Pi Pocket 0.22.0: Ask someone, public pages, and extension points for people's values

Pi can now hand a question to someone outside the chat and get the answer back, and extensions can ask people for values, hide them, and drive the browser.

Important

To update: pull, then restart the server. There is no migration and no new dependency. 0.22 adds a document for public links and a place for module settings in config.json; 0.21 ignores both if you go back.

Highlights

• Ask someone. Pi writes a question that a manager, client, or expert can answer without the chat, and you share it as a link that takes one answer. (Idea by Tevis.)
• Running as a systemd service. A ready unit file and a guide. (#148, by @Quintasan)

New

• Ask someone. Off until the owner turns it on in Menu → Extensions.
  • Ask someone under one of Pi's answers has Pi write the question with the background, the options, and its recommendation.
  • Nothing is sent by itself: you edit the draft in Questions for others, then copy it or create a link for a day, a week, or a month.
  • The link opens a plain page with no sign-in and takes one answer. End link takes it down at any time.
  • Give to Pi puts the answer in the message box, quoted and marked as someone else's view.
• systemd guide. contrib/systemd/pi-pocket@.service starts Pi Pocket in any access mode (pi-pocket@lan), and docs/systemd.md covers setup, sign-in, updates, and troubleshooting. (#148, by @Quintasan)

Improved

• Extension settings in the app. A module's settings show under it in Menu → Extensions, where the owner changes them; a key or token stays on the server.

• Fold linked sessions in the session list. A session that started others has a pill with how many; a tap folds them away under it, and the fold stays across reloads.

• PiP shows messages you send while it works. They appear at once, marked as waiting, with Withdraw, instead of showing nothing until it finishes.

• PiP compacts as sessions do by default. An owner who chose a limit keeps it.

Fixed

• The app icon is valid again. Its SVG had text that made it invalid XML, so browsers could refuse it as the tab, home-screen, and notification icon. (#151, by @lingmann)

Security

• Passwords stay out of descriptions. Pi's browser tool never describes a password field by its value, even when the field has no name of its own.
• Public links. /l/<token> is a new address that needs no sign-in. Its 128-bit token is the whole of its access, each link closes at its time or after its answers, and pages run in a sandbox with no script, so someone signed in who opens one lends it nothing.
• Hidden values. What extensions hide with host.hide is also hidden in files a message brings along (@file), in a session's subagents, and in PiP's tool results. A ! command that holds one is refused, since it would be stored as typed. Hiding tells whether a guess is right, so the docs say to hide only values that cannot be guessed (a password or a token, not a PIN).
• Filling a field. fill refuses a field that something covers or that the focus does not reach, so a value never lands in another field.

For theme and extension authors

• Public pages. web.publicPage and web.links show pages to anyone with a module's link, with no sign-in. See Public pages. (experimental)
• People's values and the browser. host.ask puts a question with fields on a card that only the person Pi works for answers, and its values go to the extension alone. host.hide keeps values out of command output and tool results. host.commandEnv gives commands environment variables. host.browser drives the session's page, with fill for a person's value. See People's values and the browser. With them, sign-in cards (#133), secrets (#132), and browser runs (#134) can be gallery extensions that live in their author's own repository, with no change to Pi Pocket's core. (experimental)
• Events, services, and settings. host.on hears sessions made, renamed, and archived, messages to Pi, and runs. web.provide / web.use let one module build on another. web.settings declares settings that core keeps and shows in Menu → Extensions, with secrets that never leave the server, and pocket.settings reads them in the browser. See Events, services, and settings. (experimental)
• Hooks can guard the browser. The browser tool's action and the arguments that name its target are public for hooks, so a sign-in extension can keep Pi from typing a password. (experimental)
• Tools can call a model. The tools guide shows how a tool asks the session's model, and how its cost counts toward the session's spend.
• When experimental becomes stable. API stability now says when an experimental member is ready: two modules by different authors use it, a release passes with no change, and its docs and tests are in place.
• The Extensions sheet says which modules show pages to anyone with a link, and which offer a service. Gallery entries do not declare it yet.
• Release notes now follow docs/release-notes.md. (#145)

Updating

1. Pull, or run git pull in your checkout.
2. Restart the server (Menu → Restart server).
3. To use Ask someone, turn it on in Menu → Extensions.

How this release was checked

• npm run check, npm run lint, Prettier, the docs-site build, and npm test: 595 pass (one artifact UI test that this release does not touch timed out once under load and passed alone). 31 tests are in new files (public-links, extension-points, extension-ecosystem, session-tree), and others are added to existing files, some in a real browser (folds, PiP's waiting messages).

• A separate security review of public links found no high-severity issue. Its three medium findings are fixed: a form that arrives while its module is turned off, a refund lost when other links are made, and no limit on page handlers running at once.

• Three rounds of review by subagents (public links, people's values, the extension ecosystem, the UI, and docs against types) found 3 high and 14 medium issues. All are fixed in code, most with a test that fails without the fix, except one: that hiding tells whether a guess is right, which the docs now say. Among them:

  • a secret setting's default reached browsers;
  • setting switches stored a click event;
  • folding linked sessions did not redraw the list;
  • a peek tile offered Allow on an extension's question;
  • a page handler that never answered held its place;
  • Ask someone's notices reached other sessions and other people.

• A final review by four more reviewers (security, server, browser code, and an extension author who built #132, #133, and #134 from the docs alone) passed. Their low findings are fixed, and the author's four doc gaps too: the browser tool's action and target arguments are now public for hooks (experimental), and the tools guide shows how to call a model.

• Four testers then used the release on copies of their own, and all passed:

  • the UI at desktop and phone sizes: folds, PiP, settings, Ask someone, and ask cards, also as a guest;
  • an extension author's secrets, sign-in, and browser-run modules, with reloads, restarts, and a module that fails;
  • public pages as a stranger and an attacker, in 85 checks;
  • an upgrade from 0.21 and a downgrade back, on the same data.

  Their three low bugs are fixed, each with a test: a settings range no value fits, a secret on a setting that is not text, and a form that arrived too slowly got an empty reply instead of a page.

• One known limit is left as it is: when Lancet Guard allowed a call and the extension then asks a question in it, the call shows only the answer, not the guard's decision.

• The systemd guide was corrected before merging: the launcher has no tailscale-serve mode.

• Not tested: the systemd unit on a real machine (only systemd-analyze verify, by its author), and public pages behind a Cloudflare or Tailscale address.

Thanks to Tevis for the Ask someone idea, @Quintasan for the systemd unit and guide, and @lingmann for the icon fix.

Full changes: v0.21.0...release/0.22.0