The bearer token came from Math.random(), which is predictable. Use crypto.randomBytes
and write piagentui-port.json (which stores the token) with mode 0600.
GET /api/sessions (and every session lookup) re-read and JSON.parsed every
.jsonl session file synchronously on each request, blocking the agent's
event loop. Parsed metadata is now cached per path (bounded to 500 entries)
and invalidated when mtime or size changes.
Add characterization tests first, then split the hot spots into small helpers:
- STT/TTS settings updates move to extensions/piagentui-speech-settings.ts (rule tables)
- defaultExtractData is split into diff/diagnostic/output extractors
- getToolSummaryCategory becomes an ordered rule table (toolSummary.ts)
- sanitizePersistedTerminalLayoutMap is split per level
- duplicated diff stats helpers are merged into utils/diffStats.ts
- README.md rewritten from the real code: quick start, container stack with the actual image namespaces, Pages deploy, verification with the commands that ran, honest limitations
- README.pt-BR.md rewritten; the es/ja translations get a warning pointing at the canonical README
- package.json: homepage/repository point at this repository, node >=22 declared, @mariozechner/pi-coding-agent added as devDependency (extensions/piagentui-server.ts imports it)
- Cargo.toml: repository field filled
- .pi-lens/ ignored and its cached review graph removed from tracking
- three material icons replaced by their 32x32 sources (the committed 16x16 files were broken)
- backend and gateway images come from ghcr.io/evandrodevbr/opencodeui-{backend,gateway} (published)
- ghcr.io/evandrodevbr/opencodeui-frontend was never published (docker-frontend.yml failing since 2026-06-01), so the frontend keeps pulling ghcr.io/lehhair/opencodeui-frontend
- trigger on main (the default branch) instead of the non-existent dev
- VITE_BASE_PATH /OpenCodeUI/ -> /PiAgentUI/, matching the repository name
- enable Pages automatically on the first run
evandro
Evandro Fonseca Junior