@amodalai/runtime 0.3.49 → 0.3.51

package/dist/src/agent/propose-plan.integration.test.js

@@ -0,0 +1,186 @@
+/**
+ * @license
+ * Copyright 2026 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+/**
+ * Phase D integration test for `propose_plan` + `update_plan`. Pins
+ * the agent-admin handlers end-to-end through the actual runtime
+ * path: LocalToolExecutor compiles handler.ts via esbuild,
+ * dynamic-imports the resulting .mjs, and runs each with a
+ * CustomToolContext whose `emit` callback captures SSE events the
+ * way the runtime's executing state would.
+ *
+ * Skips when the agent-admin cache (~/.amodal/admin-agent/latest/)
+ * isn't populated.
+ */
+import { existsSync } from 'node:fs';
+import { homedir } from 'node:os';
+import * as path from 'node:path';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { LocalToolExecutor } from './tool-executor-local.js';
+const ADMIN_AGENT_PATH = path.join(homedir(), '.amodal', 'admin-agent', 'latest');
+const PROPOSE_HANDLER = path.join(ADMIN_AGENT_PATH, 'tools', 'propose_plan', 'handler.ts');
+const UPDATE_HANDLER = path.join(ADMIN_AGENT_PATH, 'tools', 'update_plan', 'handler.ts');
+const HAS_DEPS = existsSync(PROPOSE_HANDLER) && existsSync(UPDATE_HANDLER);
+const describeWhenReady = HAS_DEPS ? describe : describe.skip;
+describeWhenReady('propose_plan + update_plan (Phase D integration)', () => {
+    let executor;
+    let emitted;
+    beforeEach(() => {
+        executor = new LocalToolExecutor();
+        emitted = [];
+    });
+    afterEach(() => {
+        executor.dispose();
+    });
+    function loadedTool(handlerPath, name) {
+        return {
+            name,
+            description: `${name} test`,
+            parameters: {},
+            confirm: false,
+            timeout: 5_000,
+            env: [],
+            handlerPath,
+            location: path.dirname(handlerPath),
+            hasPackageJson: false,
+            hasSetupScript: false,
+            hasRequirementsTxt: false,
+            hasDockerfile: false,
+            sandboxLanguage: 'typescript',
+        };
+    }
+    function buildCtx() {
+        return {
+            async request() {
+                throw new Error('not used');
+            },
+            async exec() {
+                throw new Error('not used');
+            },
+            async store() {
+                throw new Error('not used');
+            },
+            env: () => undefined,
+            log: () => undefined,
+            signal: AbortSignal.timeout(30_000),
+            sessionId: 'sess_test',
+            emit: (event) => {
+                emitted.push(event);
+            },
+        };
+    }
+    it('propose_plan emits a proposal SSE event with the right shape', async () => {
+        const result = await executor.execute(loadedTool(PROPOSE_HANDLER, 'propose_plan'), {
+            summary: 'Plumbing scheduler + reminders',
+            skills: [{ label: 'Job Scheduler', description: 'Daily schedule via chat' }],
+            requiredConnections: [{ label: 'Twilio', description: 'SMS reminders' }],
+            optionalConnections: [{ label: 'Google Calendar', description: 'Sync' }],
+        }, buildCtx());
+        expect(result).toMatchObject({ ok: true });
+        expect(emitted).toHaveLength(1);
+        const event = emitted[0];
+        expect(event.type).toBe('proposal');
+        if (event.type !== 'proposal')
+            throw new Error('unreachable');
+        expect(event.summary).toBe('Plumbing scheduler + reminders');
+        expect(event.skills[0]).toEqual({ label: 'Job Scheduler', description: 'Daily schedule via chat' });
+        expect(event.required_connections[0]?.label).toBe('Twilio');
+        expect(event.optional_connections[0]?.label).toBe('Google Calendar');
+        expect(event.proposal_id).toMatch(/^proposal_/);
+    });
+    it('propose_plan rejects empty summary with reason: invalid_params', async () => {
+        const result = await executor.execute(loadedTool(PROPOSE_HANDLER, 'propose_plan'), {
+            summary: '',
+            skills: [],
+            requiredConnections: [],
+            optionalConnections: [],
+        }, buildCtx());
+        expect(result).toMatchObject({ ok: false, reason: 'invalid_params' });
+        expect(emitted).toHaveLength(0);
+    });
+    it('propose_plan rejects malformed skill entries', async () => {
+        const result = await executor.execute(loadedTool(PROPOSE_HANDLER, 'propose_plan'), {
+            summary: 'x',
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any -- intentional bad input
+            skills: [{ label: 'No description' }],
+            requiredConnections: [],
+            optionalConnections: [],
+        }, buildCtx());
+        expect(result).toMatchObject({ ok: false, reason: 'invalid_params' });
+        expect(emitted).toHaveLength(0);
+    });
+    it('propose_plan returns no_emit when ctx.emit is absent', async () => {
+        const ctxNoEmit = buildCtx();
+        delete ctxNoEmit.emit;
+        const result = await executor.execute(loadedTool(PROPOSE_HANDLER, 'propose_plan'), {
+            summary: 'x',
+            skills: [],
+            requiredConnections: [],
+            optionalConnections: [],
+        }, ctxNoEmit);
+        expect(result).toMatchObject({ ok: false, reason: 'no_emit' });
+    });
+    it('update_plan emits an update_plan SSE event with only the patched fields', async () => {
+        const result = await executor.execute(loadedTool(UPDATE_HANDLER, 'update_plan'), {
+            proposalId: 'proposal_abc',
+            optionalConnections: [{ label: 'QuickBooks', description: 'Invoicing' }],
+        }, buildCtx());
+        expect(result).toMatchObject({ ok: true, proposalId: 'proposal_abc' });
+        expect(emitted).toHaveLength(1);
+        const event = emitted[0];
+        expect(event.type).toBe('update_plan');
+        if (event.type !== 'update_plan')
+            throw new Error('unreachable');
+        expect(event.proposal_id).toBe('proposal_abc');
+        // Only patched fields are emitted; unspecified ones must be omitted
+        // so the widget reducer leaves them untouched.
+        expect(event.optional_connections).toEqual([{ label: 'QuickBooks', description: 'Invoicing' }]);
+        expect(event.skills).toBeUndefined();
+        expect(event.required_connections).toBeUndefined();
+        expect(event.summary).toBeUndefined();
+    });
+    it('update_plan rejects empty proposalId', async () => {
+        const result = await executor.execute(loadedTool(UPDATE_HANDLER, 'update_plan'), { proposalId: '' }, buildCtx());
+        expect(result).toMatchObject({ ok: false, reason: 'invalid_params' });
+    });
+    it('update_plan accepts an empty array to clear a list', async () => {
+        const result = await executor.execute(loadedTool(UPDATE_HANDLER, 'update_plan'), { proposalId: 'p1', optionalConnections: [] }, buildCtx());
+        expect(result).toMatchObject({ ok: true });
+        const event = emitted[0];
+        if (event.type !== 'update_plan')
+            throw new Error('unreachable');
+        expect(event.optional_connections).toEqual([]);
+    });
+    it('propose_plan generates unique proposalIds across calls', async () => {
+        // Force time progression between calls so the suffix differs.
+        const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+        const r1 = await executor.execute(loadedTool(PROPOSE_HANDLER, 'propose_plan'), {
+            summary: 'a',
+            skills: [],
+            requiredConnections: [],
+            optionalConnections: [],
+        }, buildCtx());
+        await sleep(5);
+        const r2 = await executor.execute(loadedTool(PROPOSE_HANDLER, 'propose_plan'), {
+            summary: 'b',
+            skills: [],
+            requiredConnections: [],
+            optionalConnections: [],
+        }, buildCtx());
+        const id1 = r1.proposalId;
+        const id2 = r2.proposalId;
+        expect(id1).not.toBe(id2);
+    });
+    it('update_plan returns no_emit when ctx.emit is absent', async () => {
+        const ctxNoEmit = buildCtx();
+        delete ctxNoEmit.emit;
+        const result = await executor.execute(loadedTool(UPDATE_HANDLER, 'update_plan'), { proposalId: 'p1' }, ctxNoEmit);
+        expect(result).toMatchObject({ ok: false, reason: 'no_emit' });
+    });
+});
+// vi import is intentionally retained even when unused by individual cases:
+// vitest's mock factory may be needed in the future for ctx variations.
+void vi;
+//# sourceMappingURL=propose-plan.integration.test.js.map

package/dist/src/agent/propose-plan.integration.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"propose-plan.integration.test.js","sourceRoot":"","sources":["../../../src/agent/propose-plan.integration.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;;;;;;GAUG;AAEH,OAAO,EAAC,UAAU,EAAC,MAAM,SAAS,CAAC;AACnC,OAAO,EAAC,OAAO,EAAC,MAAM,SAAS,CAAC;AAChC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAC,MAAM,QAAQ,CAAC;AAIvE,OAAO,EAAC,iBAAiB,EAAC,MAAM,0BAA0B,CAAC;AAE3D,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;AAClF,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,OAAO,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC;AAC3F,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC;AAEzF,MAAM,QAAQ,GAAG,UAAU,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,cAAc,CAAC,CAAC;AAC3E,MAAM,iBAAiB,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;AAE9D,iBAAiB,CAAC,kDAAkD,EAAE,GAAG,EAAE;IACzE,IAAI,QAA2B,CAAC;IAChC,IAAI,OAAgC,CAAC;IAErC,UAAU,CAAC,GAAG,EAAE;QACd,QAAQ,GAAG,IAAI,iBAAiB,EAAE,CAAC;QACnC,OAAO,GAAG,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,QAAQ,CAAC,OAAO,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,SAAS,UAAU,CAAC,WAAmB,EAAE,IAAY;QACnD,OAAO;YACL,IAAI;YACJ,WAAW,EAAE,GAAG,IAAI,OAAO;YAC3B,UAAU,EAAE,EAAE;YACd,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,KAAK;YACd,GAAG,EAAE,EAAE;YACP,WAAW;YACX,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;YACnC,cAAc,EAAE,KAAK;YACrB,cAAc,EAAE,KAAK;YACrB,kBAAkB,EAAE,KAAK;YACzB,aAAa,EAAE,KAAK;YACpB,eAAe,EAAE,YAAY;SAC9B,CAAC;IACJ,CAAC;IAED,SAAS,QAAQ;QACf,OAAO;YACL,KAAK,CAAC,OAAO;gBACX,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC;YAC9B,CAAC;YACD,KAAK,CAAC,IAAI;gBACR,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC;YAC9B,CAAC;YACD,KAAK,CAAC,KAAK;gBACT,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC;YAC9B,CAAC;YACD,GAAG,EAAE,GAAG,EAAE,CAAC,SAAS;YACpB,GAAG,EAAE,GAAG,EAAE,CAAC,SAAS;YACpB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;YACnC,SAAS,EAAE,WAAW;YACtB,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE;gBACd,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;SACF,CAAC;IACJ,CAAC;IAED,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CACnC,UAAU,CAAC,eAAe,EAAE,cAAc,CAAC,EAC3C;YACE,OAAO,EAAE,gCAAgC;YACzC,MAAM,EAAE,CAAC,EAAC,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,yBAAyB,EAAC,CAAC;YAC1E,mBAAmB,EAAE,CAAC,EAAC,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,EAAC,CAAC;YACtE,mBAAmB,EAAE,CAAC,EAAC,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,EAAC,CAAC;SACvE,EACD,QAAQ,EAAE,CACX,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC,EAAC,EAAE,EAAE,IAAI,EAAC,CAAC,CAAC;QACzC,MAAM,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACpC,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;QAC9D,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QAC7D,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAC,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,yBAAyB,EAAC,CAAC,CAAC;QAClG,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5D,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACrE,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CACnC,UAAU,CAAC,eAAe,EAAE,cAAc,CAAC,EAC3C;YACE,OAAO,EAAE,EAAE;YACX,MAAM,EAAE,EAAE;YACV,mBAAmB,EAAE,EAAE;YACvB,mBAAmB,EAAE,EAAE;SACxB,EACD,QAAQ,EAAE,CACX,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC,EAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAC,CAAC,CAAC;QACpE,MAAM,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CACnC,UAAU,CAAC,eAAe,EAAE,cAAc,CAAC,EAC3C;YACE,OAAO,EAAE,GAAG;YACZ,uFAAuF;YACvF,MAAM,EAAE,CAAC,EAAC,KAAK,EAAE,gBAAgB,EAAC,CAAQ;YAC1C,mBAAmB,EAAE,EAAE;YACvB,mBAAmB,EAAE,EAAE;SACxB,EACD,QAAQ,EAAE,CACX,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC,EAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAC,CAAC,CAAC;QACpE,MAAM,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,SAAS,GAAsB,QAAQ,EAAE,CAAC;QAChD,OAAQ,SAA8B,CAAC,IAAI,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CACnC,UAAU,CAAC,eAAe,EAAE,cAAc,CAAC,EAC3C;YACE,OAAO,EAAE,GAAG;YACZ,MAAM,EAAE,EAAE;YACV,mBAAmB,EAAE,EAAE;YACvB,mBAAmB,EAAE,EAAE;SACxB,EACD,SAAS,CACV,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC,EAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAC,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CACnC,UAAU,CAAC,cAAc,EAAE,aAAa,CAAC,EACzC;YACE,UAAU,EAAE,cAAc;YAC1B,mBAAmB,EAAE,CAAC,EAAC,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAC,CAAC;SACvE,EACD,QAAQ,EAAE,CACX,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC,EAAC,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,cAAc,EAAC,CAAC,CAAC;QACrE,MAAM,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACvC,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa;YAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;QACjE,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC/C,oEAAoE;QACpE,+CAA+C;QAC/C,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC,CAAC,EAAC,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAC,CAAC,CAAC,CAAC;QAC9F,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC;QACrC,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,aAAa,EAAE,CAAC;QACnD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CACnC,UAAU,CAAC,cAAc,EAAE,aAAa,CAAC,EACzC,EAAC,UAAU,EAAE,EAAE,EAAC,EAChB,QAAQ,EAAE,CACX,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC,EAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAC,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CACnC,UAAU,CAAC,cAAc,EAAE,aAAa,CAAC,EACzC,EAAC,UAAU,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,EAAC,EAC3C,QAAQ,EAAE,CACX,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC,EAAC,EAAE,EAAE,IAAI,EAAC,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa;YAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;QACjE,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,8DAA8D;QAC9D,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACpE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,OAAO,CAC/B,UAAU,CAAC,eAAe,EAAE,cAAc,CAAC,EAC3C;YACE,OAAO,EAAE,GAAG;YACZ,MAAM,EAAE,EAAE;YACV,mBAAmB,EAAE,EAAE;YACvB,mBAAmB,EAAE,EAAE;SACxB,EACD,QAAQ,EAAE,CACX,CAAC;QACF,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC;QACf,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,OAAO,CAC/B,UAAU,CAAC,eAAe,EAAE,cAAc,CAAC,EAC3C;YACE,OAAO,EAAE,GAAG;YACZ,MAAM,EAAE,EAAE;YACV,mBAAmB,EAAE,EAAE;YACvB,mBAAmB,EAAE,EAAE;SACxB,EACD,QAAQ,EAAE,CACX,CAAC;QAGF,MAAM,GAAG,GAAI,EAA2B,CAAC,UAAU,CAAC;QAEpD,MAAM,GAAG,GAAI,EAA2B,CAAC,UAAU,CAAC;QACpD,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,SAAS,GAAsB,QAAQ,EAAE,CAAC;QAChD,OAAQ,SAA8B,CAAC,IAAI,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CACnC,UAAU,CAAC,cAAc,EAAE,aAAa,CAAC,EACzC,EAAC,UAAU,EAAE,IAAI,EAAC,EAClB,SAAS,CACV,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC,EAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAC,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,4EAA4E;AAC5E,wEAAwE;AAExE,KAAK,EAAE,CAAC"}

package/dist/src/agent/routes/package-updates.d.ts

@@ -0,0 +1,42 @@
+/**
+ * @license
+ * Copyright 2026 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+/**
+ * GET /api/package-updates — checks every entry in `amodal.json#packages`
+ * for a newer published npm version and returns the diff. Cached in-memory
+ * for 1 day so refreshing the home screen doesn't hammer the registry.
+ *
+ * POST /api/package-updates/install — runs `npm install <pkg>@latest` in
+ * the repo root, then invalidates the cache so the next GET reflects the
+ * new state.
+ */
+import { type Router } from 'express';
+import type { Logger } from '../../logger.js';
+export interface PackageUpdate {
+    /** Package name, e.g. "@amodalai/connection-slack". */
+    name: string;
+    /** Currently installed version (from node_modules/<pkg>/package.json). */
+    installed: string | null;
+    /** Latest version published to npm. Null if the registry call failed. */
+    latest: string | null;
+    /** True when latest > installed (string compare on semver-like values). */
+    hasUpdate: boolean;
+}
+interface RouterDeps {
+    /** Repo root used to resolve `amodal.json` and `node_modules/<pkg>`. */
+    repoPath: string;
+    logger: Logger;
+}
+export declare function createPackageUpdatesRouter(deps: RouterDeps): Router;
+declare function readAmodalPackages(repoPath: string): string[];
+declare function readInstalledVersion(repoPath: string, name: string): string | null;
+/**
+ * Loose semver compare: split on dots, compare numerically when possible.
+ * Returns negative when a < b, positive when a > b, 0 when equal. Tags like
+ * "1.2.0-beta.1" sort by lexical order on the tail — good enough for "is
+ * there an update available?".
+ */
+export declare function compareVersions(a: string, b: string): number;
+export { readAmodalPackages, readInstalledVersion };

package/dist/src/agent/routes/package-updates.js

@@ -0,0 +1,207 @@
+/**
+ * @license
+ * Copyright 2026 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+/**
+ * GET /api/package-updates — checks every entry in `amodal.json#packages`
+ * for a newer published npm version and returns the diff. Cached in-memory
+ * for 1 day so refreshing the home screen doesn't hammer the registry.
+ *
+ * POST /api/package-updates/install — runs `npm install <pkg>@latest` in
+ * the repo root, then invalidates the cache so the next GET reflects the
+ * new state.
+ */
+import express, {} from 'express';
+import { execFile } from 'node:child_process';
+import { readFileSync, existsSync } from 'node:fs';
+import { promisify } from 'node:util';
+import * as path from 'node:path';
+const execFileAsync = promisify(execFile);
+const CACHE_TTL_MS = 24 * 60 * 60 * 1000; // 1 day
+const NPM_VIEW_TIMEOUT_MS = 10_000;
+const NPM_INSTALL_TIMEOUT_MS = 120_000;
+const PACKAGE_NAME_REGEX = /^(?:@[a-z0-9-]+\/)?[a-z0-9][a-z0-9._-]*$/;
+/**
+ * Resolve a path beneath `<repoPath>/node_modules` and verify the
+ * result stays inside that base. Returns null on traversal attempts
+ * (symlinks, double-resolved paths, etc.). The regex above already
+ * blocks `/` outside the scope segment, but CodeQL flags any flow
+ * from user input into a path expression — this is the belt and
+ * suspenders.
+ */
+function safeNodeModulesPath(repoPath, name, ...rest) {
+    const base = path.resolve(repoPath, 'node_modules');
+    const candidate = path.resolve(base, name, ...rest);
+    if (candidate !== base && !candidate.startsWith(base + path.sep))
+        return null;
+    return candidate;
+}
+export function createPackageUpdatesRouter(deps) {
+    const router = express.Router();
+    const cache = { payload: null };
+    router.get('/api/package-updates', (_req, res) => {
+        void (async () => {
+            try {
+                const fresh = cache.payload && Date.now() - cache.payload.checkedAt < CACHE_TTL_MS;
+                if (!fresh) {
+                    cache.payload = await refreshUpdates(deps);
+                }
+                res.json(cache.payload);
+            }
+            catch (err) {
+                deps.logger.warn('package_updates_failed', { error: err instanceof Error ? err.message : String(err) });
+                res.status(500).json({ error: 'package_updates_failed' });
+            }
+        })();
+    });
+    // Read the installed card.json for a single package — drives the
+    // "See what changed" page so it can show the user what they have today
+    // before they hit Update.
+    router.get('/api/package-card', (req, res) => {
+        void (async () => {
+            const name = typeof req.query['name'] === 'string' ? req.query['name'] : '';
+            if (!PACKAGE_NAME_REGEX.test(name)) {
+                res.status(400).json({ error: 'invalid_package_name' });
+                return;
+            }
+            // Allowlist gate: only read card.json for packages declared in
+            // amodal.json#packages. Belt to safeNodeModulesPath's suspenders —
+            // the regex above already blocks traversal characters, but explicit
+            // allowlisting tells static analyzers (CodeQL) that the eventual
+            // path expression depends on a sanitized value, not raw user input.
+            const declared = new Set(readAmodalPackages(deps.repoPath));
+            if (!declared.has(name)) {
+                res.status(404).json({ error: 'card_not_found' });
+                return;
+            }
+            const cardPath = safeNodeModulesPath(deps.repoPath, name, 'card', 'card.json');
+            if (cardPath === null || !existsSync(cardPath)) {
+                res.status(404).json({ error: 'card_not_found' });
+                return;
+            }
+            try {
+                const raw = readFileSync(cardPath, 'utf-8');
+                res.type('application/json').send(raw);
+            }
+            catch (err) {
+                deps.logger.warn('package_card_read_failed', { name, error: err instanceof Error ? err.message : String(err) });
+                res.status(500).json({ error: 'card_read_failed' });
+            }
+        })();
+    });
+    router.post('/api/package-updates/install', express.json({ limit: '8kb' }), (req, res) => {
+        void (async () => {
+            // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- parsing JSON body at module boundary
+            const body = req.body;
+            const name = body.name;
+            if (typeof name !== 'string' || !PACKAGE_NAME_REGEX.test(name)) {
+                res.status(400).json({ error: 'invalid_package_name' });
+                return;
+            }
+            try {
+                await execFileAsync('npm', ['install', `${name}@latest`], {
+                    cwd: deps.repoPath,
+                    timeout: NPM_INSTALL_TIMEOUT_MS,
+                });
+                cache.payload = null; // force refresh on next GET
+                res.json({ ok: true, name });
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : String(err);
+                deps.logger.warn('package_install_failed', { name, error: message });
+                res.status(500).json({ error: 'install_failed', message });
+            }
+        })();
+    });
+    return router;
+}
+// ---------------------------------------------------------------------------
+// Refresh logic
+// ---------------------------------------------------------------------------
+async function refreshUpdates(deps) {
+    const { repoPath, logger } = deps;
+    const installedNames = readAmodalPackages(repoPath);
+    if (installedNames.length === 0) {
+        return { updates: [], checkedAt: Date.now() };
+    }
+    const updates = await Promise.all(installedNames.map(async (name) => {
+        const installed = readInstalledVersion(repoPath, name);
+        const latest = await fetchLatestVersion(name, logger);
+        const hasUpdate = installed !== null && latest !== null && compareVersions(installed, latest) < 0;
+        return { name, installed, latest, hasUpdate };
+    }));
+    return { updates, checkedAt: Date.now() };
+}
+function readAmodalPackages(repoPath) {
+    const configPath = path.join(repoPath, 'amodal.json');
+    if (!existsSync(configPath))
+        return [];
+    try {
+        const raw = JSON.parse(readFileSync(configPath, 'utf-8'));
+        if (typeof raw !== 'object' || raw === null)
+            return [];
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- guarded above
+        const packagesRaw = raw['packages'];
+        if (!Array.isArray(packagesRaw))
+            return [];
+        return packagesRaw.filter((n) => typeof n === 'string' && PACKAGE_NAME_REGEX.test(n));
+    }
+    catch {
+        return [];
+    }
+}
+function readInstalledVersion(repoPath, name) {
+    const pkgPath = safeNodeModulesPath(repoPath, name, 'package.json');
+    if (pkgPath === null || !existsSync(pkgPath))
+        return null;
+    try {
+        const raw = JSON.parse(readFileSync(pkgPath, 'utf-8'));
+        if (typeof raw !== 'object' || raw === null)
+            return null;
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- guarded above
+        const version = raw['version'];
+        return typeof version === 'string' ? version : null;
+    }
+    catch {
+        return null;
+    }
+}
+async function fetchLatestVersion(name, logger) {
+    try {
+        const { stdout } = await execFileAsync('npm', ['view', name, 'version'], {
+            timeout: NPM_VIEW_TIMEOUT_MS,
+        });
+        const version = stdout.trim();
+        return version === '' ? null : version;
+    }
+    catch (err) {
+        logger.debug('npm_view_failed', { name, error: err instanceof Error ? err.message : String(err) });
+        return null;
+    }
+}
+/**
+ * Loose semver compare: split on dots, compare numerically when possible.
+ * Returns negative when a < b, positive when a > b, 0 when equal. Tags like
+ * "1.2.0-beta.1" sort by lexical order on the tail — good enough for "is
+ * there an update available?".
+ */
+export function compareVersions(a, b) {
+    const partsA = a.split('.');
+    const partsB = b.split('.');
+    const len = Math.max(partsA.length, partsB.length);
+    for (let i = 0; i < len; i++) {
+        const av = partsA[i] ?? '0';
+        const bv = partsB[i] ?? '0';
+        const an = Number.parseInt(av, 10);
+        const bn = Number.parseInt(bv, 10);
+        if (!Number.isNaN(an) && !Number.isNaN(bn) && an !== bn)
+            return an - bn;
+        if (av !== bv)
+            return av < bv ? -1 : 1;
+    }
+    return 0;
+}
+// Re-export for unit test access without going through the router.
+export { readAmodalPackages, readInstalledVersion };
+//# sourceMappingURL=package-updates.js.map

package/dist/src/agent/routes/package-updates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-updates.js","sourceRoot":"","sources":["../../../../src/agent/routes/package-updates.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;;;;GAQG;AAEH,OAAO,OAAO,EAAE,EAA0C,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAC,QAAQ,EAAC,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAC,YAAY,EAAE,UAAU,EAAC,MAAM,SAAS,CAAC;AACjD,OAAO,EAAC,SAAS,EAAC,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,QAAQ;AAClD,MAAM,mBAAmB,GAAG,MAAM,CAAC;AACnC,MAAM,sBAAsB,GAAG,OAAO,CAAC;AACvC,MAAM,kBAAkB,GAAG,0CAA0C,CAAC;AAEtE;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAAC,QAAgB,EAAE,IAAY,EAAE,GAAG,IAAc;IAC5E,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC;IACpD,IAAI,SAAS,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9E,OAAO,SAAS,CAAC;AACnB,CAAC;AAyBD,MAAM,UAAU,0BAA0B,CAAC,IAAgB;IACzD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAChC,MAAM,KAAK,GAAqC,EAAC,OAAO,EAAE,IAAI,EAAC,CAAC;IAEhE,MAAM,CAAC,GAAG,CAAC,sBAAsB,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QAClE,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,GAAG,YAAY,CAAC;gBACnF,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,KAAK,CAAC,OAAO,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;gBAC7C,CAAC;gBACD,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC1B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAC,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAC,CAAC,CAAC;gBACtG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,KAAK,EAAE,wBAAwB,EAAC,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,iEAAiE;IACjE,uEAAuE;IACvE,0BAA0B;IAC1B,MAAM,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAC9D,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,KAAK,EAAE,sBAAsB,EAAC,CAAC,CAAC;gBACtD,OAAO;YACT,CAAC;YACD,+DAA+D;YAC/D,mEAAmE;YACnE,oEAAoE;YACpE,iEAAiE;YACjE,oEAAoE;YACpE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC5D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,KAAK,EAAE,gBAAgB,EAAC,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;YACD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;YAC/E,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC/C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,KAAK,EAAE,gBAAgB,EAAC,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBAC5C,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAC,IAAI,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAC,CAAC,CAAC;gBAC9G,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,KAAK,EAAE,kBAAkB,EAAC,CAAC,CAAC;YACpD,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,OAAO,CAAC,IAAI,CAAC,EAAC,KAAK,EAAE,KAAK,EAAC,CAAC,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QACxG,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,+GAA+G;YAC/G,MAAM,IAAI,GAAG,GAAG,CAAC,IAAwB,CAAC;YAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;YACvB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,KAAK,EAAE,sBAAsB,EAAC,CAAC,CAAC;gBACtD,OAAO;YACT,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,GAAG,IAAI,SAAS,CAAC,EAAE;oBACxD,GAAG,EAAE,IAAI,CAAC,QAAQ;oBAClB,OAAO,EAAE,sBAAsB;iBAChC,CAAC,CAAC;gBACH,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,4BAA4B;gBAClD,GAAG,CAAC,IAAI,CAAC,EAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAC,CAAC,CAAC;YAC7B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACjE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAC,CAAC,CAAC;gBACnE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAC,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,KAAK,UAAU,cAAc,CAAC,IAAgB;IAC5C,MAAM,EAAC,QAAQ,EAAE,MAAM,EAAC,GAAG,IAAI,CAAC;IAChC,MAAM,cAAc,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,EAAC,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAC,CAAC;IAC9C,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAA0B,EAAE;QACxD,MAAM,SAAS,GAAG,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,SAAS,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI,IAAI,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QAClG,OAAO,EAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAC,CAAC;IAC9C,CAAC,CAAC,CACH,CAAC;IAEF,OAAO,EAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAC,CAAC;AAC1C,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IACtD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;QACnE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,EAAE,CAAC;QACvD,wFAAwF;QACxF,MAAM,WAAW,GAAI,GAA+B,CAAC,UAAU,CAAC,CAAC;QACjE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC;YAAE,OAAO,EAAE,CAAC;QAC3C,OAAO,WAAW,CAAC,MAAM,CACvB,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CACxE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAgB,EAAE,IAAY;IAC1D,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;IACpE,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,GAAG,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAChE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACzD,wFAAwF;QACxF,MAAM,OAAO,GAAI,GAA+B,CAAC,SAAS,CAAC,CAAC;QAC5D,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,IAAY,EAAE,MAAc;IAC5D,IAAI,CAAC;QACH,MAAM,EAAC,MAAM,EAAC,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE;YACrE,OAAO,EAAE,mBAAmB;SAC7B,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9B,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAC,IAAI,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAC,CAAC,CAAC;QACjG,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,CAAS,EAAE,CAAS;IAClD,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACnD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;QAC5B,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;QAC5B,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACnC,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,EAAE,GAAG,EAAE,CAAC;QACxE,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,mEAAmE;AACnE,OAAO,EAAC,kBAAkB,EAAE,oBAAoB,EAAC,CAAC"}

package/dist/src/agent/routes/package-updates.test.d.ts

@@ -0,0 +1,6 @@
+/**
+ * @license
+ * Copyright 2026 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+export {};

package/dist/src/agent/routes/package-updates.test.js

@@ -0,0 +1,25 @@
+/**
+ * @license
+ * Copyright 2026 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+import { describe, it, expect } from 'vitest';
+import { compareVersions } from './package-updates.js';
+describe('compareVersions', () => {
+    it('orders patch bumps numerically, not lexically', () => {
+        expect(compareVersions('1.2.10', '1.2.9')).toBeGreaterThan(0);
+        expect(compareVersions('1.2.9', '1.2.10')).toBeLessThan(0);
+    });
+    it('treats missing components as zero', () => {
+        expect(compareVersions('1.2', '1.2.0')).toBe(0);
+        expect(compareVersions('1.2', '1.2.1')).toBeLessThan(0);
+    });
+    it('returns 0 for identical versions', () => {
+        expect(compareVersions('0.3.40', '0.3.40')).toBe(0);
+    });
+    it('orders prereleases lexically on the tail', () => {
+        expect(compareVersions('1.0.0-beta.1', '1.0.0-beta.2')).toBeLessThan(0);
+        expect(compareVersions('1.0.0-beta.10', '1.0.0-beta.9')).toBeGreaterThan(0);
+    });
+});
+//# sourceMappingURL=package-updates.test.js.map

package/dist/src/agent/routes/package-updates.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-updates.test.js","sourceRoot":"","sources":["../../../../src/agent/routes/package-updates.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAC,MAAM,QAAQ,CAAC;AAC5C,OAAO,EAAC,eAAe,EAAC,MAAM,sBAAsB,CAAC;AAErD,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,CAAC,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAC9D,MAAM,CAAC,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChD,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,CAAC,eAAe,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACxE,MAAM,CAAC,eAAe,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/src/agent/setup-state.integration.test.d.ts

@@ -0,0 +1,6 @@
+/**
+ * @license
+ * Copyright 2026 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+export {};