@astralyn/pi 1.4.11 → 1.5.0

package/dist/core/package-manager.js

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { chmodSync, existsSync, globSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync, } from "node:fs";
+import { chmodSync, existsSync, globSync, mkdirSync, readdirSync, readFileSync, realpathSync, rmSync, statSync, writeFileSync, } from "node:fs";
 import { homedir } from "node:os";
 function getEnv() {
     if (process.platform !== "linux" || Object.keys(process.env).length > 0) {
@@ -20,18 +20,18 @@ function getEnv() {
         return process.env;
     }
 }
-import { basename, dirname, join, relative, resolve, sep } from "node:path";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import ignore from "ignore";
 import { minimatch } from "minimatch";
 import { gt, maxSatisfying, rcompare, satisfies, valid, validRange } from "semver";
 import { CONFIG_DIR_NAME } from "../config.js";
 import { spawnProcess, spawnProcessSync } from "../utils/child-process.js";
 import { parseGitUrl } from "../utils/git.js";
-import { canonicalizePath, isLocalPath, markPathIgnoredByCloudSync, normalizePath, resolvePath, } from "../utils/paths.js";
+import { canonicalizePath, getPathComparisonKey, isLocalPath, markPathIgnoredByCloudSync, normalizePath, pathsEqual, resolvePath, } from "../utils/paths.js";
 import { stripBom } from "../utils/text.js";
 import { isStdoutTakenOver } from "./output-guard.js";
 import { readPiManifest } from "./pi-manifest.js";
-import { BUILTIN_PATH_PREFIX } from "./source-info.js";
+import { BUILTIN_PATH_PREFIX, getResourcePathKey } from "./source-info.js";
 const NETWORK_TIMEOUT_MS = 10000;
 const UPDATE_CHECK_CONCURRENCY = 4;
 const GIT_UPDATE_CONCURRENCY = 4;
@@ -470,6 +470,33 @@ function collectResourceFiles(dir, resourceType) {
     }
     return collectFiles(dir, FILE_PATTERNS[resourceType]);
 }
+// A `pi` object counts as an explicit resource manifest only when it lists resources. Packages whose
+// `pi` object holds only metadata (changelogPath, gallery image/video) still use directory auto-discovery.
+function hasManifestResourceFields(manifest) {
+    return RESOURCE_TYPES.some((resourceType) => manifest[resourceType] !== undefined);
+}
+function isPathInside(parent, child) {
+    const relativePath = relative(parent, child);
+    return (relativePath !== "" && relativePath !== ".." && !relativePath.startsWith(`..${sep}`) && !isAbsolute(relativePath));
+}
+function resolvePackageChangelogPath(packageRoot, manifest) {
+    const changelogPath = manifest?.changelogPath ?? "CHANGELOG.md";
+    if (!changelogPath)
+        return undefined;
+    const resolvedPath = resolve(packageRoot, changelogPath);
+    if (!existsSync(resolvedPath))
+        return undefined;
+    const canonicalPackageRoot = canonicalizePath(packageRoot);
+    const canonicalChangelogPath = canonicalizePath(resolvedPath);
+    if (!isPathInside(canonicalPackageRoot, canonicalChangelogPath))
+        return undefined;
+    try {
+        return statSync(resolvedPath).isFile() ? resolvedPath : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 function matchesAnyPattern(filePath, patterns, baseDir) {
     const rel = toPosixPath(relative(baseDir, filePath));
     const name = basename(filePath);
@@ -708,7 +735,7 @@ export class DefaultPackageManager {
         }
         // Dedupe: project scope wins over global for same package identity
         const packageSources = this.dedupePackages(allPackages);
-        await this.resolvePackageSources(packageSources, accumulator, onMissing);
+        const installFailures = await this.resolvePackageSources(packageSources, accumulator, onMissing);
         const globalBaseDir = this.agentDir;
         const projectBaseDir = join(this.cwd, CONFIG_DIR_NAME);
         for (const resourceType of RESOURCE_TYPES) {
@@ -734,7 +761,7 @@ export class DefaultPackageManager {
             const projectEnabled = applyAutoloadDisabledPatterns([path], getOverridePatterns(projectSettings.extensions ?? []), projectBaseDir).get(path);
             this.addResource(accumulator.extensions, path, { source: "builtin", scope: projectEnabled === undefined ? "user" : "project", origin: "top-level" }, projectEnabled ?? isEnabledByOverrides(path, globalSettings.extensions ?? [], globalBaseDir));
         }
-        return this.toResolvedPaths(accumulator);
+        return { ...this.toResolvedPaths(accumulator), installFailures };
     }
     async resolveExtensionSources(sources, options) {
         const accumulator = this.createAccumulator();
@@ -746,8 +773,8 @@ export class DefaultPackageManager {
         const packageSources = sources
             .filter((source) => !source.startsWith(BUILTIN_PATH_PREFIX))
             .map((source) => ({ pkg: source, scope }));
-        await this.resolvePackageSources(packageSources, accumulator);
-        return this.toResolvedPaths(accumulator);
+        const installFailures = await this.resolvePackageSources(packageSources, accumulator);
+        return { ...this.toResolvedPaths(accumulator), installFailures };
     }
     listConfiguredPackages() {
         const globalSettings = this.settingsManager.getGlobalSettings();
@@ -870,10 +897,13 @@ export class DefaultPackageManager {
                 gitCandidates.push({ ...entry, parsed });
             }
         }
-        const npmCheckTasks = npmCandidates.map((entry) => async () => ({
-            entry,
-            shouldUpdate: await this.shouldUpdateNpmSource(entry.parsed, entry.scope),
-        }));
+        const npmCheckTasks = npmCandidates.map((entry) => async () => {
+            const check = await this.shouldUpdateNpmSource(entry.parsed, entry.scope);
+            return {
+                entry: { ...entry, installedVersion: check.installedVersion, targetVersion: check.targetVersion },
+                shouldUpdate: check.shouldUpdate,
+            };
+        });
         const npmCheckResults = await this.runWithConcurrency(npmCheckTasks, UPDATE_CHECK_CONCURRENCY);
         const userNpmUpdates = [];
         const projectNpmUpdates = [];
@@ -907,15 +937,15 @@ export class DefaultPackageManager {
         const installedPath = this.getManagedNpmInstallPath(source, scope);
         const installedVersion = existsSync(installedPath) ? this.getInstalledNpmVersion(installedPath) : undefined;
         if (!installedVersion) {
-            return true;
+            return { shouldUpdate: true };
         }
         try {
             const targetVersion = await this.getLatestNpmVersion(source.version ? source.spec : source.name, source.range);
-            return gt(targetVersion, installedVersion);
+            return { shouldUpdate: gt(targetVersion, installedVersion), installedVersion, targetVersion };
         }
         catch {
             // Preserve existing update behavior when version lookup fails.
-            return true;
+            return { shouldUpdate: true, installedVersion };
         }
     }
     async updateNpmBatch(sources, scope) {
@@ -928,6 +958,29 @@ export class DefaultPackageManager {
         await this.withProgress("update", sourceLabel, message, async () => {
             await this.installNpmBatch(specs, scope);
         });
+        this.reportUnchangedNpmUpdates(sources, scope);
+    }
+    /**
+     * npm can resolve stale registry metadata shortly after a publish and install the old
+     * version without an error. Warn when an announced update did not change the installed version.
+     */
+    reportUnchangedNpmUpdates(sources, scope) {
+        for (const entry of sources) {
+            if (!entry.installedVersion || !entry.targetVersion) {
+                continue;
+            }
+            const installedPath = this.getManagedNpmInstallPath(entry.parsed, scope);
+            const versionAfter = this.getInstalledNpmVersion(installedPath);
+            if (versionAfter !== entry.installedVersion) {
+                continue;
+            }
+            this.emitProgress({
+                type: "progress",
+                action: "update",
+                source: entry.source,
+                message: `${entry.source} is still ${versionAfter} (registry reports ${entry.targetVersion}); npm registry metadata may be stale, try again in a few minutes`,
+            });
+        }
     }
     async installNpmBatch(specs, scope) {
         const installRoot = this.getNpmInstallRoot(scope, false);
@@ -991,6 +1044,7 @@ export class DefaultPackageManager {
         return results.filter((result) => result !== undefined);
     }
     async resolvePackageSources(sources, accumulator, onMissing) {
+        const installFailures = [];
         for (const { pkg, scope } of sources) {
             const sourceStr = typeof pkg === "string" ? pkg : pkg.source;
             const filter = typeof pkg === "object" ? pkg : undefined;
@@ -1007,21 +1061,46 @@ export class DefaultPackageManager {
             const installMissing = async () => {
                 if (isOfflineModeEnabled())
                     return false;
-                if (!onMissing) {
+                if (onMissing) {
+                    const action = await onMissing(resolvedSource);
+                    if (action === "skip")
+                        return false;
+                    if (action === "error")
+                        throw new Error(`Missing source: ${resolvedSource}`);
+                }
+                // A source that cannot be installed (no network, missing package, failing git prepare step)
+                // must not abort startup. Skip its resources, like offline mode does, and report the failure.
+                try {
                     await this.installParsedSource(parsed, resolvedScope);
                     return true;
                 }
-                const action = await onMissing(resolvedSource);
-                if (action === "skip")
+                catch (error) {
+                    installFailures.push({
+                        source: resolvedSource,
+                        scope: resolvedScope,
+                        message: error instanceof Error ? error.message : String(error),
+                    });
                     return false;
-                if (action === "error")
-                    throw new Error(`Missing source: ${resolvedSource}`);
-                await this.installParsedSource(parsed, resolvedScope);
-                return true;
+                }
             };
             if (parsed.type === "npm") {
                 let installedPath = this.getNpmInstallPath(parsed, resolvedScope);
                 const needsInstall = !existsSync(installedPath) || !(await this.installedNpmMatchesConfiguredVersion(parsed, installedPath));
+                if (!needsInstall &&
+                    resolvedScope === "temporary" &&
+                    !parsed.pinned &&
+                    (await this.npmHasAvailableUpdate(parsed, installedPath))) {
+                    // Temporary (-e) sources have no `pi update` path, so refresh unpinned ones on load like
+                    // temporary git sources. Like `pi update`, install `name@latest` for unversioned specs because a bare
+                    // `npm install name` keeps the range already saved in the temporary package.json.
+                    const spec = parsed.version ? parsed.spec : `${parsed.name}@latest`;
+                    try {
+                        await this.installNpm({ ...parsed, spec }, resolvedScope, true);
+                    }
+                    catch {
+                        // Keep the cached install if the refresh fails.
+                    }
+                }
                 if (needsInstall) {
                     const installed = await installMissing();
                     if (!installed)
@@ -1040,14 +1119,15 @@ export class DefaultPackageManager {
                     if (!installed)
                         continue;
                 }
-                else if (resolvedScope === "temporary" && !parsed.pinned && !isOfflineModeEnabled()) {
-                    await this.refreshTemporaryGitSource(parsed, resolvedSource);
+                else if (resolvedScope === "temporary" && !isOfflineModeEnabled()) {
+                    await this.refreshTemporaryGitSource(parsed, resolvedSource, installedPath);
                 }
                 metadata.baseDir = installedPath;
                 metadata.packageRoot = installedPath;
                 this.collectPackageResources(installedPath, accumulator, filter, metadata);
             }
         }
+        return installFailures;
     }
     findAutoloadDeltaBase(pkg, scope, sources) {
         if (scope !== "project" || typeof pkg !== "object" || pkg.autoload !== false)
@@ -1103,7 +1183,7 @@ export class DefaultPackageManager {
         if (parsed.type === "git") {
             return `git:${parsed.host}/${parsed.path}`;
         }
-        return `local:${this.resolvePath(parsed.path)}`;
+        return `local:${getPathComparisonKey(this.resolvePath(parsed.path))}`;
     }
     getSourceMatchKeyForSettings(source, scope) {
         const parsed = this.parseSource(source);
@@ -1114,7 +1194,7 @@ export class DefaultPackageManager {
             return `git:${parsed.host}/${parsed.path}`;
         }
         const baseDir = this.getBaseDirForScope(scope);
-        return `local:${this.resolvePathFromBase(parsed.path, baseDir)}`;
+        return `local:${getPathComparisonKey(this.resolvePathFromBase(parsed.path, baseDir))}`;
     }
     buildNoMatchingPackageMessage(source, configuredPackages) {
         const suggestion = this.findSuggestedConfiguredSource(source, configuredPackages);
@@ -1393,9 +1473,9 @@ export class DefaultPackageManager {
         }
         if (scope) {
             const baseDir = this.getBaseDirForScope(scope);
-            return `local:${this.resolvePathFromBase(parsed.path, baseDir)}`;
+            return `local:${getPathComparisonKey(this.resolvePathFromBase(parsed.path, baseDir))}`;
         }
-        return `local:${this.resolvePath(parsed.path)}`;
+        return `local:${getPathComparisonKey(this.resolvePath(parsed.path))}`;
     }
     /**
      * Dedupe packages: if same package identity appears in both global and project,
@@ -1486,7 +1566,7 @@ export class DefaultPackageManager {
                     "--config.strict-dep-builds=false",
                 ];
             case "npm":
-                return ["install", "--omit=dev", "--legacy-peer-deps"];
+                return ["install", "--omit=dev", "--legacy-peer-deps", "--no-audit", "--no-fund"];
             default:
                 return ["install"];
         }
@@ -1495,7 +1575,9 @@ export class DefaultPackageManager {
         const npmCommand = this.getNpmCommand();
         return this.runCommandSync(npmCommand.command, [...npmCommand.args, ...args]);
     }
-    getNpmInstallArgs(specs, installRoot) {
+    getNpmInstallArgs(specs, root) {
+        // npm writes broken nested package-lock.json paths when --prefix goes through a symlink.
+        const installRoot = existsSync(root) ? realpathSync(root) : root;
         const packageManagerName = this.getPackageManagerName();
         // Extension packages run inside pi and resolve pi APIs through loader aliases/virtual modules.
         // Disable peer dependency resolution for managed installs (npm's --legacy-peer-deps, and
@@ -1515,7 +1597,8 @@ export class DefaultPackageManager {
                 "--config.strict-dep-builds=false",
             ];
         }
-        return ["install", ...specs, "--prefix", installRoot, "--legacy-peer-deps"];
+        // npm audit fix would run without --legacy-peer-deps and install pi peers, so skip audit advice.
+        return ["install", ...specs, "--prefix", installRoot, "--legacy-peer-deps", "--no-audit", "--no-fund"];
     }
     async installNpm(source, scope, temporary) {
         const installRoot = this.getNpmInstallRoot(scope, temporary);
@@ -1523,10 +1606,12 @@ export class DefaultPackageManager {
         await this.runNpmCommand(this.getNpmInstallArgs([source.spec], installRoot));
     }
     async uninstallNpm(source, scope) {
-        const installRoot = this.getNpmInstallRoot(scope, false);
-        if (!existsSync(installRoot)) {
+        const root = this.getNpmInstallRoot(scope, false);
+        if (!existsSync(root)) {
             return;
         }
+        // npm writes broken nested package-lock.json paths when --prefix goes through a symlink.
+        const installRoot = realpathSync(root);
         const packageManagerName = this.getPackageManagerName();
         if (packageManagerName === "bun") {
             await this.runNpmCommand(["uninstall", source.name, "--cwd", installRoot]);
@@ -1534,7 +1619,7 @@ export class DefaultPackageManager {
         }
         const args = ["uninstall", source.name, "--prefix", installRoot];
         if (packageManagerName !== "pnpm") {
-            args.push("--legacy-peer-deps");
+            args.push("--legacy-peer-deps", "--no-audit", "--no-fund");
         }
         await this.runNpmCommand(args);
     }
@@ -1616,20 +1701,31 @@ export class DefaultPackageManager {
         return join(dirname(targetDir), `.${basename(targetDir)}.pi-update-incomplete`);
     }
     async cleanAndInstallGitDependencies(targetDir, markerPath) {
-        // Clean untracked files (extensions should be pristine). If this fails after
-        // deleting dependencies, repair them so the existing extension still loads.
+        // Clean untracked files (extensions should be pristine). On Windows, files loaded by
+        // another process (e.g. a native module of this extension in another pi session) cannot
+        // be deleted, so git clean fails. Still install dependencies for the new commit, but keep
+        // the marker so the next update retries the clean.
+        let cleaned = true;
         try {
             await this.runCommand("git", ["clean", "-fdx"], { cwd: targetDir });
         }
         catch (error) {
-            await this.repairMissingGitDependencies(targetDir).catch(() => { });
-            throw error;
+            cleaned = false;
+            const reason = error instanceof Error ? error.message : String(error);
+            this.emitProgress({
+                type: "progress",
+                action: "update",
+                source: targetDir,
+                message: `Could not remove all untracked files in ${targetDir} (${reason}). Files may be in use by another pi session; close it and run the update again.`,
+            });
         }
         const packageJsonPath = join(targetDir, "package.json");
         if (existsSync(packageJsonPath)) {
             await this.runNpmCommand(this.getGitDependencyInstallArgs(), { cwd: targetDir });
         }
-        rmSync(markerPath, { force: true });
+        if (cleaned) {
+            rmSync(markerPath, { force: true });
+        }
     }
     async ensureGitRef(targetDir, fetchArgs, ref) {
         // Fetch only the ref we will reset to, avoiding unrelated branch/tag noise.
@@ -1657,11 +1753,22 @@ export class DefaultPackageManager {
         await this.runCommand("git", ["reset", "--hard", commitRef], { cwd: targetDir });
         await this.cleanAndInstallGitDependencies(targetDir, markerPath);
     }
-    async refreshTemporaryGitSource(source, sourceStr) {
+    async refreshTemporaryGitSource(source, sourceStr, installedPath) {
         if (isOfflineModeEnabled()) {
             return;
         }
         try {
+            // A ref can name a moving branch, so refresh refs too. Skip the network call only when the
+            // ref is a commit hash that is already checked out.
+            if (source.ref && /^[0-9a-f]{7,64}$/i.test(source.ref)) {
+                const head = await this.runCommandCapture("git", ["rev-parse", "HEAD"], {
+                    cwd: installedPath,
+                    timeoutMs: NETWORK_TIMEOUT_MS,
+                });
+                if (head.trim().toLowerCase().startsWith(source.ref.toLowerCase())) {
+                    return;
+                }
+            }
             await this.withProgress("pull", sourceStr, `Refreshing ${sourceStr}...`, async () => {
                 await this.updateGit(source, "temporary");
             });
@@ -1849,6 +1956,14 @@ export class DefaultPackageManager {
         return resolvePath(input, baseDir, { homeDir: getHomeDir(), trim: true });
     }
     collectPackageResources(packageRoot, accumulator, filter, metadata) {
+        const manifest = readPiManifest(join(packageRoot, "package.json"));
+        const changelogPath = resolvePackageChangelogPath(packageRoot, manifest);
+        if (changelogPath) {
+            metadata.changelogPath = changelogPath;
+        }
+        else {
+            delete metadata.changelogPath;
+        }
         if (filter) {
             for (const resourceType of RESOURCE_TYPES) {
                 const patterns = filter[resourceType];
@@ -1865,8 +1980,7 @@ export class DefaultPackageManager {
             }
             return true;
         }
-        const manifest = readPiManifest(join(packageRoot, "package.json"));
-        if (manifest) {
+        if (manifest && hasManifestResourceFields(manifest)) {
             for (const resourceType of RESOURCE_TYPES) {
                 const entries = manifest[resourceType];
                 this.addManifestEntries(entries, packageRoot, resourceType, this.getTargetMap(accumulator, resourceType), metadata);
@@ -2026,7 +2140,7 @@ export class DefaultPackageManager {
         const userAgentsSkillsDir = join(getHomeDir(), ".agents", "skills");
         const projectTrusted = this.settingsManager.isProjectTrusted();
         const projectAgentsSkillDirs = projectTrusted
-            ? collectAncestorAgentsSkillDirs(this.cwd).filter((dir) => resolve(dir) !== resolve(userAgentsSkillsDir))
+            ? collectAncestorAgentsSkillDirs(this.cwd).filter((dir) => !pathsEqual(dir, userAgentsSkillsDir))
             : [];
         const addResources = (resourceType, paths, metadata, overrides, baseDir) => {
             const target = this.getTargetMap(accumulator, resourceType);
@@ -2127,10 +2241,10 @@ export class DefaultPackageManager {
             resolved.sort((a, b) => resourcePrecedenceRank(a.metadata) - resourcePrecedenceRank(b.metadata));
             const seen = new Set();
             return resolved.filter((entry) => {
-                const canonicalPath = canonicalizePath(entry.path);
-                if (seen.has(canonicalPath))
+                const pathKey = getResourcePathKey(entry.path);
+                if (seen.has(pathKey))
                     return false;
-                seen.add(canonicalPath);
+                seen.add(pathKey);
                 return true;
             });
         };