@danypops/pi-packed 0.19.12 → 0.20.1

package/service/src/daemon/service.ts

@@ -5,8 +5,11 @@
  */
 
 import { existsSync as fileExistsSync } from "node:fs";
+import { VehicleRegistry } from "@danypops/vehicle-server";
+import { createVehicleHttpApp } from "@danypops/vehicle-server/http";
 import { errorResponse, healthResponse, jsonResponse, readyResponse, requireBearerToken } from "@danypops/vehicle-server/rpc-http";
 import type { ServiceSpec } from "@danypops/vehicle-server/service";
+import { registerPackedVehicleOperations } from "./vehicle-registration.ts";
 import { type AdvisoryReport, resolveInstalledVersions, scanInstalledPackages } from "../adoption/advisories.ts";
 import { type CheckReport, type PackageChecker, StaticPackageChecker } from "../adoption/check.ts";
 import { type DoctorReport, runDoctor } from "../adoption/doctor.ts";
@@ -42,7 +45,7 @@ import { SEARCH_DEFAULT_LIMIT, SEARCH_MAX_LIMIT } from "../shared/constants.ts";
 import { createLogger } from "../shared/log.ts";
 import { VERSION } from "../shared/version.ts";
 import { formatCleanupSummary, runCleanup } from "./cleanup.ts";
-import { type DaemonServiceInstaller, RealDaemonServiceInstaller } from "./daemon-service.ts";
+import { type DaemonServiceInstaller, type ReconcileAllResult, reconcileAllDaemonServices, RealDaemonServiceInstaller } from "./daemon-service.ts";
 import { checkUpdates, loadUpdates } from "./watcher.ts";
 
 const log = createLogger("service");
@@ -90,6 +93,7 @@ export type OperationName =
 	| "package.install"
 	| "package.install_service"
 	| "package.restart_service"
+	| "package.reconcile_services"
 	| "package.remove"
 	| "package.update"
 	| "resources.list"
@@ -120,6 +124,7 @@ export interface OperationInputs {
 	"package.install": { source: string; approved?: boolean };
 	"package.install_service": { source: string; approved?: boolean };
 	"package.restart_service": { source: string; approved?: boolean };
+	"package.reconcile_services": { approved?: boolean; projectRoot?: string };
 	"package.remove": { name: string; approved?: boolean };
 	"package.update": { source: string; approved?: boolean };
 	"resources.list": { projectRoot?: string };
@@ -138,12 +143,13 @@ interface UpdateMutationResponse extends MutationResponse, Partial<Omit<UpdateOu
 interface InstallServiceResponse {
 	ok: boolean;
 	output: string;
-	spec?: Pick<ServiceSpec, "name" | "binPath" | "descriptorPath">;
+	spec?: Pick<ServiceSpec, "name" | "binPath">;
 	notADaemon?: boolean;
 }
 interface RestartServiceResponse extends InstallServiceResponse {
 	restarted?: boolean;
 }
+interface ReconcileServicesResponse extends MutationResponse, ReconcileAllResult {}
 
 export interface OperationOutputs {
 	"package.search": { query: string; total: number; results: SearchPage["results"]; offline?: boolean };
@@ -166,6 +172,7 @@ export interface OperationOutputs {
 	"package.install": MutationResponse;
 	"package.install_service": InstallServiceResponse;
 	"package.restart_service": RestartServiceResponse;
+	"package.reconcile_services": ReconcileServicesResponse;
 	"package.remove": MutationResponse;
 	"package.update": UpdateMutationResponse;
 	"resources.list": { global: PackageResources[]; project: PackageResources[] };
@@ -197,6 +204,7 @@ export const OPERATION_NAMES: readonly OperationName[] = [
 	"package.install",
 	"package.install_service",
 	"package.restart_service",
+	"package.reconcile_services",
 	"package.remove",
 	"package.update",
 	"resources.list",
@@ -227,8 +235,8 @@ function err(status: number, msg: string, details: Record<string, unknown> = {})
 	return jsonResponse({ error: msg, ...details }, { status });
 }
 
-function pickSpec(spec: ServiceSpec): Pick<ServiceSpec, "name" | "binPath" | "descriptorPath"> {
-	return { name: spec.name, binPath: spec.binPath, descriptorPath: spec.descriptorPath };
+function pickSpec(spec: ServiceSpec): Pick<ServiceSpec, "name" | "binPath"> {
+	return { name: spec.name, binPath: spec.binPath };
 }
 
 export function createApp(deps: Deps): { fetch: (req: Request) => Promise<Response> } {
@@ -240,6 +248,13 @@ export function createApp(deps: Deps): { fetch: (req: Request) => Promise<Respon
 	const daemonServiceInstaller = deps.daemonServiceInstaller ?? new RealDaemonServiceInstaller();
 	const piHomeForServiceInstall = deps.piHome ?? defaultPiHome();
 
+	// Additive, real Vehicle protocol surface for this daemon's full operation set -- served
+	// at /vehicle/* alongside (not replacing) /api/v1/ops below. Every operation delegates to
+	// the exact same executeOperation() this route's own /api/v1/ops handler calls.
+	const vehicleRegistry = new VehicleRegistry({ name: "packed", version: VERSION, description: "Pi package lifecycle daemon" });
+	registerPackedVehicleOperations(vehicleRegistry, executeOperation);
+	const vehicleApp = createVehicleHttpApp({ registry: vehicleRegistry, token: deps.token });
+
 	function authorize(operation: PackageOperation, approved: boolean): Response | undefined {
 		try {
 			assertPackagePermission(readSecuritySettings(deps.stateDir), operation, approved);
@@ -331,11 +346,21 @@ export function createApp(deps: Deps): { fetch: (req: Request) => Promise<Respon
 			// pi.cleanup is read and applied before delegating to pi remove --
 			// once pi remove finishes, an npm-sourced package's own directory
 			// (and its manifest) may already be gone.
-			const installedDir = resolveInstalledDir(deps.piHome ?? defaultPiHome(), `npm:${name}`);
+			const piHome = deps.piHome ?? defaultPiHome();
+			const installedDir = resolveInstalledDir(piHome, `npm:${name}`);
+			let serviceRemoved = false;
+			if (installedDir) {
+				const service = await daemonServiceInstaller.remove(piHome, `npm:${name}`);
+				if (!service.ok && !service.notADaemon) return json({ ok: false, name, output: service.reason });
+				if (service.ok) {
+					if (!service.result.installed) return json({ ok: false, name, output: service.result.reason });
+					serviceRemoved = true;
+				}
+			}
 			const cleanup = installedDir ? runCleanup(installedDir) : [];
 			try {
 				const output = await deps.inst.remove(`npm:${name}`, { approved });
-				return json({ ok: true, name, output: output + formatCleanupSummary(cleanup) });
+				return json({ ok: true, name, output: output + formatCleanupSummary(cleanup), serviceRemoved });
 			} catch (e) {
 				const message = e instanceof Error ? e.message : String(e);
 				return json({ ok: false, name, output: message + formatCleanupSummary(cleanup) });
@@ -359,7 +384,19 @@ export function createApp(deps: Deps): { fetch: (req: Request) => Promise<Respon
 			if (denied) return denied;
 			try {
 				const output = await deps.inst.install(source, { approved });
-				return json({ ok: true, source, output });
+				if (!source.startsWith("npm:")) return json({ ok: true, source, output });
+				const service = await daemonServiceInstaller.install(piHomeForServiceInstall, source);
+				if (!service.ok) {
+					if (service.notADaemon) return json({ ok: true, source, output });
+					return json({ ok: false, source, output: `${output}\n${service.reason}` });
+				}
+				if (!service.result.installed) return json({ ok: false, source, output: `${output}\n${service.result.reason}` });
+				return json({
+					ok: true,
+					source,
+					output: `${output}\ninstalled persistent Vehicle ${service.spec.name}`,
+					service: pickSpec(service.spec),
+				});
 			} catch (e) {
 				return json({ ok: false, source, output: e instanceof Error ? e.message : String(e) });
 			}
@@ -380,7 +417,7 @@ export function createApp(deps: Deps): { fetch: (req: Request) => Promise<Respon
 			}
 			const denied = authorize("install_service", approved);
 			if (denied) return denied;
-			const resolved = daemonServiceInstaller.install(piHomeForServiceInstall, source);
+			const resolved = await daemonServiceInstaller.install(piHomeForServiceInstall, source);
 			if (!resolved.ok) return json({ ok: false, output: resolved.reason, notADaemon: resolved.notADaemon });
 			if (!resolved.result.installed) return json({ ok: false, output: resolved.result.reason, spec: pickSpec(resolved.spec) });
 			return json({ ok: true, output: `installed a persistent service for ${resolved.spec.name}`, spec: pickSpec(resolved.spec) });
@@ -401,7 +438,7 @@ export function createApp(deps: Deps): { fetch: (req: Request) => Promise<Respon
 			}
 			const denied = authorize("restart_service", approved);
 			if (denied) return denied;
-			const resolved = daemonServiceInstaller.restart(piHomeForServiceInstall, source);
+			const resolved = await daemonServiceInstaller.restart(piHomeForServiceInstall, source);
 			if (!resolved.ok) return json({ ok: false, output: resolved.reason, notADaemon: resolved.notADaemon });
 			const output = resolved.restarted
 				? `restarted the persistent service for ${resolved.spec.name}`
@@ -409,6 +446,23 @@ export function createApp(deps: Deps): { fetch: (req: Request) => Promise<Respon
 			return json({ ok: true, output, restarted: resolved.restarted, spec: pickSpec(resolved.spec) });
 		}
 
+		if (path === "/reconcile-services" && req.method === "POST") {
+			let approved = false;
+			let projectRoot: string | undefined;
+			try {
+				const body = (await req.json()) as { approved?: unknown; projectRoot?: unknown };
+				approved = body.approved === true;
+				projectRoot = typeof body.projectRoot === "string" ? body.projectRoot : undefined;
+			} catch {
+				/* fall through -- approved stays false, projectRoot stays undefined */
+			}
+			const denied = authorize("reconcile_services", approved);
+			if (denied) return denied;
+			const result = await reconcileAllDaemonServices(piHomeForServiceInstall, projectRoot, daemonServiceInstaller);
+			const output = `reconciled ${result.reconciled.length} Vehicle(s), skipped ${result.skipped} non-daemon package(s)${result.failed.length > 0 ? `, ${result.failed.length} failure(s)` : ""}`;
+			return json({ ok: result.failed.length === 0, output, ...result });
+		}
+
 		if (path === "/update" && req.method === "POST") {
 			let source = "";
 			let approved = false;
@@ -426,7 +480,13 @@ export function createApp(deps: Deps): { fetch: (req: Request) => Promise<Respon
 			if (denied) return denied;
 			try {
 				const outcome = await deps.inst.update(source, { approved });
-				return json({ ok: true, source, ...outcome });
+				if (!source.startsWith("npm:") || outcome.alreadyUpToDate) return json({ ok: true, source, ...outcome });
+				const service = await daemonServiceInstaller.restart(piHomeForServiceInstall, source);
+				if (!service.ok) {
+					if (service.notADaemon) return json({ ok: true, source, ...outcome });
+					return json({ ok: false, source, ...outcome, output: `${outcome.output}\n${service.reason}` });
+				}
+				return json({ ok: true, source, ...outcome, serviceReconciled: service.restarted });
 			} catch (error) {
 				return json({ ok: false, source, output: error instanceof Error ? error.message : String(error), reloadRequired: false });
 			}
@@ -601,6 +661,10 @@ export function createApp(deps: Deps): { fetch: (req: Request) => Promise<Respon
 				path = "/restart-service";
 				init = { method: "POST", body: JSON.stringify(input) };
 				break;
+			case "package.reconcile_services":
+				path = "/reconcile-services";
+				init = { method: "POST", body: JSON.stringify(input) };
+				break;
 			case "package.remove":
 				path = "/remove";
 				init = { method: "POST", body: JSON.stringify(input) };
@@ -626,8 +690,9 @@ export function createApp(deps: Deps): { fetch: (req: Request) => Promise<Respon
 	return {
 		async fetch(req: Request): Promise<Response> {
 			const t0 = Date.now();
-			if (!requireBearerToken(req, deps.token)) return errorResponse("missing or invalid bearer token", 401);
 			const requestUrl = new URL(req.url);
+			if (requestUrl.pathname.startsWith("/vehicle/")) return vehicleApp.fetch(req);
+			if (!requireBearerToken(req, deps.token)) return errorResponse("missing or invalid bearer token", 401);
 			if (req.method === "GET" && requestUrl.pathname === "/api/v1/ops") return jsonResponse({ operations: OPERATION_NAMES });
 			if (req.method === "POST" && requestUrl.pathname === "/api/v1/ops") {
 				try {

package/service/src/daemon/vehicle-registration.ts

@@ -0,0 +1,173 @@
+/**
+ * packed's full 29-operation daemon surface projected onto the real Vehicle
+ * protocol. Every operation delegates to the exact same executeOperation()
+ * function /api/v1/ops already calls (one implementation, two projections --
+ * the same shape every other Vehicle-migrated daemon in this ecosystem
+ * uses) -- no behavior change, only a second real transport served
+ * alongside (not replacing) the existing /api/v1/ops route.
+ *
+ * Every operation's input is already a well-typed OperationInputs[Name] that
+ * executeOperation() validates and dispatches internally (throwing
+ * PackageOperationError on a bad shape/denied approval) -- there is no
+ * separate Vehicle-side schema to duplicate that logic, so both input and
+ * output use passthroughVehicleSchema and let executeOperation's own
+ * validation (already covered by service.test.ts) be the single source of
+ * truth for what's accepted.
+ *
+ * Effect classification is grounded in security.ts's own PACKAGE_OPERATIONS
+ * classification (read/maintenance/code-execution/settings-mutation/
+ * security-mutation) -- the codebase's own, already-deployed risk model --
+ * translated to Vehicle's effect vocabulary rather than independently
+ * re-derived, with two deliberate refinements documented at each entry
+ * where Vehicle's own taxonomy draws a finer distinction Packed's doesn't
+ * (package.remove -> destructive, since Vehicle has a dedicated category
+ * for irreversible deletion; restart_service/reconcile_services ->
+ * external-write rather than open-world, since restarting/reconciling an
+ * ALREADY-installed, already-vetted service introduces no new code, unlike
+ * install/install_service/update/setup.apply which can fetch and run
+ * arbitrary newly-published code).
+ *
+ * Approval/authorization is NOT reimplemented here: executeOperation()
+ * (and the route()-based operations it delegates to internally) already
+ * calls authorize()/assertPackagePermission() and throws
+ * PackageOperationError(status: 403) on a denied mutation -- reusing
+ * executeOperation() verbatim means this Vehicle surface automatically
+ * inherits the exact same approval gate, with zero duplicated policy logic
+ * to drift out of sync.
+ */
+
+import type { VehicleEffect, VehicleIdempotency } from "@danypops/vehicle-core";
+import { bindVehicleOperation, defineVehicleOperation, passthroughVehicleSchema, VehicleError } from "@danypops/vehicle-core";
+import type { VehicleRegistry } from "@danypops/vehicle-server";
+import { OPERATION_NAMES, type OperationInputs, type OperationName, type OperationOutputs } from "./service.ts";
+
+/** Thrown by executeOperation() with an HTTP-shaped .status; preserves /api/v1/ops's own status->meaning exactly instead of letting VehicleRegistry.invoke()'s catch-all flatten every failure into a generic internal/500 with the message discarded. */
+interface StatusCarryingError extends Error {
+	readonly status: number;
+}
+
+function hasStatus(error: unknown): error is StatusCarryingError {
+	return error instanceof Error && typeof (error as { status?: unknown }).status === "number";
+}
+
+async function withPackedErrorParity<T>(run: () => T | Promise<T>): Promise<T> {
+	try {
+		return await run();
+	} catch (error) {
+		if (error instanceof VehicleError) throw error;
+		if (hasStatus(error)) {
+			const category =
+				error.status === 403
+					? "authorization"
+					: error.status === 404
+						? "not_found"
+						: error.status === 400
+							? "validation"
+							: error.status >= 500
+								? "unavailable"
+								: "validation";
+			throw new VehicleError("operation-rejected", error.message, { category, cause: error });
+		}
+		const message = error instanceof Error ? error.message : String(error);
+		throw new VehicleError("operation-rejected", message, { category: "validation", cause: error });
+	}
+}
+
+const OWNER = "packed";
+const LIMITS = { defaultTimeoutMs: 30_000, maxTimeoutMs: 120_000, maxRequestBytes: 65_536, maxResponseBytes: 4_194_304 };
+
+const READ: VehicleIdempotency = { mode: "safe" };
+const WRITE: VehicleIdempotency = { mode: "unsafe" };
+
+interface OperationMeta {
+	readonly description: string;
+	readonly effect: VehicleEffect;
+}
+
+/**
+ * One entry per OPERATION_NAMES member. See this file's own doc comment for
+ * the general translation rule (security.ts's PACKAGE_OPERATIONS
+ * classification) and its two deliberate refinements.
+ */
+const OPERATION_META: Record<OperationName, OperationMeta> = {
+	"package.search": { description: "Searches Pi packages on npm.", effect: "read" },
+	"package.info": { description: "Reads bounded metadata for one package.", effect: "read" },
+	"package.installed": { description: "Lists locally installed Pi packages.", effect: "read" },
+	"package.catalog": { description: "Reads the local SQLite catalog mirror.", effect: "read" },
+	"package.catalog.sync": {
+		description: "Refreshes the local catalog mirror from the Pi-package-tagged npm registry subset.",
+		effect: "external-write",
+	},
+	"package.index": { description: "Reads the locally built adoption-score index, if one exists.", effect: "read" },
+	"package.index.build": {
+		description: "Builds the adoption-score index by scoring catalog entries against the npm registry.",
+		effect: "external-write",
+	},
+	"package.updates": { description: "Reads the last background update-check snapshot.", effect: "read" },
+	"package.check": { description: "Runs static (and optionally smoke-test) quality checks against a local package path.", effect: "read" },
+	"package.pack": { description: "Verifies a local package path via npm pack.", effect: "read" },
+	"package.score": { description: "Computes an adoption-readiness score for a local path or registry package.", effect: "read" },
+	"setup.export": { description: "Exports the current Pi setup as a portable manifest.", effect: "local-write" },
+	"setup.update": { description: "Updates an existing setup manifest in place.", effect: "local-write" },
+	"setup.plan": { description: "Computes a setup manifest's install/update/remove plan without applying it.", effect: "read" },
+	"setup.apply": {
+		description: "Applies a setup manifest's plan -- can install, update, or remove packages.",
+		effect: "open-world",
+	},
+	"package.security.get": { description: "Reads this daemon's mutation-approval security settings.", effect: "read" },
+	"package.security.set": { description: "Writes this daemon's mutation-approval security settings.", effect: "local-write" },
+	"package.install": { description: "Installs a Pi package from an npm, git, or https source.", effect: "open-world" },
+	"package.install_service": {
+		description: "Installs a persistent supervised service for an already-installed daemon package.",
+		effect: "open-world",
+	},
+	"package.restart_service": {
+		description: "Restarts an already-installed package's persistent service -- no new code introduced.",
+		effect: "external-write",
+	},
+	"package.reconcile_services": {
+		description: "Reconciles every installed daemon package's persistent service against desired state.",
+		effect: "external-write",
+	},
+	"package.remove": { description: "Removes an installed Pi package. Irreversible.", effect: "destructive" },
+	"package.update": { description: "Updates a configured Pi package to its latest available version.", effect: "open-world" },
+	"resources.list": { description: "Lists global and project-scoped Pi resources (extensions, skills, prompts, themes).", effect: "read" },
+	"resources.toggle": { description: "Enables or disables one Pi resource in a settings file.", effect: "local-write" },
+	"pi.status": { description: "Reports the locally running Pi version against the latest published release.", effect: "read" },
+	"advisories.scan": { description: "Scans installed package versions against known advisories.", effect: "read" },
+	"doctor.run": { description: "Runs diagnostic health checks (service install drift, resource config, ...).", effect: "read" },
+	"package.updates.project": { description: "Checks for updates across every scope visible to one project.", effect: "read" },
+};
+
+/** Read effects need only packed:read; every other effect needs both (writes commonly also read first). */
+function permissionsFor(effect: VehicleEffect): readonly string[] {
+	return effect === "read" ? ["packed:read"] : ["packed:read", "packed:write"];
+}
+
+export function registerPackedVehicleOperations(
+	registry: VehicleRegistry,
+	executeOperation: <Name extends OperationName>(op: Name, input: OperationInputs[Name]) => Promise<OperationOutputs[Name]>,
+): void {
+	for (const name of OPERATION_NAMES) {
+		const meta = OPERATION_META[name];
+		const operation = defineVehicleOperation({
+			name,
+			version: 1,
+			description: meta.description,
+			input: passthroughVehicleSchema,
+			output: passthroughVehicleSchema,
+			permissions: permissionsFor(meta.effect),
+			effect: meta.effect,
+			idempotency: meta.effect === "read" ? READ : WRITE,
+			limits: LIMITS,
+		});
+		registry.register(
+			OWNER,
+			bindVehicleOperation(
+				operation,
+				() => async (context) =>
+					withPackedErrorParity(() => executeOperation(name, context.input as OperationInputs[typeof name])),
+			),
+		);
+	}
+}

package/service/src/public/client.ts

@@ -1,10 +1,10 @@
 import { spawn } from "node:child_process";
-import { existsSync, readFileSync } from "node:fs";
+import { readFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { AuthenticatedRpcClient } from "@danypops/vehicle-client/rpc-client";
 import { readDaemonHandle, resolveDaemonPaths } from "@danypops/vehicle-server/paths";
-import { isServiceInstalled as vehicleIsServiceInstalled } from "@danypops/vehicle-server/service";
+import { createNodeServiceInstallDeps, isServiceInstalled as vehicleIsServiceInstalled } from "@danypops/vehicle-server/service";
 import type {
 	ExtensionOperationInputs,
 	ExtensionOperationName,
@@ -89,21 +89,9 @@ export function resolvePackedClientPaths(options: PackedPathOptions = {}): Packe
 	return { token: paths.token, handle: paths.handle, serviceDescriptor: paths.serviceDescriptor };
 }
 
-/** Real, file-existence-only check on Linux/macOS (Windows checks a
- * registry Run key instead) -- cheap, synchronous, no subprocess. */
-function isPackedServiceInstalled(serviceDescriptor: string): boolean {
-	return vehicleIsServiceInstalled(
-		{ name: SERVICE_NAME, binPath: "", descriptorPath: serviceDescriptor },
-		{
-			fileExists: existsSync,
-			writeFile: () => {},
-			readFile: () => null,
-			removeFile: () => {},
-			mkdirp: () => {},
-			runCommand: () => ({ ok: false, output: "" }),
-			which: () => false,
-		},
-	);
+/** Checks Armada's authoritative desired fleet rather than native descriptor files. */
+function isPackedServiceInstalled(): boolean {
+	return vehicleIsServiceInstalled(SERVICE_NAME, createNodeServiceInstallDeps());
 }
 
 export type FetchTransport = (request: Request) => Promise<Response>;
@@ -251,7 +239,7 @@ export async function ensureClient(deps: EnsureClientDeps): Promise<PackedClient
 	const waitedSeconds = (attempts * delayMs) / 1000;
 	throw new Error(
 		serviceInstalled
-			? `Packed daemon did not become ready within ${waitedSeconds} seconds, but a supervised service is installed -- check it directly (e.g. systemctl --user status pi-packed.service) rather than auto-spawning a second one`
+			? `Packed daemon did not become ready within ${waitedSeconds} seconds, but a managed service is installed -- run packed doctor rather than auto-spawning a second one`
 			: `Packed daemon did not become ready within ${waitedSeconds} seconds`,
 	);
 }
@@ -259,7 +247,7 @@ export async function ensureClient(deps: EnsureClientDeps): Promise<PackedClient
 export async function ensurePackedClient(paths = resolvePackedClientPaths(), transport: FetchTransport = fetch): Promise<PackedClient> {
 	return ensureClient({
 		connect: () => connectPackedClient(paths, transport),
-		isServiceInstalled: () => isPackedServiceInstalled(paths.serviceDescriptor),
+		isServiceInstalled: () => isPackedServiceInstalled(),
 		spawn: () => {
 			const override = process.env.PI_PACKED_BIN;
 			const command = override ?? process.env.PI_PACKED_BUN ?? "bun";

package/service/src/public/protocol.ts

@@ -92,7 +92,6 @@ export type PackageResources = { source: string; name: string; scope: "global" |
 export interface ServiceSpecSummary {
 	name: string;
 	binPath: string;
-	descriptorPath: string;
 }
 
 /** Mirrors service/src/pi/pi-version.ts's CURRENT_PI_PACKAGE_NAME

package/service/src/security/security.ts

@@ -23,6 +23,7 @@ export const PACKAGE_OPERATIONS = [
 	"install",
 	"install_service",
 	"restart_service",
+	"reconcile_services",
 	"setup.apply",
 	"update",
 	"update.self",
@@ -70,6 +71,7 @@ const CLASSIFICATIONS: Record<PackageOperation, PackageOperationClassification>
 	install: "code-execution",
 	install_service: "code-execution",
 	restart_service: "code-execution",
+	reconcile_services: "code-execution",
 	"setup.apply": "code-execution",
 	update: "code-execution",
 	"update.self": "code-execution",

package/service/src/shared/constants.ts

@@ -52,6 +52,7 @@ export const INDEX_OPERATION_TIMEOUT_MS = 10 * 60_000;
 export const WATCH_INTERVAL_DEFAULT_MS = 30 * 60_000; // updates diff cadence
 export const CATALOG_INTERVAL_DEFAULT_MS = 6 * 3_600_000; // full mirror TTL
 export const INDEX_INTERVAL_DEFAULT_MS = 6 * 3_600_000; // static index regeneration TTL, same cadence as the catalog mirror it reads from
+export const RECONCILE_INTERVAL_DEFAULT_MS = 30 * 60_000; // Vehicle-service drift sweep cadence -- catches an out-of-band npm install/update a running daemon never picked up
 export const IDLE_BUDGET_DEFAULT_MS = 10 * 60_000; // on-demand self-exit
 export const WATCHDOG_TICK_MS = 15_000;
 
@@ -69,5 +70,6 @@ export const ENV = {
 	WATCH_SECS: "PI_PACKED_WATCH_SECS",
 	CATALOG_SECS: "PI_PACKED_CATALOG_SECS",
 	INDEX_SECS: "PI_PACKED_INDEX_SECS",
+	RECONCILE_SECS: "PI_PACKED_RECONCILE_SECS",
 	IDLE_SECS: "PI_PACKED_IDLE_SECS",
 } as const;