@danypops/pi-packed 0.19.9 → 0.19.10

package/service/test/resources.test.ts

@@ -0,0 +1,255 @@
+import { afterEach, describe, expect, it } from "bun:test";
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { AuthenticatedRpcClient } from "@danypops/vehicle-client/rpc-client";
+import { createApp, type OperationInputs, type OperationName, type OperationOutputs } from "../src/daemon/service.ts";
+import type { Installer, PkgInfo, Registry, SearchPage } from "../src/packages/package.ts";
+import { listPackageResources, toggleResource } from "../src/packages/resources.ts";
+
+const roots: string[] = [];
+afterEach(() => {
+	for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
+});
+
+function piHome(settingsPackages: unknown[]): string {
+	const root = mkdtempSync(join(tmpdir(), "packed-resources-"));
+	roots.push(root);
+	writeFileSync(join(root, "settings.json"), JSON.stringify({ packages: settingsPackages }, null, 2));
+	return root;
+}
+
+function installNpmPackage(home: string, name: string, pi: Record<string, unknown>, files: Record<string, string>): void {
+	const dir = join(home, "npm", "node_modules", name);
+	mkdirSync(dir, { recursive: true });
+	writeFileSync(join(dir, "package.json"), JSON.stringify({ name, version: "1.0.0", pi }, null, 2));
+	for (const [path, content] of Object.entries(files)) {
+		mkdirSync(join(dir, path, ".."), { recursive: true });
+		writeFileSync(join(dir, path), content);
+	}
+}
+
+describe("listPackageResources", () => {
+	it("lists an npm package's discovered resources with the default all-enabled state", () => {
+		const home = piHome(["npm:pi-demo"]);
+		installNpmPackage(
+			home,
+			"pi-demo",
+			{ extensions: ["extensions/*.ts"], skills: ["skills/*/SKILL.md"] },
+			{
+				"extensions/one.ts": "",
+				"extensions/two.ts": "",
+				"skills/review/SKILL.md": "",
+			},
+		);
+
+		const { global, project } = listPackageResources(home);
+
+		expect(project).toEqual([]);
+		expect(global).toHaveLength(1);
+		expect(global[0]?.source).toBe("npm:pi-demo");
+		expect(global[0]?.extensions).toEqual([
+			{ path: "extensions/one.ts", enabled: true },
+			{ path: "extensions/two.ts", enabled: true },
+		]);
+		expect(global[0]?.skills).toEqual([{ path: "skills/review/SKILL.md", enabled: true }]);
+	});
+
+	it("applies a settings-level filter, narrowing what the package already declares", () => {
+		const home = piHome([{ source: "npm:pi-demo", extensions: ["!extensions/two.ts"] }]);
+		installNpmPackage(home, "pi-demo", { extensions: ["extensions/*.ts"] }, { "extensions/one.ts": "", "extensions/two.ts": "" });
+
+		const { global } = listPackageResources(home);
+
+		expect(global[0]?.extensions).toEqual([
+			{ path: "extensions/one.ts", enabled: true },
+			{ path: "extensions/two.ts", enabled: false },
+		]);
+	});
+
+	it("treats an empty filter array as loading none of that resource type", () => {
+		const home = piHome([{ source: "npm:pi-demo", extensions: [] }]);
+		installNpmPackage(home, "pi-demo", { extensions: ["extensions/*.ts"] }, { "extensions/one.ts": "" });
+
+		const { global } = listPackageResources(home);
+
+		expect(global[0]?.extensions).toEqual([{ path: "extensions/one.ts", enabled: false }]);
+	});
+
+	it("omits git:, https:, and local sources rather than reporting them inaccurately", () => {
+		const home = piHome(["git:github.com/example/repo", "https://example.test/pkg", "/abs/local/pkg", "npm:pi-demo"]);
+		installNpmPackage(home, "pi-demo", {}, { "extensions/one.ts": "" });
+
+		const { global } = listPackageResources(home);
+
+		expect(global).toHaveLength(1);
+		expect(global[0]?.source).toBe("npm:pi-demo");
+	});
+
+	it("reads project settings and resolves project-local npm installs under .pi/, matching setup.ts's own -l convention", () => {
+		const home = piHome(["npm:pi-demo"]);
+		installNpmPackage(home, "pi-demo", {}, { "extensions/one.ts": "" });
+		const projectRoot = mkdtempSync(join(tmpdir(), "packed-resources-project-"));
+		roots.push(projectRoot);
+		const projectHome = join(projectRoot, ".pi");
+		mkdirSync(projectHome, { recursive: true });
+		writeFileSync(join(projectHome, "settings.json"), JSON.stringify({ packages: ["npm:pi-demo-local"] }));
+		installNpmPackage(projectHome, "pi-demo-local", {}, { "extensions/local.ts": "" });
+
+		const { global, project } = listPackageResources(home, projectRoot);
+
+		expect(global).toHaveLength(1);
+		expect(project).toHaveLength(1);
+		expect(project[0]?.source).toBe("npm:pi-demo-local");
+		expect(project[0]?.scope).toBe("project");
+	});
+
+	it("is unaffected by a missing project settings file", () => {
+		const home = piHome(["npm:pi-demo"]);
+		installNpmPackage(home, "pi-demo", {}, { "extensions/one.ts": "" });
+		const projectRoot = mkdtempSync(join(tmpdir(), "packed-resources-project-"));
+		roots.push(projectRoot);
+
+		const { global, project } = listPackageResources(home, projectRoot);
+
+		expect(global).toHaveLength(1);
+		expect(project).toEqual([]);
+	});
+});
+
+class NoopRegistry implements Registry {
+	async search(): Promise<SearchPage> {
+		return { results: [], total: 0 };
+	}
+	async searchPage(): Promise<SearchPage> {
+		return { results: [], total: 0 };
+	}
+	async searchAll() {
+		return [];
+	}
+	async info(name: string): Promise<PkgInfo> {
+		return { name, version: "1.0.0" };
+	}
+}
+
+class NoopInstaller implements Installer {
+	async install() {
+		return "ok";
+	}
+	async remove() {
+		return "ok";
+	}
+	async update() {
+		return { output: "ok", reloadRequired: false, alreadyUpToDate: true, pinned: false };
+	}
+}
+
+function rpcClient(piHome: string) {
+	const app = createApp({
+		reg: new NoopRegistry(),
+		inst: new NoopInstaller(),
+		token: "test-token",
+		stateDir: mkdtempSync(join(tmpdir(), "packed-resources-state-")),
+		dataDir: mkdtempSync(join(tmpdir(), "packed-resources-data-")),
+		piHome,
+	});
+	return new AuthenticatedRpcClient<OperationName, OperationInputs, OperationOutputs>("http://packed.test", "test-token", {
+		label: "Packed",
+		transport: (request) => app.fetch(request),
+	});
+}
+
+describe("resources.list / resources.toggle (daemon RPC wiring)", () => {
+	it("lists resources through the authenticated RPC operation, matching the pure domain function", async () => {
+		const home = piHome(["npm:pi-demo"]);
+		installNpmPackage(home, "pi-demo", { extensions: ["extensions/*.ts"] }, { "extensions/one.ts": "" });
+		const client = rpcClient(home);
+
+		const result = await client.call("resources.list", {});
+
+		expect(result).toEqual(listPackageResources(home));
+	});
+
+	it("requires approval before toggling, matching every other settings-mutating operation", async () => {
+		const home = piHome(["npm:pi-demo"]);
+		installNpmPackage(home, "pi-demo", { extensions: ["extensions/*.ts"] }, { "extensions/one.ts": "" });
+		const client = rpcClient(home);
+
+		await expect(
+			client.call("resources.toggle", { source: "npm:pi-demo", field: "extensions", path: "extensions/one.ts", enabled: false }),
+		).rejects.toThrow();
+
+		const approved = await client.call("resources.toggle", {
+			source: "npm:pi-demo",
+			field: "extensions",
+			path: "extensions/one.ts",
+			enabled: false,
+			approved: true,
+		});
+		expect(approved.ok).toBe(true);
+		const { global } = await client.call("resources.list", {});
+		expect(global[0]?.extensions).toEqual([{ path: "extensions/one.ts", enabled: false }]);
+	});
+
+	it("rejects a path-escaping toggle request instead of writing it", async () => {
+		const home = piHome(["npm:pi-demo"]);
+		installNpmPackage(home, "pi-demo", { extensions: ["extensions/*.ts"] }, { "extensions/one.ts": "" });
+		const client = rpcClient(home);
+
+		await expect(
+			client.call("resources.toggle", {
+				source: "npm:pi-demo",
+				field: "extensions",
+				path: "../../etc/passwd",
+				enabled: false,
+				approved: true,
+			}),
+		).rejects.toThrow();
+	});
+});
+
+describe("toggleResource", () => {
+	it("disables a resource with a minimal -path override, leaving the package's own glob defaults untouched", async () => {
+		const home = piHome(["npm:pi-demo"]);
+		installNpmPackage(home, "pi-demo", { extensions: ["extensions/*.ts"] }, { "extensions/one.ts": "" });
+		const settingsPath = join(home, "settings.json");
+
+		const result = await toggleResource({
+			settingsPath,
+			source: "npm:pi-demo",
+			field: "extensions",
+			path: "extensions/one.ts",
+			enabled: false,
+		});
+
+		expect(result.ok).toBe(true);
+		const written = JSON.parse(readFileSync(settingsPath, "utf8"));
+		expect(written.packages).toEqual([{ source: "npm:pi-demo", extensions: ["-extensions/one.ts"] }]);
+		const { global } = listPackageResources(home);
+		expect(global[0]?.extensions).toEqual([{ path: "extensions/one.ts", enabled: false }]);
+	});
+
+	it("is idempotent and replaces a prior override for the same exact path instead of accumulating duplicates", async () => {
+		const home = piHome([{ source: "npm:pi-demo", extensions: ["-extensions/one.ts"] }]);
+		installNpmPackage(home, "pi-demo", { extensions: ["extensions/*.ts"] }, { "extensions/one.ts": "" });
+		const settingsPath = join(home, "settings.json");
+
+		await toggleResource({ settingsPath, source: "npm:pi-demo", field: "extensions", path: "extensions/one.ts", enabled: true });
+
+		const written = JSON.parse(readFileSync(settingsPath, "utf8"));
+		expect(written.packages).toEqual([{ source: "npm:pi-demo", extensions: ["+extensions/one.ts"] }]);
+	});
+
+	it("fails closed with an error, not a throw, when the package is not in settings", async () => {
+		const home = piHome(["npm:other"]);
+		const result = await toggleResource({
+			settingsPath: join(home, "settings.json"),
+			source: "npm:pi-demo",
+			field: "extensions",
+			path: "extensions/one.ts",
+			enabled: false,
+		});
+		expect(result.ok).toBe(false);
+		expect(result.error).toContain("not found");
+	});
+});

package/service/test/security.test.ts

@@ -0,0 +1,89 @@
+import { describe, expect, it } from "bun:test";
+import { mkdtempSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { PACKAGE_OPERATIONS, packagePermissionDecision, readSecuritySettings, writeSecuritySettings } from "../src/security/security.ts";
+
+describe("package permission policy", () => {
+	it("defaults every arbitrary-code and settings/install-root mutation to approval", () => {
+		const dir = mkdtempSync(join(tmpdir(), "packed-security-"));
+		const settings = readSecuritySettings(dir);
+		expect(settings).toEqual({ mutationApproval: "always" });
+		expect(PACKAGE_OPERATIONS).toEqual([
+			"search",
+			"info",
+			"installed",
+			"catalog",
+			"index.status",
+			"index.build",
+			"updates",
+			"check",
+			"setup.plan",
+			"security.read",
+			"mirror",
+			"setup.export",
+			"setup.update",
+			"install",
+			"install_service",
+			"restart_service",
+			"setup.apply",
+			"update",
+			"update.self",
+			"remove",
+			"resources.list",
+			"resources.toggle",
+			"security.write",
+			"pi.status",
+			"advisories.scan",
+			"doctor",
+		]);
+		const decisions = Object.fromEntries(
+			PACKAGE_OPERATIONS.map((operation) => [operation, packagePermissionDecision(settings, operation)]),
+		);
+		expect(decisions).toMatchObject({
+			search: { classification: "read", approvalRequired: false },
+			info: { classification: "read", approvalRequired: false },
+			installed: { classification: "read", approvalRequired: false },
+			catalog: { classification: "read", approvalRequired: false },
+			"index.status": { classification: "read", approvalRequired: false },
+			"index.build": { classification: "maintenance", approvalRequired: false },
+			updates: { classification: "read", approvalRequired: false },
+			check: { classification: "read", approvalRequired: false },
+			"setup.plan": { classification: "read", approvalRequired: false },
+			"security.read": { classification: "read", approvalRequired: false },
+			mirror: { classification: "maintenance", approvalRequired: false },
+			"setup.export": { classification: "maintenance", approvalRequired: false },
+			"setup.update": { classification: "maintenance", approvalRequired: false },
+			install: { classification: "code-execution", approvalRequired: true },
+			install_service: { classification: "code-execution", approvalRequired: true },
+			restart_service: { classification: "code-execution", approvalRequired: true },
+			"setup.apply": { classification: "code-execution", approvalRequired: true },
+			update: { classification: "code-execution", approvalRequired: true },
+			"update.self": { classification: "code-execution", approvalRequired: true },
+			remove: { classification: "settings-mutation", approvalRequired: true },
+			"resources.list": { classification: "read", approvalRequired: false },
+			"resources.toggle": { classification: "settings-mutation", approvalRequired: true },
+			"security.write": { classification: "security-mutation", approvalRequired: true },
+			"pi.status": { classification: "read", approvalRequired: false },
+			"advisories.scan": { classification: "read", approvalRequired: false },
+			doctor: { classification: "read", approvalRequired: false },
+		});
+	});
+
+	it("persists an explicit unsafe opt-out and migrates the prior storage key", async () => {
+		const dir = mkdtempSync(join(tmpdir(), "packed-security-"));
+		expect(await writeSecuritySettings(dir, { mutationApproval: "never" })).toEqual({ mutationApproval: "never" });
+		expect(readSecuritySettings(dir)).toEqual({ mutationApproval: "never" });
+
+		const legacyDir = mkdtempSync(join(tmpdir(), "packed-security-legacy-"));
+		writeFileSync(join(legacyDir, "security.json"), '{"installApproval":"never"}\n');
+		expect(readSecuritySettings(legacyDir)).toEqual({ mutationApproval: "never" });
+	});
+
+	it("makes the explicit opt-out govern every guarded operation", () => {
+		const settings = { mutationApproval: "never" as const };
+		for (const operation of PACKAGE_OPERATIONS) {
+			expect(packagePermissionDecision(settings, operation).approvalRequired).toBe(false);
+		}
+	});
+});

package/service/test/self-update.test.ts

@@ -0,0 +1,257 @@
+import { describe, expect, it } from "bun:test";
+import type { PkgInfo, Registry } from "../src/packages/package.ts";
+import type { InteractiveRunResult } from "../src/publish/publish.ts";
+import { detectSelfInstallMethod, PACKED_PACKAGE_NAME, runSelfUpdate, type SelfUpdateDeps } from "../src/self-update/self-update.ts";
+import { VERSION } from "../src/shared/version.ts";
+
+class FakeRegistry implements Pick<Registry, "info"> {
+	constructor(private version: string) {}
+	async info(): Promise<PkgInfo> {
+		return { name: PACKED_PACKAGE_NAME, version: this.version };
+	}
+}
+
+const ok = (code = 0): InteractiveRunResult => ({ ok: true, code });
+const failed = (code = 1): InteractiveRunResult => ({ ok: false, code });
+
+describe("detectSelfInstallMethod", () => {
+	it("recognizes an npm-global install by its node_modules path", () => {
+		const method = detectSelfInstallMethod(`file:///usr/local/lib/node_modules/${PACKED_PACKAGE_NAME}/src/cli.ts`);
+		expect(method).toEqual({ kind: "npm-global" });
+	});
+
+	it("recognizes a Bun-global install by its install/global/node_modules path", () => {
+		const method = detectSelfInstallMethod(`file:///home/dev/.cache/.bun/install/global/node_modules/${PACKED_PACKAGE_NAME}/src/cli.ts`);
+		expect(method).toEqual({ kind: "bun-global" });
+	});
+
+	it("prefers bun-global over the broader npm-global check, since a bun-global path also contains node_modules/<pkg>/", () => {
+		const method = detectSelfInstallMethod(`file:///home/dev/.bun/install/global/node_modules/${PACKED_PACKAGE_NAME}/src/cli.ts`);
+		expect(method.kind).toBe("bun-global");
+	});
+
+	it("recognizes anything else as a local checkout, carrying the real resolved path", () => {
+		const method = detectSelfInstallMethod("file:///home/dev/Projects/packed/packages/packed/src/cli.ts");
+		expect(method.kind).toBe("local-checkout");
+		expect(method.kind === "local-checkout" && method.path).toBe("/home/dev/Projects/packed/packages/packed/src/cli.ts");
+	});
+});
+
+describe("runSelfUpdate", () => {
+	function deps(overrides: Partial<SelfUpdateDeps> = {}): SelfUpdateDeps {
+		return { registry: new FakeRegistry("9.9.9"), installMethod: { kind: "npm-global" }, ...overrides };
+	}
+
+	it("never attempts an npm install for a local checkout -- update it with git, not packed", async () => {
+		let called = false;
+		const report = await runSelfUpdate(
+			deps({
+				installMethod: { kind: "local-checkout", path: "/home/dev/packed" },
+				runNpmInstall: async () => {
+					called = true;
+					return ok();
+				},
+			}),
+		);
+		expect(called).toBe(false);
+		expect(report.updated).toBe(false);
+		expect(report.message).toContain("local checkout at /home/dev/packed");
+		expect(report.message).toContain("git pull");
+	});
+
+	it("still restarts the service for a local checkout -- that's the actual point for a dev loop", async () => {
+		let restarted = false;
+		const report = await runSelfUpdate(
+			deps({
+				installMethod: { kind: "local-checkout", path: "/home/dev/packed" },
+				isServiceInstalled: () => true,
+				restartService: async () => {
+					restarted = true;
+					return ok();
+				},
+			}),
+		);
+		expect(restarted).toBe(true);
+		expect(report.ok).toBe(true);
+		expect(report.restarted).toBe(true);
+		expect(report.updated).toBe(false);
+	});
+
+	it("runs npm install --global for an npm-global install and reports the version transition", async () => {
+		let args: string[] | undefined;
+		const report = await runSelfUpdate(
+			deps({
+				runNpmInstall: async (a) => {
+					args = a;
+					return ok();
+				},
+				isServiceInstalled: () => false,
+			}),
+		);
+		expect(args).toEqual(["install", "--global", `${PACKED_PACKAGE_NAME}@latest`]);
+		expect(report.updated).toBe(true);
+		expect(report.previousVersion).toBe(VERSION);
+		expect(report.latestVersion).toBe("9.9.9");
+		expect(report.message).toContain("updated via npm");
+	});
+
+	it("fails, never restarting, when npm install itself fails", async () => {
+		let restartCalled = false;
+		const report = await runSelfUpdate(
+			deps({
+				runNpmInstall: async () => failed(1),
+				isServiceInstalled: () => true,
+				restartService: async () => {
+					restartCalled = true;
+					return ok();
+				},
+			}),
+		);
+		expect(report.ok).toBe(false);
+		expect(report.updated).toBe(false);
+		expect(report.restarted).toBe(false);
+		expect(restartCalled).toBe(false);
+		expect(report.message).toContain("npm install --global");
+		expect(report.message).toContain("failed (exit 1)");
+	});
+
+	it("proceeds even when the registry lookup for the latest version fails -- best-effort only", async () => {
+		const report = await runSelfUpdate(
+			deps({
+				registry: {
+					info: async () => {
+						throw new Error("registry down");
+					},
+				},
+				runNpmInstall: async () => ok(),
+				isServiceInstalled: () => false,
+			}),
+		);
+		expect(report.updated).toBe(true);
+		expect(report.latestVersion).toBeUndefined();
+	});
+
+	it("reports no supervised service found, never guessing at a restart", async () => {
+		const report = await runSelfUpdate(
+			deps({
+				runNpmInstall: async () => ok(),
+				isServiceInstalled: () => false,
+			}),
+		);
+		expect(report.ok).toBe(true);
+		expect(report.restarted).toBe(false);
+		expect(report.message).toContain("no supervised pi-packed service was found");
+	});
+
+	it("reports restart-unsupported explicitly when the platform has no restart mechanism wired in", async () => {
+		const report = await runSelfUpdate(
+			deps({
+				runNpmInstall: async () => ok(),
+				isServiceInstalled: () => true,
+				restartService: undefined,
+			}),
+		);
+		expect(report.ok).toBe(true);
+		expect(report.updated).toBe(true);
+		expect(report.restarted).toBe(false);
+		expect(report.message).toContain("isn't supported on this platform yet");
+		expect(report.message).toContain("systemctl --user restart pi-packed.service");
+	});
+
+	it("reports an updated-but-not-restarted outcome, never a full failure, when the restart command itself fails", async () => {
+		const report = await runSelfUpdate(
+			deps({
+				runNpmInstall: async () => ok(),
+				isServiceInstalled: () => true,
+				restartService: async () => failed(3),
+			}),
+		);
+		expect(report.ok).toBe(true);
+		expect(report.updated).toBe(true);
+		expect(report.restarted).toBe(false);
+		expect(report.message).toContain("restarting pi-packed.service failed (exit 3)");
+	});
+
+	it("reports full success when the update and restart both succeed", async () => {
+		const report = await runSelfUpdate(
+			deps({
+				runNpmInstall: async () => ok(),
+				isServiceInstalled: () => true,
+				restartService: async () => ok(),
+			}),
+		);
+		expect(report).toEqual({
+			ok: true,
+			previousVersion: VERSION,
+			latestVersion: "9.9.9",
+			updated: true,
+			restarted: true,
+			message: "updated via npm; restarted the pi-packed service",
+		});
+	});
+
+	it("runs bun add --global for a bun-global install, never touching npm, and reports the version transition", async () => {
+		let bunArgs: string[] | undefined;
+		let npmCalled = false;
+		const report = await runSelfUpdate(
+			deps({
+				installMethod: { kind: "bun-global" },
+				runBunInstall: async (a) => {
+					bunArgs = a;
+					return ok();
+				},
+				runNpmInstall: async () => {
+					npmCalled = true;
+					return ok();
+				},
+				isServiceInstalled: () => false,
+			}),
+		);
+		expect(bunArgs).toEqual(["add", "--global", `${PACKED_PACKAGE_NAME}@latest`]);
+		expect(npmCalled).toBe(false);
+		expect(report.updated).toBe(true);
+		expect(report.previousVersion).toBe(VERSION);
+		expect(report.latestVersion).toBe("9.9.9");
+		expect(report.message).toContain("updated via bun");
+	});
+
+	it("fails, never restarting, when bun add itself fails", async () => {
+		let restartCalled = false;
+		const report = await runSelfUpdate(
+			deps({
+				installMethod: { kind: "bun-global" },
+				runBunInstall: async () => failed(1),
+				isServiceInstalled: () => true,
+				restartService: async () => {
+					restartCalled = true;
+					return ok();
+				},
+			}),
+		);
+		expect(report.ok).toBe(false);
+		expect(report.updated).toBe(false);
+		expect(report.restarted).toBe(false);
+		expect(restartCalled).toBe(false);
+		expect(report.message).toContain("bun add --global");
+		expect(report.message).toContain("failed (exit 1)");
+	});
+
+	it("restarts the service after a successful bun-global update, same as npm-global", async () => {
+		const report = await runSelfUpdate(
+			deps({
+				installMethod: { kind: "bun-global" },
+				runBunInstall: async () => ok(),
+				isServiceInstalled: () => true,
+				restartService: async () => ok(),
+			}),
+		);
+		expect(report).toEqual({
+			ok: true,
+			previousVersion: VERSION,
+			latestVersion: "9.9.9",
+			updated: true,
+			restarted: true,
+			message: "updated via bun; restarted the pi-packed service",
+		});
+	});
+});