@danypops/pi-packed 0.21.10 → 0.21.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@danypops/pi-packed",
-  "version": "0.21.10",
+  "version": "0.21.11",
   "description": "Pi package lifecycle, validation, daemon, tools, profiles, and TUI",
   "type": "module",
   "bin": {

package/service/src/adoption/install-validation.ts

@@ -3,7 +3,8 @@
  * for ExecInstaller.install(), so a package that crashes at registration
  * time never gets fully wired into ~/.pi/npm and ~/.pi/agent in the first
  * place. Stages the real npm tarball into a throwaway temp dir (never the
- * live piHome), then runs @danypops/pi-extension-harness's own mock-pi-cli
+ * live piHome), installs its own declared dependencies there, then runs
+ * @danypops/pi-extension-harness's own mock-pi-cli
  * subprocess -- a real, isolated process exercising the same production
  * jiti load path Pi's own binary uses -- against every declared
  * pi.extensions entry.
@@ -33,6 +34,7 @@ export interface InstallValidator {
 const DEFAULT_LOAD_TIMEOUT_MS = 8_000;
 const MAX_LOAD_TIMEOUT_MS = 30_000;
 const PACK_TIMEOUT_MS = 30_000;
+const INSTALL_TIMEOUT_MS = 60_000;
 const MAX_EXTENSIONS = 20;
 
 function bounded(value: number | undefined, fallback: number, maximum: number): number {
@@ -96,6 +98,19 @@ async function stageNpmTarball(spec: string, stageDir: string): Promise<StageRes
 	return { ok: true, root };
 }
 
+/** Installs the staged tarball's own declared dependencies -- npm pack +
+ * tar only extract the package's own files, never fetch what its
+ * package.json requires. --ignore-scripts keeps an untrusted candidate's
+ * lifecycle scripts from running during a headless check nobody explicitly
+ * approved; --omit=dev matches what the entry point actually needs at
+ * runtime (jiti loads its TS source directly, no separate build step). */
+async function installStagedDependencies(root: string): Promise<{ ok: true } | { ok: false; message: string }> {
+	const install = await runCommand(["npm", "install", "--ignore-scripts", "--omit=dev", "--no-audit", "--no-fund"], root, INSTALL_TIMEOUT_MS);
+	if (install.timedOut) return { ok: false, message: `npm install exceeded ${INSTALL_TIMEOUT_MS}ms installing the staged package's own dependencies` };
+	if (install.code !== 0) return { ok: false, message: (install.stderr.trim() || `npm install exited ${install.code}`).slice(0, 2_000) };
+	return { ok: true };
+}
+
 /** Runs pi-extension-harness's mock-pi-cli against one extension entry
  * point, in its own load-only mode (--tool omitted): a real, isolated
  * subprocess exercising Pi's own production jiti load path. */
@@ -165,6 +180,9 @@ export class HeadlessInstallValidator implements InstallValidator {
 				: [];
 			if (declared.length === 0) return { ok: true, source, extensions: [] };
 
+			const installed = await installStagedDependencies(staged.root);
+			if (!installed.ok) return { ok: false, source, extensions: [], message: installed.message };
+
 			const extensions: ExtensionLoadResult[] = [];
 			for (const entry of declared) {
 				const entryPath = resolve(staged.root, entry);

package/service/test/fixtures/install-validation/dep-package/index.js

@@ -0,0 +1,3 @@
+export function greet() {
+	return "hello from packed-fixture-dep";
+}

package/service/test/fixtures/install-validation/dep-package/package.json

@@ -0,0 +1,7 @@
+{
+	"name": "packed-fixture-dep",
+	"version": "1.0.0",
+	"private": true,
+	"type": "module",
+	"main": "index.js"
+}

package/service/test/install-validation.test.ts

@@ -8,7 +8,7 @@
  * pass.
  */
 import { describe, expect, it } from "bun:test";
-import { mkdirSync, mkdtempSync } from "node:fs";
+import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -21,6 +21,39 @@ const FIXTURES = join(__dirname, "fixtures/install-validation");
 const HEALTHY = join(FIXTURES, "healthy-package");
 const BROKEN = join(FIXTURES, "broken-package");
 const NO_MANIFEST = join(FIXTURES, "no-manifest-package");
+const DEP_PACKAGE = join(FIXTURES, "dep-package");
+
+/** Writes a fresh package into `dir` whose extension entry point has a real
+ * runtime import (`packed-fixture-dep`, a `file:` dependency resolvable
+ * fully offline) -- otherwise healthy, structurally identical to HEALTHY,
+ * except its one declared dependency must actually be installed into the
+ * staged tarball for its entry point to load at all. The file: target is
+ * an absolute path computed at test time (checkout-independent), so this
+ * can't be a static checked-in fixture the way HEALTHY/BROKEN are. */
+function writePackageWithRealDependency(dir: string): void {
+	mkdirSync(join(dir, "extension"), { recursive: true });
+	writeFileSync(
+		join(dir, "package.json"),
+		JSON.stringify({
+			name: "packed-install-validation-fixture-with-dependency",
+			version: "1.0.0",
+			private: true,
+			pi: { extensions: ["extension/index.ts"] },
+			dependencies: { "packed-fixture-dep": `file:${DEP_PACKAGE}` },
+		}),
+	);
+	writeFileSync(
+		join(dir, "extension/index.ts"),
+		[
+			'import { greet } from "packed-fixture-dep";',
+			"",
+			"export default function withDependencyFixtureExtension(pi: { registerCommand: (name: string, def: unknown) => void }) {",
+			'\tpi.registerCommand("with-dependency-fixture", { description: greet(), handler: async () => {} });',
+			"}",
+			"",
+		].join("\n"),
+	);
+}
 
 describe("bareNpmSpec", () => {
 	it("strips the npm: scheme", () => {
@@ -77,6 +110,31 @@ describe("HeadlessInstallValidator (real npm pack + tar extraction, no mocking)"
 	}, 20_000);
 });
 
+describe("HeadlessInstallValidator (bug repro, packed-headlessinstallvalidator-never-installs-the): staged tarball's own declared dependencies are never installed before the load check", () => {
+	it("approves an otherwise-healthy package whose entry point needs its one declared file: dependency", async () => {
+		const dir = mkdtempSync(join(tmpdir(), "packed-install-validation-dep-fixture-"));
+		writePackageWithRealDependency(dir);
+
+		// Ground truth this isn't a broken fixture: a plain `bun install` in an
+		// identical staged copy resolves and loads it fine (mirrors the real
+		// @danypops/pi-pipes repro: `npm pack` + `tar -xzf` + `bun install`
+		// succeeds outside of HeadlessInstallValidator).
+		const install = await Bun.spawn(["bun", "install", "--no-save"], { cwd: dir, stdout: "pipe", stderr: "pipe" }).exited;
+		expect(install).toBe(0);
+		const directLoad = await validateExtensionLoadsHeadless(join(dir, "extension/index.ts"));
+		expect(directLoad.ok).toBe(true);
+
+		// The real bug: HeadlessInstallValidator stages its own fresh copy via
+		// npm pack + tar (never running bun/npm install in that copy), so the
+		// same otherwise-healthy package fails the load check purely because
+		// its declared dependency was never installed into *that* copy.
+		const validator = new HeadlessInstallValidator();
+		const result = await validator.validate(`npm:${dir}`);
+		expect(result.ok).toBe(true);
+		expect(result.extensions).toEqual([{ path: "extension/index.ts", ok: true }]);
+	}, 30_000);
+});
+
 describe("ExecInstaller.install() -- refuses before ever spawning the real pi binary", () => {
 	function fakeValidator(result: InstallValidationResult): InstallValidator {
 		return { validate: async () => result };