@danypops/pi-packed 0.21.11 → 0.21.12

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@danypops/pi-packed",
-  "version": "0.21.11",
+  "version": "0.21.12",
   "description": "Pi package lifecycle, validation, daemon, tools, profiles, and TUI",
   "type": "module",
   "bin": {
@@ -31,6 +31,7 @@
     "@danypops/packed": "^0.7.0",
     "@danypops/pi-extension-harness": "^0.2.0",
     "@danypops/vehicle-client": "^0.5.2",
+    "@danypops/vehicle-client-pi": "^0.16.9",
     "@danypops/vehicle-core": "^0.12.3",
     "@danypops/vehicle-server": "^0.17.1",
     "jiti": "^2.7.0",
@@ -40,7 +41,6 @@
   },
   "devDependencies": {
     "@danypops/pi-tui-harness": "^0.0.1",
-    "@danypops/vehicle-client-pi": "^0.16.2",
     "@types/semver": "^7.7.1"
   },
   "peerDependencies": {

package/service/src/adoption/install-validation.ts

@@ -7,7 +7,10 @@
  * @danypops/pi-extension-harness's own mock-pi-cli
  * subprocess -- a real, isolated process exercising the same production
  * jiti load path Pi's own binary uses -- against every declared
- * pi.extensions entry.
+ * pi.extensions entry. Also runs @danypops/vehicle-client-pi's
+ * pi-load-harness (native ESM, jiti tryNative:false) in its own isolated
+ * subprocess as non-gating, observational evidence alongside that gating
+ * check -- see ExtensionLoadResult.additionalLoadPaths.
  */
 import { existsSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
 import { createRequire } from "node:module";
@@ -18,6 +21,26 @@ export interface ExtensionLoadResult {
 	path: string;
 	ok: boolean;
 	message?: string;
+	/** Non-gating: @danypops/vehicle-client-pi's pi-load-harness checks two
+	 * further Pi extension load paths (native ESM, jiti tryNative:false)
+	 * beyond the one path above (jiti tryNative:true) already gates install.
+	 * Surfaced as observational evidence only, for two independent reasons:
+	 * (1) native-esm can legitimately fail for a perfectly loadable extension
+	 * on an older Node without TS type-stripping support, with no real-world
+	 * signal yet on how often that's a false alarm; (2) this check only
+	 * verifies the module *imports* cleanly -- unlike the gating check above,
+	 * it never calls the extension's exported factory, so it cannot catch a
+	 * factory that throws once actually registered (confirmed directly: the
+	 * BROKEN test fixture, whose factory always throws, reports ok:true on
+	 * every one of these paths). Complementary evidence for an import-time
+	 * failure class, not a broader replacement for the gating check. */
+	additionalLoadPaths?: PiLoadPathResult[];
+}
+
+export interface PiLoadPathResult {
+	path: "native-esm" | "jiti-try-native-false" | "jiti-try-native-true";
+	ok: boolean;
+	error?: string;
 }
 
 export interface InstallValidationResult {
@@ -151,6 +174,28 @@ export async function validateExtensionLoadsHeadless(entryPath: string, timeoutM
 	};
 }
 
+/** Runs the extra two Pi extension load paths @danypops/vehicle-client-pi's
+ * pi-load-harness knows about (native ESM, jiti tryNative:false) against
+ * one entry point, in their own isolated subprocess -- same trust boundary
+ * as validateExtensionLoadsHeadless, never inside the daemon process.
+ * Returns undefined (not a failure) when the probe subprocess itself
+ * couldn't run at all -- vehicle-client-pi is an optional enrichment here,
+ * not a hard requirement the way pi-extension-harness is. */
+async function verifyAllLoadPathsHeadless(entryPath: string, timeoutMs?: number): Promise<PiLoadPathResult[] | undefined> {
+	const bound = bounded(timeoutMs, DEFAULT_LOAD_TIMEOUT_MS, MAX_LOAD_TIMEOUT_MS);
+	const childPath = new URL("verify-load-paths-child.mjs", import.meta.url).pathname;
+	const result = await runCommand(["node", childPath, "--extension", entryPath], tmpdir(), bound);
+	if (result.timedOut) return undefined;
+	const lastLine = result.stdout.trim().split("\n").at(-1);
+	if (!lastLine) return undefined;
+	try {
+		const parsed = JSON.parse(lastLine) as { results?: PiLoadPathResult[]; error?: string };
+		return Array.isArray(parsed.results) ? parsed.results : undefined;
+	} catch {
+		return undefined;
+	}
+}
+
 /** Stages the real npm tarball in isolation and headlessly load-checks
  * every pi.extensions entry it declares. A package with no pi.extensions
  * (most npm packages) or a non-npm source has nothing to validate and
@@ -194,7 +239,8 @@ export class HeadlessInstallValidator implements InstallValidator {
 				// path into a throwaway temp stage dir -- meaningful to a caller,
 				// matches what package.json itself says.
 				const loadResult = await validateExtensionLoadsHeadless(entryPath, this.timeoutMs);
-				extensions.push({ ...loadResult, path: entry });
+				const additionalLoadPaths = await verifyAllLoadPathsHeadless(entryPath, this.timeoutMs);
+				extensions.push({ ...loadResult, path: entry, ...(additionalLoadPaths ? { additionalLoadPaths } : {}) });
 			}
 			const ok = extensions.every((extension) => extension.ok);
 			return { ok, source, extensions, ...(ok ? {} : { message: "one or more declared extensions failed a headless load check" }) };

package/service/src/adoption/verify-load-paths-child.mjs

@@ -0,0 +1,55 @@
+#!/usr/bin/env node
+
+/**
+ * verify-load-paths-child.mjs — spawned in isolation by install-validation.ts
+ * to check a staged candidate's extension entry against every Pi extension
+ * load path @danypops/vehicle-client-pi's pi-load-harness knows about
+ * (native ESM, jiti tryNative:false, jiti tryNative:true) -- not just the
+ * single tryNative:true path mock-pi-cli's own headless check exercises.
+ *
+ * Runs as its own subprocess, same trust boundary as mock-pi-cli: the
+ * candidate's real code executes here, never inside the trusted daemon
+ * process. Uses jiti itself (the same technique mock-pi-cli.mjs already
+ * relies on) to import pi-load-harness's raw TypeScript source -- that
+ * package deliberately ships this subpath uncompiled, since its intended
+ * consumers already run through a TS-transforming toolchain.
+ *
+ * Accepts:
+ *   --extension <path>   candidate extension entry point to check
+ *
+ * Emits exactly one JSON line on stdout, then exits 0 (a probe failure is
+ * data, not a process failure -- the caller decides what a failing path
+ * means):
+ *   { "results": [{ "path": "native-esm", "ok": true }, ...] }
+ * or, if the harness itself couldn't even be loaded/invoked:
+ *   { "error": "..." }
+ */
+
+import { createJiti } from "jiti";
+
+const args = process.argv.slice(2);
+const get = (flag) => {
+	const i = args.indexOf(flag);
+	return i !== -1 ? args[i + 1] : null;
+};
+
+const extensionPath = get("--extension");
+if (!extensionPath) {
+	process.stderr.write("--extension required\n");
+	process.exit(1);
+}
+
+function emit(obj) {
+	process.stdout.write(`${JSON.stringify(obj)}\n`);
+}
+
+try {
+	const jiti = createJiti(import.meta.url, { moduleCache: false });
+	const { verifyLoadableUnderPi } = await jiti.import("@danypops/vehicle-client-pi/pi-load-harness");
+	const results = await verifyLoadableUnderPi(extensionPath);
+	emit({ results });
+	process.exit(0);
+} catch (err) {
+	emit({ error: err?.message ?? String(err) });
+	process.exit(1);
+}

package/service/test/install-validation.test.ts

@@ -106,7 +106,40 @@ describe("HeadlessInstallValidator (real npm pack + tar extraction, no mocking)"
 		const validator = new HeadlessInstallValidator();
 		const result = await validator.validate(`npm:${HEALTHY}`);
 		expect(result.ok).toBe(true);
-		expect(result.extensions).toEqual([{ path: "extension/index.ts", ok: true }]);
+		expect(result.extensions).toHaveLength(1);
+		expect(result.extensions[0]).toMatchObject({ path: "extension/index.ts", ok: true });
+	}, 20_000);
+});
+
+describe("HeadlessInstallValidator (vehicle-client-pi pi-load-harness, non-gating diagnostic)", () => {
+	it("attaches all-three-path evidence for a real healthy package without changing its ok:true verdict", async () => {
+		const validator = new HeadlessInstallValidator();
+		const result = await validator.validate(`npm:${HEALTHY}`);
+		expect(result.ok).toBe(true);
+		expect(result.extensions).toHaveLength(1);
+		const paths = result.extensions[0]?.additionalLoadPaths;
+		expect(paths).toBeDefined();
+		expect(paths?.map((p) => p.path).sort()).toEqual(["jiti-try-native-false", "jiti-try-native-true", "native-esm"]);
+		expect(paths?.every((p) => p.ok)).toBe(true);
+	}, 20_000);
+
+	it("reports the broken fixture's additional paths as ok:true -- documents a real, deliberate difference in what's checked, not a bug", async () => {
+		// verifyLoadableUnderPi only checks that *importing* the module succeeds;
+		// it never calls the extension's exported factory the way mock-pi-cli's
+		// gating check does. BROKEN's factory only throws once invoked, so
+		// merely importing it succeeds on every path -- confirmed directly
+		// against the real child process, not assumed. The two checks answer
+		// genuinely different questions (import-time vs. factory-execution-time
+		// failure) and are complementary for exactly that reason; this test
+		// exists so a future change that makes them silently agree (e.g. an
+		// accidental factory invocation creeping into the load-path check)
+		// gets caught as a real behavior change.
+		const validator = new HeadlessInstallValidator();
+		const result = await validator.validate(`npm:${BROKEN}`);
+		expect(result.ok).toBe(false); // the gating check still refuses it
+		const paths = result.extensions[0]?.additionalLoadPaths;
+		expect(paths).toBeDefined();
+		expect(paths?.every((p) => p.ok === true)).toBe(true);
 	}, 20_000);
 });
 
@@ -131,7 +164,8 @@ describe("HeadlessInstallValidator (bug repro, packed-headlessinstallvalidator-n
 		const validator = new HeadlessInstallValidator();
 		const result = await validator.validate(`npm:${dir}`);
 		expect(result.ok).toBe(true);
-		expect(result.extensions).toEqual([{ path: "extension/index.ts", ok: true }]);
+		expect(result.extensions).toHaveLength(1);
+		expect(result.extensions[0]).toMatchObject({ path: "extension/index.ts", ok: true });
 	}, 30_000);
 });