@danypops/pi-packed 0.21.14 → 0.22.0

package/service/test/install.test.ts

@@ -159,6 +159,235 @@ describe("ExecInstaller.update() — honest reloadRequired despite pi's ambiguou
 	});
 });
 
+describe("ExecInstaller.update() — out-of-range update detection (confirmed live: a 0.x package past its own caret boundary reported a bare 'already up to date')", () => {
+	it("alreadyUpToDate but a real newer version exists outside the declared range: reports outOfRangeUpdateAvailable", async () => {
+		const scriptDir = track(mkdtempSync(join(tmpdir(), "packed-exec-bin-")));
+		const bin = writeFakePi(scriptDir); // no rewrite: `pi update` genuinely no-ops, bound by ^0.9.8
+		const npmBin = writeFakeNpm(scriptDir, join(scriptDir, "npm.log"));
+		const piHome = writePiHome({ "@scope/pkg": "0.9.8" });
+		const installer = new ExecInstaller(bin, piHome, undefined, npmBin, undefined, (name) =>
+			name === "@scope/pkg" ? "0.10.0" : undefined,
+		);
+
+		const outcome = await installer.update("npm:@scope/pkg@0.9.8");
+
+		expect(outcome.alreadyUpToDate).toBe(true);
+		expect(outcome.reloadRequired).toBe(false);
+		expect(outcome.outOfRangeUpdateAvailable).toBe("0.10.0");
+	});
+
+	it("alreadyUpToDate and genuinely current against the mirror too: no outOfRangeUpdateAvailable", async () => {
+		const scriptDir = track(mkdtempSync(join(tmpdir(), "packed-exec-bin-")));
+		const bin = writeFakePi(scriptDir);
+		const npmBin = writeFakeNpm(scriptDir, join(scriptDir, "npm.log"));
+		const piHome = writePiHome({ plain: "0.5.0" });
+		const installer = new ExecInstaller(bin, piHome, undefined, npmBin, undefined, () => "0.5.0");
+
+		const outcome = await installer.update("npm:plain");
+
+		expect(outcome.alreadyUpToDate).toBe(true);
+		expect(outcome.outOfRangeUpdateAvailable).toBeUndefined();
+	});
+
+	it("no latestOf wired in at all: behaves exactly as before (no cross-check attempted)", async () => {
+		const scriptDir = track(mkdtempSync(join(tmpdir(), "packed-exec-bin-")));
+		const bin = writeFakePi(scriptDir);
+		const npmBin = writeFakeNpm(scriptDir, join(scriptDir, "npm.log"));
+		const piHome = writePiHome({ "@scope/pkg": "0.9.8" });
+		const installer = new ExecInstaller(bin, piHome, undefined, npmBin);
+
+		const outcome = await installer.update("npm:@scope/pkg@0.9.8");
+
+		expect(outcome.alreadyUpToDate).toBe(true);
+		expect(outcome.outOfRangeUpdateAvailable).toBeUndefined();
+	});
+
+	it("a real version change happened: never reports outOfRangeUpdateAvailable even if the mirror knows a still-newer version", async () => {
+		const scriptDir = track(mkdtempSync(join(tmpdir(), "packed-exec-bin-")));
+		const piHome = writePiHome({ plain: "0.5.0" });
+		const bin = writeFakePi(scriptDir, { piHome, name: "plain", newVersion: "0.6.0" });
+		const npmBin = writeFakeNpm(scriptDir, join(scriptDir, "npm.log"));
+		const installer = new ExecInstaller(bin, piHome, undefined, npmBin, undefined, () => "0.7.0");
+
+		const outcome = await installer.update("npm:plain");
+
+		expect(outcome.alreadyUpToDate).toBe(false);
+		expect(outcome.reloadRequired).toBe(true);
+		expect(outcome.outOfRangeUpdateAvailable).toBeUndefined();
+	});
+});
+
+/**
+ * A real, general-purpose fake `pi` binary for replace() tests -- unlike
+ * writeFakePi/writeFakeNpm above (each tailored to one specific pre-baked
+ * rewrite), this one genuinely implements `install <source>`/`remove
+ * <source>` against a real piHome: writes/removes the real
+ * node_modules/<name>/package.json entry AND the real settings.json
+ * packages[] entry, exactly like the two-step remove+install sequence
+ * replace() actually drives. A plain bun script (not bash) so exact-pin
+ * name/version parsing (scoped packages, the LAST "@" only) is real JS,
+ * not fragile shell string splitting.
+ */
+function writeFakeReplacePi(dir: string, piHome: string, options: { failInstallFor?: string } = {}): string {
+	const script = join(dir, "fake-replace-pi");
+	const body = `
+const piHome = ${JSON.stringify(piHome)};
+const failInstallFor = ${JSON.stringify(options.failInstallFor ?? null)};
+const fs = require("node:fs");
+const path = require("node:path");
+
+function bareName(source) {
+	const spec = source.startsWith("npm:") ? source.slice(4) : source;
+	const at = spec.lastIndexOf("@");
+	return at > 0 ? spec.slice(0, at) : spec;
+}
+function versionOf(source) {
+	const spec = source.startsWith("npm:") ? source.slice(4) : source;
+	const at = spec.lastIndexOf("@");
+	return at > 0 ? spec.slice(at + 1) : undefined;
+}
+function readSettings() {
+	try {
+		return JSON.parse(fs.readFileSync(path.join(piHome, "settings.json"), "utf8"));
+	} catch {
+		return { packages: [] };
+	}
+}
+function writeSettings(settings) {
+	fs.writeFileSync(path.join(piHome, "settings.json"), JSON.stringify(settings, null, 2));
+}
+function entrySource(entry) {
+	return typeof entry === "string" ? entry : entry && typeof entry === "object" ? entry.source : undefined;
+}
+
+const [cmd, ...rest] = process.argv.slice(2);
+const args = rest.filter((a) => a !== "-l");
+const source = args[args.length - 1];
+const name = bareName(source);
+
+if (cmd === "install") {
+	if (failInstallFor && source === failInstallFor) {
+		process.stderr.write("simulated install failure for " + source + "\\n");
+		process.exit(1);
+	}
+	const version = versionOf(source) ?? "0.0.0";
+	const pkgDir = path.join(piHome, "npm", "node_modules", name);
+	fs.mkdirSync(pkgDir, { recursive: true });
+	fs.writeFileSync(path.join(pkgDir, "package.json"), JSON.stringify({ name, version }));
+	const settings = readSettings();
+	const packages = (settings.packages ?? []).filter((e) => bareName(entrySource(e) ?? "") !== name);
+	packages.push(source);
+	writeSettings({ ...settings, packages });
+	process.stdout.write("Installed " + source + "\\n");
+	process.exit(0);
+}
+if (cmd === "remove") {
+	const pkgDir = path.join(piHome, "npm", "node_modules", name);
+	fs.rmSync(pkgDir, { recursive: true, force: true });
+	const settings = readSettings();
+	const packages = (settings.packages ?? []).filter((e) => bareName(entrySource(e) ?? "") !== name);
+	writeSettings({ ...settings, packages });
+	process.stdout.write("Removed " + source + "\\n");
+	process.exit(0);
+}
+process.stderr.write("unsupported command: " + cmd + "\\n");
+process.exit(1);
+`;
+	writeFileSync(script, `#!/usr/bin/env bun\n${body}`);
+	chmodSync(script, 0o755);
+	return script;
+}
+
+describe("ExecInstaller.update({ target }) — the supervised replace() workflow for moving an exact pin", () => {
+	function setup(options: { failInstallFor?: string } = {}) {
+		const scriptDir = track(mkdtempSync(join(tmpdir(), "packed-replace-bin-")));
+		const piHome = writePiHome();
+		mkdirSync(piHome, { recursive: true });
+		writeFileSync(join(piHome, "settings.json"), JSON.stringify({ packages: [] }));
+		const bin = writeFakeReplacePi(scriptDir, piHome, options);
+		const npmBin = writeFakeNpm(scriptDir, join(scriptDir, "npm.log"));
+		const validator = { validate: async (source: string) => ({ ok: true as const, source, extensions: [] }) };
+		const installer = new ExecInstaller(bin, piHome, validator, npmBin);
+		return { piHome, installer };
+	}
+
+	function configurePinned(piHome: string, entry: unknown): void {
+		writeFileSync(join(piHome, "settings.json"), JSON.stringify({ packages: [entry] }));
+	}
+
+	it("replaces an exact pin end to end: removes the old entry, installs the new one, verifies both postconditions", async () => {
+		const { piHome, installer } = setup();
+		configurePinned(piHome, "npm:@scope/pkg@1.0.0");
+		mkdirSync(join(piHome, "npm", "node_modules", "@scope", "pkg"), { recursive: true });
+		writeFileSync(join(piHome, "npm", "node_modules", "@scope", "pkg", "package.json"), JSON.stringify({ version: "1.0.0" }));
+
+		const outcome = await installer.update("npm:@scope/pkg@1.0.0", { target: "npm:@scope/pkg@2.0.0" });
+
+		expect(outcome.replaced).toBe(true);
+		expect(outcome.before).toEqual({ source: "npm:@scope/pkg@1.0.0", version: "1.0.0" });
+		expect(outcome.after).toEqual({ source: "npm:@scope/pkg@2.0.0", version: "2.0.0" });
+		expect(outcome.reloadRequired).toBe(true);
+		expect(outcome.alreadyUpToDate).toBe(false);
+		expect(outcome.currentVersion).toBe("2.0.0");
+		const settings = JSON.parse(readFileSync(join(piHome, "settings.json"), "utf8"));
+		expect(settings.packages).toEqual(["npm:@scope/pkg@2.0.0"]);
+	});
+
+	it("rejects a target that names a different package, before mutating anything", async () => {
+		const { piHome, installer } = setup();
+		configurePinned(piHome, "npm:@scope/pkg@1.0.0");
+
+		await expect(installer.update("npm:@scope/pkg@1.0.0", { target: "npm:@scope/other@1.0.0" })).rejects.toThrow(
+			/same package/,
+		);
+		const settings = JSON.parse(readFileSync(join(piHome, "settings.json"), "utf8"));
+		expect(settings.packages).toEqual(["npm:@scope/pkg@1.0.0"]);
+	});
+
+	it("rolls back to the original pin when installing the new target fails", async () => {
+		const { piHome, installer } = setup({ failInstallFor: "npm:@scope/pkg@2.0.0" });
+		configurePinned(piHome, "npm:@scope/pkg@1.0.0");
+		mkdirSync(join(piHome, "npm", "node_modules", "@scope", "pkg"), { recursive: true });
+		writeFileSync(join(piHome, "npm", "node_modules", "@scope", "pkg", "package.json"), JSON.stringify({ version: "1.0.0" }));
+
+		await expect(installer.update("npm:@scope/pkg@1.0.0", { target: "npm:@scope/pkg@2.0.0" })).rejects.toThrow(
+			/rolled back to npm:@scope\/pkg@1\.0\.0/,
+		);
+		const settings = JSON.parse(readFileSync(join(piHome, "settings.json"), "utf8"));
+		expect(settings.packages).toEqual(["npm:@scope/pkg@1.0.0"]);
+		expect(JSON.parse(readFileSync(join(piHome, "npm", "node_modules", "@scope", "pkg", "package.json"), "utf8")).version).toBe("1.0.0");
+	});
+
+	it("preserves the old entry's own filter overrides onto the freshly-installed replacement entry", async () => {
+		const { piHome, installer } = setup();
+		configurePinned(piHome, { source: "npm:@scope/pkg@1.0.0", extensions: ["-extensions/one.ts"] });
+		mkdirSync(join(piHome, "npm", "node_modules", "@scope", "pkg"), { recursive: true });
+		writeFileSync(join(piHome, "npm", "node_modules", "@scope", "pkg", "package.json"), JSON.stringify({ version: "1.0.0" }));
+
+		await installer.update("npm:@scope/pkg@1.0.0", { target: "npm:@scope/pkg@2.0.0" });
+
+		const settings = JSON.parse(readFileSync(join(piHome, "settings.json"), "utf8"));
+		expect(settings.packages).toEqual([{ source: "npm:@scope/pkg@2.0.0", extensions: ["-extensions/one.ts"] }]);
+	});
+
+	it("reports pinnedSourceRequiresTarget on a plain update() call against an unchanged exact pin, with no target given", async () => {
+		// This scenario needs the ORIGINAL "always prints Updated, changes
+		// nothing for a pin" fake pi -- writeFakeReplacePi only implements
+		// install/remove, not update --extension.
+		const scriptDir = track(mkdtempSync(join(tmpdir(), "packed-replace-bin-")));
+		const piHome = writePiHome({ "@scope/pkg": "1.0.0" });
+		const bin = writeFakePi(scriptDir);
+		const npmBin = writeFakeNpm(scriptDir, join(scriptDir, "npm.log"));
+		const plainInstaller = new ExecInstaller(bin, piHome, undefined, npmBin);
+
+		const outcome = await plainInstaller.update("npm:@scope/pkg@1.0.0");
+
+		expect(outcome.pinned).toBe(true);
+		expect(outcome.alreadyUpToDate).toBe(true);
+		expect(outcome.pinnedSourceRequiresTarget).toBe(true);
+	});
+});
+
 describe("ExecInstaller — forces full dependency re-resolution, not just the target's own subtree", () => {
 	it("update() fixes a stale root-level sibling that the targeted pi update never touched", async () => {
 		const scriptDir = track(mkdtempSync(join(tmpdir(), "packed-exec-bin-")));

package/service/test/module-freshness.test.ts

@@ -0,0 +1,146 @@
+/**
+ * module-freshness.test.ts — the "X is not a constructor" pattern this
+ * exists to catch: a long-running process's in-memory copy of a dependency
+ * going stale after an on-disk update, with the process itself none the
+ * wiser until restarted.
+ */
+import { afterEach, describe, expect, it } from "bun:test";
+import { mkdirSync, mkdtempSync, rmSync, utimesSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+	captureLoadedModule,
+	captureLoadedModules,
+	checkModuleFreshness,
+	checkModuleFreshnessAll,
+	ownRuntimeDependencyNames,
+} from "../src/adoption/module-freshness.ts";
+
+const roots: string[] = [];
+afterEach(() => {
+	for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
+});
+
+function track(dir: string): string {
+	roots.push(dir);
+	return dir;
+}
+
+function writeDependency(nodeModulesDir: string, name: string, version: string): string {
+	const dir = join(nodeModulesDir, name);
+	mkdirSync(dir, { recursive: true });
+	const packageJsonPath = join(dir, "package.json");
+	writeFileSync(packageJsonPath, JSON.stringify({ name, version }));
+	return packageJsonPath;
+}
+
+function fromPackageDir(): string {
+	const dir = track(mkdtempSync(join(tmpdir(), "packed-module-freshness-")));
+	writeFileSync(join(dir, "package.json"), JSON.stringify({ name: "consumer", version: "1.0.0" }));
+	return dir;
+}
+
+describe("captureLoadedModule / checkModuleFreshness", () => {
+	it("reports not stale immediately after capture -- nothing has changed yet", () => {
+		const fromDir = fromPackageDir();
+		writeDependency(join(fromDir, "node_modules"), "watched-dep", "1.0.0");
+
+		const snapshot = captureLoadedModule(fromDir, "watched-dep");
+		expect(snapshot).toBeDefined();
+		expect(snapshot!.version).toBe("1.0.0");
+
+		const diagnostic = checkModuleFreshness(snapshot!);
+		expect(diagnostic.stale).toBe(false);
+		expect(diagnostic.loadedVersion).toBe("1.0.0");
+		expect(diagnostic.currentVersion).toBe("1.0.0");
+	});
+
+	it("reports stale once the on-disk package.json is rewritten after the snapshot was taken -- the exact confirmed-live pattern", async () => {
+		const fromDir = fromPackageDir();
+		const packageJsonPath = writeDependency(join(fromDir, "node_modules"), "watched-dep", "1.0.0");
+		const snapshot = captureLoadedModule(fromDir, "watched-dep")!;
+
+		// Simulate a pkg_update landing a new build while this process (whose
+		// own snapshot was already taken) keeps running -- rewrite the file
+		// and force its mtime forward, since two writes in the same tick can
+		// otherwise land on an indistinguishable mtime on a fast filesystem.
+		writeFileSync(packageJsonPath, JSON.stringify({ name: "watched-dep", version: "2.0.0" }));
+		const future = new Date(Date.now() + 5_000);
+		utimesSync(packageJsonPath, future, future);
+
+		const diagnostic = checkModuleFreshness(snapshot);
+		expect(diagnostic.stale).toBe(true);
+		expect(diagnostic.loadedVersion).toBe("1.0.0");
+		expect(diagnostic.currentVersion).toBe("2.0.0");
+	});
+
+	it("never reports stale when either mtime is unknown -- never guesses from version alone", () => {
+		const fromDir = fromPackageDir();
+		const packageJsonPath = writeDependency(join(fromDir, "node_modules"), "watched-dep", "1.0.0");
+		const snapshot = { name: "watched-dep", packageJsonPath, version: "1.0.0", mtimeMs: undefined };
+
+		expect(checkModuleFreshness(snapshot).stale).toBe(false);
+	});
+
+	it("returns undefined (never throws) when the dependency isn't resolvable from here at all", () => {
+		const fromDir = fromPackageDir();
+		expect(captureLoadedModule(fromDir, "does-not-exist-anywhere")).toBeUndefined();
+	});
+});
+
+describe("captureLoadedModules / checkModuleFreshnessAll -- bulk, one unresolvable name never blocks the rest", () => {
+	it("captures every resolvable name and silently skips the rest", () => {
+		const fromDir = fromPackageDir();
+		writeDependency(join(fromDir, "node_modules"), "dep-a", "1.0.0");
+		writeDependency(join(fromDir, "node_modules"), "dep-b", "2.0.0");
+
+		const snapshots = captureLoadedModules(fromDir, ["dep-a", "dep-b", "dep-missing"]);
+
+		expect(snapshots.map((s) => s.name)).toEqual(["dep-a", "dep-b"]);
+	});
+
+	it("checks every captured snapshot and reports which ones went stale", () => {
+		const fromDir = fromPackageDir();
+		const staleDepPath = writeDependency(join(fromDir, "node_modules"), "dep-a", "1.0.0");
+		writeDependency(join(fromDir, "node_modules"), "dep-b", "2.0.0");
+		const snapshots = captureLoadedModules(fromDir, ["dep-a", "dep-b"]);
+
+		writeFileSync(staleDepPath, JSON.stringify({ name: "dep-a", version: "1.1.0" }));
+		const future = new Date(Date.now() + 5_000);
+		utimesSync(staleDepPath, future, future);
+
+		const diagnostics = checkModuleFreshnessAll(snapshots);
+		expect(diagnostics.find((d) => d.name === "dep-a")?.stale).toBe(true);
+		expect(diagnostics.find((d) => d.name === "dep-b")?.stale).toBe(false);
+	});
+});
+
+describe("ownRuntimeDependencyNames", () => {
+	it("returns exactly the dependencies field's keys, never devDependencies/peerDependencies", () => {
+		const dir = track(mkdtempSync(join(tmpdir(), "packed-module-freshness-pkg-")));
+		const packageJsonPath = join(dir, "package.json");
+		writeFileSync(
+			packageJsonPath,
+			JSON.stringify({
+				name: "pkg",
+				dependencies: { "runtime-a": "^1.0.0", "runtime-b": "^2.0.0" },
+				devDependencies: { "dev-only": "^1.0.0" },
+				peerDependencies: { "peer-only": "*" },
+			}),
+		);
+
+		expect(ownRuntimeDependencyNames(packageJsonPath)).toEqual(["runtime-a", "runtime-b"]);
+	});
+
+	it("returns an empty array, never throws, for a missing or malformed package.json", () => {
+		expect(ownRuntimeDependencyNames("/nonexistent/package.json")).toEqual([]);
+	});
+
+	it("returns an empty array when dependencies is absent", () => {
+		const dir = track(mkdtempSync(join(tmpdir(), "packed-module-freshness-pkg-")));
+		const packageJsonPath = join(dir, "package.json");
+		writeFileSync(packageJsonPath, JSON.stringify({ name: "pkg" }));
+
+		expect(ownRuntimeDependencyNames(packageJsonPath)).toEqual([]);
+	});
+});

package/service/test/resources.test.ts

@@ -5,7 +5,7 @@ import { join } from "node:path";
 import { AuthenticatedRpcClient } from "@danypops/vehicle-client/rpc-client";
 import { createApp, type OperationInputs, type OperationName, type OperationOutputs } from "../src/daemon/service.ts";
 import type { Installer, PkgInfo, Registry, SearchPage } from "../src/packages/package.ts";
-import { listPackageResources, toggleResource } from "../src/packages/resources.ts";
+import { applyEntryFilters, captureEntryFilters, listPackageResources, toggleResource } from "../src/packages/resources.ts";
 
 const roots: string[] = [];
 afterEach(() => {
@@ -258,3 +258,68 @@ describe("toggleResource", () => {
 		expect(result.error).toContain("not found");
 	});
 });
+
+describe("captureEntryFilters / applyEntryFilters (preserving a pinned package's own filter overrides across a replace)", () => {
+	it("captures every filter field an object-form entry declares", () => {
+		const home = piHome([{ source: "npm:pi-demo@1.0.0", extensions: ["-extensions/one.ts"], skills: ["+skills/two.md"] }]);
+
+		const filters = captureEntryFilters(join(home, "settings.json"), "npm:pi-demo@1.0.0");
+
+		expect(filters).toEqual({ extensions: ["-extensions/one.ts"], skills: ["+skills/two.md"] });
+	});
+
+	it("returns undefined for a bare string entry -- nothing to preserve", () => {
+		const home = piHome(["npm:pi-demo@1.0.0"]);
+		expect(captureEntryFilters(join(home, "settings.json"), "npm:pi-demo@1.0.0")).toBeUndefined();
+	});
+
+	it("returns undefined when the source isn't found at all", () => {
+		const home = piHome(["npm:other"]);
+		expect(captureEntryFilters(join(home, "settings.json"), "npm:pi-demo@1.0.0")).toBeUndefined();
+	});
+
+	it("re-applies captured filters onto the new source's own freshly-installed bare-string entry", async () => {
+		const home = piHome(["npm:pi-demo@2.0.0"]);
+		const settingsPath = join(home, "settings.json");
+
+		const ok = await applyEntryFilters(settingsPath, "npm:pi-demo@2.0.0", { extensions: ["-extensions/one.ts"] });
+
+		expect(ok).toBe(true);
+		const written = JSON.parse(readFileSync(settingsPath, "utf8"));
+		expect(written.packages).toEqual([{ source: "npm:pi-demo@2.0.0", extensions: ["-extensions/one.ts"] }]);
+	});
+
+	it("is a no-op (still ok:true) when there are no filters to preserve", async () => {
+		const home = piHome(["npm:pi-demo@2.0.0"]);
+		const settingsPath = join(home, "settings.json");
+
+		expect(await applyEntryFilters(settingsPath, "npm:pi-demo@2.0.0", undefined)).toBe(true);
+		const written = JSON.parse(readFileSync(settingsPath, "utf8"));
+		expect(written.packages).toEqual(["npm:pi-demo@2.0.0"]);
+	});
+
+	it("reports failure (never throws) when the target entry doesn't exist yet -- e.g. install itself failed", async () => {
+		const home = piHome(["npm:unrelated"]);
+		const settingsPath = join(home, "settings.json");
+
+		const ok = await applyEntryFilters(settingsPath, "npm:pi-demo@2.0.0", { extensions: ["-extensions/one.ts"] });
+
+		expect(ok).toBe(false);
+	});
+
+	it("round-trips through a real capture-then-apply replace simulation", async () => {
+		const home = piHome([{ source: "npm:pi-demo@1.0.0", extensions: ["-extensions/one.ts"] }]);
+		const settingsPath = join(home, "settings.json");
+		const filters = captureEntryFilters(settingsPath, "npm:pi-demo@1.0.0");
+
+		// Simulate remove()+install(): the old entry is gone, a fresh bare-string
+		// entry exists for the new pinned version.
+		writeFileSync(settingsPath, JSON.stringify({ packages: ["npm:pi-demo@2.0.0"] }));
+
+		const ok = await applyEntryFilters(settingsPath, "npm:pi-demo@2.0.0", filters);
+
+		expect(ok).toBe(true);
+		const written = JSON.parse(readFileSync(settingsPath, "utf8"));
+		expect(written.packages).toEqual([{ source: "npm:pi-demo@2.0.0", extensions: ["-extensions/one.ts"] }]);
+	});
+});

package/service/test/service.test.ts

@@ -52,8 +52,10 @@ class FakeInstaller implements Installer {
 		return this.output;
 	}
 	updateOutcome: Partial<UpdateOutcome> = {};
-	async update(source: string): Promise<UpdateOutcome> {
+	gotTarget: string | undefined;
+	async update(source: string, options?: { target?: string }): Promise<UpdateOutcome> {
 		this.updated = source;
+		this.gotTarget = options?.target;
 		return { output: this.output, reloadRequired: true, alreadyUpToDate: false, pinned: false, ...this.updateOutcome };
 	}
 }
@@ -539,6 +541,71 @@ describe("service app", () => {
 		});
 	});
 
+	it("POST /update threads target through to the installer and validates it the same way as source", async () => {
+		const inst = new FakeInstaller();
+		const app = createApp(deps({ inst }));
+		const invalidTarget = await app.fetch(
+			new Request("http://x/update", {
+				method: "POST",
+				headers: { ...auth, "content-type": "application/json" },
+				body: JSON.stringify({ source: "npm:@scope/pkg@1.0.0", target: "not a valid source!", approved: true }),
+			}),
+		);
+		expect(invalidTarget.status).toBe(400);
+		expect(inst.updated).toBe("");
+
+		const valid = await app.fetch(
+			new Request("http://x/update", {
+				method: "POST",
+				headers: { ...auth, "content-type": "application/json" },
+				body: JSON.stringify({ source: "npm:@scope/pkg@1.0.0", target: "npm:@scope/pkg@2.0.0", approved: true }),
+			}),
+		);
+		expect(valid.status).toBe(200);
+		expect(inst.updated).toBe("npm:@scope/pkg@1.0.0");
+		expect(inst.gotTarget).toBe("npm:@scope/pkg@2.0.0");
+	});
+
+	it("POST /update reconciles the Vehicle under the NEW (target) source after a replace, not the removed one", async () => {
+		const svc = new FakeDaemonServiceInstaller();
+		const inst = new FakeInstaller();
+		const piHome = track(mkdtempSync(join(tmpdir(), "packed-update-vehicle-replace-")));
+		const app = createApp(deps({ inst, daemonServiceInstaller: svc, piHome }));
+		const response = await app.fetch(
+			new Request("http://x/update", {
+				method: "POST",
+				headers: { ...auth, "content-type": "application/json" },
+				body: JSON.stringify({ source: "npm:@scope/pkg@1.0.0", target: "npm:@scope/pkg@2.0.0", approved: true }),
+			}),
+		);
+		expect(await response.json()).toMatchObject({ ok: true, serviceReconciled: true });
+		expect(svc.restartGotSource).toBe("npm:@scope/pkg@2.0.0");
+	});
+
+	it("POST /update surfaces pinnedSourceRequiresTarget/replaced/before/after/rollback through the wire response", async () => {
+		const inst = new FakeInstaller();
+		inst.updateOutcome = {
+			replaced: true,
+			before: { source: "npm:@scope/pkg@1.0.0", version: "1.0.0" },
+			after: { source: "npm:@scope/pkg@2.0.0", version: "2.0.0" },
+			rollback: { attempted: false, ok: true },
+		};
+		const app = createApp(deps({ inst }));
+		const response = await app.fetch(
+			new Request("http://x/update", {
+				method: "POST",
+				headers: { ...auth, "content-type": "application/json" },
+				body: JSON.stringify({ source: "npm:@scope/pkg@1.0.0", target: "npm:@scope/pkg@2.0.0", approved: true }),
+			}),
+		);
+		expect(await response.json()).toMatchObject({
+			replaced: true,
+			before: { source: "npm:@scope/pkg@1.0.0", version: "1.0.0" },
+			after: { source: "npm:@scope/pkg@2.0.0", version: "2.0.0" },
+			rollback: { attempted: false, ok: true },
+		});
+	});
+
 	it("GET /updates serves the watcher snapshot", async () => {
 		const d = deps();
 		await saveUpdates(d.stateDir, {

package/service/test/smoke.test.ts

@@ -1,10 +1,10 @@
 import { afterEach, describe, expect, it } from "bun:test";
 import { spawnSync } from "node:child_process";
-import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, mkdtempSync, realpathSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { checkPackage } from "../src/adoption/check.ts";
-import { runExtensionSmoke } from "../src/adoption/smoke.ts";
+import { resolveDependencyModulesDir, runExtensionSmoke } from "../src/adoption/smoke.ts";
 
 const roots: string[] = [];
 afterEach(() => {
@@ -47,6 +47,53 @@ function extension(source: string): { root: string; path: string } {
 	return { root, path };
 }
 
+/** A minimal fake dependency package.json -- no "exports" map, so a bare
+ * `require.resolve("<name>/package.json")` subpath is allowed by Node's
+ * default (no-exports-map) resolution rules without needing to replicate
+ * the real jiti package's own exports field. */
+function writeFakeDependency(nodeModulesDir: string, name: string): void {
+	const dir = join(nodeModulesDir, name);
+	mkdirSync(dir, { recursive: true });
+	writeFileSync(join(dir, "package.json"), JSON.stringify({ name, version: "0.0.0-fixture" }));
+}
+
+describe("resolveDependencyModulesDir (packed doctor's real-layout dependency resolution)", () => {
+	it("resolves a dependency nested directly under the package's own node_modules", () => {
+		const root = mkdtempSync(join(tmpdir(), "packed-resolve-nested-"));
+		roots.push(root);
+		writeFileSync(join(root, "package.json"), JSON.stringify({ name: "pkg", version: "1.0.0" }));
+		writeFakeDependency(join(root, "node_modules"), "fake-loader");
+
+		const resolved = resolveDependencyModulesDir(root, "fake-loader");
+
+		expect(resolved).toBe(realpathSync(join(root, "node_modules", "fake-loader")));
+	});
+
+	it("resolves a dependency hoisted to a shared ancestor node_modules -- confirmed live bug: packed doctor --json crashed assuming a fixed nested-only path", () => {
+		const workspaceRoot = mkdtempSync(join(tmpdir(), "packed-resolve-hoisted-"));
+		roots.push(workspaceRoot);
+		const packageDir = join(workspaceRoot, "node_modules", "@danypops", "pi-packed");
+		mkdirSync(packageDir, { recursive: true });
+		writeFileSync(join(packageDir, "package.json"), JSON.stringify({ name: "@danypops/pi-packed", version: "1.0.0" }));
+		// The dependency sits in the WORKSPACE's node_modules, never nested
+		// under the package's own -- exactly what npm's hoisting produces
+		// when another package in the tree also depends on it.
+		writeFakeDependency(join(workspaceRoot, "node_modules"), "fake-loader");
+
+		const resolved = resolveDependencyModulesDir(packageDir, "fake-loader");
+
+		expect(resolved).toBe(realpathSync(join(workspaceRoot, "node_modules", "fake-loader")));
+	});
+
+	it("returns undefined (never throws) when the dependency is genuinely unresolvable from here", () => {
+		const root = mkdtempSync(join(tmpdir(), "packed-resolve-missing-"));
+		roots.push(root);
+		writeFileSync(join(root, "package.json"), JSON.stringify({ name: "pkg", version: "1.0.0" }));
+
+		expect(resolveDependencyModulesDir(root, "does-not-exist-anywhere")).toBeUndefined();
+	});
+});
+
 describeIfSandboxed("isolated extension smoke runner", () => {
 	it("captures bounded registrations without a model", async () => {
 		const fixture = extension(`export default function (pi: any) {