@danypops/pi-packed 0.21.15 → 0.22.0

package/service/src/adoption/smoke.ts

@@ -1,4 +1,5 @@
 import { existsSync, realpathSync } from "node:fs";
+import { createRequire } from "node:module";
 import { dirname, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 
@@ -53,13 +54,36 @@ function addReadOnlyBind(args: string[], path: string): void {
 	if (existsSync(path)) args.push("--ro-bind", path, path);
 }
 
+/**
+ * Resolves an installed dependency's real on-disk package directory via
+ * Node's own module-resolution algorithm (require.resolve against its
+ * package.json), starting from `fromDir` -- correct regardless of whether
+ * the package manager nested it under fromDir's own node_modules or
+ * hoisted it to a shared ancestor node_modules (npm's own hoisting
+ * decision, driven by what else in the tree also depends on it).
+ * Confirmed live: `packed doctor --json` crashed hard reconstructing a
+ * fixed nested-only path (`<packageDirectory>/node_modules/jiti`) that
+ * doesn't exist once jiti is hoisted to Pi's own npm prefix instead of
+ * pi-packed's own node_modules. Never executes the resolved module --
+ * require.resolve only locates a path, it never runs anything. undefined
+ * (not a throw) when genuinely unresolvable from here.
+ */
+export function resolveDependencyModulesDir(fromDir: string, name: string): string | undefined {
+	try {
+		const req = createRequire(join(fromDir, "package.json"));
+		return realpathSync(dirname(req.resolve(`${name}/package.json`)));
+	} catch {
+		return undefined;
+	}
+}
+
 function sandboxCommand(packageRoot: string, extensionPath: string, maxProcesses: number): string[] | undefined {
 	if (process.platform !== "linux" || !existsSync("/usr/bin/bwrap") || !existsSync("/usr/bin/prlimit")) return undefined;
 	const serviceRoot = dirname(dirname(dirname(fileURLToPath(import.meta.url))));
 	const packageDirectory = dirname(serviceRoot);
 	const childHarness = join(serviceRoot, "src/adoption/smoke-child.ts");
-	const runnerModules = join(packageDirectory, "node_modules");
-	const jitiModules = realpathSync(join(runnerModules, "jiti"));
+	const jitiModules = resolveDependencyModulesDir(packageDirectory, "jiti");
+	if (!jitiModules) return undefined;
 	const bun = realpathSync(process.execPath);
 	const relativeExtension = relative(packageRoot, extensionPath).split(sep).join("/");
 	const args = [

package/service/src/cli/cli.ts

@@ -13,6 +13,7 @@ import { checkUpdates } from "../daemon/watcher.ts";
 import { generateIndex, indexPath, readIndex } from "../index/build-index.ts";
 import { syncCatalog } from "../packages/catalog.ts";
 import { catalogList, dbPath, getSyncMeta, latestVersion, openDb, searchLocal } from "../packages/db.ts";
+import { formatDeployVerification, verifyDeploy } from "../packages/deploy-verify.ts";
 import { defaultPiBin, NAME_RE } from "../packages/install.ts";
 import { npmPackageName, readInstalledPackages, readInstalledPackagesAcrossScopes } from "../packages/installed.ts";
 import type { Installer, Pkg, Registry, UpdateEntry } from "../packages/package.ts";
@@ -93,6 +94,7 @@ usage:
   packed index status [--json]                 report the local static index's generatedAt and package count
   packed check [path] [--smoke] [--json]       diagnose a Pi package; smoke is isolated and opt-in
   packed doctor [--project <path>] [--json]    smoke-test every enabled extension (global + project scope) and report tool/command/shortcut/flag name collisions before pi has to
+  packed verify-deploy <name> [--version <v>] [--json] diff a package's on-disk version across every known install location plus stale node_modules shadow copies
   packed pack [path] [--json]                  verify exact npm tarball contents without lifecycle scripts
   packed score [path|name] [--json]            report adoption-readiness evidence by dimension
   packed publish setup [path] [--force] [--json] generate an OIDC staged-publish workflow
@@ -169,6 +171,8 @@ interface Flags {
 	ecosystem: boolean;
 	self: boolean;
 	project?: string;
+	version?: string;
+	to?: string;
 }
 
 function parseFlags(rest: string[]): { flags: Flags; pos: string[] } {
@@ -202,6 +206,10 @@ function parseFlags(rest: string[]): { flags: Flags; pos: string[] } {
 		else if (a.startsWith("--limit=")) flags.limit = Number(a.slice(8)) || SEARCH_DEFAULT_LIMIT;
 		else if (a === "--project" && i + 1 < rest.length) flags.project = rest[++i];
 		else if (a.startsWith("--project=")) flags.project = a.slice(10);
+		else if (a === "--version" && i + 1 < rest.length) flags.version = rest[++i];
+		else if (a.startsWith("--version=")) flags.version = a.slice(10);
+		else if (a === "--to" && i + 1 < rest.length) flags.to = rest[++i];
+		else if (a.startsWith("--to=")) flags.to = a.slice(5);
 		else pos.push(a);
 	}
 	return { flags, pos };
@@ -358,6 +366,17 @@ const commands: Record<string, { usage: string; run: Command }> = {
 		},
 	},
 
+	"verify-deploy": {
+		usage: "packed verify-deploy <name> [--version <v>] [--json]  (diff a package's on-disk version across every known install location plus stale node_modules shadow copies)",
+		async run(_rest, d, flags, pos) {
+			const name = pos[0] ?? "";
+			if (!NAME_RE.test(name)) return usageErr(`usage: ${commands["verify-deploy"]!.usage}\n`);
+			const report = verifyDeploy(d.piHome, name, flags.version);
+			const output = formatDeployVerification(report, flags.json);
+			return report.ok ? ok(output) : fail(output);
+		},
+	},
+
 	search: {
 		usage: "packed search <query> [--offline] [--limit N] [--json]",
 		async run(_rest, d, flags, pos) {
@@ -646,7 +665,8 @@ const commands: Record<string, { usage: string; run: Command }> = {
 	},
 
 	update: {
-		usage: "packed update <configured-source> [--approve] [--json] | packed update --self [--approve] [--json]",
+		usage:
+			"packed update <configured-source> [--to <new-source>] [--approve] [--json] | packed update --self [--approve] [--json]  (--to replaces an exact pin end to end -- see verify-deploy/doctor for post-replace checks)",
 		async run(_rest, d, flags, pos) {
 			if (flags.self) {
 				try {
@@ -666,20 +686,25 @@ const commands: Record<string, { usage: string; run: Command }> = {
 			}
 			const source = pos[0] ?? "";
 			if (!SOURCE_RE.test(source)) return usageErr(`usage: ${commands.update!.usage}\n`);
+			if (flags.to !== undefined && !SOURCE_RE.test(flags.to)) return usageErr(`usage: ${commands.update!.usage}\n`);
 			try {
-				const outcome = await d.inst.update(source, { approved: flags.approved });
+				const outcome = await d.inst.update(source, { approved: flags.approved, target: flags.to });
 				if (outcome.alreadyUpToDate) {
 					if (flags.json) return ok(`${JSON.stringify({ ok: true, source, ...outcome })}\n`);
 					const version = outcome.currentVersion ?? outcome.previousVersion;
 					const reason = outcome.pinned
-						? `is pinned to ${version ?? "an exact version"} — pi update intentionally leaves pinned packages unchanged; run \`packed install npm:${npmPackageName(source) ?? source}\` to move off the pin`
+						? `is pinned to ${version ?? "an exact version"} — pi update intentionally leaves pinned packages unchanged; run \`packed update ${source} --to npm:${npmPackageName(source) ?? source}@<version>\` to move off the pin`
 						: `is already up to date${version ? ` at ${version}` : ""}`;
-					return ok(`${source} ${reason}\n`);
+					const outOfRangeNote = outcome.outOfRangeUpdateAvailable
+						? ` (a newer version, ${outcome.outOfRangeUpdateAvailable}, exists outside the declared range -- widen it to update)`
+						: "";
+					return ok(`${source} ${reason}${outOfRangeNote}\n`);
 				}
 				if (flags.json) return ok(`${JSON.stringify({ ok: true, source, ...outcome })}\n`);
 				const transition =
 					outcome.previousVersion && outcome.currentVersion ? ` (${outcome.previousVersion} → ${outcome.currentVersion})` : "";
-				return ok(`${outcome.output}${transition}\nReload Pi with /reload to activate the updated package.\n`);
+				const replacedNote = outcome.replaced ? ` (replaced ${outcome.before?.source ?? source} with ${outcome.after?.source ?? ""})` : "";
+				return ok(`${outcome.output}${transition}${replacedNote}\nReload Pi with /reload to activate the updated package.\n`);
 			} catch (error) {
 				const message = error instanceof Error ? error.message : String(error);
 				return flags.json

package/service/src/daemon/client.ts

@@ -51,7 +51,7 @@ export interface PackageDaemonPort {
 	restartService(source: string, approved?: boolean): Promise<{ output: string; restarted?: boolean; spec?: ServiceSummary }>;
 	reconcileServices(approved?: boolean, projectRoot?: string): Promise<OperationOutputs["package.reconcile_services"]>;
 	remove(name: string, approved?: boolean): Promise<string>;
-	update(source: string, approved?: boolean): Promise<UpdateOutcome>;
+	update(source: string, approved?: boolean, target?: string): Promise<UpdateOutcome>;
 	piStatus(): Promise<PiVersionReport>;
 	resourcesList(projectRoot?: string): Promise<{ global: PackageResources[]; project: PackageResources[] }>;
 	resourcesToggle(
@@ -265,8 +265,8 @@ export class PackageDaemonClient implements PackageDaemonPort {
 		return result.output;
 	}
 
-	async update(source: string, approved = false): Promise<UpdateOutcome> {
-		const result = await this.call("package.update", { source, approved });
+	async update(source: string, approved = false, target?: string): Promise<UpdateOutcome> {
+		const result = await this.call("package.update", { source, approved, target });
 		if (!result.ok) throw new PackageDaemonError(result.output || `failed to update ${source}`, "package.update");
 		return {
 			output: result.output,
@@ -275,6 +275,12 @@ export class PackageDaemonClient implements PackageDaemonPort {
 			pinned: result.pinned ?? false,
 			previousVersion: result.previousVersion,
 			currentVersion: result.currentVersion,
+			outOfRangeUpdateAvailable: result.outOfRangeUpdateAvailable,
+			pinnedSourceRequiresTarget: result.pinnedSourceRequiresTarget,
+			replaced: result.replaced,
+			before: result.before,
+			after: result.after,
+			rollback: result.rollback,
 		};
 	}
 }
@@ -289,8 +295,8 @@ export class PackageDaemonInstaller implements Installer {
 			throw new PackageDaemonError("daemon package removal requires an npm: source", "package.remove");
 		return this.client.remove(source.slice(4), options?.approved);
 	}
-	update(source: string, options?: { approved?: boolean; local?: boolean }): Promise<UpdateOutcome> {
-		return this.client.update(source, options?.approved);
+	update(source: string, options?: { approved?: boolean; local?: boolean; target?: string }): Promise<UpdateOutcome> {
+		return this.client.update(source, options?.approved, options?.target);
 	}
 }
 
@@ -312,8 +318,8 @@ export class DaemonBackedInstaller implements Installer {
 	async remove(source: string, options?: { approved?: boolean }): Promise<string> {
 		return new PackageDaemonInstaller(await connectPackageDaemon(this.paths)).remove(source, options);
 	}
-	async update(source: string, options?: { approved?: boolean }): Promise<UpdateOutcome> {
-		return (await connectPackageDaemon(this.paths)).update(source, options?.approved);
+	async update(source: string, options?: { approved?: boolean; target?: string }): Promise<UpdateOutcome> {
+		return (await connectPackageDaemon(this.paths)).update(source, options?.approved, options?.target);
 	}
 }
 

package/service/src/daemon/daemon.ts

@@ -1,4 +1,5 @@
-import { dirname } from "node:path";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
 import {
 	type MaintenanceTask,
 	type RunningDaemon,
@@ -7,6 +8,7 @@ import {
 	startDaemon,
 } from "@danypops/vehicle-server/daemon";
 import { ensureAuthToken } from "@danypops/vehicle-server/paths";
+import { captureLoadedModules, checkModuleFreshnessAll, ownRuntimeDependencyNames } from "../adoption/module-freshness.ts";
 import { type DaemonServiceInstaller, RealDaemonServiceInstaller, reconcileAllDaemonServices } from "./daemon-service.ts";
 import { generateIndex, indexPath, indexStatus } from "../index/build-index.ts";
 import { catalogStatus, syncCatalog } from "../packages/catalog.ts";
@@ -51,14 +53,34 @@ function configuredIdleBudgetMs(options: StartPackedDaemonOptions): number | und
 	return Number.isFinite(seconds) && seconds >= 0 ? seconds * 1_000 : undefined;
 }
 
+/**
+ * Captured exactly once, here at daemon startup (daemonOptions() itself
+ * runs once per process -- see vehicle-server/daemon.js's own single
+ * `buildApp()` call site) -- see module-freshness.ts's own header comment
+ * for why this specific moment is what makes the later comparison
+ * meaningful: this is the instant this process's own static imports last
+ * actually loaded these files into memory.
+ */
+function captureOwnModuleSnapshot() {
+	const serviceRoot = dirname(dirname(dirname(fileURLToPath(import.meta.url))));
+	const packageDirectory = dirname(serviceRoot);
+	const ownPackageJsonPath = join(packageDirectory, "package.json");
+	return captureLoadedModules(packageDirectory, ownRuntimeDependencyNames(ownPackageJsonPath));
+}
+
 export function daemonOptions(options: StartPackedDaemonOptions): StartDaemonOptions {
 	const paths = options.paths ?? resolvePackedPaths();
 	if (options.migrateLegacy ?? options.paths === undefined) migrateLegacyPackedState(paths, legacyPackedStateDirectory());
 	const token = ensureAuthToken(paths.token, "Packed");
 	const reg = options.reg ?? new HttpRegistry();
-	const inst = options.inst ?? new ExecInstaller();
 	const piHome = options.piHome ?? defaultPiHome();
 	const database = openDb(paths.database);
+	const moduleSnapshot = captureOwnModuleSnapshot();
+	// Wires ExecInstaller.update()'s own out-of-range cross-check to the exact
+	// same registry-mirror source of truth the package-update-check task below
+	// already uses via checkUpdates() -- one mirror, two consumers, never two
+	// notions of "the real latest version".
+	const inst = options.inst ?? new ExecInstaller(undefined, piHome, undefined, undefined, undefined, (name) => latestVersion(database, name));
 	const daemonServiceInstaller = options.daemonServiceInstaller ?? new RealDaemonServiceInstaller();
 	const configuredMaintenanceTasks = options.maintenanceTasks ?? [
 		{
@@ -116,7 +138,17 @@ export function daemonOptions(options: StartPackedDaemonOptions): StartDaemonOpt
 		maintenanceTasks,
 		...(idleBudgetMs === undefined ? {} : { idleBudgetMs }),
 		idleTickMs: WATCHDOG_TICK_MS,
-		buildApp: () => createApp({ reg, inst, token, stateDir: paths.stateDirectory, dataDir: dirname(paths.database), piHome, daemonServiceInstaller }),
+		buildApp: () =>
+			createApp({
+				reg,
+				inst,
+				token,
+				stateDir: paths.stateDirectory,
+				dataDir: dirname(paths.database),
+				piHome,
+				daemonServiceInstaller,
+				moduleFreshness: () => checkModuleFreshnessAll(moduleSnapshot),
+			}),
 		onShutdown: () => database.close(),
 	};
 }

package/service/src/daemon/service.ts

@@ -13,6 +13,7 @@ import { registerPackedVehicleOperations } from "./vehicle-registration.ts";
 import { type AdvisoryReport, resolveInstalledVersions, scanInstalledPackages } from "../adoption/advisories.ts";
 import { type CheckReport, type PackageChecker, StaticPackageChecker } from "../adoption/check.ts";
 import { type DoctorReport, runDoctor } from "../adoption/doctor.ts";
+import type { ModuleFreshnessDiagnostic } from "../adoption/module-freshness.ts";
 import { NpmPackVerifier, type PackReport } from "../adoption/pack.ts";
 import { type AdoptionReport, scoreTarget } from "../adoption/score.ts";
 import { buildIndex, indexPath, type PackageIndex, readIndex, writeIndex } from "../index/build-index.ts";
@@ -68,6 +69,15 @@ export interface Deps {
 		apply(manifestPath: string, options?: { prune?: boolean }): Promise<SetupApplyResult>;
 	};
 	daemonServiceInstaller?: DaemonServiceInstaller;
+	/**
+	 * Re-checks this exact running process's own captured startup snapshot
+	 * of its runtime dependencies against their current on-disk state --
+	 * see module-freshness.ts. Sync (a handful of small file stats/reads),
+	 * injected by daemon.ts once at process start; undefined for any Deps
+	 * built without a real running process behind it (a standalone `packed
+	 * doctor` never has a snapshot to compare against at all).
+	 */
+	moduleFreshness?: () => ModuleFreshnessDiagnostic[];
 	piVersion?: { check(options?: { timeoutMs?: number }): Promise<PiVersionReport> };
 	advisories?: { scan(installed: Record<string, string>): Promise<AdvisoryReport> };
 }
@@ -126,7 +136,7 @@ export interface OperationInputs {
 	"package.restart_service": { source: string; approved?: boolean };
 	"package.reconcile_services": { approved?: boolean; projectRoot?: string };
 	"package.remove": { name: string; approved?: boolean };
-	"package.update": { source: string; approved?: boolean };
+	"package.update": { source: string; approved?: boolean; target?: string };
 	"resources.list": { projectRoot?: string };
 	"resources.toggle": { source: string; field: ResourceField; path: string; enabled: boolean; projectRoot?: string; approved?: boolean };
 	"pi.status": Record<string, never>;
@@ -257,6 +267,10 @@ export function createApp(deps: Deps): { fetch: (req: Request) => Promise<Respon
 		description: "Pi package lifecycle daemon",
 	});
 	registerPackedVehicleOperations(vehicleRegistry, executeOperation);
+	// Live from day one: the registry's own gate mirrors whatever mutationApproval already
+	// is on disk at startup, then tracks every /security POST from here on (see below) --
+	// never a fixed per-deployment constant baked in once and forgotten.
+	vehicleRegistry.configureApprovals({ enabled: readSecuritySettings(deps.stateDir).mutationApproval === "always" });
 	const vehicleApp = createVehicleHttpApp({ registry: vehicleRegistry, token: deps.token });
 
 	function authorize(operation: PackageOperation, approved: boolean): Response | undefined {
@@ -294,7 +308,14 @@ export function createApp(deps: Deps): { fetch: (req: Request) => Promise<Respon
 			}
 			const denied = authorize("security.write", body.approved === true);
 			if (denied) return denied;
-			return json(await writeSecuritySettings(deps.stateDir, { mutationApproval: body.mutationApproval as MutationApproval }));
+			const mutationApproval = body.mutationApproval as MutationApproval;
+			const written = await writeSecuritySettings(deps.stateDir, { mutationApproval });
+			// Same live-toggle guarantee the legacy /api/v1/ops transport already had via
+			// readSecuritySettings() being re-read fresh on every request -- the Vehicle
+			// transport's own gate is a stateful in-memory policy, so a change here has to
+			// be pushed to it explicitly instead of being implicitly always-fresh.
+			vehicleRegistry.updateApprovalPolicy({ enabled: mutationApproval === "always" });
+			return json(written);
 		}
 
 		if (path === "/search" && req.method === "GET") {
@@ -486,22 +507,32 @@ export function createApp(deps: Deps): { fetch: (req: Request) => Promise<Respon
 		if (path === "/update" && req.method === "POST") {
 			let source = "";
 			let approved = false;
+			let target: string | undefined;
 			try {
-				const body = (await req.json()) as { source?: unknown; approved?: unknown };
+				const body = (await req.json()) as { source?: unknown; approved?: unknown; target?: unknown };
 				source = String(body.source ?? "");
 				approved = body.approved === true;
+				target = typeof body.target === "string" && body.target.length > 0 ? body.target : undefined;
 			} catch {
 				/* fall through to validation */
 			}
 			if (!SOURCE_RE.test(source)) {
 				return err(400, "invalid source; want a configured npm:, git:, or https package source");
 			}
+			if (target !== undefined && !SOURCE_RE.test(target)) {
+				return err(400, "invalid target; want a configured npm:, git:, or https package source");
+			}
 			const denied = authorize("update", approved);
 			if (denied) return denied;
+			// A successful replace re-identifies the package under `target`, not
+			// `source` -- a daemon-backed package's own service restart (below)
+			// must reconcile against the NEW installed source, never the one that
+			// was just removed.
+			const restartSource = target ?? source;
 			try {
-				const outcome = await deps.inst.update(source, { approved });
-				if (!source.startsWith("npm:") || outcome.alreadyUpToDate) return json({ ok: true, source, ...outcome });
-				const service = await daemonServiceInstaller.restart(piHomeForServiceInstall, source);
+				const outcome = await deps.inst.update(source, { approved, target });
+				if (!restartSource.startsWith("npm:") || outcome.alreadyUpToDate) return json({ ok: true, source, ...outcome });
+				const service = await daemonServiceInstaller.restart(piHomeForServiceInstall, restartSource);
 				if (!service.ok) {
 					if (service.notADaemon) return json({ ok: true, source, ...outcome });
 					return json({ ok: false, source, ...outcome, output: `${outcome.output}\n${service.reason}` });
@@ -598,7 +629,11 @@ export function createApp(deps: Deps): { fetch: (req: Request) => Promise<Respon
 			const value = input as OperationInputs["doctor.run"];
 			if (value.projectRoot !== undefined && (typeof value.projectRoot !== "string" || value.projectRoot.length > 4_096))
 				throw new PackageOperationError("projectRoot must be a string up to 4096 characters", 400);
-			return (await runDoctor(deps.piHome ?? defaultPiHome(), value.projectRoot)) as OperationOutputs[Name];
+			const report = await runDoctor(deps.piHome ?? defaultPiHome(), value.projectRoot);
+			const moduleFreshness = deps.moduleFreshness?.();
+			if (moduleFreshness === undefined) return report as OperationOutputs[Name];
+			const anyStale = moduleFreshness.some((diagnostic) => diagnostic.stale);
+			return { ...report, moduleFreshness, ok: report.ok && !anyStale } as OperationOutputs[Name];
 		}
 		if (op === "package.updates.project") {
 			const value = input as OperationInputs["package.updates.project"];

package/service/src/daemon/vehicle-registration.ts

@@ -27,13 +27,29 @@
  * install/install_service/update/setup.apply which can fetch and run
  * arbitrary newly-published code).
  *
- * Approval/authorization is NOT reimplemented here: executeOperation()
- * (and the route()-based operations it delegates to internally) already
- * calls authorize()/assertPackagePermission() and throws
- * PackageOperationError(status: 403) on a denied mutation -- reusing
- * executeOperation() verbatim means this Vehicle surface automatically
- * inherits the exact same approval gate, with zero duplicated policy logic
- * to drift out of sync.
+ * Approval is delegated to the registry's own Vehicle-native mechanism
+ * (VehicleRegistry.configureApprovals/updateApprovalPolicy, wired up in
+ * daemon.ts/service.ts against packed's own mutationApproval setting) --
+ * NOT reimplemented here. Each operation below carries an explicit
+ * requiresApproval, exactly matching security.ts's PACKAGE_OPERATIONS
+ * classification's own guarded set (code-execution/settings-mutation/
+ * security-mutation), set unconditionally rather than left to derive from
+ * effect: two of Vehicle's five effect buckets already mix a guarded
+ * operation with an unguarded one here (external-write covers both
+ * restart_service/reconcile_services, which ARE guarded, and
+ * catalog.sync/index.build, which never were; local-write covers both
+ * resources.toggle/security.set, guarded, and setup.export/setup.update,
+ * never guarded) -- no single effect-derived default could reproduce this
+ * split, which is exactly the gap VehicleOperationDescriptor.requiresApproval
+ * exists to close.
+ *
+ * Once the registry's own gate approves a call (because it wasn't gated,
+ * or because a real capability was presented), the bound handler forces
+ * approved: true onto the input before delegating to executeOperation() --
+ * its own legacy authorize()/assertPackagePermission() check (still the
+ * sole gate for the older /api/v1/ops transport, untouched here) would
+ * otherwise reject a call whose caller never knew that REST-only field
+ * existed. A Vehicle caller's only approval contract is Vehicle's own.
  */
 
 import type { VehicleEffect, VehicleIdempotency } from "@danypops/vehicle-core";
@@ -66,6 +82,11 @@ const WRITE: VehicleIdempotency = { mode: "unsafe" };
 interface OperationMeta {
 	readonly description: string;
 	readonly effect: VehicleEffect;
+	/** See vehicle-core's VehicleOperationDescriptor.requiresApproval -- set explicitly for
+	 * every operation here (never left to derive from effect), matching security.ts's own
+	 * per-operation guarded/unguarded classification exactly. See this file's own doc
+	 * comment for why effect alone can't reproduce that split. */
+	readonly requiresApproval: boolean;
 }
 
 /**
@@ -74,53 +95,111 @@ interface OperationMeta {
  * classification) and its two deliberate refinements.
  */
 const OPERATION_META: Record<OperationName, OperationMeta> = {
-	"package.search": { description: "Searches Pi packages on npm.", effect: "read" },
-	"package.info": { description: "Reads bounded metadata for one package.", effect: "read" },
-	"package.installed": { description: "Lists locally installed Pi packages.", effect: "read" },
-	"package.catalog": { description: "Reads the local SQLite catalog mirror.", effect: "read" },
+	"package.search": { description: "Searches Pi packages on npm.", effect: "read", requiresApproval: false },
+	"package.info": { description: "Reads bounded metadata for one package.", effect: "read", requiresApproval: false },
+	"package.installed": { description: "Lists locally installed Pi packages.", effect: "read", requiresApproval: false },
+	"package.catalog": { description: "Reads the local SQLite catalog mirror.", effect: "read", requiresApproval: false },
 	"package.catalog.sync": {
 		description: "Refreshes the local catalog mirror from the Pi-package-tagged npm registry subset.",
 		effect: "external-write",
+		requiresApproval: false,
 	},
-	"package.index": { description: "Reads the locally built adoption-score index, if one exists.", effect: "read" },
+	"package.index": { description: "Reads the locally built adoption-score index, if one exists.", effect: "read", requiresApproval: false },
 	"package.index.build": {
 		description: "Builds the adoption-score index by scoring catalog entries against the npm registry.",
 		effect: "external-write",
+		requiresApproval: false,
+	},
+	"package.updates": { description: "Reads the last background update-check snapshot.", effect: "read", requiresApproval: false },
+	"package.check": {
+		description: "Runs static (and optionally smoke-test) quality checks against a local package path.",
+		effect: "read",
+		requiresApproval: false,
+	},
+	"package.pack": { description: "Verifies a local package path via npm pack.", effect: "read", requiresApproval: false },
+	"package.score": {
+		description: "Computes an adoption-readiness score for a local path or registry package.",
+		effect: "read",
+		requiresApproval: false,
+	},
+	"setup.export": { description: "Exports the current Pi setup as a portable manifest.", effect: "local-write", requiresApproval: false },
+	"setup.update": { description: "Updates an existing setup manifest in place.", effect: "local-write", requiresApproval: false },
+	"setup.plan": {
+		description: "Computes a setup manifest's install/update/remove plan without applying it.",
+		effect: "read",
+		requiresApproval: false,
 	},
-	"package.updates": { description: "Reads the last background update-check snapshot.", effect: "read" },
-	"package.check": { description: "Runs static (and optionally smoke-test) quality checks against a local package path.", effect: "read" },
-	"package.pack": { description: "Verifies a local package path via npm pack.", effect: "read" },
-	"package.score": { description: "Computes an adoption-readiness score for a local path or registry package.", effect: "read" },
-	"setup.export": { description: "Exports the current Pi setup as a portable manifest.", effect: "local-write" },
-	"setup.update": { description: "Updates an existing setup manifest in place.", effect: "local-write" },
-	"setup.plan": { description: "Computes a setup manifest's install/update/remove plan without applying it.", effect: "read" },
 	"setup.apply": {
 		description: "Applies a setup manifest's plan -- can install, update, or remove packages.",
 		effect: "open-world",
+		requiresApproval: true,
+	},
+	"package.security.get": {
+		description: "Reads this daemon's mutation-approval security settings.",
+		effect: "read",
+		requiresApproval: false,
+	},
+	"package.security.set": {
+		description: "Writes this daemon's mutation-approval security settings.",
+		effect: "local-write",
+		requiresApproval: true,
+	},
+	"package.install": {
+		description: "Installs a Pi package from an npm, git, or https source.",
+		effect: "open-world",
+		requiresApproval: true,
 	},
-	"package.security.get": { description: "Reads this daemon's mutation-approval security settings.", effect: "read" },
-	"package.security.set": { description: "Writes this daemon's mutation-approval security settings.", effect: "local-write" },
-	"package.install": { description: "Installs a Pi package from an npm, git, or https source.", effect: "open-world" },
 	"package.install_service": {
 		description: "Installs a persistent supervised service for an already-installed daemon package.",
 		effect: "open-world",
+		requiresApproval: true,
 	},
 	"package.restart_service": {
 		description: "Restarts an already-installed package's persistent service -- no new code introduced.",
 		effect: "external-write",
+		requiresApproval: true,
 	},
 	"package.reconcile_services": {
 		description: "Reconciles every installed daemon package's persistent service against desired state.",
 		effect: "external-write",
+		requiresApproval: true,
+	},
+	"package.remove": { description: "Removes an installed Pi package. Irreversible.", effect: "destructive", requiresApproval: true },
+	"package.update": {
+		description: "Updates a configured Pi package to its latest available version.",
+		effect: "open-world",
+		requiresApproval: true,
+	},
+	"resources.list": {
+		description: "Lists global and project-scoped Pi resources (extensions, skills, prompts, themes).",
+		effect: "read",
+		requiresApproval: false,
+	},
+	"resources.toggle": {
+		description: "Enables or disables one Pi resource in a settings file.",
+		effect: "local-write",
+		requiresApproval: true,
+	},
+	"pi.status": {
+		description: "Reports the locally running Pi version against the latest published release.",
+		effect: "read",
+		requiresApproval: false,
+	},
+	"advisories.scan": {
+		description: "Scans installed package versions against known advisories.",
+		effect: "read",
+		requiresApproval: false,
+	},
+	"doctor.run": {
+		description: "Runs diagnostic health checks (service install drift, resource config, ...).",
+		effect: "read",
+		requiresApproval: false,
+	},
+	"package.updates.project": {
+		description: "Checks for updates across every scope visible to one project.",
+		effect: "read",
+		requiresApproval: false,
 	},
-	"package.remove": { description: "Removes an installed Pi package. Irreversible.", effect: "destructive" },
-	"package.update": { description: "Updates a configured Pi package to its latest available version.", effect: "open-world" },
-	"resources.list": { description: "Lists global and project-scoped Pi resources (extensions, skills, prompts, themes).", effect: "read" },
-	"resources.toggle": { description: "Enables or disables one Pi resource in a settings file.", effect: "local-write" },
-	"pi.status": { description: "Reports the locally running Pi version against the latest published release.", effect: "read" },
-	"advisories.scan": { description: "Scans installed package versions against known advisories.", effect: "read" },
-	"doctor.run": { description: "Runs diagnostic health checks (service install drift, resource config, ...).", effect: "read" },
-	"package.updates.project": { description: "Checks for updates across every scope visible to one project.", effect: "read" },
 };
 
 /** Read effects need only packed:read; every other effect needs both (writes commonly also read first). */
@@ -142,16 +221,20 @@ export function registerPackedVehicleOperations(
 			output: passthroughVehicleSchema,
 			permissions: permissionsFor(meta.effect),
 			effect: meta.effect,
+			requiresApproval: meta.requiresApproval,
 			idempotency: meta.effect === "read" ? READ : WRITE,
 			limits: LIMITS,
 		});
 		registry.register(
 			OWNER,
-			bindVehicleOperation(
-				operation,
-				() => async (context) =>
-					withPackedErrorParity(() => executeOperation(name, context.input as OperationInputs[typeof name])),
-			),
+			bindVehicleOperation(operation, () => async (context) => {
+				// The registry's own gate (see this file's doc comment) already decided this
+				// call is approved by the time the handler runs -- forcing approved: true
+				// here satisfies executeOperation()'s own legacy authorize() check without
+				// asking a Vehicle caller to know that REST-only field even exists.
+				const input = { ...(context.input as Record<string, unknown>), approved: true } as OperationInputs[typeof name];
+				return withPackedErrorParity(() => executeOperation(name, input));
+			}),
 		);
 	}
 }

package/service/src/daemon/watcher.ts

@@ -5,12 +5,12 @@
  */
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { join } from "node:path";
-import { gt, valid } from "semver";
 import { UPDATES_FILE } from "../shared/constants.ts";
 import { createLogger } from "../shared/log.ts";
 
 const log = createLogger("watcher");
 
+import { isNewer } from "../packages/package.ts";
 import type { InstalledPkg, UpdateEntry, UpdatesSnapshot } from "../packages/package.ts";
 
 function updatesPath(dir: string): string {
@@ -30,23 +30,6 @@ export async function loadUpdates(dir: string): Promise<UpdatesSnapshot | undefi
 	}
 }
 
-/**
- * True drift only: mirrored latest is a real semver step *ahead* of what's
- * installed, never merely different from it. A plain !== check (this
- * function's own bug until fixed) cannot distinguish "installed is behind
- * latest" from "installed is already ahead of a stale/wrong mirrored
- * latest" -- confirmed live: an installed package whose version had
- * already passed the daemon's own mirrored dist-tags.latest kept showing
- * a permanent, un-clearable "update available" badge pointing at an
- * *older* version. Falls back to the old inequality only when either side
- * isn't parseable semver (a git ref, a literal "latest" tag, etc.) --
- * those aren't comparable at all, so "different" is the only signal left.
- */
-function isNewer(latest: string, have: string): boolean {
-	if (valid(latest, { loose: true }) && valid(have, { loose: true })) return gt(latest, have, { loose: true });
-	return latest !== have;
-}
-
 /** Pure diff against the local mirror (apt list --upgradable semantics):
  * drift = mirrored latest is genuinely newer than what we have. The
  * mirror is refreshed by catalogSync; updates are computed offline,