@danypops/pi-packed 0.21.7 → 0.21.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@danypops/pi-packed",
-  "version": "0.21.7",
+  "version": "0.21.9",
   "description": "Pi package lifecycle, validation, daemon, tools, profiles, and TUI",
   "type": "module",
   "bin": {

package/service/src/packages/install.ts

@@ -1,5 +1,6 @@
 /** install.ts — driven adapter: pi CLI mutations via Bun.spawn. */
 
+import { join } from "node:path";
 import { HeadlessInstallValidator, type InstallValidator } from "../adoption/install-validation.ts";
 import { defaultPiHome, isPinnedNpmSource, readResolvedVersion } from "./installed.ts";
 import type { Installer, UpdateOutcome } from "./package.ts";
@@ -11,11 +12,16 @@ export function defaultPiBin(): string {
 	return process.env.PI_PACKED_PI_BIN ?? process.env.PI_BIN ?? "pi";
 }
 
+export function defaultNpmBin(): string {
+	return process.env.PI_PACKED_NPM_BIN ?? process.env.NPM_BIN ?? "npm";
+}
+
 export class ExecInstaller implements Installer {
 	constructor(
 		private bin = defaultPiBin(),
 		private piHome = defaultPiHome(),
 		private validator: InstallValidator = new HeadlessInstallValidator(),
+		private npmBin = defaultNpmBin(),
 	) {}
 
 	private async run(args: string[]): Promise<string> {
@@ -27,6 +33,26 @@ export class ExecInstaller implements Installer {
 		return out;
 	}
 
+	/**
+	 * `pi install`/`pi update --extension <source>` only resolve the target
+	 * package's own subtree. npm's own `dedupe` docs (confirmed by
+	 * npm/cli#5307 and npm/cli#7277) describe rearranging already-resolved
+	 * versions, never installing a newer one -- so a sibling package's own
+	 * declared range can go unsatisfied at the shared root and node's
+	 * resolution silently walks up to a stale copy nothing wanted. A full
+	 * `npm install` (no args) at piHome/npm is npm's own documented reliable
+	 * fix: it re-resolves the whole tree, not just the last-touched package.
+	 */
+	private async reresolveDependencyTree(): Promise<string> {
+		const cwd = join(this.piHome, "npm");
+		const proc = Bun.spawn([this.npmBin, "install"], { cwd, stdout: "pipe", stderr: "pipe" });
+		const [stdout, stderr] = await Promise.all([new Response(proc.stdout).text(), new Response(proc.stderr).text()]);
+		const out = [stdout.trim(), stderr.trim()].filter(Boolean).join("\n");
+		const code = await proc.exited;
+		if (code !== 0) throw new Error(`npm install failed to re-resolve the dependency tree at ${cwd} (exit ${code}): ${out || "no output"}`);
+		return out;
+	}
+
 	async install(source: string, options?: { approved?: boolean; local?: boolean }): Promise<string> {
 		const validation = await this.validator.validate(source);
 		if (!validation.ok) {
@@ -36,7 +62,9 @@ export class ExecInstaller implements Installer {
 				.join("; ");
 			throw new Error(`install refused -- ${detail || validation.message || "extension failed a headless load check"}`);
 		}
-		return this.run(["install", ...(options?.local ? ["-l"] : []), source]);
+		const output = await this.run(["install", ...(options?.local ? ["-l"] : []), source]);
+		await this.reresolveDependencyTree();
+		return output;
 	}
 
 	remove(source: string, options?: { approved?: boolean; local?: boolean }): Promise<string> {
@@ -47,6 +75,7 @@ export class ExecInstaller implements Installer {
 		const pinned = isPinnedNpmSource(source);
 		const previousVersion = readResolvedVersion(this.piHome, source);
 		const output = await this.run(["update", "--extension", source]);
+		await this.reresolveDependencyTree();
 		const currentVersion = readResolvedVersion(this.piHome, source);
 		// Only trust a "nothing changed" conclusion when we actually read a
 		// real version both before and after (npm source, resolvable in

package/service/src/registry/registry.ts

@@ -16,6 +16,7 @@ import { createLogger } from "../shared/log.ts";
 
 const log = createLogger("registry");
 const README_MAX_CHARS = 50_000;
+const README_DOCUMENT_MAX_BYTES = 1024 * 1024;
 
 /** Upstream etiquette: honor Retry-After on 429, exponential backoff
  * otherwise, give up after RETRY_MAX_ATTEMPTS. */
@@ -126,11 +127,10 @@ export class HttpRegistry implements Registry {
 			pi?: Record<string, unknown>;
 			peerDependencies?: Record<string, string>;
 			scripts?: Record<string, string>;
-			readme?: unknown;
 			dist?: { unpackedSize?: number; integrity?: string; attestations?: { url?: string; provenance?: unknown } };
 		};
 		const manifestFields = v.pi ? Object.keys(v.pi).filter((key) => ["extensions", "skills", "prompts", "themes"].includes(key)) : [];
-		const readme = boundedString(v.readme, README_MAX_CHARS);
+		const readme = await this.publishedReadme(encoded);
 		return {
 			name: boundedString(v.name, 214) ?? boundedString(name, 214)!,
 			version: boundedString(v.version, 128) ?? "",
@@ -166,6 +166,22 @@ export class HttpRegistry implements Registry {
 		};
 	}
 
+	private async publishedReadme(encodedName: string): Promise<string | undefined> {
+		try {
+			const response = await fetchWithRetry(
+				`${this.base}/${encodedName}`,
+				{ headers: { accept: "application/json" } },
+				this.retryBaseDelayMs,
+			);
+			if (!response.ok) return undefined;
+			const document = (await boundedJson(response, README_DOCUMENT_MAX_BYTES)) as { readme?: unknown };
+			return boundedString(document.readme, README_MAX_CHARS);
+		} catch (error) {
+			log.debug("published README unavailable", { error: error instanceof Error ? error.message : String(error) });
+			return undefined;
+		}
+	}
+
 	/** Uses npm's abbreviated multi-version doc, not `/latest` (which carries
 	 * no `time`/`modified` field at all -- confirmed against the live
 	 * registry). Still bounded well under the full unabbreviated document's

package/service/test/core.test.ts

@@ -69,7 +69,6 @@ describe("HttpRegistry", () => {
 						license: "MIT",
 						keywords: ["pi-package", "lsp"],
 						pi: { extensions: ["./src/index.ts"] },
-						readme: `# pi-lsp\n\n${"r".repeat(60_000)}`,
 						dist: {
 							unpackedSize: 12345,
 							integrity: "sha512-test",
@@ -77,6 +76,7 @@ describe("HttpRegistry", () => {
 						},
 					});
 				}
+				if (url.pathname === "/pi-lsp") return Response.json({ readme: `# pi-lsp\n\n${"r".repeat(60_000)}` });
 				return new Response("nf", { status: 404 });
 			},
 		});

package/service/test/install-validation.test.ts

@@ -8,6 +8,8 @@
  * pass.
  */
 import { describe, expect, it } from "bun:test";
+import { mkdirSync, mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import type { InstallValidationResult, InstallValidator } from "../src/adoption/install-validation.ts";
@@ -94,13 +96,18 @@ describe("ExecInstaller.install() -- refuses before ever spawning the real pi bi
 		await expect(installer.install("npm:broken-pkg")).rejects.toThrow(/install refused.*extension\/index\.ts: boom/);
 	});
 
-	it("proceeds to the real install when the validator approves", async () => {
-		// /bin/true always exits 0 -- proves the real spawn path was reached
-		// (a refused install never gets this far to find out).
+	it("proceeds to the real install when the validator approves, then re-resolves the whole tree", async () => {
+		// A real piHome/npm dir must exist for the post-install re-resolution
+		// step to cwd into -- /bin/true always exits 0 regardless, proving both
+		// the real install spawn *and* the re-resolution spawn were reached (a
+		// refused install never gets this far to find out).
+		const piHome = mkdtempSync(join(tmpdir(), "packed-install-validation-pihome-"));
+		mkdirSync(join(piHome, "npm"), { recursive: true });
 		const installer = new ExecInstaller(
 			"/bin/true",
-			"/tmp/unused-pihome",
+			piHome,
 			fakeValidator({ ok: true, source: "npm:good-pkg", extensions: [] }),
+			"/bin/true",
 		);
 
 		await expect(installer.install("npm:good-pkg")).resolves.toBeDefined();

package/service/test/install.test.ts

@@ -40,6 +40,7 @@ function writeFakePi(dir: string, rewrite?: { piHome: string; name: string; newV
 
 function writePiHome(nodeModules: Record<string, string> = {}): string {
 	const dir = mkdtempSync(join(tmpdir(), "packed-exec-pihome-"));
+	mkdirSync(join(dir, "npm"), { recursive: true });
 	for (const [name, version] of Object.entries(nodeModules)) {
 		const pkgDir = join(dir, "npm", "node_modules", name);
 		mkdirSync(pkgDir, { recursive: true });
@@ -48,12 +49,35 @@ function writePiHome(nodeModules: Record<string, string> = {}): string {
 	return dir;
 }
 
+/**
+ * A fake `npm` binary standing in for ExecInstaller's post-install/update
+ * full-tree re-resolution step. Writes every invocation's cwd to `logFile`
+ * (so a test can assert it actually ran against piHome/npm, not some other
+ * directory) and, when `rewrite` is given, writes a fresh version for a
+ * *different* package than the one the fake `pi` binary touched --
+ * reproducing the real defect: only a real `npm install` (no args, whole
+ * tree) reaches a stale sibling that a targeted `pi update` never does.
+ */
+function writeFakeNpm(dir: string, logFile: string, rewrite?: { piHome: string; name: string; newVersion: string }): string {
+	const script = join(dir, "fake-npm");
+	const rewriteLine = rewrite
+		? `mkdir -p '${join(rewrite.piHome, "npm", "node_modules", rewrite.name)}' && printf '{"version":"%s"}' '${rewrite.newVersion}' > '${join(rewrite.piHome, "npm", "node_modules", rewrite.name, "package.json")}'`
+		: "true";
+	writeFileSync(
+		script,
+		["#!/usr/bin/env bash", "set -euo pipefail", `pwd >> '${logFile}'`, `echo "$@" >> '${logFile}'`, rewriteLine, "exit 0"].join("\n"),
+	);
+	chmodSync(script, 0o755);
+	return script;
+}
+
 describe("ExecInstaller.update() — honest reloadRequired despite pi's ambiguous exit-0 text", () => {
 	it("pinned source, version genuinely unchanged: alreadyUpToDate, reloadRequired false", async () => {
 		const scriptDir = mkdtempSync(join(tmpdir(), "packed-exec-bin-"));
 		const bin = writeFakePi(scriptDir);
+		const npmBin = writeFakeNpm(scriptDir, join(scriptDir, "npm.log"));
 		const piHome = writePiHome({ "@scope/pkg": "1.2.3" });
-		const installer = new ExecInstaller(bin, piHome);
+		const installer = new ExecInstaller(bin, piHome, undefined, npmBin);
 
 		const outcome = await installer.update("npm:@scope/pkg@1.2.3");
 
@@ -68,8 +92,9 @@ describe("ExecInstaller.update() — honest reloadRequired despite pi's ambiguou
 	it('unpinned source, already latest (pi still exits 0 and says "Updated"): alreadyUpToDate', async () => {
 		const scriptDir = mkdtempSync(join(tmpdir(), "packed-exec-bin-"));
 		const bin = writeFakePi(scriptDir);
+		const npmBin = writeFakeNpm(scriptDir, join(scriptDir, "npm.log"));
 		const piHome = writePiHome({ plain: "0.5.0" });
-		const installer = new ExecInstaller(bin, piHome);
+		const installer = new ExecInstaller(bin, piHome, undefined, npmBin);
 
 		const outcome = await installer.update("npm:plain");
 
@@ -84,7 +109,8 @@ describe("ExecInstaller.update() — honest reloadRequired despite pi's ambiguou
 		const scriptDir = mkdtempSync(join(tmpdir(), "packed-exec-bin-"));
 		const piHome = writePiHome({ plain: "0.5.0" });
 		const bin = writeFakePi(scriptDir, { piHome, name: "plain", newVersion: "0.6.0" });
-		const installer = new ExecInstaller(bin, piHome);
+		const npmBin = writeFakeNpm(scriptDir, join(scriptDir, "npm.log"));
+		const installer = new ExecInstaller(bin, piHome, undefined, npmBin);
 
 		const outcome = await installer.update("npm:plain");
 
@@ -98,8 +124,9 @@ describe("ExecInstaller.update() — honest reloadRequired despite pi's ambiguou
 	it("git: source (no npm resolution possible either side): conservatively assumes it may have changed", async () => {
 		const scriptDir = mkdtempSync(join(tmpdir(), "packed-exec-bin-"));
 		const bin = writeFakePi(scriptDir);
+		const npmBin = writeFakeNpm(scriptDir, join(scriptDir, "npm.log"));
 		const piHome = writePiHome();
-		const installer = new ExecInstaller(bin, piHome);
+		const installer = new ExecInstaller(bin, piHome, undefined, npmBin);
 
 		const outcome = await installer.update("git:github.com/u/r@main");
 
@@ -111,3 +138,61 @@ describe("ExecInstaller.update() — honest reloadRequired despite pi's ambiguou
 		expect(outcome.reloadRequired).toBe(true);
 	});
 });
+
+describe("ExecInstaller — forces full dependency re-resolution, not just the target's own subtree", () => {
+	it("update() fixes a stale root-level sibling that the targeted pi update never touched", async () => {
+		const scriptDir = mkdtempSync(join(tmpdir(), "packed-exec-bin-"));
+		// Simulates the confirmed live defect: after `pi update npm:@scope/leaf`,
+		// the leaf's own version bumps, but a root-level sibling
+		// (@scope/shared) that the freshly-updated leaf now needs a newer
+		// range of stays pinned at its old, now-unsatisfied version --
+		// `pi update --extension` only ever resolved the leaf's own subtree.
+		const piHome = writePiHome({ "@scope/leaf": "1.0.0", "@scope/shared": "1.0.0" });
+		const bin = writeFakePi(scriptDir, { piHome, name: "@scope/leaf", newVersion: "2.0.0" });
+		// A real `npm install` (no args, whole-tree) is the only thing that
+		// actually reaches @scope/shared -- reproduced here as the fake npm
+		// binary rewriting it to the version the leaf's new range needs.
+		const npmLog = join(scriptDir, "npm.log");
+		const npmBin = writeFakeNpm(scriptDir, npmLog, { piHome, name: "@scope/shared", newVersion: "2.0.0" });
+		const installer = new ExecInstaller(bin, piHome, undefined, npmBin);
+
+		const outcome = await installer.update("npm:@scope/leaf");
+
+		expect(outcome.currentVersion).toBe("2.0.0");
+		// The real assertion: a package `pi update` never named is resolved
+		// too, everywhere in the tree -- not just the target's own package.json.
+		expect(readFileSync(join(piHome, "npm", "node_modules", "@scope/shared", "package.json"), "utf8")).toContain("2.0.0");
+		// And it ran the re-resolution against piHome/npm specifically, with
+		// no target argument -- a full-tree resolve, not another targeted op.
+		const log = readFileSync(npmLog, "utf8").trim().split("\n");
+		expect(log[0]).toBe(join(piHome, "npm"));
+		expect(log[1]).toBe("install");
+	});
+
+	it("install() also forces a full re-resolution after a successful pi install", async () => {
+		const scriptDir = mkdtempSync(join(tmpdir(), "packed-exec-bin-"));
+		const piHome = writePiHome({ "@scope/shared": "1.0.0" });
+		const bin = writeFakePi(scriptDir);
+		const npmLog = join(scriptDir, "npm.log");
+		const npmBin = writeFakeNpm(scriptDir, npmLog, { piHome, name: "@scope/shared", newVersion: "2.0.0" });
+		const installer = new ExecInstaller(bin, piHome, { validate: async (source) => ({ ok: true, source, extensions: [] }) }, npmBin);
+
+		await installer.install("npm:@scope/new-pkg");
+
+		expect(readFileSync(join(piHome, "npm", "node_modules", "@scope/shared", "package.json"), "utf8")).toContain("2.0.0");
+		const log = readFileSync(npmLog, "utf8").trim().split("\n");
+		expect(log[0]).toBe(join(piHome, "npm"));
+	});
+
+	it("surfaces a failed re-resolution instead of silently reporting success", async () => {
+		const scriptDir = mkdtempSync(join(tmpdir(), "packed-exec-bin-"));
+		const piHome = writePiHome({ plain: "0.5.0" });
+		const bin = writeFakePi(scriptDir, { piHome, name: "plain", newVersion: "0.6.0" });
+		const failingNpm = join(scriptDir, "fake-npm-fail");
+		writeFileSync(failingNpm, ["#!/usr/bin/env bash", "echo 'ERESOLVE unable to resolve dependency tree' >&2", "exit 1"].join("\n"));
+		chmodSync(failingNpm, 0o755);
+		const installer = new ExecInstaller(bin, piHome, undefined, failingNpm);
+
+		await expect(installer.update("npm:plain")).rejects.toThrow(/npm install failed to re-resolve/);
+	});
+});

package/service/test/npm-metadata-e2e.test.ts

@@ -52,10 +52,16 @@ describe("published npm metadata E2E", () => {
 						description: "Encrypted credential vault daemon",
 						license: "MIT",
 						repository: { type: "git", url: "git+https://github.com/DanyPops/enigma.git" },
-						readme: PUBLISHED_README,
 						dist: { integrity: "sha512-published-fixture" },
 					});
 				}
+				if (url.pathname === "/%40danypops/enigma") {
+					return Response.json({
+						name: "@danypops/enigma",
+						"dist-tags": { latest: "0.22.1" },
+						readme: PUBLISHED_README,
+					});
+				}
 				return new Response("not found", { status: 404 });
 			},
 		});
@@ -78,7 +84,13 @@ describe("published npm metadata E2E", () => {
 		const client = new PackedClient(`http://127.0.0.1:${daemonServer.port}`, TOKEN);
 		const info = await client.info("@danypops/enigma");
 
-		expect(npmRequests).toEqual([{ path: "/%40danypops/enigma/latest", accept: "application/json" }]);
+		expect(npmRequests).toHaveLength(2);
+		expect(npmRequests).toEqual(
+			expect.arrayContaining([
+				{ path: "/%40danypops/enigma/latest", accept: "application/json" },
+				{ path: "/%40danypops/enigma", accept: "application/json" },
+			]),
+		);
 		expect(info).toMatchObject({
 			name: "@danypops/enigma",
 			version: "0.22.1",