@danypops/pi-packed 0.22.2 → 0.22.3

package/extension/src/vehicle-tools.ts

@@ -74,7 +74,11 @@ export async function registerPackedVehicle(pi: ExtensionAPI): Promise<void> {
 		await registerVehicleTools(pi, client, {
 			permissions: ["packed:read"],
 			principal: { id: "pi-packed" },
-			shell: { coreOperations: CORE_OPERATIONS },
+			// ownVehicleName must match daemon.ts's own PACKED_VEHICLE_NAME (the shared Vehicle Handle
+			// Directory entry Packed's own daemon registers under via daemonOptions()'s vehicleName --
+			// see service/src/daemon/daemon.ts). activateForeignOperation is auto-supplied by
+			// registerVehicleTools. See enable-vehicle-shell-broker-mode-in-pi-packed.
+			shell: { coreOperations: CORE_OPERATIONS, broker: { ownVehicleName: "pi-packed" } },
 		});
 	} catch {
 		// Daemon state is stale/unreachable -- degrade silently, matching

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@danypops/pi-packed",
-  "version": "0.22.2",
+  "version": "0.22.3",
   "description": "Pi package lifecycle, validation, daemon, tools, profiles, and TUI",
   "type": "module",
   "bin": {

package/service/src/cli/cli.ts

@@ -14,6 +14,7 @@ import { generateIndex, indexPath, readIndex } from "../index/build-index.ts";
 import { syncCatalog } from "../packages/catalog.ts";
 import { catalogList, dbPath, getSyncMeta, latestVersion, openDb, searchLocal } from "../packages/db.ts";
 import { formatDeployVerification, verifyDeploy } from "../packages/deploy-verify.ts";
+import { listManagedPackages } from "../daemon/daemon-service.ts";
 import { defaultPiBin, NAME_RE } from "../packages/install.ts";
 import { npmPackageName, readInstalledPackages, readInstalledPackagesAcrossScopes } from "../packages/installed.ts";
 import type { Installer, Pkg, Registry, UpdateEntry } from "../packages/package.ts";
@@ -556,9 +557,13 @@ const commands: Record<string, { usage: string; run: Command }> = {
 	installed: {
 		usage: "packed installed [--json]",
 		async run(_rest, d, flags) {
-			const installed = d.daemon ? await d.daemon.installed() : readInstalledPackages(d.piHome);
+			const installed = d.daemon ? await d.daemon.installed() : listManagedPackages(d.piHome);
 			if (flags.json) return ok(`${JSON.stringify(installed)}\n`);
-			return ok(installed.map((p) => `  ${p.name}@${p.pinned ?? p.installed ?? "?"}\n`).join(""));
+			return ok(
+				installed
+					.map((p) => `  ${p.name}@${p.pinned ?? p.installed ?? "?"}${p.kind === "daemon-dependency" ? " [daemon-dependency]" : ""}\n`)
+					.join(""),
+			);
 		},
 	},
 

package/service/src/daemon/daemon-service.ts

@@ -25,7 +25,7 @@
  * step isn't a real convention, so detection reads what's already true
  * on disk instead of asking for one more declaration.
  */
-import { readFileSync } from "node:fs";
+import { readdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { createVehicleRegistrar, type VehicleRegistrar } from "@danypops/armada";
 import { resolveDaemonPaths } from "@danypops/vehicle-server/paths";
@@ -36,7 +36,8 @@ import {
 	type ServiceSpec,
 	unregisterVehicleService,
 } from "@danypops/vehicle-server/service";
-import { npmPackageName, readInstalledPackagesAcrossScopes } from "../packages/installed.ts";
+import { npmPackageName, readInstalledPackagesAcrossScopes, readPackageDeclarations } from "../packages/installed.ts";
+import type { InstalledPkg } from "../packages/package.ts";
 
 export interface DaemonServiceManifest {
 	/** Relative to the installed package's own root directory. */
@@ -154,12 +155,25 @@ export function detectVehicleDaemonService(
 	return undefined;
 }
 
+/**
+ * "daemon.json" -- not "handle.json" -- when a detected daemon carries no explicit
+ * packed.daemonService.handleFilename override. Confirmed live across every real Vehicle daemon
+ * checked in this ecosystem: jittor, pipes, and web-spider-daemon's own HANDLE_FILENAME constants
+ * are all "daemon.json"; only enigma uses "handle.json". A real, reported bug traced back to this
+ * default: pipes' Armada vehicle registration kept reverting to the wrong handlePath every time
+ * this auto-detect path re-ran, because this guess didn't match pipes' own real convention. Still
+ * a guess, not a read of the target package's own actual value -- a package with a real,
+ * non-default handleFilename must declare it explicitly via packed.daemonService for a fully
+ * correct resolution; this only narrows how often the guess is wrong.
+ */
+const DEFAULT_DETECTED_HANDLE_FILENAME = "daemon.json";
+
 function buildSpec(entry: ResolvedDaemonEntrypoint): ServiceSpec {
 	const paths = resolveDaemonPaths({
 		stateDirectoryName: entry.name,
 		databaseFilename: "unused.db",
 		tokenFilename: "unused-token",
-		handleFilename: entry.handleFilename ?? "handle.json",
+		handleFilename: entry.handleFilename ?? DEFAULT_DETECTED_HANDLE_FILENAME,
 		systemdUnitName: `${entry.name}.service`,
 	});
 	return {
@@ -218,6 +232,156 @@ export function resolveDaemonServiceSpec(piHome: string, source: string): Resolv
 	};
 }
 
+export interface DaemonDependencyPkg {
+	name: string;
+	version: string;
+	/** The Armada vehicle name resolveDaemonServiceSpec built for this package -- may differ
+	 * from `name`'s own bare unscoped form when a packed.daemonService manifest overrides it. */
+	vehicleName: string;
+}
+
+/** Bare npm package names directly under a node_modules directory -- one level for an
+ * unscoped name, two for a @scope/name pair. Never throws; a missing directory (no
+ * npm project yet) is just an empty result. */
+function listTopLevelPackageNames(nodeModulesDir: string): string[] {
+	let entries: string[];
+	try {
+		entries = readdirSync(nodeModulesDir);
+	} catch {
+		return [];
+	}
+	const names: string[] = [];
+	for (const entry of entries) {
+		if (!entry.startsWith("@")) {
+			names.push(entry);
+			continue;
+		}
+		let scoped: string[];
+		try {
+			scoped = readdirSync(join(nodeModulesDir, entry));
+		} catch {
+			continue;
+		}
+		for (const name of scoped) names.push(`${entry}/${name}`);
+	}
+	return names;
+}
+
+/** Matches reconcileAllDaemonServices' own bound -- a full node_modules sweep never
+ * processes an unbounded package list either. */
+const MAX_DAEMON_DEPENDENCY_SCAN = 500;
+
+/**
+ * Every top-level npm package physically installed under piHome/npm/node_modules
+ * that resolveDaemonServiceSpec() itself already recognizes as a real Vehicle-
+ * shaped daemon (an explicit packed.daemonService manifest, or
+ * detectVehicleDaemonService()'s own-bin-plus-real-vehicle-dependency
+ * convention), but that is NOT itself a pi:-configured extension
+ * (readPackageDeclarations() has no entry for it) -- e.g. @danypops/lector,
+ * added directly to piHome/npm/package.json as an independent pin so it can
+ * run ahead of whatever version its own pi-lector wrapper's dependency tree
+ * would otherwise resolve. These are real, running Armada vehicles that a
+ * pi:-manifest-only "installed packages" notion makes permanently invisible
+ * to `packed installed`/`packed update` -- see
+ * packed-package-update-restart-service-cant-manage.
+ *
+ * Deliberately does NOT walk one level into each configured extension's own
+ * dependencies the way resolveDaemonServiceSpec's own detection does for
+ * install-service/restart-service/doctor (service-doctor.ts's
+ * checkServiceUnitPaths already reaches that same dependency through its
+ * wrapper extension's own row) -- duplicating that walk here would
+ * double-report the same Vehicle under two different package names. This
+ * only reports a dependency independently resolvable BY ITS OWN NAME at
+ * piHome/npm's own top level -- exactly the shape a caller can actually run
+ * `packed update npm:<name>` against directly.
+ */
+export function listUnconfiguredDaemonDependencies(piHome: string): DaemonDependencyPkg[] {
+	const configured = new Set(
+		readPackageDeclarations(piHome).flatMap((source) => {
+			const name = npmPackageName(source);
+			return name ? [name] : [];
+		}),
+	);
+	const names = listTopLevelPackageNames(join(piHome, "npm", "node_modules")).slice(0, MAX_DAEMON_DEPENDENCY_SCAN);
+	const out: DaemonDependencyPkg[] = [];
+	for (const name of names) {
+		if (configured.has(name)) continue;
+		const resolved = resolveDaemonServiceSpec(piHome, `npm:${name}`);
+		if (resolved.ok) out.push({ name, version: resolved.spec.version, vehicleName: resolved.spec.name });
+	}
+	return out;
+}
+
+/**
+ * True when `packageName` (a bare npm name) is a pi:-configured extension --
+ * present in readPackageDeclarations()'s own packages[] list, regardless of
+ * whether it's pinned. The other half of the classification
+ * classifyUpdateSource() needs: a name that resolves ok via
+ * resolveDaemonServiceSpec() but returns false here is a "daemon-dependency"
+ * class source, not an "extension" one.
+ */
+export function isConfiguredExtension(piHome: string, packageName: string): boolean {
+	return readPackageDeclarations(piHome).some((source) => npmPackageName(source) === packageName);
+}
+
+export type UpdateSourceKind = "extension" | "daemon-dependency";
+
+/**
+ * Classifies an npm: source for package.update's own two-path mutation:
+ * "extension" (pi:-configured, settings.json's packages[] -- `pi update
+ * --extension` already handles this correctly, unchanged) vs.
+ * "daemon-dependency" (NOT pi:-configured, but resolveDaemonServiceSpec()
+ * resolves it directly BY ITS OWN NAME -- pi-core can never see this one;
+ * confirmed via this house's own failing-test repro, service/test/
+ * install.test.ts, of pi's real "No matching package found"). Needs the
+ * alternate npm-level mutation path (Installer.updateDaemonDependency())
+ * instead of shelling to `pi update --extension` at all.
+ *
+ * undefined for a non-npm: source, or an npm: source that is neither
+ * (never installed, or installed but not Vehicle-shaped) -- package.update's
+ * existing catch-all path (calling `pi update --extension` and surfacing
+ * whatever it reports) still applies unchanged to either of those, exactly
+ * as it did before this classification existed.
+ */
+export function classifyUpdateSource(piHome: string, source: string): UpdateSourceKind | undefined {
+	if (!source.startsWith("npm:")) return undefined;
+	const packageName = npmPackageName(source);
+	if (!packageName) return undefined;
+	if (isConfiguredExtension(piHome, packageName)) return "extension";
+	return resolveDaemonServiceSpec(piHome, source).ok ? "daemon-dependency" : undefined;
+}
+
+/**
+ * `packed installed`'s real, whole-fleet listing: every pi:-configured
+ * extension (`kind: "extension"`, exactly today's
+ * readInstalledPackagesAcrossScopes() output, unchanged) PLUS every
+ * top-level daemon-only dependency listUnconfiguredDaemonDependencies() can
+ * independently resolve (`kind: "daemon-dependency"`) -- so a real, running
+ * Armada vehicle like @danypops/lector shows up under its own name instead
+ * of staying invisibly nested inside its pi-lector wrapper's own row. See
+ * packed-package-update-restart-service-cant-manage.
+ *
+ * projectRoot only ever widens the extension half (matching
+ * readInstalledPackagesAcrossScopes' own scope) -- daemon-dependency
+ * detection is global-only for now, since the reported gap itself (an
+ * independently-pinned piHome/npm/package.json dependency) is a global-scope
+ * shape; a project-scoped .pi/npm equivalent is real future work, not
+ * something this fixes today.
+ */
+export function listManagedPackages(piHome: string, projectRoot?: string): InstalledPkg[] {
+	const extensions: InstalledPkg[] = readInstalledPackagesAcrossScopes(piHome, projectRoot).map((pkg) => ({
+		...pkg,
+		kind: "extension",
+	}));
+	const daemonDependencies: InstalledPkg[] = listUnconfiguredDaemonDependencies(piHome).map((dep) => ({
+		name: dep.name,
+		installed: dep.version,
+		scope: "global",
+		kind: "daemon-dependency",
+	}));
+	return [...extensions, ...daemonDependencies];
+}
+
 export interface ReconcileAllResult {
 	reconciled: Array<{ packageName: string; vehicleName: string; installed: boolean; reason?: string }>;
 	skipped: number;
@@ -227,7 +391,11 @@ export interface ReconcileAllResult {
 /** Matches readPackageDeclarations' own bound -- a reconcile-all sweep never processes an unbounded package list. */
 const MAX_RECONCILE_PACKAGES = 500;
 const PACKED_PACKAGE_NAME = "@danypops/pi-packed";
-const PACKED_VEHICLE_NAME = "pi-packed";
+/** Packed's own stable cross-daemon identity -- both its real Armada vehicle name (this file's own
+ * self-registration guards below) and, since it's the same daemon, the name it registers under in
+ * the shared Vehicle Handle Directory for Vehicle Shell broker mode (see daemon.ts's own
+ * daemonOptions() -- vehicleName: PACKED_VEHICLE_NAME). One canonical name, not two. */
+export const PACKED_VEHICLE_NAME = "pi-packed";
 const SELF_REGISTRATION_REASON = "Packed cannot replace its own Armada service from inside the running daemon";
 
 /**

package/service/src/daemon/daemon.ts

@@ -9,7 +9,7 @@ import {
 } from "@danypops/vehicle-server/daemon";
 import { ensureAuthToken } from "@danypops/vehicle-server/paths";
 import { captureLoadedModules, checkModuleFreshnessAll, ownRuntimeDependencyNames } from "../adoption/module-freshness.ts";
-import { type DaemonServiceInstaller, RealDaemonServiceInstaller, reconcileAllDaemonServices } from "./daemon-service.ts";
+import { type DaemonServiceInstaller, PACKED_VEHICLE_NAME, RealDaemonServiceInstaller, reconcileAllDaemonServices } from "./daemon-service.ts";
 import { generateIndex, indexPath, indexStatus } from "../index/build-index.ts";
 import { catalogStatus, syncCatalog } from "../packages/catalog.ts";
 import { latestVersion, openDb } from "../packages/db.ts";
@@ -134,6 +134,15 @@ export function daemonOptions(options: StartPackedDaemonOptions): StartDaemonOpt
 	return {
 		daemonLabel: "Packed",
 		handlePath: paths.handle,
+		// Vehicle Shell broker mode (enable-vehicle-shell-broker-mode-in-pi-packed): registers this
+		// daemon's own identity in the shared, cross-daemon Vehicle Handle Directory, alongside its
+		// existing private handlePath above -- unaffected either way. Must match
+		// extension/src/vehicle-tools.ts's own registerVehicleTools({ shell: { broker: { ownVehicleName }
+		// } }) literal (extension/ and service/ deliberately never cross-import in this package, so both
+		// sides carry the same comment-anchored literal instead of a shared TS import -- see that
+		// file's own comment).
+		vehicleName: PACKED_VEHICLE_NAME,
+		tokenPath: paths.token,
 		logger,
 		maintenanceTasks,
 		...(idleBudgetMs === undefined ? {} : { idleBudgetMs }),

package/service/src/daemon/service.ts

@@ -19,7 +19,7 @@ import { type AdoptionReport, scoreTarget } from "../adoption/score.ts";
 import { buildIndex, indexPath, type PackageIndex, readIndex, writeIndex } from "../index/build-index.ts";
 import { syncCatalog } from "../packages/catalog.ts";
 import { catalogList, dbPath, getSyncMeta, latestVersion, openDb, searchLocal } from "../packages/db.ts";
-import { defaultPiHome, readInstalledPackages, readInstalledPackagesAcrossScopes } from "../packages/installed.ts";
+import { defaultPiHome, npmPackageName, readInstalledPackagesAcrossScopes, splitNpmSource } from "../packages/installed.ts";
 import type { InstalledPkg, Installer, Pkg, PkgInfo, Registry, SearchPage, UpdateOutcome, UpdatesSnapshot } from "../packages/package.ts";
 import { buildSearchQuery, clampLimit } from "../packages/package.ts";
 import {
@@ -46,7 +46,14 @@ import { SEARCH_DEFAULT_LIMIT, SEARCH_MAX_LIMIT } from "../shared/constants.ts";
 import { createLogger } from "../shared/log.ts";
 import { VERSION } from "../shared/version.ts";
 import { formatCleanupSummary, runCleanup } from "./cleanup.ts";
-import { type DaemonServiceInstaller, type ReconcileAllResult, reconcileAllDaemonServices, RealDaemonServiceInstaller } from "./daemon-service.ts";
+import {
+	classifyUpdateSource,
+	type DaemonServiceInstaller,
+	listManagedPackages,
+	type ReconcileAllResult,
+	reconcileAllDaemonServices,
+	RealDaemonServiceInstaller,
+} from "./daemon-service.ts";
 import { checkUpdates, loadUpdates } from "./watcher.ts";
 
 const log = createLogger("service");
@@ -366,7 +373,7 @@ export function createApp(deps: Deps): { fetch: (req: Request) => Promise<Respon
 		}
 
 		if (path === "/installed" && req.method === "GET") {
-			return json(readInstalledPackages(deps.piHome ?? defaultPiHome()));
+			return json(listManagedPackages(deps.piHome ?? defaultPiHome()));
 		}
 
 		if (path === "/remove" && req.method === "POST") {
@@ -529,8 +536,35 @@ export function createApp(deps: Deps): { fetch: (req: Request) => Promise<Respon
 			// must reconcile against the NEW installed source, never the one that
 			// was just removed.
 			const restartSource = target ?? source;
+			// A real Vehicle-shaped daemon dependency with no pi: manifest of its
+			// own (e.g. @danypops/lector, pinned independently of its pi-lector
+			// wrapper) can never be found by `pi update --extension` -- pi-core's
+			// own "configured packages" notion IS settings.json's packages[].
+			// Route it through updateDaemonDependency() instead of ever shelling
+			// to pi at all, rather than surfacing its raw, unhelpful "No matching
+			// package found". See packed-package-update-restart-service-cant-manage.
+			const kind = classifyUpdateSource(piHomeForServiceInstall, source);
 			try {
-				const outcome = await deps.inst.update(source, { approved, target });
+				let outcome: UpdateOutcome;
+				if (kind === "daemon-dependency") {
+					if (!deps.inst.updateDaemonDependency) {
+						return json({
+							ok: false,
+							source,
+							output: `${source} is a real Vehicle-shaped daemon dependency with no pi: manifest of its own -- this installer cannot update it directly`,
+							reloadRequired: false,
+						});
+					}
+					const packageName = npmPackageName(source);
+					if (!packageName) return err(400, "invalid source; want npm:<pkg>[@ver]");
+					if (target !== undefined && npmPackageName(target) !== packageName) {
+						return err(400, "target must be the same package as source for a daemon-dependency update");
+					}
+					const [, targetVersion] = target ? splitNpmSource(target.slice(4)) : [undefined, undefined];
+					outcome = await deps.inst.updateDaemonDependency(packageName, { approved, version: targetVersion || undefined });
+				} else {
+					outcome = await deps.inst.update(source, { approved, target });
+				}
 				if (!restartSource.startsWith("npm:") || outcome.alreadyUpToDate) return json({ ok: true, source, ...outcome });
 				const service = await daemonServiceInstaller.restart(piHomeForServiceInstall, restartSource);
 				if (!service.ok) {

package/service/src/packages/install.ts

@@ -202,6 +202,46 @@ export class ExecInstaller implements Installer {
 		};
 	}
 
+	/**
+	 * The alternate mutation path for a source classifyUpdateSource() flags as
+	 * "daemon-dependency" -- genuinely installed and npm-resolvable, but NOT
+	 * itself a pi:-configured extension, so `pi update --extension` can never
+	 * find it (confirmed via a real failing-test repro of pi's own "No
+	 * matching package found"). Runs a real, scoped `npm install
+	 * <name>[@version]` at piHome/npm directly -- npm's own single-invocation
+	 * dependency + lockfile update, no separate reresolveDependencyTree() call
+	 * needed afterward. No `pi:` manifest exists for this package to validate
+	 * against, so -- unlike install()/update() -- there is no validate() step
+	 * here at all.
+	 */
+	async updateDaemonDependency(name: string, options?: { approved?: boolean; version?: string }): Promise<UpdateOutcome> {
+		const t0 = performance.now();
+		const previousVersion = readResolvedVersion(this.piHome, `npm:${name}`);
+		const spec = `${name}@${options?.version ?? "latest"}`;
+		const cwd = join(this.piHome, "npm");
+		// See run()'s own comment: env is explicit for the identical reason.
+		const proc = Bun.spawn([this.npmBin, "install", spec], { cwd, stdout: "pipe", stderr: "pipe", env: process.env });
+		const [stdout, stderr] = await Promise.all([new Response(proc.stdout).text(), new Response(proc.stderr).text()]);
+		const out = [stdout.trim(), stderr.trim()].filter(Boolean).join("\n");
+		const code = await proc.exited;
+		if (code !== 0) throw new Error(out || `exit ${code}`);
+		const currentVersion = readResolvedVersion(this.piHome, `npm:${name}`);
+		this.logger.debug("updateDaemonDependency timing", { name, totalMs: round1(performance.now() - t0) });
+		// Same honesty discipline as update() above: only trust a "nothing
+		// changed" conclusion when a real version was actually read both before
+		// and after.
+		const knowsBoth = previousVersion !== undefined && currentVersion !== undefined;
+		const changed = !knowsBoth || previousVersion !== currentVersion;
+		return {
+			output: out,
+			reloadRequired: changed,
+			alreadyUpToDate: !changed,
+			pinned: options?.version !== undefined,
+			previousVersion,
+			currentVersion,
+		};
+	}
+
 	/**
 	 * The supervised "move a pin" workflow `pi update --extension` can never
 	 * perform by itself (it intentionally skips an exact pin) -- see the

package/service/src/packages/package.ts

@@ -181,6 +181,21 @@ export interface Installer {
 	 * why a plain `pi update` can never move an exact pin by itself.
 	 */
 	update(source: string, options?: { approved?: boolean; local?: boolean; target?: string }): Promise<UpdateOutcome>;
+	/**
+	 * Updates a package that is genuinely installed and npm-resolvable but is
+	 * NOT itself a pi:-configured extension -- `pi update --extension` can
+	 * never find it (pi-core's own "configured packages" notion IS exactly
+	 * settings.json's packages[]), confirmed via a real failing-test repro
+	 * (service/test/install.test.ts) of pi's own "No matching package found".
+	 * `daemon-service.ts`'s `classifyUpdateSource()` decides when this path
+	 * applies instead of `update()` -- a real Vehicle-shaped daemon dependency
+	 * with no `pi:` manifest of its own (e.g. @danypops/lector, pinned
+	 * independently of its pi-lector wrapper). Optional because only a real
+	 * npm-backed Installer (ExecInstaller) can perform it; a caller checks for
+	 * its presence before using this path, exactly like validate()/
+	 * installOnly()/reresolveDependencyTree() below.
+	 */
+	updateDaemonDependency?(name: string, options?: { approved?: boolean; version?: string }): Promise<UpdateOutcome>;
 	/**
 	 * Optional batch-oriented split of install(), for a caller installing several packages
 	 * together (see SetupManager.apply()) -- a single ad hoc install() still does all three
@@ -212,6 +227,17 @@ export interface InstalledPkg {
 	pinned?: string;
 	installed?: string;
 	scope?: "global" | "project";
+	/**
+	 * "extension" (a real pi:-manifested package, settings.json's own
+	 * packages[]) vs. "daemon-dependency" (a Vehicle-shaped daemon Packed
+	 * independently detects at piHome/npm's own top level -- e.g.
+	 * @danypops/lector -- that is NOT itself pi:-configured). Undefined from
+	 * every pre-existing reader (readInstalledPackages/
+	 * readInstalledPackagesAcrossScopes); only daemon-service.ts's
+	 * listManagedPackages() sets this on every row it returns. See
+	 * packed-package-update-restart-service-cant-manage.
+	 */
+	kind?: "extension" | "daemon-dependency";
 }
 
 export interface UpdateEntry {

package/service/test/cli.test.ts

@@ -387,6 +387,57 @@ describe("CLI", () => {
 		expect(out).toContain('"pinned":"0.8.2"');
 	});
 
+	it("installed --json also surfaces a real Vehicle-shaped daemon dependency that has no pi: manifest of its own, standalone without a daemon -- packed-package-update-restart-service-cant-manage", async () => {
+		const d = deps();
+		writeFileSync(join(d.piHome, "settings.json"), JSON.stringify({ packages: ["npm:@danypops/pi-lector@0.12.7"] }));
+		const piLectorDir = join(d.piHome, "npm", "node_modules", "@danypops", "pi-lector");
+		mkdirSync(piLectorDir, { recursive: true });
+		writeFileSync(
+			join(piLectorDir, "package.json"),
+			JSON.stringify({ name: "@danypops/pi-lector", version: "0.12.7", dependencies: { "@danypops/lector": "^0.18.0" } }),
+		);
+		const lectorDir = join(d.piHome, "npm", "node_modules", "@danypops", "lector");
+		mkdirSync(lectorDir, { recursive: true });
+		writeFileSync(
+			join(lectorDir, "package.json"),
+			JSON.stringify({
+				name: "@danypops/lector",
+				version: "0.18.9",
+				bin: { lector: "src/cli.ts" },
+				dependencies: { "@danypops/vehicle-server": "^0.18.2" },
+			}),
+		);
+		const { code, out } = await cliRun(["installed", "--json"], d);
+		expect(code).toBe(0);
+		expect(out).toContain('"name":"@danypops/lector"');
+		expect(out).toContain('"kind":"daemon-dependency"');
+	});
+
+	it("installed (human-readable) tags a daemon-dependency row distinctly from a plain pi: extension row", async () => {
+		const d = deps();
+		writeFileSync(join(d.piHome, "settings.json"), JSON.stringify({ packages: ["npm:@danypops/pi-lector@0.12.7"] }));
+		const piLectorDir = join(d.piHome, "npm", "node_modules", "@danypops", "pi-lector");
+		mkdirSync(piLectorDir, { recursive: true });
+		writeFileSync(
+			join(piLectorDir, "package.json"),
+			JSON.stringify({ name: "@danypops/pi-lector", version: "0.12.7", dependencies: { "@danypops/lector": "^0.18.0" } }),
+		);
+		const lectorDir = join(d.piHome, "npm", "node_modules", "@danypops", "lector");
+		mkdirSync(lectorDir, { recursive: true });
+		writeFileSync(
+			join(lectorDir, "package.json"),
+			JSON.stringify({
+				name: "@danypops/lector",
+				version: "0.18.9",
+				bin: { lector: "src/cli.ts" },
+				dependencies: { "@danypops/vehicle-server": "^0.18.2" },
+			}),
+		);
+		const { code, out } = await cliRun(["installed"], d);
+		expect(code).toBe(0);
+		expect(out).toBe("  @danypops/pi-lector@0.12.7\n  @danypops/lector@0.18.9 [daemon-dependency]\n");
+	});
+
 	it("updates computes drift from the local mirror", async () => {
 		const d = deps();
 		writeFileSync(join(d.piHome, "settings.json"), JSON.stringify({ packages: ["npm:pi-extension-manager@0.8.2"] }));

package/service/test/daemon-maintenance.test.ts

@@ -128,6 +128,17 @@ describe("startPackedDaemon's own maintenance-task wiring (self-heals Vehicle dr
 		expect(options.idleBudgetMs).toBe(17_000);
 	});
 
+	it("registers pi-packed's own stable identity in the shared Vehicle Handle Directory (Vehicle Shell broker mode) -- enable-vehicle-shell-broker-mode-in-pi-packed", () => {
+		const paths = fakePaths();
+		const options = daemonOptions({ paths, reg: registry, inst: installer, piHome: fakePiHome([]), maintenanceTasks: [] });
+		// Must match extension/src/vehicle-tools.ts's own registerVehicleTools({ shell: { broker:
+		// { ownVehicleName } } }) literal -- the two sides can't share a real TS import (extension/
+		// and service/ deliberately never cross-import, matching this package's own established
+		// convention), so both carry the same comment-anchored literal instead.
+		expect(options.vehicleName).toBe("pi-packed");
+		expect(options.tokenPath).toBe(paths.token);
+	});
+
 	it("includes a vehicle-reconcile task, defaulting to RECONCILE_INTERVAL_DEFAULT_MS", () => {
 		const piHome = fakePiHome([]);
 		const paths = fakePaths();

package/service/test/daemon-service.test.ts

@@ -4,7 +4,14 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import type { VehicleRegistrar } from "@danypops/armada";
 import { createArmadaTestHarness } from "@danypops/armada/testing";
-import { detectVehicleDaemonService, RealDaemonServiceInstaller, resolveDaemonServiceSpec } from "../src/daemon/daemon-service.ts";
+import {
+	classifyUpdateSource,
+	detectVehicleDaemonService,
+	listManagedPackages,
+	listUnconfiguredDaemonDependencies,
+	RealDaemonServiceInstaller,
+	resolveDaemonServiceSpec,
+} from "../src/daemon/daemon-service.ts";
 
 const roots: string[] = [];
 afterEach(() => {
@@ -118,6 +125,22 @@ describe("resolveDaemonServiceSpec", () => {
 		});
 	});
 
+	it("defaults a detected (manifest-less) daemon's handle filename to 'daemon.json', not 'handle.json' -- confirmed live: jittor, pipes, and web-spider-daemon's own real HANDLE_FILENAME constants are all 'daemon.json'; only enigma uses 'handle.json'", () => {
+		const piHome = fakePiHome();
+		const dir = join(piHome, "npm", "node_modules", "@danypops/papyrus");
+		writeRawPackage(dir, {
+			name: "@danypops/papyrus",
+			version: "1.0.0",
+			bin: { papyrus: "src/cli.ts" },
+			dependencies: { "@danypops/vehicle-server": "^0.1.0" },
+		});
+
+		const result = resolveDaemonServiceSpec(piHome, "npm:@danypops/papyrus");
+		expect(result.ok).toBe(true);
+		if (!result.ok) throw new Error("expected ok");
+		expect(result.spec.handlePath.endsWith("daemon.json")).toBe(true);
+	});
+
 	it("falls back to detection one level into a real dependency -- a Pi extension with no daemon of its own", () => {
 		const piHome = fakePiHome();
 		const extDir = join(piHome, "npm", "node_modules", "@danypops/pi-papyrus");
@@ -208,6 +231,131 @@ describe("resolveDaemonServiceSpec", () => {
 	});
 });
 
+describe("listUnconfiguredDaemonDependencies -- the packed-package-update-restart-service-cant-manage visibility gap", () => {
+	it("reports a real Vehicle-shaped daemon installed at piHome/npm's own top level that is NOT a pi:-configured extension", () => {
+		const piHome = fakePiHome();
+		// @danypops/pi-lector IS configured (a real Pi extension, settings.json packages[]).
+		// @danypops/lector is a plain top-level dependency -- installed, own bin, real
+		// vehicle-server dependency -- but never itself `pi install`ed. Exactly the live
+		// shape confirmed in ~/.pi/agent/npm/package.json.
+		writeFileSync(join(piHome, "settings.json"), JSON.stringify({ packages: ["npm:@danypops/pi-lector"] }));
+		writeRawPackage(join(piHome, "npm", "node_modules", "@danypops", "pi-lector"), {
+			name: "@danypops/pi-lector",
+			version: "0.12.7",
+			dependencies: { "@danypops/lector": "^0.18.0" },
+		});
+		writeRawPackage(join(piHome, "npm", "node_modules", "@danypops", "lector"), {
+			name: "@danypops/lector",
+			version: "0.18.9",
+			bin: { lector: "src/cli.ts" },
+			dependencies: { "@danypops/vehicle-server": "^0.18.2" },
+		});
+
+		const result = listUnconfiguredDaemonDependencies(piHome);
+
+		expect(result).toEqual([{ name: "@danypops/lector", version: "0.18.9", vehicleName: "lector" }]);
+	});
+
+	it("never reports a package that is already pi:-configured, even though it independently resolves as a daemon too", () => {
+		const piHome = fakePiHome();
+		writeFileSync(join(piHome, "settings.json"), JSON.stringify({ packages: ["npm:@danypops/papyrus"] }));
+		writeRawPackage(join(piHome, "npm", "node_modules", "@danypops", "papyrus"), {
+			name: "@danypops/papyrus",
+			version: "1.0.0",
+			bin: { papyrus: "src/cli.ts" },
+			dependencies: { "@danypops/vehicle-server": "^0.1.0" },
+		});
+
+		expect(listUnconfiguredDaemonDependencies(piHome)).toEqual([]);
+	});
+
+	it("never reports a package with no real Vehicle-shaped daemon of its own -- an ordinary library dependency", () => {
+		const piHome = fakePiHome();
+		writeFileSync(join(piHome, "settings.json"), JSON.stringify({ packages: [] }));
+		writeRawPackage(join(piHome, "npm", "node_modules", "picomatch"), { name: "picomatch", version: "4.0.5" });
+
+		expect(listUnconfiguredDaemonDependencies(piHome)).toEqual([]);
+	});
+
+	it("returns [] rather than throwing when piHome/npm/node_modules doesn't exist yet", () => {
+		const piHome = fakePiHome();
+		expect(listUnconfiguredDaemonDependencies(piHome)).toEqual([]);
+	});
+});
+
+describe("listManagedPackages -- packed installed's real whole-fleet listing (packed-package-update-restart-service-cant-manage)", () => {
+	it("tags a pi:-configured extension row 'extension' and a detected top-level daemon dependency 'daemon-dependency', side by side", () => {
+		const piHome = fakePiHome();
+		writeFileSync(join(piHome, "settings.json"), JSON.stringify({ packages: ["npm:@danypops/pi-lector@0.12.7"] }));
+		writeRawPackage(join(piHome, "npm", "node_modules", "@danypops", "pi-lector"), {
+			name: "@danypops/pi-lector",
+			version: "0.12.7",
+			dependencies: { "@danypops/lector": "^0.18.0" },
+		});
+		writeRawPackage(join(piHome, "npm", "node_modules", "@danypops", "lector"), {
+			name: "@danypops/lector",
+			version: "0.18.9",
+			bin: { lector: "src/cli.ts" },
+			dependencies: { "@danypops/vehicle-server": "^0.18.2" },
+		});
+
+		const result = listManagedPackages(piHome);
+
+		expect(result).toEqual([
+			{ name: "@danypops/pi-lector", pinned: "0.12.7", installed: undefined, scope: "global", kind: "extension" },
+			{ name: "@danypops/lector", installed: "0.18.9", scope: "global", kind: "daemon-dependency" },
+		]);
+	});
+
+	it("is exactly today's extension listing, with kind added, when there are no daemon-only dependencies at all", () => {
+		const piHome = fakePiHome();
+		writeFileSync(piHome + "/settings.json", JSON.stringify({ packages: ["npm:plain@1.0.0"] }));
+		writeRawPackage(join(piHome, "npm", "node_modules", "plain"), { name: "plain", version: "1.0.0" });
+
+		expect(listManagedPackages(piHome)).toEqual([{ name: "plain", pinned: "1.0.0", installed: undefined, scope: "global", kind: "extension" }]);
+	});
+});
+
+describe("classifyUpdateSource -- package.update's own two-path split (packed-package-update-restart-service-cant-manage)", () => {
+	it("classifies a pi:-configured extension as 'extension', even when it also happens to resolve as a Vehicle daemon itself", () => {
+		const piHome = fakePiHome();
+		writeFileSync(piHome + "/settings.json", JSON.stringify({ packages: ["npm:@danypops/papyrus"] }));
+		writeRawPackage(join(piHome, "npm", "node_modules", "@danypops", "papyrus"), {
+			name: "@danypops/papyrus",
+			version: "1.0.0",
+			bin: { papyrus: "src/cli.ts" },
+			dependencies: { "@danypops/vehicle-server": "^0.1.0" },
+		});
+
+		expect(classifyUpdateSource(piHome, "npm:@danypops/papyrus")).toBe("extension");
+	});
+
+	it("classifies a real Vehicle-shaped daemon with no pi:-configured entry of its own as 'daemon-dependency'", () => {
+		const piHome = fakePiHome();
+		writeFileSync(piHome + "/settings.json", JSON.stringify({ packages: ["npm:@danypops/pi-lector"] }));
+		writeRawPackage(join(piHome, "npm", "node_modules", "@danypops", "lector"), {
+			name: "@danypops/lector",
+			version: "0.18.9",
+			bin: { lector: "src/cli.ts" },
+			dependencies: { "@danypops/vehicle-server": "^0.18.2" },
+		});
+
+		expect(classifyUpdateSource(piHome, "npm:@danypops/lector")).toBe("daemon-dependency");
+	});
+
+	it("classifies neither for an npm: source that resolves as nothing at all", () => {
+		const piHome = fakePiHome();
+		writeFileSync(piHome + "/settings.json", JSON.stringify({ packages: [] }));
+
+		expect(classifyUpdateSource(piHome, "npm:never-installed")).toBeUndefined();
+	});
+
+	it("classifies neither for a non-npm source -- git:/https: replace/update behavior is untouched", () => {
+		const piHome = fakePiHome();
+		expect(classifyUpdateSource(piHome, "git:github.com/u/r@v1")).toBeUndefined();
+	});
+});
+
 describe("RealDaemonServiceInstaller -- Armada registration through the in-process registrar", () => {
 	it("install() resolves the package and drives Armada's real registrar/reconciler through the isolated harness", async () => {
 		const piHome = fakePiHome();

package/service/test/install.test.ts

@@ -298,6 +298,174 @@ process.exit(1);
 	return script;
 }
 
+/**
+ * A fake `pi` binary reproducing real `pi update --extension <source>`'s own
+ * "configured packages" check (settings.json's `packages[]` -- the exact
+ * same list installed.ts's readPackageDeclarations()/readInstalledPackages()
+ * reads) -- distinct from writeFakePi above, which never looks at
+ * settings.json at all and so can't reproduce this failure mode. Real `pi`
+ * fails this way for ANY source not itself present in `packages[]`,
+ * regardless of whether it is genuinely resolvable on disk in node_modules --
+ * exactly the shape of a plain library dependency (e.g. @danypops/lector,
+ * added directly to piHome/npm/package.json so it can run as its own
+ * standalone Armada vehicle) that was never itself `pi install`ed as a Pi
+ * extension. See packed-package-update-restart-service-cant-manage.
+ */
+function writeFakePiConfiguredOnly(dir: string, piHome: string): string {
+	const script = join(dir, "fake-pi-configured-only");
+	const body = `
+const piHome = ${JSON.stringify(piHome)};
+const fs = require("node:fs");
+const path = require("node:path");
+
+function bareName(source) {
+	const spec = source.startsWith("npm:") ? source.slice(4) : source;
+	const at = spec.lastIndexOf("@");
+	return at > 0 ? spec.slice(0, at) : spec;
+}
+function entrySource(entry) {
+	return typeof entry === "string" ? entry : entry && typeof entry === "object" ? entry.source : undefined;
+}
+function readSettings() {
+	try {
+		return JSON.parse(fs.readFileSync(path.join(piHome, "settings.json"), "utf8"));
+	} catch {
+		return { packages: [] };
+	}
+}
+
+const [cmd, flag, source] = process.argv.slice(2);
+if (cmd === "update" && flag === "--extension") {
+	const settings = readSettings();
+	const configured = (settings.packages ?? []).some((e) => bareName(entrySource(e) ?? "") === bareName(source));
+	if (!configured) {
+		process.stderr.write("Error: No matching package found for " + source + "\\n");
+		process.exit(1);
+	}
+	process.stdout.write("Updated " + source + "\\n");
+	process.exit(0);
+}
+process.stderr.write("unsupported invocation: " + process.argv.slice(2).join(" ") + "\\n");
+process.exit(1);
+`;
+	writeFileSync(script, `#!/usr/bin/env bun\n${body}`);
+	chmodSync(script, 0o755);
+	return script;
+}
+
+describe("ExecInstaller.update() — a real Vehicle daemon dependency with no pi: extension manifest of its own (packed-package-update-restart-service-cant-manage)", () => {
+	it("fails with pi's own 'No matching package found' for a package that is genuinely installed on disk but was never configured as a Pi extension -- e.g. a standalone Armada vehicle dependency like @danypops/lector", async () => {
+		const scriptDir = track(mkdtempSync(join(tmpdir(), "packed-exec-bin-")));
+		const piHome = writePiHome({ "@danypops/lector": "1.0.0", "@danypops/pi-lector": "0.12.7" });
+		// Only pi-lector (the real Pi extension, with its own `pi:` manifest) is a
+		// configured `packages[]` entry. @danypops/lector is a plain library
+		// dependency of piHome/npm/package.json -- installed and resolvable in
+		// node_modules, registered as its own independent Armada vehicle, but
+		// never itself `pi install`ed.
+		writeFileSync(join(piHome, "settings.json"), JSON.stringify({ packages: ["npm:@danypops/pi-lector"] }));
+		const bin = writeFakePiConfiguredOnly(scriptDir, piHome);
+		const npmBin = writeFakeNpm(scriptDir, join(scriptDir, "npm.log"));
+		const installer = new ExecInstaller(bin, piHome, undefined, npmBin);
+
+		await expect(installer.update("npm:@danypops/lector")).rejects.toThrow(/No matching package found for npm:@danypops\/lector/);
+
+		// Its sibling, a real configured Pi extension, updates fine through the
+		// exact same code path -- matching the live-confirmed asymmetry this task
+		// recorded (`packed update npm:@danypops/pi-lector` reports
+		// alreadyUpToDate, `packed update npm:@danypops/lector` fails outright).
+		const sibling = await installer.update("npm:@danypops/pi-lector");
+		expect(sibling.alreadyUpToDate).toBe(true);
+	});
+});
+
+/**
+ * A fake `npm` binary genuinely implementing `install <name>[@version]` against
+ * a real piHome -- distinct from writeFakeNpm above (a no-args
+ * reresolveDependencyTree() stand-in) and writeFakeReplacePi (implements `pi
+ * install`/`pi remove`, not raw npm). No version given simulates "whatever
+ * the registry's own latest happens to be right now" via `latestVersion`.
+ */
+function writeFakeNpmInstall(dir: string, piHome: string, latestVersion = "9.9.9"): string {
+	const script = join(dir, "fake-npm-install");
+	const body = `
+const piHome = ${JSON.stringify(piHome)};
+const latestVersion = ${JSON.stringify(latestVersion)};
+const fs = require("node:fs");
+const path = require("node:path");
+
+const [cmd, spec] = process.argv.slice(2);
+if (cmd !== "install" || !spec) {
+	process.stderr.write("unsupported invocation: " + process.argv.slice(2).join(" ") + "\\n");
+	process.exit(1);
+}
+const at = spec.lastIndexOf("@");
+const name = at > 0 ? spec.slice(0, at) : spec;
+const version = at > 0 ? spec.slice(at + 1) : latestVersion;
+const resolved = version === "latest" ? latestVersion : version;
+const pkgDir = path.join(piHome, "npm", "node_modules", name);
+fs.mkdirSync(pkgDir, { recursive: true });
+fs.writeFileSync(path.join(pkgDir, "package.json"), JSON.stringify({ name, version: resolved }));
+process.stdout.write("added 1 package, changed 1 package\\n");
+process.exit(0);
+`;
+	writeFileSync(script, `#!/usr/bin/env bun\n${body}`);
+	chmodSync(script, 0o755);
+	return script;
+}
+
+describe("ExecInstaller.updateDaemonDependency() -- the alternate npm-level mutation path for a package with no pi: manifest of its own (packed-package-update-restart-service-cant-manage)", () => {
+	it("bumps to the registry's real latest when no version is given, reporting an honest reloadRequired", async () => {
+		const scriptDir = track(mkdtempSync(join(tmpdir(), "packed-exec-daemon-dep-")));
+		const piHome = writePiHome({ "@danypops/lector": "0.18.9" });
+		const npmBin = writeFakeNpmInstall(scriptDir, piHome, "0.19.0");
+		const installer = new ExecInstaller("unused-pi-bin", piHome, undefined, npmBin);
+
+		const outcome = await installer.updateDaemonDependency("@danypops/lector");
+
+		expect(outcome.previousVersion).toBe("0.18.9");
+		expect(outcome.currentVersion).toBe("0.19.0");
+		expect(outcome.reloadRequired).toBe(true);
+		expect(outcome.alreadyUpToDate).toBe(false);
+		expect(outcome.pinned).toBe(false);
+	});
+
+	it("pins to an explicit version when one is given, and reports pinned:true", async () => {
+		const scriptDir = track(mkdtempSync(join(tmpdir(), "packed-exec-daemon-dep-")));
+		const piHome = writePiHome({ "@danypops/lector": "0.18.9" });
+		const npmBin = writeFakeNpmInstall(scriptDir, piHome);
+		const installer = new ExecInstaller("unused-pi-bin", piHome, undefined, npmBin);
+
+		const outcome = await installer.updateDaemonDependency("@danypops/lector", { version: "0.20.0" });
+
+		expect(outcome.currentVersion).toBe("0.20.0");
+		expect(outcome.pinned).toBe(true);
+		expect(outcome.reloadRequired).toBe(true);
+	});
+
+	it("reports an honest alreadyUpToDate when the version genuinely doesn't change", async () => {
+		const scriptDir = track(mkdtempSync(join(tmpdir(), "packed-exec-daemon-dep-")));
+		const piHome = writePiHome({ "@danypops/lector": "0.18.9" });
+		const npmBin = writeFakeNpmInstall(scriptDir, piHome, "0.18.9");
+		const installer = new ExecInstaller("unused-pi-bin", piHome, undefined, npmBin);
+
+		const outcome = await installer.updateDaemonDependency("@danypops/lector");
+
+		expect(outcome.alreadyUpToDate).toBe(true);
+		expect(outcome.reloadRequired).toBe(false);
+	});
+
+	it("surfaces a real npm failure instead of silently reporting success", async () => {
+		const scriptDir = track(mkdtempSync(join(tmpdir(), "packed-exec-daemon-dep-")));
+		const piHome = writePiHome({ "@danypops/lector": "0.18.9" });
+		const failingNpm = join(scriptDir, "fake-npm-fail");
+		writeFileSync(failingNpm, ["#!/usr/bin/env bash", "echo 'ERESOLVE unable to resolve dependency tree' >&2", "exit 1"].join("\n"));
+		chmodSync(failingNpm, 0o755);
+		const installer = new ExecInstaller("unused-pi-bin", piHome, undefined, failingNpm);
+
+		await expect(installer.updateDaemonDependency("@danypops/lector")).rejects.toThrow(/ERESOLVE/);
+	});
+});
+
 describe("ExecInstaller.update({ target }) — the supervised replace() workflow for moving an exact pin", () => {
 	function setup(options: { failInstallFor?: string } = {}) {
 		const scriptDir = track(mkdtempSync(join(tmpdir(), "packed-replace-bin-")));

package/service/test/service.test.ts

@@ -58,6 +58,14 @@ class FakeInstaller implements Installer {
 		this.gotTarget = options?.target;
 		return { output: this.output, reloadRequired: true, alreadyUpToDate: false, pinned: false, ...this.updateOutcome };
 	}
+	updateDaemonDependencyGotName = "";
+	updateDaemonDependencyGotVersion: string | undefined;
+	updateDaemonDependencyOutcome: Partial<UpdateOutcome> = {};
+	async updateDaemonDependency(name: string, options?: { approved?: boolean; version?: string }): Promise<UpdateOutcome> {
+		this.updateDaemonDependencyGotName = name;
+		this.updateDaemonDependencyGotVersion = options?.version;
+		return { output: this.output, reloadRequired: true, alreadyUpToDate: false, pinned: false, ...this.updateDaemonDependencyOutcome };
+	}
 }
 
 class FakeDaemonServiceInstaller implements DaemonServiceInstaller {
@@ -606,6 +614,72 @@ describe("service app", () => {
 		});
 	});
 
+	it("POST /update routes a real Vehicle-shaped daemon dependency with no pi: manifest of its own through updateDaemonDependency, never pi update --extension -- packed-package-update-restart-service-cant-manage", async () => {
+		const inst = new FakeInstaller();
+		const svc = new FakeDaemonServiceInstaller();
+		const piHome = track(mkdtempSync(join(tmpdir(), "packed-update-daemon-dep-")));
+		writeFileSync(join(piHome, "settings.json"), JSON.stringify({ packages: ["npm:@danypops/pi-lector@0.12.7"] }));
+		const lectorDir = join(piHome, "npm", "node_modules", "@danypops", "lector");
+		mkdirSync(lectorDir, { recursive: true });
+		writeFileSync(
+			join(lectorDir, "package.json"),
+			JSON.stringify({
+				name: "@danypops/lector",
+				version: "0.18.9",
+				bin: { lector: "src/cli.ts" },
+				dependencies: { "@danypops/vehicle-server": "^0.18.2" },
+			}),
+		);
+		const app = createApp(deps({ inst, daemonServiceInstaller: svc, piHome }));
+
+		const response = await app.fetch(
+			new Request("http://x/update", {
+				method: "POST",
+				headers: { ...auth, "content-type": "application/json" },
+				body: JSON.stringify({ source: "npm:@danypops/lector", approved: true }),
+			}),
+		);
+
+		expect(response.status).toBe(200);
+		expect(await response.json()).toMatchObject({ ok: true, source: "npm:@danypops/lector", serviceReconciled: true });
+		expect(inst.updateDaemonDependencyGotName).toBe("@danypops/lector");
+		// Never fell through to pi update --extension -- the exact call that fails
+		// live with pi-core's own "No matching package found".
+		expect(inst.updated).toBe("");
+		expect(svc.restartGotSource).toBe("npm:@danypops/lector");
+	});
+
+	it("POST /update still routes a pi:-configured extension through the ordinary pi update --extension path, unchanged, even when it also happens to resolve as a Vehicle daemon itself", async () => {
+		const inst = new FakeInstaller();
+		const svc = new FakeDaemonServiceInstaller();
+		const piHome = track(mkdtempSync(join(tmpdir(), "packed-update-extension-")));
+		writeFileSync(join(piHome, "settings.json"), JSON.stringify({ packages: ["npm:@danypops/papyrus"] }));
+		const papyrusDir = join(piHome, "npm", "node_modules", "@danypops", "papyrus");
+		mkdirSync(papyrusDir, { recursive: true });
+		writeFileSync(
+			join(papyrusDir, "package.json"),
+			JSON.stringify({
+				name: "@danypops/papyrus",
+				version: "1.0.0",
+				bin: { papyrus: "src/cli.ts" },
+				dependencies: { "@danypops/vehicle-server": "^0.18.2" },
+			}),
+		);
+		const app = createApp(deps({ inst, daemonServiceInstaller: svc, piHome }));
+
+		const response = await app.fetch(
+			new Request("http://x/update", {
+				method: "POST",
+				headers: { ...auth, "content-type": "application/json" },
+				body: JSON.stringify({ source: "npm:@danypops/papyrus", approved: true }),
+			}),
+		);
+
+		expect(response.status).toBe(200);
+		expect(inst.updated).toBe("npm:@danypops/papyrus");
+		expect(inst.updateDaemonDependencyGotName).toBe("");
+	});
+
 	it("GET /updates serves the watcher snapshot", async () => {
 		const d = deps();
 		await saveUpdates(d.stateDir, {
@@ -632,6 +706,37 @@ describe("service app", () => {
 		expect(body.map((p: { name: string }) => p.name)).toEqual(["pi-extension-manager", "obj"]);
 	});
 
+	it("GET /installed also surfaces a real Vehicle-shaped daemon dependency that has no pi: manifest of its own -- packed-package-update-restart-service-cant-manage", async () => {
+		const piHome = track(mkdtempSync(join(tmpdir(), "packed-pi-")));
+		writeFileSync(join(piHome, "settings.json"), JSON.stringify({ packages: ["npm:@danypops/pi-lector@0.12.7"] }));
+		const piLectorDir = join(piHome, "npm", "node_modules", "@danypops", "pi-lector");
+		mkdirSync(piLectorDir, { recursive: true });
+		writeFileSync(
+			join(piLectorDir, "package.json"),
+			JSON.stringify({ name: "@danypops/pi-lector", version: "0.12.7", dependencies: { "@danypops/lector": "^0.18.0" } }),
+		);
+		const lectorDir = join(piHome, "npm", "node_modules", "@danypops", "lector");
+		mkdirSync(lectorDir, { recursive: true });
+		writeFileSync(
+			join(lectorDir, "package.json"),
+			JSON.stringify({
+				name: "@danypops/lector",
+				version: "0.18.9",
+				bin: { lector: "src/cli.ts" },
+				dependencies: { "@danypops/vehicle-server": "^0.18.2" },
+			}),
+		);
+		const d = deps({ piHome });
+		const app = createApp(d);
+		const res = await app.fetch(new Request("http://x/installed", { headers: auth }));
+		expect(res.status).toBe(200);
+		const body = (await res.json()) as any;
+		expect(body).toEqual([
+			{ name: "@danypops/pi-lector", pinned: "0.12.7", installed: undefined, scope: "global", kind: "extension" },
+			{ name: "@danypops/lector", installed: "0.18.9", scope: "global", kind: "daemon-dependency" },
+		]);
+	});
+
 	it("POST /remove validates bare names and reports in-band", async () => {
 		const inst = new FakeInstaller();
 		const app = createApp(deps({ inst }));