@danypops/pi-packed 0.22.6 → 0.24.0

package/extension/src/vehicle-tools.ts

@@ -74,11 +74,10 @@ export async function registerPackedVehicle(pi: ExtensionAPI): Promise<void> {
 		await registerVehicleTools(pi, client, {
 			permissions: ["packed:read"],
 			principal: { id: "pi-packed" },
-			// ownVehicleName must match daemon.ts's own PACKED_VEHICLE_NAME (the shared Vehicle Handle
-			// Directory entry Packed's own daemon registers under via daemonOptions()'s vehicleName --
-			// see service/src/daemon/daemon.ts). activateForeignOperation is auto-supplied by
-			// registerVehicleTools. See enable-vehicle-shell-broker-mode-in-pi-packed.
-			shell: { coreOperations: CORE_OPERATIONS, broker: { ownVehicleName: "pi-packed" } },
+			// tools_list/tools_man are a neutral, process-wide singleton now (vehicle-client-pi's own
+			// ensureVehicleShellHandle) -- no ownVehicleName/broker option needed here anymore; every
+			// vehicle in the process (including packed's own) is discovered and namespaced uniformly.
+			shell: { coreOperations: CORE_OPERATIONS },
 		});
 	} catch {
 		// Daemon state is stale/unreachable -- degrade silently, matching

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@danypops/pi-packed",
-  "version": "0.22.6",
+  "version": "0.24.0",
   "description": "Pi package lifecycle, validation, daemon, tools, profiles, and TUI",
   "type": "module",
   "bin": {
@@ -31,7 +31,7 @@
     "@danypops/packed": "^0.7.0",
     "@danypops/pi-extension-harness": "^0.7.0",
     "@danypops/vehicle-client": "^0.8.1",
-    "@danypops/vehicle-client-pi": "^0.39.0",
+    "@danypops/vehicle-client-pi": "^0.40.1",
     "@danypops/vehicle-core": "^0.15.0",
     "@danypops/vehicle-server": "^0.22.0",
     "jiti": "^2.7.0",

package/service/src/cli/cli.ts

@@ -171,6 +171,7 @@ interface Flags {
 	machineLocal: boolean;
 	ecosystem: boolean;
 	self: boolean;
+	all: boolean;
 	project?: string;
 	version?: string;
 	to?: string;
@@ -189,6 +190,7 @@ function parseFlags(rest: string[]): { flags: Flags; pos: string[] } {
 		machineLocal: false,
 		ecosystem: false,
 		self: false,
+		all: false,
 	};
 	const pos: string[] = [];
 	for (let i = 0; i < rest.length; i++) {
@@ -203,6 +205,7 @@ function parseFlags(rest: string[]): { flags: Flags; pos: string[] } {
 		else if (a === "--machine-local") flags.machineLocal = true;
 		else if (a === "--ecosystem") flags.ecosystem = true;
 		else if (a === "--self") flags.self = true;
+		else if (a === "--all") flags.all = true;
 		else if (a === "--limit" && i + 1 < rest.length) flags.limit = Number(rest[++i]) || SEARCH_DEFAULT_LIMIT;
 		else if (a.startsWith("--limit=")) flags.limit = Number(a.slice(8)) || SEARCH_DEFAULT_LIMIT;
 		else if (a === "--project" && i + 1 < rest.length) flags.project = rest[++i];
@@ -671,8 +674,29 @@ const commands: Record<string, { usage: string; run: Command }> = {
 
 	update: {
 		usage:
-			"packed update <configured-source> [--to <new-source>] [--approve] [--json] | packed update --self [--approve] [--json]  (--to replaces an exact pin end to end -- see verify-deploy/doctor for post-replace checks)",
+			"packed update <configured-source> [--to <new-source>] [--approve] [--json] | packed update --self [--approve] [--json] | packed update --all [--approve] [--json]  (--to replaces an exact pin end to end -- see verify-deploy/doctor for post-replace checks; --all batches every currently-stale package, re-resolving once instead of once per package)",
 		async run(_rest, d, flags, pos) {
+			if (flags.all) {
+				if (!d.daemon) return fail("update --all requires a running packed daemon\n");
+				try {
+					const result = await d.daemon.updateAll(undefined, flags.approved);
+					if (flags.json) return ok(`${JSON.stringify(result)}\n`);
+					if (result.results.length === 0) return ok("all pi packages up to date (per the local mirror)\n");
+					let out = `${result.output}\n\n`;
+					for (const item of result.results) {
+						const transition = item.previousVersion && item.currentVersion ? ` (${item.previousVersion} → ${item.currentVersion})` : "";
+						const status = item.ok ? (item.alreadyUpToDate ? "already up to date" : `updated${transition}`) : `FAILED: ${item.output}`;
+						out += `  ${item.source}  ${status}\n`;
+					}
+					if (result.reresolveError) out += `\nWARNING: final dependency re-resolution failed: ${result.reresolveError}\n`;
+					const anyChanged = result.results.some((item) => item.ok && !item.alreadyUpToDate);
+					if (anyChanged) out += "\nReload Pi with /reload to activate the updated packages.\n";
+					return result.ok ? ok(out) : fail(out);
+				} catch (error) {
+					const message = error instanceof Error ? error.message : String(error);
+					return flags.json ? fail(`${JSON.stringify({ ok: false, error: message })}\n`) : fail(`${message}\n`);
+				}
+			}
 			if (flags.self) {
 				try {
 					assertPackagePermission(await d.security.security(), "update.self", flags.approved);

package/service/src/daemon/client.ts

@@ -52,6 +52,7 @@ export interface PackageDaemonPort {
 	reconcileServices(approved?: boolean, projectRoot?: string): Promise<OperationOutputs["package.reconcile_services"]>;
 	remove(name: string, approved?: boolean): Promise<string>;
 	update(source: string, approved?: boolean, target?: string): Promise<UpdateOutcome>;
+	updateAll(sources?: string[], approved?: boolean): Promise<OperationOutputs["package.update_all"]>;
 	piStatus(): Promise<PiVersionReport>;
 	resourcesList(projectRoot?: string): Promise<{ global: PackageResources[]; project: PackageResources[] }>;
 	resourcesToggle(
@@ -283,6 +284,14 @@ export class PackageDaemonClient implements PackageDaemonPort {
 			rollback: result.rollback,
 		};
 	}
+
+	/** Batch update -- see updateManyPackages()'s own doc comment (install.ts). sources omitted
+	 * defaults to every currently-stale global package the mirror already knows about. */
+	async updateAll(sources?: string[], approved = false): Promise<OperationOutputs["package.update_all"]> {
+		const result = await this.call("package.update_all", { sources, approved });
+		if (!result.ok) throw new PackageDaemonError(result.output || "failed to update packages", "package.update_all");
+		return result;
+	}
 }
 
 export class PackageDaemonInstaller implements Installer {

package/service/src/daemon/service.ts

@@ -18,6 +18,7 @@ import { NpmPackVerifier, type PackReport } from "../adoption/pack.ts";
 import { type AdoptionReport, scoreTarget } from "../adoption/score.ts";
 import { buildIndex, indexPath, type PackageIndex, readIndex, writeIndex } from "../index/build-index.ts";
 import { syncCatalog } from "../packages/catalog.ts";
+import { updateManyPackages } from "../packages/install.ts";
 import { catalogList, dbPath, getSyncMeta, latestVersion, openDb, searchLocal } from "../packages/db.ts";
 import { defaultPiHome, npmPackageName, readInstalledPackagesAcrossScopes, splitNpmSource } from "../packages/installed.ts";
 import type { InstalledPkg, Installer, Pkg, PkgInfo, Registry, SearchPage, UpdateOutcome, UpdatesSnapshot } from "../packages/package.ts";
@@ -113,6 +114,7 @@ export type OperationName =
 	| "package.reconcile_services"
 	| "package.remove"
 	| "package.update"
+	| "package.update_all"
 	| "resources.list"
 	| "resources.toggle"
 	| "pi.status"
@@ -144,6 +146,7 @@ export interface OperationInputs {
 	"package.reconcile_services": { approved?: boolean; projectRoot?: string };
 	"package.remove": { name: string; approved?: boolean };
 	"package.update": { source: string; approved?: boolean; target?: string };
+	"package.update_all": { sources?: string[]; approved?: boolean };
 	"resources.list": { projectRoot?: string };
 	"resources.toggle": { source: string; field: ResourceField; path: string; enabled: boolean; projectRoot?: string; approved?: boolean };
 	"pi.status": Record<string, never>;
@@ -157,6 +160,10 @@ interface MutationResponse {
 	output: string;
 }
 interface UpdateMutationResponse extends MutationResponse, Partial<Omit<UpdateOutcome, "output">> {}
+interface UpdateAllMutationResponse extends MutationResponse {
+	results: Array<{ source: string; ok: boolean; output: string; serviceReconciled?: boolean } & Partial<Omit<UpdateOutcome, "output">>>;
+	reresolveError?: string;
+}
 interface InstallServiceResponse {
 	ok: boolean;
 	output: string;
@@ -192,6 +199,7 @@ export interface OperationOutputs {
 	"package.reconcile_services": ReconcileServicesResponse;
 	"package.remove": MutationResponse;
 	"package.update": UpdateMutationResponse;
+	"package.update_all": UpdateAllMutationResponse;
 	"resources.list": { global: PackageResources[]; project: PackageResources[] };
 	"resources.toggle": MutationResponse;
 	"pi.status": PiVersionReport;
@@ -224,6 +232,7 @@ export const OPERATION_NAMES: readonly OperationName[] = [
 	"package.reconcile_services",
 	"package.remove",
 	"package.update",
+	"package.update_all",
 	"resources.list",
 	"resources.toggle",
 	"pi.status",
@@ -577,6 +586,55 @@ export function createApp(deps: Deps): { fetch: (req: Request) => Promise<Respon
 			}
 		}
 
+		if (path === "/update-all" && req.method === "POST") {
+			let approved = false;
+			let sources: string[] | undefined;
+			try {
+				const body = (await req.json()) as { approved?: unknown; sources?: unknown };
+				approved = body.approved === true;
+				if (Array.isArray(body.sources)) sources = body.sources.filter((item): item is string => typeof item === "string");
+			} catch {
+				/* fall through -- approved stays false, sources stays undefined (defaults to every stale package) */
+			}
+			if (sources && sources.some((source) => !SOURCE_RE.test(source))) {
+				return err(400, "invalid source; want a configured npm:, git:, or https package source");
+			}
+			const denied = authorize("update_all", approved);
+			if (denied) return denied;
+			// Default: every currently-stale GLOBAL package the mirror already knows about -- same set
+			// `packed updates` (no --project) reports. A caller wanting project-scoped sources too
+			// passes them explicitly via body.sources; this endpoint never guesses project scope.
+			if (!sources) {
+				const snap = await loadUpdates(deps.stateDir);
+				sources = (snap?.updates ?? []).map((entry) => `npm:${entry.name}`);
+			}
+			// Daemon-dependency sources (see classifyUpdateSource's own doc comment) still route through
+			// updateOnly()/update() here, exactly like a bare `pi update --extension` would today -- a
+			// known, non-regressive scope limit for this batch endpoint's first version, not a silent
+			// misclassification: each such source simply reports its already-existing, honest
+			// "No matching package found" failure as its own independent per-source outcome.
+			const batchResult = await updateManyPackages(deps.inst, sources, { approved });
+			const results: UpdateAllMutationResponse["results"] = batchResult.outcomes.map((item) =>
+				item.status === "succeeded" && item.outcome
+					? { source: item.source, ok: true, ...item.outcome }
+					: { source: item.source, ok: false, output: item.error ?? "update failed" },
+			);
+			// Best-effort per-source service-restart reconciliation, same as /update's own -- one
+			// package's restart failing never fails the batch or blocks a sibling's own reconciliation.
+			for (const result of results) {
+				if (!result.ok || result.alreadyUpToDate || !result.source.startsWith("npm:")) continue;
+				try {
+					const service = await daemonServiceInstaller.restart(piHomeForServiceInstall, result.source);
+					if (service.ok) result.serviceReconciled = service.restarted;
+				} catch {
+					/* best-effort -- a restart failure never fails the batch */
+				}
+			}
+			const ok = results.every((result) => result.ok) && !batchResult.reresolveError;
+			const output = `updated ${results.filter((result) => result.ok && !result.alreadyUpToDate).length}/${results.length} package(s)`;
+			return json({ ok, output, results, ...(batchResult.reresolveError ? { reresolveError: batchResult.reresolveError } : {}) });
+		}
+
 		if (path === "/updates" && req.method === "GET") {
 			const snap = await loadUpdates(deps.stateDir);
 			return json(snap ?? { updates: [] });
@@ -762,6 +820,10 @@ export function createApp(deps: Deps): { fetch: (req: Request) => Promise<Respon
 				path = "/update";
 				init = { method: "POST", body: JSON.stringify(input) };
 				break;
+			case "package.update_all":
+				path = "/update-all";
+				init = { method: "POST", body: JSON.stringify(input) };
+				break;
 			default:
 				throw new PackageOperationError(`unknown operation: ${String(op)}`, 404);
 		}

package/service/src/daemon/vehicle-registration.ts

@@ -170,6 +170,11 @@ const OPERATION_META: Record<OperationName, OperationMeta> = {
 		effect: "open-world",
 		requiresApproval: true,
 	},
+	"package.update_all": {
+		description: "Updates every currently-stale Pi package in one batch, re-resolving the dependency tree once instead of once per package.",
+		effect: "open-world",
+		requiresApproval: true,
+	},
 	"resources.list": {
 		description: "Lists global and project-scoped Pi resources (extensions, skills, prompts, themes).",
 		effect: "read",

package/service/src/packages/install.ts

@@ -151,23 +151,22 @@ export class ExecInstaller implements Installer {
 		return this.run(["remove", ...(options?.local ? ["-l"] : []), source]);
 	}
 
-	async update(source: string, options?: { approved?: boolean; local?: boolean; target?: string }): Promise<UpdateOutcome> {
+	/**
+	 * The real `pi update --extension <source>` mutation alone -- no trailing reresolveDependencyTree()
+	 * (a batch caller defers that to once per batch via updateManyPackages(), not once per package).
+	 * Returns the full UpdateOutcome (unlike installOnly()'s raw string): a single package's own
+	 * before/after version diff is already correct right after ITS OWN update -- reresolveDependencyTree()
+	 * exists to fix a DIFFERENT sibling's drift, not this package's own resolved version. MUST be
+	 * awaited sequentially across a batch, never run concurrently -- same shared settings.json/
+	 * package.json mutation hazard as installOnly(), see its own doc comment.
+	 */
+	async updateOnly(source: string, options?: { approved?: boolean; local?: boolean; target?: string }): Promise<UpdateOutcome> {
 		if (options?.target) return this.replace(source, options.target, options);
 		const t0 = performance.now();
 		const pinned = isPinnedNpmSource(source);
 		const previousVersion = readResolvedVersion(this.piHome, source);
-		const t1 = performance.now();
 		const output = await this.run(["update", "--extension", source]);
-		const updateMs = performance.now() - t1;
-		const t2 = performance.now();
-		await this.reresolveDependencyTree();
-		const reresolveMs = performance.now() - t2;
-		this.logger.debug("update timing", {
-			source,
-			updateMs: round1(updateMs),
-			reresolveMs: round1(reresolveMs),
-			totalMs: round1(performance.now() - t0),
-		});
+		this.logger.debug("updateOnly timing", { source, updateMs: round1(performance.now() - t0) });
 		const currentVersion = readResolvedVersion(this.piHome, source);
 		// Only trust a "nothing changed" conclusion when we actually read a
 		// real version both before and after (npm source, resolvable in
@@ -202,6 +201,24 @@ export class ExecInstaller implements Installer {
 		};
 	}
 
+	async update(source: string, options?: { approved?: boolean; local?: boolean; target?: string }): Promise<UpdateOutcome> {
+		if (options?.target) return this.replace(source, options.target, options);
+		const t0 = performance.now();
+		const t1 = performance.now();
+		const result = await this.updateOnly(source, options);
+		const updateMs = performance.now() - t1;
+		const t2 = performance.now();
+		await this.reresolveDependencyTree();
+		const reresolveMs = performance.now() - t2;
+		this.logger.debug("update timing", {
+			source,
+			updateMs: round1(updateMs),
+			reresolveMs: round1(reresolveMs),
+			totalMs: round1(performance.now() - t0),
+		});
+		return result;
+	}
+
 	/**
 	 * The alternate mutation path for a source classifyUpdateSource() flags as
 	 * "daemon-dependency" -- genuinely installed and npm-resolvable, but NOT
@@ -325,3 +342,57 @@ export class ExecInstaller implements Installer {
 		};
 	}
 }
+
+export interface UpdateManyOutcome {
+	readonly source: string;
+	readonly status: "succeeded" | "failed";
+	readonly outcome?: UpdateOutcome;
+	readonly error?: string;
+}
+
+export interface UpdateManyResult {
+	readonly outcomes: readonly UpdateManyOutcome[];
+	/** True whenever any succeeded source actually changed version -- one combined signal instead of a caller re-deriving it per outcome. */
+	readonly reloadRequired: boolean;
+	/** Set only when the final batch-wide reresolve itself failed -- every individual outcome above already reflects its own real result regardless. */
+	readonly reresolveError?: string;
+}
+
+/**
+ * Batch update over several sources at once -- same validate-concurrently/commit-sequentially/
+ * reresolve-once shape as SetupManager.apply()'s own batch mode (see Installer.updateOnly's own
+ * doc comment): every source is updated in turn via updateOnly() (no per-source reresolve), then
+ * reresolveDependencyTree() runs exactly ONCE for the whole batch -- the real cost `packed update`
+ * one source at a time was paying N times over (see ExecInstaller's own constructor doc comment).
+ * Sequential across sources, never fanned out -- same shared-file mutation hazard as installOnly().
+ * One source failing never stops the rest; each gets its own independent outcome. Falls back to
+ * one update() call per source (each paying its own reresolve) when the installer doesn't
+ * implement the updateOnly/reresolveDependencyTree batch trio -- matching SetupManager.apply()'s
+ * own graceful degradation for a non-batch-capable Installer (e.g. a plain test double).
+ */
+export async function updateManyPackages(
+	installer: Installer,
+	sources: readonly string[],
+	options?: { approved?: boolean },
+): Promise<UpdateManyResult> {
+	const batch = Boolean(installer.updateOnly && installer.reresolveDependencyTree);
+	const outcomes: UpdateManyOutcome[] = [];
+	for (const source of sources) {
+		try {
+			const outcome =
+				batch && installer.updateOnly ? await installer.updateOnly(source, options) : await installer.update(source, options);
+			outcomes.push({ source, status: "succeeded", outcome });
+		} catch (error) {
+			outcomes.push({ source, status: "failed", error: error instanceof Error ? error.message : String(error) });
+		}
+	}
+	const reloadRequired = outcomes.some((item) => item.status === "succeeded" && item.outcome?.reloadRequired);
+	if (batch && installer.reresolveDependencyTree && outcomes.some((item) => item.status === "succeeded")) {
+		try {
+			await installer.reresolveDependencyTree();
+		} catch (error) {
+			return { outcomes, reloadRequired, reresolveError: error instanceof Error ? error.message : String(error) };
+		}
+	}
+	return { outcomes, reloadRequired };
+}

package/service/src/packages/package.ts

@@ -219,6 +219,15 @@ export interface Installer {
 	 */
 	validate?(source: string): Promise<InstallValidationResult>;
 	installOnly?(source: string, options?: { approved?: boolean; local?: boolean }): Promise<string>;
+	/**
+	 * updateOnly() is update()'s own equivalent split: the real `pi update --extension` mutation
+	 * (or replace(), when options.target is given) WITHOUT the trailing reresolveDependencyTree(),
+	 * returning the same UpdateOutcome update() itself returns -- a single package's own before/
+	 * after version diff is already correct right after its own mutation, reresolveDependencyTree()
+	 * exists to fix a DIFFERENT sibling's drift. See updateManyPackages() (install.ts) for the
+	 * batch caller. Same SEQUENTIAL-only constraint as installOnly() above.
+	 */
+	updateOnly?(source: string, options?: { approved?: boolean; local?: boolean; target?: string }): Promise<UpdateOutcome>;
 	reresolveDependencyTree?(): Promise<string>;
 }
 

package/service/src/security/security.ts

@@ -26,6 +26,7 @@ export const PACKAGE_OPERATIONS = [
 	"reconcile_services",
 	"setup.apply",
 	"update",
+	"update_all",
 	"update.self",
 	"remove",
 	"resources.list",
@@ -74,6 +75,7 @@ const CLASSIFICATIONS: Record<PackageOperation, PackageOperationClassification>
 	reconcile_services: "code-execution",
 	"setup.apply": "code-execution",
 	update: "code-execution",
+	update_all: "code-execution",
 	"update.self": "code-execution",
 	remove: "settings-mutation",
 	"resources.list": "read",

package/service/test/cli.test.ts

@@ -788,6 +788,71 @@ describe("CLI", () => {
 		});
 	});
 
+	/** A PackageDaemonPort stub that throws "unexpected call" for anything the test doesn't
+	 * explicitly override -- update --all only ever calls updateAll(), so nothing else should
+	 * ever be invoked; a Proxy avoids hand-writing 25+ unused method stubs. */
+	function baseDaemonPort(): PackageDaemonPort {
+		return new Proxy(
+			{},
+			{
+				get: (_target, prop) => async () => {
+					throw new Error(`unexpected call: ${String(prop)}`);
+				},
+			},
+		) as PackageDaemonPort;
+	}
+
+	it("update --all fails closed without a running daemon", async () => {
+		const d = deps({ daemon: undefined });
+		const { code, out } = await cliRun(["update", "--all", "--approve"], d);
+		expect(code).toBe(1);
+		expect(out).toContain("requires a running packed daemon");
+	});
+
+	it("update --all delegates to the daemon's batch endpoint and reports a per-package summary", async () => {
+		const calls: Array<[string[] | undefined, boolean | undefined]> = [];
+		const daemon = {
+			...baseDaemonPort(),
+			async updateAll(sources?: string[], approved?: boolean) {
+				calls.push([sources, approved]);
+				return {
+					ok: true,
+					output: "updated 1/2 package(s)",
+					results: [
+						{ source: "npm:pi-lsp", ok: true, output: "Updated npm:pi-lsp", previousVersion: "1.0.0", currentVersion: "1.1.0" },
+						{ source: "npm:pi-tickets", ok: true, output: "Updated npm:pi-tickets", alreadyUpToDate: true },
+					],
+				};
+			},
+		};
+		const d = deps({ daemon });
+		const { code, out } = await cliRun(["update", "--all", "--approve"], d);
+		expect(code).toBe(0);
+		expect(calls).toEqual([[undefined, true]]);
+		expect(out).toContain("npm:pi-lsp  updated (1.0.0 \u2192 1.1.0)");
+		expect(out).toContain("npm:pi-tickets  already up to date");
+		expect(out).toContain("Reload Pi with /reload to activate the updated packages.");
+		const json = await cliRun(["update", "--all", "--approve", "--json"], d);
+		expect(JSON.parse(json.out).results).toHaveLength(2);
+	});
+
+	it("update --all reports failures inline with exit code 1, without hiding the packages that did succeed", async () => {
+		const daemon = {
+			...baseDaemonPort(),
+			async updateAll() {
+				return {
+					ok: false,
+					output: "updated 0/1 package(s)",
+					results: [{ source: "npm:broken", ok: false, output: "No matching package found" }],
+				};
+			},
+		};
+		const d = deps({ daemon });
+		const { code, out } = await cliRun(["update", "--all", "--approve"], d);
+		expect(code).toBe(1);
+		expect(out).toContain("npm:broken  FAILED: No matching package found");
+	});
+
 	it("remove wants a bare name and has stable JSON output", async () => {
 		const d = deps();
 		expect((await cliRun(["remove", "npm:foo"], d)).code).toBe(2);
@@ -947,6 +1012,10 @@ describe("CLI", () => {
 			async update(source) {
 				return { output: source, reloadRequired: false, alreadyUpToDate: true, pinned: false };
 			},
+			async updateAll(sources) {
+				calls.push(`updateAll:${sources?.join(",")}`);
+				return { ok: true, output: "updated 0/0 package(s)", results: [] };
+			},
 			async piStatus() {
 				calls.push("piStatus");
 				return { current: "0.82.1", latest: "0.83.0", upToDate: false };

package/service/test/daemon-kit-migration.test.ts

@@ -145,6 +145,7 @@ describe("daemon-kit migration", () => {
 			"package.reconcile_services",
 			"package.remove",
 			"package.update",
+			"package.update_all",
 			"resources.list",
 			"resources.toggle",
 			"pi.status",

package/service/test/install.test.ts

@@ -11,10 +11,11 @@
  * version diff is what actually drives reloadRequired/alreadyUpToDate.
  */
 import { afterEach, describe, expect, it } from "bun:test";
-import { chmodSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { ExecInstaller } from "../src/packages/install.ts";
+import { ExecInstaller, updateManyPackages } from "../src/packages/install.ts";
+import type { Installer, UpdateOutcome } from "../src/packages/package.ts";
 import { createLogger } from "../src/shared/log.ts";
 
 /**
@@ -710,3 +711,98 @@ describe("ExecInstaller — run()/reresolveDependencyTree() thread the CURRENT p
 		expect(readFileSync(npmLog, "utf8")).toBe("reresolve-sees-this-too");
 	});
 });
+
+describe("updateManyPackages -- batch update over several sources at once, reresolving ONCE for the whole batch", () => {
+	it("updates every source via updateOnly() and runs exactly one npm install afterward, not one per source", async () => {
+		const scriptDir = track(mkdtempSync(join(tmpdir(), "packed-exec-bin-")));
+		const piHome = writePiHome({ "@scope/a": "1.0.0", "@scope/b": "1.0.0" });
+		const bin = writeFakePi(scriptDir);
+		const npmLog = join(scriptDir, "npm.log");
+		const npmBin = writeFakeNpm(scriptDir, npmLog);
+		const installer = new ExecInstaller(bin, piHome, undefined, npmBin);
+
+		const result = await updateManyPackages(installer, ["npm:@scope/a", "npm:@scope/b"]);
+
+		expect(result.outcomes.map((o) => o.source)).toEqual(["npm:@scope/a", "npm:@scope/b"]);
+		expect(result.outcomes.every((o) => o.status === "succeeded")).toBe(true);
+		// The real point of this batch path: ONE npm install for two sources, not two.
+		const invocations = readFileSync(npmLog, "utf8").trim().split("\n").filter((line) => line === "install");
+		expect(invocations).toHaveLength(1);
+	});
+
+	it("one source failing never stops the rest, and each gets its own independent outcome", async () => {
+		const scriptDir = track(mkdtempSync(join(tmpdir(), "packed-exec-bin-")));
+		const piHome = writePiHome({ "@scope/a": "1.0.0", "@scope/b": "1.0.0" });
+		const failingPi = join(scriptDir, "fake-pi-fail-once");
+		writeFileSync(
+			failingPi,
+			[
+				"#!/usr/bin/env bash",
+				"set -euo pipefail",
+				'source="${3:-}"',
+				'if [ "$source" = "npm:@scope/a" ]; then echo "No matching package found" >&2; exit 1; fi',
+				'echo "Updated $source"',
+				"exit 0",
+			].join("\n"),
+		);
+		chmodSync(failingPi, 0o755);
+		const npmLog = join(scriptDir, "npm.log");
+		const npmBin = writeFakeNpm(scriptDir, npmLog);
+		const installer = new ExecInstaller(failingPi, piHome, undefined, npmBin);
+
+		const result = await updateManyPackages(installer, ["npm:@scope/a", "npm:@scope/b"]);
+
+		expect(result.outcomes[0]).toMatchObject({ source: "npm:@scope/a", status: "failed" });
+		expect(result.outcomes[1]).toMatchObject({ source: "npm:@scope/b", status: "succeeded" });
+		// The batch-wide reresolve still runs once, since @scope/b did succeed.
+		expect(readFileSync(npmLog, "utf8").trim().split("\n").filter((line) => line === "install")).toHaveLength(1);
+	});
+
+	it("never runs the batch-wide reresolve when every source failed", async () => {
+		const scriptDir = track(mkdtempSync(join(tmpdir(), "packed-exec-bin-")));
+		const piHome = writePiHome({ "@scope/a": "1.0.0" });
+		const failingPi = join(scriptDir, "fake-pi-always-fail");
+		writeFileSync(failingPi, ["#!/usr/bin/env bash", "echo 'No matching package found' >&2", "exit 1"].join("\n"));
+		chmodSync(failingPi, 0o755);
+		const npmLog = join(scriptDir, "npm.log");
+		const npmBin = writeFakeNpm(scriptDir, npmLog);
+		const installer = new ExecInstaller(failingPi, piHome, undefined, npmBin);
+
+		await updateManyPackages(installer, ["npm:@scope/a"]);
+
+		expect(existsSync(npmLog)).toBe(false);
+	});
+
+	it("reports a failed final reresolve distinctly, after every individual source already succeeded", async () => {
+		const scriptDir = track(mkdtempSync(join(tmpdir(), "packed-exec-bin-")));
+		const piHome = writePiHome({ "@scope/a": "1.0.0" });
+		const bin = writeFakePi(scriptDir);
+		const failingNpm = join(scriptDir, "fake-npm-fail");
+		writeFileSync(failingNpm, ["#!/usr/bin/env bash", "echo 'ERESOLVE unable to resolve dependency tree' >&2", "exit 1"].join("\n"));
+		chmodSync(failingNpm, 0o755);
+		const installer = new ExecInstaller(bin, piHome, undefined, failingNpm);
+
+		const result = await updateManyPackages(installer, ["npm:@scope/a"]);
+
+		expect(result.outcomes[0]?.status).toBe("succeeded");
+		expect(result.reresolveError).toMatch(/npm install failed to re-resolve/);
+	});
+
+	it("falls back to one update() call per source (each paying its own reresolve) when the installer lacks the batch trio", async () => {
+		const calls: string[] = [];
+		const fake: Installer = {
+			install: async () => "",
+			remove: async () => "",
+			update: async (source): Promise<UpdateOutcome> => {
+				calls.push(source);
+				return { output: `updated ${source}`, reloadRequired: true, alreadyUpToDate: false, pinned: false };
+			},
+		};
+
+		const result = await updateManyPackages(fake, ["npm:a", "npm:b"]);
+
+		expect(calls).toEqual(["npm:a", "npm:b"]);
+		expect(result.outcomes.every((o) => o.status === "succeeded")).toBe(true);
+		expect(result.reloadRequired).toBe(true);
+	});
+});

package/service/test/security.test.ts

@@ -39,6 +39,7 @@ describe("package permission policy", () => {
 			"reconcile_services",
 			"setup.apply",
 			"update",
+			"update_all",
 			"update.self",
 			"remove",
 			"resources.list",
@@ -70,6 +71,7 @@ describe("package permission policy", () => {
 			restart_service: { classification: "code-execution", approvalRequired: true },
 			"setup.apply": { classification: "code-execution", approvalRequired: true },
 			update: { classification: "code-execution", approvalRequired: true },
+			update_all: { classification: "code-execution", approvalRequired: true },
 			"update.self": { classification: "code-execution", approvalRequired: true },
 			remove: { classification: "settings-mutation", approvalRequired: true },
 			"resources.list": { classification: "read", approvalRequired: false },

package/service/test/service.test.ts

@@ -53,10 +53,20 @@ class FakeInstaller implements Installer {
 	}
 	updateOutcome: Partial<UpdateOutcome> = {};
 	gotTarget: string | undefined;
+	updatedSources: string[] = [];
+	updateOutcomeFor: Record<string, Partial<UpdateOutcome>> = {};
 	async update(source: string, options?: { target?: string }): Promise<UpdateOutcome> {
 		this.updated = source;
+		this.updatedSources.push(source);
 		this.gotTarget = options?.target;
-		return { output: this.output, reloadRequired: true, alreadyUpToDate: false, pinned: false, ...this.updateOutcome };
+		return {
+			output: this.output,
+			reloadRequired: true,
+			alreadyUpToDate: false,
+			pinned: false,
+			...this.updateOutcome,
+			...this.updateOutcomeFor[source],
+		};
 	}
 	updateDaemonDependencyGotName = "";
 	updateDaemonDependencyGotVersion: string | undefined;
@@ -680,6 +690,89 @@ describe("service app", () => {
 		expect(inst.updateDaemonDependencyGotName).toBe("");
 	});
 
+	it("POST /update-all validates, authorizes, and delegates every explicitly given source", async () => {
+		const inst = new FakeInstaller();
+		const app = createApp(deps({ inst }));
+		const denied = await app.fetch(
+			new Request("http://x/update-all", {
+				method: "POST",
+				headers: { ...auth, "content-type": "application/json" },
+				body: JSON.stringify({ sources: ["npm:pi-lsp"] }),
+			}),
+		);
+		expect(denied.status).toBe(403);
+		const allowed = await app.fetch(
+			new Request("http://x/update-all", {
+				method: "POST",
+				headers: { ...auth, "content-type": "application/json" },
+				body: JSON.stringify({ sources: ["npm:pi-lsp", "npm:pi-tickets"], approved: true }),
+			}),
+		);
+		expect(allowed.status).toBe(200);
+		const body = (await allowed.json()) as any;
+		expect(body.ok).toBe(true);
+		expect(inst.updatedSources).toEqual(["npm:pi-lsp", "npm:pi-tickets"]);
+		expect(body.results.map((r: any) => r.source)).toEqual(["npm:pi-lsp", "npm:pi-tickets"]);
+		expect(body.results.every((r: any) => r.ok)).toBe(true);
+	});
+
+	it("POST /update-all defaults to every currently-stale global package from the mirror when sources is omitted", async () => {
+		const inst = new FakeInstaller();
+		const d = deps({ inst });
+		await saveUpdates(d.stateDir, {
+			checkedAt: new Date().toISOString(),
+			updates: [
+				{ name: "pi-lsp", installed: "1.0.0", latest: "1.1.0" },
+				{ name: "pi-tickets", installed: "2.0.0", latest: "2.1.0" },
+			],
+		});
+		const app = createApp(d);
+		const response = await app.fetch(
+			new Request("http://x/update-all", {
+				method: "POST",
+				headers: { ...auth, "content-type": "application/json" },
+				body: JSON.stringify({ approved: true }),
+			}),
+		);
+		expect(response.status).toBe(200);
+		expect(inst.updatedSources).toEqual(["npm:pi-lsp", "npm:pi-tickets"]);
+	});
+
+	it("POST /update-all reports one failure without blocking the rest of the batch", async () => {
+		const inst = new FakeInstaller();
+		inst.updateOutcomeFor["npm:broken"] = undefined as unknown as Partial<UpdateOutcome>;
+		const originalUpdate = inst.update.bind(inst);
+		inst.update = async (source: string, options?: { target?: string }) => {
+			if (source === "npm:broken") throw new Error("No matching package found");
+			return originalUpdate(source, options);
+		};
+		const app = createApp(deps({ inst }));
+		const response = await app.fetch(
+			new Request("http://x/update-all", {
+				method: "POST",
+				headers: { ...auth, "content-type": "application/json" },
+				body: JSON.stringify({ sources: ["npm:broken", "npm:pi-lsp"], approved: true }),
+			}),
+		);
+		expect(response.status).toBe(200);
+		const body = (await response.json()) as any;
+		expect(body.ok).toBe(false);
+		expect(body.results[0]).toMatchObject({ source: "npm:broken", ok: false });
+		expect(body.results[1]).toMatchObject({ source: "npm:pi-lsp", ok: true });
+	});
+
+	it("POST /update-all rejects an invalid source the same way /update does", async () => {
+		const app = createApp(deps({ inst: new FakeInstaller() }));
+		const response = await app.fetch(
+			new Request("http://x/update-all", {
+				method: "POST",
+				headers: { ...auth, "content-type": "application/json" },
+				body: JSON.stringify({ sources: ["not-a-real-source"], approved: true }),
+			}),
+		);
+		expect(response.status).toBe(400);
+	});
+
 	it("GET /updates serves the watcher snapshot", async () => {
 		const d = deps();
 		await saveUpdates(d.stateDir, {