@danypops/pi-packed 0.25.1 → 0.25.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@danypops/pi-packed",
-  "version": "0.25.1",
+  "version": "0.25.2",
   "description": "Pi package lifecycle, validation, daemon, tools, profiles, and TUI",
   "type": "module",
   "bin": {

package/service/src/daemon/daemon-service.ts

@@ -38,6 +38,7 @@ import {
 } from "@danypops/vehicle-server/service";
 import { npmPackageName, readInstalledPackagesAcrossScopes, readPackageDeclarations } from "../packages/installed.ts";
 import type { InstalledPkg } from "../packages/package.ts";
+import { versionAtLeast } from "../publish/publish.ts";
 
 export interface DaemonServiceManifest {
 	/** Relative to the installed package's own root directory. */
@@ -125,6 +126,47 @@ function dependsOnVehicle(pkg: InstalledPackageJson): boolean {
  * web-spider, packed, enigma all expose a `serve` subcommand on the same
  * bin their `service install` command already points at).
  */
+/**
+ * Resolves ONE candidate directory to a daemon entrypoint, using the same
+ * explicit-manifest-first-then-convention rule detectVehicleDaemonService's
+ * own doc comment describes -- factored out so the nested and hoisted
+ * candidates for the same dependency name can each be resolved
+ * independently and then compared, instead of the first one found
+ * unconditionally winning (see detectVehicleDaemonService's own comment on
+ * why iteration order alone is never a safe tie-break).
+ */
+function resolveDependencyCandidate(depDir: string, depName: string): ResolvedDaemonEntrypoint | undefined {
+	const dep = readPackageJson(depDir);
+	if (!dep) return undefined;
+	// An explicit manifest on the dependency itself wins over convention detection here too --
+	// mirrors resolveDaemonServiceSpec's own explicit-manifest-first behavior for a directly
+	// installed package. Without this, a dependency's own correct, explicit
+	// handleFilename/name/etc. was silently discarded in favor of a guess whenever the daemon
+	// was discovered one level down instead of installed directly by name -- exactly the
+	// common case (a Pi extension like pi-papyrus has no daemon of its own). Confirmed live:
+	// papyrus's real handle file is "vehicle-handle.json", not the "daemon.json" convention
+	// guess, and papyrus is only ever discovered this way, never installed directly by name.
+	const depManifest = dep.packed?.daemonService;
+	if (depManifest && typeof depManifest.binPath === "string" && depManifest.binPath.length > 0 && dep.version) {
+		return {
+			binPath: join(depDir, depManifest.binPath),
+			args: depManifest.args,
+			name: depManifest.name ?? unscopedName(dep.name ?? depName),
+			displayName: depManifest.displayName,
+			handleFilename: depManifest.handleFilename,
+			workingDirectory: depManifest.workingDirectory,
+			restartOnFailure: depManifest.restartOnFailure,
+			restartSec: depManifest.restartSec,
+			version: dep.version,
+		};
+	}
+	const depBin = firstBinPath(dep);
+	if (depBin && dependsOnVehicle(dep) && dep.version) {
+		return { binPath: join(depDir, depBin), args: ["serve"], name: unscopedName(dep.name ?? depName), version: dep.version };
+	}
+	return undefined;
+}
+
 export function detectVehicleDaemonService(
 	packageDir: string,
 	fallbackName: string,
@@ -143,36 +185,24 @@ export function detectVehicleDaemonService(
 			join(packageDir, "node_modules", depName),
 			...(hoistedNodeModulesDir ? [join(hoistedNodeModulesDir, depName)] : []),
 		];
-		for (const depDir of candidateDirs) {
-			const dep = readPackageJson(depDir);
-			if (!dep) continue;
-			// An explicit manifest on the dependency itself wins over convention detection here too --
-			// mirrors resolveDaemonServiceSpec's own explicit-manifest-first behavior for a directly
-			// installed package. Without this, a dependency's own correct, explicit
-			// handleFilename/name/etc. was silently discarded in favor of a guess whenever the daemon
-			// was discovered one level down instead of installed directly by name -- exactly the
-			// common case (a Pi extension like pi-papyrus has no daemon of its own). Confirmed live:
-			// papyrus's real handle file is "vehicle-handle.json", not the "daemon.json" convention
-			// guess, and papyrus is only ever discovered this way, never installed directly by name.
-			const depManifest = dep.packed?.daemonService;
-			if (depManifest && typeof depManifest.binPath === "string" && depManifest.binPath.length > 0 && dep.version) {
-				return {
-					binPath: join(depDir, depManifest.binPath),
-					args: depManifest.args,
-					name: depManifest.name ?? unscopedName(dep.name ?? depName),
-					displayName: depManifest.displayName,
-					handleFilename: depManifest.handleFilename,
-					workingDirectory: depManifest.workingDirectory,
-					restartOnFailure: depManifest.restartOnFailure,
-					restartSec: depManifest.restartSec,
-					version: dep.version,
-				};
-			}
-			const depBin = firstBinPath(dep);
-			if (depBin && dependsOnVehicle(dep) && dep.version) {
-				return { binPath: join(depDir, depBin), args: ["serve"], name: unscopedName(dep.name ?? depName), version: dep.version };
-			}
+		const resolved = candidateDirs
+			.map((depDir) => resolveDependencyCandidate(depDir, depName))
+			.filter((entry): entry is ResolvedDaemonEntrypoint => entry !== undefined);
+		if (resolved.length === 0) continue;
+		if (resolved.length === 1) return resolved[0];
+		// Both a nested copy (checked first, above) and a hoisted copy resolved for the exact same
+		// dependency name -- e.g. pi-papyrus's own nested @danypops/jittor@0.14.0 alongside the
+		// correctly-versioned, tree-wide hoisted @danypops/jittor@0.18.1. The real jittor incident:
+		// the nested copy always won here, unconditionally, purely because candidateDirs checks it
+		// first -- regardless of which was actually newer. Prefer the real higher semver version
+		// instead; a genuine tie keeps the first-found (nested) result, preserving papyrus's own
+		// intentional-nesting case (confirmed live, see resolveDependencyCandidate's own comment)
+		// exactly as before whenever there's nothing to disambiguate.
+		let best = resolved[0]!;
+		for (const candidate of resolved.slice(1)) {
+			if (versionAtLeast(candidate.version, best.version) && candidate.version !== best.version) best = candidate;
 		}
+		return best;
 	}
 	return undefined;
 }

package/service/test/daemon-service.test.ts

@@ -208,6 +208,60 @@ describe("resolveDaemonServiceSpec", () => {
 		expect(result.spec.restartSec).toBe(2);
 	});
 
+	it("prefers the higher-semver candidate when BOTH a nested and hoisted copy of the same dependency resolve via bin+dependency convention -- the real jittor incident: a stale nested copy must never win over a correctly-versioned hoisted one just because it's checked first", () => {
+		const piHome = fakePiHome();
+		const extDir = join(piHome, "npm", "node_modules", "@danypops/pi-papyrus");
+		writeRawPackage(extDir, { name: "@danypops/pi-papyrus", version: "1.0.0", dependencies: { "@danypops/jittor": "^0.14.0" } });
+		// A stale nested copy pi-papyrus's own outdated floor forced npm to keep private, instead of
+		// deduping to the shared, correctly-versioned, hoisted copy every other consumer already uses.
+		const nestedDir = join(extDir, "node_modules", "@danypops/jittor");
+		writeRawPackage(nestedDir, {
+			name: "@danypops/jittor",
+			version: "0.14.0",
+			bin: { jittor: "src/cli.ts" },
+			dependencies: { "@danypops/vehicle-server": "^0.3.1" },
+		});
+		const hoistedDir = join(piHome, "npm", "node_modules", "@danypops/jittor");
+		writeRawPackage(hoistedDir, {
+			name: "@danypops/jittor",
+			version: "0.18.1",
+			bin: { jittor: "src/cli.ts" },
+			dependencies: { "@danypops/vehicle-server": "^0.17.0" },
+		});
+
+		const result = resolveDaemonServiceSpec(piHome, "npm:@danypops/pi-papyrus");
+		expect(result.ok).toBe(true);
+		if (!result.ok) throw new Error("expected ok");
+		expect(result.spec.binPath).toBe(join(hoistedDir, "src/cli.ts"));
+		expect(result.spec.version).toBe("0.18.1");
+	});
+
+	it("keeps the nested copy when it is genuinely the newer (or equal) one -- the tie-break only ever prefers a candidate that's actually newer, never blindly flips to hoisted", () => {
+		const piHome = fakePiHome();
+		const extDir = join(piHome, "npm", "node_modules", "@danypops/pi-papyrus");
+		writeRawPackage(extDir, { name: "@danypops/pi-papyrus", version: "1.0.0", dependencies: { "@danypops/jittor": "^0.18.0" } });
+		const nestedDir = join(extDir, "node_modules", "@danypops/jittor");
+		writeRawPackage(nestedDir, {
+			name: "@danypops/jittor",
+			version: "0.18.1",
+			bin: { jittor: "src/cli.ts" },
+			dependencies: { "@danypops/vehicle-server": "^0.17.0" },
+		});
+		const hoistedDir = join(piHome, "npm", "node_modules", "@danypops/jittor");
+		writeRawPackage(hoistedDir, {
+			name: "@danypops/jittor",
+			version: "0.14.0",
+			bin: { jittor: "src/cli.ts" },
+			dependencies: { "@danypops/vehicle-server": "^0.3.1" },
+		});
+
+		const result = resolveDaemonServiceSpec(piHome, "npm:@danypops/pi-papyrus");
+		expect(result.ok).toBe(true);
+		if (!result.ok) throw new Error("expected ok");
+		expect(result.spec.binPath).toBe(join(nestedDir, "src/cli.ts"));
+		expect(result.spec.version).toBe("0.18.1");
+	});
+
 	it("also detects the legacy @danypops/daemon-kit dependency name, not just vehicle-server", () => {
 		const piHome = fakePiHome();
 		const dir = join(piHome, "npm", "node_modules", "@danypops/web-spider-daemon");