@danypops/pi-packed 0.28.13 → 0.28.15

package/extension/src/doctor-overlay.ts

@@ -46,7 +46,9 @@ function defaultClient(): VehicleClient {
 		async () => {
 			const resolved = currentVehicleClientTarget();
 			if (!resolved) throw new Error("Packed daemon is not running");
-			return new RemoteVehicleClient({ baseUrl: resolved.baseUrl, token: resolved.token });
+			const remote = new RemoteVehicleClient({ baseUrl: resolved.baseUrl, token: resolved.token });
+			await remote.negotiate({ minimumVersion: 1, maximumVersion: 1, requiredCapabilities: [], optionalCapabilities: [] });
+			return remote;
 		},
 		{ connectRetry: true },
 	);

package/extension/src/vehicle-tools.ts

@@ -86,7 +86,9 @@ export async function registerPackedVehicle(pi: ExtensionAPI): Promise<void> {
 				async () => {
 					const resolved = currentVehicleClientTarget();
 					if (!resolved) throw new Error("Packed daemon is not running");
-					return new RemoteVehicleClient({ baseUrl: resolved.baseUrl, token: resolved.token });
+					const remote = new RemoteVehicleClient({ baseUrl: resolved.baseUrl, token: resolved.token });
+					await remote.negotiate({ minimumVersion: 1, maximumVersion: 1, requiredCapabilities: [], optionalCapabilities: [] });
+					return remote;
 				},
 				{ connectRetry: true },
 			),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@danypops/pi-packed",
-  "version": "0.28.13",
+  "version": "0.28.15",
   "description": "Pi package lifecycle, validation, daemon, tools, profiles, and TUI",
   "type": "module",
   "bin": {
@@ -36,9 +36,9 @@
     "@danypops/armada": "^0.5.1",
     "@danypops/packed": "^0.7.0",
     "@danypops/pi-extension-harness": "^0.7.0",
-    "@danypops/vehicle-client": "^0.10.7",
-    "@danypops/vehicle-core": "^0.19.0",
-    "@danypops/vehicle-server": "^0.27.0",
+    "@danypops/vehicle-client": "^0.10.8",
+    "@danypops/vehicle-core": "^0.19.1",
+    "@danypops/vehicle-server": "^0.27.1",
     "jiti": "^2.7.0",
     "malevich-tui-components": "^0.32.1",
     "publint": "0.3.22",

package/service/src/daemon/service.ts

@@ -302,7 +302,12 @@ export function createApp(deps: Deps): { fetch: (req: Request) => Promise<Respon
 		vehicleRegistry.useExecutionMiddleware(createVehicleMetricsMiddleware(deps.vehicleMetrics, "packed"));
 		registerVehicleMetricsOperations(vehicleRegistry, deps.vehicleMetrics, "packed");
 	}
-	const vehicleApp = createVehicleHttpApp({ registry: vehicleRegistry, token: deps.token });
+	const permissions = [...new Set(vehicleRegistry.manifest().operations.flatMap((operation) => operation.permissions))];
+	const vehicleApp = createVehicleHttpApp({
+		registry: vehicleRegistry,
+		token: deps.token,
+		invocationAuthority: { mode: "attested", resolve: () => ({ permissions, principal: { id: "packed-authenticated-client" } }) },
+	});
 
 	function authorize(operation: PackageOperation, approved: boolean): Response | undefined {
 		try {

package/service/test/vehicle-registration.test.ts

@@ -97,6 +97,24 @@ describe("packed's daemon operation surface, through the real Vehicle wire proto
 		expect(byName.get("setup.update")).toBe(false);
 	});
 
+	it("derives Vehicle permissions from authenticated server state", async () => {
+		const app = createApp(deps());
+		const response = await app.fetch(
+			new Request("http://packed.internal/vehicle/invoke", {
+				method: "POST",
+				headers: { authorization: "Bearer test-token", "content-type": "application/json" },
+				body: JSON.stringify({
+					name: "package.search",
+					version: 1,
+					input: { query: "lsp", limit: 10 },
+					permissions: [],
+					principal: { id: "forged-caller" },
+				}),
+			}),
+		);
+		expect(response.status).toBe(200);
+	});
+
 	it("package.search round-trips through /vehicle/invoke, matching /api/v1/ops's own shape", async () => {
 		const app = createApp(deps());
 		const result = await invoke(app, "package.search", { query: "lsp", limit: 10 });