@danypops/pi-packed 0.4.0 → 0.5.1

package/README.md

@@ -10,7 +10,7 @@ inside the supervised Bun daemon.
 
 ```text
 ┌─ Pi extension (Node-compatible) ──────────────┐
-│ pkg_search · pkg_info · pkg_install · pkg_remove│
+│ pkg_search · pkg_info · pkg_install/update/remove│
 │ /packages · /packed permission settings         │
 │ operation-aware approval · no Bun/SQLite access │
 └──────────────────┬────────────────────────────┘
@@ -46,6 +46,7 @@ Packages execute arbitrary code and mutate Pi settings/install roots. One daemon
 | `packed search <q> [--offline] [--limit N] [--json]` | Search npm or the local mirror, scoped to `keywords:pi-package` |
 | `packed info <name> [--json]` | Show version, repository, Pi manifest, size, and license |
 | `packed updates [--json]` | Show drift from the local mirror |
+| `packed update <source> [--approve] [--json]` | Update one configured source through `pi update --extension` |
 | `packed mirror [--json]` | Refresh the SQLite package index |
 | `packed installed [--json]` | Read Pi's installed package declarations |
 | `packed catalog [--json]` | Inspect the local package index |
@@ -81,6 +82,7 @@ The daemon listens on loopback only.
 | `GET` | `/updates` |
 | `GET` | `/catalog` |
 | `POST` | `/install` with `{ "source": "...", "approved": true }` |
+| `POST` | `/update` with `{ "source": "...", "approved": true }` |
 | `POST` | `/remove` with `{ "name": "...", "approved": true }` |
 
 State defaults to `~/.cache/pi-packed/` and contains `token`, `port`,

package/extension/src/index.ts

@@ -1,7 +1,7 @@
 /**
  * pi-packed — Pi extension seam.
  *
- * Thin by design: registers agent tools (pkg_search/pkg_info/pkg_install),
+ * Thin by design: registers agent tools (pkg_search/pkg_info/pkg_install/pkg_update/pkg_remove),
  * the /packages command, and a session_start update notification. ALL logic
  * lives in the Bun service (src/): registry access, caching, watcher,
  * catalog sync, install execution.

package/extension/src/packed.ts

@@ -30,6 +30,7 @@ export interface Natives {
 	setMutationApproval(value: MutationApproval, approved?: boolean): Promise<SecuritySettings>;
 	install(source: string, approved?: boolean): Promise<string>;
 	remove(name: string, approved?: boolean): Promise<string>;
+	update(source: string, approved?: boolean): Promise<string>;
 }
 
 export type PackageDaemonConnector = () => Promise<PackageDaemonPort>;
@@ -65,5 +66,6 @@ export async function createNatives(connect: PackageDaemonConnector = connectDef
 		setMutationApproval: (value, approved) => call((daemon) => daemon.setMutationApproval(value, approved)),
 		install: (source, approved) => call((daemon) => daemon.install(source, approved)),
 		remove: (name, approved) => call((daemon) => daemon.remove(name, approved)),
+		update: (source, approved) => call((daemon) => daemon.update(source, approved)),
 	};
 }

package/extension/src/tools.ts

@@ -51,6 +51,21 @@ export async function installPackageWithPolicy(
 	}
 }
 
+export async function updatePackageWithPolicy(
+	source: string,
+	natives: Pick<Natives, "security" | "update">,
+	ctx: ApprovalContext,
+) {
+	try {
+		const approval = await approvePackageOperation("update", `pi update --extension ${source}`, natives, ctx);
+		if (!approval.allowed) return text(approval.message ?? "update denied");
+		const out = await natives.update(source, approval.approved);
+		return text(`${out || `Updated ${source}.`} Reload with /reload to activate.`);
+	} catch (error) {
+		return text(`update failed: ${error instanceof Error ? error.message : error}`);
+	}
+}
+
 export async function removePackageWithPolicy(
 	name: string,
 	natives: Pick<Natives, "security" | "remove">,
@@ -121,6 +136,16 @@ export function registerTools(pi: ExtensionAPI, natives: Natives): void {
 		},
 	});
 
+	pi.registerTool({
+		name: "pkg_update",
+		label: "Pi Package Update",
+		description: "Update one configured Pi package through Pi's documented update command. Operation-aware approval is secure by default.",
+		parameters: Type.Object({ source: Type.String({ description: "configured npm:, git:, or https source" }) }),
+		async execute(_id, params, _signal, _onUpdate, ctx) {
+			return updatePackageWithPolicy(params.source, natives, ctx);
+		},
+	});
+
 	pi.registerTool({
 		name: "pkg_remove",
 		label: "Pi Package Remove",

package/extension/src/tui.ts

@@ -72,10 +72,10 @@ export async function showPackages(ctx: ExtensionCommandContext, natives: Native
 					continue;
 				}
 				ctx.ui.notify(`Updating ${row.name}…`, "info");
-				await natives.install(`npm:${row.name}@${row.latest}`, approval.approved);
-				ctx.ui.notify(`Updated ${row.name} to ${row.latest} (takes effect after /reload)`, "info");
-				row.version = row.latest ?? row.version;
-				row.hasUpdate = false;
+				await natives.update(`npm:${row.name}`, approval.approved);
+				ctx.ui.notify(`Updated ${row.name} to ${row.latest}; reloading Pi resources`, "info");
+				await ctx.reload();
+				return;
 			} catch (e) {
 				ctx.ui.notify(`update failed: ${e instanceof Error ? e.message : e}`, "error");
 			}

package/package.json

@@ -1,8 +1,11 @@
 {
   "name": "@danypops/pi-packed",
-  "version": "0.4.0",
+  "version": "0.5.1",
   "description": "Package service for the Pi agent: search/info/install/updates + /packages TUI, backed by a long-running Bun service",
   "type": "module",
+  "bin": {
+    "packed": "src/cli.ts"
+  },
   "keywords": [
     "pi-package"
   ],

package/src/cli.ts

@@ -1,3 +1,4 @@
+#!/usr/bin/env bun
 /**
  * cli.ts — second driving adapter (humans drive the same hexagon ports).
  * cliRun is pure: ({code, out}) in, no I/O — the entry point prints.
@@ -35,6 +36,7 @@ usage:
   packed search <query> [--offline] [--json]   search npm (or the local mirror with --offline)
   packed info <name> [--json]                  package details
   packed updates [--json]                      updates per the local mirror
+  packed update <source> [--approve] [--json]  update one configured package through Pi
   packed mirror [--json]                       sync upstream into the local SQLite index
   packed installed [--json]                    installed pi packages
   packed catalog [--json]                      local package index (apt-cache stats)
@@ -98,6 +100,7 @@ const PACKAGE_COMMAND_OPERATIONS: Record<string, PackageOperation | undefined> =
 	installed: "installed",
 	catalog: "catalog",
 	updates: "updates",
+	update: "update",
 	mirror: "mirror",
 	install: "install",
 	remove: "remove",
@@ -237,8 +240,27 @@ const commands: Record<string, { usage: string; run: Command }> = {
 		},
 	},
 
+	update: {
+		usage: "packed update <configured-source> [--approve] [--json]",
+		async run(_rest, d, flags, pos) {
+			const source = pos[0] ?? "";
+			if (!SOURCE_RE.test(source)) return usageErr(`usage: ${commands["update"]!.usage}\n`);
+			try {
+				const output = await d.inst.update(source, { approved: flags.approved });
+				return flags.json
+					? ok(`${JSON.stringify({ ok: true, source, output, reloadRequired: true })}\n`)
+					: ok(`${output}\nReload Pi with /reload to activate the updated package.\n`);
+			} catch (error) {
+				const message = error instanceof Error ? error.message : String(error);
+				return flags.json
+					? fail(`${JSON.stringify({ ok: false, source, error: message, reloadRequired: false })}\n`)
+					: fail(`${message}\n`);
+			}
+		},
+	},
+
 	remove: {
-		usage: "packed remove <name> [--json]  (bare npm name, e.g. pi-lsp or @scope/pkg)",
+		usage: "packed remove <name> [--approve] [--json]  (bare npm name, e.g. pi-lsp or @scope/pkg)",
 		async run(_rest, d, flags, pos) {
 			const name = pos[0] ?? "";
 			if (!NAME_RE.test(name)) return usageErr(`usage: ${commands["remove"]!.usage}\n`);
@@ -299,7 +321,7 @@ export async function cliRun(args: string[], d: CliDeps): Promise<CliResult> {
 	if (!cmd) return usageErr(`unknown command "${name}"\n${USAGE}`);
 	const { flags, pos } = parseFlags(rest);
 	try {
-		const validMutationInput = name === "install"
+		const validMutationInput = name === "install" || name === "update"
 			? SOURCE_RE.test(pos[0] ?? "")
 			: name === "remove" ? NAME_RE.test(pos[0] ?? "")
 				: name === "security" ? (pos[0] === undefined || pos[0] === "always" || pos[0] === "never")

package/src/client.ts

@@ -21,6 +21,7 @@ export interface PackageDaemonPort {
 	setMutationApproval(value: MutationApproval, approved?: boolean): Promise<SecuritySettings>;
 	install(source: string, approved?: boolean): Promise<string>;
 	remove(name: string, approved?: boolean): Promise<string>;
+	update(source: string, approved?: boolean): Promise<string>;
 }
 
 interface MutationResponse {
@@ -113,6 +114,15 @@ export class PackageDaemonClient implements PackageDaemonPort {
 		if (!result.ok) throw new PackageDaemonError(result.output || `failed to remove ${name}`, "remove");
 		return result.output;
 	}
+
+	async update(source: string, approved = false): Promise<string> {
+		const result = await this.request<MutationResponse>("/update", {
+			method: "POST",
+			body: JSON.stringify({ source, approved }),
+		});
+		if (!result.ok) throw new PackageDaemonError(result.output || `failed to update ${source}`, "update");
+		return result.output;
+	}
 }
 
 export class PackageDaemonInstaller implements Installer {
@@ -128,6 +138,10 @@ export class PackageDaemonInstaller implements Installer {
 		}
 		return this.client.remove(source.slice(4), options?.approved);
 	}
+
+	update(source: string, options?: { approved?: boolean }): Promise<string> {
+		return this.client.update(source, options?.approved);
+	}
 }
 
 export class DaemonBackedSecurity {
@@ -150,6 +164,10 @@ export class DaemonBackedInstaller implements Installer {
 	async remove(source: string, options?: { approved?: boolean }): Promise<string> {
 		return new PackageDaemonInstaller(await connectPackageDaemon(this.stateDirectory)).remove(source, options);
 	}
+
+	async update(source: string, options?: { approved?: boolean }): Promise<string> {
+		return (await connectPackageDaemon(this.stateDirectory)).update(source, options?.approved);
+	}
 }
 
 export class DaemonRegistry implements Registry {

package/src/install.ts

@@ -30,4 +30,8 @@ export class ExecInstaller implements Installer {
 	remove(source: string, _options?: { approved?: boolean }): Promise<string> {
 		return this.run(["remove", source]);
 	}
+
+	update(source: string, _options?: { approved?: boolean }): Promise<string> {
+		return this.run(["update", "--extension", source]);
+	}
 }

package/src/ports.ts

@@ -41,6 +41,7 @@ export interface Registry {
 export interface Installer {
 	install(source: string, options?: { approved?: boolean }): Promise<string>;
 	remove(source: string, options?: { approved?: boolean }): Promise<string>;
+	update(source: string, options?: { approved?: boolean }): Promise<string>;
 }
 
 export interface InstalledPkg {

package/src/service.ts

@@ -166,6 +166,29 @@ export function createApp(deps: Deps): { fetch: (req: Request) => Promise<Respon
 			}
 		}
 
+		if (path === "/update" && req.method === "POST") {
+			let source = "";
+			let approved = false;
+			try {
+				const body = (await req.json()) as { source?: unknown; approved?: unknown };
+				source = String(body.source ?? "");
+				approved = body.approved === true;
+			} catch {
+				/* fall through to validation */
+			}
+			if (!SOURCE_RE.test(source)) {
+				return err(400, "invalid source; want a configured npm:, git:, or https package source");
+			}
+			const denied = authorize("update", approved);
+			if (denied) return denied;
+			try {
+				const output = await deps.inst.update(source, { approved });
+				return json({ ok: true, source, output, reloadRequired: true });
+			} catch (error) {
+				return json({ ok: false, source, output: error instanceof Error ? error.message : String(error), reloadRequired: false });
+			}
+		}
+
 		if (path === "/updates" && req.method === "GET") {
 			const snap = await loadUpdates(deps.stateDir);
 			return json(snap ?? { updates: [] });