@danypops/pi-packed 0.5.3 → 0.6.1

package/extension/src/resource-config.ts

@@ -0,0 +1,230 @@
+/**
+ * resource-config.ts — /packed config overlay: enable/disable individual
+ * extensions, skills, prompt templates, and themes declared by installed
+ * Pi packages, matching pi's own `pi config` interaction model (group by
+ * package, toggle with space/enter, Tab to switch global/project scope).
+ * Pi's own settings mutation lives in its internal SettingsManager, which
+ * extensions cannot reach -- this reads and writes the same documented
+ * settings.json filter arrays (docs/packages.md, "Enable and Disable
+ * Resources") entirely through Packed's authenticated daemon.
+ */
+import type { ExtensionCommandContext } from "@earendil-works/pi-coding-agent";
+import { DynamicBorder, rawKeyHint } from "@earendil-works/pi-coding-agent";
+import { Container, Input, Spacer, truncateToWidth, visibleWidth } from "@earendil-works/pi-tui";
+import type { PackageResources, ResourceField } from "./packed.js";
+import type { Natives } from "./packed.js";
+import { packagePermissionDecision } from "./permission.js";
+
+type Scope = "global" | "project";
+const RESOURCE_FIELDS = ["extensions", "skills", "prompts", "themes"] as const satisfies readonly ResourceField[];
+
+interface FlatItem {
+	scope: Scope;
+	source: string;
+	packageName: string;
+	field: ResourceField;
+	path: string;
+	enabled: boolean;
+}
+
+export function flatten(groups: PackageResources[], scope: Scope): FlatItem[] {
+	const items: FlatItem[] = [];
+	for (const group of groups) {
+		for (const field of RESOURCE_FIELDS) {
+			for (const item of group[field]) items.push({ scope, source: group.source, packageName: group.name, field, path: item.path, enabled: item.enabled });
+		}
+	}
+	return items.sort((a, b) => a.packageName.localeCompare(b.packageName) || a.field.localeCompare(b.field) || a.path.localeCompare(b.path));
+}
+
+export function filterItems(items: FlatItem[], query: string): FlatItem[] {
+	const q = query.trim().toLowerCase();
+	if (!q) return items;
+	return items.filter((item) => `${item.packageName} ${item.field} ${item.path}`.toLowerCase().includes(q));
+}
+
+export type { FlatItem };
+
+interface PanelAction {
+	type: "toggle" | "switch" | "refresh" | "close";
+	item?: FlatItem;
+}
+
+async function approveToggle(
+	natives: Pick<Natives, "security">,
+	ctx: Pick<ExtensionCommandContext, "hasUI" | "ui">,
+	item: FlatItem,
+	nextEnabled: boolean,
+): Promise<boolean> {
+	const settings = await natives.security();
+	if (!packagePermissionDecision(settings, "toggle").approvalRequired) return true;
+	if (!ctx.hasUI) return false;
+	const reloadNote = item.field === "extensions" ? " This will require a Pi reload (/reload) to take effect." : "";
+	return ctx.ui.confirm(
+		`${nextEnabled ? "Enable" : "Disable"} ${item.field.slice(0, -1)}`,
+		`${item.packageName} \u00b7 ${item.path}.${reloadNote} Continue?`,
+	);
+}
+
+export type ToggleOutcome = "toggled" | "cancelled" | "failed";
+
+/** Warns inline (in the pre-toggle confirm dialog, not a footer note),
+ * requires the same approval every other settings-mutating operation
+ * requires, and reports -- never silently assumes -- whether the toggle
+ * actually reached the daemon. Extracted from the render loop so this
+ * approve-then-mutate decision is directly testable without faking a full
+ * ctx.ui.custom interaction. */
+export async function applyResourceToggle(item: FlatItem, natives: Pick<Natives, "security" | "toggleResource">, ctx: ExtensionCommandContext): Promise<ToggleOutcome> {
+	const nextEnabled = !item.enabled;
+	const approved = await approveToggle(natives, ctx, item, nextEnabled);
+	if (!approved) { ctx.ui.notify("toggle cancelled", "warning"); return "cancelled"; }
+	try {
+		await natives.toggleResource(item.source, item.field, item.path, nextEnabled, item.scope === "project" ? ctx.cwd : undefined, true);
+		return "toggled";
+	} catch (error) {
+		ctx.ui.notify(`toggle failed: ${error instanceof Error ? error.message : error}`, "error");
+		return "failed";
+	}
+}
+
+/** `/packed config` dispatch, matching handleSetupCommand's own
+ * returns-true-if-handled shape so index.ts can chain both checks. */
+export async function handleResourceConfigCommand(args: string, ctx: ExtensionCommandContext, natives: Natives): Promise<boolean> {
+	if (args.trim() !== "config") return false;
+	await showResourceConfig(ctx, natives);
+	return true;
+}
+
+export async function showResourceConfig(ctx: ExtensionCommandContext, natives: Natives): Promise<void> {
+	if (!ctx.hasUI) {
+		ctx.ui.notify("/packed config requires interactive mode", "warning");
+		return;
+	}
+	let data: { global: PackageResources[]; project: PackageResources[] };
+	try { data = await natives.listResources(ctx.cwd); }
+	catch (error) {
+		ctx.ui.notify(`packed unavailable: ${error instanceof Error ? error.message : error}`, "error");
+		return;
+	}
+
+	let scope: Scope = "global";
+	let pendingReload = false;
+
+	for (;;) {
+		const action = await renderConfig(ctx, data, scope);
+		if (action.type === "close") break;
+		if (action.type === "switch") { scope = scope === "global" ? "project" : "global"; continue; }
+		if (action.type === "refresh") {
+			try { data = await natives.listResources(ctx.cwd); }
+			catch (error) { ctx.ui.notify(`refresh failed: ${error instanceof Error ? error.message : error}`, "error"); }
+			continue;
+		}
+		const item = action.item;
+		if (!item) continue;
+		const outcome = await applyResourceToggle(item, natives, ctx);
+		if (outcome !== "toggled") continue;
+		const group = (item.scope === "global" ? data.global : data.project).find((candidate) => candidate.source === item.source);
+		const entry = group?.[item.field].find((candidate) => candidate.path === item.path);
+		if (entry) entry.enabled = !item.enabled;
+		if (item.field === "extensions") pendingReload = true;
+	}
+
+	if (!pendingReload) return;
+	const confirmed = await ctx.ui.confirm("Reload Pi now?", "Extension changes only take effect after a reload.");
+	if (confirmed) await ctx.reload();
+	else ctx.ui.notify("Extension changes pending -- run /reload when ready.", "warning");
+}
+
+function renderConfig(ctx: ExtensionCommandContext, data: { global: PackageResources[]; project: PackageResources[] }, scope: Scope): Promise<PanelAction> {
+	return ctx.ui.custom<PanelAction>((tui, theme, _kb, done) => {
+		const searchInput = new Input();
+		let searchActive = false;
+		const items = flatten(scope === "global" ? data.global : data.project, scope);
+		let filtered = items;
+		let selectedIndex = 0;
+		const maxVisible = 20;
+
+		function applyFilter(): void {
+			filtered = filterItems(items, searchInput.getValue());
+			selectedIndex = 0;
+		}
+
+		const header = {
+			invalidate() {},
+			render(width: number): string[] {
+				const title = theme.bold(scope === "project" ? "Project Resources" : "Global Resources");
+				const hint = searchActive
+					? rawKeyHint("esc", "clear")
+					: rawKeyHint("space", "toggle") + theme.fg("muted", " \u00b7 ") + rawKeyHint("/", "filter") + theme.fg("muted", " \u00b7 ") + rawKeyHint("tab", "scope") + theme.fg("muted", " \u00b7 ") + rawKeyHint("esc", "close");
+				const spacing = Math.max(1, width - visibleWidth(title) - visibleWidth(hint));
+				const line1 = truncateToWidth(`${title}${" ".repeat(spacing)}${hint}`, width, "");
+				const line2 = truncateToWidth(theme.fg("muted", `${items.length} resource(s) \u00b7 extensions need /reload after a change`), width, "");
+				return [line1, line2];
+			},
+		};
+
+		const list = {
+			invalidate() {},
+			render(width: number): string[] {
+				const lines: string[] = [];
+				if (searchActive) lines.push(...searchInput.render(width));
+				lines.push("");
+				if (filtered.length === 0) { lines.push(theme.fg("muted", "  No resources found")); return lines; }
+				const start = Math.max(0, Math.min(selectedIndex - Math.floor(maxVisible / 2), filtered.length - maxVisible));
+				const end = Math.min(start + maxVisible, filtered.length);
+				for (let index = start; index < end; index++) {
+					const item = filtered[index]!;
+					const isSelected = index === selectedIndex;
+					const cursor = isSelected ? theme.fg("accent", "\u276f") : " ";
+					const box = item.enabled ? theme.fg("success", "[x]") : theme.fg("dim", "[ ]");
+					const reloadMark = item.field === "extensions" ? theme.fg("warning", " \u27f3") : "";
+					const label = `${item.packageName} \u00b7 ${item.field} \u00b7 ${item.path}${reloadMark}`;
+					lines.push(truncateToWidth(`${cursor} ${box} ${isSelected ? theme.bold(label) : label}`, width, "..."));
+				}
+				const hasScroll = start > 0 || end < filtered.length;
+				if (hasScroll) lines.push(theme.fg("dim", `  ${selectedIndex + 1}/${filtered.length}`));
+				return lines;
+			},
+		};
+
+		const container = new Container();
+		container.addChild(new Spacer(1));
+		container.addChild(new DynamicBorder());
+		container.addChild(new Spacer(1));
+		container.addChild(header);
+		container.addChild(new Spacer(1));
+		container.addChild(list);
+		container.addChild(new Spacer(1));
+		container.addChild(new DynamicBorder());
+
+		return {
+			render: (width: number) => container.render(width),
+			invalidate: () => container.invalidate(),
+			handleInput(raw: string) {
+				if (searchActive) {
+					if (raw === "\x1b") { searchActive = false; searchInput.setValue?.(""); applyFilter(); }
+					else if (raw === "\r") searchActive = false;
+					else { searchInput.handleInput(raw); applyFilter(); }
+					tui.requestRender();
+					return;
+				}
+				switch (raw) {
+					case "\x1b[A": selectedIndex = (selectedIndex - 1 + filtered.length) % Math.max(filtered.length, 1); break;
+					case "\x1b[B": selectedIndex = (selectedIndex + 1) % Math.max(filtered.length, 1); break;
+					case "\t": done({ type: "switch" }); return;
+					case "/": searchActive = true; break;
+					case "r": done({ type: "refresh" }); return;
+					case " ":
+					case "\r": {
+						const item = filtered[selectedIndex];
+						if (item) done({ type: "toggle", item });
+						return;
+					}
+					case "\x1b": done({ type: "close" }); return;
+					default: return;
+				}
+				tui.requestRender();
+			},
+		};
+	});
+}

package/extension/src/security-tui.ts

@@ -1,5 +1,6 @@
 import type { ExtensionCommandContext } from "@earendil-works/pi-coding-agent";
-import type { MutationApproval } from "../../src/security.ts";
+import type { SecuritySettings } from "@danypops/packed/protocol";
+type MutationApproval = SecuritySettings["mutationApproval"];
 import type { Natives } from "./packed.ts";
 
 const OPTIONS: Array<{ value: MutationApproval; label: string }> = [

package/extension/src/setup-command.ts

@@ -0,0 +1,50 @@
+import { resolve } from "node:path";
+import type { ExtensionCommandContext } from "@earendil-works/pi-coding-agent";
+import type { Natives } from "./packed.js";
+
+interface SetupCommandArgs { action: "plan" | "apply"; path: string; prune: boolean; }
+
+function parseSetupCommand(args: string, cwd: string): SetupCommandArgs | undefined {
+	const parts = args.trim().split(/\s+/).filter(Boolean);
+	if (parts[0] !== "setup" || (parts[1] !== "plan" && parts[1] !== "apply")) return undefined;
+	const prune = parts.includes("--prune");
+	const path = parts.slice(2).find((part) => !part.startsWith("--")) ?? "pi-setup.json";
+	return { action: parts[1], path: resolve(cwd, path), prune };
+}
+
+export async function handleSetupCommand(args: string, ctx: ExtensionCommandContext, natives: Pick<Natives, "setupPlan" | "setupApply">): Promise<boolean> {
+	const parsed = parseSetupCommand(args, ctx.cwd);
+	if (!parsed) return false;
+	if (!ctx.hasUI) return true;
+	const plan = await natives.setupPlan(parsed.path, parsed.prune);
+	if (!plan.ok) {
+		ctx.ui.notify(plan.diagnostics[0]?.message ?? "Setup manifest is invalid", "error");
+		return true;
+	}
+	if (parsed.action === "plan") {
+		const suffix = parsed.prune ? " with prune" : "";
+		ctx.ui.notify(`${plan.operations.length} setup operation(s)${suffix}`, "info");
+		return true;
+	}
+	if (plan.operations.length === 0) {
+		ctx.ui.notify("Setup already matches", "info");
+		return true;
+	}
+	const packageChanges = plan.operations.filter((operation) => operation.kind.includes("package")).length;
+	const confirmed = await ctx.ui.confirm(
+		"Apply Pi setup?",
+		`Apply ${plan.operations.length} operation(s)${parsed.prune ? ", including prune removals" : ""}. ${packageChanges} package operation(s) may execute package code.`,
+	);
+	if (!confirmed) return true;
+	const result = await natives.setupApply(parsed.path, true, parsed.prune);
+	if (!result.ok) {
+		ctx.ui.notify(result.diagnostics[0]?.message ?? "Setup apply failed", "error");
+		return true;
+	}
+	if (result.reloadRequired) {
+		await ctx.reload();
+		return true;
+	}
+	ctx.ui.notify(`Applied ${result.operations.length} setup operation(s)`, "info");
+	return true;
+}

package/extension/src/tool-output.ts

@@ -9,17 +9,21 @@ import {
 	TOOL_DETAILS_MAX_PACKAGES,
 	TOOL_DETAILS_MAX_SERIALIZED_CHARACTERS,
 	TOOL_MODEL_CONTENT_MAX_CHARACTERS,
-} from "../../src/constants.ts";
-import type { Pkg, PkgInfo } from "../../src/ports.ts";
+} from "./constants.js";
+import type { PackageInfo as PkgInfo, PackageSummary as Pkg } from "@danypops/packed/protocol";
 
-const DETAILS_VERSION = 1 as const;
+const DETAILS_VERSION = 2 as const;
 const MUTATION_OPERATIONS = new Set(["install", "update", "remove"]);
 const MUTATION_STATUSES = new Set(["succeeded", "cancelled", "denied"]);
+const PACKAGE_SHAPES = new Set(["keyword-only", "manifest", "conventional"]);
+const TRUSTED_PUBLISHER_STATES = new Set(["verified", "not-verified", "unknown"]);
 
 export interface PackageSummaryDetails {
 	name: string;
 	version: string;
 	description: string;
+	shape: "keyword-only" | "manifest" | "conventional";
+	verified: boolean;
 }
 
 export interface SearchToolDetails {
@@ -42,6 +46,8 @@ export interface InfoToolDetails {
 		license?: string;
 		keywords: string[];
 		capabilities: string[];
+		provenance?: string;
+		trustedPublisher: "verified" | "not-verified" | "unknown";
 	};
 }
 
@@ -116,6 +122,8 @@ function packageSummary(pkg: Pkg): PackageSummaryDetails {
 		name: bounded(pkg.name, TOOL_DETAILS_MAX_DESCRIPTION_CHARACTERS),
 		version: bounded(pkg.version, TOOL_DETAILS_MAX_DESCRIPTION_CHARACTERS),
 		description: bounded(pkg.description, TOOL_DETAILS_MAX_DESCRIPTION_CHARACTERS),
+		shape: pkg.packageEvidence?.shape ?? "keyword-only",
+		verified: pkg.packageEvidence?.verified === true,
 	};
 }
 
@@ -143,6 +151,8 @@ export function createInfoDetails(info: PkgInfo): InfoToolDetails {
 			...(info.license ? { license: bounded(info.license, TOOL_DETAILS_MAX_DESCRIPTION_CHARACTERS) } : {}),
 			keywords: (info.keywords ?? []).slice(0, TOOL_DETAILS_MAX_KEYWORDS).map((keyword) => bounded(keyword, TOOL_DETAILS_MAX_DESCRIPTION_CHARACTERS)),
 			capabilities: Object.keys(info.pi ?? {}).slice(0, TOOL_DETAILS_MAX_CAPABILITIES).map((name) => bounded(name, TOOL_DETAILS_MAX_DESCRIPTION_CHARACTERS)),
+			...(info.publication?.provenanceUrl ? { provenance: safePackageTarget(info.publication.provenanceUrl) } : {}),
+			trustedPublisher: info.publication?.trustedPublisher ?? "unknown",
 		},
 	};
 }
@@ -191,9 +201,10 @@ export function parsePackageToolDetails(value: unknown): PackageToolDetails | un
 			const pkg = candidate.package as Record<string, unknown>;
 			if (!isPackageSummary(pkg) || !Array.isArray(pkg.keywords) || pkg.keywords.length > TOOL_DETAILS_MAX_KEYWORDS || !pkg.keywords.every((item) => isShortString(item, TOOL_DETAILS_MAX_DESCRIPTION_CHARACTERS))) return undefined;
 			if (!Array.isArray(pkg.capabilities) || pkg.capabilities.length > TOOL_DETAILS_MAX_CAPABILITIES || !pkg.capabilities.every((item) => isShortString(item, TOOL_DETAILS_MAX_DESCRIPTION_CHARACTERS))) return undefined;
-			for (const field of ["homepage", "repository", "license"] as const) {
+			for (const field of ["homepage", "repository", "license", "provenance"] as const) {
 				if (pkg[field] !== undefined && !isShortString(pkg[field])) return undefined;
 			}
+			if (typeof pkg.trustedPublisher !== "string" || !TRUSTED_PUBLISHER_STATES.has(pkg.trustedPublisher)) return undefined;
 			return value as InfoToolDetails;
 		}
 		if (candidate.kind === "mutation") {
@@ -213,7 +224,9 @@ function isPackageSummary(value: unknown): boolean {
 	const item = value as Record<string, unknown>;
 	return isShortString(item.name, TOOL_DETAILS_MAX_DESCRIPTION_CHARACTERS)
 		&& isShortString(item.version, TOOL_DETAILS_MAX_DESCRIPTION_CHARACTERS)
-		&& isShortString(item.description, TOOL_DETAILS_MAX_DESCRIPTION_CHARACTERS);
+		&& isShortString(item.description, TOOL_DETAILS_MAX_DESCRIPTION_CHARACTERS)
+		&& typeof item.shape === "string" && PACKAGE_SHAPES.has(item.shape)
+		&& typeof item.verified === "boolean";
 }
 
 function contentFallback(result: AgentToolResult<unknown>): string {
@@ -240,7 +253,10 @@ export function renderPackageToolResult(
 			if (details.kind === "search") {
 				const shown = options.expanded ? details.items : details.items.slice(0, TOOL_COLLAPSED_PACKAGE_PREVIEW);
 				const heading = `${theme.bold(String(details.total))} packages · showing ${details.items.length}${details.truncated ? " · bounded" : ""}`;
-				const rows = shown.map((pkg) => truncateToWidth(`${theme.fg("accent", `${pkg.name}@${pkg.version}`)}${options.expanded && pkg.description ? ` — ${pkg.description}` : ""}`, safeWidth));
+				const rows = shown.map((pkg) => {
+					const evidence = pkg.verified ? ` [verified ${pkg.shape}]` : " [keyword candidate]";
+					return truncateToWidth(`${theme.fg("accent", `${pkg.name}@${pkg.version}`)}${theme.fg("muted", evidence)}${options.expanded && pkg.description ? ` — ${pkg.description}` : ""}`, safeWidth);
+				});
 				if (!options.expanded && details.items.length > shown.length) rows.push(theme.fg("muted", `… ${details.items.length - shown.length} more`));
 				return [truncateToWidth(heading, safeWidth), ...rows];
 			}
@@ -251,6 +267,9 @@ export function renderPackageToolResult(
 					if (pkg.license) lines.push(`license: ${pkg.license}`);
 					if (pkg.repository) lines.push(`repository: ${pkg.repository}`);
 					if (pkg.homepage) lines.push(`homepage: ${pkg.homepage}`);
+					lines.push(`shape: ${pkg.shape}${pkg.verified ? " (tarball verified)" : " (metadata only)"}`);
+					if (pkg.provenance) lines.push(`provenance: ${pkg.provenance}`);
+					lines.push(`trusted publisher: ${pkg.trustedPublisher}`);
 					if (pkg.capabilities.length) lines.push(`provides: ${pkg.capabilities.join(", ")}`);
 					if (pkg.keywords.length) lines.push(`keywords: ${pkg.keywords.join(", ")}`);
 				}

package/extension/src/tools.ts

@@ -1,8 +1,9 @@
 /** Agent-facing package tools over the authenticated daemon. */
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
-import { packagePermissionDecision, type PackageOperation } from "../../src/security.ts";
-import type { Natives } from "./packed.js";
+import { packagePermissionDecision, type PackageOperation } from "./permission.js";
+import { InstallServiceError, PI_COMMAND_NAME, type Natives } from "./packed.js";
+import { reloadWarning } from "./reload.js";
 import {
 	createInfoDetails,
 	createModelContent,
@@ -41,14 +42,14 @@ export async function approvePackageOperation(
 	}
 	const approved = await ctx.ui.confirm(
 		`${operation[0]!.toUpperCase()}${operation.slice(1)} Pi package`,
-		`Run: ${command}\n\nThis operation can execute package code or mutate Pi settings/install roots. Continue?`,
+		`Run: ${command}\n\nThis operation can execute package code or mutate Pi settings/install roots. ${reloadWarning(operation)} Continue?`,
 	);
 	return approved ? { allowed: true, approved: true } : { allowed: false, approved: false, reason: "cancelled", message: `${operation} cancelled by user.` };
 }
 
 export async function installPackageWithPolicy(
 	source: string,
-	natives: Pick<Natives, "security" | "install">,
+	natives: Pick<Natives, "security" | "install" | "installService">,
 	ctx: ApprovalContext,
 ) {
 	const approval = await approvePackageOperation("install", `pi install ${source}`, natives, ctx);
@@ -56,7 +57,23 @@ export async function installPackageWithPolicy(
 		const output = approval.message ?? "install denied";
 		return text(output, createMutationDetails("install", source, approval.reason ?? "denied", output));
 	}
-	const output = await natives.install(source, approval.approved) || `Installed ${source}. Reload with /reload to activate.`;
+	let output = await natives.install(source, approval.approved) || `Installed ${source}. Reload with /reload to activate.`;
+	// Piggybacks on the same approval already granted for install -- both are
+	// the same code-execution mutation tier, not a new consent surface. Silent
+	// for the overwhelmingly common case (most Pi packages aren't daemons at
+	// all); a genuine failure is reported without failing the install itself,
+	// which already succeeded.
+	if (source.startsWith("npm:")) {
+		try {
+			const svc = await natives.installService(source, approval.approved);
+			output += `\n${svc.output}`;
+		} catch (e) {
+			if (!(e instanceof InstallServiceError) || !e.notADaemon) {
+				const message = e instanceof Error ? e.message : String(e);
+				output += `\nnote: detected a persistent-service daemon but could not register it: ${message}`;
+			}
+		}
+	}
 	return text(output, createMutationDetails("install", source, "succeeded", output));
 }
 
@@ -125,7 +142,7 @@ export function registerTools(pi: ExtensionAPI, natives: Natives): void {
 	pi.registerTool({
 		name: "pkg_info",
 		label: "Pi Package Info",
-		description: "Show bounded metadata and declared Pi resources for one package.",
+		description: `Show bounded metadata and declared Pi resources for one package. Special case: querying ${PI_COMMAND_NAME} (Pi itself) also reports the locally running version against the latest published release -- a different question from, and in addition to, the generic npm registry metadata every other package gets.`,
 		parameters: Type.Object({ name: Type.String({ description: "npm package name" }) }),
 		renderCall(args, theme) { return renderPackageToolCall("Package info", args, theme); },
 		renderResult(result, options, theme, context) { return renderPackageToolResult(result, options, theme, context); },
@@ -141,6 +158,21 @@ export function registerTools(pi: ExtensionAPI, natives: Natives): void {
 					info.unpackedSize ? `size: ${(info.unpackedSize / 1024).toFixed(0)} KB` : "",
 					info.modified ? `modified: ${info.modified}` : "",
 				].filter(Boolean);
+				// Special-cased by package identity, not by any change in risk
+				// profile -- still a pure read, just answering a second, genuinely
+				// different question (what's actually running here, not what npm
+				// last published) that the generic registry lookup above cannot.
+				if (params.name === PI_COMMAND_NAME) {
+					const status = await natives.piStatus().catch(() => undefined);
+					if (status?.current) {
+						const comparison = status.latest === undefined
+							? "latest release unknown"
+							: status.upToDate === false
+								? `behind -- latest is ${status.latest}, run pi update --self`
+								: `up to date with the latest ${status.latest}`;
+						lines.push(`--- Pi runtime (not npm registry data) ---`, `currently running: ${status.current}`, comparison);
+					}
+				}
 				return text(lines.join("\n"), createInfoDetails(info));
 			} catch (error) {
 				throw new Error(`pkg_info failed: ${error instanceof Error ? error.message : error}`);

package/extension/src/tui.ts

@@ -17,6 +17,63 @@ interface PanelAction {
 	row?: Row;
 }
 
+/** Outcome of a confirmed row action, resolved after any real mutation and
+ * reload decision -- "changed" means the daemon state changed and Pi has
+ * already been reloaded (the caller should stop showing the stale panel);
+ * "unchanged"/"cancelled" mean the panel keeps running as-is. */
+export type PackageChoiceOutcome = "changed" | "unchanged" | "cancelled";
+
+export async function applyPackageChoice(
+	choice: string | undefined,
+	row: Row,
+	natives: Natives,
+	ctx: ExtensionCommandContext,
+): Promise<PackageChoiceOutcome> {
+	if (choice?.startsWith("Update")) {
+		try {
+			const approval = await approvePackageOperation("update", `pi update --extension npm:${row.name}`, natives, ctx);
+			if (!approval.allowed) {
+				ctx.ui.notify(approval.message ?? "update denied", "warning");
+				return "cancelled";
+			}
+			ctx.ui.notify(`Updating ${row.name}…`, "info");
+			const outcome = await natives.update(`npm:${row.name}`, approval.approved);
+			if (!outcome.reloadRequired) {
+				const version = outcome.currentVersion ?? outcome.previousVersion;
+				const reason = outcome.pinned
+					? `pinned to ${version ?? "an exact version"} -- pi update intentionally leaves pinned packages unchanged`
+					: `already up to date${version ? ` at ${version}` : ""}`;
+				ctx.ui.notify(`${row.name} is ${reason}.`, "info");
+				return "unchanged";
+			}
+			const transition = outcome.previousVersion && outcome.currentVersion ? ` (${outcome.previousVersion} → ${outcome.currentVersion})` : "";
+			ctx.ui.notify(`Updated ${row.name}${transition}; reloading Pi resources.`, "info");
+			await ctx.reload();
+			return "changed";
+		} catch (e) {
+			ctx.ui.notify(`update failed: ${e instanceof Error ? e.message : e}`, "error");
+			return "cancelled";
+		}
+	}
+	if (choice === "Remove") {
+		try {
+			const approval = await approvePackageOperation("remove", `pi remove npm:${row.name}`, natives, ctx);
+			if (!approval.allowed) {
+				ctx.ui.notify(approval.message ?? "remove denied", "warning");
+				return "cancelled";
+			}
+			await natives.remove(row.name, approval.approved);
+			ctx.ui.notify(`Removed ${row.name}; reloading Pi resources.`, "info");
+			await ctx.reload();
+			return "changed";
+		} catch (e) {
+			ctx.ui.notify(`remove failed: ${e instanceof Error ? e.message : e}`, "error");
+			return "cancelled";
+		}
+	}
+	return "cancelled";
+}
+
 async function loadRows(natives: Natives): Promise<{ rows: Row[]; error?: string }> {
 	try {
 		const [installed, updates] = await Promise.all([
@@ -64,35 +121,8 @@ export async function showPackages(ctx: ExtensionCommandContext, natives: Native
 			],
 		);
 
-		if (choice?.startsWith("Update")) {
-			try {
-				const approval = await approvePackageOperation("update", `pi update --extension npm:${row.name}`, natives, ctx);
-				if (!approval.allowed) {
-					ctx.ui.notify(approval.message ?? "update denied", "warning");
-					continue;
-				}
-				ctx.ui.notify(`Updating ${row.name}…`, "info");
-				await natives.update(`npm:${row.name}`, approval.approved);
-				ctx.ui.notify(`Updated ${row.name} to ${row.latest}; reloading Pi resources`, "info");
-				await ctx.reload();
-				return;
-			} catch (e) {
-				ctx.ui.notify(`update failed: ${e instanceof Error ? e.message : e}`, "error");
-			}
-		} else if (choice === "Remove") {
-			try {
-				const approval = await approvePackageOperation("remove", `pi remove npm:${row.name}`, natives, ctx);
-				if (approval.allowed) {
-					await natives.remove(row.name, approval.approved);
-					ctx.ui.notify(`Removed ${row.name}`, "info");
-					rows = rows.filter((r) => r.name !== row.name);
-				} else {
-					ctx.ui.notify(approval.message ?? "remove denied", "warning");
-				}
-			} catch (e) {
-				ctx.ui.notify(`remove failed: ${e instanceof Error ? e.message : e}`, "error");
-			}
-		}
+		const outcome = await applyPackageChoice(choice, row, natives, ctx);
+		if (outcome === "changed") return; // ctx.reload() already replaced the session
 	}
 }
 

package/package.json

@@ -1,43 +1,30 @@
 {
   "name": "@danypops/pi-packed",
-  "version": "0.5.3",
-  "description": "Package service for the Pi agent: search/info/install/updates + /packages TUI, backed by a long-running Bun service",
+  "version": "0.6.1",
+  "description": "Pi package tools, commands, profiles, and TUI for the Packed daemon",
   "type": "module",
-  "bin": {
-    "packed": "src/cli.ts"
+  "keywords": ["pi-package"],
+  "pi": {
+    "extensions": ["extension/src/index.ts"]
   },
-  "keywords": [
-    "pi-package"
-  ],
   "scripts": {
-    "test": "bun test",
-    "typecheck": "bun x tsc --noEmit",
-    "cli": "bun src/cli.ts",
-    "serve": "bun src/cli.ts serve"
-  },
-  "pi": {
-    "extensions": [
-      "extension/src/index.ts"
-    ]
+    "test": "bun test test",
+    "typecheck": "bunx tsc --noEmit"
   },
   "dependencies": {
-    "@danypops/daemon-kit": "^0.4.0"
+    "@danypops/packed": "^0.2.0",
+    "@danypops/vehicle-client": "^0.1.1",
+    "@danypops/vehicle-client-pi": "^0.1.5"
   },
   "peerDependencies": {
     "@earendil-works/pi-coding-agent": "*",
-    "@earendil-works/pi-tui": "*",
-    "typebox": "*"
-  },
-  "devDependencies": {
-    "bun-types": "latest"
+    "typebox": "*",
+    "@earendil-works/pi-tui": "*"
   },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/DanyPops/pi-packed.git"
+    "url": "git+https://github.com/DanyPops/packed.git",
+    "directory": "packages/pi-packed"
   },
-  "files": [
-    "src",
-    "extension",
-    "README.md"
-  ]
+  "files": ["extension", "setup", "README.md"]
 }

package/src/cache.ts

@@ -1,21 +0,0 @@
-/** TTLCache — the smart-proxy concern, nothing more. */
-import { CACHE_TTL_MS } from "./constants.ts";
-
-export class TTLCache {
-	private m = new Map<string, { body: string; expires: number }>();
-	constructor(private ttlMs = CACHE_TTL_MS) {}
-
-	get(key: string): string | undefined {
-		const e = this.m.get(key);
-		if (!e) return undefined;
-		if (Date.now() > e.expires) {
-			this.m.delete(key);
-			return undefined;
-		}
-		return e.body;
-	}
-
-	set(key: string, body: string): void {
-		this.m.set(key, { body, expires: Date.now() + this.ttlMs });
-	}
-}