@fdcn/sourcefed 0.3.8 → 0.4.0

package/README.md

@@ -33,11 +33,46 @@ OpenCode loads this package as both a server and a TUI plugin from one entry:
 
 ```json
 // ~/.config/opencode/opencode.jsonc
-{ "plugins": ["@fdcn/sourcefed@0.3.8"] }
+{ "plugins": ["@fdcn/sourcefed@0.4.0"] }
 ```
 
 The package exposes `./server`, `./tui`, `./opencode`, `./opencode/tui`, and `./pi` entrypoints for hosts that load them directly.
 
+## Host dependencies
+
+Pi provides `@earendil-works/pi-coding-agent`, `@earendil-works/pi-tui` and
+`typebox` through its extension loader. Sourcefed declares each as an optional
+peer with a `"*"` range and leaves their imports external in `dist/pi.js`, matching
+[Pi’s package contract](https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/packages.md#dependencies).
+OpenCode, CLI, daemon and MCP entry points do not import these peers. A plain npm
+install downloads no Pi host packages; a Pi host supplies its own versions.
+
+Install the extension through the Pi host:
+
+```sh
+pi install npm:@fdcn/sourcefed@0.4.0
+```
+
+The workspace uses pinned development dependencies to compile and test the Pi
+adapter. Those development tools are separate from the published runtime.
+
+From a checkout, verify the packed package:
+
+```sh
+npm run check
+
+node scripts/check-optional-pi.mjs
+```
+
+The check packs and installs Sourcefed into fresh temporary directories. It
+verifies the absence of Pi packages, imports the non-Pi libraries, loads the
+installed plugin in a private OpenCode host, and loads the Pi-managed extension
+in RPC mode without a model request. The Pi installer uses an isolated
+`npmCommand` wrapper that substitutes the local tarball for the package’s npm
+spec; the registry contains only published releases. The check needs OpenCode,
+OpenSSL and the workspace’s Pi development host. Its audit output includes
+remaining OpenCode dependencies and does not certify a clean security gate.
+
 ## Skills
 
 ```sh

package/dist/{chunk-5JL3UV72.js → chunk-L4SMC2NT.js}

@@ -25,6 +25,9 @@ import { createServer } from "node:http";
 import { Readable } from "node:stream";
 import { spawn as spawn2 } from "node:child_process";
 import path7 from "node:path";
+import { get as getHttp } from "node:http";
+import { get as getHttps } from "node:https";
+import { Readable as Readable2 } from "node:stream";
 var store$4;
 var DEFAULT_CONFIG = {
   lang: void 0,
@@ -12670,6 +12673,28 @@ function parseDaemonFrame(line) {
     return void 0;
   }
 }
+async function openEventResponse(url, headers, signal) {
+  signal.throwIfAborted();
+  const endpoint = new URL(url);
+  if (endpoint.protocol !== "http:" && endpoint.protocol !== "https:") {
+    throw new Error("event stream requires HTTP or HTTPS");
+  }
+  const get = endpoint.protocol === "https:" ? getHttps : getHttp;
+  const response = await new Promise((resolve, reject) => {
+    const request = get(endpoint, { headers, signal, agent: false }, resolve);
+    request.once("error", reject);
+  });
+  if (!response.statusCode || response.statusCode < 200 || response.statusCode >= 300) {
+    response.destroy();
+    throw new Error("event stream failed: " + response.statusCode);
+  }
+  return response;
+}
+function eventReader(response) {
+  return Readable2.toWeb(response, {
+    strategy: { highWaterMark: 64 * 1024, size: (chunk) => chunk.byteLength }
+  }).getReader();
+}
 var DaemonEventStream = class {
   constructor(url, headers, onEvents, acknowledge, onClose) {
     this.url = url;
@@ -12742,14 +12767,11 @@ var DaemonEventStream = class {
     this.stream = controller;
     this.controller.signal.addEventListener("abort", abort, { once: true });
     let reader;
+    let response;
     try {
       this.controller.signal.throwIfAborted();
-      const response = await fetch(this.url, { signal: controller.signal, headers: this.headers });
-      if (!response.ok || !response.body) {
-        await response.body?.cancel();
-        throw new Error(`event stream failed: ${response.status}`);
-      }
-      reader = response.body.getReader();
+      response = await openEventResponse(this.url, this.headers, controller.signal);
+      reader = eventReader(response);
       const decoder = new TextDecoder();
       let buffer = "";
       while (!controller.signal.aborted) {
@@ -12763,6 +12785,7 @@ var DaemonEventStream = class {
     } finally {
       await reader?.cancel().catch(() => void 0);
       reader?.releaseLock();
+      response?.destroy();
       this.controller.signal.removeEventListener("abort", abort);
       if (this.stream === controller) this.stream = void 0;
     }