@iseoane/agent-depot 0.6.1 → 0.6.2

package/CHANGELOG.md

@@ -7,6 +7,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.6.2] - 2026-10-13
+
+### Fixed
+
+- Pi Package update comparison no longer treats npm's generated dependency-free
+  root `package-lock.json` as a local checkout change. Any other lockfile, and
+  any tracked modification or additional untracked file, still blocks the
+  comparison.
+
 ## [0.6.1] - 2026-10-13
 
 ### Added

package/dist/src/package-host-state.js

@@ -258,7 +258,9 @@ async function readPiCheckoutEvidence(checkoutPath, sourceIdentity) {
         const version = isRecord(packageJson) && typeof packageJson.version === "string" && packageJson.version.trim() !== ""
             ? packageJson.version
             : undefined;
-        if (status !== "") {
+        const generatedRootLock = status === "?? package-lock.json"
+            && await isMatchingRootOnlyNpmLock(checkoutPath, packageJson);
+        if (status !== "" && !generatedRootLock) {
             return {
                 ...(version === undefined ? {} : { version }),
                 issue: `Pi reports this Package installed, but the Pi Git checkout has local modifications. Update assessment is unavailable; inspect the checkout before updating.`,
@@ -276,6 +278,48 @@ async function readPiCheckoutEvidence(checkoutPath, sourceIdentity) {
         return unavailable(reason);
     }
 }
+/** Recognize only npm's dependency-free generated root lock, never tracked edits. */
+async function isMatchingRootOnlyNpmLock(checkoutPath, manifest) {
+    try {
+        if (!isRecord(manifest))
+            return false;
+        const lockPath = path.join(checkoutPath, "package-lock.json");
+        await assertNoSymlinkPath(lockPath, "Pi generated lockfile");
+        const stat = await lstat(lockPath);
+        if (!stat.isFile() || stat.size > 64 * 1024)
+            return false;
+        const lock = JSON.parse(await readFile(lockPath, "utf8"));
+        if (!isRecord(lock) || lock.lockfileVersion !== 3 || lock.requires !== true
+            || typeof manifest.name !== "string" || typeof manifest.version !== "string"
+            || lock.name !== manifest.name || lock.version !== manifest.version
+            || Object.keys(lock).some((key) => !["name", "version", "lockfileVersion", "requires", "packages"].includes(key))
+            || !isRecord(lock.packages) || Object.keys(lock.packages).length !== 1)
+            return false;
+        const root = lock.packages[""];
+        if (!isRecord(root) || root.name !== manifest.name || root.version !== manifest.version)
+            return false;
+        // Ordinary dependencies mean this is more than the harmless root-only artifact.
+        for (const key of ["dependencies", "devDependencies", "optionalDependencies"]) {
+            if (manifest[key] !== undefined && (!isRecord(manifest[key]) || Object.keys(manifest[key]).length !== 0))
+                return false;
+        }
+        const allowed = ["name", "version", "license", "peerDependencies", "peerDependenciesMeta"];
+        const equalJson = (left, right) => {
+            if (left === right)
+                return true;
+            if (!isRecord(left) || !isRecord(right))
+                return false;
+            const keys = Object.keys(left);
+            return keys.length === Object.keys(right).length
+                && keys.every((key) => Object.hasOwn(right, key) && equalJson(left[key], right[key]));
+        };
+        return Object.keys(root).every((key) => allowed.includes(key) && equalJson(root[key], manifest[key]))
+            && ["peerDependencies", "peerDependenciesMeta"].every((key) => equalJson(root[key], manifest[key]));
+    }
+    catch {
+        return false;
+    }
+}
 async function runPiGit(checkoutPath, args) {
     const result = await runProcess("git", ["-C", checkoutPath, ...args], {
         captureStdout: true,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@iseoane/agent-depot",
-  "version": "0.6.1",
+  "version": "0.6.2",
   "description": "A cross-platform catalog for reusable coding-agent skills.",
   "license": "MIT",
   "author": "iseoane",