@llblab/pi-telegram 0.51.3 → 0.51.4

package/AGENTS.md

@@ -152,7 +152,7 @@ Before non-trivial work:
 While working:
 
 - Keep changes inside this repository; updating an installed Pi checkout is a separate operator action.
-- Rebuild the package with `npm run build` after edits. Pi loads `dist/pi-telegram/index.js`, so source-only changes are not live and `/reload` or process restart alone will reload stale compiled output.
+- Rebuild the package with `npm run build` after edits. Pi loads `dist/pi-telegram/index.js`, so source-only changes are not live and `/reload` or process restart alone will reload stale compiled output. Keep the committed `dist/` synchronized for Git installs; builds use a temporary candidate and rollback-safe swap, while `npm run build:check` rejects drift without rewriting the tree.
 - Read large artifacts search-first and range-bounded. For `CHANGELOG.md`, inspect only the current release section unless older history is relevant.
 - Keep successful validation output compact; inspect focused failure tails. Prefer focused tests/typecheck during iteration and broad validation at a stable gate.
 - Preserve unrelated work and do not commit, publish, tag, deploy, or perform external actions without explicit authorization.

package/CHANGELOG.md

@@ -4,6 +4,11 @@
 
 ## Unreleased
 
+## 0.51.4: Resolver-owned Skills and drift-safe Git installs
+
+- `Resolver-owned Skills`: Auto-discovered user/project checkouts now contribute source Skills even when Pi selects their compiled entrypoint, while manifest-loaded npm, Git, and Pi Kit packages retain `pi.skills` filters and package provenance. Resolver regressions cover checkout and filtered-package behavior; unsupported source manifest aliases are removed.
+- `Drift-safe distributive`: The compiled runtime and Skill tree are now committed for self-contained Git installs. Builds compile into a temporary candidate and use a rollback-safe swap; validation rejects stale committed output without silently repairing it.
+
 ## 0.51.3: Follower recovery and filterable Skills
 
 - `Follower slot reconciliation`: Re-registration now treats the exact Workspace claim as canonical when a retained follower record carries a different slot. It repairs the record before binding commit, preserves the unrelated binding that owns the stale letter, and makes repeated registration idempotent instead of returning `Telegram Workspace binding claim changed.` forever.

package/README.md

@@ -26,7 +26,7 @@ From git:
 pi install git:github.com/llblab/pi-telegram
 ```
 
-Installed npm/git packages expose bundled Skills through their `pi.skills` manifest, so Pi package filters can select individual Skills. A raw TypeScript checkout placed directly under Pi's `extensions` directory instead contributes its adjacent source Skills at runtime; the two discovery paths are mutually exclusive.
+Installed npm/git packages expose bundled Skills through their `pi.skills` manifest, so Pi package filters and package provenance remain authoritative. A checkout auto-discovered directly under Pi's user or project `extensions` directory contributes its adjacent source Skills even when Pi selects the checkout's compiled entrypoint; the two discovery paths are mutually exclusive.
 
 The extension requires Pi `0.84.4` or newer, matching the package's peer dependencies. Its Activity API uses the public `agent_settled` lifecycle event to keep retries/continuations under one activity identity and release that identity only after the run fully settles.
 
@@ -319,7 +319,7 @@ The docs index lives at [docs/README.md](./docs/README.md).
 
 ## Development
 
-Pi loads the compiled `dist/pi-telegram/index.js` entrypoint. After every project change, run `npm run build` before `/reload`, restart, or live verification; reloading source without rebuilding can leave the running extension on stale compiled code.
+Pi loads the compiled `dist/pi-telegram/index.js` entrypoint. The committed distributive also makes Git installs self-contained. After every project change, run `npm run build` before `/reload`, restart, or live verification; `npm run build:check` verifies source/artifact synchronization without rewriting it.
 
 ```bash
 npm run build

package/dist/lib/skills.d.ts

@@ -4,5 +4,11 @@
  * Owns source-checkout skill contribution; installed packages use their manifest
  */
 import type { ExtensionAPI } from "./pi.ts";
+export declare function getTelegramExtensionPackageRoot(modulePath: string): string;
+export interface TelegramRawExtensionCheckoutOptions {
+    agentDir?: string;
+    cwd?: string;
+}
+export declare function isRawTelegramExtensionCheckout(modulePath: string, options?: TelegramRawExtensionCheckoutOptions): boolean;
 export declare const TELEGRAM_SKILLS_PATH: string;
-export declare function registerTelegramSkillDiscovery(pi: Pick<ExtensionAPI, "on">, modulePath?: string): boolean;
+export declare function registerTelegramSkillDiscovery(pi: Pick<ExtensionAPI, "on">, modulePath?: string, options?: TelegramRawExtensionCheckoutOptions): boolean;

package/dist/lib/skills.js

@@ -3,17 +3,42 @@
  * Zones: pi agent, telegram guidance
  * Owns source-checkout skill contribution; installed packages use their manifest
  */
-import { extname } from "node:path";
+import { existsSync } from "node:fs";
+import { basename, dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
+import { resolveAgentDir } from "./paths.js";
 const TELEGRAM_SKILLS_MODULE_PATH = fileURLToPath(import.meta.url);
-export const TELEGRAM_SKILLS_PATH = fileURLToPath(new URL("../skills", import.meta.url));
-export function registerTelegramSkillDiscovery(pi, modulePath = TELEGRAM_SKILLS_MODULE_PATH) {
-    // A raw source extension has no package manifest owner. Compiled npm/git
-    // packages do, so contributing again would bypass their resource filters.
-    if (extname(modulePath) !== ".ts")
+export function getTelegramExtensionPackageRoot(modulePath) {
+    let current = dirname(modulePath);
+    while (true) {
+        if (existsSync(join(current, "package.json"))) {
+            const parent = dirname(current);
+            if (basename(current) === "dist" && existsSync(join(parent, "package.json"))) {
+                return parent;
+            }
+            return current;
+        }
+        const parent = dirname(current);
+        if (parent === current)
+            return dirname(modulePath);
+        current = parent;
+    }
+}
+export function isRawTelegramExtensionCheckout(modulePath, options = {}) {
+    const packageRoot = resolve(getTelegramExtensionPackageRoot(modulePath));
+    const agentDir = resolve(options.agentDir ?? resolveAgentDir());
+    const cwd = resolve(options.cwd ?? process.cwd());
+    return dirname(packageRoot) === join(agentDir, "extensions") ||
+        dirname(packageRoot) === join(cwd, ".pi", "extensions");
+}
+export const TELEGRAM_SKILLS_PATH = join(getTelegramExtensionPackageRoot(TELEGRAM_SKILLS_MODULE_PATH), "skills");
+export function registerTelegramSkillDiscovery(pi, modulePath = TELEGRAM_SKILLS_MODULE_PATH, options = {}) {
+    // Pi auto-discovers extension entrypoints but not their manifest Skills.
+    // Manifest-loaded packages own Skills and filters through `pi.skills`.
+    if (!isRawTelegramExtensionCheckout(modulePath, options))
         return false;
     pi.on("resources_discover", () => ({
-        skillPaths: [TELEGRAM_SKILLS_PATH],
+        skillPaths: [join(getTelegramExtensionPackageRoot(modulePath), "skills")],
     }));
     return true;
 }

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@llblab/pi-telegram",
-  "version": "0.51.3",
+  "version": "0.51.4",
   "private": false,
   "publishConfig": {
     "access": "public"
@@ -31,12 +31,13 @@
     "test:verbose": "node --experimental-strip-types --test --test-reporter=spec tests/*.test.ts",
     "typecheck": "tsc --noEmit",
     "build": "node scripts/build-dist.mjs",
+    "build:check": "node scripts/build-dist.mjs --check",
     "prepack": "npm run build",
     "check": "node -e \"await import('./dist/pi-telegram/index.js'); console.log('pi-telegram: extension import ok')\"",
     "audit": "npm audit --omit=peer",
     "audit:host": "npm audit",
     "pack:check": "npm pack --dry-run",
-    "validate": "npm run build && npm run typecheck && npm test && npm run audit && npm run check && npm run pack:check"
+    "validate": "npm run build:check && npm run typecheck && npm test && npm run audit && npm run check && npm run pack:check"
   },
   "files": [
     "index.ts",
@@ -102,15 +103,9 @@
     "extensions": [
       "./dist/pi-telegram/index.js"
     ],
-    "sourceExtensions": [
-      "./index.ts"
-    ],
     "skills": [
       "./dist/skills"
     ],
-    "sourceSkills": [
-      "./skills"
-    ],
     "image": "https://raw.githubusercontent.com/llblab/pi-telegram/main/screenshot.png"
   },
   "peerDependencies": {

package/lib/skills.ts

@@ -4,26 +4,62 @@
  * Owns source-checkout skill contribution; installed packages use their manifest
  */
 
-import { extname } from "node:path";
+import { existsSync } from "node:fs";
+import { basename, dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
 import type { ExtensionAPI } from "./pi.ts";
+import { resolveAgentDir } from "./paths.ts";
 
 const TELEGRAM_SKILLS_MODULE_PATH = fileURLToPath(import.meta.url);
 
-export const TELEGRAM_SKILLS_PATH = fileURLToPath(
-  new URL("../skills", import.meta.url),
+export function getTelegramExtensionPackageRoot(modulePath: string): string {
+  let current = dirname(modulePath);
+  while (true) {
+    if (existsSync(join(current, "package.json"))) {
+      const parent = dirname(current);
+      if (basename(current) === "dist" && existsSync(join(parent, "package.json"))) {
+        return parent;
+      }
+      return current;
+    }
+    const parent = dirname(current);
+    if (parent === current) return dirname(modulePath);
+    current = parent;
+  }
+}
+
+export interface TelegramRawExtensionCheckoutOptions {
+  agentDir?: string;
+  cwd?: string;
+}
+
+export function isRawTelegramExtensionCheckout(
+  modulePath: string,
+  options: TelegramRawExtensionCheckoutOptions = {},
+): boolean {
+  const packageRoot = resolve(getTelegramExtensionPackageRoot(modulePath));
+  const agentDir = resolve(options.agentDir ?? resolveAgentDir());
+  const cwd = resolve(options.cwd ?? process.cwd());
+  return dirname(packageRoot) === join(agentDir, "extensions") ||
+    dirname(packageRoot) === join(cwd, ".pi", "extensions");
+}
+
+export const TELEGRAM_SKILLS_PATH = join(
+  getTelegramExtensionPackageRoot(TELEGRAM_SKILLS_MODULE_PATH),
+  "skills",
 );
 
 export function registerTelegramSkillDiscovery(
   pi: Pick<ExtensionAPI, "on">,
   modulePath = TELEGRAM_SKILLS_MODULE_PATH,
+  options: TelegramRawExtensionCheckoutOptions = {},
 ): boolean {
-  // A raw source extension has no package manifest owner. Compiled npm/git
-  // packages do, so contributing again would bypass their resource filters.
-  if (extname(modulePath) !== ".ts") return false;
+  // Pi auto-discovers extension entrypoints but not their manifest Skills.
+  // Manifest-loaded packages own Skills and filters through `pi.skills`.
+  if (!isRawTelegramExtensionCheckout(modulePath, options)) return false;
   pi.on("resources_discover", () => ({
-    skillPaths: [TELEGRAM_SKILLS_PATH],
+    skillPaths: [join(getTelegramExtensionPackageRoot(modulePath), "skills")],
   }));
   return true;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@llblab/pi-telegram",
-  "version": "0.51.3",
+  "version": "0.51.4",
   "private": false,
   "publishConfig": {
     "access": "public"
@@ -31,12 +31,13 @@
     "test:verbose": "node --experimental-strip-types --test --test-reporter=spec tests/*.test.ts",
     "typecheck": "tsc --noEmit",
     "build": "node scripts/build-dist.mjs",
+    "build:check": "node scripts/build-dist.mjs --check",
     "prepack": "npm run build",
     "check": "node -e \"await import('./dist/pi-telegram/index.js'); console.log('pi-telegram: extension import ok')\"",
     "audit": "npm audit --omit=peer",
     "audit:host": "npm audit",
     "pack:check": "npm pack --dry-run",
-    "validate": "npm run build && npm run typecheck && npm test && npm run audit && npm run check && npm run pack:check"
+    "validate": "npm run build:check && npm run typecheck && npm test && npm run audit && npm run check && npm run pack:check"
   },
   "files": [
     "index.ts",
@@ -102,15 +103,9 @@
     "extensions": [
       "./dist/pi-telegram/index.js"
     ],
-    "sourceExtensions": [
-      "./index.ts"
-    ],
     "skills": [
       "./dist/skills"
     ],
-    "sourceSkills": [
-      "./skills"
-    ],
     "image": "https://raw.githubusercontent.com/llblab/pi-telegram/main/screenshot.png"
   },
   "peerDependencies": {

package/scripts/build-dist.mjs

@@ -1,44 +1,115 @@
 #!/usr/bin/env node
 
 /**
- * Builds the distributive JavaScript, declarations, Pi entrypoint, and Skills.
- * Usage: node scripts/build-dist.mjs
- *
- * The build replaces `dist`, compiles with `tsconfig.build.json`, then copies
- * package-owned runtime assets. It does not publish, pack, or modify sources.
+ * Builds or verifies the distributive JavaScript, declarations, Pi entrypoint,
+ * Skills, and runtime assets without exposing a partial tree.
  */
 
 import { spawnSync } from "node:child_process";
-import { cpSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
+import {
+  cpSync,
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  renameSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { join, relative } from "node:path";
+
+const DIST_DIR = "dist";
+const checkOnly = process.argv.includes("--check");
 
 function run(command, args) {
   const result = spawnSync(command, args, { stdio: "inherit" });
   if (result.error) throw result.error;
-  if (result.status !== 0) process.exit(result.status ?? 1);
+  if (result.status !== 0) {
+    throw new Error(`${command} exited with status ${result.status ?? "unknown"}.`);
+  }
+}
+
+function listFiles(root, current = root) {
+  return readdirSync(current, { withFileTypes: true }).flatMap((entry) => {
+    const path = join(current, entry.name);
+    return entry.isDirectory() ? listFiles(root, path) : [relative(root, path)];
+  }).sort();
+}
+
+function normalizeTextFiles(root) {
+  const textSuffixes = [".js", ".ts", ".mjs", ".json", ".md"];
+  for (const path of listFiles(root)) {
+    if (!textSuffixes.some((suffix) => path.endsWith(suffix))) continue;
+    const absolutePath = join(root, path);
+    const source = readFileSync(absolutePath, "utf8");
+    const normalized = source.replace(/\r\n?/g, "\n");
+    if (normalized !== source) writeFileSync(absolutePath, normalized, "utf8");
+  }
+}
+
+function assertTreesEqual(expectedRoot, actualRoot) {
+  if (!existsSync(expectedRoot)) {
+    throw new Error(`${expectedRoot} is missing; run npm run build.`);
+  }
+  const expectedFiles = listFiles(expectedRoot);
+  const actualFiles = listFiles(actualRoot);
+  if (JSON.stringify(expectedFiles) !== JSON.stringify(actualFiles)) {
+    throw new Error("dist file inventory is stale; run npm run build.");
+  }
+  for (const path of expectedFiles) {
+    if (!readFileSync(join(expectedRoot, path)).equals(readFileSync(join(actualRoot, path)))) {
+      throw new Error(`dist/${path} is stale; run npm run build.`);
+    }
+  }
+}
+
+function replaceDist(candidate) {
+  const backup = `.dist-backup-${process.pid}-${Date.now()}`;
+  const hadDist = existsSync(DIST_DIR);
+  if (hadDist) renameSync(DIST_DIR, backup);
+  try {
+    renameSync(candidate, DIST_DIR);
+    if (hadDist) rmSync(backup, { recursive: true, force: true });
+  } catch (error) {
+    if (hadDist && existsSync(backup) && !existsSync(DIST_DIR)) {
+      renameSync(backup, DIST_DIR);
+    }
+    throw error;
+  }
 }
 
-rmSync("dist", { recursive: true, force: true });
-mkdirSync("dist", { recursive: true });
-
-run(process.execPath, [
-  join("node_modules", "typescript", "bin", "tsc"),
-  "-p",
-  "tsconfig.build.json",
-]);
-
-mkdirSync(join("dist", "pi-telegram"), { recursive: true });
-writeFileSync(
-  join("dist", "pi-telegram", "index.js"),
-  'export { default } from "../index.js";\n',
-  "utf8",
-);
-
-cpSync("skills", join("dist", "skills"), { recursive: true });
-cpSync("package.json", join("dist", "package.json"));
-cpSync(
-  join("lib", "generative-app-worker.mjs"),
-  join("dist", "lib", "generative-app-worker.mjs"),
-);
-
-run(process.execPath, ["--check", join("dist", "pi-telegram", "index.js")]);
+const candidate = mkdtempSync(join(process.cwd(), ".dist-build-"));
+try {
+  run(process.execPath, [
+    join("node_modules", "typescript", "bin", "tsc"),
+    "-p",
+    "tsconfig.build.json",
+    "--outDir",
+    candidate,
+  ]);
+
+  mkdirSync(join(candidate, "pi-telegram"), { recursive: true });
+  writeFileSync(
+    join(candidate, "pi-telegram", "index.js"),
+    'export { default } from "../index.js";\n',
+    "utf8",
+  );
+  normalizeTextFiles(candidate);
+  cpSync("skills", join(candidate, "skills"), { recursive: true });
+  cpSync("package.json", join(candidate, "package.json"));
+  cpSync(
+    join("lib", "generative-app-worker.mjs"),
+    join(candidate, "lib", "generative-app-worker.mjs"),
+  );
+  run(process.execPath, ["--check", join(candidate, "pi-telegram", "index.js")]);
+
+  if (checkOnly) {
+    assertTreesEqual(DIST_DIR, candidate);
+    console.log("pi-telegram: dist is current");
+  } else {
+    replaceDist(candidate);
+  }
+} finally {
+  rmSync(candidate, { recursive: true, force: true });
+}