@makerstufferupper/flypi 0.1.3 → 0.1.4

package/src/agent/pi-compat.ts

@@ -0,0 +1,204 @@
+/**
+ * The surface of pi that flypi depends on, and a check that a candidate tree still offers it
+ * (docs/pi-upgrades.md Phase 8.2, risk 14).
+ *
+ * This is a **pre-filter, not a gate**. It catches the dominant breakage class — a renamed or dropped export,
+ * a moved internal file, a raised Node floor — in about a second and without restarting anything. It cannot
+ * see the behavioural half of pi-api.md: pi 1.4.0 kept every export and changed the *shape* of the
+ * `before_agent_start` event, which no `typeof` check can find. Only `npm test` and `npm run smoke` catch
+ * that class, and they are the gate.
+ *
+ * The list is **generated from the source, never maintained by hand**: `tests/scripts/pi-compat.test.ts`
+ * greps every `from "@earendil-works/…"` in `src/ scripts/ tests/ ui/` and fails when the two disagree. A
+ * hand-kept list that drifts reports a clean pass, which is worse than no list.
+ *
+ * Three specifiers, not one (docs/pi-upgrades.md C3): `pi-coding-agent` is the bulk, `pi-mcp` is imported by
+ * the memory smoke script and three tests without being a declared dependency of flypi, and
+ * `pi-ai/providers/faux` is the stub every model-touching test runs on. A probe that checked only
+ * `pi-coding-agent` would report a clean pass while the whole suite was broken.
+ */
+import { existsSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+
+/** One specifier flypi imports from, and what it takes from it. */
+export interface PiImport {
+	/** The bare specifier, exactly as the source writes it. */
+	specifier: string;
+	/** Names with a runtime presence. flypi calls every one of them, so each must stay a function. */
+	values: string[];
+	/** Type-only names: no runtime check is possible, so the entry's `.d.ts` is checked instead. */
+	types: string[];
+}
+
+export interface PiDeepImport {
+	/** The package whose internals flypi reaches into by path. */
+	specifier: string;
+	/** The file inside it, as `src/agent/pi-mcp.ts` joins it onto `getPackageDir()`. */
+	path: string;
+}
+
+/** What flypi imports from pi. Kept honest by `tests/scripts/pi-compat.test.ts`, not by anyone's memory. */
+export const PI_COMPAT: { imports: PiImport[]; deep: PiDeepImport[] } = {
+	imports: [
+		{
+			specifier: "@earendil-works/pi-coding-agent",
+			values: [
+				"createAgentSession",
+				"DefaultResourceLoader",
+				"DefaultPackageManager",
+				"SettingsManager",
+				"SessionManager",
+				"ModelRuntime",
+				"getPackageDir",
+				"createMcpExtension",
+				"createToolSearchExtension",
+			],
+			types: [
+				"AgentSessionEvent",
+				"CreateAgentSessionOptions",
+				"CustomMessageEntry",
+				"ExtensionAPI",
+				"ExtensionContext",
+				"ExtensionFactory",
+				"ExtensionUIContext",
+				"ExtensionUIDialogOptions",
+				"LoadedMcpConfig",
+				"McpExtensionOptions",
+				"McpServerConfig",
+				"McpServerEntry",
+				"SessionEntry",
+			],
+		},
+		{ specifier: "@earendil-works/pi-mcp", values: ["McpClient", "StreamableHttpTransport"], types: [] },
+		{
+			specifier: "@earendil-works/pi-ai/providers/faux",
+			values: ["fauxAssistantMessage", "fauxProvider", "fauxText", "fauxThinking", "fauxToolCall"],
+			types: ["FauxProviderHandle", "FauxResponseStep"],
+		},
+	],
+	// Reached by path because the entry does not export them and its `exports` map hides the types
+	// (src/agent/pi-mcp.ts). A moved internal file breaks flypi while every export still passes.
+	deep: [
+		{ specifier: "@earendil-works/pi-coding-agent", path: "dist/extensions/mcp/runtime.js" },
+		{ specifier: "@earendil-works/pi-coding-agent", path: "dist/core/auth-storage.js" },
+		{ specifier: "@earendil-works/pi-coding-agent", path: "dist/core/resolve-config-value.js" },
+	],
+};
+
+/** `engines.node: ">=22.19.0"` against the Node that would run it. Numeric parts, left to right. */
+function nodeSatisfied(range: string, version: string): boolean {
+	const min = /(\d+)\.(\d+)\.(\d+)/.exec(range);
+	if (!min) return true;
+	const parts = version.split(".").map(Number);
+	for (let i = 1; i <= 3; i++) {
+		const diff = Math.sign((parts[i - 1] ?? 0) - Number(min[i]));
+		if (diff) return diff > 0;
+	}
+	return true;
+}
+
+/** Walk up from a resolved file to the package that owns it — `dist/index.js` is not the package root. */
+function packageRoot(fromFile: string, name: string): string | null {
+	let dir = dirname(fromFile);
+	while (dir !== dirname(dir)) {
+		try {
+			if ((JSON.parse(readFileSync(join(dir, "package.json"), "utf8")) as { name?: string }).name === name) return dir;
+		} catch {
+			/* keep walking */
+		}
+		dir = dirname(dir);
+	}
+	return null;
+}
+
+/**
+ * Resolve specifiers **from inside the candidate tree**. `import.meta.resolve(spec, parentURL)` cannot do
+ * it — Node 24 ignores the parent argument and resolves from the calling module, which would have the probe
+ * check flypi's own pi and report a clean pass for a candidate that is not even there. A module written at
+ * the candidate's root resolves from its own location, which is the tree being probed.
+ */
+async function resolverFor(root: string): Promise<(specifier: string) => string | null> {
+	const helper = join(root, ".flypi-probe-resolver.mjs");
+	writeFileSync(helper, "export const resolveFrom = (specifier) => import.meta.resolve(specifier);\n");
+	let resolveFrom: (specifier: string) => string;
+	try {
+		({ resolveFrom } = await import(pathToFileURL(helper).href));
+	} finally {
+		rmSync(helper, { force: true });
+	}
+	return (specifier) => {
+		try {
+			const url = resolveFrom(specifier);
+			return fileURLToPath(url).startsWith(join(root, "node_modules") + "/") ? url : null;
+		} catch {
+			return null;
+		}
+	};
+}
+
+/**
+ * What a candidate tree is missing — one sentence per problem, empty when it looks usable. A complete tree
+ * resolves its own third-party dependencies, so the probe asks the candidate rather than flypi.
+ */
+export async function checkPiCompat(candidateRoot: string): Promise<string[]> {
+	const failures: string[] = [];
+	let root: string;
+	try {
+		root = realpathSync(candidateRoot);
+	} catch {
+		return [`${candidateRoot} is not a directory — nothing to probe`];
+	}
+	if (!existsSync(join(root, "node_modules", "@earendil-works"))) return [`${candidateRoot} has no @earendil-works in its node_modules — that is not a candidate pi tree`];
+	const resolveFrom = await resolverFor(root);
+
+	for (const entry of PI_COMPAT.imports) {
+		const url = resolveFrom(entry.specifier);
+		if (!url) {
+			failures.push(`${entry.specifier}: does not resolve from inside ${candidateRoot}`);
+			continue;
+		}
+		let mod: Record<string, unknown>;
+		try {
+			// The query busts the ESM module cache: asked twice in one process, the probe has to look at the
+			// tree again rather than at what the first look left loaded.
+			mod = (await import(`${url}?pi-probe=1`)) as Record<string, unknown>;
+		} catch (error) {
+			failures.push(`${entry.specifier}: importing it threw — ${(error as Error).message}`);
+			continue;
+		}
+		for (const name of entry.values) {
+			if (typeof mod[name] !== "function") failures.push(`${entry.specifier}: ${name} is ${typeof mod[name]}, and flypi calls it as a function`);
+		}
+		if (entry.types.length === 0) continue;
+		// The entry's own declaration file: `dist/index.d.ts` for the package entry,
+		// `dist/providers/faux.d.ts` for the subpath. Every type flypi imports is re-exported there by name.
+		const declaration = fileURLToPath(url.replace(/\.js$/, ".d.ts"));
+		if (!existsSync(declaration)) {
+			failures.push(`${entry.specifier}: no ${declaration.slice(declaration.lastIndexOf("/") + 1)} beside the entry, so its type exports cannot be checked`);
+			continue;
+		}
+		const text = readFileSync(declaration, "utf8");
+		for (const name of entry.types) {
+			if (!new RegExp(`\\b${name}\\b`).test(text)) failures.push(`${entry.specifier}: the type ${name} is no longer re-exported from the entry`);
+		}
+	}
+
+	for (const deep of PI_COMPAT.deep) {
+		const url = resolveFrom(deep.specifier);
+		const owner = url ? packageRoot(fileURLToPath(url), deep.specifier) : null;
+		const file = owner ? join(owner, deep.path) : "";
+		if (!url || !owner || !existsSync(file)) failures.push(`${deep.specifier}: ${deep.path} is not there, and flypi imports it by path`);
+	}
+
+	// The Node floor: a candidate that needs a newer Node than the daemon runs on fails at import, which is
+	// the failure that leaves no web UI to click rollback on (docs/risks.md risk 13).
+	const entry = resolveFrom("@earendil-works/pi-coding-agent");
+	if (entry) {
+		const packageJson = join(packageRoot(fileURLToPath(entry), "@earendil-works/pi-coding-agent") ?? "", "package.json");
+		const engines = existsSync(packageJson) ? (JSON.parse(readFileSync(packageJson, "utf8")) as { engines?: { node?: string } }).engines?.node : undefined;
+		if (engines && !nodeSatisfied(engines, process.versions.node)) failures.push(`this pi needs Node ${engines}; this process is ${process.versions.node}`);
+	}
+
+	return failures;
+}

package/src/daemon/index.ts

@@ -11,13 +11,13 @@
  * and so is the run store, which is a file either entrypoint can open in a millisecond. Everything that makes
  * it a *daemon* — the reconciliation, `/healthz`, `daemon.json`, the queue — lives here, and is tested here.
  */
-import { existsSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { existsSync, openSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { spawn } from "node:child_process";
 import { join, resolve } from "node:path";
 import type { DatabaseSync } from "node:sqlite";
 import type { FlypiPaths } from "../agent/paths.ts";
 import { applyConfigEdits, ensureAgentConfig, ensureMemoryEntry, memoryEndpoint } from "../agent/config-files.ts";
-import { applyPackageEdits, checkPackageUpdates, dueForPackageCheck, readPackageCheck, writePackageCheck } from "../agent/packages.ts";
+import { applyPackageEdits, autoExtensions, checkPackageUpdates, dueForPackageCheck, readPackageCheck, writePackageCheck } from "../agent/packages.ts";
 import { CONSOLIDATE_JOB, consolidate, sweepDue } from "../memory/consolidate.ts";
 import { startMemoryServer, type MemoryServerHandle } from "../memory/mcp.ts";
 import type { MemoryStore } from "../memory/store.ts";
@@ -30,6 +30,7 @@ import { startFlypiServer, type FlypiServerHandle, type FlypiServerOptions } fro
 import { SessionRegistry, type CreateSession } from "../server/session-registry.ts";
 import type { RunStore } from "../server/run-store.ts";
 import { JobQueue, startJobLoop, type JobHandler } from "./jobs.ts";
+import { PI_PACKAGE, dueForPiCheck, loadedPi, piTrees, readPiCheck, writePiCheck } from "./pi.ts";
 import { IDLE_BEFORE_INSTALL_MS, checkForUpdate, clearUpdateCheck, downloadUpdate, dueForCheck, installArgs, isGlobalInstall, isNewer, keepDownload, packageDir, packageInfo, readUpdateCheck, stagedUpdate, updateAvailable, writeUpdateCheck } from "./update.ts";
 
 /** What `.flypi/daemon.json` holds: enough for `flypi status` to find a running daemon again. */
@@ -191,6 +192,7 @@ export async function startFlypiDaemon(options: DaemonOptions): Promise<DaemonHa
 				pid: process.pid,
 				startedAt: startedAt,
 				version,
+				pi: loadedPi(paths.root),
 				memoryPort: memory.port,
 				jobs: queue.queued(),
 				...(newer ? { updateAvailable: newer } : {}),
@@ -205,6 +207,42 @@ export async function startFlypiDaemon(options: DaemonOptions): Promise<DaemonHa
 		interruptedRun: (sessionFile) => options.runs.interruptedFor(sessionFile),
 		// The page's "install now": the same path the idle rule takes, without the wait.
 		installUpdate: () => installStaged(),
+		// Which pi this is, what is on disk to move to, and the daily registry answer. No network here: the
+		// stamp is what the page shows (docs/pi-upgrades.md Phase 8.4).
+		piVersions: () => {
+			const pi = loadedPi(paths.root);
+			const stamp = readPiCheck(paths.root);
+			return {
+				running: pi.version,
+				pinned: pi.pinned,
+				...(pi.bundled ? { bundled: pi.bundled } : {}),
+				trees: piTrees(paths.root),
+				...(stamp?.next ? { next: stamp.next } : {}),
+				...(stamp?.latest ? { latest: stamp.latest } : {}),
+				...(stamp ? { checkedAt: stamp.checkedAt } : {}),
+			};
+		},
+		// "Check now": the daily registry answer asked again on request, then read back through the same shape.
+		piCheck: async () => {
+			await checkPiVersions();
+			return serverOptions.piVersions!();
+		},
+		// Move pi and restart, through the same CLI path `flypi pi use` takes — the daemon cannot re-pick the
+		// module graph it already imported, and the child is the process that survives the restart to notice a
+		// failed start and put the pointer back (docs/risks.md risk 13).
+		usePi: async (version: string) => {
+			if (pkg.checkout || !isGlobalInstall()) {
+				return "this flypi is not the npm global package — in a checkout, `npm install @earendil-works/pi-coding-agent@X && npm test && npm run smoke`; in a container, rebuild the image";
+			}
+			const logFile = openSync(resolve(paths.root, ".flypi", "daemon.log"), "a");
+			const child = spawn(process.execPath, ["--import", "tsx", resolve(packageDir(), "scripts", "pi.ts"), "--root", paths.root, "use", version], { cwd: packageDir(), detached: true, stdio: ["ignore", logFile, logFile] });
+			child.on("error", (error) => log(`flypi: the pi switch could not start: ${error.message}`));
+			child.unref();
+			log(`flypi: moving to pi ${version} — the daemon restarts to run it, and goes back on its own if it does not come up`);
+			return null;
+		},
+		// `hello` carries it too, so a client knows what pi it is talking to without a round trip to /healthz.
+		pi: () => loadedPi(paths.root),
 	};
 	let server: FlypiServerHandle;
 	// The same rule as the memory port above, and the reason the pid file is written after the bind rather
@@ -344,12 +382,23 @@ export async function startFlypiDaemon(options: DaemonOptions): Promise<DaemonHa
 		if (check.error) log(`flypi: no extension update check: ${check.error}`);
 		else if (check.updates.length) log(`flypi: ${check.updates.length} extension package(s) have updates — ${check.updates.join(", ")}; they install the next time the daemon is idle`);
 	};
+	// The daily answer about published pi versions. It is only ever *shown*: moving pi restarts the process,
+	// so it never happens unattended (docs/pi-upgrades.md — the thing to recover from is exactly an unattended
+	// version change). The stamp is what the Versions section reads.
+	const checkPiVersions = async () => {
+		const check = await checkForUpdate({ current: loadedPi(paths.root).version, name: PI_PACKAGE });
+		writePiCheck(paths.root, { checkedAt: check.checkedAt, latest: check.latest, next: check.next, ...(check.error ? { error: check.error } : {}) });
+		if (check.next) log(`flypi: pi ${check.next} is available (running ${check.current}) — the Settings tab moves to it; nothing moves by itself`);
+		else if (check.error) log(`flypi: no pi version check: ${check.error}`);
+	};
+
 	const updatePass = (idle: boolean) => {
 		const stamp = readUpdateCheck(paths.root);
 		const pkgStamp = readPackageCheck(paths.root);
 		// A checkout is not an installed package, but the extensions it loads are: only flypi's own ladder is
 		// skipped there.
 		if (!pkg.checkout && dueForCheck(stamp)) void checkUpdates();
+		if (!pkg.checkout && dueForPiCheck(readPiCheck(paths.root))) void checkPiVersions();
 		if (dueForPackageCheck(pkgStamp)) void checkPackages();
 		const staged = pkg.checkout ? null : stagedUpdate(stamp, version);
 		const pending = pkgStamp?.updates ?? [];
@@ -360,12 +409,17 @@ export async function startFlypiDaemon(options: DaemonOptions): Promise<DaemonHa
 		if (!idleSince) idleSince = Date.now();
 		if (Date.now() - idleSince < IDLE_BEFORE_INSTALL_MS) return;
 		// Packages first: they need no restart, and the flypi install below may take this process away.
-		if (pending.length) void updatePackages(pending);
+		// The choice is the user's (`updates.autoExtensions` in settings.json): an unattended extension
+		// update is how an incompatible one arrives.
+		if (pending.length && autoExtensions(paths)) void updatePackages(pending);
 		if (staged && stamp?.download?.file) installPackage(staged, stamp.download.file);
 		// Start the clock again either way: a failed install retries after another idle stretch, not every pass.
 		idleSince = 0;
 	};
-	if (!pkg.checkout) void checkUpdates();
+	if (!pkg.checkout) {
+		void checkUpdates();
+		void checkPiVersions();
+	}
 	if (dueForPackageCheck(readPackageCheck(paths.root))) void checkPackages();
 
 	const handlers: Record<string, JobHandler> = {