@pi-harness/pi-harness 0.1.22 → 0.1.24

package/packages/api-gateway/test/marketplace-schema.test.ts

@@ -0,0 +1,139 @@
+import { readdirSync, readFileSync } from "node:fs";
+import { join, relative, resolve } from "node:path";
+import { describe, expect, test } from "vitest";
+import { MARKETPLACE_PLUGINS } from "../src/marketplace.js";
+
+const repositoryRoot = resolve(import.meta.dirname, "../../..");
+const schemaPath = resolve(repositoryRoot, "docs/marketplace-entry.schema.json");
+const entriesRoot = resolve(import.meta.dirname, "../src/marketplace-entries");
+
+type Schema = Record<string, unknown>;
+type JsonType = "array" | "boolean" | "integer" | "null" | "number" | "object" | "string";
+
+// The repository has no JSON Schema validator dependency (ajv is only a transitive draft-07 build), so this test interprets exactly the keyword subset the published schema uses. Any keyword outside this set fails loudly instead of being silently ignored, so a schema edit cannot escape the check.
+const supportedKeywords = new Set([
+  "$schema",
+  "title",
+  "description",
+  "type",
+  "required",
+  "additionalProperties",
+  "properties",
+  "pattern",
+  "minLength",
+  "enum",
+  "const",
+  "items",
+  "minItems",
+  "uniqueItems",
+  "minimum",
+  "maximum",
+  "if",
+  "then",
+  "else",
+]);
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+function jsonType(value: unknown): JsonType {
+  if (value === null) return "null";
+  if (Array.isArray(value)) return "array";
+  if (typeof value === "number") return Number.isInteger(value) ? "integer" : "number";
+  return typeof value as JsonType;
+}
+
+function sameJson(left: unknown, right: unknown): boolean {
+  return JSON.stringify(left) === JSON.stringify(right);
+}
+
+function validate(schema: Schema, value: unknown, path = "$"): string[] {
+  for (const keyword of Object.keys(schema)) {
+    if (!supportedKeywords.has(keyword)) throw new Error(`Unsupported schema keyword "${keyword}" at ${path}`);
+  }
+  const errors: string[] = [];
+  if (schema.type !== undefined) {
+    const allowed = (Array.isArray(schema.type) ? schema.type : [schema.type]) as JsonType[];
+    const actual = jsonType(value);
+    if (!allowed.some((type) => type === actual || (type === "number" && actual === "integer")))
+      errors.push(`${path}: expected ${allowed.join("|")}, got ${actual}`);
+  }
+  if (Array.isArray(schema.enum) && !schema.enum.some((candidate) => sameJson(candidate, value)))
+    errors.push(`${path}: not one of ${JSON.stringify(schema.enum)}`);
+  if ("const" in schema && !sameJson(schema.const, value)) errors.push(`${path}: expected ${JSON.stringify(schema.const)}`);
+  if (typeof value === "string") {
+    if (typeof schema.pattern === "string" && !new RegExp(schema.pattern, "u").test(value))
+      errors.push(`${path}: ${JSON.stringify(value)} does not match ${schema.pattern}`);
+    if (typeof schema.minLength === "number" && value.length < schema.minLength) errors.push(`${path}: shorter than ${schema.minLength}`);
+  }
+  if (typeof value === "number") {
+    if (typeof schema.minimum === "number" && value < schema.minimum) errors.push(`${path}: ${value} < ${schema.minimum}`);
+    if (typeof schema.maximum === "number" && value > schema.maximum) errors.push(`${path}: ${value} > ${schema.maximum}`);
+  }
+  if (Array.isArray(value)) {
+    if (typeof schema.minItems === "number" && value.length < schema.minItems) errors.push(`${path}: fewer than ${schema.minItems} items`);
+    if (schema.uniqueItems === true && new Set(value.map((item) => JSON.stringify(item))).size !== value.length) errors.push(`${path}: items are not unique`);
+    if (isRecord(schema.items)) value.forEach((item, index) => errors.push(...validate(schema.items as Schema, item, `${path}[${index}]`)));
+  }
+  if (isRecord(value)) {
+    const properties = isRecord(schema.properties) ? schema.properties : {};
+    if (Array.isArray(schema.required))
+      for (const key of schema.required as string[]) if (!(key in value)) errors.push(`${path}: missing required property "${key}"`);
+    for (const [key, property] of Object.entries(properties)) {
+      if (key in value) errors.push(...validate(property as Schema, value[key], `${path}.${key}`));
+    }
+    if (schema.additionalProperties === false) {
+      for (const key of Object.keys(value)) if (!(key in properties)) errors.push(`${path}: unexpected property "${key}"`);
+    }
+  }
+  if (isRecord(schema.if)) {
+    const branch = validate(schema.if, value, path).length === 0 ? schema.then : schema.else;
+    if (isRecord(branch)) errors.push(...validate(branch, value, path));
+  }
+  return errors;
+}
+
+function entryFiles(directory: string): string[] {
+  return readdirSync(directory, { withFileTypes: true }).flatMap((entry) => {
+    const path = join(directory, entry.name);
+    if (entry.isDirectory()) return entryFiles(path);
+    return entry.isFile() && entry.name.endsWith(".json") ? [path] : [];
+  });
+}
+
+const schema = JSON.parse(readFileSync(schemaPath, "utf8")) as Schema;
+const files = entryFiles(entriesRoot).sort();
+const readEntry = (path: string): Record<string, unknown> => JSON.parse(readFileSync(path, "utf8")) as Record<string, unknown>;
+const validEntry = (): Record<string, unknown> => readEntry(join(entriesRoot, "official", "agent-teams.json"));
+const groupEntry = (): Record<string, unknown> => readEntry(join(entriesRoot, "official", "cordis-group.json"));
+
+describe("marketplace entry schema", () => {
+  test("covers every shipped entry file", () => {
+    expect(files.length).toBe(MARKETPLACE_PLUGINS.length);
+  });
+
+  test.each(files.map((path) => [relative(entriesRoot, path), path] as const))("accepts %s", (_name, path) => {
+    expect(validate(schema, readEntry(path))).toEqual([]);
+  });
+
+  test("accepts core plugin subpaths and group entries with array config", () => {
+    expect(validate(schema, validEntry())).toEqual([]);
+    expect(validate(schema, groupEntry())).toEqual([]);
+    expect(validate(schema, { ...validEntry(), statistics: { downloads30d: 12, quality: 0.5, updatedAt: "2026-01-01T00:00:00.000Z" } })).toEqual([]);
+  });
+
+  test("rejects entries the runtime validator rejects", () => {
+    const withoutCategory = validEntry();
+    delete withoutCategory.category;
+    expect(validate(schema, withoutCategory)).toContain('$: missing required property "category"');
+    expect(validate(schema, { ...validEntry(), category: { id: "Not Kebab", label: "x" } })).not.toEqual([]);
+    expect(validate(schema, { ...validEntry(), category: { id: "collaboration", label: " " } })).not.toEqual([]);
+    expect(validate(schema, { ...validEntry(), packageName: "Not/Valid Name" })).not.toEqual([]);
+    expect(validate(schema, { ...validEntry(), profile: { name: "@pi-harness/core/plugins/agent-teams", config: [] } })).not.toEqual([]);
+    expect(validate(schema, { ...groupEntry(), profile: { name: "@deepseek-ai/cordis-plugin-group", group: true, config: {} } })).not.toEqual([]);
+    expect(validate(schema, { ...validEntry(), capabilities: [] })).not.toEqual([]);
+    expect(validate(schema, { ...validEntry(), repository: "http://example.com" })).not.toEqual([]);
+    expect(validate(schema, { ...validEntry(), unexpected: true })).not.toEqual([]);
+  });
+});

package/packages/api-gateway/test/packed-package.test.ts

@@ -0,0 +1,70 @@
+import { execFile } from "node:child_process";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { resolve } from "node:path";
+import { promisify } from "node:util";
+import { afterEach, describe, expect, it } from "vitest";
+
+const execFileAsync = promisify(execFile);
+const fixtures: string[] = [];
+const repositoryRoot = resolve(import.meta.dirname, "../../..");
+
+// Stands in for npm so the smoke test can be exercised without packing and globally installing the real workspace: `pack` reports tarball names and `install` lays out
+// the tree the script inspects, optionally without the files the root bin map points at.
+const fakeNpmSource = `import { mkdirSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import process from "node:process";
+
+const args = process.argv.slice(2);
+if (args[0] === "pack") {
+  process.stdout.write(args.includes("--workspace") ? "core.tgz\\n" : "harness.tgz\\n");
+  process.exit(0);
+}
+if (args[0] !== "install") process.exit(1);
+const prefix = args[args.indexOf("--prefix") + 1];
+const harnessRoot = join(prefix, "lib", "node_modules", "@pi-harness", "pi-harness");
+const agentRoot = join(harnessRoot, "node_modules", "@earendil-works", "pi-coding-agent");
+const write = (path, content) => {
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, content);
+};
+const bin = { "pi-harness": "./apps/web/server-dist/bin.js", pih: "./packages/cli/dist/bin.js" };
+write(join(harnessRoot, "package.json"), JSON.stringify({ name: "@pi-harness/pi-harness", version: "9.9.9", bin, dependencies: { "@earendil-works/pi-coding-agent": "0.84.4" } }));
+write(join(agentRoot, "package.json"), JSON.stringify({ name: "@earendil-works/pi-coding-agent", version: "0.84.4", dependencies: {} }));
+write(join(agentRoot, "dist", "cli", "args.js"), "");
+if (process.env.PACKED_PACKAGE_FIXTURE_BINS === "1") for (const target of Object.values(bin)) write(join(harnessRoot, target), "");
+`;
+
+const createFakeNpm = async (): Promise<string> => {
+  const fixture = await mkdtemp(resolve(tmpdir(), "pi-harness-packed-package-fixture-"));
+  fixtures.push(fixture);
+  const fakeNpm = resolve(fixture, "npm.mjs");
+  await writeFile(fakeNpm, fakeNpmSource);
+  return fakeNpm;
+};
+
+const runSmokeTest = async (fakeNpm: string, bins: boolean): ReturnType<typeof execFileAsync> =>
+  execFileAsync(process.execPath, [resolve(repositoryRoot, "scripts/test-packed-package.mjs")], {
+    env: { ...process.env, npm_execpath: fakeNpm, PACKED_PACKAGE_FIXTURE_BINS: bins ? "1" : "0" },
+  });
+
+afterEach(async () => {
+  await Promise.all(fixtures.splice(0).map((fixture) => rm(fixture, { recursive: true, force: true })));
+});
+
+describe("packed package smoke test", () => {
+  it("accepts a tarball whose bin entrypoints are present", async () => {
+    const fakeNpm = await createFakeNpm();
+
+    const { stdout } = await runSmokeTest(fakeNpm, true);
+
+    expect(stdout).toContain("Packed package smoke test passed");
+  });
+
+  it("rejects a tarball that ships no runnable bin entrypoint", async () => {
+    // `npm pack --ignore-scripts` never runs prepack, so an unbuilt workspace produces a tarball with a bin map pointing at files the tarball does not contain.
+    const fakeNpm = await createFakeNpm();
+
+    await expect(runSmokeTest(fakeNpm, false)).rejects.toThrow(/missing the pi-harness entrypoint \.\/apps\/web\/server-dist\/bin\.js/u);
+  });
+});

package/packages/api-gateway/test/reference-docs.test.ts

@@ -0,0 +1,50 @@
+import { readdir, readFile } from "node:fs/promises";
+import { resolve } from "node:path";
+import { describe, expect, it } from "vitest";
+
+const repositoryRoot = resolve(import.meta.dirname, "../../..");
+
+const readText = async (path: string): Promise<string> => readFile(resolve(repositoryRoot, path), "utf8");
+
+// The number of built-in plugins that `docs/README.reference.md` still has no `###` section for. It may only ever go down.
+const undocumentedBudget = 53;
+
+describe("reference documentation", () => {
+  it("documents every registered API route", async () => {
+    // The reference is the inventory a reader audits the unauthenticated local port with, so an undocumented route is an invisible attack surface.
+    const gateway = await readText("packages/api-gateway/src/index.ts");
+    const reference = await readText("docs/README.reference.md");
+    const routes = [...gateway.matchAll(/path: "(\/api[^"]*)"/gu)].map((match) => match[1] ?? "");
+
+    expect(routes.length).toBeGreaterThan(0);
+    for (const route of routes) expect(reference, `${route} is not documented`).toContain(`\`${route}\``);
+  });
+
+  it("claims documentation coverage only for the plugins it actually describes", async () => {
+    const readme = await readText("README.md");
+    const reference = await readText("docs/README.reference.md");
+    const sections = new Set([...reference.matchAll(/^### (.+)$/gmu)].map((match) => (match[1] ?? "").toLowerCase().replaceAll(/[^a-z]/gu, "")));
+    const plugins = (await readdir(resolve(repositoryRoot, "packages/core/src/plugins"), { withFileTypes: true }))
+      .filter((entry) => entry.isFile() && entry.name.endsWith(".ts"))
+      .map((entry) => entry.name.replace(/\.ts$/u, "").replaceAll("-", ""));
+    const undocumented = plugins.filter((plugin) => !sections.has(plugin));
+
+    // A ratchet, not a floor: documenting more plugins only lowers the count, while a plugin that arrives without a reference section pushes it over the budget. Lower the budget whenever it drops.
+    expect(undocumented.length, `undocumented built-in plugins: ${undocumented.join(", ")}`).toBeLessThanOrEqual(undocumentedBudget);
+    expect(readme).not.toMatch(/documents every built-in plugin/u);
+    expect(reference).not.toMatch(/canonical reference for the complete plugin catalog/u);
+  });
+
+  it("documents the model the shipped web profile actually selects", async () => {
+    const profile = await readText("apps/web/profile/cordis.yml");
+    const reference = await readText("docs/README.reference.md");
+    const readme = await readText("README.md");
+    const provider = /provider: .*\?\? '([^']+)'/u.exec(profile)?.[1];
+    const model = /model: .*\?\? '([^']+)'/u.exec(profile)?.[1];
+
+    expect(provider).toBeDefined();
+    expect(model).toBeDefined();
+    expect(reference).toContain(`\`${provider ?? ""}/${model ?? ""}\``);
+    for (const variable of ["PI_HARNESS_PROVIDER", "PI_HARNESS_MODEL"]) expect(readme, `${variable} is undocumented`).toContain(variable);
+  });
+});

package/packages/api-gateway/test/release-contract.test.ts

@@ -0,0 +1,77 @@
+import { readdirSync, readFileSync, statSync } from "node:fs";
+import { dirname, join, relative, resolve } from "node:path";
+import { describe, expect, test } from "vitest";
+
+const repositoryRoot = resolve(import.meta.dirname, "../../..");
+
+const readText = (path: string): string => readFileSync(resolve(repositoryRoot, path), "utf8");
+const readJson = (path: string): Record<string, unknown> => JSON.parse(readText(path)) as Record<string, unknown>;
+
+function sourceFiles(directory: string, extension: string): string[] {
+  return readdirSync(directory, { withFileTypes: true }).flatMap((entry) => {
+    const path = join(directory, entry.name);
+    if (entry.isDirectory()) return sourceFiles(path, extension);
+    return entry.isFile() && entry.name.endsWith(extension) ? [path] : [];
+  });
+}
+
+// Reduces a bare module specifier such as "@scope/name/subpath" or "name/subpath" to the npm package that provides it.
+function packageNameOf(specifier: string): string {
+  const segments = specifier.split("/");
+  return specifier.startsWith("@") ? segments.slice(0, 2).join("/") : (segments[0] ?? specifier);
+}
+
+function workspaceNameFor(binTarget: string): string {
+  let directory = dirname(resolve(repositoryRoot, binTarget));
+  while (directory !== repositoryRoot) {
+    const manifest = join(directory, "package.json");
+    if (statSync(manifest, { throwIfNoEntry: false })?.isFile()) return (JSON.parse(readFileSync(manifest, "utf8")) as { name: string }).name;
+    directory = dirname(directory);
+  }
+  throw new Error(`No workspace manifest above ${binTarget}`);
+}
+
+describe("release contract", () => {
+  const workflow = readText(".github/workflows/release.yml");
+
+  test("publish step retries after a failed publish instead of trusting the release tag", () => {
+    // The tag is pushed before npm publish runs, so its existence must never be used as evidence that a package version was submitted.
+    expect(workflow).not.toContain("RELEASE_TAG_EXISTS");
+    expect(workflow).not.toContain("was already submitted");
+    expect(workflow).not.toContain("tag_exists=$tag_exists");
+    expect(workflow).toContain("npm publish --workspace @pi-harness/core --access public");
+    expect(workflow).toContain("npm publish --access public");
+  });
+
+  test("pins every action to a full commit SHA with its release tag recorded", () => {
+    const uses = [...workflow.matchAll(/^\s+uses:\s*(.+)$/gmu)].map((match) => match[1] ?? "");
+    expect(uses.length).toBeGreaterThanOrEqual(2);
+    for (const reference of uses) expect(reference).toMatch(/^[\w.-]+\/[\w.-]+@[0-9a-f]{40} # v\d+\.\d+\.\d+$/u);
+  });
+
+  test("prepack builds every workspace that a root bin points at", () => {
+    const root = readJson("package.json") as { bin: Record<string, string>; scripts: Record<string, string> };
+    expect(root.scripts.prepack).toBe("npm run build:web");
+    const built = [...root.scripts["build:web"]!.matchAll(/npm run build -w (\S+)/gu)].map((match) => match[1]);
+    for (const target of Object.values(root.bin)) expect(built, `${target} is not built by build:web`).toContain(workspaceNameFor(target));
+    expect(built.indexOf("@pi-harness/core")).toBeLessThan(built.indexOf("@pi-harness/cli"));
+  });
+
+  test("core declares every package its sources and shipped profiles load", () => {
+    const core = readJson("packages/core/package.json") as { name: string; dependencies: Record<string, string> };
+    const specifierPattern =
+      /(?:from\s*|import\s*\(\s*|import\.meta\.resolve\(\s*|require(?:\.resolve)?\(\s*)["']([@a-z][^"'\s]*)["']|"(@[a-z0-9._~-]+\/[a-z0-9._~-]+(?:\/[a-z0-9._~-]+)*)"/gu;
+    const required = new Map<string, string>();
+    for (const file of sourceFiles(resolve(repositoryRoot, "packages/core/src"), ".ts")) {
+      for (const match of readFileSync(file, "utf8").matchAll(specifierPattern))
+        required.set(packageNameOf(match[1] ?? match[2] ?? ""), relative(repositoryRoot, file));
+    }
+    for (const file of sourceFiles(resolve(repositoryRoot, "packages/core/profiles"), ".yml")) {
+      for (const match of readFileSync(file, "utf8").matchAll(/^\s*name:\s*"?([^"\s]+)"?\s*$/gmu))
+        required.set(packageNameOf(match[1] ?? ""), relative(repositoryRoot, file));
+    }
+    const external = [...required].filter(([name]) => !name.startsWith("node:") && !name.includes(":") && name !== core.name);
+    expect(external.length).toBeGreaterThan(0);
+    for (const [name, file] of external) expect(core.dependencies[name], `${name} (used by ${file}) is missing from ${core.name} dependencies`).toBeDefined();
+  });
+});

package/packages/api-gateway/test/release-package.test.ts

@@ -1,4 +1,4 @@
-import { readFile } from "node:fs/promises";
+import { readdir, readFile, stat } from "node:fs/promises";
 import { resolve } from "node:path";
 import { describe, expect, it } from "vitest";
 
@@ -33,6 +33,37 @@ describe("release package", () => {
     expect(workflow).toContain("npm publish --workspace @pi-harness/core --access public");
     expect(workflow).toContain("npm publish --access public");
     expect(workflow).toContain("Verify package availability");
-    expect(workflow).toContain("RELEASE_TAG_EXISTS: ${{ steps.release.outputs.tag_exists }}");
+    expect(workflow).not.toContain("RELEASE_TAG_EXISTS");
+  });
+
+  it("cleans every compiled workspace output", async () => {
+    // `tsc` never removes stale emit, so an output directory that no clean script touches keeps publishing files whose sources are gone.
+    const rootManifest = await readJson("package.json");
+    const rootClean = (rootManifest.scripts as Record<string, string>).clean ?? "";
+    const outputs: string[] = [];
+
+    for (const root of ["packages", "apps", "examples"]) {
+      for (const entry of await readdir(resolve(repositoryRoot, root), { withFileTypes: true })) {
+        if (!entry.isDirectory()) continue;
+        const workspace = `${root}/${entry.name}`;
+        const buildConfigPath = resolve(repositoryRoot, workspace, "tsconfig.build.json");
+        const hasBuildConfig = await stat(buildConfigPath).then(
+          () => true,
+          () => false,
+        );
+        if (!hasBuildConfig) continue;
+        const buildConfig = JSON.parse(await readFile(buildConfigPath, "utf8")) as { compilerOptions?: { outDir?: string } };
+        const outDir = buildConfig.compilerOptions?.outDir;
+        expect(outDir, `${workspace}/tsconfig.build.json declares no outDir`).toBeDefined();
+        const workspaceManifest = await readJson(`${workspace}/package.json`);
+        const workspaceClean = (workspaceManifest.scripts as Record<string, string> | undefined)?.clean;
+        outputs.push(`${workspace}/${outDir ?? ""}`);
+        expect(workspaceClean !== undefined || rootClean.includes(`${workspace}/${outDir ?? ""}`), `${workspace}/${outDir ?? ""} survives npm run clean`).toBe(
+          true,
+        );
+      }
+    }
+
+    expect(outputs.length).toBeGreaterThan(0);
   });
 });

package/packages/api-gateway/test/release-version.test.ts

@@ -37,10 +37,9 @@ describe("release version preparation", () => {
         "packages/api-gateway": { name: "@pi-harness/api-gateway", version: "0.1.2" },
       },
     });
-    await writeJson(fixture, "packages/api-gateway/src/marketplace-entries/official/internal.json", {
-      packageName: "@pi-harness/core/plugins/example",
-      version: "0.1.2",
-    });
+    const formattedInternalEntry = `{\n  "packageName": "@pi-harness/core/plugins/example",\n  "version": "0.1.2",\n  "hooks": ["tool", "panel"],\n  "profile": { "config": { "version": "keep-me" } }\n}\n`;
+    await mkdir(resolve(fixture, "packages/api-gateway/src/marketplace-entries/official"), { recursive: true });
+    await writeFile(resolve(fixture, "packages/api-gateway/src/marketplace-entries/official/internal.json"), formattedInternalEntry);
     await writeJson(fixture, "packages/api-gateway/src/marketplace-entries/official/external.json", { packageName: "external-plugin", version: "4.5.6" });
 
     await execFileAsync(process.execPath, [resolve(repositoryRoot, "scripts/set-release-version.mjs"), "0.1.3"], { cwd: fixture });
@@ -72,8 +71,51 @@ describe("release version preparation", () => {
       },
     });
     expect(internalEntry.version).toBe("0.1.3");
+    expect(await readFile(resolve(fixture, "packages/api-gateway/src/marketplace-entries/official/internal.json"), "utf8")).toBe(
+      formattedInternalEntry.replace('"version": "0.1.2"', '"version": "0.1.3"'),
+    );
     expect(externalEntry.version).toBe("4.5.6");
     expect(packedInternalEntry.version).toBe("0.1.3");
     expect(packedExternalEntry.version).toBe("4.5.6");
   });
+
+  it("re-runs against a checkout that already carries the release version", async () => {
+    // A re-dispatched release run checks out the release commit, so every manifest and marketplace entry already holds the requested version.
+    const fixture = await mkdtemp(resolve(tmpdir(), "pi-harness-release-version-"));
+    fixtures.push(fixture);
+    await Promise.all([mkdir(resolve(fixture, "apps")), mkdir(resolve(fixture, "examples"))]);
+    await writeJson(fixture, "package.json", { name: "@pi-harness/pi-harness", version: "0.1.3", dependencies: { "@pi-harness/core": "^0.1.3" } });
+    await writeJson(fixture, "packages/core/package.json", { name: "@pi-harness/core", version: "0.1.3" });
+    await writeJson(fixture, "packages/api-gateway/package.json", { name: "@pi-harness/api-gateway", version: "0.1.3" });
+    await writeJson(fixture, "package-lock.json", {
+      name: "@pi-harness/pi-harness",
+      version: "0.1.3",
+      lockfileVersion: 3,
+      packages: { "": { name: "@pi-harness/pi-harness", version: "0.1.3", dependencies: { "@pi-harness/core": "^0.1.3" } } },
+    });
+    const formattedInternalEntry = `{\n  "packageName": "@pi-harness/core/plugins/example",\n  "version": "0.1.3",\n  "hooks": ["tool", "panel"]\n}\n`;
+    await mkdir(resolve(fixture, "packages/api-gateway/src/marketplace-entries/official"), { recursive: true });
+    await writeFile(resolve(fixture, "packages/api-gateway/src/marketplace-entries/official/internal.json"), formattedInternalEntry);
+
+    await execFileAsync(process.execPath, [resolve(repositoryRoot, "scripts/set-release-version.mjs"), "0.1.3"], { cwd: fixture });
+
+    expect(await readFile(resolve(fixture, "packages/api-gateway/src/marketplace-entries/official/internal.json"), "utf8")).toBe(formattedInternalEntry);
+    expect(await readFile(resolve(fixture, "packages/api-gateway/dist/marketplace-entries/official/internal.json"), "utf8")).toBe(formattedInternalEntry);
+  });
+
+  it("rejects an internal marketplace entry without a top-level version field", async () => {
+    const fixture = await mkdtemp(resolve(tmpdir(), "pi-harness-release-version-"));
+    fixtures.push(fixture);
+    await Promise.all([mkdir(resolve(fixture, "apps")), mkdir(resolve(fixture, "examples"))]);
+    await writeJson(fixture, "package.json", { name: "@pi-harness/pi-harness", version: "0.1.2" });
+    await writeJson(fixture, "packages/core/package.json", { name: "@pi-harness/core", version: "0.1.2" });
+    await writeJson(fixture, "packages/api-gateway/package.json", { name: "@pi-harness/api-gateway", version: "0.1.2" });
+    await writeJson(fixture, "package-lock.json", { name: "@pi-harness/pi-harness", version: "0.1.2", lockfileVersion: 3, packages: {} });
+    await mkdir(resolve(fixture, "packages/api-gateway/src/marketplace-entries/official"), { recursive: true });
+    await writeJson(fixture, "packages/api-gateway/src/marketplace-entries/official/internal.json", { packageName: "@pi-harness/core/plugins/example" });
+
+    await expect(execFileAsync(process.execPath, [resolve(repositoryRoot, "scripts/set-release-version.mjs"), "0.1.3"], { cwd: fixture })).rejects.toThrow(
+      /has no top-level version field to update/u,
+    );
+  });
 });

package/packages/bundle-web-app/dist/index.d.ts

@@ -1,8 +1,11 @@
+import { type PlatformPath } from "node:path";
 import type { Context } from "@deepseek-ai/cordis";
 import "@pi-harness/host-webserver";
 export interface WebAppConfig {
     readonly staticDir?: string;
 }
+type ContainmentPath = Pick<PlatformPath, "isAbsolute" | "relative" | "sep">;
+export declare function isInsideStaticRoot(root: string, candidate: string, pathApi?: ContainmentPath): boolean;
 declare const _default: {
     name: string;
     inject: string[];

package/packages/bundle-web-app/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAEnD,OAAO,4BAA4B,CAAC;AAEpC,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;;;;mBAuCgB,OAAO,UAAU,YAAY;;AAH9C,wBAsBE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAA4C,KAAK,YAAY,EAAE,MAAM,WAAW,CAAC;AAExF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAEnD,OAAO,4BAA4B,CAAC;AAEpC,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAwBD,KAAK,eAAe,GAAG,IAAI,CAAC,YAAY,EAAE,YAAY,GAAG,UAAU,GAAG,KAAK,CAAC,CAAC;AAI7E,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,eAA8B,GAAG,OAAO,CAGpH;;;;mBAwBgB,OAAO,UAAU,YAAY;;AAH9C,wBAuBE"}

package/packages/bundle-web-app/dist/index.js

@@ -1,6 +1,6 @@
 import { createReadStream, existsSync } from "node:fs";
 import { realpath, stat } from "node:fs/promises";
-import { join, resolve } from "node:path";
+import { isAbsolute, join, relative, resolve, sep } from "node:path";
 import { pipeline } from "node:stream/promises";
 import "@pi-harness/host-webserver";
 const MIME_TYPES = {
@@ -8,16 +8,28 @@ const MIME_TYPES = {
     ".html": "text/html; charset=utf-8",
     ".js": "text/javascript; charset=utf-8",
     ".json": "application/json; charset=utf-8",
+    ".png": "image/png",
     ".svg": "image/svg+xml",
+    ".webmanifest": "application/manifest+json",
+};
+// The console renders model- and tool-produced markdown through dangerouslySetInnerHTML, so a CSP is the second line of defence behind the sanitizer: a bypass still cannot load a remote script or exfiltrate to another origin. frame-ancestors keeps any page the operator visits from framing the unauthenticated console, which the Host/Origin guard cannot block because browsers send no Origin on a frame navigation. Inline styles stay allowed because React writes element style attributes; nosniff is safe because every extension the bundle ships has an entry in MIME_TYPES.
+const SECURITY_HEADERS = {
+    "content-security-policy": "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; connect-src 'self'; worker-src 'self' blob:; object-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'",
+    "x-content-type-options": "nosniff",
 };
 function contentType(path) {
     const extension = path.slice(path.lastIndexOf(".")).toLowerCase();
     return MIME_TYPES[extension] ?? "application/octet-stream";
 }
+const platformPath = { isAbsolute, relative, sep };
+// Containment is decided with path.relative instead of a "/"-prefixed string compare so backslash-separated Windows paths and other drives are handled; the pathApi parameter exists so tests can exercise path.win32 on any host.
+export function isInsideStaticRoot(root, candidate, pathApi = platformPath) {
+    const remainder = pathApi.relative(root, candidate);
+    return remainder === "" || (remainder !== ".." && !remainder.startsWith(".." + pathApi.sep) && !pathApi.isAbsolute(remainder));
+}
 function safePath(root, pathname) {
     const candidate = resolve(root, "." + pathname);
-    const rootWithSlash = root.endsWith("/") ? root : root + "/";
-    if (candidate !== root && !candidate.startsWith(rootWithSlash))
+    if (!isInsideStaticRoot(root, candidate))
         return undefined;
     return candidate;
 }
@@ -25,13 +37,12 @@ async function sendFile(path, response) {
     const info = await stat(path);
     if (!info.isFile())
         throw new Error("Not a file");
-    response.writeHead(200, { "content-type": contentType(path), "content-length": info.size, "cache-control": "no-cache" });
+    response.writeHead(200, { "content-type": contentType(path), "content-length": info.size, "cache-control": "no-cache", ...SECURITY_HEADERS });
     await pipeline(createReadStream(path), response);
 }
 async function sendSafeFile(root, path, response) {
     const [rootReal, pathReal] = await Promise.all([realpath(root), realpath(path)]);
-    const rootWithSlash = rootReal.endsWith("/") ? rootReal : rootReal + "/";
-    if (pathReal !== rootReal && !pathReal.startsWith(rootWithSlash))
+    if (!isInsideStaticRoot(rootReal, pathReal))
         throw new Error("Static file escapes web root");
     await sendFile(pathReal, response);
 }
@@ -51,8 +62,10 @@ export default {
                     await sendSafeFile(root, requested, response);
                     return;
                 }
-                catch {
-                    // SPA fallback below.
+                catch (error) {
+                    // SPA fallback below, but only while nothing has reached the wire: once sendFile has written the 200 header the request is committed to that file, so a second writeHead would throw ERR_HTTP_HEADERS_SENT over the real failure.
+                    if (response.headersSent)
+                        throw error;
                 }
             }
             await sendSafeFile(root, index, response);

package/packages/bundle-web-app/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAGhD,OAAO,4BAA4B,CAAC;AAMpC,MAAM,UAAU,GAA2B;IACzC,MAAM,EAAE,yBAAyB;IACjC,OAAO,EAAE,0BAA0B;IACnC,KAAK,EAAE,gCAAgC;IACvC,OAAO,EAAE,iCAAiC;IAC1C,MAAM,EAAE,eAAe;CACxB,CAAC;AAEF,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAClE,OAAO,UAAU,CAAC,SAAS,CAAC,IAAI,0BAA0B,CAAC;AAC7D,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,QAAgB;IAC9C,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,GAAG,GAAG,QAAQ,CAAC,CAAC;IAChD,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC;IAC7D,IAAI,SAAS,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,aAAa,CAAC;QAAE,OAAO,SAAS,CAAC;IACjF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAE,QAAwB;IAC5D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;IAClD,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;IACzH,MAAM,QAAQ,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,IAAY,EAAE,QAAwB;IAC9E,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjF,MAAM,aAAa,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,GAAG,GAAG,CAAC;IACzE,IAAI,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClH,MAAM,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACrC,CAAC;AAED,eAAe;IACb,IAAI,EAAE,YAAY;IAClB,MAAM,EAAE,CAAC,WAAW,CAAC;IACrB,KAAK,CAAC,OAAgB,EAAE,MAAoB;QAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;QACjD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,GAAG,IAAI,CAAC,CAAC;QACpF,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,gBAAgB,CAAC,KAAK,EAAE,OAAwB,EAAE,QAAwB,EAAE,EAAE;YAC9G,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;YAChF,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;YACvC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,IAAI,CAAC;oBACH,MAAM,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;oBAC9C,OAAO;gBACT,CAAC;gBAAC,MAAM,CAAC;oBACP,sBAAsB;gBACxB,CAAC;YACH,CAAC;YACD,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;CACF,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAqB,MAAM,WAAW,CAAC;AACxF,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAGhD,OAAO,4BAA4B,CAAC;AAMpC,MAAM,UAAU,GAA2B;IACzC,MAAM,EAAE,yBAAyB;IACjC,OAAO,EAAE,0BAA0B;IACnC,KAAK,EAAE,gCAAgC;IACvC,OAAO,EAAE,iCAAiC;IAC1C,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,eAAe;IACvB,cAAc,EAAE,2BAA2B;CAC5C,CAAC;AAEF,8jBAA8jB;AAC9jB,MAAM,gBAAgB,GAAG;IACvB,yBAAyB,EACvB,mPAAmP;IACrP,wBAAwB,EAAE,SAAS;CAC3B,CAAC;AAEX,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAClE,OAAO,UAAU,CAAC,SAAS,CAAC,IAAI,0BAA0B,CAAC;AAC7D,CAAC;AAGD,MAAM,YAAY,GAAoB,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;AAEpE,mOAAmO;AACnO,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,SAAiB,EAAE,UAA2B,YAAY;IACzG,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACpD,OAAO,SAAS,KAAK,EAAE,IAAI,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;AACjI,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,QAAgB;IAC9C,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,GAAG,GAAG,QAAQ,CAAC,CAAC;IAChD,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAE,QAAwB;IAC5D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;IAClD,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,GAAG,gBAAgB,EAAE,CAAC,CAAC;IAC9I,MAAM,QAAQ,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,IAAY,EAAE,QAAwB;IAC9E,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjF,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAC7F,MAAM,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACrC,CAAC;AAED,eAAe;IACb,IAAI,EAAE,YAAY;IAClB,MAAM,EAAE,CAAC,WAAW,CAAC;IACrB,KAAK,CAAC,OAAgB,EAAE,MAAoB;QAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;QACjD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,GAAG,IAAI,CAAC,CAAC;QACpF,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,gBAAgB,CAAC,KAAK,EAAE,OAAwB,EAAE,QAAwB,EAAE,EAAE;YAC9G,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;YAChF,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;YACvC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,IAAI,CAAC;oBACH,MAAM,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;oBAC9C,OAAO;gBACT,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,kOAAkO;oBAClO,IAAI,QAAQ,CAAC,WAAW;wBAAE,MAAM,KAAK,CAAC;gBACxC,CAAC;YACH,CAAC;YACD,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;CACF,CAAC"}

package/packages/bundle-web-app/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/web-app",
-  "version": "0.1.22",
+  "version": "0.1.24",
   "private": true,
   "description": "Patchable Web application bundle for Pi Harness",
   "homepage": "https://github.com/pi-harness/pi-harness#readme",