@pi-harness/pi-harness 0.1.25 → 0.1.27

package/packages/api-gateway/src/marketplace-entries/official/workspace-navigator.json

@@ -1,7 +1,7 @@
 {
   "id": "workspace-navigator",
   "packageName": "@pi-harness/core/plugins/workspace-navigator",
-  "version": "0.1.25",
+  "version": "0.1.27",
   "name": "Workspace Navigator",
   "description": "Show a bounded workspace tree and read-only Git status for a high-signal coding sidebar.",
   "author": "Pi Harness",

package/packages/api-gateway/src/marketplace-entries/official/workspace-search.json

@@ -1,7 +1,7 @@
 {
   "id": "workspace-search",
   "packageName": "@pi-harness/core/plugins/workspace-search",
-  "version": "0.1.25",
+  "version": "0.1.27",
   "name": "Workspace Search",
   "description": "Search bounded text files in the active workspace with ignored directories and binary content excluded.",
   "author": "Pi Harness",

package/packages/api-gateway/src/marketplace-entries/official/yaml-validator.json

@@ -1,7 +1,7 @@
 {
   "id": "yaml-validator",
   "packageName": "@pi-harness/core/plugins/yaml-validator",
-  "version": "0.1.25",
+  "version": "0.1.27",
   "name": "YAML Validator",
   "description": "Validate workspace-contained UTF-8 multi-document YAML through bounded, cancellable reads and line-aware diagnostics.",
   "author": "Pi Harness",

package/packages/api-gateway/test/release-contract.test.ts

@@ -39,7 +39,7 @@ describe("release contract", () => {
     expect(workflow).not.toContain("RELEASE_TAG_EXISTS");
     expect(workflow).not.toContain("was already submitted");
     expect(workflow).not.toContain("tag_exists=$tag_exists");
-    expect(workflow).toContain("npm publish --workspace @pi-harness/core --access public");
+    expect(workflow).toContain('npm publish --workspace "$package_name" --access public');
     expect(workflow).toContain("npm publish --access public");
   });
 
@@ -58,7 +58,7 @@ describe("release contract", () => {
   });
 
   test("core declares every package its sources and shipped profiles load", () => {
-    const core = readJson("packages/core/package.json") as { name: string; dependencies: Record<string, string> };
+    const core = readJson("packages/core/package.json") as { name: string; dependencies: Record<string, string>; peerDependencies: Record<string, string> };
     const specifierPattern =
       /(?:from\s*|import\s*\(\s*|import\.meta\.resolve\(\s*|require(?:\.resolve)?\(\s*)["']([@a-z][^"'\s]*)["']|"(@[a-z0-9._~-]+\/[a-z0-9._~-]+(?:\/[a-z0-9._~-]+)*)"/gu;
     const required = new Map<string, string>();
@@ -72,6 +72,29 @@ describe("release contract", () => {
     }
     const external = [...required].filter(([name]) => !name.startsWith("node:") && !name.includes(":") && name !== core.name);
     expect(external.length).toBeGreaterThan(0);
-    for (const [name, file] of external) expect(core.dependencies[name], `${name} (used by ${file}) is missing from ${core.name} dependencies`).toBeDefined();
+    // A runtime that appears in the published type surface is declared as a peer instead, so the consumer owns the single installed copy.
+    for (const [name, file] of external)
+      expect(
+        core.dependencies[name] ?? core.peerDependencies[name],
+        `${name} (used by ${file}) is declared by neither ${core.name} dependencies nor peerDependencies`,
+      ).toBeDefined();
+  });
+
+  test("the plugin API declares every package its sources import as a peer", () => {
+    // A plugin author installs this package on its own, so anything it imports has to be something the author is told to install alongside it.
+    const pluginApi = readJson("packages/plugin-api/package.json") as {
+      name: string;
+      dependencies?: Record<string, string>;
+      peerDependencies: Record<string, string>;
+    };
+    const required = new Map<string, string>();
+    for (const file of sourceFiles(resolve(repositoryRoot, "packages/plugin-api/src"), ".ts")) {
+      for (const match of readFileSync(file, "utf8").matchAll(/(?:from|declare module)\s*["']([^"'\s]+)["']/gu))
+        required.set(packageNameOf(match[1] ?? ""), relative(repositoryRoot, file));
+    }
+    const external = [...required].filter(([name]) => !name.startsWith("node:") && !name.startsWith("."));
+    expect(external.length).toBeGreaterThan(0);
+    for (const [name, file] of external) expect(pluginApi.peerDependencies[name], `${name} (used by ${file}) is not a peer of ${pluginApi.name}`).toBeDefined();
+    expect(pluginApi.dependencies, `${pluginApi.name} must not pull a second copy of anything a plugin already installs`).toBeUndefined();
   });
 });

package/packages/api-gateway/test/release-package.test.ts

@@ -7,6 +7,8 @@ const bundledWorkspacePaths = ["api-gateway", "cli", "host-webserver", "bundle-w
 const bundledRuntimePackageNames = ["@earendil-works/pi-agent-core", "@earendil-works/pi-ai", "@earendil-works/pi-coding-agent"] as const;
 const bundledWorkspacePackageNames = ["@pi-harness/api-gateway", "@pi-harness/cli", "@pi-harness/host-webserver", "@pi-harness/web-app"] as const;
 const bundledPackageNames = [...bundledRuntimePackageNames, ...bundledWorkspacePackageNames];
+// Runtimes whose types appear in the published surface of @pi-harness/core. npm nests a second copy of a pinned dependency when the consumer wants a different version; a peer resolves to the consumer's single copy instead.
+const corePeerRuntimeNames = ["@deepseek-ai/cordis", "@deepseek-ai/schemastery", "@earendil-works/pi-ai", "@earendil-works/pi-coding-agent"] as const;
 
 const readJson = async (path: string): Promise<Record<string, unknown>> =>
   JSON.parse(await readFile(resolve(repositoryRoot, path), "utf8")) as Record<string, unknown>;
@@ -30,12 +32,51 @@ describe("release package", () => {
     expect(clientManifest.private).toBe(true);
 
     const workflow = await readFile(resolve(repositoryRoot, ".github/workflows/release.yml"), "utf8");
-    expect(workflow).toContain("npm publish --workspace @pi-harness/core --access public");
+    expect(workflow).toContain('npm publish --workspace "$package_name" --access public');
     expect(workflow).toContain("npm publish --access public");
     expect(workflow).toContain("Verify package availability");
     expect(workflow).not.toContain("RELEASE_TAG_EXISTS");
   });
 
+  it("publishes the plugin API as its own package before the packages that depend on it", async () => {
+    const rootManifest = await readJson("package.json");
+    const rootDependencies = rootManifest.dependencies as Record<string, string>;
+    const manifest = await readJson("packages/plugin-api/package.json");
+
+    expect(manifest.name).toBe("@pi-harness/plugin-api");
+    expect(manifest.private, "the plugin API is the package a plugin author installs directly").toBeUndefined();
+    expect(manifest.version).toBe(rootManifest.version);
+    expect(manifest.files).toEqual(["dist", "README.md"]);
+    expect((manifest.publishConfig as Record<string, string>).access).toBe("public");
+
+    // The runtimes are peers here for the same reason they are peers in core: a second copy detaches the Context augmentation.
+    expect(manifest.dependencies, "plugin API runtimes must stay peers so a plugin shares the harness copy").toBeUndefined();
+    const peers = manifest.peerDependencies as Record<string, string>;
+    expect(Object.keys(peers).sort()).toEqual([...corePeerRuntimeNames]);
+    for (const name of corePeerRuntimeNames) expect(peers[name], `${name} peer range must pin the version the launcher installs`).toBe(rootDependencies[name]);
+
+    const core = await readJson("packages/core/package.json");
+    expect((core.dependencies as Record<string, string>)["@pi-harness/plugin-api"]).toBe(rootManifest.version);
+
+    const workflow = await readFile(resolve(repositoryRoot, ".github/workflows/release.yml"), "utf8");
+    expect(workflow).toContain("for workspace in packages/plugin-api packages/core .; do");
+    expect(workflow).toContain("for package_name in @pi-harness/plugin-api @pi-harness/core @pi-harness/pi-harness; do");
+  });
+
+  it("keeps the runtimes in the core type surface as peers so a plugin author resolves one copy", async () => {
+    const rootManifest = await readJson("package.json");
+    const rootDependencies = rootManifest.dependencies as Record<string, string>;
+    const core = await readJson("packages/core/package.json");
+    const coreDependencies = (core.dependencies ?? {}) as Record<string, string>;
+    const corePeers = (core.peerDependencies ?? {}) as Record<string, string>;
+
+    expect(Object.keys(corePeers).sort()).toEqual([...corePeerRuntimeNames]);
+    for (const name of corePeerRuntimeNames) {
+      expect(coreDependencies[name], `${name} must not also be a dependency, which reintroduces the nested copy`).toBeUndefined();
+      expect(corePeers[name], `${name} peer range must pin the version the launcher installs`).toBe(rootDependencies[name]);
+    }
+  });
+
   it("cleans every compiled workspace output", async () => {
     // `tsc` never removes stale emit, so an output directory that no clean script touches keeps publishing files whose sources are gone.
     const rootManifest = await readJson("package.json");

package/packages/bundle-web-app/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/web-app",
-  "version": "0.1.25",
+  "version": "0.1.27",
   "private": true,
   "description": "Patchable Web application bundle for Pi Harness",
   "homepage": "https://github.com/pi-harness/pi-harness#readme",

package/packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/cli",
-  "version": "0.1.25",
+  "version": "0.1.27",
   "private": true,
   "description": "Plugin-first Pi Harness CLI",
   "homepage": "https://github.com/pi-harness/pi-harness#readme",

package/packages/host-webserver/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/host-webserver",
-  "version": "0.1.25",
+  "version": "0.1.27",
   "private": true,
   "description": "Cordis route-registration service for the Pi Harness web host",
   "homepage": "https://github.com/pi-harness/pi-harness#readme",