@pi-harness/pi-harness 0.1.29 → 0.1.31

package/node_modules/@pi-harness/cli/profiles/default/cordis.yml

@@ -26,97 +26,10 @@
           - bash
           - edit
           - write
-    - id: agent-teams
-      name: "@pi-harness/plugin-agent-teams"
-      config: {}
-    - id: modlens
-      name: "@pi-harness/plugin-modlens"
-      config: {}
-    - id: vision-toolkit
-      name: "@pi-harness/plugin-vision-toolkit"
-      config: {}
-    - id: git-time-capsule
-      name: "@pi-harness/plugin-git-time-capsule"
-      config: {}
-    - id: dependency-checker
-      name: "@pi-harness/plugin-dependency-checker"
-      config: {}
-    - id: at-file
-      name: "@pi-harness/plugin-at-file"
-      config: {}
-    - id: test-harness
-      name: "@pi-harness/plugin-test-harness"
-      config:
-        timeoutMs: 120000
-    - id: session-insights
-      name: "@pi-harness/plugin-session-insights"
-      config: {}
-    - id: readme-gen
-      name: "@pi-harness/plugin-readme-gen"
-      config: {}
-    - id: i18n-pair
-      name: "@pi-harness/plugin-i18n-pair"
-      config: {}
-    - id: cleaner
-      name: "@pi-harness/plugin-cleaner"
-      config: {}
-    - id: sql-lens
-      name: "@pi-harness/plugin-sql-lens"
-      config:
-        timeoutMs: 5000
-    - id: docker-sandbox
-      name: "@pi-harness/plugin-docker-sandbox"
-      config: {}
-    - id: mcp-client
-      name: "@pi-harness/plugin-mcp-client"
-      config: {}
-    - id: browser-fetch
-      name: "@pi-harness/plugin-browser-fetch"
-      config: {}
-    - id: browser-session
-      name: "@pi-harness/plugin-browser-session"
-      config: {}
-    - id: plugin-stars
-      name: "@pi-harness/plugin-plugin-stars"
-      config: {}
-    - id: yaml-validator
-      name: "@pi-harness/plugin-yaml-validator"
-      config: {}
-    - id: plugin-dev
-      name: "@pi-harness/plugin-plugin-dev"
-      config: {}
-    - id: openpets
-      name: "@pi-harness/plugin-openpets"
-      config: {}
-    - id: session-bridge
-      name: "@pi-harness/plugin-session-bridge"
-      config: {}
-    - id: skill-guard
-      name: "@pi-harness/plugin-skill-guard"
-      config: {}
-    - id: recall-unread
-      name: "@pi-harness/plugin-recall-unread"
-      config: {}
-    - id: turn-rewind
-      name: "@pi-harness/plugin-turn-rewind"
-      config: {}
-    - id: context-doctor
-      name: "@pi-harness/plugin-context-doctor"
-      config: {}
     - id: runtime
       name: "@pi-harness/core/plugins/runtime"
       config:
         thinkingLevel: medium
-    - id: context
-      name: "@pi-harness/plugin-context"
-      config: {}
-    - id: token-guard
-      name: "@pi-harness/plugin-token-guard"
-      config:
-        maxPercent: 90
-    - id: fail-logger
-      name: "@pi-harness/plugin-fail-logger"
-      config: {}
     - id: stdio
       name: "@pi-harness/core/plugins/stdio"
       config: {}

package/node_modules/@pi-harness/host-webserver/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/host-webserver",
-  "version": "0.1.29",
+  "version": "0.1.31",
   "private": true,
   "description": "Cordis route-registration service for the Pi Harness web host",
   "homepage": "https://github.com/pi-harness/pi-harness#readme",

package/node_modules/@pi-harness/web-app/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/web-app",
-  "version": "0.1.29",
+  "version": "0.1.31",
   "private": true,
   "description": "Patchable Web application bundle for Pi Harness",
   "homepage": "https://github.com/pi-harness/pi-harness#readme",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/pi-harness",
-  "version": "0.1.29",
+  "version": "0.1.31",
   "homepage": "https://github.com/pi-harness/pi-harness#readme",
   "bugs": {
     "url": "https://github.com/pi-harness/pi-harness/issues"
@@ -34,7 +34,8 @@
     "web": "npm run build:web && node apps/web/server-dist/bin.js",
     "format": "vp fmt . --write",
     "format:check": "vp fmt . --check",
-    "prepack": "npm run build:web",
+    "prepack": "npm run build:web && node scripts/prepare-published-manifest.mjs --strip",
+    "postpack": "node scripts/prepare-published-manifest.mjs --restore",
     "test:package": "node scripts/test-packed-package.mjs",
     "clean": "npm run clean --workspaces --if-present && node -e \"for (const target of ['packages/api-gateway/dist','packages/bundle-web-app/dist','packages/client-web/dist','packages/host-webserver/dist','apps/web/dist','apps/web/server-dist']) require('node:fs').rmSync(target,{recursive:true,force:true})\"",
     "lint": "npm run build && npm run lint:check",
@@ -56,39 +57,11 @@
     "@earendil-works/pi-agent-core": "0.84.4",
     "@earendil-works/pi-ai": "0.84.4",
     "@earendil-works/pi-coding-agent": "0.84.4",
-    "@pi-harness/api-gateway": "0.1.29",
-    "@pi-harness/cli": "0.1.29",
-    "@pi-harness/core": "^0.1.29",
-    "@pi-harness/host-webserver": "0.1.29",
-    "@pi-harness/plugin-agent-teams": "0.1.29",
-    "@pi-harness/plugin-at-file": "0.1.29",
-    "@pi-harness/plugin-browser-fetch": "0.1.29",
-    "@pi-harness/plugin-browser-session": "0.1.29",
-    "@pi-harness/plugin-cleaner": "0.1.29",
-    "@pi-harness/plugin-context": "0.1.29",
-    "@pi-harness/plugin-context-doctor": "0.1.29",
-    "@pi-harness/plugin-dependency-checker": "0.1.29",
-    "@pi-harness/plugin-docker-sandbox": "0.1.29",
-    "@pi-harness/plugin-fail-logger": "0.1.29",
-    "@pi-harness/plugin-git-time-capsule": "0.1.29",
-    "@pi-harness/plugin-i18n-pair": "0.1.29",
-    "@pi-harness/plugin-mcp-client": "0.1.29",
-    "@pi-harness/plugin-modlens": "0.1.29",
-    "@pi-harness/plugin-openpets": "0.1.29",
-    "@pi-harness/plugin-plugin-dev": "0.1.29",
-    "@pi-harness/plugin-plugin-stars": "0.1.29",
-    "@pi-harness/plugin-readme-gen": "0.1.29",
-    "@pi-harness/plugin-recall-unread": "0.1.29",
-    "@pi-harness/plugin-session-bridge": "0.1.29",
-    "@pi-harness/plugin-session-insights": "0.1.29",
-    "@pi-harness/plugin-skill-guard": "0.1.29",
-    "@pi-harness/plugin-sql-lens": "0.1.29",
-    "@pi-harness/plugin-test-harness": "0.1.29",
-    "@pi-harness/plugin-token-guard": "0.1.29",
-    "@pi-harness/plugin-turn-rewind": "0.1.29",
-    "@pi-harness/plugin-vision-toolkit": "0.1.29",
-    "@pi-harness/plugin-yaml-validator": "0.1.29",
-    "@pi-harness/web-app": "0.1.29",
+    "@pi-harness/api-gateway": "0.1.31",
+    "@pi-harness/cli": "0.1.31",
+    "@pi-harness/core": "^0.1.31",
+    "@pi-harness/host-webserver": "0.1.31",
+    "@pi-harness/web-app": "0.1.31",
     "semver": "7.8.5"
   },
   "devDependencies": {

package/packages/api-gateway/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;;;;mBA4sBlC,OAAO;;AAHxB,wBAg4CE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;;;;mBAmuBlC,OAAO;;AAHxB,wBA+4CE"}

package/packages/api-gateway/dist/index.js

@@ -3,10 +3,11 @@ import { mkdir, mkdtemp, readFile, realpath, rename, rm, stat, unlink, writeFile
 import { basename, dirname, isAbsolute, join, posix, relative, resolve, sep } from "node:path";
 import { tmpdir } from "node:os";
 import { SessionManager } from "@earendil-works/pi-coding-agent";
-import { atomicWriteFile } from "@pi-harness/core";
+import { atomicWriteFile, isPiToolRegistryLeasedError } from "@pi-harness/core";
 import { MARKETPLACE_CAPABILITIES, MARKETPLACE_CATEGORIES, MARKETPLACE_PLUGINS, attachMarketplaceStatistics, createMarketplaceStatisticsLoader, paginateMarketplace, searchMarketplace, marketplaceNpmPackageName, sortMarketplaceByRecommendation, } from "./marketplace.js";
 import { parseGitWorktrees } from "./workspaces.js";
 const loadMarketplaceStatistics = createMarketplaceStatisticsLoader();
+const RUNTIME_ENTRY_NAME = "@pi-harness/core/plugins/runtime";
 const DEFAULT_BODY_LIMIT_BYTES = 64 * 1024;
 const IMPORT_CONTENT_LIMIT_BYTES = 10 * 1024 * 1024;
 // The import body carries the JSONL content as a JSON string, so quotes and newlines are escaped; leave headroom above the content limit for that overhead.
@@ -434,15 +435,23 @@ function runProcess(executable, args, cwd) {
         });
     });
 }
-async function appendMarketplaceProfile(configPath, plugin) {
+// A plugin registers its tools before pi-runtime acquires the tool registry, so an installed entry has to sit in the runtime's own group ahead of the runtime. Appended at the end of the profile it would load after the runtime and fail on every subsequent start.
+function marketplaceProfileEntry(plugin, indent) {
+    const child = `${indent}  `;
+    const group = plugin.profile.group === true ? `\n${child}group: true` : "";
+    return `${indent}- id: marketplace-${plugin.id}\n${child}name: ${JSON.stringify(plugin.packageName)}${group}\n${child}config: ${JSON.stringify(plugin.profile.config)}\n`;
+}
+async function appendMarketplaceProfile(configPath, plugin, beforeEntryId) {
     const source = await readFile(configPath, "utf8");
     if (source.includes(`name: ${JSON.stringify(plugin.packageName)}`))
         return source;
-    const entryId = `marketplace-${plugin.id}`;
-    const config = JSON.stringify(plugin.profile.config);
-    const group = plugin.profile.group === true ? "\n  group: true" : "";
-    const entry = `\n- id: ${entryId}\n  name: ${JSON.stringify(plugin.packageName)}${group}\n  config: ${config}\n`;
-    await writeFile(configPath, source.replace(/\s*$/, "") + entry, "utf8");
+    const anchor = beforeEntryId === undefined ? null : source.match(new RegExp(`^([ \\t]*)- id: ${beforeEntryId.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&")}[ \\t]*$`, "mu"));
+    if (anchor === null) {
+        await writeFile(configPath, `${source.replace(/\s*$/u, "")}\n${marketplaceProfileEntry(plugin, "")}`, "utf8");
+        return source;
+    }
+    const start = anchor.index ?? 0;
+    await writeFile(configPath, source.slice(0, start) + marketplaceProfileEntry(plugin, anchor[1] ?? "") + source.slice(start), "utf8");
     return source;
 }
 async function updateMarketplaceProfile(configPath, entryId, update) {
@@ -590,7 +599,7 @@ async function isFile(path) {
         return false;
     }
 }
-// The loader resolves a bare plugin specifier from the profile file upwards (`createRequire(profilePath).resolve(name)`), never from the shell the harness was started in, so a marketplace package has to land in the package that owns the profile or it installs successfully and then fails to load.
+// The loader resolves a bare plugin specifier by walking node_modules from the profile file upwards, never from the shell the harness was started in, so a marketplace package has to land in the package that owns the profile or it installs successfully and then fails to load. Under a built-in profile that package is the harness home, which is why the launcher boots a copy there instead of the read-only one inside its own installation.
 async function marketplaceInstallDirectory(configPath, fallback) {
     let directory = dirname(resolve(configPath));
     let parent = dirname(directory);
@@ -602,6 +611,17 @@ async function marketplaceInstallDirectory(configPath, fallback) {
     }
     return fallback;
 }
+// Where an installed plugin belongs in the running loader: inside the group that owns pi-runtime, immediately ahead of it. A profile without a runtime entry (the stdio CLI profile does have one, a hand-written profile may not) places the entry at the end of the root instead.
+function runtimePlacement(loader) {
+    const entries = [...loader.entries()];
+    const runtime = entries.find((entry) => entry.options.name === RUNTIME_ENTRY_NAME);
+    if (runtime === undefined)
+        return undefined;
+    const group = entries.find((entry) => entry.subgroup === runtime.parent);
+    const position = runtime.parent.data.indexOf(runtime.options);
+    // The loader addresses a nested group by its qualified id (`profile:agent`), while the profile file names the entry by its own id.
+    return { groupEntryId: group?.id ?? null, position: position < 0 ? Infinity : position, beforeEntryId: runtime.options.id };
+}
 function pickDirectory() {
     return new Promise((resolvePath, reject) => {
         execFile("osascript", ["-e", 'POSIX path of (choose folder with prompt "选择 Pi 工作区")'], { timeout: 120_000, maxBuffer: 64 * 1024 }, (error, stdout, stderr) => {
@@ -1057,27 +1077,33 @@ export default {
                     const packageLockPath = join(installDirectory, "package-lock.json");
                     const packageJsonBefore = await readFile(packageJsonPath, "utf8").catch(() => undefined);
                     const packageLockBefore = await readFile(packageLockPath, "utf8").catch(() => undefined);
+                    const placement = runtimePlacement(loader);
                     let profileBefore;
                     let entryId;
                     try {
                         const specifier = `${marketplaceNpmPackageName(plugin.packageName)}@${plugin.version}`;
                         await runProcess("npm", ["install", "--save-exact", "--package-lock=false", specifier], installDirectory);
-                        profileBefore = await appendMarketplaceProfile(configPath, plugin);
+                        profileBefore = await appendMarketplaceProfile(configPath, plugin, placement?.beforeEntryId);
                         entryId = await loader.create({
                             id: `marketplace-${plugin.id}`,
                             name: plugin.packageName,
                             ...(plugin.profile.group === true ? { group: true } : {}),
                             config: plugin.profile.config,
-                        });
+                        }, placement?.groupEntryId ?? null, placement?.position ?? Infinity);
                         const entry = loader.resolve(entryId);
                         if (entry.fiber === undefined)
                             throw new Error(`Plugin ${plugin.packageName} did not create a runtime fiber`);
                         await entry.fiber.await();
-                        sendJson(response, 200, { plugin, installed: true });
+                        sendJson(response, 200, { plugin, installed: true, restartRequired: false });
                     }
                     catch (error) {
                         if (entryId !== undefined)
                             await loader.remove(entryId).catch(() => { });
+                        // The runtime holds the tool registry for its whole life and snapshots the tool set when it takes it, so a plugin that contributes tools cannot join a harness that is already running. The package and its profile entry stay in place and the plugin arrives on the next start; rolling the install back would leave the user unable to install it at all.
+                        if (isPiToolRegistryLeasedError(error)) {
+                            sendJson(response, 200, { plugin, installed: true, restartRequired: true });
+                            return;
+                        }
                         if (profileBefore !== undefined)
                             await writeFile(configPath, profileBefore, "utf8").catch(() => { });
                         // A manifest npm created for this install is removed rather than left behind; restoring is only possible when one existed before.
@@ -1138,9 +1164,14 @@ export default {
                     const before = await updateMarketplaceProfile(configPath, profileEntryId, { disabled: !payload.enabled });
                     try {
                         await entry.update({ disabled: !payload.enabled });
-                        sendJson(response, 200, { plugin: pluginSummary(entry) });
+                        sendJson(response, 200, { plugin: pluginSummary(entry), restartRequired: false });
                     }
                     catch (error) {
+                        // Re-enabling a plugin that contributes tools cannot take effect in a harness the runtime already leased, so the profile keeps the change and the plugin comes back on the next start. Reverting it would leave a plugin that can be switched off but never on again.
+                        if (isPiToolRegistryLeasedError(error)) {
+                            sendJson(response, 200, { plugin: pluginSummary(entry), restartRequired: true });
+                            return;
+                        }
                         await writeFile(configPath, before, "utf8").catch(() => { });
                         sendJson(response, 502, { error: errorText(error) });
                     }