@piagent/platform 1.1.6 → 1.1.8

package/scripts/install-global.sh

@@ -15,7 +15,7 @@ Package source examples:
   # Installs the stable tag after resolving it to a commit SHA.
 
   # Pin a specific release:
-  scripts/install-global.sh --version v1.1.6 --resolve-tag
+  scripts/install-global.sh --version v1.1.8 --resolve-tag
 
   # Preview the planned install/update without changing user config:
   scripts/install-global.sh --stable --dry-run
@@ -127,7 +127,7 @@ detect_runtime_surface() {
       printf 'native-windows/%s (not release-gated; terminal helpers require Bash semantics)' "$arch_name"
       ;;
     *)
-      printf '%s/%s (outside v1.1.6 release matrix)' "$os_name" "$arch_name"
+      printf '%s/%s (outside v1.1.8 release matrix)' "$os_name" "$arch_name"
       ;;
   esac
 }
@@ -135,7 +135,7 @@ detect_runtime_surface() {
 warn_runtime_surface_if_needed() {
   local surface="$1"
   case "$surface" in
-    *"supported target"*|*"experimental"*|*"not release-gated"*|*"outside v1.1.6 release matrix"*)
+    *"supported target"*|*"experimental"*|*"not release-gated"*|*"outside v1.1.8 release matrix"*)
       echo "WARN: runtime surface is $surface." >&2
       echo "WARN: For team rollout, run piagent-doctor plus the project smoke/verify suite on this machine before relying on it." >&2
       ;;

package/scripts/profile-doctor.sh

@@ -19,12 +19,22 @@ if [[ ! -f "$PROFILE_PATH" ]]; then
   exit 1
 fi
 
-node --input-type=module - "$PROJECT_PATH" "$PROFILE_PATH" <<'NODE'
+PLATFORM_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+
+node --input-type=module - "$PROJECT_PATH" "$PROFILE_PATH" "$PLATFORM_ROOT" <<'NODE'
 import fs from "node:fs";
 import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+const [projectPath, profilePath, platformRoot] = process.argv.slice(2);
+const stored = JSON.parse(fs.readFileSync(profilePath, "utf8"));
 
-const [projectPath, profilePath] = process.argv.slice(2);
-const profile = JSON.parse(fs.readFileSync(profilePath, "utf8"));
+// A profile that names an adapter is checked as the document that will actually
+// be enforced, not as the few lines the project happens to store.
+const { resolveProjectProfileDocument } = await import(
+  pathToFileURL(path.join(platformRoot, "packages", "piagent-core", "capabilities", "project-profile.js")).href
+);
+const profile = resolveProjectProfileDocument(platformRoot, stored).profile;
 
 const errors = [];
 const warnings = [];

package/scripts/runtime-policy-smoke.sh

@@ -25,11 +25,20 @@ bash "$ROOT/scripts/profile-doctor.sh" "$PROJECT" >/dev/null
 bash "$ROOT/scripts/quality-benchmark.sh" "$PROJECT" --init >/dev/null
 bash "$ROOT/scripts/quality-benchmark.sh" "$PROJECT" --record --scenario smoke --surface pi --result pass --tokens 1 --verify "test -s README.md" >/dev/null
 
-node --input-type=module - "$PROJECT/.pi/piagent-profile.json" "$PROJECT/.pi/benchmarks/quality-runs.jsonl" <<'NODE'
+node --input-type=module - "$PROJECT/.pi/piagent-profile.json" "$PROJECT/.pi/benchmarks/quality-runs.jsonl" "$ROOT" <<'NODE'
 import fs from "node:fs";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
 
-const [profilePath, benchmarkPath] = process.argv.slice(2);
-const profile = JSON.parse(fs.readFileSync(profilePath, "utf8"));
+const [profilePath, benchmarkPath, platformRoot] = process.argv.slice(2);
+const stored = JSON.parse(fs.readFileSync(profilePath, "utf8"));
+
+// A project that names an adapter stores identity and overrides only. The policy
+// the runtime enforces is the resolved document, so that is what gets checked.
+const { resolveProjectProfileDocument } = await import(
+  pathToFileURL(path.join(platformRoot, "packages", "piagent-core", "capabilities", "project-profile.js")).href
+);
+const profile = resolveProjectProfileDocument(platformRoot, stored).profile;
 for (const capability of ["filesystem-readonly", "filesystem-write", "shell", "memory"]) {
   if (!profile.mcpCapabilities.includes(capability)) {
     throw new Error(`missing capability ${capability}`);

package/scripts/team-doctor.sh

@@ -137,7 +137,7 @@ function runtimeMatrixStatus() {
     surface: `${platform}/${arch}`,
     status: "outside-release-matrix",
     teamRolloutReady: false,
-    note: "This runtime is outside the documented v1.1.6 support matrix."
+    note: "This runtime is outside the documented v1.1.8 support matrix."
   };
 }
 
@@ -313,7 +313,12 @@ if (foreignAgentConfig.length > 0) {
 const projectProfilePath = path.join(projectPath, ".pi", "piagent-profile.json");
 let projectProfile = null;
 if (fs.existsSync(projectProfilePath)) {
-  const profile = readJson(projectProfilePath);
+  // Check the document that will be enforced. A profile that names an adapter
+  // stores only its own identity and overrides.
+  const { resolveProjectProfileDocument } = await import(
+    pathToFileURL(path.join(platformRoot, "packages", "piagent-core", "capabilities", "project-profile.js")).href
+  );
+  const profile = resolveProjectProfileDocument(platformRoot, readJson(projectProfilePath)).profile;
   projectProfile = profile;
   for (const field of ["schemaVersion", "projectId", "displayName", "mode"]) {
     if (profile[field] === undefined || profile[field] === "") errors.push(`project profile missing ${field}`);
@@ -333,7 +338,11 @@ if (fs.existsSync(projectProfilePath)) {
       try {
         const lock = readJson(projectLockPath);
         const verification = verifyCapabilityLock(platformRoot, projectProfilePath, lock, { packageSource: projectPackageSource });
-        if (!verification.ok) errors.push("project capability lock is stale or does not match the configured package source");
+        if (verification.status === "blocked") {
+          errors.push(`project capability lock no longer matches what the project agreed to: ${verification.reasons.join("; ")}`);
+        } else if (verification.status === "repin") {
+          warnings.push(`project capability lock is behind the installed platform and will be re-pinned on the next Pi session (${verification.reasons.join("; ")})`);
+        }
       } catch (error) {
         errors.push(`project capability lock validation failed: ${error instanceof Error ? error.message : String(error)}`);
       }