@tryinget/pi-agent-vent 0.1.0

package/scripts/release-check.sh

@@ -0,0 +1,196 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT_DIR"
+
+NAME="$(node -p "JSON.parse(require('node:fs').readFileSync('package.json', 'utf8')).name")"
+VERSION="$(node -p "JSON.parse(require('node:fs').readFileSync('package.json', 'utf8')).version")"
+REPOSITORY_URL="$(node -p "(() => { const pkg = JSON.parse(require('node:fs').readFileSync('package.json', 'utf8')); const repo = pkg.repository; if (typeof repo === 'string') return repo.trim(); if (repo && typeof repo === 'object' && typeof repo.url === 'string') return repo.url.trim(); return ''; })()")"
+
+echo "== release-check: ${NAME}@${VERSION}"
+
+if [[ -z "$REPOSITORY_URL" ]]; then
+  echo "package.json repository.url is required for provenance release publishing." >&2
+  exit 1
+fi
+
+if [[ "$NAME" != "${NAME,,}" ]]; then
+  echo "Invalid npm package name: must be lowercase: $NAME" >&2
+  exit 1
+fi
+
+echo "== npm pack --dry-run --json"
+PACK_JSON="$(npm pack --dry-run --json)"
+echo "$PACK_JSON"
+
+PACK_JSON="$PACK_JSON" node ./scripts/release-artifact-check.mjs
+
+echo "== npm publish --dry-run"
+set +e
+PUBLISH_DRY_RUN_OUTPUT="$(npm publish --dry-run 2>&1)"
+PUBLISH_DRY_RUN_EXIT=$?
+set -e
+echo "$PUBLISH_DRY_RUN_OUTPUT"
+if [[ "$PUBLISH_DRY_RUN_EXIT" -ne 0 ]]; then
+  if grep -qiE "You cannot publish over the previously published versions|previously published version .* is higher than the new version" <<<"$PUBLISH_DRY_RUN_OUTPUT"; then
+    echo "npm publish --dry-run hit registry version guard (${VERSION}); continuing."
+  else
+    echo "npm publish --dry-run failed." >&2
+    exit "$PUBLISH_DRY_RUN_EXIT"
+  fi
+fi
+
+TEST_AGENT_DIR=""
+TEST_NPM_PREFIX=""
+TEST_NPM_CACHE=""
+ARTIFACT_NPM_PREFIX=""
+ARTIFACT_NPM_CACHE=""
+ARTIFACT_TOOL_VENT_DIR=""
+TARBALL_CHECK_DIR=""
+TARBALL_PATH=""
+cleanup() {
+  if [[ "${KEEP_RELEASE_ARTIFACTS:-0}" != "1" ]]; then
+    if [[ -n "$TEST_AGENT_DIR" && -d "$TEST_AGENT_DIR" ]]; then
+      rm -rf "$TEST_AGENT_DIR"
+    fi
+    if [[ -n "$TEST_NPM_PREFIX" && -d "$TEST_NPM_PREFIX" ]]; then
+      rm -rf "$TEST_NPM_PREFIX"
+    fi
+    if [[ -n "$TEST_NPM_CACHE" && -d "$TEST_NPM_CACHE" ]]; then
+      rm -rf "$TEST_NPM_CACHE"
+    fi
+    if [[ -n "$ARTIFACT_NPM_PREFIX" && -d "$ARTIFACT_NPM_PREFIX" ]]; then
+      rm -rf "$ARTIFACT_NPM_PREFIX"
+    fi
+    if [[ -n "$ARTIFACT_NPM_CACHE" && -d "$ARTIFACT_NPM_CACHE" ]]; then
+      rm -rf "$ARTIFACT_NPM_CACHE"
+    fi
+    if [[ -n "$ARTIFACT_TOOL_VENT_DIR" && -d "$ARTIFACT_TOOL_VENT_DIR" ]]; then
+      rm -rf "$ARTIFACT_TOOL_VENT_DIR"
+    fi
+    if [[ -n "$TARBALL_CHECK_DIR" && -d "$TARBALL_CHECK_DIR" ]]; then
+      rm -rf "$TARBALL_CHECK_DIR"
+    fi
+    if [[ -n "$TARBALL_PATH" && -f "$TARBALL_PATH" ]]; then
+      rm -f "$TARBALL_PATH"
+    fi
+  fi
+}
+trap cleanup EXIT
+
+echo "== npm pack"
+TARBALL="$(npm pack --silent | tail -n 1)"
+TARBALL_PATH="$ROOT_DIR/$TARBALL"
+echo "Tarball: $TARBALL_PATH"
+
+TARBALL_CHECK_DIR="$(mktemp -d /tmp/pi-agent-vent-tarball-check-XXXXXX)"
+echo "== unpacked tarball package contract"
+tar -xzf "$TARBALL_PATH" -C "$TARBALL_CHECK_DIR"
+(
+  cd "$TARBALL_CHECK_DIR/package"
+  npm install --ignore-scripts --no-audit --fund=false
+  npm run check
+)
+
+ARTIFACT_NPM_PREFIX="$(mktemp -d /tmp/pi-agent-vent-artifact-npm-prefix-XXXXXX)"
+ARTIFACT_NPM_CACHE="$(mktemp -d /tmp/pi-agent-vent-artifact-npm-cache-XXXXXX)"
+ARTIFACT_TOOL_VENT_DIR="$(mktemp -d /tmp/pi-agent-vent-artifact-tool-store-XXXXXX)"
+ARTIFACT_PACKAGE_ROOT="$(npm --prefix "$ARTIFACT_NPM_PREFIX" root -g)/$NAME"
+
+case "$ARTIFACT_PACKAGE_ROOT" in
+  "$ARTIFACT_NPM_PREFIX"/*) ;;
+  *)
+    echo "Artifact package root escaped isolated npm prefix: $ARTIFACT_PACKAGE_ROOT" >&2
+    exit 1
+    ;;
+esac
+
+echo "== npm installed artifact shadow registered-tool smoke (no Pi auth)"
+npm --prefix "$ARTIFACT_NPM_PREFIX" --cache "$ARTIFACT_NPM_CACHE" \
+  install --global --ignore-scripts --no-audit --fund=false "$TARBALL_PATH"
+node ./scripts/release-smoke-check.mjs assert-installed-artifact \
+  --package-root "$ARTIFACT_PACKAGE_ROOT" \
+  --package-name "$NAME" \
+  --package-version "$VERSION"
+node ./scripts/release-smoke-check.mjs assert-installed-tool-path \
+  --package-root "$ARTIFACT_PACKAGE_ROOT" \
+  --vent-dir "$ARTIFACT_TOOL_VENT_DIR"
+
+if [[ "${SKIP_PI_SMOKE:-0}" == "1" ]]; then
+  echo "Skipping pi smoke tests (SKIP_PI_SMOKE=1)."
+else
+  if ! command -v pi >/dev/null 2>&1; then
+    echo "pi CLI not found in PATH." >&2
+    exit 1
+  fi
+  if [[ ! -f "$HOME/.pi/agent/auth.json" ]]; then
+    echo "Missing $HOME/.pi/agent/auth.json (needed for isolated pi smoke tests)." >&2
+    echo "Tip: set SKIP_PI_SMOKE=1 for artifact-only checks." >&2
+    exit 1
+  fi
+
+  TEST_AGENT_DIR="$(mktemp -d /tmp/pi-extension-release-check-XXXXXX)"
+  TEST_NPM_PREFIX="$(mktemp -d /tmp/pi-extension-release-npm-prefix-XXXXXX)"
+  TEST_NPM_CACHE="$(mktemp -d /tmp/pi-extension-release-npm-cache-XXXXXX)"
+
+  cp "$HOME/.pi/agent/auth.json" "$TEST_AGENT_DIR/auth.json"
+
+  # Allow override via environment variables for different provider configurations
+  PI_TEST_DEFAULT_PROVIDER="${PI_TEST_DEFAULT_PROVIDER:-openai}"
+  PI_TEST_DEFAULT_MODEL="${PI_TEST_DEFAULT_MODEL:-gpt-4o}"
+  PI_TEST_ENABLED_MODELS="${PI_TEST_ENABLED_MODELS:-[\"openai/gpt-4*\"]}"
+
+  cat > "$TEST_AGENT_DIR/settings.json" <<JSON
+{
+  "defaultProvider": "${PI_TEST_DEFAULT_PROVIDER}",
+  "defaultModel": "${PI_TEST_DEFAULT_MODEL}",
+  "enabledModels": ${PI_TEST_ENABLED_MODELS},
+  "npmCommand": ["npm", "--prefix", "${TEST_NPM_PREFIX}", "--cache", "${TEST_NPM_CACHE}"],
+  "extensions": []
+}
+JSON
+
+  echo "== pi install tarball (isolated PI_CODING_AGENT_DIR and npm prefix)"
+  PACKAGE_SPEC="npm:$TARBALL_PATH"
+  NPM_CONFIG_PREFIX="$TEST_NPM_PREFIX" NPM_CONFIG_CACHE="$TEST_NPM_CACHE" \
+    PI_CODING_AGENT_DIR="$TEST_AGENT_DIR" pi install "$PACKAGE_SPEC"
+
+  echo "== verify tarball package recorded in settings"
+  TEST_AGENT_DIR="$TEST_AGENT_DIR" PACKAGE_SPEC="$PACKAGE_SPEC" node <<'NODE'
+const fs = require("node:fs");
+const path = require("node:path");
+const settingsPath = path.join(process.env.TEST_AGENT_DIR, "settings.json");
+const packageSpec = process.env.PACKAGE_SPEC;
+const settings = JSON.parse(fs.readFileSync(settingsPath, "utf8"));
+const packages = Array.isArray(settings.packages) ? settings.packages : [];
+const found = packages.some((entry) => {
+  if (typeof entry === "string") return entry === packageSpec;
+  if (entry && typeof entry === "object") return entry.source === packageSpec;
+  return false;
+});
+if (!found) {
+  console.error(`Could not find ${packageSpec} in settings.packages`);
+  process.exit(1);
+}
+console.log("Tarball package entry present in settings.packages.");
+NODE
+
+  if [[ -x "./scripts/release-smoke.sh" ]]; then
+    echo "== extension-specific smoke checks (scripts/release-smoke.sh)"
+    NPM_CONFIG_PREFIX="$TEST_NPM_PREFIX" NPM_CONFIG_CACHE="$TEST_NPM_CACHE" \
+      PI_CODING_AGENT_DIR="$TEST_AGENT_DIR" PACKAGE_SPEC="$PACKAGE_SPEC" bash ./scripts/release-smoke.sh
+  fi
+fi
+
+echo "== npm view ${NAME} version (pre-publish may be 404)"
+set +e
+npm view "$NAME" version --json --registry https://registry.npmjs.org/
+VIEW_EXIT=$?
+set -e
+echo "npm view exit: $VIEW_EXIT"
+if [[ "$VIEW_EXIT" -ne 0 ]]; then
+  echo "Package likely not published yet (expected for first release)."
+fi
+
+echo "release-check done"

package/scripts/release-smoke-check.mjs

@@ -0,0 +1,367 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+export const readJsonFile = (filePath) => JSON.parse(fs.readFileSync(filePath, "utf8"));
+
+export const packageSourcesFromSettings = (settings) => {
+  const packages = Array.isArray(settings?.packages) ? settings.packages : [];
+  return packages
+    .map((entry) => {
+      if (typeof entry === "string") return entry;
+      if (entry && typeof entry === "object" && typeof entry.source === "string") {
+        return entry.source;
+      }
+      return undefined;
+    })
+    .filter(Boolean);
+};
+
+export const findPackageEntryBySource = (settings, packageSpec) => {
+  const packages = Array.isArray(settings?.packages) ? settings.packages : [];
+  return packages.find((entry) => {
+    if (typeof entry === "string") return entry === packageSpec;
+    return entry && typeof entry === "object" && entry.source === packageSpec;
+  });
+};
+
+export const assertPackageSpecInstalled = ({ settings, packageSpec }) => {
+  if (!packageSpec || typeof packageSpec !== "string") {
+    throw new Error("PACKAGE_SPEC is required for release smoke validation.");
+  }
+
+  const entry = findPackageEntryBySource(settings, packageSpec);
+  if (!entry) {
+    const sources = packageSourcesFromSettings(settings);
+    throw new Error(
+      [
+        `Installed package spec not found in isolated pi settings: ${packageSpec}`,
+        `Found: ${sources.join(", ") || "(none)"}`,
+      ].join("\n"),
+    );
+  }
+
+  if (typeof entry !== "string") {
+    throw new Error(
+      "Release smoke requires an unfiltered package entry; object-form package filters could disable the extension under test.",
+    );
+  }
+};
+
+const normalizePathForOutput = (value) => path.resolve(value).replace(/\\/g, "/");
+const normalizeOutput = (value) => String(value || "").replace(/\\/g, "/");
+
+export const assertInstalledArtifactPackage = ({ packageRoot, packageName, packageVersion }) => {
+  if (!packageRoot || typeof packageRoot !== "string") {
+    throw new Error("packageRoot is required for release smoke validation.");
+  }
+
+  const packageJsonPath = path.join(packageRoot, "package.json");
+  const extensionPath = path.join(packageRoot, "extensions", "agent-vent.ts");
+  if (!fs.existsSync(packageJsonPath)) {
+    throw new Error(`Installed package.json not found: ${packageJsonPath}`);
+  }
+  if (!fs.existsSync(extensionPath)) {
+    throw new Error(`Installed agent_vent extension not found: ${extensionPath}`);
+  }
+
+  const pkg = readJsonFile(packageJsonPath);
+  if (pkg.name !== packageName) {
+    throw new Error(`Installed package name mismatch: expected ${packageName}, got ${pkg.name}`);
+  }
+  if (pkg.version !== packageVersion) {
+    throw new Error(
+      `Installed package version mismatch: expected ${packageVersion}, got ${pkg.version}`,
+    );
+  }
+  const extensions = Array.isArray(pkg.pi?.extensions) ? pkg.pi.extensions : [];
+  if (!extensions.includes("./extensions/agent-vent.ts")) {
+    throw new Error("Installed package pi.extensions does not include ./extensions/agent-vent.ts");
+  }
+
+  return { packageJsonPath, extensionPath };
+};
+
+export const assertLocalTarballInstallSource = ({ packageSpec }) => {
+  if (!packageSpec || typeof packageSpec !== "string") {
+    throw new Error("PACKAGE_SPEC is required for local tarball install-source validation.");
+  }
+  if (!packageSpec.startsWith("npm:")) {
+    throw new Error(`Release smoke expected an npm: tarball install source, got: ${packageSpec}`);
+  }
+
+  const tarballPath = packageSpec.slice("npm:".length);
+  if (!path.isAbsolute(tarballPath) || !tarballPath.endsWith(".tgz")) {
+    throw new Error(
+      `Release smoke expected npm:<absolute .tgz path> as the install source, got: ${packageSpec}`,
+    );
+  }
+
+  return { tarballPath };
+};
+
+export const buildLocalPathArtifactSettings = ({ settings, packageRoot }) => {
+  if (!packageRoot || typeof packageRoot !== "string") {
+    throw new Error("packageRoot is required for release smoke settings preparation.");
+  }
+
+  return {
+    ...settings,
+    packages: [packageRoot],
+    extensions: [],
+  };
+};
+
+export const buildInstalledArtifactSettings = buildLocalPathArtifactSettings;
+
+export const assertAgentVentPathSmokeOutput = ({ output, ventDir }) => {
+  if (!ventDir || typeof ventDir !== "string") {
+    throw new Error("ventDir is required for release smoke validation.");
+  }
+
+  const normalizedOutput = normalizeOutput(output);
+  const normalizedVentDir = normalizePathForOutput(ventDir);
+  const expectedStore = `${normalizedVentDir}/vents.jsonl`;
+  const expectedReview = `${normalizedVentDir}/review-events.jsonl`;
+  const expectedCuration = `${normalizedVentDir}/curation-events.jsonl`;
+  const expectedRetention = `${normalizedVentDir}/retention-events.jsonl`;
+  const expectedBackups = `${normalizedVentDir}/backups`;
+
+  const requiredFragments = [
+    `Agent vent store: ${expectedStore}`,
+    `Agent vent review events: ${expectedReview}`,
+    `Agent vent curation events: ${expectedCuration}`,
+    `Agent vent retention events: ${expectedRetention}`,
+    `Agent vent retention backups: ${expectedBackups}`,
+    "Override: set PI_AGENT_VENT_DIR",
+    "not tasks, issues, incidents, evidence, telemetry, or ASC/self state",
+  ];
+
+  const missing = requiredFragments.filter((fragment) => !normalizedOutput.includes(fragment));
+  if (missing.length) {
+    throw new Error(
+      [
+        "Installed /agent_vent path smoke output did not match the expected local diagnostic contract.",
+        ...missing.map((fragment) => `Missing: ${fragment}`),
+      ].join("\n"),
+    );
+  }
+
+  const defaultStoreFragment = "/.pi/agent/agent-vent/vents.jsonl";
+  if (normalizedOutput.includes(defaultStoreFragment)) {
+    throw new Error(
+      "Installed /agent_vent path smoke used the default operator vent store instead of the isolated PI_AGENT_VENT_DIR.",
+    );
+  }
+};
+
+const activeStoreArtifacts = (ventDir) => [
+  path.join(ventDir, "vents.jsonl"),
+  path.join(ventDir, "review-events.jsonl"),
+  path.join(ventDir, "curation-events.jsonl"),
+  path.join(ventDir, "retention-events.jsonl"),
+  path.join(ventDir, "backups"),
+];
+
+const findNodeModulesAncestor = (startPath) => {
+  let current = path.resolve(startPath);
+  while (current && current !== path.dirname(current)) {
+    if (path.basename(current) === "node_modules") return current;
+    current = path.dirname(current);
+  }
+  return undefined;
+};
+
+const createImportablePackageShadow = (packageRoot) => {
+  const resolvedPackageRoot = path.resolve(packageRoot);
+  const shadowParent = fs.mkdtempSync(path.join(os.tmpdir(), "agent-vent-installed-shadow-"));
+  const shadowRoot = path.join(shadowParent, "package");
+  fs.cpSync(resolvedPackageRoot, shadowRoot, {
+    recursive: true,
+    filter: (sourcePath) => {
+      const relativePath = path.relative(resolvedPackageRoot, sourcePath);
+      return !relativePath.split(path.sep).includes("node_modules");
+    },
+  });
+
+  const packageNodeModules = path.join(packageRoot, "node_modules");
+  const dependencyRoot = fs.existsSync(packageNodeModules)
+    ? packageNodeModules
+    : findNodeModulesAncestor(packageRoot);
+  if (dependencyRoot) {
+    fs.symlinkSync(dependencyRoot, path.join(shadowRoot, "node_modules"), "dir");
+  }
+
+  return { shadowParent, shadowRoot };
+};
+
+export const executeInstalledArtifactToolPathSmoke = async ({ packageRoot, ventDir }) => {
+  if (!packageRoot || typeof packageRoot !== "string") {
+    throw new Error("packageRoot is required for installed tool smoke validation.");
+  }
+  if (!ventDir || typeof ventDir !== "string") {
+    throw new Error("ventDir is required for installed tool smoke validation.");
+  }
+
+  const installedExtensionPath = path.join(packageRoot, "extensions", "agent-vent.ts");
+  if (!fs.existsSync(installedExtensionPath)) {
+    throw new Error(`Installed agent_vent extension not found: ${installedExtensionPath}`);
+  }
+
+  const tools = new Map();
+  const commands = new Map();
+  const shadow = createImportablePackageShadow(packageRoot);
+  try {
+    const extensionPath = path.join(shadow.shadowRoot, "extensions", "agent-vent.ts");
+    const extensionModule = await import(pathToFileURL(extensionPath).href);
+    if (typeof extensionModule.default !== "function") {
+      throw new Error(
+        `Installed agent_vent extension has no default factory: ${installedExtensionPath}`,
+      );
+    }
+
+    extensionModule.default({
+      registerTool(tool) {
+        if (tool?.name) tools.set(tool.name, tool);
+      },
+      registerCommand(name, command) {
+        commands.set(name, command);
+      },
+    });
+  } finally {
+    fs.rmSync(shadow.shadowParent, { recursive: true, force: true });
+  }
+
+  const tool = tools.get("agent_vent");
+  if (!tool || typeof tool.execute !== "function") {
+    throw new Error("Installed agent_vent extension did not register executable agent_vent tool.");
+  }
+
+  const artifacts = activeStoreArtifacts(ventDir);
+  const existingArtifacts = new Set(
+    artifacts.filter((artifactPath) => fs.existsSync(artifactPath)),
+  );
+  const oldVentDir = process.env.PI_AGENT_VENT_DIR;
+  let result;
+  try {
+    process.env.PI_AGENT_VENT_DIR = ventDir;
+    result = await tool.execute(
+      "release-smoke-tool-path",
+      { action: "path" },
+      undefined,
+      undefined,
+      {
+        cwd: packageRoot,
+        sessionManager: { getSessionFile: () => undefined },
+      },
+    );
+  } finally {
+    if (oldVentDir === undefined) delete process.env.PI_AGENT_VENT_DIR;
+    else process.env.PI_AGENT_VENT_DIR = oldVentDir;
+  }
+
+  const output = result?.content?.[0]?.text;
+  if (typeof output !== "string") {
+    throw new Error("Installed agent_vent tool path smoke did not return text content.");
+  }
+
+  assertAgentVentPathSmokeOutput({ output, ventDir });
+
+  const createdArtifacts = artifacts.filter(
+    (artifactPath) => !existingArtifacts.has(artifactPath) && fs.existsSync(artifactPath),
+  );
+  if (createdArtifacts.length) {
+    throw new Error(
+      [
+        "Installed agent_vent tool path smoke created local store artifacts; action=path must stay no-store-read/no-store-write.",
+        ...createdArtifacts.map((artifactPath) => `Created: ${artifactPath}`),
+      ].join("\n"),
+    );
+  }
+
+  return { output, executionMode: "shadow-copy", registeredCommandCount: commands.size };
+};
+
+const readArgValue = (args, name) => {
+  const index = args.indexOf(name);
+  if (index === -1) return undefined;
+  return args[index + 1];
+};
+
+const runCli = async () => {
+  const [command, ...args] = process.argv.slice(2);
+
+  if (command === "assert-settings") {
+    const settingsPath = readArgValue(args, "--settings");
+    const packageSpec = readArgValue(args, "--package-spec");
+    if (!settingsPath) throw new Error("--settings is required");
+    assertPackageSpecInstalled({ settings: readJsonFile(settingsPath), packageSpec });
+    console.log("Isolated pi settings include installed package spec.");
+    return;
+  }
+
+  if (command === "assert-installed-artifact") {
+    const packageRoot = readArgValue(args, "--package-root");
+    const packageName = readArgValue(args, "--package-name");
+    const packageVersion = readArgValue(args, "--package-version");
+    assertInstalledArtifactPackage({ packageRoot, packageName, packageVersion });
+    console.log("Installed package artifact exposes the agent_vent extension entrypoint.");
+    return;
+  }
+
+  if (command === "assert-local-tarball-install-source") {
+    const packageSpec = readArgValue(args, "--package-spec");
+    assertLocalTarballInstallSource({ packageSpec });
+    console.log(
+      "Local npm:<tarball> package spec is validated as an install source; runtime discovery smoke uses the installed local package path.",
+    );
+    return;
+  }
+
+  if (
+    command === "prepare-local-path-artifact-settings" ||
+    command === "prepare-installed-artifact-settings"
+  ) {
+    const settingsPath = readArgValue(args, "--settings");
+    const packageRoot = readArgValue(args, "--package-root");
+    if (!settingsPath) throw new Error("--settings is required");
+    const settings = readJsonFile(settingsPath);
+    const nextSettings = buildLocalPathArtifactSettings({ settings, packageRoot });
+    fs.writeFileSync(settingsPath, `${JSON.stringify(nextSettings, null, 2)}\n`, "utf8");
+    console.log(
+      "Isolated pi settings now load the installed package artifact through local-path package discovery.",
+    );
+    return;
+  }
+
+  if (command === "assert-command-output") {
+    const outputPath = readArgValue(args, "--output");
+    const ventDir = readArgValue(args, "--vent-dir");
+    if (!outputPath) throw new Error("--output is required");
+    assertAgentVentPathSmokeOutput({ output: fs.readFileSync(outputPath, "utf8"), ventDir });
+    console.log("Installed /agent_vent path command smoke output OK.");
+    return;
+  }
+
+  if (command === "assert-installed-tool-path") {
+    const packageRoot = readArgValue(args, "--package-root");
+    const ventDir = readArgValue(args, "--vent-dir");
+    await executeInstalledArtifactToolPathSmoke({ packageRoot, ventDir });
+    console.log("Installed artifact shadow registered-tool path smoke output OK.");
+    return;
+  }
+
+  throw new Error(
+    "Usage: node ./scripts/release-smoke-check.mjs <assert-settings|assert-local-tarball-install-source|assert-installed-artifact|prepare-local-path-artifact-settings|assert-command-output|assert-installed-tool-path> ...",
+  );
+};
+
+if (import.meta.url === `file://${process.argv[1]}`) {
+  try {
+    await runCli();
+  } catch (error) {
+    console.error(error.message);
+    process.exit(1);
+  }
+}

package/scripts/release-smoke.sh

@@ -0,0 +1,90 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT_DIR"
+
+if [[ -z "${PACKAGE_SPEC:-}" ]]; then
+  echo "PACKAGE_SPEC is required; release-check.sh sets it to the packed tarball spec." >&2
+  exit 1
+fi
+
+if [[ -z "${PI_CODING_AGENT_DIR:-}" ]]; then
+  echo "PI_CODING_AGENT_DIR is required so release smoke cannot touch operator pi settings." >&2
+  exit 1
+fi
+
+if ! command -v pi >/dev/null 2>&1; then
+  echo "pi CLI not found in PATH." >&2
+  exit 1
+fi
+
+if [[ ! -f "$PI_CODING_AGENT_DIR/settings.json" ]]; then
+  echo "Isolated pi settings missing: $PI_CODING_AGENT_DIR/settings.json" >&2
+  exit 1
+fi
+
+SMOKE_DIR=""
+cleanup() {
+  if [[ "${KEEP_RELEASE_ARTIFACTS:-0}" != "1" && -n "$SMOKE_DIR" && -d "$SMOKE_DIR" ]]; then
+    rm -rf "$SMOKE_DIR"
+  fi
+}
+trap cleanup EXIT
+
+SMOKE_DIR="$(mktemp -d /tmp/pi-agent-vent-release-smoke-XXXXXX)"
+SMOKE_LOCAL_PATH_VENT_DIR="$SMOKE_DIR/agent-vent-local-path-store"
+SMOKE_TOOL_VENT_DIR="$SMOKE_DIR/agent-vent-tool-store"
+SMOKE_LOCAL_PATH_OUTPUT="$SMOKE_DIR/agent-vent-local-path.out"
+PACKAGE_NAME="$(node -p "JSON.parse(require('node:fs').readFileSync('package.json', 'utf8')).name")"
+PACKAGE_VERSION="$(node -p "JSON.parse(require('node:fs').readFileSync('package.json', 'utf8')).version")"
+if [[ -n "${NPM_CONFIG_PREFIX:-}" ]]; then
+  GLOBAL_NODE_MODULES="$(npm --prefix "$NPM_CONFIG_PREFIX" root -g)"
+else
+  GLOBAL_NODE_MODULES="$(npm root -g)"
+fi
+INSTALLED_PACKAGE_ROOT="$GLOBAL_NODE_MODULES/$PACKAGE_NAME"
+INSTALLED_EXTENSION_PATH="$INSTALLED_PACKAGE_ROOT/extensions/agent-vent.ts"
+
+if [[ -n "${NPM_CONFIG_PREFIX:-}" ]]; then
+  case "$INSTALLED_PACKAGE_ROOT" in
+    "$NPM_CONFIG_PREFIX"/*) ;;
+    *)
+      echo "Installed package root escaped isolated npm prefix: $INSTALLED_PACKAGE_ROOT" >&2
+      exit 1
+      ;;
+  esac
+fi
+
+node ./scripts/release-smoke-check.mjs assert-settings \
+  --settings "$PI_CODING_AGENT_DIR/settings.json" \
+  --package-spec "$PACKAGE_SPEC"
+
+node ./scripts/release-smoke-check.mjs assert-installed-artifact \
+  --package-root "$INSTALLED_PACKAGE_ROOT" \
+  --package-name "$PACKAGE_NAME" \
+  --package-version "$PACKAGE_VERSION"
+
+node ./scripts/release-smoke-check.mjs assert-local-tarball-install-source \
+  --package-spec "$PACKAGE_SPEC"
+
+node ./scripts/release-smoke-check.mjs prepare-local-path-artifact-settings \
+  --settings "$PI_CODING_AGENT_DIR/settings.json" \
+  --package-root "$INSTALLED_PACKAGE_ROOT"
+
+echo "== installed local-path package-discovery /agent_vent command smoke"
+PI_AGENT_VENT_DIR="$SMOKE_LOCAL_PATH_VENT_DIR" \
+  pi --offline --no-session --no-builtin-tools --no-skills --no-prompt-templates --no-context-files --no-themes \
+  -p "/agent_vent path" >"$SMOKE_LOCAL_PATH_OUTPUT" 2>&1
+cat "$SMOKE_LOCAL_PATH_OUTPUT"
+
+node ./scripts/release-smoke-check.mjs assert-command-output \
+  --output "$SMOKE_LOCAL_PATH_OUTPUT" \
+  --vent-dir "$SMOKE_LOCAL_PATH_VENT_DIR"
+
+echo "== installed artifact shadow agent_vent registered-tool path smoke"
+node ./scripts/release-smoke-check.mjs assert-installed-tool-path \
+  --package-root "$INSTALLED_PACKAGE_ROOT" \
+  --vent-dir "$SMOKE_TOOL_VENT_DIR"
+
+echo "release smoke done: local npm:<tarball> install source was validated; installed artifact /agent_vent path command loads through local-path package discovery and agent_vent shadow tool path executes from $INSTALLED_PACKAGE_ROOT."