@yagni-app/code 0.1.0 → 0.2.0

package/dist/extension/tokenProvider.d.ts

@@ -0,0 +1,93 @@
+/**
+ * Refreshing TokenProvider — kills the boot-time token snapshot (spec §4, W4).
+ *
+ * The extension used to capture `YAGNI_TOKEN` once at registration, so a long
+ * session outlived its token and every grounding tool started 401-ing with no
+ * recovery. The provider owns the CURRENT token + expiry instead:
+ *
+ *  - `getToken()` always returns the current token (tools read it per call).
+ *  - A proactive, unref'd timer rotates the token via `POST /auth/refresh`
+ *    when it is within 24h of expiry (the CLI launcher covers the 7-day
+ *    window at spawn; this covers sessions that outlive that).
+ *  - On a tool 401, {@link makeAuthedFetch} asks for ONE refresh and retries
+ *    the request once with the fresh token. ALL refresh calls (proactive and
+ *    401-triggered, from any number of concurrent tools) are serialized behind
+ *    a single in-flight promise, so a burst of 401s costs one rotation.
+ *  - On rotation the provider updates `process.env.YAGNI_TOKEN` (pi re-resolves
+ *    `$YAGNI_TOKEN` per model request — see provider.ts) AND
+ *    `process.env.YAGNI_TOKEN_EXPIRES_AT` (config.ts reads it), and persists
+ *    the rotated token back to the launcher's profile file (`YAGNI_PROFILE_PATH`,
+ *    atomic write, 0600) when set, so the next `yagni` launch reuses it.
+ *
+ * Everything is FAIL-SOFT: a refresh failure leaves the current token in place
+ * (the old token keeps a 5-minute server-side grace after a successful rotation,
+ * so in-flight requests never race the swap).
+ */
+/** How close to expiry (24h) the proactive in-session refresh fires. */
+export declare const PROACTIVE_REFRESH_WINDOW_MS: number;
+/** How long after a failed proactive refresh the timer retries (fail-soft). */
+export declare const REFRESH_RETRY_MS: number;
+/** The rotated-token payload from `POST /api/yagni-code/auth/refresh` (§2). */
+interface RefreshResponse {
+    token: string;
+    expiresAt?: string;
+    workspaceId?: string;
+}
+/** A cancellable timer seam: schedule `fn` after `ms`, return a cancel. */
+export type ScheduleFn = (fn: () => void, ms: number) => () => void;
+/** Injectable seams for {@link makeTokenProvider}. */
+export interface TokenProviderDeps {
+    baseUrl: string;
+    /**
+     * The env object rotations are WRITTEN to (default: process.env). Seeding is
+     * the caller's job (registerYagni resolves the env itself) so the provider
+     * never silently re-reads a different env than the caller intended.
+     */
+    env?: NodeJS.ProcessEnv;
+    /** Seed token (undefined = not authenticated; refresh() is then a no-op). */
+    initialToken?: string;
+    /** Seed ISO expiry (undefined = unknown; the proactive timer stays off). */
+    initialExpiresAt?: string;
+    fetchImpl?: typeof fetch;
+    now?: () => number;
+    /** Timer seam (default: unref'd setTimeout); injected in tests. */
+    schedule?: ScheduleFn;
+    /**
+     * Persist a rotation to the active profile file. Default: atomic 0600 write
+     * to `env.YAGNI_PROFILE_PATH` (merging the existing profile JSON), no-op when
+     * the launcher did not forward a profile path. Always fail-soft.
+     */
+    persistProfile?: (rotation: RefreshResponse) => void;
+}
+/** The live token surface the tools and the model provider read through. */
+export interface TokenProvider {
+    getToken(): string | undefined;
+    getExpiresAt(): string | undefined;
+    /**
+     * Rotate the token via `POST /auth/refresh`. Serialized: concurrent callers
+     * share one in-flight request. Resolves `true` only when a new token was
+     * installed. Never throws (fail-soft).
+     */
+    refresh(): Promise<boolean>;
+    /** Cancel the proactive timer (test hygiene; the default timer is unref'd). */
+    dispose(): void;
+}
+/**
+ * Atomic profile write: merge the rotation into the existing profile JSON,
+ * write a fresh 0600 temp file in the same directory, then rename over the
+ * original (rename is atomic on the same filesystem). Mirrors the launcher's
+ * profiles.ts format (2-space indent + trailing newline). Fail-soft.
+ */
+export declare function persistRotationToProfile(profilePath: string, rotation: RefreshResponse): void;
+export declare function makeTokenProvider(deps: TokenProviderDeps): TokenProvider;
+/**
+ * The ONE 401 seam for every authed fetch: wrap the base fetch so a 401
+ * triggers a single serialized refresh and, when the token actually rotated,
+ * ONE retry with a fresh `authorization` header. Non-401 responses and
+ * failed refreshes pass through untouched; a body that cannot be replayed
+ * (anything but a string/undefined) is never retried. The wrapper adds no
+ * retry loops of its own — resilientFetch above it still owns transient retry.
+ */
+export declare function makeAuthedFetch(provider: TokenProvider, baseFetch?: typeof fetch): typeof fetch;
+export {};
+//# sourceMappingURL=tokenProvider.d.ts.map

package/dist/extension/tokenProvider.js

@@ -0,0 +1,234 @@
+/**
+ * Refreshing TokenProvider — kills the boot-time token snapshot (spec §4, W4).
+ *
+ * The extension used to capture `YAGNI_TOKEN` once at registration, so a long
+ * session outlived its token and every grounding tool started 401-ing with no
+ * recovery. The provider owns the CURRENT token + expiry instead:
+ *
+ *  - `getToken()` always returns the current token (tools read it per call).
+ *  - A proactive, unref'd timer rotates the token via `POST /auth/refresh`
+ *    when it is within 24h of expiry (the CLI launcher covers the 7-day
+ *    window at spawn; this covers sessions that outlive that).
+ *  - On a tool 401, {@link makeAuthedFetch} asks for ONE refresh and retries
+ *    the request once with the fresh token. ALL refresh calls (proactive and
+ *    401-triggered, from any number of concurrent tools) are serialized behind
+ *    a single in-flight promise, so a burst of 401s costs one rotation.
+ *  - On rotation the provider updates `process.env.YAGNI_TOKEN` (pi re-resolves
+ *    `$YAGNI_TOKEN` per model request — see provider.ts) AND
+ *    `process.env.YAGNI_TOKEN_EXPIRES_AT` (config.ts reads it), and persists
+ *    the rotated token back to the launcher's profile file (`YAGNI_PROFILE_PATH`,
+ *    atomic write, 0600) when set, so the next `yagni` launch reuses it.
+ *
+ * Everything is FAIL-SOFT: a refresh failure leaves the current token in place
+ * (the old token keeps a 5-minute server-side grace after a successful rotation,
+ * so in-flight requests never race the swap).
+ */
+import { chmodSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+/** How close to expiry (24h) the proactive in-session refresh fires. */
+export const PROACTIVE_REFRESH_WINDOW_MS = 24 * 60 * 60 * 1000;
+/** How long after a failed proactive refresh the timer retries (fail-soft). */
+export const REFRESH_RETRY_MS = 60 * 60 * 1000;
+/** Per-request wall-clock cap so a hung refresh never stalls a 401 retry. */
+const REFRESH_REQUEST_TIMEOUT_MS = 10_000;
+/** setTimeout overflows past 2^31-1 ms; clamp long delays and re-arm on fire. */
+const MAX_TIMER_MS = 2 ** 31 - 1;
+const defaultSchedule = (fn, ms) => {
+    const t = setTimeout(fn, ms);
+    // Never keep the process alive for a background refresh.
+    t.unref?.();
+    return () => clearTimeout(t);
+};
+/**
+ * Atomic profile write: merge the rotation into the existing profile JSON,
+ * write a fresh 0600 temp file in the same directory, then rename over the
+ * original (rename is atomic on the same filesystem). Mirrors the launcher's
+ * profiles.ts format (2-space indent + trailing newline). Fail-soft.
+ */
+export function persistRotationToProfile(profilePath, rotation) {
+    try {
+        let existing = {};
+        try {
+            const parsed = JSON.parse(readFileSync(profilePath, "utf8"));
+            if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+                existing = parsed;
+            }
+        }
+        catch {
+            /* missing/corrupt profile — still persist the rotation fields */
+        }
+        const next = {
+            ...existing,
+            token: rotation.token,
+            ...(rotation.expiresAt ? { expiresAt: rotation.expiresAt } : {}),
+            ...(rotation.workspaceId ? { workspaceId: rotation.workspaceId } : {}),
+        };
+        mkdirSync(dirname(profilePath), { recursive: true, mode: 0o700 });
+        const tmp = join(dirname(profilePath), `.${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.tmp`);
+        writeFileSync(tmp, `${JSON.stringify(next, null, 2)}\n`, { mode: 0o600 });
+        // writeFile honors mode only on create; the tmp file IS a create, but be
+        // explicit so a umask can never widen a token-bearing file.
+        chmodSync(tmp, 0o600);
+        renameSync(tmp, profilePath);
+    }
+    catch {
+        /* fail-soft: a failed persist never breaks the session (memory + env win) */
+    }
+}
+export function makeTokenProvider(deps) {
+    const env = deps.env ?? process.env;
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    const now = deps.now ?? (() => Date.now());
+    const schedule = deps.schedule ?? defaultSchedule;
+    const persistProfile = deps.persistProfile ??
+        ((rotation) => {
+            const profilePath = env.YAGNI_PROFILE_PATH?.trim();
+            if (profilePath)
+                persistRotationToProfile(profilePath, rotation);
+        });
+    let token = deps.initialToken;
+    let expiresAt = deps.initialExpiresAt;
+    let cancelTimer = null;
+    let inFlight = null;
+    function parsedExpiryMs() {
+        if (!expiresAt)
+            return null;
+        const ms = Date.parse(expiresAt);
+        return Number.isNaN(ms) ? null : ms;
+    }
+    /** (Re)arm the proactive timer from the current expiry. Unknown expiry → off. */
+    function armProactiveTimer() {
+        cancelTimer?.();
+        cancelTimer = null;
+        const expiryMs = parsedExpiryMs();
+        if (expiryMs === null)
+            return;
+        if (expiryMs <= now())
+            return; // already expired: refresh would 401 forever
+        const untilWindow = expiryMs - now() - PROACTIVE_REFRESH_WINDOW_MS;
+        const delay = Math.min(Math.max(untilWindow, 0), MAX_TIMER_MS);
+        cancelTimer = schedule(() => {
+            cancelTimer = null;
+            // A clamped long delay fired early: not in the window yet, just re-arm.
+            const nowExpiryMs = parsedExpiryMs();
+            if (nowExpiryMs !== null && nowExpiryMs - now() > PROACTIVE_REFRESH_WINDOW_MS) {
+                armProactiveTimer();
+                return;
+            }
+            void refresh().then((rotated) => {
+                // Success re-arms from the new expiry inside applyRotation; a failure
+                // retries later (fail-soft) as long as the token is not yet expired.
+                if (!rotated && cancelTimer === null) {
+                    const expiry = parsedExpiryMs();
+                    if (expiry !== null && expiry > now()) {
+                        cancelTimer = schedule(() => {
+                            cancelTimer = null;
+                            void refresh();
+                        }, Math.min(REFRESH_RETRY_MS, MAX_TIMER_MS));
+                    }
+                }
+            });
+        }, delay);
+    }
+    function applyRotation(rotation) {
+        token = rotation.token;
+        if (rotation.expiresAt)
+            expiresAt = rotation.expiresAt;
+        // pi re-resolves $YAGNI_TOKEN per model request; config helpers read the
+        // expiry env. Both must see the rotation immediately.
+        env.YAGNI_TOKEN = rotation.token;
+        if (rotation.expiresAt)
+            env.YAGNI_TOKEN_EXPIRES_AT = rotation.expiresAt;
+        try {
+            persistProfile(rotation);
+        }
+        catch {
+            /* fail-soft */
+        }
+        armProactiveTimer();
+    }
+    async function doRefresh() {
+        const current = token;
+        if (!current)
+            return false;
+        try {
+            const res = await fetchImpl(`${deps.baseUrl}/api/yagni-code/auth/refresh`, {
+                method: "POST",
+                headers: {
+                    "content-type": "application/json",
+                    authorization: `Bearer ${current}`,
+                },
+                body: "{}",
+                signal: AbortSignal.timeout(REFRESH_REQUEST_TIMEOUT_MS),
+            });
+            if (!res.ok)
+                return false;
+            const data = (await res.json());
+            if (!data || typeof data.token !== "string" || data.token.length === 0)
+                return false;
+            applyRotation({
+                token: data.token,
+                expiresAt: typeof data.expiresAt === "string" ? data.expiresAt : undefined,
+                workspaceId: typeof data.workspaceId === "string" ? data.workspaceId : undefined,
+            });
+            return true;
+        }
+        catch {
+            return false; // network/timeout: keep the current token (fail-soft)
+        }
+    }
+    function refresh() {
+        // Single-flight: a proactive tick and N simultaneous 401 handlers share
+        // one POST, so the backend never sees a refresh stampede and the 5-minute
+        // grace window on the old token stays meaningful.
+        if (!inFlight) {
+            inFlight = doRefresh().finally(() => {
+                inFlight = null;
+            });
+        }
+        return inFlight;
+    }
+    armProactiveTimer();
+    return {
+        getToken: () => token,
+        getExpiresAt: () => expiresAt,
+        refresh,
+        dispose: () => {
+            cancelTimer?.();
+            cancelTimer = null;
+        },
+    };
+}
+/**
+ * The ONE 401 seam for every authed fetch: wrap the base fetch so a 401
+ * triggers a single serialized refresh and, when the token actually rotated,
+ * ONE retry with a fresh `authorization` header. Non-401 responses and
+ * failed refreshes pass through untouched; a body that cannot be replayed
+ * (anything but a string/undefined) is never retried. The wrapper adds no
+ * retry loops of its own — resilientFetch above it still owns transient retry.
+ */
+export function makeAuthedFetch(provider, baseFetch) {
+    const underlying = baseFetch ?? fetch;
+    const wrapped = async (input, init) => {
+        const res = await underlying(input, init);
+        if (res.status !== 401)
+            return res;
+        // Only string (or absent) bodies are safely re-sendable.
+        if (init?.body !== undefined && typeof init.body !== "string")
+            return res;
+        let rotated = false;
+        try {
+            rotated = await provider.refresh();
+        }
+        catch {
+            rotated = false;
+        }
+        if (!rotated)
+            return res;
+        const headers = new Headers(init?.headers);
+        headers.set("authorization", `Bearer ${provider.getToken() ?? ""}`);
+        return underlying(input, { ...init, headers });
+    };
+    return wrapped;
+}
+//# sourceMappingURL=tokenProvider.js.map

package/dist/launch.d.ts

@@ -1,7 +1,9 @@
 /**
- * Build the configured pi launch. `buildLaunch` is pure (no spawn, no fs) so it
- * is fully unit-testable: it returns the child environment and the pi argv that
- * registers pi-extension-yagni and defaults the provider to `yagni`.
+ * Build the configured pi launch. `buildLaunch` has no spawn/fs side effects,
+ * so it stays fully unit-testable, though it is no longer strictly pure: it
+ * mints a fresh session id (`randomUUID()`) on every call. It returns the
+ * child environment and the pi argv that registers pi-extension-yagni and
+ * defaults the provider to `yagni`.
  */
 import type { Credentials } from "./credentials.js";
 export interface LaunchPlan {
@@ -59,10 +61,30 @@ export interface BuildLaunchOptions {
      * in-process only, still fail-soft).
      */
     profilePath?: string;
+    /** Distribution-specific root shared with the bundled extension. */
+    stateDir?: string;
+    /**
+     * Launcher version, forwarded as `YAGNI_CODE_VERSION` so the bundled
+     * extension (which has no package.json on disk to read) can label its crash
+     * reports with the shipping version. Optional: omitted, reports say "unknown".
+     */
+    cliVersion?: string;
     /** Base environment to extend (defaults to process.env at call sites). */
     baseEnv?: NodeJS.ProcessEnv;
     /** Clock seam for the token-expiry preflight (defaults to Date.now). */
     now?: () => number;
+    /**
+     * Launcher-computed agent flags (e.g. Claude-compat `--skill` /
+     * `--prompt-template` paths). Inserted before the user's passthrough args so
+     * anything the user passes explicitly still wins.
+     */
+    extraAgentArgs?: string[];
+    /**
+     * Launcher-computed child env (e.g. Claude-compat plugin agent dirs and
+     * rules dirs). Merged before the YAGNI-critical keys so it can never
+     * override the token, base URL, or hermetic agent dir.
+     */
+    extraEnv?: Record<string, string>;
 }
 export declare function buildLaunch(creds: Credentials | null, passthroughArgs: string[], opts: BuildLaunchOptions): LaunchPlan;
 //# sourceMappingURL=launch.d.ts.map

package/dist/launch.js

@@ -1,8 +1,11 @@
 /**
- * Build the configured pi launch. `buildLaunch` is pure (no spawn, no fs) so it
- * is fully unit-testable: it returns the child environment and the pi argv that
- * registers pi-extension-yagni and defaults the provider to `yagni`.
+ * Build the configured pi launch. `buildLaunch` has no spawn/fs side effects,
+ * so it stays fully unit-testable, though it is no longer strictly pure: it
+ * mints a fresh session id (`randomUUID()`) on every call. It returns the
+ * child environment and the pi argv that registers pi-extension-yagni and
+ * defaults the provider to `yagni`.
  */
+import { randomUUID } from "node:crypto";
 import { agentDirEnvVar } from "./branding.js";
 /**
  * How close to expiry the token can be before launch warns. A coding session
@@ -50,6 +53,13 @@ export function buildLaunch(creds, passthroughArgs, opts) {
     }
     const env = {
         ...(opts.baseEnv ?? {}),
+        ...(opts.extraEnv ?? {}),
+        // One session id per launch (YAG-471 attribution). The extension reads this
+        // as YAGNI_SESSION_ID and forwards it as the model proxy's x-yagni-session-id
+        // header on the driver's own completions. /go's children override
+        // YAGNI_CALLER with their own stage/subagent/advisor label but inherit this
+        // session id (unless they also carry a YAGNI_RUN_ID, which wins server-side).
+        YAGNI_SESSION_ID: randomUUID(),
         YAGNI_TOKEN: creds.token,
         YAGNI_BASE_URL: creds.baseUrl,
         // Forward the token's expiry (when known) so the extension can surface a
@@ -62,6 +72,10 @@ export function buildLaunch(creds, passthroughArgs, opts) {
         // atomically persist a mid-session token rotation back to the same profile
         // the launcher read (0600). Absent when the caller can't resolve it.
         ...(opts.profilePath ? { YAGNI_PROFILE_PATH: opts.profilePath } : {}),
+        ...(opts.stateDir ? { YAGNI_CODE_HOME: opts.stateDir } : {}),
+        // Forward the launcher's version so the extension's crash reports carry
+        // the shipping version (the bundled extension has no package.json to read).
+        ...(opts.cliVersion ? { YAGNI_CODE_VERSION: opts.cliVersion } : {}),
         // Rebrand pi's chrome ("pi"/"π" → "YAGNI Code"): pi reads piConfig.name from
         // the package at PI_PACKAGE_DIR (a shadow package the launcher generates).
         ...(opts.piPackageDir ? { PI_PACKAGE_DIR: opts.piPackageDir } : {}),
@@ -85,20 +99,24 @@ export function buildLaunch(creds, passthroughArgs, opts) {
     // Always load our extension. Default the provider to `yagni` unless the user
     // explicitly chose one (so power users can still point pi elsewhere).
     const userChoseProvider = passthroughArgs.some(arg => arg === "--provider" || arg.startsWith("--provider="));
-    // Default the model to the `advanced` tier — the strongest judgment-grade
-    // model, so interactive sessions get the best reasoning by default. A user
-    // `--model` (e.g. `standard` or `efficient`) still wins. Without this, pi's
-    // default-model heuristic could land an interactive session on a weaker tier.
+    // Default the model to the `balanced` tier (YAG-380). Balanced drives on the
+    // judgment-grade `advanced` model and additionally lets the session escalate
+    // hard calls to `peak` through the capped ask_advisor tool. So it is strictly
+    // additive: no session reasons worse than plain advanced, and the hard ones
+    // can reason better. A user `--model` (e.g. `standard` or `efficient`) still
+    // wins. Without this, pi's default-model heuristic could land an interactive
+    // session on a weaker tier.
     // Detect if the user explicitly set a model, whether via "--model" as a separate
     // argument or using the equals form "--model=efficient". The previous check only
-    // caught the separate form, causing a duplicate "--model advanced" to be added
+    // caught the separate form, causing a duplicate "--model balanced" to be added
     // when the equals form was used.
     const userChoseModel = passthroughArgs.some(arg => arg === "--model" || arg.startsWith("--model="));
     const argv = [
         "-e",
         opts.extensionPath,
         ...(userChoseProvider ? [] : ["--provider", "yagni"]),
-        ...(userChoseModel ? [] : ["--model", "advanced"]),
+        ...(userChoseModel ? [] : ["--model", "balanced"]),
+        ...(opts.extraAgentArgs ?? []),
         ...passthroughArgs,
     ];
     return { env, argv, warnings };

package/dist/login.d.ts

@@ -9,6 +9,13 @@ export interface LoginDeps {
     baseUrl?: string;
     /** Which profile to store the minted token in. Defaults to the active one. */
     profileName?: string;
+    /**
+     * Client identifier sent with the token poll so the backend can attribute
+     * the minted credential to the app that requested it. Defaults to "cli";
+     * the desktop shell (which reuses this flow) passes "desktop". The server
+     * treats unknown values as absent, so this can never break a login.
+     */
+    client?: string;
     fetchImpl?: typeof fetch;
     now?: () => number;
     sleep?: (ms: number) => Promise<void>;

package/dist/login.js

@@ -100,7 +100,9 @@ export async function login(deps = {}) {
             res = await fetchImpl(`${baseUrl}/api/yagni-code/auth/token`, {
                 method: "POST",
                 headers: { "content-type": "application/json" },
-                body: JSON.stringify({ device_code: start.device_code }),
+                // `client` attributes the minted token to the requesting app; servers
+                // that predate the field simply ignore it.
+                body: JSON.stringify({ device_code: start.device_code, client: deps.client ?? "cli" }),
                 signal: AbortSignal.timeout(POLL_REQUEST_TIMEOUT_MS),
             });
         }

package/dist/paths.d.ts

@@ -1,7 +1,7 @@
 /**
- * Resolve the bundled dependency entry points the launcher needs: pi's CLI and
- * the pi-extension-yagni extension. Both are package dependencies, so we resolve
- * them from this module rather than assuming a global install.
+ * Resolve the dependency entry points the launcher needs: pi's CLI and the
+ * YAGNI extension. pi is a package dependency, so we resolve it from this module
+ * rather than assuming a global install; the extension ships inside our own dist.
  *
  * We use the ESM-native `import.meta.resolve` (NOT `createRequire().resolve`):
  * pi is an ESM-only package whose `exports` map declares only the `import`
@@ -9,7 +9,16 @@
  * on it. pi's package.json is also not an exported subpath, so we read it from
  * disk after resolving the package's main entry.
  */
-/** Absolute path to pi-extension-yagni's built entry (dist/index.js). */
+/**
+ * Absolute path to the extension's built entry.
+ *
+ * Published installs read the copy bundled into this package's own
+ * `dist/extension/` (see scripts/bundle-extension.mjs) — pi-extension-yagni is a
+ * private workspace package and is never on the registry, so module resolution
+ * would fail. In the monorepo the bundled copy only exists after a build, so we
+ * fall back to resolving the workspace-linked package, which keeps `pnpm test`
+ * and a fresh checkout working before anything is bundled.
+ */
 export declare function resolveExtensionPath(): string;
 /**
  * Absolute path to pi's package root — the dir whose package.json names the

package/dist/paths.js

@@ -1,7 +1,7 @@
 /**
- * Resolve the bundled dependency entry points the launcher needs: pi's CLI and
- * the pi-extension-yagni extension. Both are package dependencies, so we resolve
- * them from this module rather than assuming a global install.
+ * Resolve the dependency entry points the launcher needs: pi's CLI and the
+ * YAGNI extension. pi is a package dependency, so we resolve it from this module
+ * rather than assuming a global install; the extension ships inside our own dist.
  *
  * We use the ESM-native `import.meta.resolve` (NOT `createRequire().resolve`):
  * pi is an ESM-only package whose `exports` map declares only the `import`
@@ -9,14 +9,26 @@
  * on it. pi's package.json is also not an exported subpath, so we read it from
  * disk after resolving the package's main entry.
  */
-import { readFileSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 function resolveModulePath(specifier) {
     return fileURLToPath(import.meta.resolve(specifier));
 }
-/** Absolute path to pi-extension-yagni's built entry (dist/index.js). */
+/**
+ * Absolute path to the extension's built entry.
+ *
+ * Published installs read the copy bundled into this package's own
+ * `dist/extension/` (see scripts/bundle-extension.mjs) — pi-extension-yagni is a
+ * private workspace package and is never on the registry, so module resolution
+ * would fail. In the monorepo the bundled copy only exists after a build, so we
+ * fall back to resolving the workspace-linked package, which keeps `pnpm test`
+ * and a fresh checkout working before anything is bundled.
+ */
 export function resolveExtensionPath() {
+    const bundled = fileURLToPath(new URL("./extension/index.js", import.meta.url));
+    if (existsSync(bundled))
+        return bundled;
     return resolveModulePath("pi-extension-yagni");
 }
 /**

package/dist/profiles.d.ts

@@ -22,7 +22,7 @@ export interface Profile {
     expiresAt?: string;
 }
 /** The default active profile when nothing has been configured yet. */
-export declare const DEFAULT_PROFILE = "prod";
+export declare const DEFAULT_PROFILE: string;
 export declare function isValidProfileName(name: string): boolean;
 export declare function profilesDir(): string;
 export declare function profilePath(name: string): string;

package/dist/profiles.js

@@ -17,8 +17,9 @@ import { chmod, mkdir, readdir, readFile, rm, writeFile } from "node:fs/promises
 import { dirname, join } from "node:path";
 import { credentialsDir, deleteCredentials, readCredentials } from "./credentials.js";
 import { DEFAULT_BASE_URL, PRESET_BASE_URLS, presetBaseUrl } from "./config.js";
+import { DISTRIBUTION } from "./distribution.js";
 /** The default active profile when nothing has been configured yet. */
-export const DEFAULT_PROFILE = "prod";
+export const DEFAULT_PROFILE = DISTRIBUTION.defaultProfile;
 /**
  * Allowed profile-name shape. Restricts to a safe filename so a name can never
  * traverse out of the profiles dir or collide with `config.json`.
@@ -211,7 +212,9 @@ export async function migrateLegacyCredentials() {
     const legacy = await readCredentials();
     if (!legacy?.token)
         return;
-    const name = legacy.baseUrl.replace(/\/$/, "") === DEFAULT_BASE_URL ? "prod" : "default";
+    const name = legacy.baseUrl.replace(/\/$/, "") === DEFAULT_BASE_URL
+        ? DISTRIBUTION.defaultProfile
+        : "default";
     await persistProfileCredentials(name, legacy);
     await setActiveProfileName(name);
     await deleteCredentials();