jorgex-stack 1.9.55 → 1.9.57

package/dist/cli.js

@@ -3575,6 +3575,10 @@ var REQUIRED_CAPABILITIES = /* @__PURE__ */ new Set([
   "runner-json-v1",
   "managed-primary-model-v1"
 ]);
+var PERMISSIONS_UPGRADE_CAPABILITY = "permissions-upgrade-v1";
+function supportsPermissionsUpgrade(capabilities) {
+  return Array.isArray(capabilities) && capabilities.includes(PERMISSIONS_UPGRADE_CAPABILITY);
+}
 var ALLOWED_EXTERNAL_WRITES = /* @__PURE__ */ new Set([
   "settings.json",
   "models.json",
@@ -3598,6 +3602,7 @@ function managedExternalWritesAreSafe(writes, capabilities) {
   const permissions = capabilities.includes("permissions-policy-v1");
   const experience = capabilities.includes("experience-defaults-v1");
   if (experience && !permissions) return false;
+  if (supportsPermissionsUpgrade(capabilities) && !permissions) return false;
   const allowed = experience ? EXPERIENCE_EXTERNAL_WRITES : permissions ? PERMISSIONS_EXTERNAL_WRITES : ALLOWED_EXTERNAL_WRITES;
   if (writes.length !== allowed.size) return false;
   const seen = /* @__PURE__ */ new Set();
@@ -3820,6 +3825,43 @@ function runPackageCommand(input, deps, command) {
   if (result.exitCode !== 0) return { kind: "blocked", reason: "runner-unhealthy" };
   return parseRunnerRecord(result.stdout, result.stderr, command, input.candidate, input.packageRunner) ?? { kind: "blocked", reason: "runner-output" };
 }
+var CONFIG_LOCKED_SIGNAL = "CONFIG_LOCKED";
+var UPGRADE_LOCK_RETRIES = 2;
+function stdoutHasConfigLockedSignal(stdout) {
+  const body = stdout.endsWith("\n") ? stdout.slice(0, -1) : stdout;
+  if (body === "" || body.includes("\n") || body.includes("\r")) return false;
+  try {
+    const parsed = JSON.parse(body);
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return false;
+    const error = Reflect.get(parsed, "error");
+    if (error === null || typeof error !== "object" || Array.isArray(error)) return false;
+    return Reflect.get(error, "code") === CONFIG_LOCKED_SIGNAL;
+  } catch {
+    return false;
+  }
+}
+function isConfigLockedFailure(result) {
+  if (result.exitCode !== 1) return false;
+  return stdoutHasConfigLockedSignal(result.stdout) || result.stderr.includes(CONFIG_LOCKED_SIGNAL);
+}
+function runUpgradeWithLockRetry(input, deps) {
+  let retries = 0;
+  for (; ; ) {
+    const raw = deps.run({
+      executable: input.packageRunner,
+      args: ["upgrade", "--json"],
+      environment: input.environment
+    });
+    if (raw.exitCode !== 0) {
+      if (isConfigLockedFailure(raw) && retries < UPGRADE_LOCK_RETRIES) {
+        retries += 1;
+        continue;
+      }
+      return { kind: "blocked", reason: "runner-unhealthy" };
+    }
+    return parseRunnerRecord(raw.stdout, raw.stderr, "upgrade", input.candidate, input.packageRunner) ?? { kind: "blocked", reason: "runner-output" };
+  }
+}
 function isBlockedResult(value) {
   return "kind" in value;
 }
@@ -3852,7 +3894,32 @@ function executePiPackageLifecycle(input, deps) {
     if (result === null || typeof result !== "object" || Reflect.get(result, "changed") !== true && Reflect.get(result, "changed") !== false || !Array.isArray(Reflect.get(result, "actions"))) {
       return { kind: "blocked", reason: "runner-unhealthy" };
     }
-    return { kind: "synced", actions: Reflect.get(result, "actions") };
+    const syncActions = Reflect.get(result, "actions");
+    if (input.upgradePermissions !== true || !supportsPermissionsUpgrade(input.candidate.contract.capabilities)) {
+      return { kind: "synced", actions: syncActions };
+    }
+    const upgrade = runUpgradeWithLockRetry(input, deps);
+    if (isBlockedResult(upgrade)) return upgrade;
+    const upgraded = upgrade.result;
+    if (upgraded === null || typeof upgraded !== "object" || Array.isArray(upgraded)) {
+      return { kind: "blocked", reason: "runner-output" };
+    }
+    const changed = Reflect.get(upgraded, "changed");
+    const actions = Reflect.get(upgraded, "actions");
+    if (changed !== true && changed !== false || !Array.isArray(actions)) {
+      return { kind: "blocked", reason: "runner-unhealthy" };
+    }
+    if (typeof Reflect.get(upgraded, "policy") === "string" || typeof Reflect.get(upgraded, "config") === "string") {
+      return { kind: "blocked", reason: "runner-output" };
+    }
+    if (changed === true) {
+      const policySha256 = Reflect.get(upgraded, "policySha256");
+      if (typeof policySha256 !== "string" || !/^[a-f0-9]{64}$/.test(policySha256)) {
+        return { kind: "blocked", reason: "runner-output" };
+      }
+      return { kind: "synced", actions: [...syncActions, ...actions], upgraded: true, policySha256 };
+    }
+    return { kind: "synced", actions: [...syncActions, ...actions], upgraded: false };
   }
   const models = command.result;
   if (models === null || typeof models !== "object" || Reflect.get(models, "mode") !== "inherit-session" || !sameRecord(Reflect.get(models, "tiers"), ["strong", "standard", "cheap"])) {
@@ -6347,16 +6414,16 @@ import { createHash as createHash2 } from "crypto";
 var pi_runtime_pin_default = {
   package: {
     name: "jorgex-pi",
-    version: "0.8.25",
-    source: "npm:jorgex-pi@0.8.25"
+    version: "0.8.27",
+    source: "npm:jorgex-pi@0.8.27"
   },
   provenance: {
-    commit: "f8ae7ab58456d542e0cfe98232f20072d59b4966"
+    commit: "97fb35c88c484f264cbd9dc1f0a3c65da2f9dba1"
   },
   tarball: {
-    bytes: 89140483,
-    sha256: "5477605d129100f0b793d9055959439af5c4a15497ff5dc44223fe8150e3ac19",
-    sha512: "5d86567237f295bd383e8e52c72d4fa96f20b5f8ed38487e2b72ee83c22acab8f0fe65041ed27be80fb4ffa6f170efd20dbb937b51aab162073b0e958c9ddd2f"
+    bytes: 89140773,
+    sha256: "2ac1ed88c419de87d7a519aa269cac7015e477f6c5250fe7d7090a4c40e3fa17",
+    sha512: "6adbdb8dcf35bd7b6eba63ac6b1c7fc2ccf2063f5768a16bdb462104143a09039be629c8d67ab0e058533d882a27fbbc3d753c769297ed9ac1c04775a2f0b614"
   }
 };
 
@@ -6381,6 +6448,7 @@ var PI_RUNTIME_CANDIDATE = {
       "engram-runtime-tools-v1",
       "context7-http-v1",
       "permissions-policy-v1",
+      "permissions-upgrade-v1",
       "experience-defaults-v1",
       "chrome-devtools-handoff-v1",
       "playwright-handoff-v1",
@@ -6393,7 +6461,7 @@ var PI_RUNTIME_CANDIDATE = {
     ],
     runner: {
       bin: "jorgex-pi",
-      commands: ["status", "doctor", "models", "sync", "cleanup"],
+      commands: ["status", "doctor", "models", "sync", "upgrade", "cleanup"],
       schemaVersion: 1,
       maxStdoutBytes: 65536
     },
@@ -6724,7 +6792,8 @@ function runPiRuntime(input, deps) {
       plan,
       candidate: PI_RUNTIME_CANDIDATE,
       packageRunner: paths.packageRunner,
-      environment: paths.environment
+      environment: paths.environment,
+      ...input.upgradePermissions === true ? { upgradePermissions: true } : {}
     });
     persistReturnedReceipt(result2, paths, deps);
     return result2;
@@ -7065,8 +7134,11 @@ async function runManagedPiSystem(input) {
     packageOnly,
     writingStyle: suppliedStyle,
     writingStyleMode,
+    upgradePermissions: requestedUpgrade,
     ...runtimeInput
   } = input;
+  const supportsPermissionsUpgrade2 = PI_RUNTIME_CANDIDATE.contract.capabilities.includes("permissions-upgrade-v1");
+  const upgradePermissions = requestedUpgrade === true && supportsPermissionsUpgrade2;
   if (input.operation === "doctor" && packageOnly) {
     const result2 = managedPackageResult(await runPiRuntimeSystem(runtimeInput));
     return result2.kind === "manual-existing" ? manualExistingResult(result2) : result2;
@@ -7105,7 +7177,11 @@ async function runManagedPiSystem(input) {
   const result = await runManagedPiOperation(input.operation, {
     installInitRemedy: input.targetDir === void 0 ? void 0 : INSTALL_INIT_TARGET_REMEDY,
     async runPackage(operation) {
-      return managedPackageResult(await runPiRuntimeSystem({ ...runtimeInput, operation }));
+      return managedPackageResult(await runPiRuntimeSystem({
+        ...runtimeInput,
+        operation,
+        ...upgradePermissions ? { upgradePermissions: true } : {}
+      }));
     },
     runProjection(operation) {
       const result2 = runPiProjectionLifecycleSystem({
@@ -8023,7 +8099,16 @@ async function runSelectedPi(options) {
     engramBin,
     ...devtoolsMcpEnabled === void 0 ? {} : { devtoolsMcpEnabled },
     ...playwrightCliEnabled === void 0 ? {} : { playwrightCliEnabled },
-    ...playwrightCapability === void 0 ? {} : { playwrightCapability }
+    ...playwrightCapability === void 0 ? {} : { playwrightCapability },
+    ...(() => {
+      if (options.upgradePermissions !== true) return {};
+      const supports = PI_RUNTIME_CANDIDATE.contract.capabilities.includes("permissions-upgrade-v1");
+      if (!supports) {
+        p6.log.info("Pi: --upgrade-permissions requiere un paquete con permissions-upgrade-v1; se contin\xFAa en modo seed-only.");
+        return {};
+      }
+      return { upgradePermissions: true };
+    })()
   });
   if (result.kind === "blocked") {
     const paths = "paths" in result ? `: ${result.paths.join(", ")}` : "";
@@ -8258,7 +8343,8 @@ Flags disponibles: jorgex-stack --help`
               writingStyle,
               modePreference: mode,
               playwrightCliEnabled: flags.targetDir === void 0 && exitCode === 0 && playwrightToolPlan.actions.length > 0 ? playwrightToolConsent.runtimeSelection?.pi : void 0,
-              playwrightCapability
+              playwrightCapability,
+              ...flags.upgradePermissions ? { upgradePermissions: true } : {}
             });
             exitCode = Math.max(exitCode, piExitCode);
             piStatus = piExitCode === 0 ? "ok" : "failed";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jorgex-stack",
-  "version": "1.9.55",
+  "version": "1.9.57",
   "description": "Harness multi-agente portable: instala la config JorgeX (agentes, skills, hooks, Engram, MCPs) en Claude Code, Codex CLI, OpenCode y Pi",
   "type": "module",
   "license": "MIT",