Repository navigation
test: verify packed plugin installation and pinned-host loading - #450
Merged
Merged
Conversation
Validate isolated release archive installs and regress missing runtime dependencies in development links. Full validation belongs to GitHub CI; local registry access is not an acceptance gate. Assisted-by: GitHub Copilot Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Use the real package manifest path for Node dependency lookup and distinguish absent optional peers using the actual missing-module result. Assisted-by: GitHub Copilot Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
…xies (#448) Pass the pinned public Volatile config shape and verify service availability without comparing traced service proxy identities. Keep entry-specific causes for host loading failures. Assisted-by: GitHub Copilot Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Supply raw configuration at Context.plugin admission; the native schema constructs the Volatile handles before invoking WebRuntime. Assisted-by: GitHub Copilot Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Invoke the repository-only verifier through pinned pnpm exec, preserving the original package manifest and prepared alpha.3 release. This internal validation change does not require a product release or a release-policy exception. Assisted-by: GitHub Copilot Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Resolve pnpm from the runner PATH when npm_execpath is absent and require its exact repository-declared version before fixture installation. Windows invokes the native command shim with fixed arguments. Assisted-by: GitHub Copilot Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
2 tasks done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Install the actual verified tgz into an isolated temporary fixture, resolve/import its production dependencies, supply exact DSH 0.2.1-rc.3 host peers, and load all required Host/Client/Remote/Web/recovery entries. Regress development links missing zod or pi-ai. Integrate with existing Windows/Linux CI and update both installation guides.
This is repository-only validation: package.json, lockfile, deployment baseline, production source, prepared alpha.3 version and #427 remain unchanged.
Expected vs Actual
Expected: GitHub CI is the full acceptance authority; this machine cannot access npm. Test actual archive installation and pinned-host loading without real credentials, login or provider requests.
Actual: CI run 40183431291 passed at exact head
3c9a961ccda47babc4e77db19ace7ac3f5fed5faafter refreshing the branch onto current maina7a59c56aa7d5846942e34bf764a8b689caa7b59. Both Windows/Linux verify jobs, both exact published-artifact jobs and release-ready passed. Release correctly skipped. Exact commands/results on both platforms:pnpm install --frozen-lockfile— passed.pnpm verify— passed.pnpm pack --pack-destination artifacts— passed.pnpm verify:tarball -- artifacts/dsh-github-copilot-0.1.0-alpha.3.dsh.0.2.1.rc.3.tgz— passed.pnpm exec node scripts/verify-install-smoke.mjs --archive artifacts/dsh-github-copilot-0.1.0-alpha.3.dsh.0.2.1.rc.3.tgz --host-modules node_modules— passed, including both missing-dependency negative cases.The isolated smoke installed the actual packed archive, checked/imported production dependencies from the installation and loaded entries via the pinned public Cordis host. Development links missing
zodand@earendil-works/pi-aiwere both rejected on each platform. No registry or TLS workaround was used.pnpm install --frozen-lockfilepnpm verify(source/test types, Agent contract, tooling tests, clean build, import smoke)pnpm pack --pack-destination artifactspnpm verify:tarball -- artifacts/dsh-github-copilot-<package-version>.tgzAcceptance evidence
N/A: no acceptance pilot contract. Exact source and CI evidence are linked above. Runner archive SHA-256: Linux
b33f4678ad91a8da866d3ce416a549faac28c7e2c8128d040665c966a6501a29; Windows3c1922dff728d90f86d8368c6812dc9442348d0eae6ee65a08c67b42b14dc79c. These are each runner's verified archives, not a publication artifact or reproducible-build assertion.Evidence limits
No live Desktop boot, browser/account interaction, credentials, provider/model/search request, real-profile installation, merge or publication. Host bootstrap and Web entries run through exact published Cordis APIs with a stub credentials service; the dependency-gated full main integration body is not claimed active. Client is evaluated through its ModuleLoader registration; Remote and recovery entries are imported, not exercised against a live gateway/Session. No repository-owned template generating the obsolete cwd sentence was found; no global presets are rewritten. Repository doctor remains repository-only.
Iteration evidence
N/A: no Auto policy or continuity behavior change.
Contract checklist
node_modulespatches, private-registry/prototype/shared-catalog mutation, or Core commit/PR/release work.Assisted-by: DeepSeek Harness (DSH)for DSH); no copied vendor bot or fabricated Co-authored-by identity.Risks and rollback
CI adds package installation time and uses the runner's configured registry. Exact pnpm version is checked; registry/TLS settings are not overridden. Host peers are explicit; production dependencies must resolve inside the isolated packed install. Temporary fixtures are owned mkdtemp directories and cleaned on completion/failure. Rollback removes the verifier/tests, CI step and installation guidance. No settings, credentials or history migration exists.
Release delivery
Approval boundary
User explicitly authorized this PR and CI. No merge, release, real-profile installation, application launch, or Core work is authorized.
Fixes #448