Repository navigation
[Bug]: Verify release archive installation and pinned-host entry loading #448
Description
DSH baseline
0.2.1-rc.3 (official pinned target).
Plugin release or commit
Prepared 0.1.0-alpha.3.dsh.0.2.1.rc.3; implementation based on c4c3313. Not installed or published by this task.
Affected surface
Installation or release artifact.
Repository preflight (optional)
Local npm access is unavailable; GitHub CI is the authoritative full validation environment. Dependency-free focused tooling tests and policy checks can run locally. Repository doctor remains repository-only.
Minimal reproduction
Adding an unpacked plugin directory through pnpm produces a development link without preparing the source directory's production dependencies. Plugin entries then fail to load when zod or pi-ai is missing, despite an Installed UI status.
Expected behavior
Install the checksum-verified packed tgz into a temporary isolated fixture, provide exact target Core peers, verify actual runtime dependency resolution/import and required entry loading, and regress broken directory links. Integrate into existing Windows/Linux CI and document precise archive versus development-link semantics. Do not change Core, real profiles, or old host templates unless this repository generates them. No PR, merge, publication or installation is authorized by this tracking issue.
Actual behavior
Existing tarball validation checks archive bytes and package structure but does not exercise installation of that archive and subsequent host loading. The task adds this gate; its complete execution awaits the existing CI trigger path.
Safety checks
- I removed credentials, tokens, OAuth grants, and raw sensitive provider responses.
- This is not a security vulnerability requiring private disclosure.
Activity
test: resolve packed dependencies from pnpm physical package root (#448)
test: honor native Web config and avoid inspecting Cordis service pro…
test: let Cordis materialize native volatile Web configuration (#448)
ci: keep installation smoke outside published package metadata (#448)
ci: support pinned pnpm exec without lifecycle-only environment (#448)
cloga commentedon Oct 25, 2026
Progress update: implementation is available in #450 at
91fd181cb455202c55cbda286f55db2bacf3acb9. Exact-head Windows/Linux verify, both Published adapter jobs andrelease-readypassed in run 40154622483. This satisfies the original archive-install/host-entry CI gate; it is not a live Desktop installation/runtime claim. The PR is still open and this issue remains open until the change lands. After #452 merged, the base advanced, so the PR owner is refreshing against current main and rerunning strict exact-head CI. The issue's original PR/CI-only boundary remains in force; no merge, release or installation is implied by this status update.cloga commentedon Oct 25, 2026
Refresh after #452 landed: PR #450 now targets current main
a7a59c56aa7d5846942e34bf764a8b689caa7b59at head3c9a961ccda47babc4e77db19ace7ac3f5fed5fa. Exact-head run 40183431291 passed Linux/Windows verify, Linux/Windows Published adapter, andrelease-ready; release was skipped. The packed-archive/pinned-host CI acceptance is now verified, but it is not a claim of live Desktop installation or runtime loading. The original PR/CI-only boundary remains in effect. Keep this issue open until the associated implementation is accepted/landed or the owner explicitly changes that boundary.test: verify packed plugin installation and pinned-host loading (#450)