Skip to content

fix(addons): #727 follow-up fixes — pack_dir expansion, declared deps, min_lean_ctx preflight - #780

Merged
yvgude merged 8 commits into
yvgude:mainfrom
dasTholo:pr/addon-pack-deps
Jul 10, 2026
Merged

fix(addons): #727 follow-up fixes — pack_dir expansion, declared deps, min_lean_ctx preflight#780
yvgude merged 8 commits into
yvgude:mainfrom
dasTholo:pr/addon-pack-deps

Conversation

@dasTholo

Copy link
Copy Markdown
Contributor

Summary

Six follow-up fixes on top of #743 (kind=skills content packs + depth-1 dependency
resolution), which is already merged. Each one closes a gap that surfaced while wiring a
real pack through the install path:

  • {pack_dir:} expander for [mcp.env] — pure, testable, no I/O
  • [[dependencies]] authoring surface in lean-ctx-addon.toml, forwarded into the published pack
  • min_lean_ctx is enforced in preflight instead of being parsed and ignored
  • declared dependencies are installed before wiring, so {pack_dir:} always expands to a path that exists on disk
  • declared dependencies resolve on every source path (local manifest and hosted pack), and the wired version is the installed one, not a second resolve
  • the self-dependency guard on the addon resolve path is restored (it compared a bare slug against a scoped @ns/name, so it never fired)

Touches only core/addons/*, core/context_package/*, cli/addon_cmd.rs,
cli/pack_remote.rs and two docs — file-disjoint from #721, so the two can land in
either order.

Refs #727.

Test plan

  • cd rust && cargo test — run as cargo nextest run (this repo's test runner): 8759 passed
  • cd rust && cargo clippy --all-targets --all-features -- -D warnings — clean
  • cd rust && cargo fmt --check — clean
  • If cookbook/packages changed: relevant npm test / build steps — n/a, no cookbook or package changes

Notes for reviewers

  • Risk areas / edge cases:
    • The pre-consent preview resolves the highest in-range version and therefore may cosmetically
      differ from the lockfile-pinned version that actually gets installed. The wiring always uses
      the install step's output, never a second resolve.
    • That preview costs a second network resolve (TOCTOU / offline caveat). Documented on
      resolve_declared_deps.
    • root_name in resolve_one / resolve_dependencies / install_declared_dependencies must be the
      scoped reference (Some("@ns/name")) or None — a bare slug silently disables the
      self-dependency guard. That is the regression the last commit fixes; two tests pin it.
  • Backwards compatibility:
    • [[dependencies]] and the min_lean_ctx gate are additive. The gate is only enforced from the
      release that ships them onward; older binaries parse neither and are unaffected.
    • deps::already_satisfied now returns Option<ResolvedDep> instead of Option<String>, and
      deps::resolve_dependencies takes (&[PackageDependency], root_name) instead of
      &PackageManifest. Both are internal.
  • Docs updated (links/files):
    • docs/contracts/addon-manifest-v1.md[[dependencies]] + min_lean_ctx semantics
    • docs/guides/addons.md — authoring a pack with dependencies

Contributor License Agreement

First-time contributors: a bot will ask you to sign our one-time
CLA (it keeps lean-ctx
Apache-2.0 and free for individual developers — see §8). You sign once by
replying to this PR with: I have read the CLA Document and I hereby sign the CLA

dasTholo added 6 commits July 10, 2026 10:44
…ersions (yvgude#727)

Finding A: `addon add` / `addon update` now resolve and install `[[dependencies]]`
from `AddonManifest::dependencies` on every install source (local
`lean-ctx-addon.toml` included), not only the hosted `PackageManifest`. A local
install of a `{pack_dir:}` addon no longer aborts with "not a declared
dependency". The resolve/install helpers now take `&[PackageDependency]` + root
name; the hosted `PackageManifest` no longer rides along.

Finding B: `install_declared_dependencies` returns the `ResolvedDep`s it
actually landed — already-satisfied deps at their locked version, freshly
resolved ones at the picked version — and `provision_and_wire` expands
`{pack_dir:}` against that slice instead of a separate highest-match resolve.
The version burned into the wiring is the one on disk, closing the drift that
could point `{pack_dir:}` at a non-existent directory. `already_satisfied` now
returns the full `ResolvedDep` at the locked version.

Finding C: `min_lean_ctx` contract doc gains a caveat — enforcement exists only
from the release that introduced `[[dependencies]]` (3.9.x); older binaries
silently ignore both the gate and the declaration.

Tests: deps::already_satisfied_returns_the_locked_version_as_a_resolved_dep
(Finding B, red->green via return-type change);
manifest::local_manifest_dependencies_drive_pack_dir_expansion (Finding A
invariant guard).
@github-actions

github-actions Bot commented Jul 10, 2026

Copy link
Copy Markdown

All contributors have signed the CLA. ✅
Posted by the CLA Assistant Lite bot.

@dasTholo

Copy link
Copy Markdown
Contributor Author

I have read the CLA Document and I hereby sign the CLA

…ude#727)

The four depth-1 dependency helpers this PR added to addon_cmd (addon_self_ref,
resolve_declared_deps, install_declared_deps, refresh_pack_dependencies, plus
their test) pushed the file to 1623 lines; the LOC gate (scripts/loc-gate.sh,
limit 1500) forbids further growth of that file, so they move to a new
cli/addon_deps module with no behavior change.
…#727)

The tests compared a Path::join result against hardcoded /-separator strings and therefore only failed on Windows.
@yvgude
yvgude merged commit 26b69c2 into yvgude:main Jul 10, 2026
25 of 27 checks passed
@github-actions github-actions Bot locked and limited conversation to collaborators Jul 10, 2026
@dasTholo
dasTholo deleted the pr/addon-pack-deps branch July 11, 2026 06:03
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants