test: keep host-provided packages out of dependencies (#36)

Adds a manifest guard (scripts/check-manifest.ts + test/util/manifest-test.ts) so npm run check
fails if a host-provided package such as typebox lands in dependencies, plus a daemon-startup
troubleshooting section in the skill.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

1 files changed, 49 insertions, 0 deletions

diff --git a/test/util/manifest-test.ts b/test/util/manifest-test.ts
new file mode 100644
index 0000000..6fcf136
--- /dev/null
+++ b/test/util/manifest-test.ts
@@ -0,0 +1,49 @@
+import { test, describe } from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { findHostProvidedDependencies } from "../../scripts/check-manifest";
+
+describe("host-provided manifest contract", () => {
+  test("flags host-provided packages listed in dependencies", () => {
+    const manifest = { dependencies: { ws: "^8.20.0", typebox: "^1.3.34" } };
+    assert.deepEqual(findHostProvidedDependencies(manifest), ["typebox"]);
+  });
+
+  test("recognises every pi-provided package", () => {
+    const manifest = {
+      dependencies: {
+        typebox: "*",
+        "@sinclair/typebox": "*",
+        "@mariozechner/pi-tui": "*",
+        "@earendil-works/pi-coding-agent": "*",
+      },
+    };
+    assert.deepEqual(findHostProvidedDependencies(manifest), [
+      "@earendil-works/pi-coding-agent",
+      "@mariozechner/pi-tui",
+      "@sinclair/typebox",
+      "typebox",
+    ]);
+  });
+
+  test("ignores peer and devDependencies", () => {
+    const manifest = {
+      peerDependencies: { typebox: "*" },
+      devDependencies: { typebox: "*" },
+    };
+    assert.deepEqual(findHostProvidedDependencies(manifest), []);
+  });
+
+  test("tolerates a missing or malformed dependencies field", () => {
+    assert.deepEqual(findHostProvidedDependencies({}), []);
+    assert.deepEqual(findHostProvidedDependencies({ dependencies: null }), []);
+    assert.deepEqual(findHostProvidedDependencies({ dependencies: [] }), []);
+  });
+
+  test("this package declares no host-provided dependencies", () => {
+    const manifest = JSON.parse(
+      readFileSync(new URL("../../package.json", import.meta.url), "utf8")
+    );
+    assert.deepEqual(findHostProvidedDependencies(manifest), []);
+  });
+});