Pin rom-manager 0.3.2 and playnite 0.2.0 #1

Merged

enricobuehler merged 1 commits from chore/pin-rom-manager-0.3.2-playnite-0.2.0 into main 2026-07-20 22:10:32 +00:00

Conversation 0 Commits 1 Files Changed 1

+7 -7

enricobuehler commented 2026-07-20 22:07:37 +00:00

Owner

Copy Link

Copy Source

The index was stale on both entries: it pinned rom-manager 0.3.1 and playnite 0.1.1 while the registry had moved to 0.3.2 and 0.2.0.

bun run validate passes — both pins exist on the registry and both integrity hashes match dist.integrity byte for byte.

I am not the reviewer. I wrote both of these releases, so I cannot be the human gate that makes them installable under unom's badge. Everything below is evidence gathered against the published tarballs so the review is cheap — the boxes are deliberately left unticked, and this should not be merged until someone who did not write the code has worked the checklist.

What changed

	rom-manager	playnite
Package	@punktfunk/plugin-rom-manager	@punktfunk/plugin-playnite
Version	0.3.1 → 0.3.2	0.1.1 → 0.2.0
Type	version bump (bug fix)	version bump (rewrite) + metadata

Metadata changes beyond version/integrity, called out so they can be vetoed:

• playnite.icon: library → library-big, so the store card matches the icon the plugin registers for its own console nav entry.
• Both descriptions now mention the console-hosted web UI (playnite gained one in 0.2.0).
• minHost stays 0.15.0 for both — neither release needs anything newer from the host than the plugin-UI surface and the ingest inbox already provide.

Diff reviewed

Tarballs pulled from the registry and unpacked:

curl -sSL "$(curl -sS "$REG/@punktfunk%2fplugin-rom-manager" | jq -r '.versions["0.3.1"].dist.tarball')" -o a.tgz
curl -sSL "$(curl -sS "$REG/@punktfunk%2fplugin-rom-manager" | jq -r '.versions["0.3.2"].dist.tarball')" -o b.tgz
# …same for playnite 0.1.1 / 0.2.0, then extract and diff -ru

rom-manager 0.3.1 → 0.3.2

File list is identical apart from the two content-hashed SPA asset names. types/index.d.ts is byte-identical. The entire delta in dist/index.js / dist/cli.js:

<   version: "0.3.1",                              >   version: "0.3.2",
>   var nullish = (schema) => Schema.optional(Schema.NullOr(schema))
<   contested: Schema.optional(Schema.Boolean),    >   contested: nullish(Schema.Boolean),
<   exePath / appId / coresDir / cores  …optional  >   …nullish(…)
<   lastSync / lastReport / detectedAt  …optional  >   …Schema.NullOr(…)
<   lastSync: engineStatus.lastSync,               >   lastSync: engineStatus.lastSync ?? null,
<   lastReport: engineStatus.lastReport,           >   lastReport: engineStatus.lastReport ?? null,
<   detectedAt: c.detect?.at,                      >   detectedAt: c.detect?.at ?? null,
<   statusChanges: engine.changes.pipe(…)          >   statusChanges: Stream.concat(Stream.fromEffect(status), engine.changes.pipe(…))

That is the whole published change. It fixes two user-visible bugs in 0.3.1: the API encoded absent optional fields as null, which the UI's own decoder rejected — so the Overview page failed on a never-synced host, and the Emulators page's Detect button failed on any box with an emulator installed. Nothing else rode along in the tarball.

playnite 0.1.1 → 0.2.0

A ground-up rewrite onto @punktfunk/plugin-kit, so a line diff is not meaningful — the shipped surface shrank to a bundle instead of a file-per-module tree:

dist/cli.js  dist/index.js  dist/ui/{index.html,assets/*}  types/index.d.ts  package.json   (13 files)

Gone: dist/server/{password,standalone,router}.js (the standalone password server was dropped — console + CLI only). New: the three-page SPA and its five Geist font files, which is the whole of the 92 KB → 338 KB size increase. Behaviour preserved verbatim: the ingest inbox is still read first, the host/dataurl/off art modes are unchanged, and launches still hand back to Playnite via playnite://. The bundled C# exporter is untouched and the export wire schema is still version 1, so an already-installed .pext keeps working.

Evidence for the checklist

• Integrity fetched independently. I downloaded each tarball and recomputed sha512 locally; both match the registry's dist.integrity and the values pinned here. Not taken on CI's word.
• Outbound hosts. rom-manager's set is unchanged from 0.3.1 — thumbnails.libretro.com and www.steamgriddb.com, the two disclosed art providers. playnite ships no outbound endpoints; the only URLs in its bundle are json-schema.org/w3.org namespace URIs, repo/homepage links in strings, and http://localhost, which is the base argument to new URL(request.url, …) in the art route, not a fetch target.
• Install lifecycle scripts: none in either published package.json — no preinstall, install, postinstall, prepare, prepublish. Both retain prepublishOnly, which npm runs on the publisher's machine, never on install.
• Filesystem reach. playnite's new /api/art route serves cover files, and is the one thing here worth a careful look: it is an allow-list, answering only for paths the currently-ingested Playnite export references, with an image-extension check — not an arbitrary read. Worth confirming you agree with that reading.

Dependencies added or changed

rom-manager: none. playnite: runtime deps go from @punktfunk/host + effect to @punktfunk/host + @punktfunk/plugin-kit + effect — plugin-kit is first-party and is the framework this rewrite exists to consume. The UI's build-time deps (@unom/*, React, Tailwind) ship as static assets, so they add no runtime dependency.

Anything that gave you pause

Three things, stated plainly:

1. playnite 0.2.0 has not run against a real Playnite install. It was verified end-to-end on a Linux host (192.168.1.21) with a synthetic export: registers, console-proxy path answers, SSE flows, an inbox drop reconciles within seconds, SIGTERM is clean. But that export had no local art files, so the new cover-art proxy has never faced real Playnite data. If you would rather not badge a Windows-only plugin that has not met Windows, hold this half and merge rom-manager alone.
2. reviewedAt reads 2026-07-20, the same as the previous pin — that is the current UTC date, not a value I forgot to bump. If you review on a later UTC day, change it before merging.
3. The 3.7× size jump on playnite is fonts and a SPA, not code. Worth confirming from the file list rather than my say-so.

The index was stale on **both** entries: it pinned `rom-manager` 0.3.1 and `playnite` 0.1.1 while the registry had moved to 0.3.2 and 0.2.0. `bun run validate` passes — both pins exist on the registry and both integrity hashes match `dist.integrity` byte for byte. > **I am not the reviewer.** I wrote both of these releases, so I cannot be the human gate that makes them installable under unom's badge. Everything below is *evidence* gathered against the published tarballs so the review is cheap — the boxes are deliberately left unticked, and this should not be merged until someone who did not write the code has worked the checklist. ## What changed | | rom-manager | playnite | | --- | --- | --- | | **Package** | `@punktfunk/plugin-rom-manager` | `@punktfunk/plugin-playnite` | | **Version** | `0.3.1` → `0.3.2` | `0.1.1` → `0.2.0` | | **Type** | version bump (bug fix) | version bump (rewrite) + metadata | Metadata changes beyond version/integrity, called out so they can be vetoed: - `playnite.icon`: `library` → `library-big`, so the store card matches the icon the plugin registers for its own console nav entry. - Both descriptions now mention the console-hosted web UI (playnite gained one in 0.2.0). - `minHost` stays `0.15.0` for both — neither release needs anything newer from the host than the plugin-UI surface and the ingest inbox already provide. ## Diff reviewed Tarballs pulled from the registry and unpacked: ```sh curl -sSL "$(curl -sS "$REG/@punktfunk%2fplugin-rom-manager" | jq -r '.versions["0.3.1"].dist.tarball')" -o a.tgz curl -sSL "$(curl -sS "$REG/@punktfunk%2fplugin-rom-manager" | jq -r '.versions["0.3.2"].dist.tarball')" -o b.tgz # …same for playnite 0.1.1 / 0.2.0, then extract and diff -ru ``` ### rom-manager 0.3.1 → 0.3.2 File list is **identical** apart from the two content-hashed SPA asset names. `types/index.d.ts` is byte-identical. The entire delta in `dist/index.js` / `dist/cli.js`: ``` < version: "0.3.1", > version: "0.3.2", > var nullish = (schema) => Schema.optional(Schema.NullOr(schema)) < contested: Schema.optional(Schema.Boolean), > contested: nullish(Schema.Boolean), < exePath / appId / coresDir / cores …optional > …nullish(…) < lastSync / lastReport / detectedAt …optional > …Schema.NullOr(…) < lastSync: engineStatus.lastSync, > lastSync: engineStatus.lastSync ?? null, < lastReport: engineStatus.lastReport, > lastReport: engineStatus.lastReport ?? null, < detectedAt: c.detect?.at, > detectedAt: c.detect?.at ?? null, < statusChanges: engine.changes.pipe(…) > statusChanges: Stream.concat(Stream.fromEffect(status), engine.changes.pipe(…)) ``` That is the whole published change. It fixes two user-visible bugs in 0.3.1: the API encoded absent optional fields as `null`, which the UI's own decoder rejected — so the Overview page failed on a never-synced host, and the Emulators page's Detect button failed on any box with an emulator installed. Nothing else rode along in the tarball. ### playnite 0.1.1 → 0.2.0 A ground-up rewrite onto `@punktfunk/plugin-kit`, so a line diff is not meaningful — the shipped surface shrank to a bundle instead of a file-per-module tree: ``` dist/cli.js dist/index.js dist/ui/{index.html,assets/*} types/index.d.ts package.json (13 files) ``` Gone: `dist/server/{password,standalone,router}.js` (the standalone password server was dropped — console + CLI only). New: the three-page SPA and its five Geist font files, which is the whole of the **92 KB → 338 KB** size increase. Behaviour preserved verbatim: the ingest inbox is still read first, the `host`/`dataurl`/`off` art modes are unchanged, and launches still hand back to Playnite via `playnite://`. The bundled C# exporter is untouched and the export wire schema is still version 1, so an already-installed `.pext` keeps working. ## Evidence for the checklist - **Integrity fetched independently.** I downloaded each tarball and recomputed sha512 locally; both match the registry's `dist.integrity` and the values pinned here. Not taken on CI's word. - **Outbound hosts.** rom-manager's set is **unchanged** from 0.3.1 — `thumbnails.libretro.com` and `www.steamgriddb.com`, the two disclosed art providers. playnite ships **no** outbound endpoints; the only URLs in its bundle are `json-schema.org`/`w3.org` namespace URIs, repo/homepage links in strings, and `http://localhost`, which is the base argument to `new URL(request.url, …)` in the art route, not a fetch target. - **Install lifecycle scripts: none** in either published `package.json` — no `preinstall`, `install`, `postinstall`, `prepare`, `prepublish`. Both retain `prepublishOnly`, which npm runs on the publisher's machine, never on install. - **Filesystem reach.** playnite's new `/api/art` route serves cover files, and is the one thing here worth a careful look: it is an allow-list, answering only for paths the currently-ingested Playnite export references, with an image-extension check — not an arbitrary read. Worth confirming you agree with that reading. ### Dependencies added or changed rom-manager: none. playnite: runtime deps go from `@punktfunk/host` + `effect` to `@punktfunk/host` + `@punktfunk/plugin-kit` + `effect` — `plugin-kit` is first-party and is the framework this rewrite exists to consume. The UI's build-time deps (`@unom/*`, React, Tailwind) ship as static assets, so they add no runtime dependency. ### Anything that gave you pause Three things, stated plainly: 1. **playnite 0.2.0 has not run against a real Playnite install.** It was verified end-to-end on a Linux host (192.168.1.21) with a synthetic export: registers, console-proxy path answers, SSE flows, an inbox drop reconciles within seconds, SIGTERM is clean. But that export had no local art files, so the new cover-art proxy has never faced real Playnite data. If you would rather not badge a Windows-only plugin that has not met Windows, hold this half and merge rom-manager alone. 2. **`reviewedAt` reads `2026-07-20`, the same as the previous pin** — that is the current UTC date, not a value I forgot to bump. If you review on a later UTC day, change it before merging. 3. The 3.7× size jump on playnite is fonts and a SPA, not code. Worth confirming from the file list rather than my say-so.

enricobuehler added 1 commit 2026-07-20 22:07:38 +00:00

chore(index): pin rom-manager 0.3.2 and playnite 0.2.0 ... 34ccacd07e

Both entries were stale — the index still pinned rom-manager 0.3.1 and
playnite 0.1.1 while the registry had moved on.

rom-manager 0.3.2 is a bug-fix release: the API encoded absent optional fields
as `null`, which the UI's own decoder then rejected, so the Overview page broke
on a never-synced host and the Emulators page's Detect button broke on any box
with an emulator installed. The published delta is exactly that fix plus the
version bump — no new files, no new outbound hosts.

playnite 0.2.0 is a ground-up rewrite onto @punktfunk/plugin-kit: three
workspaces, a three-page console UI, per-game include/exclude overrides, and an
allow-listed cover-art proxy. Behaviour that matters is preserved verbatim — the
ingest inbox is still read first, the art modes are unchanged, and launches
still hand back to Playnite. The bundled C# exporter is untouched (same wire
schema), so an installed .pext keeps working.

Also: playnite's card icon now matches the icon the plugin registers for its own
console nav entry (`library-big`), and both descriptions mention the console UI.

minHost stays 0.15.0 for both — neither release needs anything newer from the
host than the plugin-UI surface and the ingest inbox already provide.

enricobuehler merged commit 61b12a3091 into main 2026-07-20 22:10:32 +00:00

enricobuehler deleted branch chore/pin-rom-manager-0.3.2-playnite-0.2.0 2026-07-20 22:10:32 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

enricobuehler (Enrico Bühler)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unom/punktfunk-plugin-index#1