From a24d9306203a6ebfe69c404fecbc93c0414394d7 Mon Sep 17 00:00:00 2001
From: "Christian M. Todie" <chris@todie.io>
Date: Sat, 18 Jul 2026 06:11:08 -0400
Subject: [PATCH] test(harness-pi): 3-way pin-drift gate for the
 pi-coding-agent devDependency (OPS-749)

Mirrors opencode's gate: install.sh PI_VERSION must equal the
@earendil-works/pi-coding-agent devDependency (and README, already
checked). A package.json-only bump now goes red instead of silently
diverging from the pin the install script ships.
---
 packages/harness-pi/tests/models.test.mjs | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/packages/harness-pi/tests/models.test.mjs b/packages/harness-pi/tests/models.test.mjs
index 673ae1e..8bec0fa 100644
--- a/packages/harness-pi/tests/models.test.mjs
+++ b/packages/harness-pi/tests/models.test.mjs
@@ -44,3 +44,12 @@ test("install.sh pin matches README", () => {
   assert.ok(pin, "install.sh: no exact PI_VERSION pin");
   assert.ok(readme.includes(pin), "README pin drifted from install.sh");
 });
+
+test("@earendil-works/pi-coding-agent devDependency matches the harness pin", () => {
+  // OPS-749: the 3-way gate opencode already has. Without it a
+  // package.json-only bump (dependabot PR #37) silently diverges the
+  // devDependency from the pin the install script actually ships.
+  const pin = install.match(/^PI_VERSION="(\d+\.\d+\.\d+)"$/m)?.[1];
+  const manifest = JSON.parse(readFileSync(join(PKG, "package.json"), "utf8"));
+  assert.equal(manifest.devDependencies["@earendil-works/pi-coding-agent"], pin);
+});