Feat v0.3.7 package audit (#20)

Co-authored-by: Jeffrey Smith <jasafpro@gmail.com>
Co-committed-by: Jeffrey Smith <jasafpro@gmail.com>

server/handlers/packages.go

@@ -94,6 +94,20 @@ func (h *PackageHandler) GetPackage(c *gin.Context) {
 // PUT /api/v1/admin/surfaces/:id/enable (alias)
 func (h *PackageHandler) EnablePackage(c *gin.Context) {
 	id := c.Param("id")
+
+	// v0.3.7: Block enabling dormant packages (unmet requires).
+	pkg, err := h.stores.Packages.Get(c.Request.Context(), id)
+	if err != nil || pkg == nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "package not found"})
+		return
+	}
+	if pkg.Status == "dormant" {
+		c.JSON(http.StatusConflict, gin.H{
+			"error": "package is dormant — it requires capabilities not yet available (e.g. chat)",
+		})
+		return
+	}
+
 	if err := h.stores.Packages.SetEnabled(c.Request.Context(), id, true); err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": "package not found"})
 		return
@@ -533,8 +547,8 @@ func (h *PackageHandler) InstallPackage(c *gin.Context) {
 				c.JSON(http.StatusBadRequest, gin.H{"error": "dependency is not a library: " + libID})
 				return
 			}
-			if lib.Status != "active" {
-				c.JSON(http.StatusBadRequest, gin.H{"error": "dependency is not active: " + libID})
+			if lib.Status == "suspended" || lib.Status == "dormant" {
+				c.JSON(http.StatusBadRequest, gin.H{"error": "dependency is " + lib.Status + ": " + libID})
 				return
 			}
 			versionSpec, _ := vSpec.(string)
@@ -569,14 +583,38 @@ func (h *PackageHandler) InstallPackage(c *gin.Context) {
 		}
 	}
 
-	c.JSON(http.StatusOK, gin.H{
+	// v0.3.7: Auto-set dormant for packages with unmet requires.
+	// Known capabilities: (none yet — chat and legacy-sdk are future/removed).
+	knownCaps := map[string]bool{}
+	var unmetReqs []string
+	if reqs, ok := manifest["requires"].([]any); ok && len(reqs) > 0 {
+		for _, r := range reqs {
+			req, _ := r.(string)
+			if req != "" && !knownCaps[req] {
+				unmetReqs = append(unmetReqs, req)
+			}
+		}
+	}
+	isDormant := len(unmetReqs) > 0
+	if isDormant {
+		h.stores.Packages.SetStatus(c.Request.Context(), pkgID, "dormant")
+		h.stores.Packages.SetEnabled(c.Request.Context(), pkgID, false)
+		preservedEnabled = false
+		log.Printf("[packages] %s: dormant (unmet requires: %v)", pkgID, unmetReqs)
+	}
+
+	resp := gin.H{
 		"id":      pkgID,
 		"title":   title,
 		"type":    pkgType,
 		"version": version,
 		"source":  pkgSource,
 		"enabled": preservedEnabled,
-	})
+	}
+	if isDormant {
+		resp["status"] = "dormant"
+	}
+	c.JSON(http.StatusOK, resp)
 }
 
 // extractableRelPath returns the relative path for a zip entry if it