Should plugin versions should be locked by default?

[andrewhamon]

I was investigating plugin management and it seems like there is no locking of installed plugins other than pinning an exact version. If you don't explicitly pin, you will always be on latest (i.e. when you pi update, install your config on a fresh machine, etc.).

To quote my llm:

On your new workstation, node_modules is missing, so pi runs npm install pi-web-search --prefix ~/.pi/agent/npm. That's the crux: npm install with an explicit package argument
resolves the latest dist-tag — it ignores the lockfile and the ^1.3.1 range in package.json, and rewrites both to whatever is current. Your committed lockfile is clobbered, not
consulted.

That seems like a really dangerous default, especially when the package catalog gives un-pinned copy-paste snippets.

[TheJudge26]

When pi runs npm install <plugin> to restore your setup on a new machine, npm treats it as an explicit request to add/update that specific package. It intentionally ignores your lockfile and just grabs the latest version, rewriting package.json in the process. Your lockfile is basically ignored.

Ideally, pi should fix this in one of two ways:

1. Use npm ci: If there's already a package.json and lockfile in ~/.pi/agent/npm, pi should just run npm ci (or a bare npm install) instead of looping through the plugin list and installing them by name.
2. Hard-pin by default: When you run pi plugin install foo, it should resolve the latest version but save the exact version (e.g., @1.3.1) into the config instead of a floating range.

Until that gets patched, the only safe workaround for reproducible dotfiles is to ignore the catalog copy-paste snippets and always pin the exact version yourself:
pi plugin install pi-web-search@1.3.1