@1aboveio/skills 1.0.17 → 1.0.18

package/skills/engineering/harness-runtime/agent-catalog.mjs

@@ -36,7 +36,8 @@
 //   PI_AGENT_CATALOG_COMMAND  JSON argv array: '["node","/abs/agent-catalog.mjs"]'
 //                             (preferred when arguments are needed), or a bare
 //                             executable token: 'pi-agent-catalog'.
-//   default                   pi-agent-catalog on PATH.
+//   default                   pi-agent-catalog on PATH, then (Pi only) the
+//                             catalog in Pi's installed npm packages on ENOENT.
 // A bare token cannot carry arguments — that is deliberate, so no quoting rule
 // sneaks shell semantics in. Nothing here runs npm/npx, resolves a sibling
 // checkout, or reads a registry.
@@ -48,8 +49,9 @@
 // install (`~/.agents/skills/{resolve-issues,harness-runtime}`). No path in this
 // file is relative to a source-domain layout.
 import { spawnSync } from 'node:child_process'
-import { readFileSync } from 'node:fs'
-import { resolve as resolvePath } from 'node:path'
+import { readFileSync, statSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { join, resolve as resolvePath } from 'node:path'
 
 export const AGENT_CATALOG_PROTOCOL_VERSION = 1
 export const DEFAULT_AGENT_CATALOG_COMMAND = 'pi-agent-catalog'
@@ -210,6 +212,27 @@ export function resolveCatalogCommand(env = process.env) {
   return parseCommandSpec(spec)
 }
 
+function installedPiCatalogCommand(request, env) {
+  if (request.harness !== 'pi' || env?.[AGENT_CATALOG_COMMAND_ENV]?.trim()) return null
+  const configuredRoot = request.userRoot || env?.PI_CODING_AGENT_DIR || join(homedir(), '.pi', 'agent')
+  const root = configuredRoot === '~' ? homedir()
+    : configuredRoot.startsWith('~/') ? join(homedir(), configuredRoot.slice(2)) : configuredRoot
+  for (const entry of [
+    ['pi-better-harness', 'bin', 'pi-agent-catalog.mjs'],
+    ['pi-better-subagents', 'agent-catalog.mjs'],
+  ]) {
+    const script = resolvePath(root, 'npm', 'node_modules', ...entry)
+    try {
+      if (statSync(script).isFile()) {
+        return { executable: process.execPath, args: [script], source: 'pi-installed' }
+      }
+    } catch (error) {
+      if (error.code !== 'ENOENT' && error.code !== 'ENOTDIR') throw error
+    }
+  }
+  return null
+}
+
 function normalizeAvailable(value, label = 'available') {
   if (value === undefined) return { ok: true, available: [] }
   if (!Array.isArray(value)) {
@@ -864,17 +887,27 @@ export function resolveAgentCatalog({
   }
   const commandResult = resolveCatalogCommand(env)
   if (!commandResult.ok) return commandResult
-  const { command } = commandResult
+  let { command } = commandResult
+  const invoke = () => runner({
+    executable: command.executable,
+    args: command.args,
+    input: `${JSON.stringify(request)}\n`,
+    timeoutMs,
+    env,
+  })
 
   let run
   try {
-    run = runner({
-      executable: command.executable,
-      args: command.args,
-      input: `${JSON.stringify(request)}\n`,
-      timeoutMs,
-      env,
-    })
+    run = invoke()
+    // Only a missing default command permits installed-package lookup. An
+    // explicit choice or a resolver that ran and failed stays authoritative.
+    if (run?.error?.code === 'ENOENT') {
+      const installed = installedPiCatalogCommand(request, env)
+      if (installed) {
+        command = installed
+        run = invoke()
+      }
+    }
   } catch (error) {
     return blocked(
       AGENT_CATALOG_BLOCK_CODES.COMMAND_UNAVAILABLE,

package/skills/engineering/harness-runtime/contracts.md

@@ -14,4 +14,4 @@ When no supported native question tool is advertised, concise free-text input is
 
 Model discovery and catalog persistence remain separate from question planning. Current-turn tool availability is never inferred from model or harness configuration. Source-tree imports outside `skills/engineering` are unsupported until an installation-aware adapter entrypoint exists; consumers must not copy the runtime to work around that boundary.
 
-`agent-catalog.mjs` is the consumer bridge to the harness-owned agent catalog: one versioned JSON request on stdin (`version`, `harness`, `cwd`, `available`, `foregroundModel`, `fallbackToForeground`, `launchCapabilities`, `hostPreferences`, `overrides`, `tiers`, …) and one JSON response on stdout with four worker slots. It resolves the resolver command from `PI_AGENT_CATALOG_COMMAND` (a JSON argv array, or one bare executable token) or defaults to `pi-agent-catalog` on PATH, runs it with no shell, bounds its output and runtime, and validates the response. Those host fields are validated and forwarded unchanged — nothing is inferred or completed here, so an unstated launch control or tier stays unstated. A missing, broken, or declining resolver is a reported block; the bridge never falls back to a skill-owned model ladder and never installs anything. `discover-models.mjs` and `model-catalog.mjs` remain for consumers that still import them and are no longer part of model-slot selection.
+`agent-catalog.mjs` is the consumer bridge to the harness-owned agent catalog: one versioned JSON request on stdin (`version`, `harness`, `cwd`, `available`, `foregroundModel`, `fallbackToForeground`, `launchCapabilities`, `hostPreferences`, `overrides`, `tiers`, …) and one JSON response on stdout with four worker slots. It resolves the resolver command from `PI_AGENT_CATALOG_COMMAND` (a JSON argv array, or one bare executable token) or defaults to `pi-agent-catalog` on PATH. For Pi only, when that default command is missing (`ENOENT`), it checks the installed `pi-better-harness` then standalone `pi-better-subagents` catalog under `<agent-dir>/npm/node_modules` and invokes the first installed entrypoint through the current Node executable. The agent directory is the request's `userRoot`, then `PI_CODING_AGENT_DIR`, then `~/.pi/agent`. Explicit commands and resolvers that execute but fail remain authoritative; there is no project-checkout search or second resolver after a catalog failure. The bridge runs with no shell, bounds its output and runtime, and validates the response. Those host fields are validated and forwarded unchanged — nothing is inferred or completed here, so an unstated launch control or tier stays unstated. A missing, broken, or declining resolver is a reported block; the bridge never falls back to a skill-owned model ladder and never installs anything. `discover-models.mjs` and `model-catalog.mjs` remain for consumers that still import them and are no longer part of model-slot selection.

package/skills/engineering/resolve-issues/SKILL.md

@@ -8,7 +8,7 @@ dependencies:
   - better-review
   - golden-path
   - harness-runtime
-release-version: 0.48.1
+release-version: 0.49.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Resolve issues

package/skills/engineering/resolve-release/SKILL.md

@@ -4,7 +4,7 @@ description: "Slash/explicit-only (/resolve-release). Full GitHub Flow release f
 disable-model-invocation: true
 metadata:
   workflow-role: coordinator
-release-version: 0.48.1
+release-version: 0.49.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Resolve release

package/skills/engineering/rush-issues/SKILL.md

@@ -6,7 +6,7 @@ metadata:
   workflow-role: coordinator
 dependencies:
   - resolve-issues
-release-version: 0.48.1
+release-version: 0.49.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Rush issues (shortcut of resolve-issues)

package/skills/engineering/rush-release/SKILL.md

@@ -6,7 +6,7 @@ metadata:
   workflow-role: coordinator
 dependencies:
   - resolve-release
-release-version: 0.48.1
+release-version: 0.49.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Rush release (shortcut of resolve-release)

package/skills/engineering/test-quality/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: test-quality
 description: "Seven principles for tests that catch real bugs, and an audit that reports weak, redundant, and not-coverage tests without fixing them. Use when writing, changing, or reviewing tests, or when asked whether tests are useful, redundant, over-mocked, flaky, only assert static text, or test config files, or asked to make a slow test suite faster without losing coverage, or when the user asks to write the testing conventions into a repo's CONTRIBUTING.md. NOT defining what a spec must prove (ensure-coverage) or authoring browser tests (e2e-test)."
-release-version: 0.48.1
+release-version: 0.49.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Test Quality

package/skills/risk-compliance/compliance-audit/SKILL.md

@@ -2,7 +2,7 @@
 name: compliance-audit
 version: 2.9.0
 description: "Audit operations against financial-compliance checklists (AML/KYC, VARS, PCI-DSS, TPA oversight, onboarding, transaction monitoring). Produces tracker.md (with a tracker.xlsx export) and phase-trail.md with layered validation; cites evidence by original filename. Input: reg-parser or the built-in VARS checklist."
-release-version: 0.48.1
+release-version: 0.49.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Compliance Audit

package/skills/risk-compliance/contract-compare/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: contract-compare
 description: "Compare two or more contracts side-by-side for structured diff, gap analysis, and benchmarking. Use when: comparing contracts or agreements, contract diff, compare terms, vendor-vs-vendor, compare our template vs theirs, compliance gap between contracts. NOT for single-contract risk review — use contract-review for that."
-release-version: 0.48.1
+release-version: 0.49.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Contract Compare

package/skills/risk-compliance/contract-review/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: contract-review
 description: "Review contracts for legal, commercial, and compliance risks via convert → chunk review → merge → validate (+ optional mandate preprocessing). Use for reviewing, auditing, or checking any contract, agreement, NDA, MSA, or SLA; input a file path (PDF/DOCX/TXT) or pasted text."
-release-version: 0.48.1
+release-version: 0.49.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Contract Review

package/skills/risk-compliance/doc-authenticity/SKILL.md

@@ -3,7 +3,7 @@ name: doc-authenticity
 version: 0.4.1
 description: "Screen PDF documents and raster images for fabrication, tampering, Photoshop or other image-editor use, and content validity. Detects file type, runs format-specific authenticity forensics, classifies bank statements, conversation logs, invoices, agreements, and other documents, then applies type-specific validity checks. Produces separate authenticity (NO_EVIDENCE_OF_MODIFICATION / SUSPICIOUS / LIKELY_MODIFIED / INCONCLUSIVE) and validity (VALID / INVALID / INCONCLUSIVE) verdicts. Use whenever a user asks whether a document, screenshot, scan, statement, invoice, contract, chat log, receipt, or payment evidence is genuine, original, edited, Photoshopped, manipulated, fake, or valid."
 disable-model-invocation: true
-release-version: 0.48.1
+release-version: 0.49.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Document and Image Authenticity

package/skills/risk-compliance/fraud-detection/SKILL.md

@@ -12,7 +12,7 @@ description: >
   impact, and a business report. Use for fraud, scam, mule, account-takeover,
   chargeback, dispute, transfer, collection, or payout risk analysis even when the
   user does not name this skill.
-release-version: 0.48.1
+release-version: 0.49.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Fraud Detection

package/skills/risk-compliance/payment-analysis/SKILL.md

@@ -14,7 +14,7 @@ description: >
   transactions" — even if they do not say payment-analysis. Do NOT use for
   fraud rule discovery (fraud-detection) or TLD / MCC-miscoding
   clusters (tld-detection).
-release-version: 0.48.1
+release-version: 0.49.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Payment Analysis

package/skills/risk-compliance/portfolio-payment-analysis/SKILL.md

@@ -5,7 +5,7 @@ description: >
   and investigate selected merchants' authorization, settlement and disputes,
   including descriptor mapping and overlapping exports. Portfolio-level payment
   overviews belong to payment-analysis; fraud rule discovery belongs to fraud-detection.
-release-version: 0.48.1
+release-version: 0.49.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Portfolio payment analysis

package/skills/risk-compliance/similar-domain/SKILL.md

@@ -8,7 +8,7 @@ description: >
   links, an entity chain, and a watchlist for the operator's next domains.
   Not transaction data (tld-detection) or fraud rules (fraud-detection).
 disable-model-invocation: true
-release-version: 0.48.1
+release-version: 0.49.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Similar Domain

package/skills/risk-compliance/tld-detection/SKILL.md

@@ -6,7 +6,7 @@ description: >
   patterns, with USD and BIN-country currency views, group profiles and priorities.
   Not payment-analysis, fraud-detection, or website research.
 disable-model-invocation: true
-release-version: 0.48.1
+release-version: 0.49.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # TLD detection