@groeponline/pi-wishcraft 1.14.0 → 1.15.0

package/AGENTS.md

@@ -251,7 +251,7 @@ function createRuntimeState(hooks: {
 | **Test runner** | Node built-in `node:test` with `--experimental-strip-types` type stripping |
 | **Circular import check** | `madge --circular src index.ts bash-mode queue` (via `npm run circular`) |
 | **Import style** | `.ts` extensions on all imports, `node:`-prefixed builtins |
-| **Pi CLI** | Installed at `^0.84.0`; wrapped to run under Node 24 via nvm |
+| **Pi CLI** | Installed at `^0.99.2` (`pi-coding-agent`, `pi-ai`, `pi-tui` move together — the agent depends on matching `pi-ai`/`pi-tui`, so bumping one alone splits the tree); wrapped to run under Node 24 via nvm |
 | **Docker** | `fuse-overlayfs` storage driver for nested VM testing |
 | **Compound Engineering** | `.compound-engineering/` overlay; portable skills via `~/.agents/skills/ce-*`; native Cursor plugin disabled |
 

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## [Unreleased]
 
+## [1.15.0] - 2026-10-01
+
+### Changed
+- **Pi SDK upgraded `0.84.3` -> `0.99.2`** (`@earendil-works/pi-coding-agent`, `pi-ai`, `pi-tui` moved together). These must be bumped as a set: the agent depends on matching `pi-ai`/`pi-tui`, so bumping it alone leaves a version-skewed tree — which is exactly what the queued Dependabot PR #118 does (its lockfile keeps top-level `pi-ai` at `0.84.3` under a `0.99.2` agent). On the coordinated bump npm still nests copies, but at identical versions, so nothing is skewed. One real API change: `Provider.stream()` now takes a branded `TranscriptContext` produced only by `normalizeContext()`, which folds `systemPrompt`/`tools` into a leading system message — `src/working-vibes/provider.ts` now calls it, and the working-vibes tests assert the prompt the way the SDK delivers it (as `messages[0]`) rather than through a `context.systemPrompt` field that no longer exists.
+- Audit findings drop from 3 (1 moderate, 2 high) to 1 inherited high; the `undici` advisories are cleared. The remaining `brace-expansion` finding lives inside the peer package's own tree and has no fix available at any installable version.
+
 ## [1.14.0] - 2026-10-01
 
 ### Added

package/README.md

@@ -21,7 +21,9 @@
 pi install npm:@groeponline/pi-wishcraft
 ```
 
-Reload Pi, then press `alt+p` to open the Deck. Two flows make Wishcraft click fastest:
+Reload Pi, then press `alt+p` to open the Deck. First run? `/wishcraft setup` asks four questions — language, status preset, motion level, welcome overlay — reviews them, and writes one `settings.json`.
+
+Two flows make Wishcraft click fastest:
 
 ```text
 # remember to benchmark the new provider path
@@ -30,6 +32,8 @@ Reload Pi, then press `alt+p` to open the Deck. Two flows make Wishcraft click f
 
 The `#` line is captured as an idea instead of being sent as a prompt — your active run keeps going. Then `/skills` opens the picker: search, inspect and insert a skill without leaving the session.
 
+> **Upgrading?** This project was published under the name `@groeponline/pi-powerline-footer`. That package name is deprecated on npm and no longer receives updates — install `@groeponline/pi-wishcraft` instead. Settings keys are unchanged, so an existing `settings.json` keeps working; drop the old entry from your Pi config when you switch.
+
 ## Why Wishcraft
 
 Pi stays the engine. Wishcraft adds the operator layer around it: live status, overlays, idea capture, skill search, sticky Bash, hooks, policy controls and session UX.
@@ -52,6 +56,7 @@ Kongming lanterns started as battlefield signals and later carried wishes. Wishc
 | Read hints | Appends a one-line continuation hint after a partial `read`, so the model knows the next offset. Opt-out: `wishcraft.readHints: false`. |
 | Policy | In-process deny/inject rules in global settings. No spawn. Kill-switch: `wishcraft.policyEnabled`. |
 | Working indicator | Four deterministic styles (`dots`, `pulse`, `bar`, `ascii`) with accessibility-aware static fallbacks. |
+| Interface language | English (default) or Dutch, switchable live via `wishcraft.locale`. English is compiled into every call site, so a missing translation falls back instead of blanking a surface. |
 | Welcome art | `lantern`, `balloon`, and `normal` opening artwork, each with a different silhouette and narrow-terminal fallback. |
 
 Pi owns the footer chrome, feed scrolling, and input. Wishcraft supplies widgets, overlays, and the bash/stash/editor integrations. The bar is not clickable; actions are commands and overlays.
@@ -109,6 +114,14 @@ Keybinds (`powerlineShortcuts`, applied after `/reload`; `null` disables):
 
 `chef` is muted colors, slash separators, live TPS in/out, and TCP port count. Built-in presets: `default`, `minimal`, `compact`, `full`, `nerd`, `ascii`, `chef`. For every setting at its default, see [`examples/settings.example.json`](examples/settings.example.json).
 
+Interface language (`en` | `nl`) applies immediately, no restart:
+
+```json
+{ "wishcraft": { "locale": "nl" } }
+```
+
+Set `PI_WISHCRAFT_LOCALE` to pick a language before settings are read.
+
 Daily token budget (never blocks a turn):
 
 ```json
@@ -128,8 +141,6 @@ Privacy/network boundary: ideas, settings, usage ledgers, and normal cockpit sta
 - No mouse on the live footer. Pi core owns that surface.
 - No second `alt+i` product. Ports stay on `alt+i`; other detail is `→` in the navigator.
 - Compatibility status keys (`powerline.preset`, `powerline.tps`, `powerline.ports`) are available to peer extensions; normal Wishcraft use does not require them.
-- The legacy `@groeponline/pi-powerline-footer` package is deprecated in favor of `@groeponline/pi-wishcraft`.
-- Tags are not rewritten. 0.19.x through current stay on the timeline.
 
 ## vNext direction
 

package/build-stamp.json

@@ -1 +1 @@
-{"source_sha":"a7570d9c73e85d4553e6bfbba32e1c76c7d857b9"}
+{"source_sha":"31d28fdadee020f3ee51b452deeab58c6ec9b439"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@groeponline/pi-wishcraft",
-  "version": "1.14.0",
+  "version": "1.15.0",
   "description": "Pi coding agent extension: operator cockpit with a live powerline status bar, idea queue, skill search, sticky Bash, hooks, policy guardrails, and TUI session UX.",
   "type": "module",
   "engines": {
@@ -73,9 +73,9 @@
     "@earendil-works/pi-tui": "*"
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "^0.84.0",
-    "@earendil-works/pi-coding-agent": "^0.84.3",
-    "@earendil-works/pi-tui": "^0.84.0",
+    "@earendil-works/pi-ai": "^0.99.2",
+    "@earendil-works/pi-coding-agent": "^0.99.2",
+    "@earendil-works/pi-tui": "^0.99.2",
     "@types/node": "24.13.3",
     "madge": "^8.0.0",
     "typescript": "5.9.3"

package/src/working-vibes/provider.ts

@@ -8,6 +8,7 @@ import type {
   Model,
   ProviderStreamOptions,
 } from "@earendil-works/pi-ai";
+import { normalizeContext } from "@earendil-works/pi-ai";
 import { VIBE_SYSTEM_PROMPT, vibeState } from "./storage.ts";
 
 // ═══════════════════════════════════════════════════════════════════════════
@@ -37,7 +38,11 @@ export async function completeVibe(
 
   const baseUrl = (await registry.getProviderAuth(providerId))?.auth.baseUrl;
   const requestModel = baseUrl ? { ...model, baseUrl } : model;
-  return provider.stream(requestModel, context, options).result();
+  // `Provider.stream()` now takes a branded `TranscriptContext`, which only
+  // `normalizeContext()` produces. It folds `systemPrompt` and `tools` into a
+  // leading system message; the brand exists so a raw `Context` cannot reach
+  // provider code unnormalized.
+  return provider.stream(requestModel, normalizeContext(context), options).result();
 }
 
 // ═══════════════════════════════════════════════════════════════════════════