@oriro/orirocli 0.1.11 → 0.3.1

package/ATTRIBUTION.md

@@ -1,53 +1,53 @@
-# ORIRO CLI — Attribution & Provenance
-
-Private provenance record. It honors upstream authors and satisfies MIT/Apache-2.0
-notice obligations. Per ORIRO Cardinal Rule 1, **this is never surfaced in the product UI** —
-it is the internal record of what we built on, folded from, or learned from.
-
-Living document: a source is only listed under "Code folded" once its component actually
-lands in the tree (validated, zero-OpenClaw). Until then it sits under "To fold" or "Reference".
-
----
-
-## Foundation (used as a library)
-- **Pi agent harness** — `@earendil-works/pi-*` / `@mariozechner/pi-*` (pi-agent-core, pi-ai, pi-tui, pi-coding-agent). **MIT** © 2025 Mario Zechner. The base our CLI is built on.
-
-## Code folded — our OWN modules (from ORIRO `oriro-ai/cli`)
-- **ORIRO** © ORIRO.ai / Greenri Solutions LLC — MIT. Routers/Mux, Guardian core, Language (NLLB), Scribe, Head, Avatar, identity. (Our code; folded clean, zero OpenClaw footprint.)
-
-## To fold — external, validated SAFE (MIT + TypeScript + zero OpenClaw)
-- **gitagent** — https://github.com/open-gitagent/gitagent — **MIT** — open-gitagent (shreyaskapale / shreyas-lyzr, parshvadaftari, kagura-agent, Nivesh353, carvalab).
-  Built on the same Pi harness. Candidate components: tool/skill/plugin/hook loaders, `node-cron` scheduler, git-committed memory layer, OTel setup. → Step 5 / 5A / 7.
-- **nanoclaw** — https://github.com/nanocoai/nanoclaw — **MIT** — nanocoai (gavrielc, Koshkoshinsk, gabi-simons, glifocat).
-  Independent (verified no openclaw deps). Candidate components: `better-sqlite3` session/memory store, cron scheduler, `@clack/prompts` onboarding. → 5A Scriber index / 7.
-
-## Reference only — concepts/patterns ported (credit; no code copied)
-- **agent-of-empires** — https://github.com/agent-of-empires/agent-of-empires — **MIT** — njbrake, Seluj78, jerome-benoit, BTForIT. tmux+worktree+state-machine agent supervision → Step 7.
-- **vibe-kanban** — https://github.com/BloopAI/vibe-kanban — **Apache-2.0** — BloopAI (stunningpixels, abcpro1, LSRCT, ggordonhall, anastasiya1155). kanban→worktree task model → Step 7. (Project sunsetting.)
-- **hermes-agent** — https://github.com/NousResearch/hermes-agent — **MIT** — NousResearch (teknium1, OutThisLife, kshitijk4poor, benbarclay). (Python — ideas only.) OpenClaw link = one-way `hermes claw migrate` data-import tooling only (no code dep/fork — safe). Transferable ideas: **SQLite FTS5 + LLM-summarization cross-session memory → 5A Scriber retrieval index** (highest value; pairs with nanoclaw better-sqlite3); RPC subagent isolation ("zero-context-cost turns") → Step 7; natural-language cron → Step 7 automations; multi-platform unified-context gateway → channels. CAUTION: its autonomous self-rewriting skill loop must be Guardian-gated/deferred, never ported unsandboxed.
-- **nanobot** — https://github.com/HKUDS/nanobot — **MIT** — HKUDS (Re-bin, chengyongru, Athemis). Channel/model-router design. (Python.)
-- **zeroclaw** — https://github.com/zeroclaw-labs/zeroclaw — **Apache-2.0** — zeroclaw-labs. Security policy / SOP engine design. (Rust.)
-- **nullclaw** — https://github.com/nullclaw/nullclaw — **MIT** — nullclaw (DonPrus, manelsen). vtable provider/channel/memory abstraction. (Zig.)
-- **moltis** — https://github.com/moltis-org/moltis — **MIT** — moltis-org (penso). Sandbox boundary + skill-import schema. (Rust.)
-- **picoclaw** — https://github.com/sipeed/picoclaw — **MIT** — Sipeed. Low-footprint single-binary design. (Go.)
-- **lionclaw** — https://github.com/moshthepitt/lionclaw — **MIT** — moshthepitt. Worker/permissions/audit control-plane model. (Rust.)
-
-## MCP — Step 7 connectors
-- **`@modelcontextprotocol/sdk`** — **MIT** © Anthropic — the official MCP SDK; a runtime dependency. The connectors MCP client (`src/connectors/mcp-client.ts`) is built on its `Client` + stdio/streamable-HTTP transports (no hand-rolled protocol).
-- **openharness** (`github.com/zhijiewong/openharness`) — **MIT** — *pattern reference only* (no code copied): the official-SDK migration, `server__tool` namespacing, deferred-loading, OAuth+keychain, retryable reconnect. Independent, zero OpenClaw footprint.
-- **goose** (`github.com/aaif-goose/goose`, Block) — **Apache-2.0** — *pattern reference only* (Rust): the battle-scars hardening — per-server isolation, stderr-on-init-failure, env denylist, 3-state OAuth, OSV check, Windows Job Objects, `_meta` owner stamping.
-- Connector catalog (59 entries) generated from ORIRO's own `connectors_pass.jsonl` (validated set), scrubbed.
-
-## Skill library — skills folded into `skills/` (2026-07-01 batch: +4, 327 total)
-- **graphify** — public/community skill (knowledge-graph builder); Pi variant (`skill-pi.md`) promoted to SKILL.md; license as embedded in dir.
-- **impeccable** — public/community frontend-quality skill; license as embedded in dir.
-- **uipm-ui-styling** — from the public UIPM / ui-ux-pro-max skill pack.
-- **21stdev** — ORIRO-authored (© 2026 ORIRO.ai) 21st.dev Magic-MCP usage skill, privacy-scrubbed for bundling.
-- Evaluated, already bundled (nested in the Step-5 pack — not re-added): focus, marketing, design, zero-to-live, gh, gh-skill, grill-me, playwright-cli, remotion-best-practices, supabase-postgres-best-practices, uipm-* (6), web-design-guidelines, doc-coauthoring, idea-to-deploy, app-builder-guide, debug-and-build-methodology, become-an-ai-engineer-26, image-generation-engineer, oriro-ui-2026, vercel-optimize.
-- Evaluated and EXCLUDED as private/unshippable: tranzguard-1, triro-trading, Training-Steps-Modal, ai-engineering, oriro-agentic, godmode, master-architect, google-ai-latest, remotion-narvo, scribe (local-path-bound), dev, codex-cli-runtime, codex-result-handling, gpt-5-4-prompting, last30days (16MB + vendored scrapers).
-
-## Evaluated — NOT used (recorded for honesty)
-- **github/copilot-cli** — proprietary / no-derivatives, no source in repo. Blocked.
-- **manaflow-ai/cmux** — GPL-3.0 (copyleft) + Swift/macOS. Blocked.
-- **superset-sh/superset** — Elastic License 2.0 (license-key + anti-competing-service clauses). Blocked for fold; pattern reference only.
-- **dataelement/Clawith** — Apache-2.0 but "OpenClaw for Teams" branded Python/React web platform. Skipped (footprint + wrong shape).
+# ORIRO CLI — Attribution & Provenance
+
+Private provenance record. It honors upstream authors and satisfies MIT/Apache-2.0
+notice obligations. Per ORIRO Cardinal Rule 1, **this is never surfaced in the product UI** —
+it is the internal record of what we built on, folded from, or learned from.
+
+Living document: a source is only listed under "Code folded" once its component actually
+lands in the tree (validated, zero-OpenClaw). Until then it sits under "To fold" or "Reference".
+
+---
+
+## Foundation (used as a library)
+- **Pi agent harness** — `@earendil-works/pi-*` / `@mariozechner/pi-*` (pi-agent-core, pi-ai, pi-tui, pi-coding-agent). **MIT** © 2025 Mario Zechner. The base our CLI is built on.
+
+## Code folded — our OWN modules (from ORIRO `oriro-ai/cli`)
+- **ORIRO** © ORIRO.ai / Greenri Solutions LLC — MIT. Routers/Mux, Guardian core, Language (NLLB), Scribe, Head, Avatar, identity. (Our code; folded clean, zero OpenClaw footprint.)
+
+## To fold — external, validated SAFE (MIT + TypeScript + zero OpenClaw)
+- **gitagent** — https://github.com/open-gitagent/gitagent — **MIT** — open-gitagent (shreyaskapale / shreyas-lyzr, parshvadaftari, kagura-agent, Nivesh353, carvalab).
+  Built on the same Pi harness. Candidate components: tool/skill/plugin/hook loaders, `node-cron` scheduler, git-committed memory layer, OTel setup. → Step 5 / 5A / 7.
+- **nanoclaw** — https://github.com/nanocoai/nanoclaw — **MIT** — nanocoai (gavrielc, Koshkoshinsk, gabi-simons, glifocat).
+  Independent (verified no openclaw deps). Candidate components: `better-sqlite3` session/memory store, cron scheduler, `@clack/prompts` onboarding. → 5A Scriber index / 7.
+
+## Reference only — concepts/patterns ported (credit; no code copied)
+- **agent-of-empires** — https://github.com/agent-of-empires/agent-of-empires — **MIT** — njbrake, Seluj78, jerome-benoit, BTForIT. tmux+worktree+state-machine agent supervision → Step 7.
+- **vibe-kanban** — https://github.com/BloopAI/vibe-kanban — **Apache-2.0** — BloopAI (stunningpixels, abcpro1, LSRCT, ggordonhall, anastasiya1155). kanban→worktree task model → Step 7. (Project sunsetting.)
+- **hermes-agent** — https://github.com/NousResearch/hermes-agent — **MIT** — NousResearch (teknium1, OutThisLife, kshitijk4poor, benbarclay). (Python — ideas only.) OpenClaw link = one-way `hermes claw migrate` data-import tooling only (no code dep/fork — safe). Transferable ideas: **SQLite FTS5 + LLM-summarization cross-session memory → 5A Scriber retrieval index** (highest value; pairs with nanoclaw better-sqlite3); RPC subagent isolation ("zero-context-cost turns") → Step 7; natural-language cron → Step 7 automations; multi-platform unified-context gateway → channels. CAUTION: its autonomous self-rewriting skill loop must be Guardian-gated/deferred, never ported unsandboxed.
+- **nanobot** — https://github.com/HKUDS/nanobot — **MIT** — HKUDS (Re-bin, chengyongru, Athemis). Channel/model-router design. (Python.)
+- **zeroclaw** — https://github.com/zeroclaw-labs/zeroclaw — **Apache-2.0** — zeroclaw-labs. Security policy / SOP engine design. (Rust.)
+- **nullclaw** — https://github.com/nullclaw/nullclaw — **MIT** — nullclaw (DonPrus, manelsen). vtable provider/channel/memory abstraction. (Zig.)
+- **moltis** — https://github.com/moltis-org/moltis — **MIT** — moltis-org (penso). Sandbox boundary + skill-import schema. (Rust.)
+- **picoclaw** — https://github.com/sipeed/picoclaw — **MIT** — Sipeed. Low-footprint single-binary design. (Go.)
+- **lionclaw** — https://github.com/moshthepitt/lionclaw — **MIT** — moshthepitt. Worker/permissions/audit control-plane model. (Rust.)
+
+## MCP — Step 7 connectors
+- **`@modelcontextprotocol/sdk`** — **MIT** © Anthropic — the official MCP SDK; a runtime dependency. The connectors MCP client (`src/connectors/mcp-client.ts`) is built on its `Client` + stdio/streamable-HTTP transports (no hand-rolled protocol).
+- **openharness** (`github.com/zhijiewong/openharness`) — **MIT** — *pattern reference only* (no code copied): the official-SDK migration, `server__tool` namespacing, deferred-loading, OAuth+keychain, retryable reconnect. Independent, zero OpenClaw footprint.
+- **goose** (`github.com/aaif-goose/goose`, Block) — **Apache-2.0** — *pattern reference only* (Rust): the battle-scars hardening — per-server isolation, stderr-on-init-failure, env denylist, 3-state OAuth, OSV check, Windows Job Objects, `_meta` owner stamping.
+- Connector catalog (59 entries) generated from ORIRO's own `connectors_pass.jsonl` (validated set), scrubbed.
+
+## Skill library — skills folded into `skills/` (2026-07-01 batch: +4, 327 total)
+- **graphify** — public/community skill (knowledge-graph builder); Pi variant (`skill-pi.md`) promoted to SKILL.md; license as embedded in dir.
+- **impeccable** — public/community frontend-quality skill; license as embedded in dir.
+- **uipm-ui-styling** — from the public UIPM / ui-ux-pro-max skill pack.
+- **21stdev** — ORIRO-authored (© 2026 ORIRO.ai) 21st.dev Magic-MCP usage skill, privacy-scrubbed for bundling.
+- Evaluated, already bundled (nested in the Step-5 pack — not re-added): focus, marketing, design, zero-to-live, gh, gh-skill, grill-me, playwright-cli, remotion-best-practices, supabase-postgres-best-practices, uipm-* (6), web-design-guidelines, doc-coauthoring, idea-to-deploy, app-builder-guide, debug-and-build-methodology, become-an-ai-engineer-26, image-generation-engineer, oriro-ui-2026, vercel-optimize.
+- Evaluated and EXCLUDED as private/unshippable: tranzguard-1, triro-trading, Training-Steps-Modal, ai-engineering, oriro-agentic, godmode, master-architect, google-ai-latest, remotion-narvo, scribe (local-path-bound), dev, codex-cli-runtime, codex-result-handling, gpt-5-4-prompting, last30days (16MB + vendored scrapers).
+
+## Evaluated — NOT used (recorded for honesty)
+- **github/copilot-cli** — proprietary / no-derivatives, no source in repo. Blocked.
+- **manaflow-ai/cmux** — GPL-3.0 (copyleft) + Swift/macOS. Blocked.
+- **superset-sh/superset** — Elastic License 2.0 (license-key + anti-competing-service clauses). Blocked for fold; pattern reference only.
+- **dataelement/Clawith** — Apache-2.0 but "OpenClaw for Teams" branded Python/React web platform. Skipped (footprint + wrong shape).

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 Vinay Sharma / ORIRO (Greenri Solutions LLC)
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 ORIRO
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,4 +1,10 @@
-<!-- Banner: added separately by Vinay -->
+<!-- Banner / demo -->
+<p align="center">
+  <a href="https://github.com/oriro-ai/cli/raw/main/media/oriro-cli-demo.mp4">
+    <img src="https://github.com/oriro-ai/cli/raw/main/media/oriro-cli-demo.gif" alt="ORIRO CLI v0.1.12 — live demo" width="900">
+  </a>
+</p>
+<p align="center"><em>▶ ORIRO CLI v0.1.12 — 55-second live demo · keyless chat · avatar · agents · Guardian. <a href="https://github.com/oriro-ai/cli/raw/main/media/oriro-cli-demo.mp4">Click for full-quality MP4.</a></em></p>
 
 # ORIRO‑Terminal - **“Head | Memory | Eyeball for AI”**
 
@@ -9,19 +15,14 @@ It **writes and runs code** from a pool of free routers, works in **your languag
 can **inspect a live site's structure**, and greets you with an **avatar in its own on-device voice**.
 Your language, your machine, no paid keys required.
 
-<p align="center">
-  <img src="docs/oriro-cli-live.gif" alt="ORIRO CLI — a live keyless session: writes code, sees the web, guards itself" width="820">
-</p>
-
-<p align="center"><sub>A real terminal session, captured live: <code>npx @oriro/orirocli</code> → write code → Head → Guardian → voice.</sub></p>
-
 ## What's inside (this release)
 - **Keyless free-router Mux** — best-router selection + invisible failover across free providers, with an on-device floor. **Never a paid key.** BYOK optional (live-validated).
 - **100 languages** — pick yours at first run; the model works in English. On-device NLLB translation is an optional add-on (without it, your text passes through as-is).
 - **Guardian V3 (Lite)** — a **deterministic** security gate on every tool call (default-on, fail-closed): blocks `curl|sh` remote-exec, destructive wipes, reverse shells, and env/secret exfil. No weights, no tokenizer, no download.
 - **Head** — go out to a live site and SEE it. `oriro head <url>` does a keyless structural read (sections, CTAs, gaps vs competitors — pure fetch, no browser). With the optional Chromium peer it also **reverse-engineers a page into clean code** (`--code`), a **YAML build spec** (`--spec`), or **full-page screenshots** (`--shots`). The chat agent can call the same via its `inspect_site` / `url_to_code` / `url_to_spec` / `capture_site` tools.
 - **Scriber (memory)** — a consent-gated local work journal, **off by default**; turns are recalled across sessions and never leave your machine.
-- **323 skills** (CORE/TAIL tiered) + **multi-agent orchestration** on the free pool.
+- **326 skills** (CORE/TAIL tiered) + **multi-agent orchestration** on the free pool.
+- **Agents** — save a workflow as an **agent** that runs on a router (its brain) with **full tools behind Guardian**: `oriro agents make <name> --task "…" [--router <id>] [--schedule 1h]`, then `oriro agents run <name>`. **Automate** it with `oriro agents tick` (wire to cron/Task Scheduler) or `oriro agents daemon`. Import shared agents with `oriro agents add <path|url>` — user-extensible, just like skills. An agent is inert until a router is behind it.
 - **MCP connectors** — a 59-entry catalog (`oriro connectors add <slug>`) **plus guided setup of ANY custom server** (`oriro connectors setup`), Guardian-vetted before it's saved (no JSON).
 - **Avatar** — pick a face at onboarding; it greets you aloud in its paired on-device voice.
 - **Voice input** — `oriro voice` transcribes audio/mic to text on-device (Whisper, translate→English path); `/voice` speaks a turn in chat. *Experimental — needs ffmpeg + the transformers peer.*
@@ -85,7 +86,7 @@ Permission cycle / Safety │ ✅ 4 modes: Shift+Tab → │ Postures │ Manual
 
  License - **MIT License**
 
-Copyright (c) 2026 VINAY SHARMA
+Copyright (c) 2026 ORIRO
 
 Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.