@oriro/orirocli 0.1.7 → 0.1.9

package/ATTRIBUTION.md

@@ -38,6 +38,14 @@ lands in the tree (validated, zero-OpenClaw). Until then it sits under "To fold"
 - **goose** (`github.com/aaif-goose/goose`, Block) — **Apache-2.0** — *pattern reference only* (Rust): the battle-scars hardening — per-server isolation, stderr-on-init-failure, env denylist, 3-state OAuth, OSV check, Windows Job Objects, `_meta` owner stamping.
 - Connector catalog (59 entries) generated from ORIRO's own `connectors_pass.jsonl` (validated set), scrubbed.
 
+## Skill library — skills folded into `skills/` (2026-07-01 batch: +4, 327 total)
+- **graphify** — public/community skill (knowledge-graph builder); Pi variant (`skill-pi.md`) promoted to SKILL.md; license as embedded in dir.
+- **impeccable** — public/community frontend-quality skill; license as embedded in dir.
+- **uipm-ui-styling** — from the public UIPM / ui-ux-pro-max skill pack.
+- **21stdev** — ORIRO-authored (© 2026 ORIRO.ai) 21st.dev Magic-MCP usage skill, privacy-scrubbed for bundling.
+- Evaluated, already bundled (nested in the Step-5 pack — not re-added): focus, marketing, design, zero-to-live, gh, gh-skill, grill-me, playwright-cli, remotion-best-practices, supabase-postgres-best-practices, uipm-* (6), web-design-guidelines, doc-coauthoring, idea-to-deploy, app-builder-guide, debug-and-build-methodology, become-an-ai-engineer-26, image-generation-engineer, oriro-ui-2026, vercel-optimize.
+- Evaluated and EXCLUDED as private/unshippable: tranzguard-1, triro-trading, Training-Steps-Modal, ai-engineering, oriro-agentic, godmode, master-architect, google-ai-latest, remotion-narvo, scribe (local-path-bound), dev, codex-cli-runtime, codex-result-handling, gpt-5-4-prompting, last30days (16MB + vendored scrapers).
+
 ## Evaluated — NOT used (recorded for honesty)
 - **github/copilot-cli** — proprietary / no-derivatives, no source in repo. Blocked.
 - **manaflow-ai/cmux** — GPL-3.0 (copyleft) + Swift/macOS. Blocked.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Vinay Sharma / ORIRO (Greenri Solutions LLC)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/cli.js

@@ -1798,6 +1798,9 @@ function useRouters(ids) {
   if (applied.length > 0) savePool(oriroDir(), applied);
   return { applied, unknown };
 }
+function registeredRouters() {
+  return Object.values(readReg());
+}
 function resolvePool() {
   const reg = readReg();
   return loadPool(oriroDir()).map((id) => reg[id]).filter((r) => Boolean(r));
@@ -3759,15 +3762,42 @@ function registerRoutersCommand(program2) {
       process.stdout.write(`  ${accent(r.id.padEnd(22))} ${r.displayName.padEnd(24)} ${tier}
 `);
     }
+    const custom = registeredRouters().filter((r) => !ROUTER_CATALOG.some((c) => c.id === r.id));
+    if (custom.length) {
+      process.stdout.write(`
+  ${accent("your custom routers")}
+`);
+      for (const r of custom) {
+        const type = r.apiKey && r.apiKey !== KEYLESS_SENTINEL ? dim("BYOK") : fgHex(PALETTE.success, "keyless");
+        process.stdout.write(`  ${accent(r.id.padEnd(22))} ${dim(r.baseUrl.padEnd(40))} ${type}
+`);
+      }
+    }
     const pool = resolvePool();
     info(pool.length ? `active pool: ${pool.map((p) => p.id).join(", ")}` : "active pool: empty \u2192 using the keyless floor");
   });
-  routers.command("add <slug>").description("live-validate a router and add it to the pool").option("-k, --key <key>", "API key (for non-keyless routers)").option("-m, --model <id>", "pin a specific model id").action(async (slug, opts) => {
-    const entry = routerById(slug);
-    if (!entry) die(`unknown router '${slug}' \u2014 run \`oriro routers list\``);
+  routers.command("add <name>").description("live-validate a router and add it to the pool \u2014 a catalog name, OR any custom endpoint via --url").option("-k, --key <key>", "API key (BYOK) \u2014 omit for a keyless free router").option("-m, --model <id>", "model id to run (REQUIRED for a custom --url router)").option("--url <baseUrl>", "add ANY custom free/BYOK router by its OpenAI-compatible base URL (the part BEFORE /chat/completions)").option("--api <api>", "custom router API: 'openai' (default) or 'google'", "openai").action(async (name, opts) => {
+    let entry;
+    if (opts.url) {
+      if (!opts.model) die("a custom --url router needs --model <id> (the model to run on that endpoint)");
+      const baseUrl = opts.url.replace(/\/(?:chat\/completions)\/?$/i, "").replace(/\/$/, "");
+      entry = {
+        id: name,
+        displayName: name,
+        baseUrl,
+        api: opts.api === "google" ? "google-generative-ai" : "openai-completions",
+        freeModels: [opts.model],
+        keyless: !opts.key,
+        tier: "free",
+        kind: "chat"
+      };
+    } else {
+      entry = routerById(name);
+      if (!entry) die(`unknown router '${name}' \u2014 run \`oriro routers list\`, or add any custom endpoint with: oriro routers add <name> --url <baseUrl> --model <id> [--key <key>]`);
+    }
     const res = await addRouter(entry, { ...opts.key ? { key: opts.key } : {}, ...opts.model ? { modelId: opts.model } : {} });
-    if (!res.ok) die(`could not add '${slug}': ${res.validation.error ?? "validation failed"}`);
-    ok(`added ${accent(slug)} (${res.validation.latencyMs}ms, model ${res.validation.model}) \u2192 active pool`);
+    if (!res.ok) die(`could not add '${name}': ${res.validation.error ?? "validation failed"}`);
+    ok(`added ${accent(name)} (${res.validation.latencyMs}ms, model ${res.validation.model}${opts.key ? ", BYOK" : ", keyless"}) \u2192 active pool`);
   });
   routers.command("use <slugs...>").description("set the active router pool (ids must be added first)").action((slugs) => {
     const { applied, unknown } = useRouters(slugs);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oriro/orirocli",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "description": "ORIRO — a free, on-device-friendly terminal AI agent. Built on the Pi agent harness (used as a library).",
   "type": "module",
   "bin": {

package/skills/21stdev/SKILL.md

@@ -0,0 +1,64 @@
+---
+provider: ORIRO.ai
+copyright: Copyright (c) 2026 ORIRO.ai
+watermark: ORIRO
+disable-model-invocation: true
+name: 21stdev
+description: 21st.dev "Magic" MCP — generate, refine, and find UI components (and brand logos) from natural language, pulling from the 21st.dev component library. Activate when the user invokes `/21stdev`, says "21st", "magic component", "build me a UI component", "get a component", "component inspiration", or wants a ready-made React/Tailwind component or a brand logo as JSX/SVG. ALWAYS pair with `oriro-ui-2026` (the version-locked 2026 stack + rich-dark rules) for ORIRO work — Magic generates the raw component, oriro-ui-2026 governs how it must look and which libraries are allowed.
+---
+
+# /21stdev — 21st.dev Magic MCP
+
+The Magic MCP server (`@21st-dev/magic`, repo `github.com/21st-dev/magic-mcp`) turns a
+natural-language description into a real, copy-ready UI component sourced from the
+21st.dev library, and can refine an existing component or fetch brand logos as
+JSX/TSX/SVG. It is a **dev-time tool** — it writes component *code* into the editor;
+nothing it produces calls an external service at runtime.
+
+## When to use
+- "Build me a `<pricing table / hero / bento grid / testimonial / navbar>`"
+- "Give me inspiration / variants for a component"
+- "Refine / polish this component" (improve an existing one)
+- "Get the `<company>` logo as a React component / SVG"
+
+## Wiring (already done in `oriro/.mcp.json`)
+Server is registered as **`magic`** (Windows-safe `cmd /c npx -y @21st-dev/magic@latest`),
+with the API key passed via env (`API_KEY=${TWENTY_FIRST_API_KEY}`) — never committed.
+To activate: set `TWENTY_FIRST_API_KEY` (key from https://21st.dev/magic/console) and
+restart Claude Code so the MCP server loads. It is wired in `oriro/` only; to use it in
+another project, add the same block to that project's `.mcp.json` or register at user
+scope with `claude mcp add -s user`.
+
+## How to call it
+Once the server is running its tools are **deferred** — discover them first with
+`ToolSearch` (query `"magic"` or `"21st"`), then call. Expected tools (prefix
+`mcp__magic__`):
+- `21st_magic_component_builder` — generate a new component from a description (the `/ui` action).
+- `21st_magic_component_inspiration` — fetch component ideas/variants/preview from 21st.dev.
+- `21st_magic_component_refiner` — improve/redesign an existing component you point it at.
+- `logo_search` — return a brand logo as JSX/TSX/SVG (SVGL).
+
+If a name differs once loaded, trust the ToolSearch result over this list.
+
+## ORIRO rules when using the output (non-negotiable)
+1. **Pair with `oriro-ui-2026`.** Magic's output is a starting point, not the final
+   look. Conform it to the 2026 stack: Motion/`motion`, Tailwind, shadcn-owned
+   primitives, rich-dark surfaces (never `#000`), distinctive self-hosted display
+   font (never Inter/Roboto). Strip anything that adds a paid dependency or a runtime
+   external call.
+2. **OR-FREE-FOREVER holds.** This tool is fine because it is build-time: the generated
+   component is plain React/Tailwind that ships **key-free**, with no runtime call to
+   21st.dev or any paid API. Never wire a generated component to a paid runtime service
+   or store a key client-side. The 21st.dev key is a *developer* credential only.
+3. **Respect frozen UI files.** Do not paste generated components into a
+   frozen UI file and push straight to prod. Build → deploy with no traffic → the owner
+   flips prod traffic. Generated components live in new/non-frozen files until approved.
+4. **Own the code.** Copy the generated source into the repo (like shadcn/MagicUI) —
+   do not add a runtime dependency on the Magic service.
+5. **Verify by real run.** A component is "done" only after a real staging run + eyeball,
+   not when it type-checks (per oriro-ui-2026 quality gates).
+
+## Quick flow
+1. `ToolSearch "magic"` → load the builder/refiner/inspiration/logo tools.
+2. Describe the component precisely (purpose, content, states, dark-mode, responsive).
+3. Take the output → conform to `oriro-ui-2026` → place in a new file → stage-deploy.