@rosetears/aili-pi 0.1.6 → 0.1.8

package/README.md

@@ -49,11 +49,15 @@ The package does not write global AILI resources during extension load. After re
 
 That command creates or updates only the AILI marker block in `~/.pi/agent/APPEND_SYSTEM.md` and installs the 19 packaged profiles at `~/.pi/agent/agents/aili/`. The marker block is a Pi-native governance derivation of the pinned `aili-workflows` global AGENTS template: it retains instruction precedence, untrusted-content handling, approval/evidence/verification discipline, bounded delegation, project-rule precedence, and user-language output, while excluding OpenCode-only control planes. It preserves unrelated prompt content, rejects malformed markers or an unowned profile collision, and reports stale profiles without pruning them.
 
-## Rem Cyberdeck
+## Rose Cyberdeck
 
-The package supplies the dark `rem-cyberdeck` theme plus three additional Pi Extensions: a Rem header, Sakura Matrix animation, and Zentui footer/editor surface. Select it through Pi's `/settings` theme selector or set `"theme": "rem-cyberdeck"` in `~/.pi/agent/settings.json`. The visual extensions are derived from `pi-sakura-cyberdeck` at revision `165a1f8011a12a58a6409b56b8a6c0416cd9b589` under MIT; see `THIRD_PARTY_NOTICES.md` and `notices/pi-sakura-cyberdeck-NOTICE.txt`.
+The package supplies the dark `rose-cyberdeck` theme plus three additional Pi Extensions: a Rose header, Rose Shimmer + four-row Rose Code Rain working surface, and Zentui footer/editor surface. Select it through Pi's `/settings` theme selector or set `"theme": "rose-cyberdeck"` in `~/.pi/agent/settings.json`. The visual extensions are adapted from `pi-sakura-cyberdeck` at revision `165a1f8011a12a58a6409b56b8a6c0416cd9b589` under MIT; see `THIRD_PARTY_NOTICES.md` and `notices/pi-sakura-cyberdeck-NOTICE.txt`.
 
-Matrix keeps the pinned sparse waterfall rhythm and default `density=0.65`, while bounded ultra-wide tracks are spread across the complete terminal-cell width instead of truncating to a left prefix. `/sakura-matrix status` reports its settings; use `/sakura-matrix density <0.45-0.95>` for an explicit density preference. The `✦ REASONING` trail uses the same pinned Sakura pastel gradient.
+Rose Code Rain retains the pinned sparse waterfall geometry and default `density=0.65`, while bounded ultra-wide tracks are spread across the complete terminal-cell width instead of truncating to a left prefix. `/rose-matrix status` reports its settings; use `/rose-matrix density <0.45-0.95>` or `/rose-matrix appearance <auto|dark|light>` for explicit preferences. `/sakura-matrix` remains a deprecated compatibility alias. The `✦ REASONING` trail uses the Rose-to-ice gradient.
+
+### Migrating from Rem/Sakura names
+
+Replace an exact legacy `rem-cyberdeck` theme token with `rose-cyberdeck` through `/settings` or `~/.pi/agent/settings.json`; when using a `light/dark` pair, replace only the legacy side. Existing `sakura-cyberdeck-matrix.json` and `rem-cyberdeck-zentui.json` configuration files are read compatibly and retained. Legacy product names below appear only for migration or upstream attribution.
 
 Zentui enables its experimental fixed-bottom editor by default when the installed Pi TUI exposes the required private layout capabilities. If capability detection or installation fails, it keeps Pi's native editor and emits a warning. The feature uses the terminal alternate screen; its default mouse scrolling can interfere with terminal text selection and tmux scrollback. Use Zentui's `/zentui` settings to disable the fixed editor or mouse scrolling. Zentui hides `pi-cache-stats` by default so the one canonical Codex weekly quota remains visible; explicitly re-enabled cache stats follow quota in the bounded footer.
 
@@ -62,18 +66,18 @@ Zentui enables its experimental fixed-bottom editor by default when the installe
 - `/ideate`, `/define`, `/build`, `/ship`: the four AILI delivery modes.
 - `/local-review`: a standalone local audit, not a fifth lifecycle mode.
 - `/aili-doctor` or `/aili-doctor --json`: human or machine-readable health evidence.
-- `/perm`: upstream `pi-permission-modes` control for `Default`, `Plan`, `Build`, and `YOLO`.
+- `/perm`: the revision-bound `pi-permission-modes@2.2.0` adaptation controls `Default`, `Plan`, `Build`, and `YOLO`.
 - `Alt+M`: upstream mode-cycle shortcut.
 - `/aili-install-global-resources`: explicit installation/update of marker-owned global ROSE and AILI-role resources.
 
-`pi-permission-modes` owns mode persistence, prompts, and sandbox behavior. A Linux disposable fixture verified its stock Build profile through installed Bubblewrap, while an incompatible Git-worktree fixture visibly fell back to confirmation. This is not an isolation guarantee. `YOLO` is an upstream unrestricted mode and must be treated accordingly.
+The `pi-permission-modes@2.2.0` baseline owns mode persistence, prompts, and sandbox behavior. AILI carries one hash-locked matcher adaptation so `*` and `?` also match line terminators; this prevents multiline Bash/heredoc text from falling through YOLO's `"*": "allow"` rule while retaining custom ask/deny and fail-closed fallback behavior across every pattern-map surface. A Linux disposable fixture verified the stock Build profile through installed Bubblewrap, while an incompatible Git-worktree fixture visibly fell back to confirmation. This is not an isolation guarantee. `YOLO` remains an unrestricted, unsandboxed mode and must be treated accordingly.
 
 ## Native integrations and side effects
 
 - `pi-web-access@0.13.0` provides its complete upstream web-search, content-fetch, curator, clone/PDF/video, and bundled-skill surface. Its provider fallback, network traffic, config/credential paths, clone cache, temporary curator service, downloads, and optional browser-cookie access are upstream behavior; inspect its tool requests and configuration before use.
 - `pi-quota-status@0.3.0` is enabled by default. It may maintain `~/.pi/agent/pi-quota-status/state.json`; `/quota config` creates its configuration template. Zentui displays exactly one weekly value as `codex <percent> <reset>`, preferring explicit `Wk` data and treating the dependency's current `5h`-labeled primary value only as a compatibility fallback when weekly is absent.
-- `pi-permission-modes@2.2.0` provides the permission UI and sandbox degradation behavior above. AILI does not retain `/aili-mode` or `Ctrl+Shift+Alt+A` as competing controls.
-- `@agwab/pi-subagent@0.4.8` owns the generic `subagent` tool, child spawn, cancellation, durable run/artifact lifecycle, bounded parallel fan-out, async actions, worktrees, external `cwd`, and sandbox options. The 19 `aili.<role>` profiles are optional named agents; generic or agentless runs do not use an AILI-only result schema. AILI adds a bounded requested `Agent:`/`Agents:` heading above upstream run-call rendering and injects an immutable credential-path guard; child Pi processes load the ambient AILI `pi-permission-modes` registration exactly once. The upstream runner excludes recursive `subagent` exposure inside workers.
+- `pi-permission-modes@2.2.0` provides the permission UI and sandbox degradation behavior above through AILI's exact-source adaptation. The only semantic source change is line-terminator-safe shared glob matching; `upstream/pi-permission-modes.lock.json` records the baseline and adapted hashes. AILI does not retain `/aili-mode` or `Ctrl+Shift+Alt+A` as competing controls.
+- `@agwab/pi-subagent@0.4.8` owns the generic `subagent` tool, child spawn, cancellation, durable run/artifact lifecycle, bounded parallel fan-out, async actions, worktrees, external `cwd`, and sandbox options. On Pi 0.81.1, AILI routes ordinary omitted/`auto` calls to `headless` because the pinned inline runner calls removed SDK factories; explicit `inline` stops before model startup with a compatibility diagnostic. Explicit `headless`/`tmux`, visible auto, sandbox auto, lifecycle actions, and caller options remain upstream paths. A mixed parallel auto call that combines visible tasks with ordinary uncontained tasks is rejected rather than silently sending one class through broken inline. The 19 `aili.<role>` profiles are optional named agents; generic or agentless runs do not use an AILI-only result schema. AILI also adds a bounded requested `Agent:`/`Agents:` heading and an immutable credential-path guard. The upstream runner excludes recursive `subagent` exposure inside workers.
 - `pi-cache-optimizer@2.6.18` provides `/cache-optimizer`, provider cache diagnostics, cache statistics, and prompt-cache optimization. It may maintain `~/.pi/agent/pi-cache-optimizer-stats.json`; `/cache-optimizer fix` is interactive and is the only command that may propose editing `models.json`.
 - `pi-markdown-preview@0.10.1` provides `/preview`, `/preview-browser`, `/preview-pdf`, `/preview-clear-cache`, and the `preview_export` tool. Terminal/browser previews require a Chromium executable; PDF export additionally requires Pandoc and a LaTeX engine.
 - `@narumitw/pi-lsp@0.25.0` provides language-agnostic `lsp_diagnostics`, `lsp_fix`, and `/lsp`. It supports routes for C/C++, Python, CSS/SCSS, JavaScript/TypeScript, Go, Rust, Java, Kotlin, Bash, YAML, Terraform, and other languages. It does not download language servers; install the required commands separately and configure project routes in `.pi/pi-lsp.json` or user routes in `~/.pi/agent/pi-lsp.json`.
@@ -93,7 +97,7 @@ When unavailable, runtime and doctor output use explicit `SKIP`/`WARN` results a
 
 ## Security boundary
 
-AILI injects a non-removable guard that denies standard Pi file-tool and parsed-bash access to credential, authentication, and private-key paths, including from an external `cwd`, a YOLO permission mode, or a caller-supplied child extension list. Child Pi processes load the ambient AILI `pi-permission-modes` registration exactly once, so vendor permission prompts and sandbox behavior remain active; headless confirmation requests fail closed. The guard does not make arbitrary third-party extension code safe: extensions remain trusted code and may have direct process authority. Neither AILI nor Pi provides a universal OS sandbox or containment: trusted extensions, user-authority processes, ambient network access, and filesystem races remain in the user trust domain. Inspect exact approval targets and do not put credentials in task text.
+AILI injects a non-removable guard that denies standard Pi file-tool and parsed-bash access to credential, authentication, and private-key paths, including from an external `cwd`, a YOLO permission mode, or a caller-supplied child extension list. Child Pi processes load the ambient AILI permission-mode registration exactly once, so adapted permission prompts and sandbox behavior remain active; headless confirmation requests fail closed. The guard does not make arbitrary third-party extension code safe: extensions remain trusted code and may have direct process authority. Neither AILI nor Pi provides a universal OS sandbox or containment: trusted extensions, user-authority processes, ambient network access, and filesystem races remain in the user trust domain. Inspect exact approval targets and do not put credentials in task text.
 
 Use `subagent` lifecycle actions (`status`, `logs`, `wait`, `interrupt`, `mark-background`, and `reconcile`) to inspect durable async work. Upstream fan-out is version-bounded rather than capped by AILI at two; background completion is not evidence until inspected. Subagents are a benefit-based way to improve execution efficiency and preserve the main agent's context: the main agent owns decisions, scope, integration, and final verification, while bounded discovery, implementation, testing, or other execution may be delegated when specialist, parallelism, or context-isolation benefits outweigh orchestration cost. Direct parent work remains valid when delegation has no clear net benefit; no subagent call is required to unlock file mutation. Provider/model behavior still depends on the configured Pi environment.
 
@@ -101,6 +105,7 @@ Use `subagent` lifecycle actions (`status`, `logs`, `wait`, `interrupt`, `mark-b
 
 - `upstream/aili-workflows.lock.json` pins the exact canonical 64-skill/471-file snapshot.
 - `upstream/opencode-global-agents.lock.json` pins the global AGENTS source revision/hash and documents its Pi-native derivation.
+- `upstream/pi-permission-modes.lock.json` pins the exact upstream and adapted permission runtime files and semantic diff.
 - `manifests/skill-compatibility.json` records one compatibility state per skill.
 - `manifests/roles.json` records the 19 generated Pi role profiles.
 - `manifests/provenance.json`, `manifests/sbom.json`, and `THIRD_PARTY_NOTICES.md` record adapted/reference sources and the exact npm lock inventory.
@@ -119,6 +124,9 @@ npm run validate:release
 - **Package install failure:** keep the reported Pi/AILI states distinct. Retry the printed `pi install` command after fixing the cause; do not automatically remove a pre-existing package.
 - **Doctor is non-pass:** inspect the exact `ERROR`, `WARN`, `SKIP`, or `UNVERIFIED` component. Missing optional packs are not core execution success.
 - **Permission shortcut does nothing:** use `/perm`; terminal multiplexers may consume `Alt+M`.
+- **YOLO still asks for multiline Bash:** confirm the loaded Package contains the adapted permission runtime with `npm run verify:permission-modes`; do not work around it by granting every distinct script for the session.
+- **Subagent reports the inline SDK `reading 'create'` failure:** omit `backend` or use `backend: "headless"`; explicit inline is unsupported for the pinned Pi 0.81.1 / subagent 0.4.8 pair.
+- **Sandboxed subagent cannot authenticate or reach its model:** `sandbox:true` is deny-all network, and model-backed sandbox calls must allow the exact provider endpoint while preserving credential protections. This is separate from default-backend compatibility.
 - **Global resources are non-pass:** run `/aili-install-global-resources` only after reviewing the exact `~/.pi/agent/` targets. A malformed marker or an unowned role collision intentionally leaves files unchanged.
 - **Offline use:** the installed Package embeds the pinned skills and does not fetch `aili-workflows` at runtime. Its Pi-managed npm lifecycle synchronizes only pre-existing same-name global skills from that embedded fixed snapshot. First-time Pi/package installation still requires the relevant package sources.
 

package/THIRD_PARTY_NOTICES.md

@@ -22,18 +22,18 @@ This distribution is MIT-licensed. The following adapted sources and locked deve
 - License: MIT
 - Source files: src/index.ts, src/api.ts, src/runners/headless-model.ts, src/artifacts/result.ts
 - Reused symbols/patterns: subagent tool renderCall, runSubagent API, headless lifecycle, artifact envelope
-- Local changes: AILI registers the full pinned upstream subagent tool schema, prepends a sanitized bounded requested-Agent heading to upstream run-call rendering, injects a non-removable credential guard, and relies on the ambient AILI pi-permission-modes registration exactly once in each child; no upstream source is copied
+- Local changes: AILI registers the full pinned upstream subagent tool schema, prepends a sanitized bounded requested-Agent heading, injects a non-removable credential guard, normalizes ordinary omitted/auto runs to headless for the Pi 0.81.1 compatibility window, and rejects explicit inline before model startup; no upstream source is copied
 
 ## pi-permission-modes
 
-- Status: dependency
+- Status: adapted
 - Source: https://github.com/wynainfo/pi-permission-modes.git
 - Revision: 23d65d10a53b67043cae42322acf9044d6edb196
 - Version: 2.2.0
 - License: MIT
-- Source files: src/index.ts, permission-mode.defaults.json
-- Reused symbols/patterns: Default/Plan/Build/YOLO, /perm, Alt+M, sandbox degradation
-- Local changes: AILI initializes the pinned upstream extension and does not retain a competing AILI mode command or shortcut
+- Source files: src/vendor/pi-permission-modes/index.ts, src/vendor/pi-permission-modes/resolve.ts, upstream/pi-permission-modes.lock.json, licenses/pi-permission-modes-MIT.txt
+- Reused symbols/patterns: Default/Plan/Build/YOLO, /perm, Alt+M, shared permission pattern matcher, sandbox degradation
+- Local changes: AILI's generated adapted entry redirects unchanged sibling modules to the exact 2.2.0 dependency; the owned resolve.ts compiles permission globs with RegExp dotAll so * and ? include ECMAScript line terminators; the exact upstream and adapted files are hash-locked and drift-checked
 
 ## pi-quota-status
 
@@ -99,10 +99,10 @@ This distribution is MIT-licensed. The following adapted sources and locked deve
 - License: MIT
 - Source files: extensions/header/index.ts, extensions/matrix/index.ts, extensions/zentui/**
 - Reused symbols/patterns: header, matrix animation, Zentui footer, fixed editor compositor
-- Local changes: registered as three additional Pi Package Extensions; header avatar loads the supplied Rem asset; Zentui shell palette uses Rem while Matrix and the reasoning trail retain the upstream Sakura palette; overflowing Matrix tracks are sampled deterministically across the complete terminal width while retaining the 96-track budget and ordinary-width behavior; relative import specifiers and session lifecycle event are adapted for this package's NodeNext TypeScript contract
+- Local changes: registered as three additional Pi Package Extensions; Rose header loads a package-owned renamed artwork asset without changing upstream identity; Rose Shimmer, Rose Code Rain, and Zentui use the Rose-owned palette and gradient; overflowing Matrix tracks remain deterministic across the complete terminal width with the 96-track budget, while each rain row receives a structural blank-row repair; relative import specifiers and session lifecycle event are adapted for this package's NodeNext TypeScript contract
 
 ## npm dependency inventory
 
 The exact 424-entry package-lock inventory, versions, integrity values, dependency scope, and declared licenses is recorded in `manifests/sbom.json`.
 
-Runtime dependencies are initialized through the single AILI Extension entry; no third-party source tree is copied into this package.
+Runtime dependencies are initialized through the single AILI Extension entry. Package-owned third-party adaptations are copied only where their provenance sourceFiles explicitly name repository paths.

package/extensions/header/index.ts

@@ -1,6 +1,8 @@
 import { readFileSync } from "node:fs";
+import { getAgentDir, type ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { fileURLToPath } from "node:url";
-import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { join } from "node:path";
+import { legacyRoseThemeGuidanceFromSettings } from "../../src/runtime/rose-theme.js";
 
 const RESET = "\x1b[0m";
 const BOLD = "\x1b[1m";
@@ -26,7 +28,7 @@ function gradient(text: string, from: RGB, to: RGB, bold = false): string {
   }).join("");
 }
 
-const ANIME_ART = readFileSync(fileURLToPath(new URL("../../src/runtime/rem-head.txt", import.meta.url)), "utf8").trimEnd().split("\n") as readonly string[];
+const ROSE_ART = readFileSync(fileURLToPath(new URL("../../src/runtime/rose-head.txt", import.meta.url)), "utf8").trimEnd().split("\n") as readonly string[];
 
 function getAvailableRows(tui: unknown): number {
   try {
@@ -38,15 +40,15 @@ function getAvailableRows(tui: unknown): number {
   }
 }
 
-function renderHeader(width: number, availableRows = 0): string[] {
+export function renderRoseHeader(width: number, availableRows = 0): string[] {
   if (width <= 0) return [];
 
-  const sakura: RGB = [136, 184, 255];
-  const peach: RGB = [125, 228, 255];
-  const lavender: RGB = [188, 167, 255];
-  const sky: RGB = [214, 244, 255];
-  const telemetry = "◈  REM CYBERDECK  ◈";
-  const artWidth = Math.max(...ANIME_ART.map((line) => [...line].length));
+  const blue: RGB = [136, 184, 255];
+  const cyan: RGB = [125, 228, 255];
+  const violet: RGB = [188, 167, 255];
+  const ice: RGB = [214, 244, 255];
+  const telemetry = "◈  ROSE CYBERDECK  ◈";
+  const artWidth = Math.max(...ROSE_ART.map((line) => [...line].length));
   const visibleArtWidth = Math.min(width, artWidth);
   const artPad = " ".repeat(Math.max(0, Math.floor((width - visibleArtWidth) / 2) - 2));
   // Keep the divider visually subordinate: inset it symmetrically from the artwork.
@@ -58,12 +60,12 @@ function renderHeader(width: number, availableRows = 0): string[] {
   const telemetryWidth = [...visibleTelemetry].length;
   const telemetryPad = " ".repeat(Math.max(0, Math.min(width - telemetryWidth, Math.floor((width - telemetryWidth) / 2) + 1)));
 
-  const art = ANIME_ART.map((line) => {
+  const art = ROSE_ART.map((line) => {
     const clipped = [...line].slice(0, visibleArtWidth).join("");
-    return `${artPad}${gradient(clipped, sakura, sky)}`;
+    return `${artPad}${gradient(clipped, blue, ice)}`;
   });
 
-  const visualHeight = ANIME_ART.length + 3; // artwork + gap + divider + label
+  const visualHeight = ROSE_ART.length + 3; // artwork + gap + divider + label
   const extraTopPadding = Math.max(0, Math.floor((availableRows - visualHeight) / 2) - 1);
 
   return [
@@ -71,17 +73,25 @@ function renderHeader(width: number, availableRows = 0): string[] {
     "",
     ...art,
     "",
-    `${railPad}${gradient(rail, sakura, sky)}`,
-    `${telemetryPad}${gradient(visibleTelemetry, lavender, peach, true)}`,
+    `${railPad}${gradient(rail, blue, ice)}`,
+    `${telemetryPad}${gradient(visibleTelemetry, violet, cyan, true)}`,
     "",
   ];
 }
 
-export default function sakuraCyberdeckHeader(pi: ExtensionAPI): void {
+export default function roseCyberdeckHeader(pi: ExtensionAPI): void {
+  let legacyThemeNoticeSent = false;
   pi.on("session_start", (_event, ctx) => {
     if (!ctx.hasUI) return;
+    if (!legacyThemeNoticeSent) {
+      const guidance = legacyRoseThemeGuidanceFromSettings(join(getAgentDir(), "settings.json"));
+      if (guidance) {
+        legacyThemeNoticeSent = true;
+        ctx.ui.notify(guidance, "warning");
+      }
+    }
     ctx.ui.setHeader((tui) => ({
-      render: (width) => renderHeader(width, getAvailableRows(tui)),
+      render: (width) => renderRoseHeader(width, getAvailableRows(tui)),
       invalidate() {},
     }));
   });