@sangyaahub/pi-marg 1.0.1 → 1.0.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sangyaahub/pi-marg",
-  "version": "1.0.1",
+  "version": "1.0.4",
   "description": "A governed, model-routed development path for Pi Agent and Oh My Pi.",
   "type": "module",
   "license": "MIT",

package/scripts/install.sh

@@ -71,4 +71,4 @@ if [[ "${runtime}" == "omp" || "${runtime}" == "both" ]]; then
   omp plugin install --scope user pi-marg@pi-marg-marketplace
 fi
 
-echo "PiMarg v1.0.1 installed for ${runtime}. Start a fresh runtime session, then run /pi-marg."
+echo "PiMarg v1.0.4 installed for ${runtime}. Start a fresh runtime session, then run /pi-marg."

package/scripts/validate.sh

@@ -14,10 +14,38 @@ done
 
 bun -e '
   import { existsSync } from "node:fs";
+  const isMapping = (value) =>
+    value !== null && !Array.isArray(value) && typeof value === "object";
+
+  function assertNpmPublishWorkflow(workflow, path) {
+    const publish = workflow.jobs.publish;
+    const steps = publish?.steps;
+    const setupNode = steps?.find((step) => step?.uses === "actions/setup-node@v7");
+    const commands = steps?.map((step) => step?.run).filter(Boolean) ?? [];
+
+    if (
+      !isMapping(workflow.on) ||
+      !("workflow_dispatch" in workflow.on) ||
+      workflow.permissions?.contents !== "read" ||
+      workflow.permissions?.["id-token"] !== "write" ||
+      !isMapping(publish) ||
+      publish.if !== "github.ref == \u0027refs/heads/main\u0027" ||
+      publish.environment !== "npm-publish" ||
+      publish["runs-on"] !== "ubuntu-latest" ||
+      !Array.isArray(steps) ||
+      setupNode?.with?.["node-version"] !== 24 ||
+      setupNode?.with?.["registry-url"] !== "https://registry.npmjs.org" ||
+      setupNode?.with?.["package-manager-cache"] !== false ||
+      !commands.includes("npm publish --provenance")
+    ) {
+      throw new Error(`Unsafe npm publishing workflow: ${path}`);
+    }
+  }
+
   const packageJson = await Bun.file("package.json").json();
   const marketplace = await Bun.file(".omp-plugin/marketplace.json").json();
   if (packageJson.name !== "@sangyaahub/pi-marg") throw new Error("Unexpected package name");
-  if (packageJson.version !== "1.0.1") throw new Error("package.json must be v1.0.1");
+  if (packageJson.version !== "1.0.4") throw new Error("package.json must be v1.0.4");
   if (packageJson.license !== "MIT") throw new Error("package.json must declare MIT");
   if (packageJson.author !== "Sangyaa") throw new Error("Unexpected package author");
   if (!packageJson.keywords?.includes("pi-package")) throw new Error("Pi catalog keyword is missing");
@@ -60,6 +88,21 @@ bun -e '
       throw new Error(`Invalid skill frontmatter: ${path}`);
     }
   }
+  for await (const path of new Bun.Glob(".github/workflows/*.{yml,yaml}").scan(".")) {
+    const text = await Bun.file(path).text();
+    const workflow = Bun.YAML.parse(text);
+    if (
+      !isMapping(workflow) ||
+      typeof workflow.name !== "string" ||
+      !("on" in workflow) ||
+      !isMapping(workflow.jobs)
+    ) {
+      throw new Error(`Invalid GitHub Actions workflow structure: ${path}`);
+    }
+    if (path === ".github/workflows/npm-deploy.yml") {
+      assertNpmPublishWorkflow(workflow, path);
+    }
+  }
   for await (const path of new Bun.Glob("**/*").scan({ cwd: ".", onlyFiles: true })) {
     if (path === "scripts/validate.sh") continue;
     if (/\.(?:png|jpe?g|gif|webp)$/i.test(path)) continue;

package/skills/auto-mode-router/SKILL.md

@@ -10,7 +10,7 @@ Turn a user request into one controlled workflow.
 1. Read [intake-and-state.md](references/intake-and-state.md) and complete the intake stages in order.
 2. After the user selects mode 1–4, read [routing-matrix.md](references/routing-matrix.md) and select exactly one primary skill spine.
 3. Read [session-ledger.md](references/session-ledger.md), create the neutral Markdown ledger, and identify the selected spine's authoritative planning artifact.
-4. Read [models-and-tools.md](references/models-and-tools.md). Call `auto_model_route` with `action: catalog` and the confirmed work type, present the live choices, and save each required A/B/C/D selection. The runtime rejects A=C and B=D.
+4. Read [models-and-tools.md](references/models-and-tools.md). Call `auto_model_route` with `action: catalog` and the confirmed work type, present the live choices, and save each required A/B/C/D selection. The runtime rejects A=C and B=D. Then save two distinct runtime-only recovery models with `action: select_fallback`: high first, low second.
 5. Call `auto_runtime_status`. If it reports `OMP`, read [native-omp-runtime.md](references/native-omp-runtime.md); if it reports `Pi`, read [native-pi-runtime.md](references/native-pi-runtime.md). Record which advisor, task, review, checkpoint/rewind, code-intelligence, debugger, browser/desktop, security, and memory routes are actually available.
 6. For work types 2–6, load `codegraph-first` and pass its bootstrap gate before making repository-wide architecture or impact claims. CodeGraph owns those claims when available. LSP, AST, compiler, and repository-native tools may handle precise operations; missing CodeGraph must be recorded rather than concealed behind broad grep output.
 7. Load `auto-mode-addons` only for requested or configured Ponytail, Hindsight, language-specific, or cost-control support. An add-on never becomes a second workflow spine.

package/skills/auto-mode-router/references/intake-and-state.md

@@ -18,11 +18,14 @@ Ask one intake stage at a time. A clear user prompt can support a proposed class
 
 ## Stage 1 — work context
 
-Ask first:
+Ask first with numbered options:
 
 > Is this for your job/client, or is it personal work?
+>
+> 1. Job/client
+> 2. Personal
 
-Record exactly one:
+Record exactly one canonical value (`job-client` or `personal`); numbering is presentation-only:
 
 - `job-client`: Do not add Sangyaa branding, name, logo, metadata, footer, or promotional language. Use the employer/client/project brand already in scope.
 - `personal`: Existing project branding wins. Sangyaa branding is opt-in, never automatic.
@@ -58,6 +61,14 @@ Ask:
 
 Call `auto_model_route` with `action: catalog` and the confirmed work type. Present only selectors returned by the tool; do not type a remembered model ID.
 
+Catalog presentation is provider-first:
+
+1. Show **every** authenticated provider as numbered options `1.`, `2.`, … (including Devin when present). Never omit a logged-in provider and never curate down to Claude/Codex/Cursor only.
+2. After the user picks a provider, call `auto_model_route` again with the same work type and `provider=<name>` so the tool lists **every** model for that provider as numbered `1.`, `2.`, …
+3. Ask the user with those numbered labels. If the option UI cannot fit the full list, paste the numbered list into the question text and accept the number or exact selector.
+
+Interactive `/pi-marg` uses the same provider → model two-step with numbered labels.
+
 The four roles are:
 
 - A — thinking/discovery using a current Claude Fable/Opus, OpenAI Astra/Sol, or Grok 4.6-or-newer frontier model.
@@ -67,7 +78,9 @@ The four roles are:
 
 Ask only for stages required by the current work type. Work types 2–3 normally use A → C → B → D. Type 4 uses A → B → D and adds C only for a non-trivial plan. Types 1, 6, and 7 use A → C. Type 5 uses A → C for review and adds B → D when fixes are authorized.
 
-Use `action: select` for each answer. The active adapter saves exact selectors in session state and immediately activates the selected runtime model. Native `devin/swe-*` selectors behave like other models. An external Devin session requires `post-web` approval before creation.
+Use `action: select` for each answer with the **exact selector** string (for example `devin/swe-2`), not the display number alone. The active adapter saves exact selectors in session state and immediately activates the selected runtime model. Native `devin/swe-*` selectors behave like other models. An external Devin session requires `post-web` approval before creation.
+
+After the stage models, choose two distinct authenticated runtime models from the same live catalog: a strong **high** backup and an economical **low** backup. Save them with `action: select_fallback`. Do not choose an external-agent route as a backup because automatic recovery requires `setModel` in the current session.
 
 ## Stage 5 — native runtime and supporting capabilities
 
@@ -98,6 +111,7 @@ type: 1..7
 mode: 1..4
 spine: compound-engineering | superpowers | gsd | none
 models: A=<selector> B=<selector|n/a> C=<selector> D=<selector|n/a>
+fallbacks: high=<runtime-selector> low=<different-runtime-selector> active=<none|high|low|exhausted>
 runtime: advisor=<off|available|on|unavailable> orchestration=<serial|task|workflowz> checkpoint=<off|available|used>
 addons: ponytail=<off|lite|full> memory=<off|local|hindsight-recall|hindsight-retain> language=<names|none> cost=<economy|balanced|quality>
 verification: tests=<planned|n/a> dap=<planned|n/a> ui=<browser|desktop|n/a> security=<planned|n/a>

package/skills/auto-mode-router/references/models-and-tools.md

@@ -4,6 +4,8 @@
 
 `auto_model_route` builds its catalog from the active runtime every time it is called: Pi uses scoped or authenticated available models, while OMP uses `ctx.models.list()`. Exact versions come from that live registry, not this document.
 
+Catalog text is compact and provider-grouped. Call `action: catalog` first to list every provider with counts, then call again with `provider=<name>` to list every model for that provider as numbered options. Both OMP and Pi adapters accept the optional `provider` parameter. Never present a hand-curated Claude/Codex/Cursor subset when other authenticated providers (including Devin) are in the catalog.
+
 | Stage | Purpose | Eligible live groups | Normal agent and tools |
 |---|---|---|---|
 | A | Thinking/discovery | Claude Fable/Opus; OpenAI Astra/Sol; current Grok 4.6-or-newer | strategy skill; detected CodeGraph/LSP/AST tools, web for current facts; no implementation writes |
@@ -15,6 +17,15 @@ The extension compares normalized provider-independent identities, so the same m
 
 OMP stage agents and the sequential Pi flow both inherit the model activated in the main session. Before each stage, call `auto_model_route` with `action: activate`; never assume the model remained selected after a manual model change.
 
+## Automatic usage-limit recovery
+
+Save two distinct authenticated runtime models after A/B/C/D selection:
+
+- **high** — the strongest practical recovery model; frontier fits rank first;
+- **low** — an economical recovery model; execution fits rank first.
+
+The runtime waits for its own retry cycle to settle. If a direct model or detected model-execution route (including external Devin and subagents) still ends with a positively identified usage-limit/quota exhaustion error, PiMarg activates high, then low if the active high model itself fails, records and deduplicates failures, notifies the user, and resumes the same stage from the last safe point. It never treats an ordinary implementation error or temporary throttle as quota exhaustion and never re-enters a failed selector within the same activated stage.
+
 Intake and lessons use the runtime's inexpensive/default model when configured. Native `devin/swe-*` entries are ordinary runtime models. A separate external Devin option appears only when a Devin tool is detected and returns a delegation instruction.
 
 ## Cross-family review
@@ -61,7 +72,9 @@ Call `auto_runtime_status` during intake. Follow [native-omp-runtime.md](native-
 - Security: detected `security_scan` when available, otherwise repository-native dependency audit, secret scan, SAST rules, configuration review, and source-to-sink inspection. Validate findings before changing code.
 - Current business/market facts: web research with source links; keep external posting disabled until approved.
 
-## Provider recommendation for the user's accounts
+## Provider recommendation (optional ranking only)
+
+These names are soft ranking hints. They are never required. PiMarg always picks up the live authenticated catalog for whoever is using it.
 
 - Cursor Composer or a zero-metered Cursor route: economical B/D work when present in the live catalog.
 - Claude Fable/Opus: A/C product thinking, architecture, specification, and cross-family review.
@@ -71,4 +84,4 @@ Call `auto_runtime_status` during intake. Follow [native-omp-runtime.md](native-
 - Latest matching Grok 4.6-or-newer model: A/C independent frontier analysis or current web/social context.
 - Native Devin SWE: B/D when exposed by the runtime. External Devin: bounded delegation with acceptance criteria and a quota limit.
 
-Use Pi or OMP's own authentication and model UI as the authority for what the account can actually access.
+Use Pi or OMP's own authentication and model UI as the authority for what the account can actually access. If the catalog is empty, promote subscription/provider setup (`/login` on OMP, or Pi credentials) before continuing. Present required stages in ascending A/B/C/D order.

package/skills/auto-mode-router/references/session-ledger.md

@@ -48,6 +48,11 @@ Record:
 - Stage C model: <exact live selector>
 - Stage D model: <exact live selector or n/a>
 - Model separation: A != C; B != D
+- High backup model: <exact live runtime selector>
+- Low backup model: <different exact live runtime selector>
+- Automatic failover: idle | high-active | low-active | exhausted
+- Last failover: <failed selector -> activated selector at timestamp, or none>
+- Recovery durability warning: <none or session ledger write failure that requires re-selection after restart>
 - CodeGraph: n/a | pending | ready | blocked
 - Runtime: advisor=<off|available|on|unavailable>; orchestration=<serial|task|workflowz>; checkpoint=<off|available|used>
 - Add-ons: Ponytail=<setting>; memory=<off|local|hindsight-recall|hindsight-retain>; language skills=<names or none>; cost=<posture>