@tianshu-ai/tianshu 0.3.16 → 0.3.18

package/README.md

@@ -1,219 +1,297 @@
-<div align="center">
+<h1 align="center">Tianshu · 天枢</h1>
+
+<p align="center">
+  <strong>The self-hosted AI agent platform — with a real browser, a real sandbox.</strong>
+</p>
+
+<p align="center">
+  <a href="https://github.com/tianshu-ai/tianshu/actions/workflows/ci.yml"><img alt="CI" src="https://img.shields.io/github/actions/workflow/status/tianshu-ai/tianshu/ci.yml?branch=main&style=flat-square&label=CI&logo=githubactions&logoColor=white"></a>
+  <a href="https://www.npmjs.com/package/@tianshu-ai/tianshu"><img alt="npm" src="https://img.shields.io/npm/v/@tianshu-ai/tianshu?style=flat-square&logo=npm&logoColor=white"></a>
+  <a href="https://github.com/tianshu-ai/tianshu/releases"><img alt="release" src="https://img.shields.io/github/v/release/tianshu-ai/tianshu?include_prereleases&style=flat-square&logo=github&logoColor=white"></a>
+  <a href="./LICENSE"><img alt="License" src="https://img.shields.io/badge/license-Apache--2.0-blue.svg?style=flat-square"></a>
+  <a href="https://github.com/tianshu-ai/tianshu/stargazers"><img alt="stars" src="https://img.shields.io/github/stars/tianshu-ai/tianshu?style=flat-square&logo=github&logoColor=white"></a>
+  <a href="https://www.typescriptlang.org/"><img alt="TypeScript" src="https://img.shields.io/badge/TypeScript-3178C6?style=flat-square&logo=typescript&logoColor=white"></a>
+  <a href="https://nodejs.org"><img alt="Node" src="https://img.shields.io/badge/Node-22%2B-339933?style=flat-square&logo=node.js&logoColor=white"></a>
+</p>
+
+<p align="center">
+  <a href="./README.md">English</a> ·
+  <a href="./README.zh-CN.md">简体中文</a> ·
+  <a href="#-install">🚀 Install</a> ·
+  <a href="#-what-you-get">✨ What you get</a> ·
+  <a href="#-first-run--5-minutes-start-to-finish">👋 First run</a> ·
+  <a href="#️-day-2-control">🎛️ Day-2 control</a> ·
+  <a href="#️-architecture">🏗️ Architecture</a> ·
+  <a href="#️-roadmap">🗺️ Roadmap</a>
+</p>
+
+<p align="center">
+  <em>⭐ Tianshu (天枢) — the brightest star of the Big Dipper, the celestial pivot.</em>
+</p>
+
+<!--
+  TODO: drop a 1600×900+ PNG/GIF at docs/assets/hero.png
+  showing the chat UI with the sandbox exec output AND the
+  browser sidecar in one frame. Recommend either:
+    (a) agent live-editing a file with the file tree visible,
+    (b) agent driving a real Chromium tab on the right while
+        typing on the left.
+  When the file exists, the markdown below renders the image;
+  until then GitHub shows a broken-image placeholder that
+  links to the README's anchor.
+-->
+<!-- ![Tianshu — agent + sandbox + browser, side by side](docs/assets/hero.png) -->
 
-# 天枢 · Tianshu
+---
 
-**An open AI agent platform with a sidecar browser. Built in public.**
+## 🚀 Install
 
-[![CI](https://github.com/tianshu-ai/tianshu/actions/workflows/ci.yml/badge.svg)](https://github.com/tianshu-ai/tianshu/actions/workflows/ci.yml)
-[![License](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](./LICENSE)
-[![Node 22+](https://img.shields.io/badge/node-22%2B-brightgreen)](https://nodejs.org)
-[![PRs welcome](https://img.shields.io/badge/PRs-welcome-orange)](./CONTRIBUTING.md)
+### Prerequisites
 
-⭐ *Tianshu (天枢) — the brightest star of the Big Dipper, the celestial pivot.*
+| What           | Why                                                |
+|----------------|----------------------------------------------------|
+| **Node 22+**   | Runtime. Use a Node manager (`nvm` / `volta` / `asdf`); avoid system Node with `sudo`. |
+| **macOS Apple Silicon** *or* **Linux + KVM** | Sandbox layer ([microsandbox](https://github.com/microsandbox/microsandbox)) needs hardware virt. Chat surface still works elsewhere, but `exec` / browser tools won't. |
+| **An LLM API key** | Anthropic, OpenAI, or Google. Or a local model server reachable on the network. |
 
-[中文](./README.zh-CN.md) · [What it will be](#what-it-will-be) · [Why](#why) · [Quick start](#quick-start) · [Roadmap](#roadmap) · [Build log](#build-log) · [Contributing](./CONTRIBUTING.md)
+### One command
 
-</div>
+```bash
+npm install -g @tianshu-ai/tianshu@latest
+```
 
----
+Don't `sudo`. If you hit `EACCES`, switch to a Node manager that
+puts the global bin under your user directory — not a system
+folder.
 
-## Status: 0.x preview
+### Configure your provider
 
-The core loop — chat, sandbox `exec`, sidecar browser, multi-tenant
-filesystem, background workers — all works end-to-end. Build-in-public
-stays the same: every meaningful change ships as a [DEV_LOG](./docs/DEV_LOG.md)
-entry plus follow-up content on the channels below.
+```bash
+tianshu setup
+```
 
-**Hardware needed**: macOS Apple Silicon, or Linux + KVM. The sandbox
-layer (microsandbox) won't boot anywhere else; the chat surface still
-works but `exec` / browser tools will be unavailable.
+A short interactive wizard. It:
+
+1. Asks which provider to use (Anthropic / OpenAI / Google).
+2. Reads your API key with a hidden prompt.
+3. Writes `~/.tianshu/config.json` (settings) and `~/.tianshu/.env`
+   (secret).
+
+Once a model is configured, the wizard hands you over to the
+**setup agent** — an LLM-driven assistant running in the same
+terminal that can finish the rest of the configuration for
+you. It has 18 tools (`run_doctor`, `sandbox_inventory`,
+`config_write`, `plugin_enable`, `build_sandbox`,
+`use_sandbox_build`, `secret_write`, `apply_update`, ...) and
+asks for your confirmation before every state-changing call.
+Things you can ask it right now:
+
+- *"Set me up a search API key for the web-search plugin."* —
+  it'll ask which provider (Tavily / Brave / SerpAPI / ...),
+  prompt for the key, and write it via `secret_write` into
+  the right tenant's plugin config. No editing JSON by hand.
+- *"Build my sandboxes so I can use the browser."* — it
+  calls `sandbox_inventory` first to see what's already on
+  disk, then `build_sandbox` and `use_sandbox_build` to fill
+  in whatever's missing. Browser tools work the moment the
+  layered `task-runner-with-browser` snapshot is published.
+- *"Doctor's complaining about my provider — fix it."* — it
+  reads `run_doctor`, finds the offending line, and proposes
+  the specific `config_write` or `secret_write` call to fix
+  it before running anything.
+- *"Am I on the latest version?"* — it runs
+  `check_for_update` and, if you say yes, `apply_update`.
+
+You can exit anytime (type *done* / Ctrl-C) and come back
+later — the agent re-reads state from disk on each invocation.
+
+Non-interactive flavour for Docker / CI (skips the
+interactive agent, only writes the provider config):
 
-## What it will be
+```bash
+tianshu setup --non-interactive --provider=anthropic --api-key=sk-***
+```
 
-Tianshu is a self-hostable, multi-tenant **AI agent platform** built on
-[`@mariozechner/pi-agent-core`](https://www.npmjs.com/package/@mariozechner/pi-agent-core).
-The opinionated parts:
+### Start the service
 
-- 🌐 **A real Chromium sidecar per tenant** — Playwright + noVNC. The
-  agent navigates, clicks, types; you watch it live in a side panel.
-- 📦 **A real Linux sandbox per tenant** — every `exec` runs isolated.
-  Crash it, fork-bomb it, fill the disk — your host is fine.
-- 📁 **A real workspace filesystem per tenant** — the agent reads and
-  writes files; you preview them in the UI; they persist across sessions.
-- 🤖 **Background workers, not "tools"** — dispatch parallel agents onto
-  a Kanban board, watch elapsed time per task, intervene when one stalls.
-- 🏢 **Multi-tenancy from row 1** — every record carries `tenantId`.
-  Sidecars, workspaces, and worker pools are tenant-isolated.
+```bash
+tianshu start
+```
 
-A previous closed-source iteration of this idea has been running in the
-maintainer's day-to-day setup for months. This repo is the from-scratch,
-open-source rebuild.
+On macOS this installs a launchd agent
+(`~/Library/LaunchAgents/ai.tianshu.prod.plist`) that auto-starts
+at login and auto-restarts on crash. Linux systemd support is on
+the roadmap; for now, run `npm run dev` from a checkout.
 
-## Why
+Open <http://localhost:3110> and start chatting.
 
-> "What if the agent could actually do the work — in a real browser, in a
-> real shell, on real files — and you could watch it?"
+### Verify everything
 
-Most "AI chat" platforms are wrappers around a chat completions endpoint.
-Tianshu starts from the other end: the agent runtime is real software,
-the sidecar is a real browser, the sandbox is a real container. The chat
-UI is the surface, not the product.
+```bash
+tianshu doctor
+```
 
-For the long version of the motivation, see the launch post:
+Reports across 8 dimensions — runtime / version freshness / config
+files / LLM providers / network / sandbox / plugins / tenant DBs.
+Read-only. Run it anytime something feels off.
 
-- 📝 dev.to — *Three things AI agents keep getting wrong (and why I'm
-  rebuilding the platform from scratch)*
-  → <https://dev.to/tianshu_ai/three-things-ai-agents-keep-getting-wrong-and-why-im-rebuilding-the-platform-from-scratch-42p6>
-- 🎥 YouTube — *Building an AI agent platform in public — starting from
-  three pains I want to fix* → <https://youtu.be/Xw7c3JrlUVo>
+---
 
-## Quick start
+## ✨ What you get
 
-```bash
-npm install -g @tianshu-ai/tianshu@latest
+Tianshu is **a runtime, not a chatbox.** Three things make it different:
 
-tianshu setup        # interactive: pick provider, paste key, write config
-tianshu doctor       # verify everything is wired up
-tianshu start        # bootstrap the launchd service (macOS) and open the UI
-```
+🌐 **A real Chromium sidecar per tenant.** Playwright + noVNC. The agent
+navigates, clicks, types — you watch it live in a side panel, take the
+mouse back when you want to.
 
-Open <http://localhost:3110> and start chatting.
+📦 **A real Linux sandbox per tenant.** Every `exec` runs in a
+[microsandbox](https://github.com/microsandbox/microsandbox) VM. Crash
+it, fork-bomb it, fill the disk — your host is untouched.
 
-The server hosts the SPA on a single port — one process, one URL.
-Need a public hostname (Cloudflare tunnel, reverse proxy)? Set
-`server.publicUrl` in `~/.tianshu/config.json`; CLI commands will
-print that instead.
+📁 **A real per-tenant workspace.** The agent reads and writes files
+you can preview in the UI; they persist across sessions. The file
+tree is a first-class citizen, not a "tool output."
 
-### Day-2 control
+Plus:
 
-```bash
-tianshu status               # what's loaded? port? health?
-tianshu logs --follow        # tail server stdout + stderr
-tianshu restart              # bounce the server
-tianshu stop                 # bootout from launchd
-tianshu tenant list          # tenants + users + open-in-browser URLs
-tianshu update               # check for / install a newer published version
-```
+- 🤖 **Background workers, not "tools."** Dispatch parallel agents
+  onto a Kanban board; watch elapsed time per task; intervene when
+  one stalls.
+- 🏢 **Multi-tenant from row 1.** Every record carries `tenantId`.
+  Sidecars, workspaces, and worker pools are tenant-isolated.
+- 🧠 **A setup assistant that fixes things.** `tianshu setup` runs a
+  Claude/Codex-driven wizard with 18 tools: it can read your doctor
+  report, enable plugins, write config, build sandboxes, and even
+  upgrade itself. See it talk you through it in
+  [the launch video](https://youtu.be/Xw7c3JrlUVo).
 
-### What `tianshu setup` does
+---
 
-It's an interactive wizard (built on `@clack/prompts`, same family as
-[OpenClaw](https://docs.openclaw.ai)) that:
+## 👋 First run — 5 minutes start to finish
 
-- Asks which LLM provider to use (Anthropic / OpenAI / Google).
-- Reads your API key with a hidden input.
-- Writes `~/.tianshu/config.json` (provider settings, models, default).
-- Writes `~/.tianshu/.env` (your key, referenced as `${VAR}` from the config).
+A narrated walk-through. From zero to "agent driving a real
+browser on your screen":
 
-Non-interactive mode is supported for Docker / CI:
+### Step 1 · Install + wizard (~2 min)
 
 ```bash
-tianshu setup --non-interactive \
-  --provider=anthropic --api-key=sk-***
+npm install -g @tianshu-ai/tianshu@latest
+tianshu setup
 ```
 
-### What `tianshu doctor` checks
+The wizard picks a provider, reads your key, writes config. If
+you skip the LLM step you can edit `~/.tianshu/config.json` by
+hand later.
 
-```
-┌  Tianshu doctor
-│
-◇  Runtime         → Node ≥ 22, OS supported
-◇  Config files    → ~/.tianshu/config.json + .env present + parseable
-◇  LLM providers   → at least one provider has a non-empty API key,
-│                    defaultModel resolves
-◇  Network         → server port reachable, /api/health responding
-◇  Sandbox         → microsandbox binary present (--probe-sandbox
-│                    boots an alpine VM as a smoke test)
-◇  Builtin plugins → manifests parse, ids unique
-◇  Tenant DBs      → each tenant's sqlite opens cleanly
-└  Setup looks healthy
+### Step 2 · Start the service (~10 s)
+
+```bash
+tianshu start
 ```
 
-Use it whenever something doesn't feel right — it's read-only.
+The wizard already verified network / config. `tianshu start`
+installs the launchd agent and waits for the server to answer
+`/api/health`.
 
-### Developing from a checkout
+### Step 3 · Ask the setup agent to finish the configuration
 
-If you want to hack on tianshu itself (not just run it):
+After `tianshu setup` writes the provider config it drops you
+straight into the **setup agent** (still in the same terminal).
+This is where you finish wiring things up. Type plain English:
 
-```bash
-git clone https://github.com/tianshu-ai/tianshu.git
-cd tianshu
+> **You:** Set up sandboxes so I can use the browser tool.
 
-npm install
-npm run setup        # same wizard, writes to ~/.tianshu/
-npm run doctor
-npm run dev          # vite (5183) + server (3110) + plugin watcher
-```
+The agent will:
 
-In dev mode you open <http://localhost:5183>. The wizard's
-launchd plist installer (`tianshu start` from inside a checkout)
-stays in dev shape — vite hosts the SPA, server is API-only —
-because the heuristic detects `.git/` in the install root.
+1. Run `sandbox_inventory` to see what's already built.
+2. If a snapshot is missing, propose `build_sandbox
+   (template='task-runner')` and ask you to confirm.
+3. After ~10 min (cold) or ~3 min (warm) the snapshot lands; the
+   agent publishes it to the `task` role pointer with
+   `use_sandbox_build`.
+4. Repeat for the browser layer
+   (`task-runner-with-browser` on top of the task snapshot).
 
-Updating:
+If the build looks stuck, the agent calls `check_build_progress`
+first — it reads the launchd logs, classifies the build state
+(`in_progress` / `stalled` / `errored`), and tells you whether
+to wait or retry. It will NOT silently retry a 10-minute build
+that's still pulling apt packages.
 
-### Updating
+While you're here, you can keep talking to the agent about
+other setup work — say *"add a Tavily API key for web search"*
+or *"check for tianshu updates"* and it'll handle them with the
+same confirm-before-mutating loop. When you're done, type
+*done* or Ctrl-C; the agent saves state to disk and you can
+come back later with another `tianshu setup`.
+
+### Step 4 · Open the SPA and use it
 
 ```bash
-tianshu update --check       # peek at what `latest` is on npm
-tianshu update               # npm install -g the latest, prints next steps
-tianshu update --tag next    # install pre-release channel (if available)
+open http://localhost:3110
 ```
 
-`tianshu update` detects a git checkout and refuses — use
-`git pull` there instead.
+This is the actual product UI — the chat surface your agent
+runs under. Try:
 
-### Useful flags
+> **You:** Open hacker news and tell me the top story right now.
 
-```bash
-# Skip the readiness check on startup (useful for empty-shell deploys)
-TIANSHU_IGNORE_SETUP=1 tianshu start
+Watch the side panel: a real Chromium tab navigates. The agent
+can click, type, scroll. You can take the mouse back any time.
 
-# Probe each provider's /v1/models endpoint to test reachability
-tianshu doctor --probe-providers
+Done. You've got a working agent.
 
-# Boot a real microsandbox VM as a smoke test (~30s, pulls image)
-tianshu doctor --probe-sandbox
-```
+### What if something goes wrong?
 
-> Default ports are `3110` (server / SPA) and, in dev mode only,
-> `5183` (vite). Both are different from the closed-source
-> predecessor's `3100 / 5173` so the two projects can run
-> alongside each other on the same machine. Override via `PORT=`
-> / `WEB_PORT=` if you need to.
+| Symptom | First step |
+|---|---|
+| `tianshu doctor` flags a blocker | Read the line; the `detail` field has the fix. |
+| Browser tool says "runner not ready" | `sandbox_inventory` in chat; build the missing snapshot. |
+| `tianshu start` says "server didn't respond" | `tianshu logs --stream=err -f` for the actual error. |
+| Setup wizard wedged | Ctrl-C, re-run `tianshu setup --wizard`. |
+| `npm install -g` errors with EACCES | Switch to nvm / volta / asdf. Don't `sudo`. |
 
-### Running as a background service
+More in [Troubleshooting](docs/getting-started.md#troubleshooting).
 
-`tianshu start` (from a global install) installs a launchd agent
-under `~/Library/LaunchAgents/` that auto-starts at login and
-auto-restarts on crash. `tianshu stop` / `restart` / `status` /
-`logs` manage it day to day. See
-[docs/running.md](./docs/running.md) for the plist shape and
-Linux / Docker plans (still TODO at the time of writing).
+---
 
-**Don't** use `nohup`, `&`, or `screen` for a long-running
-install — they don't survive logout and don't auto-restart on
-crash.
+## 🎛️ Day-2 control
 
-### Workspace-scoped npm scripts (dev checkouts only)
+Once things are running, these are the commands you'll use daily:
 
 ```bash
-# build everything (type-check + bundle)
-npm run build
+tianshu status               # plist label, pid, port, /api/health
+tianshu logs -f              # tail stdout + stderr
+tianshu restart              # bounce the server
+tianshu stop                 # bootout the launchd agent
+tianshu tenant list          # tenants + users + open-in-browser URLs
+tianshu update               # check + install npm latest
+tianshu update --check       # only check, exit 0/1/2
+```
 
-# tests
-npm test
+Behind a Cloudflare tunnel or reverse proxy? Set
+`server.publicUrl` in `~/.tianshu/config.json` once — every CLI
+command prints that hostname instead of `localhost`.
 
-# server only
-npm run dev   -w packages/server
-npm run build -w packages/server
+When something breaks:
 
-# web only
-npm run dev   -w packages/web
-npm run build -w packages/web
+```bash
+tianshu doctor                       # what's wrong?
+tianshu logs -f                      # what's the server saying?
+ls ~/Library/LaunchAgents/ai.tianshu*.plist   # is the agent installed?
+launchctl list | grep tianshu        # is it loaded? PID? exit code?
 ```
 
-## Architecture (target)
+Deeper guides:
+[Getting started](docs/getting-started.md) ·
+[Updating](docs/updating.md) ·
+[Running as a service](docs/running.md) ·
+[Developing from a checkout](docs/developing.md).
+
+---
+
+## 🏗️ Architecture
 
 ```mermaid
 flowchart LR
@@ -221,7 +299,7 @@ flowchart LR
     UI["React + Vite UI"]
   end
 
-  subgraph Server["@tianshu/server"]
+  subgraph Server["@tianshu-ai/server"]
     REST["REST /api"]
     WS["WebSocket /ws"]
     Agent["Agent runtime<br/>pi-agent-core"]
@@ -229,9 +307,9 @@ flowchart LR
     DB[("SQLite<br/>(WAL)")]
   end
 
-  subgraph Sidecars["Per-tenant sidecars (optional)"]
+  subgraph Sidecars["Per-tenant sidecars"]
     ChromiumBox["Chromium + Playwright + noVNC"]
-    SandBox["Linux microsandbox"]
+    SandBox["Linux microsandbox VM"]
     Files["Workspace filesystem"]
   end
 
@@ -249,70 +327,82 @@ flowchart LR
   Agent <--> LLM
 ```
 
-```text
-tianshu/
-├── packages/
-│   ├── server/   # Express + WS backend, agent runtime
-│   └── web/      # React + Tailwind + Vite frontend
-└── docs/         # DEV_LOG, architecture notes, RFCs
-```
-
-The agent runtime is built on
-[`@mariozechner/pi-agent-core`](https://www.npmjs.com/package/@mariozechner/pi-agent-core)
-by [@badlogic](https://github.com/badlogic). Standing on the shoulders of
-giants.
+The agent runtime stands on
+[`@earendil-works/pi-agent-core`](https://www.npmjs.com/package/@earendil-works/pi-agent-core)
+by [@badlogic](https://github.com/badlogic). The sandbox layer is
+[microsandbox](https://github.com/microsandbox/microsandbox).
 
-## Roadmap
+A 0.x repo, but the core loop — chat, sandbox `exec`, sidecar browser,
+multi-tenant filesystem, background workers — works end-to-end today.
+See the [Architecture Decision Records](docs/architecture/) for
+the full picture.
 
-### Done (0.2.x)
+---
 
-- [x] **Tenant model** — `tenantId` everywhere, dev-mode JWT
-- [x] **Agent runtime wired up** — `pi-agent-core` streaming over WS
-- [x] **Browser sidecar** — Playwright + noVNC via microsandbox
-- [x] **Microsandbox** — per-tenant + per-task Linux VMs for `exec` / file I/O
-- [x] **Task board** — background workers as Kanban cards
-- [x] **Doctor + setup wizard** — `tianshu doctor` / `tianshu setup --wizard`
+## 🗺️ Roadmap
 
-### Next (0.3.x)
+**Shipped (0.3.x)**
 
 - [x] `npm install -g @tianshu-ai/tianshu` published to npm
-- [ ] `tianshu start` single-port server (web + API together for prod)
+- [x] Production single-port server (SPA + API on `:3110`)
+- [x] `tianshu doctor` — runtime / config / network / sandbox / plugins
+- [x] Setup agent with 18 tools (inventory, build, fix, upgrade)
+- [x] Tenant model, plugin registry, sandbox role pointers
+
+**Next (0.4.x)**
+
 - [ ] Docker image with sandbox layer baked in
-- [ ] Hosted demo at `demo.tianshu-ai.com`
+- [ ] Linux systemd user service (matches macOS launchd UX)
+- [ ] Skills marketplace (registry + install command)
 
 Tracked in [GitHub Issues](https://github.com/tianshu-ai/tianshu/issues).
 
-## What it's not
+---
+
+## 🚫 What it's not
+
+- ❌ A drop-in ChatGPT clone — see
+  [LibreChat](https://github.com/danny-avila/LibreChat),
+  [Open WebUI](https://github.com/open-webui/open-webui).
+- ❌ A no-code workflow builder — see
+  [Dify](https://github.com/langgenius/dify),
+  [Flowise](https://github.com/FlowiseAI/Flowise).
+- ❌ A hosted SaaS — no billing, no SSO, no SLA. Run it on a box you own.
+- ❌ An LLM dev framework — Tianshu is an *application* on top of
+  pi-agent-core.
 
-- ❌ A drop-in ChatGPT clone — go look at LibreChat or Open WebUI.
-- ❌ A no-code workflow builder — Dify is the right shape for that.
-- ❌ A hosted SaaS — no billing, no SSO, no SLA. Run it for your team.
-- ❌ An LLM dev framework — it's an *application*; the runtime is
-  pi-agent-core underneath.
+---
 
-## Build log
+## 📺 Build log
 
-We post a development log every week. Pick the channel that fits you:
+A development log goes out roughly every week. Pick the channel that
+fits you:
 
-| Where | Language | Format |
+| Channel | Language | Format |
 | --- | --- | --- |
 | [dev.to/tianshu_ai](https://dev.to/tianshu_ai) | English | Long-form articles |
-| [YouTube @Tianshu-AI](https://www.youtube.com/@Tianshu-AI) | English | Long-form videos |
-| Bilibili 天枢AI *(launching)* | 中文 | Long-form videos |
+| [YouTube @Tianshu-AI](https://www.youtube.com/@Tianshu-AI) | English | Long-form video |
+| Bilibili 天枢AI *(launching)* | 中文 | Long-form video |
 | X / Twitter *(launching)* | English | Build-in-public threads |
 | 小红书 / 抖音 *(launching)* | 中文 | Short-form clips |
 
-## Contributing
+---
 
-PRs, issues, and discussions are all welcome — even on day 0. See
+## 🤝 Contributing
+
+PRs, issues, and discussions are welcome — even on day 0. See
 [CONTRIBUTING.md](./CONTRIBUTING.md) for setup and code style.
 
-For security issues please follow [SECURITY.md](./SECURITY.md). Do not
-file vulnerabilities in public issues.
+For security issues please follow [SECURITY.md](./SECURITY.md). **Do
+not** file vulnerabilities in public issues.
+
+---
 
-## License
+## 📜 License
 
 [Apache License 2.0](./LICENSE) © 2026 Yu Yu and Tianshu contributors.
 
 Built on [pi-agent-core](https://github.com/badlogic/pi-mono) (MIT) by
-[@badlogic](https://github.com/badlogic).
+[@badlogic](https://github.com/badlogic), and
+[microsandbox](https://github.com/microsandbox/microsandbox) (Apache-2.0)
+by [@nyxxxie](https://github.com/nyxxxie) and contributors.