pi-feats 0.1.1

package/extensions/sequential-workflow.ts

@@ -0,0 +1,270 @@
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { StringEnum } from "@earendil-works/pi-ai";
+import { Type } from "typebox";
+import { DatabaseSync } from "node:sqlite";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+type TaskType = "action" | "collect" | "evaluate";
+type TaskStatus = "pending" | "running" | "awaiting_user" | "evaluating" | "accepted" | "rejected" | "failed";
+type WorkflowStatus = "running" | "awaiting_user" | "evaluating" | "completed" | "cancelled" | "failed";
+
+type Task = {
+  id: number;
+  workflow_id: number;
+  position: number;
+  type: TaskType;
+  instruction: string;
+  criteria: string | null;
+  status: TaskStatus;
+  attempts: number;
+  result: string | null;
+  evaluation: string | null;
+};
+
+type Workflow = {
+  id: number;
+  title: string;
+  source: string;
+  status: WorkflowStatus;
+};
+
+const taskType = StringEnum(["action", "collect", "evaluate"] as const);
+const phaseType = StringEnum(["action", "collect"] as const);
+// Keep workflow state inside the active profile. Named profiles run under
+// nono and cannot write the shared extension directory.
+const workflowDatabase = () => join(process.env.PI_CODING_AGENT_DIR ?? join(homedir(), ".pi", "agent"), "sequential-workflow.db");
+
+export default function (pi: ExtensionAPI) {
+  const db = new DatabaseSync(workflowDatabase());
+  db.exec(`
+    PRAGMA journal_mode = WAL;
+    CREATE TABLE IF NOT EXISTS workflows (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      title TEXT NOT NULL,
+      source TEXT NOT NULL,
+      status TEXT NOT NULL,
+      created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+      updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+    );
+    CREATE TABLE IF NOT EXISTS workflow_tasks (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      workflow_id INTEGER NOT NULL REFERENCES workflows(id),
+      position INTEGER NOT NULL,
+      type TEXT NOT NULL,
+      instruction TEXT NOT NULL,
+      criteria TEXT,
+      status TEXT NOT NULL,
+      attempts INTEGER NOT NULL DEFAULT 0,
+      result TEXT,
+      evaluation TEXT,
+      created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+      updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+      UNIQUE(workflow_id, position)
+    );
+    CREATE TABLE IF NOT EXISTS workflow_events (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      workflow_id INTEGER NOT NULL REFERENCES workflows(id),
+      task_id INTEGER REFERENCES workflow_tasks(id),
+      phase TEXT NOT NULL,
+      payload TEXT NOT NULL,
+      created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+    );
+  `);
+
+  const one = <T>(sql: string, ...params: unknown[]) => db.prepare(sql).get(...params) as T | undefined;
+  const many = <T>(sql: string, ...params: unknown[]) => db.prepare(sql).all(...params) as T[];
+  const event = (workflowId: number, taskId: number | null, phase: string, payload: unknown) => {
+    db.prepare("INSERT INTO workflow_events (workflow_id, task_id, phase, payload) VALUES (?, ?, ?, ?)")
+      .run(workflowId, taskId, phase, JSON.stringify(payload));
+  };
+
+  const activeWorkflow = () => one<Workflow>(
+    "SELECT id, title, source, status FROM workflows WHERE status IN ('running', 'awaiting_user', 'evaluating') ORDER BY id DESC LIMIT 1",
+  );
+  const currentTask = (workflowId: number) => one<Task>(
+    "SELECT id, workflow_id, position, type, instruction, criteria, status, attempts, result, evaluation FROM workflow_tasks WHERE workflow_id = ? AND status NOT IN ('accepted', 'failed') ORDER BY position LIMIT 1",
+    workflowId,
+  );
+  const taskSummary = (task: Task) => ({
+    id: task.id,
+    position: task.position,
+    type: task.type,
+    instruction: task.instruction,
+    criteria: task.criteria,
+    status: task.status,
+    attempts: task.attempts,
+  });
+
+  const activateNext = (workflow: Workflow) => {
+    const next = currentTask(workflow.id);
+    if (!next) {
+      db.prepare("UPDATE workflows SET status = 'completed', updated_at = CURRENT_TIMESTAMP WHERE id = ?").run(workflow.id);
+      event(workflow.id, null, "completed", { message: "Todas as tasks foram aceitas." });
+      return { completed: true };
+    }
+    const status: TaskStatus = next.type === "collect" ? "awaiting_user" : "running";
+    const workflowStatus: WorkflowStatus = next.type === "collect" ? "awaiting_user" : "running";
+    db.prepare("UPDATE workflow_tasks SET status = ?, updated_at = CURRENT_TIMESTAMP WHERE id = ?").run(status, next.id);
+    db.prepare("UPDATE workflows SET status = ?, updated_at = CURRENT_TIMESTAMP WHERE id = ?").run(workflowStatus, workflow.id);
+    const activated = currentTask(workflow.id)!;
+    event(workflow.id, activated.id, "activated", taskSummary(activated));
+    return { completed: false, task: activated };
+  };
+
+  pi.on("before_agent_start", (_event, _ctx) => {
+    const workflow = activeWorkflow();
+    if (!workflow) return;
+    const task = currentTask(workflow.id);
+    if (!task) return;
+    return {
+      message: {
+        customType: "sequential-workflow-state",
+        display: false,
+        content: `Workflow ativo #${workflow.id} (${workflow.title}). Task atual obrigatória: #${task.position} [${task.type}] ${task.instruction}\nStatus: ${task.status}. Critério: ${task.criteria ?? "nenhum"}. Não execute ou avance para outra task. Use as tools sequential_workflow_* para registrar resultado e avaliação.`,
+      },
+    };
+  });
+
+  pi.registerTool({
+    name: "sequential_workflow_create",
+    label: "Create Sequential Workflow",
+    description: "Persiste um plano de workflow e ativa exclusivamente sua primeira task.",
+    promptSnippet: "Create a persisted sequential workflow from a validated Action/Collect/Evaluate plan",
+    promptGuidelines: [
+      "Use sequential_workflow_create only after an explicit request to create or execute a workflow has been identified.",
+      "A Collect task passed to sequential_workflow_create must include acceptance criteria.",
+    ],
+    parameters: Type.Object({
+      title: Type.String({ minLength: 1 }),
+      source: Type.String({ minLength: 1 }),
+      tasks: Type.Array(Type.Object({
+        type: taskType,
+        instruction: Type.String({ minLength: 1 }),
+        criteria: Type.Optional(Type.String({ minLength: 1 })),
+      }), { minItems: 1 }),
+    }),
+    async execute(_id, params) {
+      const active = activeWorkflow();
+      if (active) throw new Error(`Já existe um workflow ativo (#${active.id}: ${active.title}). Conclua ou cancele-o antes de criar outro.`);
+      for (const [index, task] of params.tasks.entries()) {
+        if (task.type === "collect" && !task.criteria) {
+          throw new Error(`Task ${index + 1} é Collect e exige criteria.`);
+        }
+      }
+      const inserted = db.prepare("INSERT INTO workflows (title, source, status) VALUES (?, ?, 'running')")
+        .run(params.title, params.source);
+      const workflowId = Number(inserted.lastInsertRowid);
+      const insertTask = db.prepare("INSERT INTO workflow_tasks (workflow_id, position, type, instruction, criteria, status) VALUES (?, ?, ?, ?, ?, 'pending')");
+      params.tasks.forEach((task, index) => insertTask.run(workflowId, index + 1, task.type, task.instruction, task.criteria ?? null));
+      const workflow = one<Workflow>("SELECT id, title, source, status FROM workflows WHERE id = ?", workflowId)!;
+      event(workflowId, null, "created", { title: params.title, taskCount: params.tasks.length });
+      const next = activateNext(workflow);
+      const message = next.completed
+        ? `Workflow #${workflowId} criado e concluído sem tasks pendentes.`
+        : `Workflow #${workflowId} criado. Execute somente a task #${next.task!.position}: ${next.task!.instruction}`;
+      return { content: [{ type: "text", text: message }], details: { workflowId, next } };
+    },
+  });
+
+  pi.registerTool({
+    name: "sequential_workflow_record_result",
+    label: "Record Workflow Result",
+    description: "Registra o resultado da Action ou Collect atual sem avançar uma task que ainda precise de avaliação.",
+    promptSnippet: "Record the result of the active Action or Collect task",
+    promptGuidelines: ["Use sequential_workflow_record_result immediately after completing the active Action or receiving the active Collect response."],
+    parameters: Type.Object({ phase: phaseType, result: Type.String({ minLength: 1 }) }),
+    async execute(_id, params) {
+      const workflow = activeWorkflow();
+      if (!workflow) throw new Error("Não existe workflow ativo.");
+      const task = currentTask(workflow.id);
+      if (!task) throw new Error("Não existe task pendente.");
+      if (task.type !== params.phase) throw new Error(`A task atual é ${task.type}, não ${params.phase}.`);
+      if (task.status === "evaluating") throw new Error("O resultado já foi registrado; avalie a task atual.");
+
+      if (task.criteria) {
+        db.prepare("UPDATE workflow_tasks SET result = ?, status = 'evaluating', updated_at = CURRENT_TIMESTAMP WHERE id = ?").run(params.result, task.id);
+        db.prepare("UPDATE workflows SET status = 'evaluating', updated_at = CURRENT_TIMESTAMP WHERE id = ?").run(workflow.id);
+        event(workflow.id, task.id, "result_recorded", { phase: params.phase, result: params.result });
+        return { content: [{ type: "text", text: `Resultado registrado. Agora avalie a task #${task.position} contra o critério e chame sequential_workflow_evaluate.` }], details: { taskId: task.id, needsEvaluation: true } };
+      }
+
+      db.prepare("UPDATE workflow_tasks SET result = ?, status = 'accepted', updated_at = CURRENT_TIMESTAMP WHERE id = ?").run(params.result, task.id);
+      event(workflow.id, task.id, "accepted_without_criteria", { result: params.result });
+      const next = activateNext(workflow);
+      return { content: [{ type: "text", text: next.completed ? "Task aceita; workflow concluído." : `Task aceita. Execute a task #${next.task!.position}: ${next.task!.instruction}` }], details: { next } };
+    },
+  });
+
+  pi.registerTool({
+    name: "sequential_workflow_evaluate",
+    label: "Evaluate Workflow Task",
+    description: "Registra a aceitação ou reprovação da task atual e mantém a mesma task ativa quando ela é reprovada.",
+    promptSnippet: "Accept or reject the active workflow task after evaluation",
+    promptGuidelines: ["Use sequential_workflow_evaluate after every task with criteria and for every Evaluate task; never advance a rejected task."],
+    parameters: Type.Object({
+      accepted: Type.Boolean(),
+      reasoning: Type.String({ minLength: 1 }),
+    }),
+    async execute(_id, params) {
+      const workflow = activeWorkflow();
+      if (!workflow) throw new Error("Não existe workflow ativo.");
+      const task = currentTask(workflow.id);
+      if (!task) throw new Error("Não existe task pendente.");
+      if (task.type !== "evaluate" && task.status !== "evaluating") {
+        throw new Error("Registre o resultado da task antes de avaliá-la.");
+      }
+
+      if (params.accepted) {
+        db.prepare("UPDATE workflow_tasks SET status = 'accepted', evaluation = ?, updated_at = CURRENT_TIMESTAMP WHERE id = ?").run(params.reasoning, task.id);
+        event(workflow.id, task.id, "accepted", { reasoning: params.reasoning });
+        const next = activateNext(workflow);
+        return { content: [{ type: "text", text: next.completed ? "Avaliação aceita; workflow concluído." : `Avaliação aceita. Execute somente a task #${next.task!.position}: ${next.task!.instruction}` }], details: { accepted: true, next } };
+      }
+
+      const retryStatus: TaskStatus = task.type === "collect" ? "awaiting_user" : "running";
+      const workflowStatus: WorkflowStatus = task.type === "collect" ? "awaiting_user" : "running";
+      db.prepare("UPDATE workflow_tasks SET status = ?, attempts = attempts + 1, evaluation = ?, updated_at = CURRENT_TIMESTAMP WHERE id = ?")
+        .run(retryStatus, params.reasoning, task.id);
+      db.prepare("UPDATE workflows SET status = ?, updated_at = CURRENT_TIMESTAMP WHERE id = ?").run(workflowStatus, workflow.id);
+      event(workflow.id, task.id, "rejected", { reasoning: params.reasoning });
+      return { content: [{ type: "text", text: task.type === "collect" ? `Critério reprovado. Permaneça na task #${task.position}, explique o que falta e solicite novamente a informação.` : `Critério reprovado. Permaneça na task #${task.position}, corrija ou repita a ação e registre um novo resultado.` }], details: { accepted: false, task: taskSummary(currentTask(workflow.id)!) } };
+    },
+  });
+
+  pi.registerTool({
+    name: "sequential_workflow_status",
+    label: "Sequential Workflow Status",
+    description: "Consulta o workflow ativo, sua task atual e o estado persistido.",
+    parameters: Type.Object({}),
+    async execute() {
+      const workflow = activeWorkflow();
+      if (!workflow) return { content: [{ type: "text", text: "Não há workflow ativo." }], details: {} };
+      const tasks = many<Task>("SELECT id, workflow_id, position, type, instruction, criteria, status, attempts, result, evaluation FROM workflow_tasks WHERE workflow_id = ? ORDER BY position", workflow.id);
+      return { content: [{ type: "text", text: `Workflow #${workflow.id} (${workflow.status}). Task atual: ${currentTask(workflow.id)?.position ?? "nenhuma"}.` }], details: { workflow, tasks } };
+    },
+  });
+
+  pi.registerCommand("workflow-status", {
+    description: "Mostra o estado do workflow sequencial ativo",
+    handler: async (_args, ctx) => {
+      const workflow = activeWorkflow();
+      if (!workflow) return ctx.ui.notify("Não há workflow ativo.", "info");
+      const task = currentTask(workflow.id);
+      ctx.ui.notify(`Workflow #${workflow.id}: ${workflow.status}. Task atual: #${task?.position ?? "nenhuma"}.`, "info");
+    },
+  });
+
+  pi.registerCommand("workflow-cancel", {
+    description: "Cancela o workflow sequencial ativo",
+    handler: async (_args, ctx) => {
+      const workflow = activeWorkflow();
+      if (!workflow) return ctx.ui.notify("Não há workflow ativo.", "info");
+      db.prepare("UPDATE workflows SET status = 'cancelled', updated_at = CURRENT_TIMESTAMP WHERE id = ?").run(workflow.id);
+      event(workflow.id, null, "cancelled", { by: "user" });
+      ctx.ui.notify(`Workflow #${workflow.id} cancelado.`, "warning");
+    },
+  });
+
+  pi.on("session_shutdown", () => db.close());
+}

package/extensions/skill-sources/index.ts

@@ -0,0 +1,4 @@
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+// Skill Sources are a managed Git catalog. They intentionally do not contribute
+// resource paths: a user must explicitly import each Skill into a profile.
+export default function (_pi: ExtensionAPI) {}

package/extensions/skill-sources/store.ts

@@ -0,0 +1,118 @@
+import { DatabaseSync } from "node:sqlite";
+import { createHash, randomUUID } from "node:crypto";
+import { execFile } from "node:child_process";
+import { cp, lstat, mkdir, readdir, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
+import { existsSync, mkdirSync } from "node:fs";
+import { dirname, join, relative, resolve } from "node:path";
+import { promisify } from "node:util";
+const exec = promisify(execFile), now = () => new Date().toISOString();
+type Row = Record<string, unknown>;
+export type Source = { identifier: string; name: string; repoUrl: string; branch: string; basePath: string; username: string | null; hasAccessToken: boolean; enabled: boolean; lastCommitHash: string | null; lastSyncedAt: string | null; syncStatus: string; lastError: string | null; createdAt: string; updatedAt: string };
+const valid = (value: string) => /^[a-z][a-z0-9-]{0,63}$/.test(value);
+export class SkillSourceStore {
+  private db: DatabaseSync; readonly root: string; private publishing = new Map<string, Promise<unknown>>();
+  constructor(agentDir: string) { this.root = join(agentDir, "skill-sources"); mkdirSync(this.root, { recursive: true }); this.db = new DatabaseSync(join(agentDir, "skill-sources.db")); this.db.exec("CREATE TABLE IF NOT EXISTS skill_sources (identifier TEXT PRIMARY KEY,name TEXT NOT NULL,repo_url TEXT NOT NULL,branch TEXT NOT NULL,base_path TEXT NOT NULL,auth_env_var TEXT,credential_username TEXT,credential_token TEXT,enabled INTEGER NOT NULL DEFAULT 1,last_commit_hash TEXT,last_synced_at TEXT,sync_status TEXT NOT NULL DEFAULT 'never_synced',last_error TEXT,created_at TEXT NOT NULL,updated_at TEXT NOT NULL); CREATE TABLE IF NOT EXISTS skill_source_skills (source_identifier TEXT NOT NULL,skill_name TEXT NOT NULL,relative_path TEXT NOT NULL,description TEXT,content_hash TEXT NOT NULL,commit_hash TEXT,status TEXT NOT NULL,seen_at TEXT NOT NULL,PRIMARY KEY(source_identifier,relative_path)); CREATE TABLE IF NOT EXISTS skill_source_sync_runs (id TEXT PRIMARY KEY,source_identifier TEXT NOT NULL,status TEXT NOT NULL,commit_hash TEXT,discovered_count INTEGER NOT NULL,valid_count INTEGER NOT NULL,invalid_count INTEGER NOT NULL,error_summary TEXT,started_at TEXT NOT NULL,finished_at TEXT); CREATE TABLE IF NOT EXISTS skill_source_installations (profile TEXT NOT NULL,skill_name TEXT NOT NULL,source_identifier TEXT NOT NULL,source_relative_path TEXT NOT NULL,source_commit_hash TEXT,source_content_hash TEXT NOT NULL,target_path TEXT NOT NULL,installed_at TEXT NOT NULL,PRIMARY KEY(profile,skill_name))"); const skillSql = String((this.db.prepare("SELECT sql FROM sqlite_master WHERE type='table' AND name='skill_source_skills'").get() as Row | undefined)?.sql ?? ""); if (skillSql.includes("PRIMARY KEY(source_identifier,skill_name)")) this.db.exec("BEGIN; ALTER TABLE skill_source_skills RENAME TO skill_source_skills_legacy; CREATE TABLE skill_source_skills (source_identifier TEXT NOT NULL,skill_name TEXT NOT NULL,relative_path TEXT NOT NULL,description TEXT,content_hash TEXT NOT NULL,commit_hash TEXT,status TEXT NOT NULL,seen_at TEXT NOT NULL,PRIMARY KEY(source_identifier,relative_path)); INSERT INTO skill_source_skills SELECT source_identifier,skill_name,relative_path,description,content_hash,commit_hash,status,seen_at FROM skill_source_skills_legacy; DROP TABLE skill_source_skills_legacy; COMMIT;"); const columns = new Set((this.db.prepare("PRAGMA table_info(skill_sources)").all() as Row[]).map(row => String(row.name))); if (!columns.has("credential_username")) this.db.exec("ALTER TABLE skill_sources ADD COLUMN credential_username TEXT"); if (!columns.has("credential_token")) this.db.exec("ALTER TABLE skill_sources ADD COLUMN credential_token TEXT"); }
+  private source(row: Row): Source { return { identifier:String(row.identifier), name:String(row.name), repoUrl:String(row.repo_url), branch:String(row.branch), basePath:String(row.base_path), username:row.credential_username == null ? null : String(row.credential_username), hasAccessToken:Boolean(row.credential_token), enabled:Boolean(row.enabled), lastCommitHash:row.last_commit_hash == null ? null : String(row.last_commit_hash), lastSyncedAt:row.last_synced_at == null ? null : String(row.last_synced_at), syncStatus:String(row.sync_status), lastError:row.last_error == null ? null : String(row.last_error), createdAt:String(row.created_at), updatedAt:String(row.updated_at) }; }
+  list() { return (this.db.prepare("SELECT * FROM skill_sources ORDER BY name").all() as Row[]).map(row => this.source(row)); }
+  get(identifier: string) { const row = this.db.prepare("SELECT * FROM skill_sources WHERE identifier=?").get(identifier) as Row | undefined; return row ? this.source(row) : undefined; }
+  save(input: Partial<Source> & { identifier: string; name: string; repoUrl: string; accessToken?: string }) { if (!valid(input.identifier)) throw Object.assign(new Error("Identifier must start with a lowercase letter and contain only lowercase letters, numbers or hyphens."), { status: 400 }); if (!input.name.trim() || !input.repoUrl.trim()) throw Object.assign(new Error("Name and repository URL are required."), { status: 400 }); const current=this.get(input.identifier), stamp=now(), branch=input.branch?.trim() || current?.branch || "main", basePath=(input.basePath?.trim() || current?.basePath || "skills").replace(/^\/+|\/+$/g, ""); if (!basePath || basePath.split("/").includes("..")) throw Object.assign(new Error("Invalid base path."), { status: 400 }); if (current) this.db.prepare("UPDATE skill_sources SET name=?,repo_url=?,branch=?,base_path=?,credential_username=?,credential_token=CASE WHEN ? THEN ? ELSE credential_token END,enabled=?,updated_at=? WHERE identifier=?").run(input.name.trim(),input.repoUrl.trim(),branch,basePath,input.username?.trim() || null,input.accessToken !== undefined ? 1 : 0,input.accessToken?.trim() || null,input.enabled === false ? 0 : 1,stamp,input.identifier); else this.db.prepare("INSERT INTO skill_sources (identifier,name,repo_url,branch,base_path,credential_username,credential_token,enabled,last_commit_hash,last_synced_at,sync_status,last_error,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?)").run(input.identifier,input.name.trim(),input.repoUrl.trim(),branch,basePath,input.username?.trim() || null,input.accessToken?.trim() || null,input.enabled === false ? 0 : 1,null,null,"never_synced",null,stamp,stamp); return this.get(input.identifier)!; }
+  async rename(identifier: string, nextIdentifier: string) { if (identifier === nextIdentifier) return; if (!valid(nextIdentifier)) throw Object.assign(new Error("Identifier must start with a lowercase letter and contain only lowercase letters, numbers or hyphens."), { status: 400 }); if (!this.get(identifier)) throw Object.assign(new Error("Skill Source not found."), { status: 404 }); if (this.get(nextIdentifier)) throw Object.assign(new Error("A Skill Source with this identifier already exists."), { status: 409 }); const previous=join(this.root,identifier), next=join(this.root,nextIdentifier), cachePrevious=join(this.root,".git-cache",identifier), cacheNext=join(this.root,".git-cache",nextIdentifier); if (existsSync(previous)) await rename(previous,next); if (existsSync(cachePrevious)) await rename(cachePrevious,cacheNext); this.db.exec("BEGIN"); try { for (const table of ["skill_sources","skill_source_skills","skill_source_sync_runs","skill_source_installations"]) this.db.prepare(`UPDATE ${table} SET ${table === "skill_sources" ? "identifier" : "source_identifier"}=? WHERE ${table === "skill_sources" ? "identifier" : "source_identifier"}=?`).run(nextIdentifier,identifier); this.db.exec("COMMIT"); } catch(error) { this.db.exec("ROLLBACK"); if (existsSync(next) && !existsSync(previous)) await rename(next,previous); if (existsSync(cacheNext) && !existsSync(cachePrevious)) await rename(cacheNext,cachePrevious); throw error; } }
+  async remove(identifier: string) { if (!this.get(identifier)) throw Object.assign(new Error("Skill Source not found."), { status: 404 }); this.db.prepare("DELETE FROM skill_source_skills WHERE source_identifier=?").run(identifier); this.db.prepare("DELETE FROM skill_sources WHERE identifier=?").run(identifier); await rm(join(this.root, identifier), { recursive:true, force:true }); await rm(join(this.root, ".git-cache", identifier), { recursive:true, force:true }); }
+  skills(identifier: string) { if (!this.get(identifier)) throw Object.assign(new Error("Skill Source not found."), { status:404 }); return (this.db.prepare("SELECT skill_name,relative_path,description,content_hash,commit_hash,status,seen_at FROM skill_source_skills WHERE source_identifier=? ORDER BY skill_name").all(identifier) as Row[]).map(row => ({ name:String(row.skill_name), relativePath:String(row.relative_path), description:row.description == null ? null : String(row.description), contentHash:String(row.content_hash), commitHash:row.commit_hash == null ? null : String(row.commit_hash), status:String(row.status), seenAt:String(row.seen_at) })); }
+  async document(identifier: string, skillName: string) { const skill=this.skills(identifier).find(item=>item.name===skillName && item.status === "synced"); if (!skill) throw Object.assign(new Error("Skill document is not available."), { status: 404 }); const root=resolve(this.root,identifier), folder=resolve(root,skill.relativePath), path=join(folder,"SKILL.md"); if (!folder.startsWith(`${root}/`) || !existsSync(path)) throw Object.assign(new Error("Skill document is not available."), { status: 404 }); const raw=await readFile(path,"utf8"), match=raw.match(/^---\r?\n([\s\S]*?)\r?\n---\r?\n?/), frontmatter:Record<string,string>={}; if (match) for (const line of match[1].split(/\r?\n/)) { const separator=line.indexOf(":"); if (separator > 0) frontmatter[line.slice(0,separator).trim()]=line.slice(separator+1).trim().replace(/^['\"]|['\"]$/g,""); } const source=this.get(identifier)!; return { name:skill.name,path:relative(root,path).replaceAll("\\","/"),frontmatter,content:match ? raw.slice(match[0].length) : raw,source:{identifier:source.identifier,name:source.name,commitHash:skill.commitHash} }; }
+  private async git(args: string[], cwd: string, env: NodeJS.ProcessEnv) { try { return (await exec("git", args, { cwd, env, timeout:120000, maxBuffer:1024*1024 })).stdout.trim(); } catch (error) { const text=String((error as { stderr?: string }).stderr ?? (error as Error).message).replace(/https?:\/\/[^@\s]+@/g,"https://***@").slice(0,800); throw new Error(text || "Git command failed."); } }
+  private async scan(base: string, repo: string, commit: string) { const found: Array<{name:string;relativePath:string;description:string|null;contentHash:string}> = []; const visit=async (dir:string):Promise<void> => { for (const entry of await readdir(dir,{withFileTypes:true})) { if (!entry.isDirectory() || entry.name === ".git") continue; const folder=join(dir,entry.name), file=join(folder,"SKILL.md"); if (existsSync(file)) { const content=await readFile(file,"utf8"), front=content.match(/^---\r?\n([\s\S]*?)\r?\n---/), name=front?.[1].match(/^name:\s*["']?([^\n"']+)/m)?.[1].trim() || relative(base,folder).replaceAll("\\","/"), description=front?.[1].match(/^description:\s*["']?([^\n"']+)/m)?.[1].trim() || null; found.push({name,relativePath:relative(repo,folder).replaceAll("\\","/"),description,contentHash:createHash("sha256").update(content).digest("hex")}); } else await visit(folder); } }; await visit(base); return found; }
+  async sync(identifier: string) { const source=this.get(identifier); if (!source) throw Object.assign(new Error("Skill Source not found."), { status:404 }); if (!source.enabled) throw Object.assign(new Error("Skill Source is disabled."), { status:422 }); const started=now(), run=randomUUID(), repo=join(this.root,".git-cache",identifier), destination=join(this.root,identifier), env:{[key:string]:string|undefined}={...process.env,GIT_TERMINAL_PROMPT:"0"}; let askpass: string | undefined; const tokenRow=this.db.prepare("SELECT credential_token FROM skill_sources WHERE identifier=?").get(identifier) as Row | undefined; const token=tokenRow?.credential_token == null ? undefined : String(tokenRow.credential_token); if (token) { askpass=join(this.root,`.git-askpass-${run}`); await writeFile(askpass,"#!/bin/sh\ncase \"$1\" in *Username*) printf '%s\\n' \"$PI_SKILL_SOURCE_GIT_USERNAME\" ;; *Password*) printf '%s\\n' \"$PI_SKILL_SOURCE_GIT_TOKEN\" ;; esac\n",{mode:0o700}); Object.assign(env,{GIT_ASKPASS:askpass,PI_SKILL_SOURCE_GIT_USERNAME:source.username || "x-access-token",PI_SKILL_SOURCE_GIT_TOKEN:token}); }
+    this.db.prepare("INSERT INTO skill_source_sync_runs VALUES (?,?,?,?,?,?,?,?,?,?)").run(run,identifier,"running",null,0,0,0,null,started,null); let commit:string|null=null, items:Awaited<ReturnType<SkillSourceStore["scan"]>>=[]; let error:string|null=null; try { if (!existsSync(join(repo,".git"))) { await rm(repo,{recursive:true,force:true}); await mkdir(dirname(repo),{recursive:true}); await this.git(["clone","--depth","1","--branch",source.branch,source.repoUrl,repo],this.root,env); } else { await this.git(["remote","set-url","origin",source.repoUrl],repo,env); await this.git(["fetch","--depth","1","--prune","origin",source.branch],repo,env); await this.git(["checkout","--force","-B",source.branch,`origin/${source.branch}`],repo,env); await this.git(["clean","-ffd"],repo,env); } commit=await this.git(["rev-parse","HEAD"],repo,env); const base=resolve(repo,source.basePath); if (!base.startsWith(`${resolve(repo)}/`) || !existsSync(base) || !(await stat(base)).isDirectory()) throw new Error(`Skill base path was not found: ${source.basePath}`); await rm(destination,{recursive:true,force:true}); await cp(base,destination,{recursive:true,filter:(path)=>!path.split("/").includes(".git")}); items=await this.scan(destination,destination,commit); const stamp=now(); this.db.prepare("UPDATE skill_source_skills SET status='missing' WHERE source_identifier=?").run(identifier); for (const item of items) this.db.prepare("INSERT INTO skill_source_skills VALUES (?,?,?,?,?,?,?,?) ON CONFLICT(source_identifier,relative_path) DO UPDATE SET skill_name=excluded.skill_name,description=excluded.description,content_hash=excluded.content_hash,commit_hash=excluded.commit_hash,status='synced',seen_at=excluded.seen_at").run(identifier,item.name,item.relativePath,item.description,item.contentHash,commit,"synced",stamp); } catch (cause) { error=(cause as Error).message; }
+    if (askpass) await rm(askpass,{force:true}); const status=error ? (items.length ? "partial_failure" : "failed") : "succeeded", finished=now(); this.db.prepare("UPDATE skill_sources SET last_commit_hash=?,last_synced_at=?,sync_status=?,last_error=?,updated_at=? WHERE identifier=?").run(commit,finished,status,error,finished,identifier); this.db.prepare("UPDATE skill_source_sync_runs SET status=?,commit_hash=?,discovered_count=?,valid_count=?,invalid_count=?,error_summary=?,finished_at=? WHERE id=?").run(status,commit,items.length,items.length,0,error,finished,run); return { source:this.get(identifier)!, status, commitHash:commit, discoveredCount:items.length, validCount:items.length, invalidCount:0, error }; }
+  private async validateSkillDirectory(directory: string): Promise<void> {
+    const root = resolve(directory);
+    const visit = async (path: string): Promise<void> => {
+      const entry = await lstat(path);
+      if (entry.isSymbolicLink()) throw Object.assign(new Error("Skills containing symbolic links cannot be published."), { status: 400 });
+      if (!entry.isDirectory()) return;
+      for (const child of await readdir(path)) await visit(join(path, child));
+    };
+    await visit(root);
+    if (!existsSync(join(root, "SKILL.md"))) throw Object.assign(new Error("The skill directory does not contain SKILL.md."), { status: 400 });
+  }
+
+  private installation(profile: string, skillName: string) {
+    return this.db.prepare("SELECT source_identifier,source_relative_path,target_path FROM skill_source_installations WHERE profile=? AND skill_name=?").get(profile, skillName) as Row | undefined;
+  }
+
+  async publish(identifier: string, profile: string, skillName: string, skillPath: string) {
+    const previous = this.publishing.get(identifier) ?? Promise.resolve();
+    let release!: () => void;
+    const queued = new Promise<void>((resolveRun) => { release = resolveRun; });
+    const chain = previous.then(() => queued);
+    this.publishing.set(identifier, chain);
+    await previous;
+    try {
+      const source = this.get(identifier);
+      if (!source) throw Object.assign(new Error("Skill Source not found."), { status: 404 });
+      if (!source.enabled) throw Object.assign(new Error("Skill Source is disabled."), { status: 422 });
+      if (!source.hasAccessToken) throw Object.assign(new Error("This Skill Source has no write credential."), { status: 422 });
+      const local = resolve(skillPath);
+      await this.validateSkillDirectory(local);
+      const installation = this.installation(profile, skillName);
+      if (installation && String(installation.source_identifier) !== identifier) throw Object.assign(new Error("This skill was imported from a different Skill Source. Publish it there or create a new local skill."), { status: 409 });
+      const targetRelative = installation ? String(installation.source_relative_path) : join(source.basePath, skillName).replaceAll("\\", "/");
+      if (targetRelative.split("/").includes("..") || targetRelative.startsWith("/")) throw Object.assign(new Error("Invalid skill destination."), { status: 400 });
+      const sameName = this.skills(identifier).filter((item) => item.name === skillName && item.relativePath !== targetRelative && item.status === "synced");
+      if (sameName.length) throw Object.assign(new Error(`A different skill named '${skillName}' already exists in this Skill Source. Publish by its original path or rename the local skill.`), { status: 409 });
+      const refreshed = await this.sync(identifier);
+      if (refreshed.status !== "succeeded") throw Object.assign(new Error(refreshed.error ?? "Unable to synchronize the Skill Source before publishing."), { status: 502 });
+      const repository = resolve(this.root, ".git-cache", identifier), target = resolve(repository, targetRelative);
+      if (!target.startsWith(`${repository}/`)) throw Object.assign(new Error("Invalid skill destination."), { status: 400 });
+      await rm(target, { recursive: true, force: true });
+      await mkdir(dirname(target), { recursive: true });
+      await cp(local, target, { recursive: true, filter: (path) => !path.split("/").includes("node_modules") && !path.split("/").includes(".git") });
+      const token = String((this.db.prepare("SELECT credential_token FROM skill_sources WHERE identifier=?").get(identifier) as Row).credential_token);
+      const askpass = join(this.root, `.git-askpass-publish-${randomUUID()}`), env: NodeJS.ProcessEnv = { ...process.env, GIT_TERMINAL_PROMPT: "0", GIT_ASKPASS: askpass, PI_SKILL_SOURCE_GIT_USERNAME: source.username || "x-access-token", PI_SKILL_SOURCE_GIT_TOKEN: token };
+      await writeFile(askpass, "#!/bin/sh\ncase \"$1\" in *Username*) printf '%s\\n' \"$PI_SKILL_SOURCE_GIT_USERNAME\" ;; *Password*) printf '%s\\n' \"$PI_SKILL_SOURCE_GIT_TOKEN\" ;; esac\n", { mode: 0o700 });
+      try {
+        await this.git(["add", "--", targetRelative], repository, env);
+        const status = await this.git(["status", "--porcelain", "--", targetRelative], repository, env);
+        if (!status) return { action: "unchanged" as const, source: identifier, relativePath: targetRelative, commitHash: refreshed.commitHash };
+        await this.git(["commit", "-m", `chore(skills): update ${skillName}`], repository, env);
+        await this.git(["push", "origin", source.branch], repository, env);
+      } finally { await rm(askpass, { force: true }); }
+      const synced = await this.sync(identifier);
+      if (synced.status !== "succeeded") throw Object.assign(new Error(synced.error ?? "The Skill Source was pushed but could not be synchronized."), { status: 502 });
+      const published = this.skills(identifier).find((item) => item.relativePath === targetRelative);
+      if (published) this.db.prepare("INSERT INTO skill_source_installations VALUES (?,?,?,?,?,?,?,?) ON CONFLICT(profile,skill_name) DO UPDATE SET source_identifier=excluded.source_identifier,source_relative_path=excluded.source_relative_path,source_commit_hash=excluded.source_commit_hash,source_content_hash=excluded.source_content_hash,target_path=excluded.target_path,installed_at=excluded.installed_at").run(profile,skillName,identifier,targetRelative,published.commitHash,published.contentHash,local,now());
+      return { action: installation ? "updated" as const : "created" as const, source: identifier, relativePath: targetRelative, commitHash: synced.commitHash };
+    } finally { release(); if (this.publishing.get(identifier) === chain) this.publishing.delete(identifier); }
+  }
+
+  async syncInstallation(profile: string, skillName: string, expectedPath: string) {
+    const installation = this.installation(profile, skillName);
+    if (!installation) throw Object.assign(new Error("This Skill was not installed from a Skill Source."), { status: 404 });
+    const identifier = String(installation.source_identifier), relativePath = String(installation.source_relative_path), target = resolve(String(installation.target_path));
+    if (target !== resolve(expectedPath)) throw Object.assign(new Error("The installed Skill path no longer matches its source record."), { status: 409 });
+    const result = await this.sync(identifier);
+    if (result.status !== "succeeded") throw Object.assign(new Error(result.error ?? "Unable to synchronize the Skill Source."), { status: 502 });
+    const skill = this.skills(identifier).find((item) => item.relativePath === relativePath && item.status === "synced");
+    if (!skill) throw Object.assign(new Error("This Skill no longer exists in its Skill Source."), { status: 404 });
+    const sourceRoot = resolve(this.root, identifier), source = resolve(sourceRoot, relativePath);
+    if (!source.startsWith(`${sourceRoot}/`) || !existsSync(join(source, "SKILL.md"))) throw Object.assign(new Error("The synchronized Skill files are unavailable."), { status: 404 });
+    const temporary = `${target}.sync-${randomUUID()}`, backup = `${target}.backup-${randomUUID()}`;
+    try {
+      await rm(temporary, { recursive: true, force: true });
+      await cp(source, temporary, { recursive: true, filter: (path) => !path.split("/").includes(".git") && !path.split("/").includes("node_modules") });
+      if (existsSync(target)) await rename(target, backup);
+      await rename(temporary, target);
+      await rm(backup, { recursive: true, force: true });
+    } catch (error) {
+      await rm(temporary, { recursive: true, force: true });
+      if (!existsSync(target) && existsSync(backup)) await rename(backup, target);
+      throw error;
+    }
+    this.db.prepare("UPDATE skill_source_installations SET source_commit_hash=?,source_content_hash=?,target_path=?,installed_at=? WHERE profile=? AND skill_name=?").run(skill.commitHash, skill.contentHash, target, now(), profile, skillName);
+    return { source: identifier, relativePath, commitHash: skill.commitHash };
+  }
+
+  forgetInstallation(profile: string, skillName: string) { this.db.prepare("DELETE FROM skill_source_installations WHERE profile=? AND skill_name=?").run(profile, skillName); }
+  async install(identifier:string, skillName:string, destination:string, profile:string) { const skill=this.skills(identifier).find(item=>item.name===skillName && item.status==="synced"); if (!skill) throw Object.assign(new Error("Skill was not found in the synchronized source."),{status:404}); const source=resolve(this.root,identifier,skill.relativePath), target=resolve(destination,skillName); if (!source.startsWith(`${resolve(this.root,identifier)}/`) || !target.startsWith(`${resolve(destination)}/`)) throw Object.assign(new Error("Invalid skill path."),{status:400}); if (existsSync(target)) throw Object.assign(new Error("A skill with this name already exists at the destination."),{status:409}); await mkdir(destination,{recursive:true}); await cp(source,target,{recursive:true,filter:(path)=>!path.split("/").includes(".git") && !path.split("/").includes("node_modules")}); this.db.prepare("INSERT INTO skill_source_installations VALUES (?,?,?,?,?,?,?,?) ON CONFLICT(profile,skill_name) DO UPDATE SET source_identifier=excluded.source_identifier,source_relative_path=excluded.source_relative_path,source_commit_hash=excluded.source_commit_hash,source_content_hash=excluded.source_content_hash,target_path=excluded.target_path,installed_at=excluded.installed_at").run(profile,skill.name,identifier,skill.relativePath,skill.commitHash,skill.contentHash,target,now()); return skill; }
+}

package/package.json

@@ -0,0 +1,89 @@
+{
+  "name": "pi-feats",
+  "version": "0.1.1",
+  "description": "A modular Pi package for profiles, sandboxing, remote access, applications, guardrails, skills, session management, observability, and web-based operations.",
+  "keywords": [
+    "pi-coding-agent",
+    "pi-agent",
+    "pi-extension",
+    "ai-agent",
+    "agent-framework",
+    "agentic-ai",
+    "sandbox",
+    "nono",
+    "guardrails",
+    "webui",
+    "agent-operations"
+  ],
+  "homepage": "https://github.com/rjaskonis/pi-feats#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/rjaskonis/pi-feats.git"
+  },
+  "bugs": {
+    "url": "https://github.com/rjaskonis/pi-feats/issues"
+  },
+  "files": [
+    "extensions",
+    "scripts",
+    "README.md",
+    "LICENSE"
+  ],
+  "license": "MIT",
+  "engines": {
+    "node": ">=22"
+  },
+  "scripts": {
+    "build:web": "cd extensions/pi-console-webui && ../../node_modules/.bin/next build",
+    "ensure:nono": "sh scripts/install-nono.sh",
+    "postinstall": "npm run ensure:nono && npm run build:web",
+    "test": "npm run build:web"
+  },
+  "dependencies": {
+    "@codemirror/lang-javascript": "^6.2.5",
+    "@codemirror/lang-json": "^6.0.2",
+    "@codemirror/lang-markdown": "^6.5.2",
+    "@fastify/websocket": "^11.3.0",
+    "@homebridge/node-pty-prebuilt-multiarch": "^0.14.1",
+    "@radix-ui/react-slot": "^1.2.4",
+    "@radix-ui/react-switch": "^1.3.7",
+    "@radix-ui/react-tabs": "^1.1.21",
+    "@types/node": "^22.0.0",
+    "@types/react": "^19.0.0",
+    "@types/react-dom": "^19.0.0",
+    "@uiw/react-codemirror": "^4.25.11",
+    "@uiw/react-md-editor": "^4.1.2",
+    "@xterm/addon-fit": "^0.11.0",
+    "@xterm/xterm": "^6.0.0",
+    "autoprefixer": "^10.4.20",
+    "class-variance-authority": "^0.7.1",
+    "clsx": "^2.1.1",
+    "fastify": "^5.12.1",
+    "ink": "^7.1.1",
+    "jiti": "^2.7.0",
+    "lucide-react": "^0.468.0",
+    "next": "^15.2.0",
+    "react": "^19.2.8",
+    "react-dom": "^19.2.8",
+    "react-markdown": "^10.1.0",
+    "remark-gfm": "^4.0.1",
+    "tailwind-merge": "^3.0.2",
+    "tailwindcss": "^3.4.17",
+    "typescript": "^5.7.2"
+  },
+  "peerDependencies": {
+    "@earendil-works/pi-coding-agent": "*"
+  },
+  "pi": {
+    "extensions": [
+      "./extensions/api-server",
+      "./extensions/cli-resources.ts",
+      "./extensions/guardrails",
+      "./extensions/pi-console-webui",
+      "./extensions/profiles.ts",
+      "./extensions/pulse",
+      "./extensions/sequential-workflow.ts",
+      "./extensions/skill-sources"
+    ]
+  }
+}

package/scripts/install-nono.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env sh
+set -eu
+
+if command -v nono >/dev/null 2>&1; then
+  printf '%s\n' "Nono is already available: $(command -v nono)"
+  exit 0
+fi
+
+if ! command -v curl >/dev/null 2>&1; then
+  printf '%s\n' "Nono is required by pi-feats but curl is not available to install it." >&2
+  printf '%s\n' "Install curl and rerun npm install, or install Nono manually from https://nono.sh/." >&2
+  exit 1
+fi
+
+temporary="$(mktemp "${TMPDIR:-/tmp}/pi-feats-nono.XXXXXX")"
+cleanup() { rm -f "$temporary"; }
+trap cleanup EXIT HUP INT TERM
+
+printf '%s\n' "Installing Nono for sandboxed Pi Profiles..."
+curl --fail --show-error --silent --location --proto '=https' --tlsv1.2 https://nono.sh/install.sh --output "$temporary"
+sh "$temporary"
+
+if command -v nono >/dev/null 2>&1; then
+  printf '%s\n' "Installed Nono: $(command -v nono)"
+  exit 0
+fi
+
+if [ -x "$HOME/.local/bin/nono" ]; then
+  printf '%s\n' "Nono was installed at $HOME/.local/bin/nono. Add $HOME/.local/bin to PATH before running Pi." >&2
+  exit 0
+fi
+
+printf '%s\n' "Nono installation finished but the nono executable was not found." >&2
+exit 1