pi-minimal 0.1.0 → 0.2.2

package/.github/dependabot.yml

@@ -0,0 +1,11 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+  - package-ecosystem: "" # See documentation for possible values
+    directory: "/" # Location of package manifests
+    schedule:
+      interval: "weekly"

package/.github/workflows/publish.yml

@@ -1,29 +1,193 @@
 name: Publish
 
+# Publishes automatically when the version in package.json changes on main:
+# verifies the build, tags vX.Y.Z, creates a GitHub Release (CHANGELOG section +
+# auto-generated notes), records a deployment to the "npm" environment, and
+# publishes to npm via trusted publishing (OIDC; no token). Pushes that do not
+# change the version are a no-op.
+#
+# This file name is registered with npm as the trusted publisher for pi-minimal.
+# Renaming it breaks publishing until npm's trusted-publisher config is updated.
+
 on:
-  release:
-    types: [published]
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+concurrency:
+  group: publish
+  cancel-in-progress: false
 
 permissions:
-  contents: read
+  contents: write
+  deployments: write
   id-token: write
+  pull-requests: read
 
 jobs:
-  publish:
+  detect:
+    name: Detect version change
     runs-on: ubuntu-latest
-    environment: npm
+    outputs:
+      publish: ${{ steps.check.outputs.publish }}
+      tag_exists: ${{ steps.check.outputs.tag_exists }}
+      version: ${{ steps.check.outputs.version }}
+      tag: ${{ steps.check.outputs.tag }}
+      previous_tag: ${{ steps.check.outputs.previous_tag }}
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
       - uses: actions/setup-node@v4
         with:
           node-version: 22.19.0
-          registry-url: https://registry.npmjs.org
-          cache: npm
-      - run: npm ci
-      - run: npm run lint
-      - run: npm test
-      - run: npm run build
-      - run: git diff --exit-code -- dist
-      - run: npm publish --access public
+      - id: check
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          name=$(node -p "require('./package.json').name")
+          version=$(node -p "require('./package.json').version")
+          tag="v$version"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+          echo "tag=$tag" >> "$GITHUB_OUTPUT"
+          previous_tag=$(git tag --list 'v*' --sort=-v:refname | grep -vx "$tag" | head -n1 || true)
+          echo "previous_tag=$previous_tag" >> "$GITHUB_OUTPUT"
+
+          tag_exists=false
+          if git rev-parse -q --verify "refs/tags/$tag" >/dev/null; then tag_exists=true; fi
+          echo "tag_exists=$tag_exists" >> "$GITHUB_OUTPUT"
+
+          if npm view "$name@$version" version >/dev/null 2>&1; then
+            echo "::notice::$name@$version is already on npm; nothing to publish."
+            echo "publish=false" >> "$GITHUB_OUTPUT"; exit 0
+          fi
+          echo "publish=true" >> "$GITHUB_OUTPUT"
+          if [ "$tag_exists" = true ]; then
+            echo "::notice::$tag exists but $name@$version is not on npm; publishing (re-run)."
+          else
+            echo "::notice::New version $version detected (previous tag: ${previous_tag:-none})."
+          fi
+
+  release:
+    name: Tag, release, publish ${{ needs.detect.outputs.tag }}
+    needs: detect
+    if: needs.detect.outputs.publish == 'true'
+    runs-on: ubuntu-latest
+    environment:
+      name: npm
+      url: https://www.npmjs.com/package/pi-minimal/v/${{ needs.detect.outputs.version }}
+    env:
+      VERSION: ${{ needs.detect.outputs.version }}
+      TAG: ${{ needs.detect.outputs.tag }}
+      PREVIOUS_TAG: ${{ needs.detect.outputs.previous_tag }}
+      GH_TOKEN: ${{ github.token }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      # No registry-url here: setup-node would write an .npmrc with a placeholder
+      # NODE_AUTH_TOKEN, and npm then sends that instead of exchanging the OIDC
+      # token, which the registry rejects with a 404. Trusted publishing needs
+      # no token configured at all.
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22.19.0
+          cache: npm
+
+      - name: Verify
+        run: |
+          npm ci
+          npm run lint
+          npm run typecheck
+          npm test
+          npm run build
+          git diff --exit-code -- dist
+
+      - name: Compose release notes
+        id: notes
+        run: |
+          set -euo pipefail
+          notes=release-notes.md
+          : > "$notes"
+
+          # 1. Hand-written section from CHANGELOG.md, if present ("## [X.Y.Z] ..." until next "## ").
+          if [ -f CHANGELOG.md ]; then
+            section=$(awk -v v="$VERSION" '
+              /^## \[/ { if (found) exit; found = index($0, "[" v "]") > 0; next }
+              found && /^\[[^]]+\]: / { exit }
+              found { print }' CHANGELOG.md | sed -e '/./,$!d' -e :a -e '/^\n*$/{$d;N;ba' -e '}')
+            if [ -n "$section" ]; then
+              printf '%s\n\n' "$section" >> "$notes"
+            else
+              echo "::warning::CHANGELOG.md has no section for [$VERSION]; using generated notes only."
+            fi
+          fi
+
+          # 2. GitHub-generated notes (merged PRs / commits since the previous tag).
+          body=$(gh api -X POST "repos/${GITHUB_REPOSITORY}/releases/generate-notes" \
+            -f tag_name="$TAG" -f target_commitish="$GITHUB_SHA" \
+            ${PREVIOUS_TAG:+-f previous_tag_name="$PREVIOUS_TAG"} --jq .body)
+          printf '%s\n\n' "$body" >> "$notes"
+
+          # 3. Install footer.
+          cat >> "$notes" <<EOF
+          ---
+          **Install / upgrade**
+          \`\`\`bash
+          pi install npm:pi-minimal@$VERSION   # or: pi update --extensions
+          \`\`\`
+          EOF
+          echo "file=$notes" >> "$GITHUB_OUTPUT"
+          echo "### Release notes for $TAG" >> "$GITHUB_STEP_SUMMARY"
+          cat "$notes" >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Create tag and GitHub Release
+        run: |
+          set -euo pipefail
+          if [ "${{ needs.detect.outputs.tag_exists }}" != true ]; then
+            git config user.name "github-actions[bot]"
+            git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+            git tag -a "$TAG" -m "pi-minimal $VERSION" "$GITHUB_SHA"
+            git push origin "refs/tags/$TAG"
+          else
+            echo "Tag $TAG already exists; not re-tagging."
+          fi
+          if gh release view "$TAG" >/dev/null 2>&1; then
+            echo "Release $TAG already exists; updating notes."
+            gh release edit "$TAG" --notes-file "${{ steps.notes.outputs.file }}"
+          else
+            gh release create "$TAG" \
+              --target "$GITHUB_SHA" \
+              --title "pi-minimal $VERSION" \
+              --notes-file "${{ steps.notes.outputs.file }}" \
+              --verify-tag
+          fi
+
+      - name: Upgrade npm for trusted publishing
+        # Node 22 bundles npm 10.x; OIDC trusted publishing needs npm >= 11.5.1.
+        # npm 12 requires Node >= 22.22.2, so stay on the 11.x line for Node 22.19.
+        run: |
+          npm install -g npm@11
+          npm --version
+
+      - name: Publish to npm (trusted publishing)
+        # No NODE_AUTH_TOKEN: npm authenticates with the job's OIDC token and
+        # generates provenance automatically.
+        run: |
+          npm config get registry
+          npm whoami 2>/dev/null || echo "no token configured (expected for OIDC)"
+          npm publish --access public
+
+      - name: Attach package tarball to release
+        run: |
+          npm pack --silent
+          gh release upload "$TAG" ./pi-minimal-"$VERSION".tgz --clobber
+
+      - name: Summary
+        run: |
+          {
+            echo "### Published"
+            echo "- Release: ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/releases/tag/$TAG"
+            echo "- npm: https://www.npmjs.com/package/pi-minimal/v/$VERSION"
+          } >> "$GITHUB_STEP_SUMMARY"

package/.github/workflows/release.yml

@@ -0,0 +1,42 @@
+name: Release (manual fallback)
+
+# Normal releases are fully automatic: bump the version in package.json on main
+# and .github/workflows/publish.yml tags, releases, and publishes via trusted
+# publishing. Use this only to re-run the npm publish for an existing release
+# when the automated path fails; it authenticates with the NPM_TOKEN secret.
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Existing release tag to publish (e.g. v0.2.0)"
+        required: true
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    environment:
+      name: npm
+      url: https://www.npmjs.com/package/pi-minimal
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.tag }}
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22.19.0
+          registry-url: https://registry.npmjs.org
+          cache: npm
+      - run: npm ci
+      - run: npm run lint
+      - run: npm test
+      - run: npm run build
+      - run: git diff --exit-code -- dist
+      - run: npm install -g npm@11
+      - run: npm publish --access public --provenance
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

package/CHANGELOG.md

@@ -0,0 +1,81 @@
+# Changelog
+
+All notable changes to this project are documented here. The format follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versions follow
+[Semantic Versioning](https://semver.org/).
+
+Releases are cut automatically: when the `version` in `package.json` changes on
+`main`, the Publish workflow tags it, publishes to npm, and uses the matching
+`## [x.y.z]` section below as the top of the release notes.
+
+## [Unreleased]
+
+## [0.2.2] - 2026-10-22
+
+### Added
+- Fenced code renders as a closed box (`╭─ lang ─╮` / `│ code │` / `╰───╯`)
+  instead of literal ``` lines, keeping syntax highlighting; long lines wrap
+  inside the box. pi-tui exposes no hook for this, so pi-minimal post-processes
+  the code token's rendered lines.
+
+### Changed
+- Chrome margin (status line, footer, turn rule, tool rows) follows pi's
+  `outputPad` setting so it lines up with transcript text. Set
+  `editorPaddingX` to the same value for a flush left edge.
+- Chrome modules tolerate a stale `chrome` module after `/reload`, which
+  previously could crash the renderer when the package was updated in place.
+- `mdCodeBlockBorder` in `minimal-dark` is a faint grey again (it frames the
+  box now) instead of background-coloured.
+
+## [0.2.1] - 2026-10-22
+
+### Added
+- Automated releases: when `version` in `package.json` changes on `main`, the
+  Publish workflow verifies the build, tags `vX.Y.Z`, creates a GitHub Release
+  (CHANGELOG section + generated notes + package tarball), records a deployment
+  to the `npm` environment, and publishes to npm via OIDC trusted publishing.
+- `CHANGELOG.md` and a "Releasing" section in the README.
+- The Publish workflow upgrades npm to >= 11.5.1 (required for OIDC trusted
+  publishing) and is re-runnable: an existing tag whose version is missing
+  from npm is published without re-tagging.
+- `repository`, `homepage`, and `bugs` fields in `package.json`, required for
+  npm provenance verification.
+
+### Changed
+- The release-triggered publish workflow is now a manual, token-based fallback
+  (`release.yml`) for re-publishing an existing tag.
+
+## [0.2.0] - 2026-10-22
+
+### Added
+- One-line tool rows for the built-in tools with a status glyph (`◐` running,
+  `✓` ok, `✗` failed), a fixed verb column, and a right-aligned outcome
+  (`34 lines · 1.0s`, `exit 1`, `+3 −1`, `4 matches`, `2.1 KB`).
+- Failed rows show the first line of output underneath; `ctrl+o` expands the
+  full output as a `│`-ruled block.
+- A dim turn rule (`── 15:51 · 12s · 4 tools ──`) after every agent run,
+  stored as a custom entry that never enters model context.
+- `┊` gutter on thinking paragraphs.
+- Status line shows the git branch and dirty count (`⎇ main ±1`) and colours
+  the context meter amber at 70 % and red at 90 %.
+- Footer key hints appear only when idle with an empty editor; `/compact` is
+  suggested under context pressure.
+- `minimal-dark` theme shipped with the package.
+
+### Changed
+- Tool renderers are attached with `registerToolRenderer` at extension load
+  instead of re-registering the built-in tools in `session_start`, so resumed
+  transcripts render the same way as new messages.
+- Requires pi `>=1.4.0`.
+
+## [0.1.0] - 2026-09-23
+
+### Added
+- Initial release: header/footer chrome, compact tool activity rows, working
+  status line, Herdr sibling status, Gauntlet widget hiding.
+
+[Unreleased]: https://github.com/raviy06/pi-minimal/compare/v0.2.2...HEAD
+[0.2.2]: https://github.com/raviy06/pi-minimal/compare/v0.2.1...v0.2.2
+[0.2.1]: https://github.com/raviy06/pi-minimal/compare/v0.2.0...v0.2.1
+[0.2.0]: https://github.com/raviy06/pi-minimal/compare/v0.1.0...v0.2.0
+[0.1.0]: https://github.com/raviy06/pi-minimal/releases/tag/v0.1.0

package/README.md

@@ -5,7 +5,7 @@ A Pi coding-agent package.
 ## Requirements
 
 - Node.js `>=22.19.0`
-- Pi `>=0.84.4`
+- Pi `>=1.4.0` (uses `registerToolRenderer`, `registerEntryRenderer`, `registerMarkdownTransformer`)
 
 No other Pi extension is required. Pi supplies the peer packages used by this extension.
 
@@ -16,12 +16,29 @@ Optional integrations:
 
 ## Installation
 
+```bash
+pi install npm:pi-minimal
+```
+
+Git installation also works:
+
 ```bash
 pi install git:github.com/raviy06/pi-minimal
 ```
 
 Do not load this package beside the live `grok-chrome` extension. Disable or remove `grok-chrome` before enabling `pi-minimal`.
 
+## What it changes
+
+- **Tool rows** – every built-in tool call (`bash`, `read`, `edit`, `write`, `grep`, `find`, `ls`) renders as one line: status glyph (`◐` running, `✓` ok, `✗` failed), verb, item, and a right-aligned outcome (`34 lines · 1.0s`, `exit 1`, `+3 −1`, `4 matches`). Failed rows show the first line of output underneath; `ctrl+o` expands full output in a `│`-ruled block.
+- **Turn rule** – after each agent run a dim `── 15:51 · 12s · 4 tools ──` separator is appended (stored as a custom entry; never sent to the model).
+- **Thinking gutter** – thinking paragraphs are prefixed with `┊` so they read as secondary.
+- **Status line** – one line above the editor: model · thinking level · context meter (amber at 70 %, red at 90 %) · cwd · `⎇ branch ±dirty` · Herdr siblings.
+- **Footer** – key hints appear only when the agent is idle and the editor is empty; `/compact` is suggested under context pressure.
+- **Code blocks** – fenced code renders as a closed box with the language as its title, keeping syntax highlighting, instead of literal ``` lines; long lines wrap inside the box.
+- **Alignment** – chrome follows pi's `outputPad` setting. Pi's editor uses the separate `editorPaddingX` setting (default `0`); set `"editorPaddingX": 1` for a flush left edge with the transcript.
+- **Theme** – ships `minimal-dark`: neutral tool backgrounds, visible user-message tint, dimmer thinking text, violet headings (yellow is reserved for warnings), and faint code-block frames. Select it in `/settings` → Theme, or set `"theme": "minimal-dark"`.
+
 ## Configuration
 
 The package loads JSON in this order:
@@ -37,3 +54,13 @@ The only supported key is `hideGauntletWidgets`. It defaults to `true`.
 ```json
 { "hideGauntletWidgets": true }
 ```
+
+## Releasing
+
+Releases are automatic. To ship a version:
+
+1. Add a `## [x.y.z] - YYYY-MM-DD` section to `CHANGELOG.md`.
+2. Bump `version` in `package.json` (and the expectation in `test/package.test.ts`), run `npm run build`, commit `dist/`.
+3. Merge to `main`.
+
+The Publish workflow (`.github/workflows/publish.yml`, npm's registered trusted publisher) detects the new version, verifies lint/typecheck/tests/build, tags `vx.y.z`, creates a GitHub Release (CHANGELOG section + auto-generated notes + package tarball), records a deployment to the `npm` environment, and publishes to npm via OIDC trusted publishing (provenance included). Pushes that do not change the version do nothing. `Release (manual fallback)` re-publishes an existing tag with the `NPM_TOKEN` secret if the automated path ever fails.

package/SECURITY.md

@@ -0,0 +1,21 @@
+# Security Policy
+
+## Supported Versions
+
+Use this section to tell people about which versions of your project are
+currently being supported with security updates.
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 5.1.x   | :white_check_mark: |
+| 5.0.x   | :x:                |
+| 4.0.x   | :white_check_mark: |
+| < 4.0   | :x:                |
+
+## Reporting a Vulnerability
+
+Use this section to tell people how to report a vulnerability.
+
+Tell them where to go, how often they can expect to get an update on a
+reported vulnerability, what to expect if the vulnerability is accepted or
+declined, etc.

package/dist/activity.js

@@ -7,6 +7,3 @@ export function rowIsRunning(context) {
         return false;
     return true;
 }
-export function activityBullet(running, frame) {
-    return running && frame === 1 ? "◇" : "◆";
-}

package/dist/chrome.js

@@ -1 +1,16 @@
+/**
+ * Horizontal margin for pi-minimal's chrome (status line, footer, turn rule, tool rows).
+ * Follows pi's `outputPad` setting so chrome lines up with transcript text. Pi's editor uses
+ * the separate `editorPaddingX` setting (default 0); set it to the same value for a flush
+ * left edge.
+ */
+const KEY = Symbol.for("pi-minimal.chrome-margin");
+const store = globalThis;
+/** Kept for modules linked against an older copy of this file across a hot reload. */
 export const CHROME_MARGIN = 1;
+export function chromeMargin() {
+    return store[KEY] ?? CHROME_MARGIN;
+}
+export function setChromeMargin(value) {
+    store[KEY] = value === 0 ? 0 : 1;
+}

package/dist/code-box.js

@@ -0,0 +1,69 @@
+import { Markdown, visibleWidth, wrapTextWithAnsi } from "@earendil-works/pi-tui";
+const PATCHED = Symbol.for("pi-minimal.code-box");
+/** Current framing implementation. Lives on globalThis so a /reload swaps the behaviour of the
+ *  wrapper that an earlier load already installed on pi-tui's shared Markdown prototype. */
+const FRAME_SLOT = Symbol.for("pi-minimal.code-box.frame");
+const slots = globalThis;
+export function frameCodeLines(lines, lang, width, theme) {
+    if (lines.length < 2)
+        return lines;
+    // Trailing spacer ("" after the closing fence) is preserved as-is.
+    let end = lines.length;
+    while (end > 0 && lines[end - 1] === "")
+        end -= 1;
+    if (end < 2)
+        return lines;
+    const trailer = lines.slice(end);
+    const body = lines.slice(1, end - 1);
+    const indent = theme.codeBlockIndent ?? "  ";
+    const outer = Math.max(6, width);
+    // "│ " + content + " │"
+    const innerWidth = outer - 4;
+    const label = lang ? ` ${lang} ` : "";
+    const topRule = "─".repeat(Math.max(1, outer - 3 - visibleWidth(label)));
+    const top = theme.codeBlockBorder(`╭─${label}${topRule}╮`);
+    const bottom = theme.codeBlockBorder(`╰${"─".repeat(outer - 2)}╯`);
+    const edge = theme.codeBlockBorder("│");
+    const framed = [];
+    for (const line of body) {
+        const content = line.startsWith(indent) ? line.slice(indent.length) : line;
+        for (const piece of wrapTextWithAnsi(content, innerWidth)) {
+            const pad = Math.max(0, innerWidth - visibleWidth(piece));
+            framed.push(`${edge} ${piece}${" ".repeat(pad)} ${edge}`);
+        }
+    }
+    if (framed.length === 0)
+        framed.push(`${edge} ${" ".repeat(innerWidth)} ${edge}`);
+    return [top, ...framed, bottom, ...trailer];
+}
+/**
+ * Patch pi-tui's Markdown renderer. The prototype wrapper is installed once per process; every
+ * call (including after /reload) points it at this module's `frameCodeLines`.
+ * Returns false when the renderer is not patchable.
+ */
+export function installCodeBox() {
+    slots[FRAME_SLOT] = frameCodeLines;
+    const proto = Markdown.prototype;
+    if (proto[PATCHED])
+        return true;
+    const original = proto.renderToken;
+    if (typeof original !== "function")
+        return false;
+    const originalRender = original;
+    proto.renderToken = function (token, width, next, style) {
+        const lines = originalRender.call(this, token, width, next, style);
+        if (token?.type !== "code" || !this.theme?.codeBlockBorder)
+            return lines;
+        const frame = slots[FRAME_SLOT];
+        if (!frame)
+            return lines;
+        try {
+            return frame(lines, token.lang, width, this.theme);
+        }
+        catch {
+            return lines;
+        }
+    };
+    proto[PATCHED] = true;
+    return true;
+}