pi-oracle 0.7.11 → 0.7.13

package/CHANGELOG.md

@@ -2,6 +2,32 @@
 
 ## Unreleased
 
+## 0.7.13 - 2026-06-15
+
+### Added
+- added a release-blocking ChatGPT preset proof gate (`npm run release:proof:chatgpt-presets`) so publishing requires fresh loaded-extension evidence for every canonical ChatGPT preset
+
+### Fixed
+- fixed compact ChatGPT Intelligence menu handling so selected thinking tiers that close back to `Medium`, `High`, or `Extra High` composer pills are accepted only after an intentional matching menu click instead of falling through to the removed legacy effort dropdown
+- fixed `instant_auto_switch` under the compact ChatGPT UI, where the legacy auto-switch control is absent after selecting the compact `Instant` tier
+- made ChatGPT model-configuration opening tolerate slower compact-UI hydration before reporting UI drift
+- stabilized archive creation when the compression subprocess exits before tar, so the worker terminates upstream tar immediately instead of waiting for the archive timeout
+- surfaced provider rate-limit/outage modals explicitly during ChatGPT model setup, upload, send, and response waits instead of reporting generic UI drift
+
+## 0.7.12 - 2026-06-15
+
+### Changed
+- switched Grok oracle submissions to gzip-compressed tar archives (`.tar.gz`) so Grok can extract uploaded context without `zstd`
+- centralized provider archive policy for archive format, upload ceiling, and local compression prerequisites
+- split oracle archive construction out of the agent-facing tool orchestration module
+
+### Fixed
+- preserved ChatGPT `.tar.zst` submissions and `zstd` preflight requirements when ChatGPT is explicitly selected while Grok is the configured default provider
+
+### Validation
+- ran the full `npm run verify:oracle` release gate
+- verified isolated local `pi` submissions create extractable Grok `.tar.gz` and explicit ChatGPT `.tar.zst` archives
+
 ## 0.7.11 - 2026-06-15
 
 ### Changed

package/README.md

@@ -11,7 +11,7 @@ You: /oracle Review the pending changes. Include the whole repo unless a narrowe
 
 pi-oracle:
   1. preflights local session/auth readiness
-  2. builds a context-rich `.tar.zst` repo archive
+  2. builds a context-rich provider archive (`.tar.zst` for ChatGPT, `.tar.gz` for Grok)
   3. starts an isolated provider web runtime in the background
   4. uploads the archive and prompt to the selected provider
   5. saves the response/artifacts under /tmp/oracle-<job-id>/
@@ -80,7 +80,7 @@ You need:
 - Suggested tested floor: `pi` 0.79.4 or newer; older pi versions are not blocked by package metadata but are outside the current validation baseline
 - Google Chrome/Chromium or another Chromium-family browser
 - ChatGPT or Grok already signed in to the configured local browser profile for the provider you plan to use
-- `agent-browser`, `tar`, and `zstd` available on the machine
+- `agent-browser` and `tar` available on the machine; `zstd` is also required when submitting ChatGPT `.tar.zst` archives
 - on macOS APFS clone mode, `cp` available on PATH or via `PI_ORACLE_CP_PATH`; Linux/Windows runtime profile copies use Node's recursive copy
 - a normal persisted `pi` session, not `pi --no-session`
 - on Linux, encrypted Chromium cookies may also require `secret-tool` (GNOME/libsecret) or `kwallet-query` + `dbus-send` (KDE), unless a Chrome/Brave safe-storage password override is set for the auth run
@@ -144,7 +144,7 @@ If the wake-up does not arrive, run:
 flowchart LR
     A["/oracle request"] --> B["Agent preflights, then gathers a context-rich relevant repo slice"]
     B --> C["Agent chooses context-rich archive inputs"]
-    C --> D["oracle_submit builds .tar.zst archive"]
+    C --> D["oracle_submit builds provider-specific archive"]
     D --> E["Detached worker clones isolated auth seed profile"]
     E --> F["Selected provider receives archive + prompt"]
     F --> G["Response/artifacts saved under oracle job dir"]
@@ -260,12 +260,12 @@ If macOS prompts for Keychain access during `/oracle-auth`, allow access for the
 
 ## Available providers and presets
 
-| Provider | Mode / preset | Upload ceiling |
-| --- | --- | --- |
-| ChatGPT | Presets below | 250 MiB |
-| Grok | `heavy` only | 200 MiB |
+| Provider | Mode / preset | Archive format | Upload ceiling |
+| --- | --- | --- | --- |
+| ChatGPT | Presets below | `.tar.zst` | 250 MiB |
+| Grok | `heavy` only | `.tar.gz` | 200 MiB |
 
-Grok accepts the same `.tar.zst` archives that pi-oracle builds. Manual testing against `https://grok.com` found a 200 MiB file is accepted and a 200 MiB + 1 byte file is rejected, so pi-oracle caps Grok archives at 200 MiB.
+Grok uploads now use `.tar.gz` archives. Grok may accept `.tar.zst` uploads, but its execution environment can lack `zstd` tooling to extract them; gzip-compressed tar keeps extraction on standard tools. Manual testing against `https://grok.com` found a 200 MiB upload is accepted and a 200 MiB + 1 byte upload is rejected, so pi-oracle caps Grok archives at 200 MiB.
 
 ## Available ChatGPT presets
 
@@ -355,7 +355,7 @@ This usually means the cookie import worked but the source cookies are not the a
 
 ### A local dependency like `agent-browser`, `tar`, or `zstd` is missing
 
-Install the missing local dependency and rerun the command. On macOS APFS clone mode, `cp` must also be available on PATH or configured with `PI_ORACLE_CP_PATH`; Linux and Windows profile copies use Node's recursive copy.
+Install the missing local dependency and rerun the command. `zstd` is only needed for ChatGPT `.tar.zst` archive submissions; Grok submissions use `.tar.gz`. On macOS APFS clone mode, `cp` must also be available on PATH or configured with `PI_ORACLE_CP_PATH`; Linux and Windows profile copies use Node's recursive copy.
 
 ### Auto-detection picked the wrong browser profile
 
@@ -382,7 +382,7 @@ npm test
 npm run verify:oracle
 ```
 
-`npm publish` is guarded by `prepublishOnly`, which runs `npm run release:check`. That release gate requires doctor-first macOS, Ubuntu, and Windows native Crabbox evidence. The required Crabbox runtime suite uses packed-install proof, not source-tree `pi -e` loading.
+`npm publish` is guarded by `prepublishOnly`, which runs `npm run release:check`. That release gate now blocks unless fresh live ChatGPT preset proof exists for every canonical preset, then requires doctor-first macOS, Ubuntu, and Windows native Crabbox evidence. The required Crabbox runtime suite uses packed-install proof, not source-tree `pi -e` loading.
 
 Use the narrowest validation workflow that proves the change:
 
@@ -391,6 +391,7 @@ Use the narrowest validation workflow that proves the change:
 | Everyday local iteration | `npm run verify:oracle` |
 | Platform-sensitive changes | `npm run smoke:platform:doctor`, then a focused `node scripts/platform-smoke.mjs run --target <target> --suite <suite>` |
 | Platform matrix proof | `npm run smoke:platform:all` |
+| ChatGPT preset release proof | `npm run release:proof:chatgpt-presets` |
 | Publish/release gate | `npm run release:check` |
 
 For macOS, Ubuntu, and Windows native package/build plus packed runtime validation, use [`docs/platform-smoke.md`](docs/platform-smoke.md). The full release gate is:
@@ -399,9 +400,19 @@ For macOS, Ubuntu, and Windows native package/build plus packed runtime validati
 npm run release:check
 ```
 
+Before a release, run live jobs through the loaded extension for every ChatGPT preset in `ORACLE_SUBMIT_PRESETS`. Each prompt must make the saved response contain exact markers `PRESET <preset> OK` and `PACKAGE pi-oracle`. After every job has completed, save the job ids/job directories in `.artifacts/chatgpt-preset-proof/latest.json`; `validatedAt` must be later than the completed jobs. Start from the checked, intentionally non-valid template:
+
+```bash
+mkdir -p .artifacts/chatgpt-preset-proof
+node scripts/oracle-chatgpt-preset-proof.mjs template > .artifacts/chatgpt-preset-proof/latest.json
+npm run release:proof:chatgpt-presets
+```
+
+The proof checker is intentionally part of `release:check`; it fails if the proof is missing, stale, tied to a different package version/git head, references jobs that completed before the current commit, or lacks actual persisted ChatGPT `.tar.zst` job state and response text for any canonical preset.
+
 The real runtime suite defaults to deterministic installed-tool execution so platform proof stays bounded. Provider/model defaults remain `zai/glm-5.2` for doctor/config and for optional model-agent debugging; override with `PI_ORACLE_REAL_TEST_PROVIDER` and `PI_ORACLE_REAL_TEST_MODEL` when needed. For inner-loop source loading only, use `npm run smoke:real:source`; it is not release proof. Set `PI_ORACLE_REAL_TEST_MODEL_AGENT=1` only when debugging the slower model-agent path. The optional second real-agent negative symlink check is opt-in via `PI_ORACLE_REAL_TEST_NEGATIVE_SYMLINK=1`; `npm run sanity:oracle` covers archive/symlink rejection by default without adding another model-agent turn to the platform release gate.
 
-For manual end-to-end local-extension smoke testing, use [`docs/ORACLE_ISOLATED_PI_VALIDATION.md`](docs/ORACLE_ISOLATED_PI_VALIDATION.md). That workflow launches isolated `pi` coding-agent sessions against this checkout and uses `instant` or `thinking_light`, as required by the project validation policy.
+For manual end-to-end local-extension smoke testing, use [`docs/ORACLE_ISOLATED_PI_VALIDATION.md`](docs/ORACLE_ISOLATED_PI_VALIDATION.md). Ordinary pre-commit smoke runs can still use `instant` or `thinking_light`, but release proof must cover every canonical ChatGPT preset through the loaded extension.
 
 ## Project map
 

package/docs/ORACLE_DESIGN.md

@@ -17,7 +17,7 @@ Create a `pi` extension that lets the user or agent consult ChatGPT.com or Grok
 
 - manual invocation via `/oracle ...`
 - automatic invocation by the agent in rare high-difficulty cases
-- mandatory project-context archive upload (`.tar.zst`)
+- mandatory project-context archive upload (`.tar.zst` for ChatGPT, `.tar.gz` for Grok)
 - long-running execution in the background
 - durable response/artifact persistence plus best-effort wake-the-agent behavior when the oracle response is ready
 - oracle requires a persisted pi session identity; in-memory/no-session contexts are rejected instead of risking cross-session wake-up misdelivery
@@ -340,7 +340,8 @@ Default location: `${PI_ORACLE_JOBS_DIR:-/tmp}/oracle-<job-id>/`
 ${PI_ORACLE_JOBS_DIR:-/tmp}/oracle-<job-id>/
   job.json
   prompt.md
-  context-<job-id>.tar.zst
+  context-<job-id>.tar.zst   # ChatGPT
+  context-<job-id>.tar.gz    # Grok
   response.md
   artifacts.json
   artifacts/
@@ -570,7 +571,7 @@ Retained from the earlier MVP:
 - `oracle_auth`, `oracle_submit`, `oracle_read`, `oracle_cancel`
 - detached background worker model
 - `${PI_ORACLE_JOBS_DIR:-/tmp}/oracle-<job-id>/...` state layout
-- shell-safe archive creation using `tar` piped to `zstd`
+- shell-safe archive creation using tar streams: `zstd` compression for ChatGPT and gzip compression for Grok
 - private permissions and atomic writes
 - stale-worker reconciliation
 - upload ordering: attach → confirm → fill → send
@@ -607,7 +608,7 @@ Live-validated after the concurrency redesign:
 
 Still to verify live after this pivot:
 
-- model-selection verification against the current ChatGPT UI under additional real-world variation
+- full ChatGPT preset release matrix evidence must be refreshed before any release; `npm run release:proof:chatgpt-presets` blocks release without one completed loaded-extension ChatGPT job for every canonical preset
 - optional richer terminal semantics for partial artifact failure (`complete_with_artifact_errors`) in more live scenarios
 
 ## Production readiness criteria
@@ -628,7 +629,7 @@ This architecture is now live-validated for the core release path:
 ### Current readiness summary
 
 Current release blockers for the validated scope:
-- none currently known
+- release is blocked until fresh loaded-extension ChatGPT preset proof passes `npm run release:proof:chatgpt-presets` for every canonical `ORACLE_SUBMIT_PRESETS` id
 
 Remaining non-blocking hardening work:
 - broaden live proof of the new lifecycle/state-machine model across more degraded paths
@@ -652,4 +653,4 @@ Recent proof points:
 - repo-owned sanity harness: `npm run sanity:oracle`
 - real installed-extension smoke source of truth: `scripts/oracle-real-smoke.mjs`; required release proof runs packed-install mode (`npm run smoke:real:packed`) and executes installed-package `oracle_submit` deterministically, with optional slower model-agent debugging via `PI_ORACLE_REAL_TEST_MODEL_AGENT=1`; source mode (`npm run smoke:real:source`) is inner-loop/debug only
 - macOS, Ubuntu, and Windows native package/build/runtime smoke source of truth: `docs/platform-smoke.md`; use `npm run verify:oracle` for everyday local iteration, `npm run smoke:platform:doctor` plus a focused target/suite run for platform-sensitive changes, `npm run smoke:platform:all` for doctor-first platform matrix evidence, and `npm run release:check` for the full local-plus-platform release gate
-- release gate: `npm run release:check`, also used by `prepublishOnly`, combines static verification and all required Crabbox platform smokes
+- release gate: `npm run release:check`, also used by `prepublishOnly`, combines static verification, fresh loaded-extension ChatGPT preset proof via `npm run release:proof:chatgpt-presets`, and all required Crabbox platform smokes

package/docs/ORACLE_ISOLATED_PI_VALIDATION.md

@@ -35,15 +35,34 @@ Do not add `https://github.com/fitchmultz/pi-oracle` to this repository's `.pi/s
 
 `oracle_submit` now preflights missing, unreadable, or unverified auth seed profiles before it creates an archive or persists a job. For archive-inspection smoke tests that intentionally run without real auth, use `oracle_preflight` for the blocker path or create a test seed only in a purpose-built fixture that includes the `.oracle-seed-generation` marker.
 
-## Preset requirement
+## Preset requirements
 
-Use either:
+For ordinary pre-commit isolated smoke tests, use either:
 
 - `instant`
 - `thinking_light`
 
 The examples below use `instant` because it is the fastest smoke-test preset.
 
+For any release, and for any change that touches ChatGPT model selection, run live loaded-extension jobs for every canonical ChatGPT preset from `ORACLE_SUBMIT_PRESETS`:
+
+- `pro_standard`
+- `pro_extended`
+- `thinking_light`
+- `thinking_standard`
+- `thinking_extended`
+- `thinking_heavy`
+- `instant`
+- `instant_auto_switch`
+
+Use prompts that make each saved response contain exact markers `PRESET <preset> OK` and `PACKAGE pi-oracle`. Save the completed job ids/job directories in `.artifacts/chatgpt-preset-proof/latest.json` only after every job completes; `validatedAt` must be later than those completed jobs. The checker reads the actual persisted `job.json`, worker log, and response files. Then run:
+
+```bash
+npm run release:proof:chatgpt-presets
+```
+
+`npm run release:check` runs that proof gate before release. This is intentional: publishing is blocked until every ChatGPT preset has fresh loaded-extension evidence.
+
 ## Prerequisites
 
 - `pi` installed locally

package/docs/platform-smoke.md

@@ -49,7 +49,8 @@ Use the narrowest workflow that proves the change. Do not run the full platform
 | Everyday local iteration | `npm run verify:oracle` | Syntax, bundle, platform-smoke invariants, type checks, oracle sanity, and package dry-run pass locally. |
 | Platform-sensitive change | `npm run smoke:platform:doctor`, then `node scripts/platform-smoke.mjs run --target <target> --suite <suite>` | Target setup is ready and the affected platform/suite works without paying for unrelated targets. |
 | Platform matrix proof | `npm run smoke:platform:all` | Doctor-first packed-install proof passes on every required target and suite. |
-| Publish/release gate | `npm run release:check` | Local verification (`verify:oracle`) passes, then the doctor-first platform matrix passes. |
+| ChatGPT preset release proof | `npm run release:proof:chatgpt-presets` | Fresh loaded-extension proof exists for every canonical ChatGPT preset. |
+| Publish/release gate | `npm run release:check` | Local verification (`verify:oracle`) passes, fresh ChatGPT preset proof exists, then the doctor-first platform matrix passes. |
 
 Platform-sensitive changes include archive behavior, process cleanup, runtime/browser profile handling, package metadata, Crabbox harness code, or anything that may differ across macOS/Linux/Windows.
 
@@ -77,7 +78,7 @@ Full release gate:
 npm run release:check
 ```
 
-`release:check` runs `verify:oracle` before `smoke:platform:all`, matching the Crabbox doctor-first release order: cheap harness checks, doctor, full matrix, then artifact review. `prepublishOnly` runs `npm run release:check`.
+`release:check` runs `verify:oracle`, then `release:proof:chatgpt-presets`, then `smoke:platform:all`, matching the release order: cheap harness checks, fresh live ChatGPT preset proof, doctor, full matrix, then artifact review. `prepublishOnly` runs `npm run release:check`.
 
 ## What `platform-build` proves