pi-skill-shiori 0.6.10 → 0.6.12

package/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 ## Unreleased
 
+## [0.6.12] - 2026-09-30
+
+### Changed
+
+- Update `@earendil-works/pi-*` dependencies to `0.99.1`.
+
+## [0.6.11] - 2026-09-21
+
+### Fixed
+
+- Rank curated trigger matches ahead of heuristic description matches when enforcing candidate limits. Derived single-token query variants can score a perfect `1.00` from substring matches while trigger matches are fixed at `0.95`, so a genuine trigger match could be dropped by the candidate cap. The same ordering now applies at both cap sites, because the per-variant cap runs before expanded retrieval merges variants and a match dropped there can never be restored.
+- Apply the original query's `exclude` triggers across merged variants in expanded retrieval. A derived single-token variant could drop the context that made an exclude match (`do not use auth` becomes `auth`), which reintroduced an excluded skill.
+
 ## [0.6.10] - 2026-09-21
 
 ### Fixed

package/README.md

@@ -19,7 +19,7 @@ For maintenance priorities and the phased plan, see [`ROADMAP.md`](ROADMAP.md).
 
 Pi Skill Shiori is a [Pi](https://pi.dev/) package for vaults or projects with many Agent Skills where the default catalog becomes noisy and expensive. It hides the normal skill catalog when safe, recommends triggerable skills with compact summaries, and loads full `SKILL.md` bodies on demand.
 
-`0.6.10` is the current working release. Prompt-boundary suppression is intentionally conservative: if Shiori cannot safely recognize a catalog boundary, it leaves the prompt untouched and warns instead of deleting too much.
+`0.6.12` is the current working release. Prompt-boundary suppression is intentionally conservative: if Shiori cannot safely recognize a catalog boundary, it leaves the prompt untouched and warns instead of deleting too much.
 
 ## Features
 
@@ -37,7 +37,7 @@ Pi Skill Shiori is a [Pi](https://pi.dev/) package for vaults or projects with m
 ### Global install from npm
 
 ```bash
-pi install npm:pi-skill-shiori@0.6.10
+pi install npm:pi-skill-shiori@0.6.12
 ```
 
 Without a version pin:
@@ -49,7 +49,7 @@ pi install npm:pi-skill-shiori
 ### Project-local install from npm
 
 ```bash
-pi install -l npm:pi-skill-shiori@0.6.10
+pi install -l npm:pi-skill-shiori@0.6.12
 ```
 
 Without a version pin:
@@ -61,7 +61,7 @@ pi install -l npm:pi-skill-shiori
 ### Install from GitHub
 
 ```bash
-pi install git:github.com/eiei114/pi-skill-shiori@v0.6.10
+pi install git:github.com/eiei114/pi-skill-shiori@v0.6.12
 pi install -l git:github.com/eiei114/pi-skill-shiori
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-skill-shiori",
-  "version": "0.6.10",
+  "version": "0.6.12",
   "description": "Pi extension that reduces Agent Skill catalog tokens with policy-based skill retrieval and on-demand skill loading.",
   "type": "module",
   "license": "MIT",
@@ -54,9 +54,9 @@
     "typebox": "*"
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "^0.85.0",
-    "@earendil-works/pi-coding-agent": "^0.84.1",
-    "@earendil-works/pi-tui": "^0.85.1",
+    "@earendil-works/pi-ai": "^0.99.1",
+    "@earendil-works/pi-coding-agent": "^0.99.1",
+    "@earendil-works/pi-tui": "^0.99.1",
     "@types/node": "^26.0.0",
     "tsx": "^4.22.4",
     "typebox": "latest",

package/src/retrieval-expanded.ts

@@ -1,5 +1,5 @@
 import { buildRetrievalQueries } from "./query.js";
-import { retrieveCandidates } from "./retrieval.js";
+import { compareCandidates, excludedSkillNames, retrieveCandidates } from "./retrieval.js";
 import type { ShioriPolicy, SkillCandidate, SkillRecord } from "./types.js";
 
 interface RetrievalIndex {
@@ -14,17 +14,21 @@ export function retrieveCandidatesExpanded(
 ): SkillCandidate[] {
   const byName = new Map<string, SkillCandidate>();
   const max = policy.candidateInjection.maxCandidates;
+  // Apply the original query's excludes across the merged set. A derived
+  // single-token variant can drop the context that made an exclude match
+  // ("do not use auth" becomes "auth"), which would otherwise let an excluded
+  // skill back in once variants are merged.
+  const excluded = excludedSkillNames(query, skills, policy);
 
   for (const variant of buildRetrievalQueries(query)) {
     for (const candidate of retrieveCandidates(variant, skills, policy, index)) {
+      if (excluded.has(candidate.skill.name)) continue;
       const previous = byName.get(candidate.skill.name);
       byName.set(candidate.skill.name, preferExpandedCandidate(previous, candidate));
     }
   }
 
-  return [...byName.values()]
-    .sort((a, b) => b.score - a.score || a.skill.name.localeCompare(b.skill.name))
-    .slice(0, max);
+  return [...byName.values()].sort(compareCandidates).slice(0, max);
 }
 
 /** Keep trigger badges when expanded query variants also score the description higher. */

package/src/retrieval.ts

@@ -34,10 +34,58 @@ export function retrieveCandidates(
   }
 
   return [...candidatesByName.values()]
-    .sort((a, b) => b.score - a.score || a.skill.name.localeCompare(b.skill.name))
+    .sort(compareCandidates)
     .slice(0, policy.candidateInjection.maxCandidates);
 }
 
+/**
+ * Order candidates so curated trigger matches rank ahead of heuristic
+ * description matches.
+ *
+ * Trigger matches carry a fixed score (0.95, see `evaluateSkill`), while
+ * description matches can reach a higher score from short query tokens that
+ * happen to appear as substrings — "is" in "history", "fix" in "prefix".
+ * Sorting by score alone therefore lets that noise push a genuine trigger match
+ * past a candidate cap, where it is dropped without a trace. A trigger is an
+ * explicit statement that the skill is relevant, so it outranks a heuristic
+ * substring match even when the heuristic scored higher.
+ *
+ * Every cap site must use this comparator: the per-variant cap inside
+ * `retrieveCandidates` runs before expanded retrieval merges variants, so a
+ * trigger match dropped there can never be restored downstream.
+ */
+export function compareCandidates(a: SkillCandidate, b: SkillCandidate): number {
+  const triggerDelta = Number(b.reason === "trigger") - Number(a.reason === "trigger");
+  if (triggerDelta !== 0) return triggerDelta;
+  return b.score - a.score || a.skill.name.localeCompare(b.skill.name);
+}
+
+/**
+ * Skill names the original query excludes via policy exclude triggers.
+ *
+ * `retrieveCandidates` evaluates excludes against whichever query string it
+ * receives. Expanded retrieval passes derived variants, and a derived variant can
+ * drop the surrounding context that made an exclude match ("do not use auth"
+ * becomes "auth"), so the exclusion no longer applies and the skill leaks back
+ * in. Callers that merge variants should apply the original query's excludes
+ * across the merged set.
+ */
+export function excludedSkillNames(
+  query: string,
+  skills: SkillRecord[],
+  policy: ShioriPolicy,
+): Set<string> {
+  const normalizedQuery = normalize(query);
+  const excluded = new Set<string>();
+  for (const skill of skills) {
+    const excludes = policy.skills[skill.name]?.triggers?.exclude ?? [];
+    if (excludes.some((trigger) => includesNormalized(normalizedQuery, trigger))) {
+      excluded.add(skill.name);
+    }
+  }
+  return excluded;
+}
+
 function evaluateSkill(
   skill: SkillRecord,
   normalizedQuery: string,