takomi 2.1.28 → 2.1.30

package/.pi/prompts/build-prompt.md

@@ -11,6 +11,21 @@ Follow the blueprints precisely. Verify constantly.
 
 ---
 
+## Build Orchestration Readiness
+
+If Build is being run through an orchestration session, do not start with bare board placeholders.
+Before dispatching Build subagents, each Build task packet must include:
+- exact FR IDs and mockup files covered
+- objective and concrete scope boundaries
+- dependencies and handoff assumptions
+- expected files/artifacts
+- definition of done and verification commands
+- privacy/payment/security constraints that apply
+
+If existing Build task packets say `Scope: None specified`, `Definition Of Done: None specified`, or `Expected Artifacts: None specified`, pause and repair the task packet before launching or continuing subagents.
+
+---
+
 ## Steps
 
 ### 1. Context Loading (MANDATORY)

package/.pi/prompts/genesis-prompt.md

@@ -138,3 +138,11 @@ Usually recommend:
 - make decisive recommendations when the evidence is clear
 - make the output strong enough that design/build can follow without guessing
 - keep FRs and issue files aligned 1:1
+
+## Tool-Use Safety for Genesis Artifacts
+- Do not generate PRDs, coding guidelines, builder prompts, issue packs, or session docs by embedding huge markdown strings inside a single `bash` command.
+- Prefer `write` for large markdown artifacts.
+- For many repeated issue files, `write` a compact generator script first, then run that script with `bash`.
+- Use `bash` for short filesystem commands, script execution, and verification only.
+- Avoid massive inline heredocs because they can hit command-length limits and fail before writing anything.
+- If `ENAMETOOLONG` appears, immediately switch to file-based writes or a written generator script; do not retry the same oversized inline command.

package/.pi/prompts/takomi-prompt.md

@@ -27,6 +27,22 @@ Always-on Takomi behavior.
 - For implementation, verify before claiming completion.
 - For planning/review, produce actionable handoffs rather than vague commentary.
 
+## Large Generated Content / Bash Safety
+- Do not place large generated documents or long scripts directly inside a `bash` command.
+- If generating large content, use `write` for individual markdown/text files.
+- If many files need generated content, first `write` a small generator script to disk, then run it with a short `bash` command.
+- Keep `bash` commands short and focused on shell work: directory creation, running scripts, inspections, and verification.
+- Never use massive inline heredocs for multi-file generation; they can fail with OS command-length limits such as `ENAMETOOLONG`, especially on Windows.
+- If a command fails with `ENAMETOOLONG`, do not retry the same inline approach. Switch immediately to file-based writes or a written generator script.
+
+## Launch-Ready Orchestration Tasks
+- Never use `takomi_board` as a placeholder task generator for Design or Build stage work.
+- Before `takomi_board init_session` or `takomi_board expand_stage`, author launch-ready task packets or provide full `taskMarkdown` for every non-trivial task.
+- A launch-ready task packet must have non-empty Objective, Scope, Context, Definition of Done, Expected Artifacts, Dependencies, Verification/Review checkpoint, and exact prime-agent files to read.
+- JSON task fields are tracking metadata only; they must not replace the human-readable task packet.
+- If the subagent launch prompt is more detailed than the task packet, copy that launch prompt back into the task packet before or immediately after launch.
+- Do not move to the next lifecycle stage with `Scope: None specified`, `Definition Of Done: None specified`, or `Expected Artifacts: None specified` task files.
+
 ## Provider / Model Selection
 Before using `takomi_subagent`, setting a model override, or naming a provider/model:
 - use the injected Pi model-registry context and active Takomi routing policy

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "takomi",
-  "version": "2.1.28",
+  "version": "2.1.30",
   "description": "🎯 Stop wrestling with AI. Start building with purpose. The artisan's toolkit for agent workflows, Codex skills, and original Takomi capabilities like 21st.dev integration.",
   "type": "module",
   "bin": {
@@ -23,7 +23,7 @@
   ],
   "scripts": {
     "postinstall": "node src/postinstall.js",
-    "test": "echo \"Error: no test specified\" && exit 1",
+    "test": "node scripts/test-skill-selection.js",
     "test:skills": "node scripts/test-skill-selection.js"
   },
   "repository": {
@@ -45,6 +45,11 @@
   "author": "J StaR Films Studios",
   "license": "ISC",
   "dependencies": {
+    "@earendil-works/pi-ai": "^0.78.1",
+    "@mariozechner/pi-agent-core": "^0.70.6",
+    "@mariozechner/pi-ai": "^0.70.2",
+    "@mariozechner/pi-coding-agent": "^0.70.2",
+    "@mariozechner/pi-tui": "^0.70.6",
     "commander": "^13.1.0",
     "figlet": "^1.8.0",
     "fs-extra": "^11.3.0",
@@ -58,11 +63,8 @@
   "homepage": "https://github.com/JStaRFilms/VibeCode-Protocol-Suite#readme",
   "devDependencies": {
     "@earendil-works/pi-agent-core": "^0.78.1",
-    "@earendil-works/pi-ai": "^0.78.1",
     "@earendil-works/pi-coding-agent": "^0.78.1",
     "@earendil-works/pi-tui": "^0.78.1",
-    "@mariozechner/pi-ai": "^0.70.2",
-    "@mariozechner/pi-coding-agent": "^0.70.2",
     "@types/node": "^25.5.2",
     "typebox": "^1.1.33",
     "typescript": "^6.0.2"

package/src/pi-harness.js

@@ -213,6 +213,42 @@ function runCommand(command, args) {
   return spawnSync(command, args, { stdio: 'pipe', encoding: 'utf8', shell: process.platform === 'win32' });
 }
 
+function runCommandWithTimeout(command, args, timeoutMs) {
+  return new Promise((resolve) => {
+    let stdout = '';
+    let stderr = '';
+    let settled = false;
+    let timedOut = false;
+
+    const child = spawn(command, args, {
+      stdio: ['ignore', 'pipe', 'pipe'],
+      shell: process.platform === 'win32',
+      windowsHide: true,
+    });
+
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve({ stdout, stderr, timedOut, ...result });
+    };
+
+    const timer = setTimeout(() => {
+      timedOut = true;
+      try { child.kill(); } catch {}
+      setTimeout(() => {
+        try { child.kill('SIGKILL'); } catch {}
+      }, 1500).unref?.();
+    }, timeoutMs);
+    timer.unref?.();
+
+    child.stdout?.on('data', (chunk) => { stdout += chunk.toString(); });
+    child.stderr?.on('data', (chunk) => { stderr += chunk.toString(); });
+    child.on('error', (error) => finish({ status: 1, error }));
+    child.on('close', (code) => finish({ status: timedOut ? null : code }));
+  });
+}
+
 export async function ensurePiInstalled() {
   const before = await detectPiCommand();
   if (before.installed) {
@@ -300,17 +336,28 @@ export function printPiSubagentsInstallResult(result) {
   if (result.report) console.log(pc.dim(result.report.split(/\r?\n/).slice(-8).join('\n')));
 }
 
-export async function updatePiManagedPackages() {
+export async function updatePiManagedPackages({ timeoutMs = 20_000 } = {}) {
+  if (process.env.TAKOMI_SKIP_PI_PACKAGE_UPDATE === '1') {
+    return { ok: true, changed: false, report: 'Skipped Pi package update because TAKOMI_SKIP_PI_PACKAGE_UPDATE=1.' };
+  }
+
   const pi = await detectPiCommand();
   if (!pi.installed) return { ok: false, changed: false, report: 'Pi is not installed.' };
 
-  // `pi update` reconciles every package listed in Pi settings, including
-  // user-installed npm/git/local packages. Keep this broad so Takomi refresh
-  // updates old, new, custom, and optional feature packages without needing to
-  // know their names ahead of time.
+  // `pi update` reconciles packages from Pi settings, including user-installed
+  // npm/git/local packages. Treat this as a best-effort follow-up: third-party
+  // packages or manual extension entries must never hang Takomi installation.
   const command = pi.path || 'pi';
-  const result = runCommand(command, ['update']);
+  const result = await runCommandWithTimeout(command, ['update'], timeoutMs);
   const output = [result.stdout, result.stderr].filter(Boolean).join('\n').trim();
+  if (result.timedOut) {
+    return {
+      ok: false,
+      changed: false,
+      report: `Timed out after ${Math.round(timeoutMs / 1000)}s while running \`pi update\`. Takomi setup is complete; retry package updates later with \`pi update\` or skip this step with TAKOMI_SKIP_PI_PACKAGE_UPDATE=1. Last output:\n${output}`.trim(),
+    };
+  }
+
   return {
     ok: result.status === 0,
     changed: result.status === 0,