thoth-agents 0.13.1 → 0.14.0

package/dist/{chunk-A7IGKE4R.js → chunk-ECCXTDVD.js}

@@ -17,7 +17,7 @@ import {
   savePiModelConfig,
   syncPiSpecialists,
   writePiManagedText
-} from "./chunk-422L76R5.js";
+} from "./chunk-7B7JYFIJ.js";
 import {
   ALL_AGENT_NAMES,
   CLAUDE_CODE_PROMPT_DIALECT,
@@ -57,7 +57,7 @@ import {
   withoutLegacyPresets,
   writeConfig,
   writeLiteConfig
-} from "./chunk-HFBCW4MD.js";
+} from "./chunk-5ANFI4LW.js";
 
 // src/cli/model-effort.ts
 function normalizeEffortSelection(value) {
@@ -9277,12 +9277,6 @@ var PI_PACKAGE_SPECS = [
     packageName: "@thoth-agents/pi-subagents",
     version: "0.3.0"
   },
-  {
-    id: "context7",
-    source: "npm:@upstash/context7-pi@>=0.1.2",
-    packageName: "@upstash/context7-pi",
-    version: "0.1.2"
-  },
   {
     id: "web-access",
     source: "npm:pi-web-access@>=0.27.0",
@@ -9327,6 +9321,12 @@ var PI_PACKAGE_SPECS = [
     packageName: "@thoth-agents/pi-sidebar",
     version: "0.3.0",
     preserveUserCopy: true
+  },
+  {
+    id: "contained-shell",
+    source: "npm:@thoth-agents/pi-contained-shell@>=0.1.0",
+    packageName: "@thoth-agents/pi-contained-shell",
+    version: "0.1.0"
   }
 ];
 var PI_GREP_MCP_ENTRY = {
@@ -9334,6 +9334,13 @@ var PI_GREP_MCP_ENTRY = {
   protocolVersion: "legacy",
   lifecycle: "lazy"
 };
+var PI_CONTEXT7_MCP_ENTRY = {
+  url: "https://mcp.context7.com/mcp",
+  protocolVersion: "auto",
+  lifecycle: "lazy",
+  // biome-ignore lint/suspicious/noTemplateCurlyInString: MCP adapter environment expansion, not JavaScript interpolation.
+  headers: { CONTEXT7_API_KEY: "${CONTEXT7_API_KEY:-}" }
+};
 function getPiFirstPartySource(version) {
   return `npm:thoth-agents@${version}`;
 }
@@ -9488,41 +9495,47 @@ function piPreservedPackageRecovery(spec, evidence) {
 }
 var PI_INCUMBENT_TODO_NAME = "@juicesharp/rpiv-todo";
 var PI_INCUMBENT_QUESTIONS_NAME = "@juicesharp/rpiv-ask-user-question";
-function piQuestionSourceName(source) {
+var PI_REPLACED_PACKAGES = [
+  PI_INCUMBENT_QUESTIONS_NAME,
+  "@upstash/context7-pi"
+];
+function piNpmSourceName(source) {
   if (!source.startsWith("npm:")) return void 0;
   const spec = source.slice(4).trim();
   const alias = spec.indexOf("@npm:");
   const target = alias >= 0 ? spec.slice(alias + 5) : spec;
   return target.match(/^(@[^/@\s]+\/[^/@\s]+|[^/@\s]+)(?:@.+)?$/)?.[1];
 }
-function findPiIncumbentQuestions(packages) {
+function findPiReplacedPackages(packages) {
   return packages.filter(
-    (candidate) => piQuestionSourceName(candidate.source) === PI_INCUMBENT_QUESTIONS_NAME || configuredPackageIdentity(candidate).packageName === PI_INCUMBENT_QUESTIONS_NAME
+    (candidate) => PI_REPLACED_PACKAGES.includes(piNpmSourceName(candidate.source) ?? "") || PI_REPLACED_PACKAGES.includes(
+      configuredPackageIdentity(candidate).packageName ?? ""
+    )
   );
 }
-function piQuestionIdentityBlockers(packages, plan) {
+function piReplacedPackageIdentityBlockers(packages, plan) {
   return packages.flatMap((candidate) => {
     const manifest = configuredPackageManifest(candidate);
     if (typeof manifest?.name === "string" && manifest.name) return [];
     const npmSource = candidate.source.startsWith("npm:");
-    const questionSource = /(?:^|[\\/:@?#._-])rpiv-ask-user-question(?:$|[\\/:@?#._-])/i.test(
+    const replacedSource = /(?:^|[\\/:@?#._-])(?:rpiv-ask-user-question|context7-pi)(?:$|[\\/:@?#._-])/i.test(
       candidate.source
     );
     const unresolvedNpmLocation = npmSource && !candidate.installedPath;
-    const unresolvedAlias = npmSource && candidate.source.includes("@npm:") && !piQuestionSourceName(candidate.source);
-    const previewedQuestion = candidate.scope === "user" && plan?.items.some(
+    const unresolvedAlias = npmSource && candidate.source.includes("@npm:") && !piNpmSourceName(candidate.source);
+    const previewedPackage = candidate.scope === "user" && plan?.items.some(
       ({ command }) => command?.command === "pi" && command.args[0] === "remove" && command.args[1] === candidate.source && command.args[2] === "--no-approve"
     );
-    if (manifest && !previewedQuestion) return [];
-    if (!questionSource && !unresolvedNpmLocation && !unresolvedAlias && !previewedQuestion)
+    if (manifest && !previewedPackage) return [];
+    if (!replacedSource && !unresolvedNpmLocation && !unresolvedAlias && !previewedPackage)
       return [];
     const flags = candidate.scope === "project" ? "--local --approve" : "--no-approve";
     return [
-      `Cannot verify configured Pi package ${candidate.source}: installed manifest identity is unavailable. Review its ownership and inspect its package.json using pi list; if it is ${PI_INCUMBENT_QUESTIONS_NAME}, manually run pi remove ${candidate.source} ${flags}. Verify removal, then rerun setup preview.`
+      `Cannot verify configured Pi package ${candidate.source}: installed manifest identity is unavailable. Review its ownership and inspect its package.json using pi list; if it is ${PI_REPLACED_PACKAGES.join(" or ")}, manually run pi remove ${candidate.source} ${flags}. Verify removal, then rerun setup preview.`
     ];
   });
 }
-function piUnpreviewedQuestionRecovery(plan, packages) {
+function piUnpreviewedPackageRecovery(plan, packages) {
   const previewed = new Set(
     plan.items.flatMap(
       ({ command }) => command?.command === "pi" && command.args[0] === "remove" && command.args[2] === "--no-approve" ? [command.args[1]] : []
@@ -9533,12 +9546,15 @@ function piUnpreviewedQuestionRecovery(plan, packages) {
   );
   if (unpreviewed.length === 0) return void 0;
   return unpreviewed.map(
-    ({ source }) => `Pi question migration blocked: incumbent ${source} was not previewed for removal. Review its ownership, then manually run: pi remove ${source} --no-approve. Verify with pi list, then rerun setup preview; no unpreviewed incumbent may be removed automatically.`
+    ({ source }) => `Pi replaced-package migration blocked: incumbent ${source} was not previewed for removal. Review its ownership, then manually run: pi remove ${source} --no-approve. Verify with pi list, then rerun setup preview; no unpreviewed incumbent may be removed automatically.`
   ).join("\n");
 }
-function piProjectQuestionConflict(candidate) {
+function piProjectReplacedPackageConflict(candidate) {
   const source = candidate.unmappedSource ? "<source>" : candidate.source;
-  return `Incumbent Pi question package ${candidate.source} conflicts with @thoth-agents/pi-questions-user. ${candidate.identityLimitation ? `${candidate.identityLimitation} ` : ""}Review the project's ownership and trust first; --approve trusts project-local settings for this command only without saving a trust decision. ${candidate.unmappedSource ? "Find the matching project settings entry, then" : "Then"} run: pi remove ${source} --local --approve. Verify removal, then rerun setup.`;
+  const context7 = piNpmSourceName(candidate.source) === "@upstash/context7-pi" || configuredPackageIdentity(candidate).packageName === "@upstash/context7-pi";
+  const replacement = context7 ? "the managed Context7 MCP entry" : "@thoth-agents/pi-questions-user";
+  const kind = context7 ? "Context7 extension" : "question package";
+  return `Incumbent Pi ${kind} ${candidate.source} conflicts with ${replacement}. ${candidate.identityLimitation ? `${candidate.identityLimitation} ` : ""}Review the project's ownership and trust first; --approve trusts project-local settings for this command only without saving a trust decision. ${candidate.unmappedSource ? "Find the matching project settings entry, then" : "Then"} run: pi remove ${source} --local --approve. Verify removal, then rerun setup.`;
 }
 function isPiIncumbentTodoSource(source) {
   return /^npm:@juicesharp\/rpiv-todo(?:@|$)/.test(source);
@@ -9737,7 +9753,7 @@ function scanPiProjectInstalledIncumbents(options, configuredPackages) {
           unmappedSource: true
         };
         const identity = configuredPackageIdentity(candidate);
-        if ((identity.packageName === PI_INCUMBENT_TODO_NAME || identity.packageName === PI_INCUMBENT_QUESTIONS_NAME) && !knownPaths.has(key))
+        if ((identity.packageName === PI_INCUMBENT_TODO_NAME || PI_REPLACED_PACKAGES.includes(identity.packageName)) && !knownPaths.has(key))
           incumbents.push({
             ...candidate,
             ...identity,
@@ -9759,12 +9775,14 @@ function mergePiCodemodeSettings(current) {
   if (current.codemode !== void 0 && !isRecord7(current.codemode))
     throw new Error("Global Pi codemode must be a JSON object.");
   const codemode = isRecord7(current.codemode) ? current.codemode : {};
-  let defaultTools = tools ?? ["+codemode"];
-  if (!defaultTools.some(
-    (tool) => ["codemode", "+codemode", "-codemode"].includes(tool)
-  )) {
+  let defaultTools = tools ?? ["+codemode", "+tool_search"];
+  for (const name of ["codemode", "tool_search"]) {
+    if (defaultTools.some(
+      (tool) => [name, `+${name}`, `-${name}`].includes(tool)
+    ))
+      continue;
     const additive = defaultTools.length > 0 && defaultTools.every((tool) => /^[+-]/.test(tool));
-    defaultTools = [...defaultTools, additive ? "+codemode" : "codemode"];
+    defaultTools = [...defaultTools, additive ? `+${name}` : name];
   }
   return {
     ...current,
@@ -9788,15 +9806,27 @@ function mergePiGrepMcpConfig(current) {
     throw new Error("Global MCP mcpServers must be a JSON object.");
   }
   const servers = isRecord7(rawServers) ? rawServers : {};
-  const existing = servers.grep;
-  if (existing !== void 0 && JSON.stringify(existing) !== JSON.stringify(PI_GREP_MCP_ENTRY)) {
-    throw new Error(
-      'Global MCP server "grep" is not owned by thoth-agents and conflicts with the required grep.app entry.'
-    );
+  for (const [name, entry] of Object.entries({
+    grep: PI_GREP_MCP_ENTRY,
+    context7: PI_CONTEXT7_MCP_ENTRY
+  })) {
+    const existing = servers[name];
+    if (existing !== void 0 && JSON.stringify(existing) !== JSON.stringify(entry)) {
+      throw new Error(
+        `Global MCP server "${name}" is not owned by thoth-agents and conflicts with the required ${name === "grep" ? "grep.app" : "Context7"} entry.`
+      );
+    }
   }
   return {
     ...current,
-    mcpServers: { ...servers, grep: { ...PI_GREP_MCP_ENTRY } }
+    mcpServers: {
+      ...servers,
+      grep: { ...PI_GREP_MCP_ENTRY },
+      context7: {
+        ...PI_CONTEXT7_MCP_ENTRY,
+        headers: { ...PI_CONTEXT7_MCP_ENTRY.headers }
+      }
+    }
   };
 }
 function frontmatterValue(content, field) {
@@ -9870,7 +9900,7 @@ function buildPiSetupPlan(options = {}) {
     }
   }
   let userPackages = [];
-  let plannedQuestionRemovals = [];
+  let plannedPackageRemovals = [];
   let codemodeSettingsContent;
   let subagentsConfigContent;
   let mcpContent;
@@ -9898,8 +9928,8 @@ function buildPiSetupPlan(options = {}) {
     if (incumbentBlockers.length > 0)
       throw new Error(incumbentBlockers.join("\n"));
     userPackages = resolvePiConfiguredPackages(userSettings, "user", options);
-    blockers.push(...piQuestionIdentityBlockers(userPackages));
-    plannedQuestionRemovals = findPiIncumbentQuestions(userPackages);
+    blockers.push(...piReplacedPackageIdentityBlockers(userPackages));
+    plannedPackageRemovals = findPiReplacedPackages(userPackages);
     subagentsConfigContent = `${JSON.stringify(
       mergePiSubagentsConfig(readJsonObject(paths.subagentsConfigPath)),
       null,
@@ -9933,7 +9963,7 @@ function buildPiSetupPlan(options = {}) {
   } catch (error) {
     blockers.push(error instanceof Error ? error.message : String(error));
   }
-  blockers.push(...piQuestionIdentityBlockers(projectPackages));
+  blockers.push(...piReplacedPackageIdentityBlockers(projectPackages));
   for (const pkg of getPiExternalPackageSpecs(options)) {
     if (!pkg.preserveUserCopy) continue;
     const recovery = piPreservedPackageRecovery(
@@ -9960,8 +9990,8 @@ function buildPiSetupPlan(options = {}) {
       `Incumbent Pi task-list package ${incumbent.source} ${location} and conflicts with @thoth-agents/pi-todo. ${recovery}`
     );
   }
-  for (const incumbent of findPiIncumbentQuestions(projectPackages))
-    blockers.push(piProjectQuestionConflict(incumbent));
+  for (const incumbent of findPiReplacedPackages(projectPackages))
+    blockers.push(piProjectReplacedPackageConflict(incumbent));
   for (const path of [...paths.projectAgentRoots, ...paths.projectMcpPaths]) {
     if (existsSync14(path))
       diagnostics.push(
@@ -9991,9 +10021,9 @@ function buildPiSetupPlan(options = {}) {
         args: ["install", firstPartySource, "--no-approve"]
       }
     },
-    ...plannedQuestionRemovals.map(({ source }) => ({
+    ...plannedPackageRemovals.map(({ source }) => ({
       kind: "preflight",
-      description: "Remove the conflicting user question provider through native Pi removal after root-package verification",
+      description: "Remove the replaced user package through native Pi removal after root-package verification",
       target: source,
       command: { command: "pi", args: ["remove", source, "--no-approve"] }
     })),
@@ -10022,7 +10052,7 @@ function buildPiSetupPlan(options = {}) {
     ...mcpContent === void 0 ? [] : [
       {
         kind: "mcp",
-        description: "Merge attributable global grep.app MCP entry",
+        description: "Merge attributable global grep.app and Context7 MCP entries",
         target: paths.mcpConfigPath,
         content: mcpContent
       }
@@ -10044,7 +10074,7 @@ function buildPiSetupPlan(options = {}) {
     projectIncumbentTodos,
     disclaimers: [
       "Pi extensions execute with the invoking user's system permissions; package minimums and tool allowlists are not a security sandbox.",
-      "Context7 and web access are native Pi extensions; only grep.app uses pi-mcp-adapter and directTools is intentionally omitted.",
+      "Web access is a native Pi extension; Context7 and grep.app use lazy pi-mcp-adapter entries with directTools intentionally omitted.",
       "Project-local resources require Pi trust and may shadow global resources.",
       "Global subagents.json requests lean session resources; project-local subagents.json may override it, and full child resource mode is unsupported."
     ],
@@ -10314,12 +10344,12 @@ function applyPiSetup(plan) {
         installedPackages
       };
     }
-    const projectQuestions = findPiIncumbentQuestions([
+    const projectReplacedPackages = findPiReplacedPackages([
       ...configuredBefore.filter(({ scope }) => scope === "project"),
       ...configuredProjectPackages
     ]);
-    if (projectQuestions.length > 0) {
-      const recovery = projectQuestions.map(piProjectQuestionConflict).join("\n");
+    if (projectReplacedPackages.length > 0) {
+      const recovery = projectReplacedPackages.map(piProjectReplacedPackageConflict).join("\n");
       return {
         success: false,
         changed,
@@ -10330,19 +10360,19 @@ function applyPiSetup(plan) {
         manualRecovery: recovery
       };
     }
-    const unpreviewedQuestions = piUnpreviewedQuestionRecovery(
+    const unpreviewedPackages = piUnpreviewedPackageRecovery(
       plan,
-      findPiIncumbentQuestions(configuredBefore)
+      findPiReplacedPackages(configuredBefore)
     );
-    if (unpreviewedQuestions)
+    if (unpreviewedPackages)
       return {
         success: false,
         changed,
         diagnostics,
-        error: unpreviewedQuestions,
+        error: unpreviewedPackages,
         failedStep: "preflight",
         installedPackages,
-        manualRecovery: unpreviewedQuestions
+        manualRecovery: unpreviewedPackages
       };
     const incumbentTodos = findPiIncumbentTodos([
       ...configuredBefore,
@@ -10399,7 +10429,7 @@ function applyPiSetup(plan) {
       throw new Error(
         `First-party Pi package ownership conflict: ${ownership.reason ?? ownership.state}`
       );
-    const identityRecovery = piQuestionIdentityBlockers(
+    const identityRecovery = piReplacedPackageIdentityBlockers(
       [...configuredBefore, ...configuredProjectPackages],
       plan
     ).join("\n");
@@ -10539,31 +10569,33 @@ function applyPiSetup(plan) {
     if (!migration.success)
       throw new Error(migration.error ?? "Pi legacy migration failed.");
     changed.push(...migration.changed);
-    const questionListing = execute("pi", ["list", "--no-approve"]);
-    if (questionListing.exitCode !== 0)
+    const replacementListing = execute("pi", ["list", "--no-approve"]);
+    if (replacementListing.exitCode !== 0)
       throw new Error(
-        `Unable to inspect conflicting Pi question packages: ${questionListing.stderr.trim() || "pi list unavailable"}`
+        `Unable to inspect replaced Pi packages: ${replacementListing.stderr.trim() || "pi list unavailable"}`
       );
-    const questionPackages = resolvePiListedPackages(
-      questionListing.stdout,
+    const replacementPackages = resolvePiListedPackages(
+      replacementListing.stdout,
       plan.options
     );
-    const freshProjectQuestions = findPiIncumbentQuestions(
-      questionPackages
+    const freshProjectReplacements = findPiReplacedPackages(
+      replacementPackages
     ).filter(({ scope }) => scope === "project");
-    const questionRecovery = freshProjectQuestions.length > 0 ? freshProjectQuestions.map(piProjectQuestionConflict).join("\n") : piUnpreviewedQuestionRecovery(
+    const replacementRecovery = freshProjectReplacements.length > 0 ? freshProjectReplacements.map(piProjectReplacedPackageConflict).join("\n") : piUnpreviewedPackageRecovery(
       plan,
-      findPiIncumbentQuestions(questionPackages)
-    ) ?? (piQuestionIdentityBlockers(questionPackages, plan).join("\n") || void 0);
-    if (questionRecovery) {
-      manualRecovery = questionRecovery;
-      throw new Error(questionRecovery);
-    }
-    const incumbentQuestions = findPiIncumbentQuestions(
-      questionPackages
+      findPiReplacedPackages(replacementPackages)
+    ) ?? (piReplacedPackageIdentityBlockers(replacementPackages, plan).join(
+      "\n"
+    ) || void 0);
+    if (replacementRecovery) {
+      manualRecovery = replacementRecovery;
+      throw new Error(replacementRecovery);
+    }
+    const incumbentReplacements = findPiReplacedPackages(
+      replacementPackages
     ).filter(({ scope }) => scope === "user");
-    for (const incumbent of incumbentQuestions) {
-      const unpreviewed = piUnpreviewedQuestionRecovery(plan, [incumbent]);
+    for (const incumbent of incumbentReplacements) {
+      const unpreviewed = piUnpreviewedPackageRecovery(plan, [incumbent]);
       if (unpreviewed) {
         manualRecovery = unpreviewed;
         throw new Error(unpreviewed);
@@ -10575,29 +10607,32 @@ function applyPiSetup(plan) {
       ]);
       if (removed.exitCode !== 0)
         throw new Error(
-          `Failed to remove conflicting Pi question package ${incumbent.source}: ${removed.stderr.trim() || "unknown Pi error"}`
+          `Failed to remove replaced Pi package ${incumbent.source}: ${removed.stderr.trim() || "unknown Pi error"}`
         );
     }
-    if (incumbentQuestions.length > 0) {
+    if (incumbentReplacements.length > 0) {
       const afterRemoval = execute("pi", ["list", "--no-approve"]);
       const remaining = resolvePiListedPackages(
         afterRemoval.stdout,
         plan.options
       );
-      const identityRecovery2 = piQuestionIdentityBlockers(remaining, plan).join(
-        "\n"
-      );
+      const identityRecovery2 = piReplacedPackageIdentityBlockers(
+        remaining,
+        plan
+      ).join("\n");
       if (identityRecovery2) {
         manualRecovery = identityRecovery2;
         throw new Error(identityRecovery2);
       }
-      if (afterRemoval.exitCode !== 0 || findPiIncumbentQuestions(remaining).some(
+      if (afterRemoval.exitCode !== 0 || findPiReplacedPackages(remaining).some(
         ({ scope }) => scope === "user"
       ) || remaining.some(
-        ({ scope, source }) => scope === "user" && incumbentQuestions.some((incumbent) => incumbent.source === source)
+        ({ scope, source }) => scope === "user" && incumbentReplacements.some(
+          (incumbent) => incumbent.source === source
+        )
       ))
         throw new Error(
-          "Pi did not verify removal of the conflicting user question package; rerun pi list and remove it before retrying setup."
+          "Pi did not verify removal of the replaced user package; rerun pi list and remove it before retrying setup."
         );
     }
     for (const pkg of getPiExternalPackageSpecs(plan.options)) {
@@ -10820,15 +10855,15 @@ var RESEARCH_PROVIDER_LABEL = {
 function researchRuntimeState(provider, targets, evidence) {
   const observed = evidence.research?.[provider];
   if (observed) return observed;
-  const packageId = provider === "grep" ? "grep-adapter" : provider;
+  const packageId = provider === "web-access" ? provider : "grep-adapter";
   const packageSource = PI_PACKAGE_SPECS.find(
     ({ id }) => id === packageId
   )?.source;
   const packageReady = targets.some(
     ({ path, state }) => path === packageSource && state === "installed"
   );
-  const configReady = provider !== "grep" || targets.some(
-    ({ kind, label, state }) => kind === "config" && label?.includes("grep.app") && state === "installed"
+  const configReady = provider === "web-access" || targets.some(
+    ({ kind, label, state }) => kind === "config" && label === `${RESEARCH_PROVIDER_LABEL[provider]} MCP entry` && state === "installed"
   );
   if (!packageReady || !configReady)
     return {
@@ -10837,15 +10872,10 @@ function researchRuntimeState(provider, targets, evidence) {
         "managed package or configuration preconditions are not satisfied"
       ]
     };
-  return provider === "web-access" ? {
+  return {
     state: "unverified",
     basis: [
-      "exact package is installed; no live provider request was observed"
-    ]
-  } : {
-    state: "ready",
-    basis: [
-      "managed package and configuration preconditions are satisfied; no live probe was requested"
+      "managed package/configuration evidence is present; no live provider request was observed"
     ]
   };
 }
@@ -10885,6 +10915,25 @@ function statusFromPlan(plan, context2, evidence = {}) {
     expected: item.kind === "package" ? item.target : "attributable managed content",
     description: item.kind === "package" ? "Validated installed-package manifest evidence; this does not prove live tool availability." : void 0
   }));
+  let mcpServers;
+  try {
+    const config = JSON.parse(readFileSync14(plan.paths.mcpConfigPath, "utf8"));
+    mcpServers = config.mcpServers;
+  } catch {
+  }
+  for (const [provider, entry] of Object.entries({
+    context7: PI_CONTEXT7_MCP_ENTRY,
+    grep: PI_GREP_MCP_ENTRY
+  })) {
+    const existing = mcpServers?.[provider];
+    targets.push({
+      kind: "config",
+      path: plan.paths.mcpConfigPath,
+      label: `${RESEARCH_PROVIDER_LABEL[provider]} MCP entry`,
+      state: existing === void 0 ? "missing" : JSON.stringify(existing) === JSON.stringify(entry) ? "installed" : "drift",
+      description: "Managed MCP entry evidence only; no live provider request was observed."
+    });
+  }
   const execute = context2.piCommandExecutor ?? ((command, args) => {
     const result = spawnSync8(command, [...args], {
       windowsHide: true,

package/dist/{chunk-KUA3F4D6.js → chunk-T2K7DYTA.js}

@@ -16,7 +16,7 @@ import {
   loadAgentPrompt,
   renderAgentRoutingDescription,
   renderRolePrompt
-} from "./chunk-HFBCW4MD.js";
+} from "./chunk-5ANFI4LW.js";
 
 // src/agents/designer.ts
 var DESIGNER_PROMPT = renderRolePrompt(
@@ -34,7 +34,7 @@ function createDesignerAgent(model, customPrompt, customAppendPrompt) {
   });
   return {
     name: "designer",
-    description: "Write-capable UI/UX implementation agent with ownership of approach, execution, and visual verification.",
+    description: "Write-capable UI/UX and creative/artistic specialist owning approach, execution, and visual and creative verification.",
     config: {
       model,
       temperature: 0.4,
@@ -173,7 +173,7 @@ function createWorkerAgent(model, customPrompt, customAppendPrompt) {
   });
   return {
     name: "worker",
-    description: "Write-capable agent for bounded nonvisual implementation regardless of complexity, with thorough context analysis, edge-case handling, and correctness verification.",
+    description: "Write-capable agent for bounded engineering implementation regardless of complexity, with thorough context analysis, edge-case handling, and correctness verification.",
     config: {
       model,
       temperature: 0.1,

package/dist/cli/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   opencodeAdapter
-} from "../chunk-KUA3F4D6.js";
+} from "../chunk-T2K7DYTA.js";
 import {
   CODEX_PLUGIN_ID,
   CODEX_ROLE_NAMES,
@@ -80,11 +80,11 @@ import {
   safeAtomicWriteFileSync,
   scalarLocation,
   syncOpenCodeOwnedSkills
-} from "../chunk-A7IGKE4R.js";
+} from "../chunk-ECCXTDVD.js";
 import "../chunk-MIDGZE34.js";
 import {
   piAdapter
-} from "../chunk-422L76R5.js";
+} from "../chunk-7B7JYFIJ.js";
 import {
   ALL_AGENT_NAMES,
   detectCurrentConfig,
@@ -95,7 +95,7 @@ import {
   resolveExecutingPackageVersion,
   updateOpenCodeMainConfig,
   writeLiteConfig
-} from "../chunk-HFBCW4MD.js";
+} from "../chunk-5ANFI4LW.js";
 
 // src/cli/index.ts
 import { pathToFileURL } from "url";

package/dist/cli/pi-install.d.ts

@@ -13,11 +13,6 @@ export declare const PI_PACKAGE_SPECS: readonly [{
     readonly source: "npm:@thoth-agents/pi-subagents@>=0.3.0";
     readonly packageName: "@thoth-agents/pi-subagents";
     readonly version: "0.3.0";
-}, {
-    readonly id: "context7";
-    readonly source: "npm:@upstash/context7-pi@>=0.1.2";
-    readonly packageName: "@upstash/context7-pi";
-    readonly version: "0.1.2";
 }, {
     readonly id: "web-access";
     readonly source: "npm:pi-web-access@>=0.27.0";
@@ -56,12 +51,25 @@ export declare const PI_PACKAGE_SPECS: readonly [{
     readonly packageName: "@thoth-agents/pi-sidebar";
     readonly version: "0.3.0";
     readonly preserveUserCopy: true;
+}, {
+    readonly id: "contained-shell";
+    readonly source: "npm:@thoth-agents/pi-contained-shell@>=0.1.0";
+    readonly packageName: "@thoth-agents/pi-contained-shell";
+    readonly version: "0.1.0";
 }];
 export declare const PI_GREP_MCP_ENTRY: {
     readonly url: "https://mcp.grep.app";
     readonly protocolVersion: "legacy";
     readonly lifecycle: "lazy";
 };
+export declare const PI_CONTEXT7_MCP_ENTRY: {
+    readonly url: "https://mcp.context7.com/mcp";
+    readonly protocolVersion: "auto";
+    readonly lifecycle: "lazy";
+    readonly headers: {
+        readonly CONTEXT7_API_KEY: "${CONTEXT7_API_KEY:-}";
+    };
+};
 export interface PiCommandResult {
     exitCode: number | null;
     stdout: string;

package/dist/cli/tui/index.js

@@ -2,10 +2,10 @@ import {
   defaultTuiOperations,
   effortChoicesForModel,
   listOperationHarnesses
-} from "../../chunk-A7IGKE4R.js";
+} from "../../chunk-ECCXTDVD.js";
 import "../../chunk-MIDGZE34.js";
-import "../../chunk-422L76R5.js";
-import "../../chunk-HFBCW4MD.js";
+import "../../chunk-7B7JYFIJ.js";
+import "../../chunk-5ANFI4LW.js";
 
 // src/cli/tui/index.tsx
 import { render } from "ink";

package/dist/harness/core/agent-pack.d.ts

@@ -127,22 +127,22 @@ export declare const AGENT_ROLES: readonly [{
     readonly mode: "write-capable";
     readonly dispatch: "task";
     readonly canMutateWorkspace: true;
-    readonly scope: "UI/UX decisions, implementation, and visual verification";
-    readonly responsibility: "Own user-facing implementation choices and visual quality for UI work.";
-    readonly useWhen: ["User-facing UI/UX, interaction, accessibility, or visual quality is material."];
-    readonly doNotUseWhen: ["Not for backend-only, non-visual, or correctness-heavy cross-cutting work."];
+    readonly scope: "UI/UX and creative/artistic decisions, implementation, and verification";
+    readonly responsibility: "Own UI/UX, creative/artistic output, and aesthetic quality.";
+    readonly useWhen: ["Material UI/UX, interaction, accessibility, visual quality, or creative/artistic work: visual style, motion/animation, layouts/levels/maps, characters, visual/audio assets, branding, creative copy, narrative."];
+    readonly doNotUseWhen: ["Not for engineering-only or correctness-heavy cross-cutting work."];
     readonly escalateWhen: ["Escalate coupled contracts, migrations, or high risk to worker."];
-    readonly toolGovernance: ["may edit focused UI/UX files", "owns screenshots and visual QA", "does not delegate further"];
-    readonly verification: ["includes visual verification when applicable"];
+    readonly toolGovernance: ["may edit focused UI/UX and creative/artistic files", "owns visual and creative QA, including screenshots", "does not delegate further"];
+    readonly verification: ["includes visual and creative verification when applicable"];
 }, {
     readonly name: "worker";
     readonly mode: "write-capable";
     readonly dispatch: "task";
     readonly canMutateWorkspace: true;
-    readonly scope: "bounded nonvisual implementation and verification";
-    readonly responsibility: "Handle bounded nonvisual implementation with full local context, including exact low-risk edits and correctness-critical, multi-file, edge-case-heavy, or high-risk work.";
-    readonly useWhen: ["Known bounded nonvisual implementation is ready, regardless of complexity; root direct work is limited to the bounded implementation-ownership exceptions.", "Correctness-critical work may be multi-file, edge-case-heavy, migration, concurrency, shared-contract, or high-risk."];
-    readonly doNotUseWhen: ["Not for visual-only work, reviewed commits, or work explicitly retained by the user in root."];
+    readonly scope: "bounded engineering implementation and verification";
+    readonly responsibility: "Handle bounded engineering implementation (business logic, backend, systems, mechanic scripts, calculations, AI) with full local context, including exact low-risk edits and correctness-critical, multi-file, edge-case-heavy, or high-risk work.";
+    readonly useWhen: ["Known bounded engineering implementation, regardless of complexity; root direct work only under bounded implementation-ownership exceptions.", "Correctness-critical work may be multi-file, edge-case-heavy, migration, concurrency, shared-contract, or high-risk."];
+    readonly doNotUseWhen: ["Not for visual-only or artistic/creative work, reviewed commits, or work explicitly retained by the user in root."];
     readonly escalateWhen: ["Return product or architecture choices to root."];
     readonly toolGovernance: ["may edit implementation and tests within the assigned surface", "validates shared behavior against related code and call sites", "does not delegate further"];
     readonly verification: ["reports focused checks and relevant edge-case evidence"];
@@ -159,7 +159,7 @@ export declare const AGENT_RETURN_CONTRACT: {
     readonly designer: readonly ["conclusion", "evidence", "verification", "risks", "openQuestions", "nextAction", "changedFiles"];
     readonly worker: readonly ["conclusion", "evidence", "verification", "risks", "openQuestions", "nextAction", "changedFiles"];
 };
-export declare const VERIFICATION_PROTOCOL: readonly ["Completion reports identify changed files and verification evidence.", "Behavior changes receive the smallest sufficient automated check or a declared manual check.", "Visual changes receive designer-owned visual QA when applicable."];
+export declare const VERIFICATION_PROTOCOL: readonly ["Completion reports identify changed files and verification evidence.", "Behavior changes receive the smallest sufficient automated check or a declared manual check.", "Visual and creative output receives designer-owned visual and creative QA when applicable."];
 export declare const AGENT_PACK_CONTRACT: AgentPackContract;
 export declare function getAgentRole(name: AgentRoleName): AgentRoleContract;
 /** Keep non-gate returns independent of the Oracle validator contract. */

package/dist/index.js

@@ -9,7 +9,7 @@ import {
 import {
   createAgents,
   renderOpenCodeAgentConfigs
-} from "./chunk-KUA3F4D6.js";
+} from "./chunk-T2K7DYTA.js";
 import {
   context7,
   exa,
@@ -26,7 +26,7 @@ import {
   mergeProfileModelChain,
   resolveRoleProfile,
   validateProfileName
-} from "./chunk-HFBCW4MD.js";
+} from "./chunk-5ANFI4LW.js";
 
 // src/opencode/permission-rules.ts
 var ACTIONS = {