ultimate-pi 0.1.2 → 0.1.4

package/extensions/lean-ctx-enforce.ts

@@ -1,166 +0,0 @@
-import type { ExtensionAPI, ExtensionContext } from "@mariozechner/pi-coding-agent";
-import { readFile, stat } from "node:fs/promises";
-import { resolve } from "node:path";
-
-const GUARDED_TOOLS = new Set(["read", "write", "edit", "grep", "find", "ls", "bash"]);
-const CACHE_TTL_MS = 10_000;
-
-type LeanCtxState = {
-  checkedAt: number;
-  available: boolean;
-  bin?: string;
-};
-
-type SystemPromptCache = {
-  path: string;
-  mtimeMs: number;
-  text: string;
-};
-
-let cachedLeanCtx: LeanCtxState = {
-  checkedAt: 0,
-  available: false,
-};
-
-let cachedSystemPrompt: SystemPromptCache | undefined;
-
-async function detectLeanCtx(pi: ExtensionAPI): Promise<LeanCtxState> {
-  const now = Date.now();
-  if (now - cachedLeanCtx.checkedAt < CACHE_TTL_MS) return cachedLeanCtx;
-
-  try {
-    const result = await pi.exec(
-      "bash",
-      [
-        "-lc",
-        'if command -v lean-ctx >/dev/null 2>&1; then command -v lean-ctx; elif [ -x "$HOME/.local/bin/lean-ctx" ]; then echo "$HOME/.local/bin/lean-ctx"; else exit 1; fi',
-      ],
-      { timeout: 2000 },
-    );
-
-    cachedLeanCtx = {
-      checkedAt: now,
-      available: result.code === 0,
-      bin: result.code === 0 ? result.stdout.trim().split("\n")[0] : undefined,
-    };
-  } catch {
-    cachedLeanCtx = { checkedAt: now, available: false };
-  }
-
-  return cachedLeanCtx;
-}
-
-function bashUsesLeanCtx(command: string): boolean {
-  const trimmed = command.trim();
-  if (!trimmed) return false;
-  return /(^|\s|&&|\|\|)lean-ctx(\s|$)/.test(trimmed);
-}
-
-async function loadProjectSystemPrompt(cwd: string): Promise<string | undefined> {
-  const path = resolve(cwd, ".pi", "SYSTEM.md");
-
-  try {
-    const info = await stat(path);
-    if (cachedSystemPrompt && cachedSystemPrompt.path === path && cachedSystemPrompt.mtimeMs === info.mtimeMs) {
-      return cachedSystemPrompt.text;
-    }
-
-    const text = await readFile(path, "utf8");
-    const trimmed = text.trim();
-    if (!trimmed) return undefined;
-
-    cachedSystemPrompt = {
-      path,
-      mtimeMs: info.mtimeMs,
-      text: trimmed,
-    };
-    return trimmed;
-  } catch {
-    return undefined;
-  }
-}
-
-function pickVerificationMarker(promptText: string): string | undefined {
-  for (const line of promptText.split("\n")) {
-    const trimmed = line.trim();
-    if (!trimmed) continue;
-    if (trimmed.startsWith("#")) continue;
-    if (trimmed.startsWith("- ")) continue;
-    if (trimmed.length < 12) continue;
-    return trimmed.slice(0, 120);
-  }
-  return undefined;
-}
-
-async function reportSystemPromptStatus(ctx: ExtensionContext): Promise<"missing" | "verified" | "uncertain"> {
-  const projectPrompt = await loadProjectSystemPrompt(ctx.cwd);
-  if (!projectPrompt) {
-    ctx.ui.notify(".pi/SYSTEM.md not found. Pi default system prompt active.", "warning");
-    return "missing";
-  }
-
-  const effectivePrompt = ctx.getSystemPrompt();
-  const marker = pickVerificationMarker(projectPrompt);
-  if (marker && effectivePrompt.includes(marker)) {
-    ctx.ui.notify(".pi/SYSTEM.md detected and present in effective system prompt.", "success");
-    return "verified";
-  }
-
-  ctx.ui.notify(".pi/SYSTEM.md found. Verification uncertain; reload and re-check.", "info");
-  return "uncertain";
-}
-
-export default function (pi: ExtensionAPI) {
-  pi.on("session_start", async (_event, ctx) => {
-    const state = await detectLeanCtx(pi);
-    if (state.available) {
-      ctx.ui.notify(`lean-ctx enforcement active (${state.bin ?? "lean-ctx"})`, "info");
-    } else {
-      ctx.ui.notify("lean-ctx not found. Built-in tools allowed until installed.", "warning");
-    }
-
-    await reportSystemPromptStatus(ctx);
-  });
-
-  pi.registerCommand("lean-ctx-status", {
-    description: "Show lean-ctx enforcement status",
-    handler: async (_args, ctx) => {
-      cachedLeanCtx.checkedAt = 0;
-      const state = await detectLeanCtx(pi);
-      if (state.available) {
-        ctx.ui.notify(`lean-ctx available: ${state.bin ?? "lean-ctx"}. Built-ins blocked.`, "success");
-      } else {
-        ctx.ui.notify("lean-ctx unavailable. Built-ins currently allowed.", "warning");
-      }
-    },
-  });
-
-  pi.registerCommand("system-prompt-status", {
-    description: "Check .pi/SYSTEM.md replacement status",
-    handler: async (_args, ctx) => {
-      await reportSystemPromptStatus(ctx);
-    },
-  });
-
-  pi.on("tool_call", async (event) => {
-    if (!GUARDED_TOOLS.has(event.toolName)) return;
-
-    const state = await detectLeanCtx(pi);
-    if (!state.available) return;
-
-    if (event.toolName === "bash") {
-      const command = String((event.input as { command?: unknown })?.command ?? "");
-      if (bashUsesLeanCtx(command)) return;
-
-      return {
-        block: true,
-        reason: "Blocked by lean-ctx enforcement. Use `lean-ctx -c <command>` for shell commands.",
-      };
-    }
-
-    return {
-      block: true,
-      reason: `Blocked by lean-ctx enforcement. Use lean-ctx tools/flows instead of built-in \`${event.toolName}\`.`,
-    };
-  });
-}

package/skills-lock.json

@@ -1,35 +0,0 @@
-{
-  "version": 1,
-  "skills": {
-    "caveman": {
-      "source": "juliusbrussee/caveman",
-      "sourceType": "github",
-      "computedHash": "a818cdc41dcfaa50dd891c5cb5e5705968338de02e7e37949ca56e8c30ad4176"
-    },
-    "compress": {
-      "source": "juliusbrussee/caveman",
-      "sourceType": "github",
-      "computedHash": "05c97bc3120108acd0b80bdef7fb4fa7c224ba83c8d384ccbc97f92e8a065918"
-    },
-    "context7-cli": {
-      "source": "upstash/context7",
-      "sourceType": "github",
-      "computedHash": "525bfb31161c3f8866920a28fb2d9a3003a23b449aa8619b1b1add0da2cc3300"
-    },
-    "emil-design-eng": {
-      "source": "emilkowalski/skill",
-      "sourceType": "github",
-      "computedHash": "8bdf9e4e6de7a4969147bf4828a4ad2c5aacd9fba4b690b250a85e0467ca387d"
-    },
-    "lean-ctx": {
-      "source": "yvgude/lean-ctx",
-      "sourceType": "github",
-      "computedHash": "3d29c02c1c3928c838228cf11635c8041e52acc2e804ba2dd19450530a34c53e"
-    },
-    "scrapling-official": {
-      "source": "D4Vinci/Scrapling",
-      "sourceType": "github",
-      "computedHash": "af9bee8b531aa5b4d499eeebca66edb0224b1ed9b61540588765140628bd7ff2"
-    }
-  }
-}

package/wiki/README.md

@@ -1,19 +0,0 @@
-# Project Wiki
-
-## Purpose
-Track architecture and implementation decisions for this repo.
-
-## Decision log
-- [0001 - Establish project wiki and decision record format](decisions/0001-establish-project-wiki-and-decision-record-format.md)
-- [0002 - Add project banner to README](decisions/0002-add-project-banner-to-readme.md)
-- [0003 - Remove redundant README title heading when banner already contains title](decisions/0003-remove-redundant-readme-title-heading.md)
-- [0004 - Publish package to npm as ultimate-pi](decisions/0004-publish-package-to-npm-as-ultimate-pi.md)
-- [0005 - Automate npm publish with GitHub Actions](decisions/0005-automate-npm-publish-with-github-actions.md)
-- [0006 - Switch npm automation to Trusted Publishing (OIDC)](decisions/0006-switch-to-npm-trusted-publishing.md)
-- [0007 - Use absolute banner URL for npm README rendering](decisions/0007-use-absolute-banner-url-for-npm-readme-rendering.md)
-- [0008 - Rename banner asset for cache-busting on npm README](decisions/0008-rename-banner-asset-for-cache-busting.md)
-- [0009 - Force OIDC path by clearing NODE_AUTH_TOKEN in publish step](decisions/0009-force-oidc-path-by-clearing-node-auth-token-in-publish-step.md)
-- [0010 - Simplify setup-node for npm Trusted Publishing](decisions/0010-simplify-setup-node-for-npm-trusted-publishing.md)
-- [0011 - Add noop workflow change to force fresh publish run](decisions/0011-add-noop-workflow-change-to-force-fresh-publish-run.md)
-- [0012 - Align workflow runtime with npm Trusted Publishing requirements](decisions/0012-align-workflow-runtime-with-npm-trusted-publishing-requirements.md)
-- [0013 - Add package repository URL for provenance validation](decisions/0013-add-package-repository-url-for-provenance-validation.md)

package/wiki/decisions/0001-establish-project-wiki-and-decision-record-format.md

@@ -1,25 +0,0 @@
-# 0001 - Establish project wiki and decision record format
-
-- Date: 2026-04-25
-- Status: Accepted
-
-## Context
-Execution model requires project wiki and documented design decisions.
-No wiki existed in repository.
-
-## Alternatives
-1. Keep decisions in ad-hoc commit messages.
-2. Store decisions in a single PLAN.md section.
-3. Create dedicated wiki/ with ADR-style files.
-
-## Chosen option
-Create wiki/ with numbered decision files in wiki/decisions/.
-
-## Rationale
-- Gives stable place for all implementation decisions.
-- Scales better than one growing plan file.
-- Easy to reference before each code change.
-
-## Consequences
-- Every implementation change must cite relevant decision docs.
-- Small overhead: keep decision log updated.

package/wiki/decisions/0002-add-project-banner-to-readme.md

@@ -1,26 +0,0 @@
-# 0002 - Add project banner to README
-
-- Date: 2026-04-25
-- Status: Accepted
-
-## Context
-User requested adding .github/banner.png to README.md as project banner.
-README currently has no image banner.
-
-## Alternatives
-1. Keep no banner.
-2. Use HTML img tag for size/alignment control.
-3. Use standard Markdown image link.
-
-## Chosen option
-Use standard Markdown image syntax near top of README:
-![Ultimate PI banner](.github/banner.png)
-
-## Rationale
-- Minimal diff.
-- Renders on GitHub without extra HTML.
-- Keeps README portable and simple.
-
-## Consequences
-- Large image may dominate first screen on some displays.
-- Future size control would require switching to HTML tag.

package/wiki/decisions/0003-remove-redundant-readme-title-heading.md

@@ -1,26 +0,0 @@
-# 0003 - Remove redundant README title heading when banner already contains title
-
-- Date: 2026-04-25
-- Status: Accepted
-
-## Context
-README shows an H1 title and a banner image.
-Banner already contains the same project title text (Ultimate Pi).
-User requested removing redundant headings.
-
-## Alternatives
-1. Keep H1 and keep banner unchanged.
-2. Keep H1 and replace banner with non-title artwork.
-3. Remove H1 and keep banner as top title element.
-
-## Chosen option
-Remove top-level H1 from README and keep banner at top.
-
-## Rationale
-- Directly satisfies user request with minimal diff.
-- Avoids duplicate title presentation.
-- Preserves remaining README structure.
-
-## Consequences
-- README no longer has explicit Markdown H1.
-- Banner becomes primary title element.

package/wiki/decisions/0004-publish-package-to-npm-as-ultimate-pi.md

@@ -1,26 +0,0 @@
-# 0004 - Publish package to npm as ultimate-pi
-
-- Date: 2026-04-25
-- Status: Accepted
-
-## Context
-User requested npm publication under package name ultimate-pi.
-Current package metadata blocks publish (private true) and uses different name (ultimate-pi-package).
-
-## Alternatives
-1. Keep current package name and publish under existing metadata.
-2. Publish under scoped name (for example @owner/ultimate-pi).
-3. Rename package to ultimate-pi and remove publish block.
-
-## Chosen option
-Rename package.json name to ultimate-pi and remove private field so npm publish can succeed.
-
-## Rationale
-- Matches explicit user requirement.
-- Keeps package unscoped and discoverable.
-- Smallest metadata diff needed for publish.
-
-## Consequences
-- Package name must stay unique in npm registry.
-- Future publishes require version bumps.
-- Publish operation depends on local npm authentication.

package/wiki/decisions/0005-automate-npm-publish-with-github-actions.md

@@ -1,27 +0,0 @@
-# 0005 - Automate npm publish with GitHub Actions
-
-- Date: 2026-04-25
-- Status: Accepted
-
-## Context
-User requested automated package publishing through GitHub Actions.
-Repository currently has no workflow files.
-Package already prepared for npm publish as ultimate-pi.
-
-## Alternatives
-1. Keep manual local npm publish only.
-2. Publish on every push to main.
-3. Publish on version tags with optional manual trigger.
-
-## Chosen option
-Create a GitHub Actions workflow that publishes to npm on tags matching v* and supports manual dispatch.
-
-## Rationale
-- Safe release gate with explicit version tags.
-- Standard npm automation pattern.
-- Keeps accidental publishes low risk.
-
-## Consequences
-- Maintainer must create npm token and store as NPM_TOKEN secret.
-- Release process must include tag creation.
-- Version in package.json must be bumped before tagging.

package/wiki/decisions/0006-switch-to-npm-trusted-publishing.md

@@ -1,26 +0,0 @@
-# 0006 - Switch npm automation to Trusted Publishing (OIDC)
-
-- Date: 2026-04-25
-- Status: Accepted
-
-## Context
-User flagged npm warning: token-based automation has security risks.
-Current workflow uses NPM_TOKEN secret for publish.
-
-## Alternatives
-1. Keep automation token secret (NPM_TOKEN).
-2. Publish manually from local machine only.
-3. Use npm Trusted Publishing with GitHub OIDC.
-
-## Chosen option
-Use npm Trusted Publishing. Remove token auth from workflow. Grant id-token permission and publish with provenance.
-
-## Rationale
-- Eliminates long-lived npm secret in GitHub.
-- Aligns with npm security guidance for CI/CD.
-- Produces provenance attestations for supply-chain trust.
-
-## Consequences
-- Must configure Trusted Publisher in npm package settings.
-- Publish only works from linked repo/workflow context.
-- Workflow must run on supported GitHub-hosted runner.

package/wiki/decisions/0007-use-absolute-banner-url-for-npm-readme-rendering.md

@@ -1,26 +0,0 @@
-# 0007 - Use absolute banner URL for npm README rendering
-
-- Date: 2026-04-25
-- Status: Accepted
-
-## Context
-README banner currently uses repository-relative path .github/banner.png.
-GitHub renders relative image paths in repository context.
-npm README rendering does not reliably resolve repository-relative image paths.
-
-## Alternatives
-1. Keep relative image path.
-2. Remove banner image from README.
-3. Use absolute raw GitHub URL to banner asset.
-
-## Chosen option
-Replace README banner image path with absolute raw.githubusercontent.com URL.
-
-## Rationale
-- Works in npm package page rendering.
-- Still works in GitHub README rendering.
-- Minimal one-line README diff.
-
-## Consequences
-- URL tied to repository path/branch (main).
-- Banner breaks if file path or default branch changes.

package/wiki/decisions/0008-rename-banner-asset-for-cache-busting.md

@@ -1,26 +0,0 @@
-# 0008 - Rename banner asset for cache-busting on npm README
-
-- Date: 2026-04-25
-- Status: Accepted
-
-## Context
-Banner image update is not reflected on npm package page.
-README already uses absolute raw.githubusercontent URL.
-Likely cause is CDN/browser cache on unchanged asset path.
-
-## Alternatives
-1. Keep same filename and wait for cache expiry.
-2. Add query parameter to image URL.
-3. Rename banner file and update README URL.
-
-## Chosen option
-Rename banner file path from .github/banner.png to .github/banner-v2.png and update README reference.
-
-## Rationale
-- New path forces cache miss immediately.
-- Minimal, safe change.
-- Works in GitHub and npm renderers.
-
-## Consequences
-- Any external links to old filename break.
-- Future banner refreshes should use versioned filenames.

package/wiki/decisions/0009-force-oidc-path-by-clearing-node-auth-token-in-publish-step.md

@@ -1,25 +0,0 @@
-# 0009 - Force OIDC path by clearing NODE_AUTH_TOKEN in publish step
-
-- Date: 2026-04-25
-- Status: Accepted
-
-## Context
-GitHub Actions publish job failed with npm E404 on PUT for ultimate-pi@0.1.2.
-Job log shows NODE_AUTH_TOKEN present during publish step, which can force token auth path instead of Trusted Publishing OIDC.
-
-## Alternatives
-1. Keep workflow unchanged and only reconfigure npm settings.
-2. Revert fully to long-lived NPM_TOKEN secret.
-3. Keep Trusted Publishing and explicitly clear NODE_AUTH_TOKEN in publish step.
-
-## Chosen option
-Use Trusted Publishing and set NODE_AUTH_TOKEN to empty string for publish step.
-
-## Rationale
-- Prevents accidental fallback to stale/unauthorized token auth.
-- Preserves secure OIDC-based publish flow.
-- Minimal surgical workflow diff.
-
-## Consequences
-- Requires npm Trusted Publisher to be correctly configured.
-- Any desired token-based publish would need explicit workflow change.

package/wiki/decisions/0010-simplify-setup-node-for-npm-trusted-publishing.md

@@ -1,26 +0,0 @@
-# 0010 - Simplify setup-node for npm Trusted Publishing
-
-- Date: 2026-04-25
-- Status: Accepted
-
-## Context
-Publish run still fails with ENEEDAUTH after Trusted Publisher setup.
-Current workflow sets npm registry-url and explicitly sets NODE_AUTH_TOKEN empty.
-This may keep npm on token-based auth path and bypass OIDC exchange.
-
-## Alternatives
-1. Keep current workflow and retry only.
-2. Re-introduce npm token secret.
-3. Remove registry auth shaping and let npm Trusted Publishing OIDC path run naturally.
-
-## Chosen option
-Use setup-node with node-version only. Remove registry-url and NODE_AUTH_TOKEN override.
-
-## Rationale
-- Avoids writing auth-specific npmrc configuration for token path.
-- Aligns with minimal OIDC trusted publishing examples.
-- Smallest workflow diff.
-
-## Consequences
-- Requires npm Trusted Publisher config to be correct.
-- If Trusted Publishing unavailable, publish will fail until fallback token flow is re-added.

package/wiki/decisions/0011-add-noop-workflow-change-to-force-fresh-publish-run.md

@@ -1,25 +0,0 @@
-# 0011 - Add noop workflow change to force fresh publish run
-
-- Date: 2026-04-25
-- Status: Accepted
-
-## Context
-User requested a fresh commit and publish attempt because rerun signal looked stale.
-Current publish workflow logic already targeted for Trusted Publishing.
-
-## Alternatives
-1. Keep rerunning same workflow execution.
-2. Make a functional workflow change.
-3. Make a minimal non-functional workflow change and trigger new run from new commit.
-
-## Chosen option
-Add a non-functional workflow metadata field (run-name) and push a new commit.
-
-## Rationale
-- Produces clean new run context tied to fresh commit SHA.
-- Avoids unnecessary behavior changes.
-- Smallest viable diff.
-
-## Consequences
-- No runtime behavior change expected.
-- Still depends on npm auth configuration correctness.

package/wiki/decisions/0012-align-workflow-runtime-with-npm-trusted-publishing-requirements.md

@@ -1,26 +0,0 @@
-# 0012 - Align workflow runtime with npm Trusted Publishing requirements
-
-- Date: 2026-04-25
-- Status: Accepted
-
-## Context
-Publish workflow still fails authentication.
-Trusted publisher mapping is already verified by user.
-Remaining common causes include runtime mismatch: npm 11.5.1+ and Node 22.14+.
-
-## Alternatives
-1. Keep current Node 20 workflow.
-2. Switch to token-based publish only.
-3. Upgrade workflow runtime to Node 22.14+, ensure npm 11.5.1+, keep OIDC permissions.
-
-## Chosen option
-Upgrade workflow to Node 22.14.0 and add npm upgrade/verification step before publish.
-
-## Rationale
-- Directly addresses documented Trusted Publishing runtime requirements.
-- Keeps secure OIDC model intact.
-- Minimal focused diff in workflow only.
-
-## Consequences
-- Slightly longer workflow run due npm update step.
-- Future runtime bumps may be needed when npm guidance changes.

package/wiki/decisions/0013-add-package-repository-url-for-provenance-validation.md

@@ -1,25 +0,0 @@
-# 0013 - Add package repository URL for provenance validation
-
-- Date: 2026-04-25
-- Status: Accepted
-
-## Context
-Trusted publishing auth now passes, but publish fails with npm E422 provenance validation.
-Error states package.json repository.url is empty and must match https://github.com/aryaniyaps/ultimate-pi.
-
-## Alternatives
-1. Disable provenance flag in publish command.
-2. Keep failing publish and document manual workaround.
-3. Add exact repository URL metadata in package.json to satisfy provenance validation.
-
-## Chosen option
-Add package.json repository metadata with URL https://github.com/aryaniyaps/ultimate-pi.
-
-## Rationale
-- Fixes current hard failure from npm provenance verifier.
-- Keeps secure --provenance publish mode.
-- Minimal metadata-only package diff.
-
-## Consequences
-- Repository URL must stay accurate.
-- If repo moves, metadata must be updated before next publish.