ultimate-pi 0.18.1 → 0.19.0

package/.pi/extensions/lib/harness-subagent-auth.ts

@@ -1,207 +0,0 @@
-/**
- * Resolve concrete LLM credentials for harness subagent subprocesses.
- *
- * Parent sessions often use `router/<profile>` (pi-model-router). Subagents run with
- * `--no-extensions`, so they cannot use the logical router provider — they need
- * a real provider/model plus that provider's API key.
- *
- * Session-locked routing: subprocess model is chosen once from agent system prompt
- * complexity (same analysis as parent session lock), not from per-turn parent tier.
- */
-
-import { existsSync, readFileSync } from "node:fs";
-import { join } from "node:path";
-import { resolveTierFromPrompt } from "../../../vendor/pi-model-router/extensions/routing.js";
-import type {
-	RouterProfile,
-	RouterTier,
-	RoutingRule,
-} from "../../../vendor/pi-model-router/extensions/types.js";
-import type { AgentConfig } from "../../../vendor/pi-subagents/src/agents.js";
-
-const ROUTER_SENTINEL_KEY = "pi-model-router";
-const SENTINEL_API_KEYS = new Set([ROUTER_SENTINEL_KEY, "<authenticated>"]);
-
-interface ModelRouterJson {
-	defaultProfile?: string;
-	phaseBias?: number;
-	rules?: RoutingRule[];
-	profiles?: Record<string, RouterProfile>;
-}
-
-export function isUsableApiKey(key: string | undefined): key is string {
-	return Boolean(key && !SENTINEL_API_KEYS.has(key));
-}
-
-export function parseModelRef(
-	ref: string,
-): { provider: string; modelId: string } | null {
-	const slash = ref.indexOf("/");
-	if (slash <= 0) return null;
-	const provider = ref.slice(0, slash).trim();
-	const modelId = ref.slice(slash + 1).trim();
-	if (!provider || !modelId) return null;
-	return { provider, modelId };
-}
-
-/** Planning subagents that should prefer low/medium router tier for latency. */
-const ROUTINE_PLANNING_AGENT_PATHS = new Set([
-	"harness/planning/plan-evaluator",
-	"harness/planning/plan-adversary",
-	"harness/planning/review-integrator",
-	"harness/planning/hypothesis-validator",
-	"harness/planning/sprint-contract-auditor",
-	"harness/planning/planning-context",
-	"harness/planning/decompose",
-	"harness/planning/hypothesis",
-	"harness/planning/stack-research",
-	"harness/planning/plan-validator",
-]);
-
-export function isRoutinePlanningAgent(agentName: string): boolean {
-	return ROUTINE_PLANNING_AGENT_PATHS.has(agentName);
-}
-
-export function thinkingToRouterTier(
-	thinking?: string,
-	agentName?: string,
-): RouterTier {
-	if (agentName && isRoutinePlanningAgent(agentName)) {
-		if (thinking === "high" || thinking === "xhigh") return "medium";
-		return "low";
-	}
-	if (thinking === "high" || thinking === "xhigh") return "high";
-	if (thinking === "off" || thinking === "minimal" || thinking === "low") {
-		return "low";
-	}
-	return "medium";
-}
-
-function loadModelRouterConfig(cwd: string): ModelRouterJson | undefined {
-	const path = join(cwd, ".pi", "model-router.json");
-	if (!existsSync(path)) return undefined;
-	try {
-		return JSON.parse(readFileSync(path, "utf8")) as ModelRouterJson;
-	} catch {
-		return undefined;
-	}
-}
-
-function resolveRouterProfileEntry(
-	config: ModelRouterJson,
-	profileId: string,
-): { profileId: string; profile: RouterProfile } | undefined {
-	const profiles = config.profiles;
-	if (!profiles) return undefined;
-	const candidates = [
-		profileId,
-		config.defaultProfile ?? "auto",
-		"auto",
-		"opencode-go",
-	];
-	const seen = new Set<string>();
-	for (const id of candidates) {
-		if (!id || seen.has(id)) continue;
-		seen.add(id);
-		const profile = profiles[id];
-		if (profile?.high?.model && profile.medium?.model && profile.low?.model) {
-			return { profileId: id, profile };
-		}
-	}
-	return undefined;
-}
-
-/** Tier from agent system prompt (+ optional task line) for session model lock. */
-export function resolveSubagentRouterTier(
-	cwd: string,
-	profileId: string,
-	agent: AgentConfig,
-	taskSnippet?: string,
-): RouterTier {
-	const config = loadModelRouterConfig(cwd);
-	if (config) {
-		const entry = resolveRouterProfileEntry(config, profileId);
-		if (entry) {
-			return resolveTierFromPrompt(
-				agent.systemPrompt ?? "",
-				taskSnippet?.trim() ?? "",
-				entry.profileId,
-				entry.profile,
-				config.rules,
-				config.phaseBias ?? 0.5,
-			);
-		}
-	}
-	return thinkingToRouterTier(agent.thinking, agent.name);
-}
-
-/** Map router profile tier → concrete `provider/model` from `.pi/model-router.json`. */
-export function resolveRouterConcreteModelRef(
-	cwd: string,
-	profileId: string,
-	tier: RouterTier,
-): string | undefined {
-	const path = join(cwd, ".pi", "model-router.json");
-	if (!existsSync(path)) return undefined;
-	const raw = loadModelRouterConfig(cwd);
-	if (!raw) return undefined;
-	const entry = resolveRouterProfileEntry(raw, profileId);
-	const model = entry?.profile[tier]?.model;
-	return typeof model === "string" && model.includes("/") ? model : undefined;
-}
-
-export interface ConcreteSubagentModel {
-	modelRef: string;
-	provider: string;
-	modelId: string;
-	routerProfile?: string;
-	routerTier?: RouterTier;
-}
-
-/**
- * Pick the subprocess model ref before resolving API keys.
- * Never returns `router/*` — always a concrete provider.
- */
-export function resolveConcreteSubagentModel(
-	cwd: string,
-	parentModel: { provider: string; id: string } | undefined,
-	agent: AgentConfig,
-	taskSnippet?: string,
-): ConcreteSubagentModel | undefined {
-	if (agent.model && !agent.model.startsWith("router/")) {
-		const parsed = parseModelRef(agent.model);
-		if (parsed) {
-			return { modelRef: agent.model, ...parsed };
-		}
-	}
-
-	const parentIsRouter = parentModel?.provider === "router";
-	const agentIsRouter = Boolean(agent.model?.startsWith("router/"));
-
-	if (!parentIsRouter && !agentIsRouter) {
-		if (parentModel && parentModel.provider !== "router") {
-			return {
-				modelRef: `${parentModel.provider}/${parentModel.id}`,
-				provider: parentModel.provider,
-				modelId: parentModel.id,
-			};
-		}
-		return undefined;
-	}
-
-	const profileId =
-		agentIsRouter && agent.model
-			? agent.model.slice("router/".length)
-			: (parentModel?.id ?? "auto");
-	const tier = resolveSubagentRouterTier(cwd, profileId, agent, taskSnippet);
-	const concrete = resolveRouterConcreteModelRef(cwd, profileId, tier);
-	if (!concrete) return undefined;
-	const parsed = parseModelRef(concrete);
-	if (!parsed || parsed.provider === "router") return undefined;
-	return {
-		modelRef: concrete,
-		...parsed,
-		routerProfile: profileId,
-		routerTier: tier,
-	};
-}

package/.pi/extensions/lib/harness-subagent-policy.ts

@@ -1,236 +0,0 @@
-/**
- * Per-agent tool policy for harness/* subagents (defense in depth with frontmatter).
- */
-
-import {
-	evaluateContextModeMutation,
-	isMutatingBash,
-} from "../../lib/harness-context-mode-policy.js";
-import type { HarnessPhase } from "../../lib/harness-run-context.js";
-import {
-	isSubmitToolName,
-	SUBMIT_TOOLS_BY_AGENT,
-} from "./harness-subagent-submit-registry.js";
-import {
-	evaluateSubagentToolCall,
-	type ToolCallDecision,
-} from "./spawn-policy.js";
-
-export type HarnessAgentKind =
-	| "planner"
-	| "executor"
-	| "evaluator"
-	| "adversary"
-	| "tie_breaker"
-	| "meta"
-	| "trace"
-	| "incident"
-	| "other";
-
-const MUTATING_TOOLS = new Set(["write", "edit"]);
-
-/** Planning agents must use submit_* → canonical artifacts/*.yaml, not JSON dumps. */
-const PLANNING_ARTIFACT_JSON_WRITE = /artifacts\/[^\s'"`;]+\.json\b/i;
-
-const PLANNING_BASH_DENY_PATTERNS = [
-	/\bgraphify\s+update\b/i,
-	/\bgraphify\s+extract\b/i,
-	/\bgraphify\s+install\b/i,
-	/\bccc\s+(index|init|reset|daemon)\b/i,
-	/\bccc\s+search\b.*--refresh/i,
-	/\bpip\s+install\b/i,
-	/\buv\s+tool\s+install\b/i,
-	/\bnpm\s+install\b/i,
-	/\bnpm\s+install\b.*cocoindex/i,
-	/\buv\s+tool\s+install\b.*cocoindex/i,
-];
-
-const READ_ONLY_KINDS = new Set<HarnessAgentKind>([
-	"planner",
-	"evaluator",
-	"adversary",
-	"tie_breaker",
-	"trace",
-	"incident",
-	"meta",
-]);
-
-export function isHarnessPlanningAgent(agentType: string): boolean {
-	const id = agentType.replace(/^harness\//, "");
-	return id.startsWith("planning/");
-}
-
-export function classifyHarnessAgent(agentType: string): HarnessAgentKind {
-	const id = agentType.replace(/^harness\//, "");
-	if (id.startsWith("planning/")) {
-		return "planner";
-	}
-	switch (id) {
-		case "running/executor":
-			return "executor";
-		case "reviewing/evaluator":
-			return "evaluator";
-		case "reviewing/adversary":
-			return "adversary";
-		case "reviewing/tie-breaker":
-			return "tie_breaker";
-		case "meta-optimizer":
-			return "meta";
-		case "trace-librarian":
-			return "trace";
-		case "incident-recorder":
-			return "incident";
-		default:
-			return agentType.startsWith("harness/") ? "other" : "other";
-	}
-}
-
-export function isHarnessPackageAgent(agentType: string): boolean {
-	return agentType.startsWith("harness/");
-}
-
-export function evaluateHarnessSubagentToolCall(
-	toolName: string,
-	input: Record<string, unknown> | undefined,
-	agentType: string,
-): ToolCallDecision {
-	const base = evaluateSubagentToolCall(toolName, agentType);
-	if (base.action === "block") {
-		return base;
-	}
-
-	if (!isHarnessPackageAgent(agentType)) {
-		if (
-			isSubmitToolName(toolName) &&
-			process.env.PI_HARNESS_SUBPROCESS !== "1"
-		) {
-			return {
-				action: "block",
-				reason:
-					"harness-subagent-policy: submit_* tools are subprocess-only; parent orchestrator must use harness_artifact_ready and write_harness_yaml for merges.",
-			};
-		}
-		return { action: "allow" };
-	}
-
-	if (isSubmitToolName(toolName)) {
-		if (process.env.PI_HARNESS_SUBPROCESS !== "1") {
-			return {
-				action: "block",
-				reason:
-					"harness-subagent-policy: submit_* tools are not available in the parent harness session.",
-			};
-		}
-		if (toolName === "submit_human_required") {
-			const kind = classifyHarnessAgent(agentType);
-			if (kind === "executor") {
-				return {
-					action: "block",
-					reason:
-						"submit_human_required is not available for harness/running/executor.",
-				};
-			}
-			return { action: "allow" };
-		}
-		const allowed = SUBMIT_TOOLS_BY_AGENT[agentType];
-		if (!allowed?.has(toolName)) {
-			return {
-				action: "block",
-				reason: `harness-subagent-policy: ${toolName} is not allowed for ${agentType}.`,
-			};
-		}
-		return { action: "allow" };
-	}
-
-	const kind = classifyHarnessAgent(agentType);
-	if (!READ_ONLY_KINDS.has(kind)) {
-		return { action: "allow" };
-	}
-
-	if (toolName === "create_plan" || toolName === "approve_plan") {
-		return {
-			action: "block",
-			reason: `harness-subagent-policy: ${toolName} is parent-orchestrator only (not available in subagents).`,
-		};
-	}
-
-	if (MUTATING_TOOLS.has(toolName)) {
-		return {
-			action: "block",
-			reason: `harness-subagent-policy: ${toolName} blocked for harness/${kind} (read-only phase agent).`,
-		};
-	}
-
-	if (toolName === "bash") {
-		const command = String(input?.command ?? "");
-		if (
-			kind === "planner" &&
-			command &&
-			PLANNING_ARTIFACT_JSON_WRITE.test(command)
-		) {
-			return {
-				action: "block",
-				reason:
-					"harness-subagent-policy: artifacts must be YAML only — use submit_* (e.g. submit_hypothesis_brief → artifacts/hypothesis.yaml), not bash writes to .json.",
-			};
-		}
-		if (command && isMutatingBash(command)) {
-			return {
-				action: "block",
-				reason: `harness-subagent-policy: mutating bash blocked for harness/${kind}.`,
-			};
-		}
-		if (
-			command &&
-			isHarnessPlanningAgent(agentType) &&
-			PLANNING_BASH_DENY_PATTERNS.some((p) => p.test(command))
-		) {
-			return {
-				action: "block",
-				reason:
-					"harness-subagent-policy: planning scouts may use read-only graphify/sg/ccc commands only.",
-			};
-		}
-	}
-
-	const ctxPhase =
-		(harnessSubagentPhaseHint(agentType) as HarnessPhase | null) ?? "plan";
-	const ctxDecision = evaluateContextModeMutation(
-		toolName,
-		input ?? {},
-		ctxPhase,
-		{ aborted: false, readOnlyAgent: true },
-	);
-	if (ctxDecision.blocked) {
-		return {
-			action: "block",
-			reason: ctxDecision.reason.replace(
-				/^policy-gate:/,
-				"harness-subagent-policy:",
-			),
-		};
-	}
-
-	return { action: "allow" };
-}
-
-export { isSubmitToolName } from "./harness-subagent-submit-registry.js";
-
-export function harnessSubagentPhaseHint(agentType: string): string | null {
-	if (isHarnessPlanningAgent(agentType)) {
-		return "plan";
-	}
-	const kind = classifyHarnessAgent(agentType);
-	switch (kind) {
-		case "planner":
-			return "plan";
-		case "executor":
-			return "execute";
-		case "evaluator":
-			return "evaluate";
-		case "adversary":
-			return "adversary";
-		default:
-			return null;
-	}
-}

package/.pi/extensions/pi-model-router-harness.ts

@@ -1,42 +0,0 @@
-/**
- * Vendored [pi-model-router](https://github.com/yeliu84/pi-model-router), gated behind
- * a project-local `.pi/model-router.json` from `/harness-setup` so the extension
- * (and built-in fallback tiers) never load before harness bootstrap.
- */
-
-import { existsSync, readFileSync } from "node:fs";
-import { join } from "node:path";
-import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
-import vendorModelRouter from "../../vendor/pi-model-router/extensions/index.js";
-
-function isHarnessRouterReady(cwd: string): boolean {
-	const path = join(cwd, ".pi", "model-router.json");
-	if (!existsSync(path)) {
-		return false;
-	}
-	try {
-		const data: unknown = JSON.parse(readFileSync(path, "utf8"));
-		if (typeof data !== "object" || data === null) {
-			return false;
-		}
-		const profiles = (data as { profiles?: unknown }).profiles;
-		return (
-			typeof profiles === "object" &&
-			profiles !== null &&
-			Object.keys(profiles).length > 0
-		);
-	} catch {
-		return false;
-	}
-}
-
-export default function piModelRouterHarness(pi: ExtensionAPI) {
-	const cwd = process.cwd();
-	if (!isHarnessRouterReady(cwd)) {
-		console.warn(
-			"[ultimate-pi] Model router disabled until `.pi/model-router.json` exists (generate via /harness-setup Step 3.5).",
-		);
-		return;
-	}
-	vendorModelRouter(pi);
-}

package/.pi/harness/evolution/meta-optimizer.mjs

@@ -1,99 +0,0 @@
-#!/usr/bin/env node
-/**
- * meta-optimizer — read harness JSONL index and emit tuning proposals (no LLM).
- */
-
-import { readFile, readdir } from "node:fs/promises";
-import { join, dirname } from "node:path";
-import { fileURLToPath } from "node:url";
-
-const ROOT = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "..");
-const RUNS = join(ROOT, ".pi", "harness", "runs");
-const OUT = join(ROOT, ".pi", "harness", "router", "proposals", "meta-optimizer-proposal.json");
-
-async function loadIndexLines() {
-	const indexPath = join(RUNS, "index.jsonl");
-	try {
-		const raw = await readFile(indexPath, "utf-8");
-		return raw
-			.trim()
-			.split("\n")
-			.filter(Boolean)
-			.map((line) => JSON.parse(line));
-	} catch {
-		return [];
-	}
-}
-
-async function countEventTypes(runId) {
-	const eventsPath = join(RUNS, runId, "events.jsonl");
-	try {
-		const raw = await readFile(eventsPath, "utf-8");
-		const counts = {};
-		for (const line of raw.trim().split("\n").filter(Boolean)) {
-			const row = JSON.parse(line);
-			const t = row.type ?? "unknown";
-			counts[t] = (counts[t] ?? 0) + 1;
-		}
-		return counts;
-	} catch {
-		return {};
-	}
-}
-
-async function main() {
-	const index = await loadIndexLines();
-	const recent = index.slice(-20);
-	let totalToolSpans = 0;
-	let runs = 0;
-	const policyHints = [];
-
-	for (const row of recent) {
-		const runId = row.run_id;
-		if (!runId) continue;
-		runs += 1;
-		try {
-			const trace = JSON.parse(
-				await readFile(join(RUNS, runId, "trace.json"), "utf-8"),
-			);
-			totalToolSpans += trace.tool_span_count ?? trace.tool_spans?.length ?? 0;
-		} catch {
-			/* skip */
-		}
-		const events = await countEventTypes(runId);
-		if ((events.tool_result ?? 0) > 50) {
-			policyHints.push({
-				run_id: runId,
-				hint: "High tool volume; consider stricter phase caps or router to smaller model for plan phase.",
-			});
-		}
-	}
-
-	const avgTools = runs > 0 ? totalToolSpans / runs : 0;
-	const proposal = {
-		schema_version: "1.0.0",
-		generated_at: new Date().toISOString(),
-		source: "meta-optimizer",
-		sample_runs: runs,
-		avg_tool_spans_per_run: avgTools,
-		router_hints: policyHints,
-		recommendation:
-			avgTools > 30
-				? "Consider lowering execute-phase tool budget or enabling HARNESS_BUDGET_HARD_STOP."
-				: "No automatic router change; metrics within nominal band.",
-	};
-
-	await import("node:fs/promises").then(({ mkdir, writeFile }) =>
-		mkdir(dirname(OUT), { recursive: true }).then(() =>
-			writeFile(OUT, `${JSON.stringify(proposal, null, 2)}\n`),
-		),
-	);
-
-	console.log(JSON.stringify(proposal, null, 2));
-	console.log(`\nWrote ${OUT}`);
-}
-
-main().catch((err) => {
-	console.error(err);
-	process.exit(1);
-});

package/.pi/harness/specs/router-tuning-proposal.schema.json

@@ -1,114 +0,0 @@
-{
-	"$schema": "https://json-schema.org/draft/2020-12/schema",
-	"$id": "https://ultimate-pi.local/.pi/harness/specs/router-tuning-proposal.schema.json",
-	"title": "RouterTuningProposal",
-	"description": "Evidence-gated, approval-required proposal for model-router updates.",
-	"type": "object",
-	"additionalProperties": false,
-	"required": [
-		"schema_version",
-		"proposal_id",
-		"created_at",
-		"router_path",
-		"base_router_sha256",
-		"candidate_router_sha256",
-		"evidence",
-		"status",
-		"approval",
-		"candidate_router"
-	],
-	"properties": {
-		"schema_version": {
-			"type": "string",
-			"const": "1.0.0"
-		},
-		"proposal_id": {
-			"type": "string",
-			"minLength": 1
-		},
-		"created_at": {
-			"type": "string",
-			"minLength": 1
-		},
-		"router_path": {
-			"type": "string",
-			"const": ".pi/model-router.json"
-		},
-		"base_router_sha256": {
-			"type": "string",
-			"pattern": "^[a-f0-9]{64}$"
-		},
-		"candidate_router_sha256": {
-			"type": "string",
-			"pattern": "^[a-f0-9]{64}$"
-		},
-		"status": {
-			"type": "string",
-			"enum": ["proposed", "approved_applied", "rejected"]
-		},
-		"evidence": {
-			"type": "object",
-			"additionalProperties": false,
-			"required": [
-				"sample_count",
-				"min_sample_count",
-				"success_rate_delta",
-				"cost_per_task_delta",
-				"regression_guard_passed",
-				"trace_refs"
-			],
-			"properties": {
-				"sample_count": {
-					"type": "integer",
-					"minimum": 1
-				},
-				"min_sample_count": {
-					"type": "integer",
-					"minimum": 1
-				},
-				"success_rate_delta": {
-					"type": "number"
-				},
-				"cost_per_task_delta": {
-					"type": "number"
-				},
-				"regression_guard_passed": {
-					"type": "boolean"
-				},
-				"trace_refs": {
-					"type": "array",
-					"items": {
-						"type": "string",
-						"minLength": 1
-					}
-				},
-				"notes": {
-					"type": "string"
-				}
-			}
-		},
-		"approval": {
-			"type": "object",
-			"additionalProperties": false,
-			"required": ["required", "approved_by", "approved_at", "justification"],
-			"properties": {
-				"required": {
-					"type": "boolean",
-					"const": true
-				},
-				"approved_by": {
-					"type": ["string", "null"]
-				},
-				"approved_at": {
-					"type": ["string", "null"]
-				},
-				"justification": {
-					"type": ["string", "null"]
-				}
-			}
-		},
-		"candidate_router": {
-			"type": "object"
-		}
-	}
-}