ultimate-pi 0.19.0 → 0.20.0

package/.pi/scripts/harness_web/rank.py

@@ -0,0 +1,163 @@
+"""URL normalization and RRF fusion for multi-angle SERP results."""
+
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass, field
+from typing import Any
+from urllib.parse import parse_qs, urlparse, urlunparse
+
+RRF_K = 60
+
+_TRACKING_PARAMS = frozenset(
+    {
+        "utm_source",
+        "utm_medium",
+        "utm_campaign",
+        "utm_term",
+        "utm_content",
+        "fbclid",
+        "gclid",
+        "mc_cid",
+        "mc_eid",
+    }
+)
+
+
+@dataclass
+class RankedHit:
+    url: str
+    title: str
+    description: str
+    score: float
+    angle_ids: list[str] = field(default_factory=list)
+    ranks: dict[str, int] = field(default_factory=dict)
+
+    def to_web_dict(self) -> dict[str, Any]:
+        return {
+            "url": self.url,
+            "title": self.title,
+            "description": self.description,
+            "score": round(self.score, 6),
+            "angle_ids": list(self.angle_ids),
+            "ranks": dict(self.ranks),
+        }
+
+
+def normalize_url(url: str) -> str:
+    u = url.strip()
+    if not u:
+        return ""
+    parsed = urlparse(u)
+    scheme = (parsed.scheme or "https").lower()
+    host = (parsed.hostname or "").lower()
+    if not host:
+        return u
+    port = parsed.port
+    netloc = host
+    if port and not ((scheme == "http" and port == 80) or (scheme == "https" and port == 443)):
+        netloc = f"{host}:{port}"
+    path = parsed.path or "/"
+    if path != "/" and path.endswith("/"):
+        path = path.rstrip("/")
+    qs = parse_qs(parsed.query, keep_blank_values=False)
+    filtered = []
+    for key in sorted(qs.keys()):
+        if key.lower() in _TRACKING_PARAMS:
+            continue
+        for val in qs[key]:
+            filtered.append(f"{key}={val}")
+    query = "&".join(filtered)
+    return urlunparse((scheme, netloc, path, "", query, ""))
+
+
+def tokenize(text: str) -> set[str]:
+    return {t for t in re.findall(r"[a-z0-9]{3,}", text.lower()) if len(t) >= 3}
+
+
+def lexical_rerank(hits: list[RankedHit], intent: str) -> list[RankedHit]:
+    """Lightweight O3 boost when HARNESS_WEB_RERANK=lexical."""
+    intent_tokens = tokenize(intent)
+    if not intent_tokens:
+        return hits
+
+    def lex_score(h: RankedHit) -> float:
+        blob = f"{h.title} {h.description}".lower()
+        tokens = tokenize(blob)
+        if not tokens:
+            return 0.0
+        overlap = len(intent_tokens & tokens) / max(len(intent_tokens), 1)
+        return overlap
+
+    scored = [(h, h.score + 0.15 * lex_score(h)) for h in hits]
+    scored.sort(key=lambda x: x[1], reverse=True)
+    out: list[RankedHit] = []
+    for h, s in scored:
+        out.append(
+            RankedHit(
+                url=h.url,
+                title=h.title,
+                description=h.description,
+                score=s,
+                angle_ids=h.angle_ids,
+                ranks=h.ranks,
+            )
+        )
+    return out
+
+
+def fuse_angle_results(
+    per_angle: dict[str, list[dict[str, str]]],
+    *,
+    final_limit: int = 10,
+    intent: str = "",
+    rerank_mode: str = "off",
+) -> list[RankedHit]:
+    """Reciprocal Rank Fusion across angle result lists."""
+    accum: dict[str, dict[str, Any]] = {}
+
+    for angle_id, results in per_angle.items():
+        for rank_1based, item in enumerate(results, start=1):
+            raw_url = (item.get("url") or "").strip()
+            norm = normalize_url(raw_url)
+            if not norm or not norm.startswith("http"):
+                continue
+            entry = accum.setdefault(
+                norm,
+                {
+                    "url": raw_url,
+                    "title": "",
+                    "description": "",
+                    "score": 0.0,
+                    "angle_ids": [],
+                    "ranks": {},
+                },
+            )
+            entry["score"] += 1.0 / (RRF_K + rank_1based)
+            if angle_id not in entry["angle_ids"]:
+                entry["angle_ids"].append(angle_id)
+            entry["ranks"][angle_id] = rank_1based
+            title = (item.get("title") or "").strip()
+            desc = (item.get("description") or "").strip()
+            if title and not entry["title"]:
+                entry["title"] = title
+            if desc and (not entry["description"] or len(desc) > len(entry["description"])):
+                entry["description"] = desc
+
+    hits = [
+        RankedHit(
+            url=e["url"],
+            title=e["title"],
+            description=e["description"],
+            score=e["score"],
+            angle_ids=e["angle_ids"],
+            ranks=e["ranks"],
+        )
+        for e in accum.values()
+    ]
+    hits.sort(key=lambda h: (-h.score, -len(h.angle_ids), min(h.ranks.values()) if h.ranks else 999))
+
+    if rerank_mode == "lexical" and intent:
+        hits = lexical_rerank(hits, intent)
+
+    return hits[:final_limit]

package/.pi/scripts/harness_web/scrape.py

@@ -41,6 +41,36 @@ def scrape_url(
     write_page_markdown(Path(output), page, main_content_only=True)
 
 
+def scrape_url_with_highlights(
+    url: str,
+    markdown_output: str,
+    highlights_output: str | None,
+    *,
+    config: HarnessWebConfig,
+    fast: bool,
+    wait_ms: int | None,
+    highlight_query: str,
+) -> None:
+    import json
+    from pathlib import Path
+
+    from .highlights import extract_highlights
+
+    page = fetch_page(url, config=config, fast=fast, wait_ms=wait_ms)
+    md_path = Path(markdown_output)
+    write_page_markdown(md_path, page, main_content_only=True)
+    if highlights_output and highlight_query.strip():
+        text = md_path.read_text(encoding="utf-8")
+        spans = extract_highlights(text, highlight_query)
+        hp = Path(highlights_output)
+        hp.parent.mkdir(parents=True, exist_ok=True)
+        hp.write_text(
+            json.dumps({"url": url, "query": highlight_query, "highlights": spans}, indent=2)
+            + "\n",
+            encoding="utf-8",
+        )
+
+
 def map_url(
     url: str,
     output: str,

package/.pi/scripts/run-tests.mjs

@@ -0,0 +1,64 @@
+#!/usr/bin/env node
+import { readdirSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+
+const TEST_DIR = 'test';
+
+const NODE_ONLY_TESTS = [
+	'harness-verify.test.mjs',
+	'harness-ask-user.test.mjs',
+	'harness-subagents-loader.test.mjs',
+	'harness-subagent-precheck.test.mjs',
+	'sentrux-rules-sync.test.mjs',
+	'harness-budget-guard.test.mjs',
+];
+
+const DEFAULT_SUITE_EXCLUDES = new Set([
+	'graphify-kb-updater.test.mjs',
+	'harness-artifact-gate.test.mjs',
+	'harness-spawn-critical-path.test.mjs',
+	'harness-yaml.test.mjs',
+	'plan-debate-lanes.test.mjs',
+]);
+
+function listTests() {
+	const entries = readdirSync(TEST_DIR, { withFileTypes: true });
+	const files = entries.filter((entry) => entry.isFile()).map((entry) => entry.name);
+	const nodeOnlySet = new Set(NODE_ONLY_TESTS);
+
+	const nodeTests = NODE_ONLY_TESTS.filter((name) => files.includes(name)).map((name) => `${TEST_DIR}/${name}`);
+	const tsxTests = files
+		.filter(
+			(name) =>
+				(name.endsWith('.test.mjs') || name.endsWith('.test.ts')) &&
+				!name.endsWith('.integration.test.ts') &&
+				!nodeOnlySet.has(name) &&
+				!DEFAULT_SUITE_EXCLUDES.has(name),
+		)
+		.map((name) => `${TEST_DIR}/${name}`)
+		.sort();
+
+	return { nodeTests, tsxTests };
+}
+
+function run(cmd, args) {
+	const result = spawnSync(cmd, args, { stdio: 'inherit' });
+	if (result.error) {
+		throw result.error;
+	}
+	if (result.status !== 0) {
+		process.exit(result.status ?? 1);
+	}
+}
+
+const { nodeTests, tsxTests } = listTests();
+
+if (nodeTests.length > 0) {
+	run('node', ['--test', ...nodeTests]);
+}
+
+run('node', ['.pi/harness/evals/smoke/smoke-harness-plan.mjs', '--fixture']);
+
+if (tsxTests.length > 0) {
+	run('npx', ['-y', 'tsx', '--test', ...tsxTests]);
+}

package/.pi/scripts/tests/test_harness_web_heuristic_config.py

@@ -0,0 +1,132 @@
+"""Unit tests for harness_web.heuristic_config."""
+
+from __future__ import annotations
+
+import json
+import os
+import tempfile
+import unittest
+from pathlib import Path
+
+from harness_web.heuristic_config import (
+    _embedded_builtin_dict,
+    _merge_config_dict,
+    build_heuristic_angles,
+    clear_heuristic_config_cache,
+    heuristic_config_from_merged,
+    load_heuristic_angles_config_cached,
+)
+
+
+class TestHeuristicConfig(unittest.TestCase):
+    def tearDown(self) -> None:
+        clear_heuristic_config_cache()
+
+    def test_builtin_code_includes_stackoverflow(self) -> None:
+        cfg = heuristic_config_from_merged(_embedded_builtin_dict())
+        angles = build_heuristic_angles("rust async", category="code", config=cfg)
+        ids = {a.id for a in angles}
+        self.assertIn("stackoverflow", ids)
+        self.assertIn("github", ids)
+        self.assertTrue(any("site:stackoverflow.com" in a.query for a in angles))
+
+    def test_shipped_code_includes_mdn_and_registries(self) -> None:
+        pkg = Path(__file__).resolve().parents[2] / "harness" / "web-heuristic-angles.yaml"
+        if not pkg.is_file():
+            self.skipTest("package yaml missing")
+        clear_heuristic_config_cache()
+        cfg = load_heuristic_angles_config_cached((str(pkg),))
+        angles = build_heuristic_angles("websocket api", category="code", config=cfg)
+        ids = {a.id for a in angles}
+        self.assertIn("mdn", ids)
+        self.assertIn("package_registries", ids)
+        self.assertLessEqual(len(angles), cfg.max_angles)
+
+    def test_shipped_security_category(self) -> None:
+        pkg = Path(__file__).resolve().parents[2] / "harness" / "web-heuristic-angles.yaml"
+        if not pkg.is_file():
+            self.skipTest("package yaml missing")
+        clear_heuristic_config_cache()
+        cfg = load_heuristic_angles_config_cached((str(pkg),))
+        angles = build_heuristic_angles("jwt validation", category="security", config=cfg)
+        ids = {a.id for a in angles}
+        self.assertIn("owasp", ids)
+        self.assertIn("cve_nvd", ids)
+
+    def test_merge_extends_code_category(self) -> None:
+        merged = _merge_config_dict(
+            _embedded_builtin_dict(),
+            {
+                "max_angles": 12,
+                "categories": {
+                    "code": [
+                        {
+                            "id": "docs_rs",
+                            "query": "{query} site:docs.rs",
+                            "rationale": "Rust docs",
+                        },
+                    ],
+                },
+            },
+        )
+        cfg = heuristic_config_from_merged(merged)
+        merged_ids = [a["id"] for a in merged["categories"]["code"]]
+        self.assertIn("docs_rs", merged_ids)
+        angles = build_heuristic_angles("tokio", category="code", config=cfg)
+        ids = {a.id for a in angles}
+        self.assertIn("stackoverflow", ids)
+        self.assertIn("github", ids)
+
+    def test_merge_adds_new_category(self) -> None:
+        merged = _merge_config_dict(
+            _embedded_builtin_dict(),
+            {
+                "categories": {
+                    "security": [
+                        {"id": "cve", "query": "{query} CVE", "rationale": "vulns"},
+                        {
+                            "id": "owasp",
+                            "query": "{query} site:owasp.org",
+                            "rationale": "guidance",
+                        },
+                    ],
+                },
+            },
+        )
+        cfg = heuristic_config_from_merged(merged)
+        angles = build_heuristic_angles("jwt auth", category="security", config=cfg)
+        ids = {a.id for a in angles}
+        self.assertIn("cve", ids)
+        self.assertIn("owasp", ids)
+
+    def test_json_project_file_merges(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            proj = Path(tmp)
+            harness_dir = proj / ".pi" / "harness"
+            harness_dir.mkdir(parents=True)
+            proj_file = harness_dir / "web-heuristic-angles.json"
+            proj_file.write_text(
+                json.dumps(
+                    {
+                        "categories": {
+                            "code": [
+                                {
+                                    "id": "crates_io",
+                                    "query": "{query} site:crates.io",
+                                    "rationale": "crates",
+                                },
+                            ],
+                        },
+                    }
+                ),
+                encoding="utf-8",
+            )
+            clear_heuristic_config_cache()
+            cfg = load_heuristic_angles_config_cached((str(proj_file),))
+            angles = build_heuristic_angles("serde", category="code", config=cfg)
+            ids = {a.id for a in angles}
+            self.assertIn("crates_io", ids)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/.pi/scripts/tests/test_harness_web_query_angles.py

@@ -0,0 +1,45 @@
+"""Unit tests for harness_web.query_angles (no network)."""
+
+from __future__ import annotations
+
+import json
+import tempfile
+import unittest
+from pathlib import Path
+
+from harness_web.query_angles import AnglesPlan, load_angles_file, resolve_angles
+
+
+class TestResolveAngles(unittest.TestCase):
+    def test_heuristic_code_category(self) -> None:
+        plan = resolve_angles("rust async", expand_heuristic=True, category="code")
+        ids = {a.id for a in plan.angles}
+        self.assertIn("github", ids)
+        self.assertGreaterEqual(len(plan.angles), 2)
+        self.assertLessEqual(len(plan.angles), 5)
+
+
+class TestLoadFile(unittest.TestCase):
+    def test_load_json_file(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            p = Path(tmp) / "angles.json"
+            p.write_text(
+                json.dumps(
+                    {
+                        "intent": "load test",
+                        "angles": [
+                            {"id": "a", "query": "first angle query"},
+                            {"id": "b", "query": "second angle query"},
+                        ],
+                    }
+                ),
+                encoding="utf-8",
+            )
+            plan = load_angles_file(p)
+            self.assertIsInstance(plan, AnglesPlan)
+            self.assertEqual(plan.intent, "load test")
+            self.assertEqual(len(plan.angles), 2)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/.pi/scripts/tests/test_harness_web_rank.py

@@ -0,0 +1,56 @@
+"""Unit tests for harness_web.rank (no network)."""
+
+from __future__ import annotations
+
+import unittest
+
+from harness_web.rank import RankedHit, fuse_angle_results, lexical_rerank, normalize_url, tokenize
+
+
+class TestNormalizeUrl(unittest.TestCase):
+    def test_strips_tracking(self) -> None:
+        a = normalize_url("https://Example.com/path?utm_source=x&id=1")
+        b = normalize_url("https://example.com/path?id=1")
+        self.assertEqual(a, b)
+
+    def test_trailing_slash(self) -> None:
+        self.assertEqual(
+            normalize_url("https://example.com/foo/"),
+            normalize_url("https://example.com/foo"),
+        )
+
+
+class TestRrfFusion(unittest.TestCase):
+    def test_merges_duplicate_urls(self) -> None:
+        angle_results = {
+            "a": [
+                {"url": "https://x.com/1", "title": "T1", "description": "d1"},
+                {"url": "https://x.com/2", "title": "T2", "description": "d2"},
+            ],
+            "b": [
+                {"url": "https://x.com/1", "title": "T1b", "description": "d1b"},
+            ],
+        }
+        fused = fuse_angle_results(angle_results, final_limit=5)
+        self.assertEqual(len(fused), 2)
+        top = fused[0]
+        self.assertEqual(top.url, "https://x.com/1")
+        self.assertIn("a", top.angle_ids)
+        self.assertIn("b", top.angle_ids)
+        self.assertGreater(top.score, fused[1].score)
+
+
+class TestLexicalRerank(unittest.TestCase):
+    def test_boosts_intent_overlap(self) -> None:
+        hits = [
+            RankedHit("https://a", "unrelated", "noise", 0.52, ["a"]),
+            RankedHit("https://b", "kubernetes architecture", "how kubernetes works", 0.50, ["b"]),
+        ]
+        reranked = lexical_rerank(hits, "kubernetes architecture")
+        self.assertEqual(reranked[0].url, "https://b")
+        self.assertGreater(reranked[0].score, reranked[1].score)
+
+
+class TestTokenize(unittest.TestCase):
+    def test_min_length(self) -> None:
+        self.assertIn("hello", tokenize("hello hi"))

package/AGENTS.md

@@ -16,7 +16,7 @@ Created: 2026-05-14
 - docs/adr/ → Repo-level Architectural Decision Records
 - .pi/harness/docs/adrs/ → Harness ADRs (team-shared; [index](.pi/harness/docs/adrs/README.md))
 - .pi/harness/docs/practice-map.md → Phase → practice → agent spawn topology for `/harness-plan`, `/harness-run`, `/harness-review`
-- .pi/skills/ → Agent skills
+- .pi/skills/ → Agent skills (harness skills symlink to `.agents/skills/`, e.g. `web-retrieval`)
 - .pi/agents/ → Specialized agents
 
 ## Graphify-First Workflow
@@ -36,7 +36,7 @@ Created: 2026-05-14
 - Harness context: **context-mode only** — never lean-ctx on harness paths (see harness-context skill)
 - `graphify update .` after significant code changes
 - ast-grep (`sg`) is the default code search tool — use `sg -p 'pattern'` for structural search, never grep for code
-- Web fetch/search via `python3 "$UP_PKG/.pi/scripts/harness-web.py"` (Scrapling; see scrapling-web skill)
+- Non-API web: invoke **`web-retrieval`** skill (WRS tiers; default `tier=deep` with `web-query-expander` → `anglesFile`). CLI: `python3 "$UP_PKG/.pi/scripts/harness-web.py"`
 
 ## graphify
 

package/CHANGELOG.md

@@ -9,6 +9,18 @@ All notable changes to this project are documented in this file.
 - **Harness lens:** Integrate selected pi-lens capabilities through a harness-owned extension, store lens state under `.pi/harness/.lens`, and route lens findings through harness PostHog telemetry instead of standalone lens health/telemetry surfaces.
 - **Graphify KB updater:** Productize conservative daily discovery/promotion with explicit repo/release taxonomy, allowlist source-class gates, operator review queue reporting, scheduler smoke validation, and safe Graphify refresh controls.
 
+## [v0.20.0] — 2026-05-26
+
+### ✨ Features
+
+- **Harness:** Add hash-anchored executor edit flow.
+
+## [v0.19.1] — 2026-05-26
+
+### 🔧 Chores
+
+- Prepare web retrieval and harness updates for release.
+
 ## [v0.19.0] — 2026-05-24
 
 ### ✨ Features

package/THIRD_PARTY_NOTICES.md

@@ -1,3 +1,10 @@
+## Dirac hash-anchored edit (vendored subset)
+
+- **Project:** https://github.com/dirac-run/dirac
+- **License:** Apache-2.0
+- **Location:** [`.pi/lib/harness-anchored-edit/`](.pi/lib/harness-anchored-edit/) (anchor state, line protocol, edit resolve/apply)
+- **Integration:** [`.pi/extensions/harness-anchored-edit.ts`](.pi/extensions/harness-anchored-edit.ts) — first-class harness `read`/`edit` (always on when harness extensions load). harness-lens autopatches anchored `edit.text` at `tool_call`; native apply via `applyAnchoredEditsToFile`.
+
 ## pi-vcc (vendored)
 
 - **Project:** https://github.com/sting8k/pi-vcc

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "ultimate-pi",
-	"version": "0.19.0",
+	"version": "0.20.0",
 	"description": "Ultimate AI coding harness for pi.dev — extensible skills, Obsidian wiki knowledge layer, compressed context, deterministic output",
 	"keywords": [
 		"pi-package",
@@ -56,7 +56,10 @@
 		".pi/harness/agents.manifest.json",
 		".pi/harness/agents.policy.yaml",
 		".pi/harness/examples",
+		".pi/harness/web-heuristic-angles.yaml",
+		".pi/harness/web-heuristic-angles.json",
 		".pi/lib/harness-lens",
+		".pi/lib/harness-anchored-edit",
 		".pi/harness/README.md",
 		".pi/npm/package.json",
 		".pi/npm/.gitignore",
@@ -76,16 +79,15 @@
 		"@earendil-works/pi-coding-agent": "*"
 	},
 	"scripts": {
-		"check:ts": "tsc --noEmit --target ES2023 --lib ES2023 --moduleResolution nodenext --module nodenext --skipLibCheck .pi/lib/agt/config.ts .pi/lib/agt/policy-engine.ts .pi/lib/agt/build-evaluation-context.ts .pi/lib/agt/evaluate-policy.ts .pi/lib/agt/legacy-evaluate.ts .pi/lib/agt/identity-registry.ts .pi/lib/agt/delegation.ts .pi/lib/agt/trust-run-store.ts .pi/lib/agt/audit-run-sink.ts .pi/lib/agt/rings.ts .pi/lib/agt/workflow-history.ts .pi/lib/agt/sre-hooks.ts .pi/lib/agt/kill-switch-state.ts .pi/lib/agt/index.ts .pi/extensions/agt-prompt-guard.ts .pi/extensions/agt-kill-switch.ts .pi/extensions/harness-subagent-governance.ts .pi/lib/harness-agt-tool-guard.ts .pi/lib/harness-subagent-submit-register.ts .pi/extensions/00-harness-project-control.ts .pi/extensions/custom-system-prompt.ts .pi/lib/harness-run-context.ts .pi/lib/harness-spawn-policy.ts .pi/lib/harness-context-mode-policy.ts .pi/lib/harness-ui-state.ts .pi/extensions/harness-run-context.ts .pi/lib/harness-vcc-settings.ts .pi/extensions/dotenv-loader.ts .pi/extensions/00-posthog-network-bootstrap.ts .pi/lib/posthog-client.ts .pi/lib/posthog-node.d.ts .pi/lib/harness-posthog.ts .pi/lib/harness-paths.ts .pi/extensions/provider-payload-sanitize.ts .pi/extensions/harness-telemetry.ts .pi/extensions/harness-ask-user.ts .pi/extensions/harness-plan-approval.ts .pi/lib/ask-user/schema.ts .pi/lib/ask-user/types.ts .pi/lib/ask-user/validate.ts .pi/lib/ask-user/dialog.ts .pi/lib/ask-user/fallback.ts .pi/lib/ask-user/render.ts .pi/lib/plan-approval/types.ts .pi/lib/plan-approval/schema.ts .pi/lib/plan-approval/validate.ts .pi/lib/plan-approval/format-plan.ts .pi/lib/plan-approval/dialog.ts .pi/lib/plan-approval/render.ts .pi/lib/plan-approval/create-plan.ts .pi/extensions/harness-subagents.ts .pi/lib/harness-subagents-bridge.ts .pi/lib/harness-cocoindex-refresh.ts .pi/lib/harness-subagent-auth.ts .pi/lib/agents-policy.ts .pi/lib/agt-governance-active.ts .pi/extensions/subagent-governance.ts .pi/lib/agt-tool-guard.ts .pi/lib/harness-subagent-precheck.ts .pi/lib/harness-spawn-budget.ts vendor/pi-subagents/src/agents.ts vendor/pi-subagents/src/subagents.ts .pi/extensions/review-integrity.ts .pi/extensions/trace-recorder.ts .pi/extensions/observation-bus.ts .pi/extensions/drift-monitor.ts .pi/extensions/policy-gate.ts .pi/extensions/budget-guard.ts .pi/extensions/debate-orchestrator.ts .pi/extensions/harness-debate-tools.ts .pi/lib/debate-bus-core.ts .pi/lib/debate-bus-state.ts .pi/lib/plan-debate-gate.ts .pi/lib/plan-debate-id.ts .pi/lib/plan-messenger.ts .pi/lib/plan-debate-envelope.ts .pi/lib/plan-review-integrator-rules.ts .pi/lib/plan-scope-guard.ts .pi/lib/plan-debate-write-guard.ts .pi/lib/plan-debate-lane.ts .pi/lib/plan-debate-round-status.ts .pi/extensions/harness-live-widget.ts .pi/extensions/sentrux-rules-sync.ts .pi/extensions/custom-header.ts .pi/extensions/harness-web-tools.ts .pi/extensions/harness-web-guard.ts .pi/lib/harness-web/run-cli.ts",
+		"check:ts": "tsc -p tsconfig.check.json",
 		"vendor:sync-vcc": "bash .pi/scripts/vendor-sync-pi-vcc.sh",
 		"vendor:sync-subagents": "bash .pi/scripts/vendor-sync-pi-subagents.sh",
-		"release": "bash .pi/scripts/release.sh",
 		"lint": "biome check",
 		"lint:fix": "biome check --fix",
 		"format": "biome format --write",
 		"format:check": "biome format",
 		"prepare": "lefthook install",
-		"test": "node --test test/harness-verify.test.mjs test/harness-ask-user.test.mjs test/harness-subagents-loader.test.mjs test/harness-subagent-precheck.test.mjs test/sentrux-rules-sync.test.mjs test/harness-budget-guard.test.mjs && node .pi/harness/evals/smoke/smoke-harness-plan.mjs --fixture && npx -y tsx --test test/posthog-client.test.mjs test/harness-agt-policy-load.test.mjs test/harness-agt-policy-matrix.test.mjs test/harness-agt-policy-parity.test.mjs test/harness-agt-packaging.test.mjs test/harness-tool-call-hook-chain.test.mjs test/harness-vcc-settings.test.ts test/harness-run-context-postrun.test.mjs test/harness-tool-payload.test.mjs test/harness-live-widget-status.test.ts test/harness-project-toggle-tui.test.ts test/harness-plan-phase-policy.test.mjs test/harness-context-mode-policy.test.mjs test/harness-subprocess-bootstrap.test.mjs test/harness-subagent-policy.test.mjs test/harness-subagent-precheck-topology.test.mjs test/plan-approval-readiness.test.mjs test/harness-spawn-budget.test.mjs test/harness-spawn-parse.test.mjs test/harness-schema-validate.test.mjs test/harness-turn-routing.test.mjs test/harness-budget-enforce.test.mjs test/harness-submit-policy.test.mjs test/harness-project-agents-policy.test.mjs test/plan-approval-format.test.mjs test/plan-approval-dialog.test.mjs test/plan-approval-sync.test.mjs test/plan-create-plan.test.mjs test/plan-review-format.test.mjs test/debate-plan-phase.test.mjs test/plan-debate-eligibility.test.mjs test/plan-messenger-gate.test.mjs test/plan-debate-lane-apply.test.mjs test/review-integrity-revise-handoff.test.mjs test/harness-plan-revise-reset.test.mjs",
+		"test": "node .pi/scripts/run-tests.mjs",
 		"test:vcc": "npx -y tsx --test vendor/pi-vcc/tests/*.test.ts",
 		"harness:sentrux-bootstrap": "node .pi/scripts/harness-sentrux-bootstrap.mjs",
 		"harness:sentrux-sync": "node .pi/scripts/sentrux-rules-sync.mjs --force",
@@ -109,6 +111,7 @@
 		"ajv": "^8.17.1",
 		"ajv-formats": "^3.0.1",
 		"croner": "^9.0.0",
+		"diff": "^8.0.4",
 		"jimp": "^1.6.1",
 		"minimatch": "^10.2.5",
 		"nanoid": "^5.1.5",

package/vendor/pi-subagents/src/agents.ts

@@ -19,6 +19,11 @@ export interface AgentConfig {
 	thinking?: string;
 	maxTurns?: number;
 	extensionsOff?: boolean;
+	/** Curated subprocess extensions (agents.policy.yaml `extension_bundle`). */
+	extensionBundle?: string;
+	extensionsFull?: boolean;
+	/** When true, subprocess uses --no-builtin-tools so extension read/edit replace builtins. */
+	noBuiltinTools?: boolean;
 	skillsOff?: boolean;
 	systemPrompt: string;
 	source: AgentSource;

package/vendor/pi-subagents/src/subagents.ts

@@ -46,6 +46,10 @@ export interface HarnessSubagentsOptions {
 	subprocessGovernanceExtensionPath?: string;
 	/** @deprecated Use subprocessGovernanceExtensionPath */
 	harnessSubprocessExtensionPath?: string;
+	/** Resolve curated `-e` extension paths for agents.policy `extension_bundle`. */
+	resolveExtensionBundlePaths?: (
+		bundleName: string,
+	) => string[];
 	/** Extra env vars per subprocess (e.g. HARNESS_RUN_ID, HARNESS_RUN_DIR). */
 	resolveSubprocessEnv?: (
 		task: string,
@@ -453,13 +457,28 @@ function buildAgentArgs(
 		agent.extensionsOff &&
 		(subagentsOptions?.subprocessGovernanceExtensionPath ??
 			subagentsOptions?.harnessSubprocessExtensionPath);
-	if (agent.extensionsOff) {
+	const bundlePaths =
+		agent.extensionBundle && subagentsOptions?.resolveExtensionBundlePaths
+			? subagentsOptions.resolveExtensionBundlePaths(agent.extensionBundle)
+			: [];
+
+	if (agent.extensionBundle && bundlePaths.length > 0) {
+		args.push("--no-extensions");
+		for (const extPath of bundlePaths) {
+			args.push("-e", extPath);
+		}
+		if (agent.skillsOff) args.push("--no-skills");
+	} else if (agent.extensionsOff) {
 		args.push("--no-extensions");
 		if (governanceExt) args.push("-e", governanceExt);
 		if (agent.skillsOff) args.push("--no-skills");
 	}
-	if (agent.tools?.length) args.push("--tools", agent.tools.join(","));
-	else if (agent.extensionsOff) args.push("--no-tools");
+	if (agent.tools?.length) {
+		args.push("--tools", agent.tools.join(","));
+		if (agent.noBuiltinTools) args.push("--no-builtin-tools");
+	} else if (agent.extensionsOff || agent.extensionBundle) {
+		args.push("--no-tools");
+	}
 	return args;
 }