ultimate-pi 0.2.4 → 0.2.6

package/.pi/PACKAGING.md

@@ -0,0 +1,35 @@
+# Pi package packaging (ultimate-pi)
+
+Aligned with [pi packages](https://github.com/badlogic/pi-mono/blob/main/packages/coding-agent/docs/packages.md).
+
+## Pi manifest (`package.json` → `pi`)
+
+| Key | Paths | Notes |
+|-----|-------|--------|
+| `extensions` | `.pi/extensions` | TypeScript extensions (loaded by pi) |
+| `skills` | `.agents/skills`, `.pi/skills` | Agent Skills + pi-local skills |
+| `prompts` | `.pi/prompts` | Slash-command prompt templates |
+
+Pi does **not** define `scripts`, `agents`, or `providers` in the manifest.
+
+- **Harness scripts** → `.pi/scripts/` (npm `harness:*` scripts; see `.pi/scripts/README.md`)
+- **Subagent agents** → `.pi/agents/**/*.md` (loaded by `@tintinweb/pi-subagents` from the **project** `.pi/agents/`; `/harness-setup` seeds them from the installed package)
+- **Providers** → install via `bundledDependencies` + user settings, not a separate manifest directory
+
+## npm `files` allowlist
+
+We use an explicit allowlist (not the whole `.pi/` tree) so dev-only artifacts never ship:
+
+- No `.pi/harness/runs/`, local `model-router.json`, or `firecrawl/.env`
+- Ship `.pi/settings.example.json`, not `.pi/settings.json` (dev checkout uses `".."` local package)
+
+## Settings
+
+| File | Shipped | Purpose |
+|------|---------|---------|
+| `.pi/settings.json` | No | Repo dev only (`"packages": ["..", …]`) |
+| `.pi/settings.example.json` | Yes | Merge into project `.pi/settings.json` during setup |
+
+## Dependencies
+
+Runtime pi extensions are in `dependencies` + `bundledDependencies`. `@mariozechner/pi-coding-agent` is a `peerDependency` (provided by the pi CLI).

package/.pi/extensions/lib/harness-paths.ts

@@ -45,3 +45,11 @@ export function resolveHarnessAsset(
 ): string {
 	return join(getHarnessPackageRoot(moduleUrl), ...segments);
 }
+
+/** Harness CLI scripts shipped under `.pi/scripts/` in the npm package. */
+export function resolveHarnessScript(
+	moduleUrl: string,
+	scriptName: string,
+): string {
+	return resolveHarnessAsset(moduleUrl, ".pi", "scripts", scriptName);
+}

package/.pi/extensions/sentrux-rules-sync.ts

@@ -4,21 +4,15 @@
 
 import { spawn } from "node:child_process";
 import { existsSync } from "node:fs";
-import { join } from "node:path";
 import type { ExtensionAPI } from "@mariozechner/pi-coding-agent";
-import { resolveHarnessAsset } from "./lib/harness-paths.js";
+import { resolveHarnessScript } from "./lib/harness-paths.js";
 
 function resolveSyncScript(): string {
-	const packaged = resolveHarnessAsset(
+	return resolveHarnessScript(
 		// @ts-expect-error pi extensions run as ESM
 		import.meta.url,
-		"scripts",
 		"sentrux-rules-sync.mjs",
 	);
-	if (existsSync(packaged)) {
-		return packaged;
-	}
-	return join(process.cwd(), "scripts", "sentrux-rules-sync.mjs");
 }
 
 function runSync(args: string[]): Promise<{ code: number; output: string }> {

package/.pi/harness/docs/adrs/0006-sentrux-dual-layer.md

@@ -28,4 +28,4 @@ Evaluator trust requires both programmatic gates (policy, budget, integrity) and
 ## References
 
 - `.pi/harness/specs/observation.schema.json`
-- `scripts/harness-verify.mjs`
+- `.pi/scripts/harness-verify.mjs`

package/.pi/harness/docs/adrs/0009-sentrux-rules-lifecycle.md

@@ -11,7 +11,7 @@ Sentrux enforces architecture via [`.sentrux/rules.toml`](https://sentrux.dev/do
 
 1. **Canonical source:** [`.pi/harness/sentrux/architecture.manifest.json`](../../sentrux/architecture.manifest.json) — layers, boundaries, global constraints.
 2. **Generated artifact:** `.sentrux/rules.toml` — committed to git; managed block between `harness:managed:start/end` markers.
-3. **Sync command:** `npm run harness:sentrux-sync` (`scripts/sentrux-rules-sync.mjs`).
+3. **Sync command:** `npm run harness:sentrux-sync` (`.pi/scripts/sentrux-rules-sync.mjs`).
 4. **Pi command:** `/harness-sentrux-sync` via `sentrux-rules-sync.ts` extension.
 5. **When to sync:**
    - `/harness-setup` Step 2.8 (after sentrux install)
@@ -34,5 +34,5 @@ Sentrux enforces architecture via [`.sentrux/rules.toml`](https://sentrux.dev/do
 ## References
 
 - ADR 0006 (Sentrux dual layer)
-- `scripts/sentrux-rules-sync.mjs`
+- `.pi/scripts/sentrux-rules-sync.mjs`
 - `.pi/extensions/sentrux-rules-sync.ts`

package/.pi/harness/sentrux/architecture.manifest.json

@@ -34,9 +34,9 @@
 		},
 		{
 			"name": "tooling",
-			"paths": ["scripts/*", "test/*"],
+			"paths": [".pi/scripts/*", "test/*"],
 			"order": 4,
-			"description": "Deterministic scripts and tests"
+			"description": "Harness CLI scripts and tests"
 		}
 	],
 	"boundaries": [
@@ -61,7 +61,7 @@
 			"reason": "Contracts are data-only JSON schemas; extensions implement behavior"
 		},
 		{
-			"from": "scripts/*",
+			"from": ".pi/scripts/*",
 			"to": ".agents/skills/*",
 			"reason": "CLI scripts stay independent of skill markdown"
 		}

package/.pi/prompts/harness-setup.md

@@ -30,7 +30,16 @@ which git && git --version
 
 Block if node < 18, npm < 9, or git missing. Report versions and continue.
 
-Read `.pi/auto-commit.json` for co-author + branch config. Read `.pi/settings.json` for extension packages list.
+Read `.pi/auto-commit.json` for co-author + branch config.
+
+Resolve the installed **ultimate-pi** package root (works in this repo and after `pi install npm:ultimate-pi`):
+
+```bash
+UP_PKG="$(node -p "require('path').dirname(require.resolve('ultimate-pi/package.json'))")"
+echo "ultimate-pi package: $UP_PKG"
+```
+
+For extension package names, read **`$UP_PKG/.pi/settings.example.json`** (shipped template). Merge its `packages` array into the **project** `.pi/settings.json` if missing — do not copy the repo-dev `.pi/settings.json` from the package (it may contain `".."` and is not published).
 
 ## Step 0.5 — Graphify (skip if `--skip-graphify`)
 
@@ -49,15 +58,14 @@ Run from the **project root** (the external repo root, not ultimate-pi unless th
 mkdir -p ./raw .pi/harness/specs .pi/harness/runs .pi/harness/incidents .pi/harness/debates
 
 # Bundled with ultimate-pi harness; copy path if bootstrap runs from a linked harness checkout
-bash scripts/harness-graphify-bootstrap.sh
+bash "$(node -p "require('path').join(require('path').dirname(require.resolve('ultimate-pi/package.json')),'.pi/scripts/harness-graphify-bootstrap.sh')")"
 # In ultimate-pi checkout: npm run harness:graphify-bootstrap
-# Or, if scripts/ is not present in the target repo, copy/run ultimate-pi/scripts/harness-graphify-bootstrap.sh
 
 # Pass --force when $ARGUMENTS contains --force to rebuild an existing graph:
-# bash scripts/harness-graphify-bootstrap.sh --force
+# npm run harness:graphify-bootstrap -- --force
 ```
 
-If `scripts/harness-graphify-bootstrap.sh` is missing in the target repo, run it from the ultimate-pi harness package path, or execute equivalent steps manually:
+If the bootstrap script is missing, run it from the installed ultimate-pi package (`.pi/scripts/` inside the npm package), or execute equivalent steps manually:
 
 1. Install `graphifyy` (`uv tool install` preferred; else `pip`/`pip3 install --user`)
 2. `graphify install --platform pi` (and `graphify cursor install` if `.cursor/` exists)
@@ -212,9 +220,9 @@ If user chose **cloud**, skip all 1.5.x steps. Just note:
 Run the bundled verifier from the **project root**. It installs missing npm globals, fixes common **Linux system dependencies** (Chrome libs for `agent-browser`), runs smoke tests, and exits non-zero if a required tool fails.
 
 ```bash
-bash scripts/harness-cli-verify.sh
+npm run harness:cli-verify
 # ultimate-pi checkout: npm run harness:cli-verify
-# Reinstall everything: bash scripts/harness-cli-verify.sh --force
+# Reinstall everything: npm run harness:cli-verify -- --force
 ```
 
 **Required (script must exit 0):** firecrawl-cli, ctx7, biome, ast-grep (`sg`), sentrux (when harness manifest present).
@@ -229,14 +237,14 @@ sudo apt-get install -y libnss3 libnspr4 libgbm1 libatk1.0-0 libatk-bridge2.0-0
   libcups2 libdrm2 libxkbcommon0 libxcomposite1 libxdamage1 libxfixes3 libxrandr2 \
   libasound2 libpango-1.0-0 libcairo2 libx11-6 libxcb1 libxext6 fonts-liberation
 agent-browser install --with-deps
-bash scripts/harness-cli-verify.sh
+npm run harness:cli-verify
 ```
 
 **Do not continue** past Step 2 if `harness-cli-verify.sh` exits non-zero.
 
 ### Manual reference (if script missing in target repo)
 
-Copy `scripts/harness-cli-verify.sh` from ultimate-pi, or install tools individually:
+Use `npm run harness:cli-verify` from the installed ultimate-pi package, or install tools individually:
 
 ### 2.1 — firecrawl-cli (Web Search + Scrape + Crawl + Interact + Download + Parse)
 
@@ -415,7 +423,7 @@ Generate architectural rules from the harness manifest (creates/updates `.sentru
 # From ultimate-pi checkout:
 npm run harness:sentrux-sync
 # From an external project (after pi install npm:ultimate-pi):
-node "$(node -p "require('path').join(require('path').dirname(require.resolve('ultimate-pi/package.json')),'scripts/sentrux-rules-sync.mjs')")" --force
+npm run harness:sentrux-sync
 # Or in pi: /harness-sentrux-sync
 ```
 
@@ -433,13 +441,20 @@ sentrux gate --save . 2>/dev/null || echo "Baseline will be saved on first gate
 
 ## Step 3 — Pi Extension Packages
 
-Install pi extension packages from `.pi/settings.json`:
+Bundled extensions load from the installed `ultimate-pi` package. Optionally install the companion lockfile used in development:
 
 ```bash
-cd .pi/npm
-npm install
+UP_PKG="$(node -p "require('path').dirname(require.resolve('ultimate-pi/package.json'))")"
+if [ -f "$UP_PKG/.pi/npm/package.json" ]; then
+  (cd "$UP_PKG/.pi/npm" && npm install)
+  echo "✓ ultimate-pi .pi/npm dependencies"
+else
+  echo "✓ skip .pi/npm (not in package)"
+fi
 ```
 
+Merge extension entries from `$UP_PKG/.pi/settings.example.json` into this project's `.pi/settings.json` `packages` array (add any missing `npm:…` entries; keep existing user packages).
+
 Verify each package:
 
 | Package | Purpose | Phase |
@@ -461,9 +476,10 @@ The script below:
 
 ```bash
 # Verify package installed first
-ls .pi/npm/node_modules/@yeliu84/pi-model-router/package.json 2>/dev/null \
+ls "$UP_PKG/node_modules/@yeliu84/pi-model-router/package.json" 2>/dev/null \
+  || ls "$UP_PKG/.pi/npm/node_modules/@yeliu84/pi-model-router/package.json" 2>/dev/null \
   && echo "✓ model-router package" \
-  || echo "✗ model-router package — run: cd .pi/npm && npm install"
+  || echo "✗ model-router package — reinstall ultimate-pi or run npm install in $UP_PKG/.pi/npm"
 
 # Generate config from detected providers (only if missing)
 if [ -f .pi/model-router.json ]; then
@@ -579,7 +595,25 @@ Do NOT block. If generation fails, warn in report and continue.
 
 > `/router profile auto`
 
-The pi TUI will intercept this and activate the `auto` profile. Then continue to Step 4.
+The pi TUI will intercept this and activate the `auto` profile. Then continue to Step 3.6.
+
+## Step 3.6 — Seed `.pi/agents` (pi-subagents)
+
+`@tintinweb/pi-subagents` reads agent definitions from **this project's** `.pi/agents/`, not from the installed npm tree. Copy packaged agents when missing (preserves user edits):
+
+```bash
+UP_PKG="$(node -p "require('path').dirname(require.resolve('ultimate-pi/package.json'))")"
+mkdir -p .pi/agents/harness .pi/agents/pi-pi
+for dir in harness pi-pi; do
+  [ -d "$UP_PKG/.pi/agents/$dir" ] || continue
+  for f in "$UP_PKG/.pi/agents/$dir"/*.md; do
+    [ -f "$f" ] || continue
+    base="$(basename "$f")"
+    [ -f ".pi/agents/$dir/$base" ] || cp "$f" ".pi/agents/$dir/$base"
+  done
+done
+echo "✓ .pi/agents (harness + pi-pi) seeded from package"
+```
 
 ## Step 4 — Configuration Files
 
@@ -644,7 +678,7 @@ Created: $(date +%Y-%m-%d)
 - .pi/harness/specs/ → Harness contracts and schema docs
 - .pi/harness/incidents/ → Incident and override records
 - `.agents/skills/` (npm package) → Harness skills (no copy into `.pi/skills/` needed)
-- .pi/agents/ → Specialized agents
+- `.pi/agents/` → Specialized agents (seed from package — see Step 3.6)
 
 ## Graphify-First Workflow
 
@@ -668,14 +702,15 @@ Created: $(date +%Y-%m-%d)
 Re-run CLI verification (must pass unless `--skip-tools`):
 
 ```bash
-bash scripts/harness-cli-verify.sh
+npm run harness:cli-verify
 ```
 
 Then run the remaining checks:
 
 ```bash
 # pi extensions
-cd .pi/npm && npm ls 2>/dev/null && echo "✓ pi extensions" || echo "✗ pi extensions"
+UP_PKG="$(node -p "require('path').dirname(require.resolve('ultimate-pi/package.json'))")"
+npm ls --prefix "$UP_PKG" 2>/dev/null | head -5 && echo "✓ ultimate-pi bundled extensions" || echo "✗ check ultimate-pi install"
 
 # graphify knowledge graph (pip/pip3, uv, apt, or PATH)
 PIP_CMD=""
@@ -707,7 +742,9 @@ print(f'✓ knowledge graph built ({n} nodes)' if n else '✗ graph.json has 0 n
 graphify hook status 2>/dev/null && echo "✓ graphify git hooks installed" || echo "✗ graphify git hooks not installed"
 
 # model router
-ls .pi/npm/node_modules/@yeliu84/pi-model-router/package.json 2>/dev/null && echo "✓ model-router package" || echo "✗ model-router package"
+ls "$UP_PKG/node_modules/@yeliu84/pi-model-router/package.json" 2>/dev/null \
+  || ls "$UP_PKG/.pi/npm/node_modules/@yeliu84/pi-model-router/package.json" 2>/dev/null \
+  && echo "✓ model-router package" || echo "✗ model-router package"
 ls .pi/model-router.json 2>/dev/null && echo "✓ model-router config" || echo "✗ model-router config"
 
 # raw folder for graphify sources
@@ -764,7 +801,7 @@ Output summary table:
 
 Next steps:
 1. If tools missing: re-run with `--force` or install individually
-2. If graph not built: run `bash scripts/harness-graphify-bootstrap.sh` (or `graphify update .` from project root)
+2. If graph not built: run `npm run harness:graphify-bootstrap` (or `graphify update .` from project root)
 3. If hooks not installed: run `graphify hook install`
 4. If gh not authenticated: `gh auth login`
 5. If self-hosted Firecrawl unhealthy: `docker compose -f firecrawl/docker-compose.yaml logs`
@@ -774,9 +811,9 @@ Next steps:
 ## Guard Rails
 
 - **Internet required**: Several tools need npm registry access. Block if offline.
-- **CLI verify script**: Step 2 and Step 5 use `scripts/harness-cli-verify.sh` — installs npm globals, Linux Chrome system libs for `agent-browser`, and smoke-tests each tool. Block on non-zero exit.
+- **CLI verify script**: Step 2 and Step 5 use `npm run harness:cli-verify` (`.pi/scripts/harness-cli-verify.sh`) — installs npm globals, Linux Chrome system libs for `agent-browser`, and smoke-tests each tool. Block on non-zero exit.
 - **Graphify requires Python 3.10+**: Check `python3 --version`. Block if too old.
-- **Graphify bootstrap is mandatory** (unless `--skip-graphify`): Run `scripts/harness-graphify-bootstrap.sh`. Never use `graphify . --wiki`. Initial setup must run `graphify update .` and verify `graphify-out/graph.json` has nodes.
+- **Graphify bootstrap is mandatory** (unless `--skip-graphify`): Run `npm run harness:graphify-bootstrap`. Never use `graphify . --wiki`. Initial setup must run `graphify update .` and verify `graphify-out/graph.json` has nodes.
 - **Python packages (Graphify)**: Before install, detect via PATH, `pip`/`pip3 show graphifyy`, `uv`, or apt. Prefer `uv tool install graphifyy`.
 - **Node.js >= 18 required**: Some pi packages use modern Node APIs.
 - **Docker required for self-hosted**: Step 1.5 needs Docker Engine + Compose. Block if install fails.
@@ -799,7 +836,7 @@ Next steps:
 | Graphify install fails | Show installer output. Retry `uv tool install graphifyy` or `pip3 install --user graphifyy`. Ensure `~/.local/bin` is on PATH. |
 | `graphify update .` fails | Block setup. Corpus may have no code files, or graphify not on PATH. Show stderr. |
 | Invalid `graphify .` usage | Replace with `graphify update .` — the `.` subcommand does not exist. |
-| graphify-out empty / 0 nodes | Re-run `bash scripts/harness-graphify-bootstrap.sh --force` from project root. |
+| graphify-out empty / 0 nodes | Re-run `npm run harness:graphify-bootstrap -- --force` from project root. |
 | graphify hook install fails | Hooks need `.git/` directory. Verify inside git repo. Manual: `git config core.hooksPath .pi/git-hooks` |
 | firecrawl auth failed | Show manual login instructions. Continue with other tools. |
 | gh not installed | Show GitHub CLI install link. Skip label creation. |

package/.pi/scripts/README.md

@@ -0,0 +1,17 @@
+# Harness CLI scripts
+
+These scripts ship inside the `ultimate-pi` npm package under `.pi/scripts/`.
+
+Pi's package manifest (`package.json` → `pi`) only loads **extensions**, **skills**, **prompts**, and **themes** — there is no `scripts` field. Harness scripts are invoked via:
+
+- `npm run harness:*` (see root `package.json`)
+- Extensions resolving paths with `resolveHarnessScript()` in `.pi/extensions/lib/harness-paths.ts`
+
+| Script | npm script |
+|--------|------------|
+| `harness-graphify-bootstrap.sh` | `harness:graphify-bootstrap` |
+| `harness-cli-verify.sh` | `harness:cli-verify` |
+| `harness-verify.mjs` | `harness:verify` |
+| `sentrux-rules-sync.mjs` | `harness:sentrux-sync` |
+
+Repo-root `scripts/` (e.g. `regen_graphify_html.py`) is dev-only and excluded from the npm tarball via `.npmignore`.

package/{scripts → .pi/scripts}/harness-verify.mjs

@@ -9,7 +9,7 @@ import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { spawn } from "node:child_process";
 
-const ROOT = join(dirname(fileURLToPath(import.meta.url)), "..");
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), "..", "..");
 const SPECS = join(ROOT, ".pi", "harness", "specs");
 const SMOKE = join(ROOT, ".pi", "harness", "evals", "smoke");
 const ADRS = join(ROOT, ".pi", "harness", "docs", "adrs");
@@ -117,7 +117,7 @@ async function checkSentruxRules() {
 	}
 	ok("sentrux architecture.manifest.json");
 
-	const syncScript = join(ROOT, "scripts", "sentrux-rules-sync.mjs");
+	const syncScript = join(ROOT, ".pi", "scripts", "sentrux-rules-sync.mjs");
 	const { code: checkCode, out: checkOut } = await runNodeScript(syncScript, [
 		"--check",
 	]);
@@ -148,7 +148,7 @@ async function checkSentruxGate() {
 	ok("Sentrux stub present");
 
 	const { code, out } = await runNodeScript(
-		join(ROOT, "scripts", "sentrux-rules-sync.mjs"),
+		join(ROOT, ".pi", "scripts", "sentrux-rules-sync.mjs"),
 		["--force", "--strict"],
 	);
 	if (code === 127 || (out && out.includes("not installed"))) {

package/{scripts → .pi/scripts}/sentrux-rules-sync.mjs

@@ -3,7 +3,7 @@
  * Sync .sentrux/rules.toml from .pi/harness/sentrux/architecture.manifest.json.
  * Preserves user content outside the harness managed block.
  *
- * Usage: node scripts/sentrux-rules-sync.mjs [--check] [--force]
+ * Usage: node .pi/scripts/sentrux-rules-sync.mjs [--check] [--force]
  */
 
 import { readFile, writeFile, mkdir, access } from "node:fs/promises";
@@ -13,7 +13,7 @@ import { fileURLToPath } from "node:url";
 import { createHash } from "node:crypto";
 import { spawn } from "node:child_process";
 
-const ROOT = join(dirname(fileURLToPath(import.meta.url)), "..");
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), "..", "..");
 const MANIFEST = join(
 	ROOT,
 	".pi",

package/.pi/{settings.json → settings.example.json}

@@ -4,7 +4,7 @@
 		"maxRetries": 3
 	},
 	"packages": [
-		"..",
+		"npm:ultimate-pi",
 		"npm:@posthog/pi",
 		"npm:context-mode",
 		"npm:@tintinweb/pi-subagents",

package/.sentrux/.harness-rules-meta.json

@@ -1,5 +1,5 @@
 {
-  "manifest_hash": "f386fef6c6281e47",
-  "synced_at": "2026-05-15T11:30:59.026Z",
+  "manifest_hash": "9a3ee466588190f3",
+  "synced_at": "2026-05-15T14:49:38.156Z",
   "manifest_path": ".pi/harness/sentrux/architecture.manifest.json"
 }

package/.sentrux/rules.toml

@@ -41,9 +41,9 @@ order = 3
 
 [[layers]]
 name = "tooling"
-paths = ["scripts/*", "test/*"]
+paths = [".pi/scripts/*", "test/*"]
 order = 4
-# Deterministic scripts and tests
+# Harness CLI scripts and tests
 
 [[boundaries]]
 from = ".agents/skills/*"
@@ -66,7 +66,7 @@ to = ".pi/extensions/*"
 reason = "Contracts are data-only JSON schemas; extensions implement behavior"
 
 [[boundaries]]
-from = "scripts/*"
+from = ".pi/scripts/*"
 to = ".agents/skills/*"
 reason = "CLI scripts stay independent of skill markdown"
 

package/CHANGELOG.md

@@ -2,6 +2,23 @@
 
 All notable changes to this project are documented in this file.
 
+## [v0.2.6] — 2026-05-15
+
+### 🔧 Chores
+
+- Align npm publish with pi package docs: explicit `files` allowlist (no dev runs, secrets, or local router config)
+- Fix `pi` manifest: drop missing `.pi/providers`, add `.pi/skills`
+- Ship `.pi/settings.example.json` instead of dev `.pi/settings.json` (removes `".."` local package from installs)
+- Document layout in `.pi/PACKAGING.md`; harness-setup seeds `.pi/agents` and resolves package root for npm installs
+
+## [v0.2.5] — 2026-05-15
+
+### 🔧 Chores
+
+- Move harness CLI scripts to `.pi/scripts/` (aligned with pi package layout; no `pi.scripts` manifest field)
+- Point `npm run harness:*` and sentrux manifest at `.pi/scripts/`
+- Exclude repo-root `scripts/` from npm publish (dev-only graphify helpers stay in checkout)
+
 ## [v0.2.4] — 2026-05-15
 
 ### 🐛 Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "ultimate-pi",
-	"version": "0.2.4",
+	"version": "0.2.6",
 	"description": "Ultimate AI coding harness for pi.dev — extensible skills, Obsidian wiki knowledge layer, compressed context, deterministic output",
 	"keywords": [
 		"pi-package",
@@ -24,22 +24,61 @@
 	},
 	"pi": {
 		"extensions": [
-			"./.pi/extensions",
-			"./.pi/providers"
+			"./.pi/extensions"
 		],
 		"skills": [
-			"./.agents/skills"
+			"./.agents/skills",
+			"./.pi/skills"
 		],
 		"prompts": [
 			"./.pi/prompts"
 		]
 	},
+	"files": [
+		".agents",
+		".sentrux",
+		".pi/extensions",
+		".pi/prompts",
+		"!.pi/prompts/release.md",
+		".pi/skills",
+		".pi/agents",
+		".pi/scripts",
+		".pi/lib",
+		".pi/sounds",
+		".pi/harness/specs",
+		".pi/harness/docs",
+		".pi/harness/sentrux",
+		".pi/harness/evals",
+		".pi/harness/evolution",
+		".pi/harness/corpus",
+		".pi/harness/README.md",
+		".pi/npm/package.json",
+		".pi/npm/.gitignore",
+		".pi/model-router.example.json",
+		".pi/settings.example.json",
+		".pi/auto-commit.json",
+		".pi/mcp.json",
+		".pi/pi-vcc-config.json",
+		".pi/SYSTEM.md",
+		".pi/PACKAGING.md",
+		"firecrawl/docker-compose.yaml",
+		"firecrawl/.env.template",
+		"firecrawl/README.md",
+		"firecrawl/searxng",
+		"AGENTS.md",
+		"biome.json",
+		"CHANGELOG.md",
+		"README.md"
+	],
+	"peerDependencies": {
+		"@mariozechner/pi-coding-agent": "*"
+	},
 	"scripts": {
 		"check:ts": "tsc --noEmit --target ES2022 --moduleResolution nodenext --module nodenext --skipLibCheck .pi/extensions/dotenv-loader.ts .pi/extensions/lib/posthog-node.d.ts .pi/extensions/lib/harness-posthog.ts .pi/extensions/lib/harness-paths.ts .pi/extensions/model-router-bootstrap.ts .pi/extensions/harness-telemetry.ts .pi/extensions/trace-recorder.ts .pi/extensions/observation-bus.ts .pi/extensions/drift-monitor.ts .pi/extensions/sentrux-rules-sync.ts .pi/extensions/custom-header.ts",
-		"harness:graphify-bootstrap": "bash scripts/harness-graphify-bootstrap.sh",
-		"harness:cli-verify": "bash scripts/harness-cli-verify.sh",
-		"harness:verify": "node scripts/harness-verify.mjs",
-		"harness:sentrux-sync": "node scripts/sentrux-rules-sync.mjs --force",
+		"harness:graphify-bootstrap": "bash .pi/scripts/harness-graphify-bootstrap.sh",
+		"harness:cli-verify": "bash .pi/scripts/harness-cli-verify.sh",
+		"harness:verify": "node .pi/scripts/harness-verify.mjs",
+		"harness:sentrux-sync": "node .pi/scripts/sentrux-rules-sync.mjs --force",
 		"harness:meta-optimizer": "node .pi/harness/evolution/meta-optimizer.mjs",
 		"lint": "biome check",
 		"lint:fix": "biome check --fix",

package/.ckignore

@@ -1,41 +0,0 @@
-# .ckignore
-
-# Build artifacts (not useful for understanding code)
-target/
-dist/
-build/
-*.o
-*.so
-*.dylib
-
-# Dependencies (too large, low signal)
-node_modules/
-vendor/
-venv/
-.venv/
-
-# Media files (not code)
-*.png
-*.jpg
-*.gif
-*.mp4
-*.pdf
-
-<!-- # Large data files
-*.csv
-*.json
-*.xml
-*.log -->
-
-# Test fixtures (unless you search them)
-fixtures/
-__snapshots__/
-*.snap
-
-<!-- # Generated code (if not relevant)
-*_pb2.py
-*.generated.*
-
-# Documentation (include if you want AI to reference docs)
-# docs/
-# *.md -->

package/.codex/hooks.json

@@ -1,15 +0,0 @@
-{
-  "hooks": {
-    "PreToolUse": [
-      {
-        "matcher": "Bash",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "/home/aryaniyaps/.local/bin/graphify hook-check"
-          }
-        ]
-      }
-    ]
-  }
-}

package/.env.example

@@ -1,21 +0,0 @@
-POSTHOG_PERSONAL_API_KEY="phx_your_personal_api_key"
-POSTHOG_API_KEY="phc_your_project_key"
-# narrow the tool surface
-POSTHOG_MCP_FEATURES="llm_analytics"
-POSTHOG_PROJECT_NAME="ultimate-pi"
-POSTHOG_PRIVACY_MODE="false"
-# Harness domain events (harness-telemetry.ts); set false to disable harness_* only
-HARNESS_TELEMETRY_ENABLED="true"
-# Optional: require Sentrux stub for npm run harness:verify
-# HARNESS_SENTRUX_REQUIRED="true"
-FIRECRAWL_API_KEY="fc_your_firecrawl_api_key"
-FIRECRAWL_API_URL="http://localhost:3002"
-# FIRECRAWL_NO_TELEMETRY=0
-VAULT_WIKI_PATH="vault/wiki"
-CURSOR_API_KEY=""
-PI_VCC_CONFIG_PATH=".pi/pi-vcc-config.json"
-# VCC config: points to project-level pi-vcc config (overrideDefaultCompaction, debug)
-
-# graphify headless extract
-OPENAI_API_KEY="sk-your_openai_api_key"
-OPENAI_API_BASE="https://opencode.ai/zen/go/v1"

package/.gitattributes

@@ -1 +0,0 @@
-data/books/**/*.pdf filter=lfs diff=lfs merge=lfs -text

package/.github/workflows/lint.yml

@@ -1,33 +0,0 @@
-name: Lint and Format
-
-on:
-  push:
-    branches:
-      - main
-      - master
-  pull_request:
-    branches:
-      - main
-      - master
-
-jobs:
-  lint:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: "npm"
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Run Biome check (Lint & Format)
-        run: npm run lint
-
-      - name: Run TypeScript check
-        run: npm run check:ts