ultimate-pi 0.3.1 → 0.4.0

package/.pi/scripts/README.md

@@ -23,7 +23,12 @@ From **Typescript extensions**, use `resolveHarnessScript()` / `getHarnessPackag
 | Graphify bootstrap | `bash "$UP_PKG/.pi/scripts/harness-graphify-bootstrap.sh"` |
 | CLI tool install + smoke tests | `bash "$UP_PKG/.pi/scripts/harness-cli-verify.sh"` |
 | Deterministic harness checks | `node "$UP_PKG/.pi/scripts/harness-verify.mjs"` |
-| Sentrux rules from manifest | `node "$UP_PKG/.pi/scripts/sentrux-rules-sync.mjs" --force` |
+| Sentrux rules bootstrap (harness-setup) | `node "$UP_PKG/.pi/scripts/harness-sentrux-bootstrap.mjs"` |
+| Sentrux rules re-sync after manifest edit | `node "$UP_PKG/.pi/scripts/harness-sentrux-bootstrap.mjs" --force` or `/harness-sentrux-sync` |
+| Sentrux rules drift check (CI) | `node "$UP_PKG/.pi/scripts/sentrux-rules-sync.mjs" --check` |
+| Resolve package root (`UP_PKG`) | `node "$UP_PKG/.pi/scripts/harness-resolve-up-pkg.mjs"` |
+| Model-router config (Pi auth) | `node "$UP_PKG/.pi/scripts/harness-generate-model-router.mjs"` |
+| Project `.env` (append-only) | `node "$UP_PKG/.pi/scripts/harness-sync-env.mjs"` (`--create-missing` after user confirms) |
 | Model-router / Pi defaults | `harness-sync-model-router.mjs` (Step 3.5 of `/harness-setup`) |
 | Vendor router sync (this repo only) | `bash .pi/scripts/vendor-sync-pi-model-router.sh` or `npm run vendor:sync-router` |
 | Meta-optimizer (JSONL proposals) | `node "$UP_PKG/.pi/harness/evolution/meta-optimizer.mjs"` |

package/.pi/scripts/harness-agents-manifest.mjs

@@ -0,0 +1,123 @@
+#!/usr/bin/env node
+/**
+ * Regenerate or verify .pi/harness/agents.manifest.json from package agents.
+ *
+ * Usage:
+ *   node .pi/scripts/harness-agents-manifest.mjs --write
+ *   node .pi/scripts/harness-agents-manifest.mjs --check
+ */
+
+import { readFile, writeFile } from "node:fs/promises";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import {
+	isSafeAgentId,
+	sha256Content,
+	walkAgentsDir,
+} from "../../test/harness-subagents-loader.core.mjs";
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), "..", "..");
+const MANIFEST_PATH = join(ROOT, ".pi", "harness", "agents.manifest.json");
+const PACKAGE_AGENTS = join(ROOT, ".pi", "agents");
+
+async function readPackageMeta() {
+	const pkg = JSON.parse(
+		await readFile(join(ROOT, "package.json"), "utf-8"),
+	);
+	return { name: pkg.name ?? "ultimate-pi", version: pkg.version ?? "0.0.0" };
+}
+
+function buildManifest(packageFiles, packageName, packageVersion) {
+	const agents = {};
+	for (const f of packageFiles.values()) {
+		agents[f.id] = {
+			path: `.pi/agents/${f.id}.md`,
+			sha256: sha256Content(f.content),
+		};
+	}
+	return {
+		schema_version: "1.0.0",
+		package: packageName,
+		package_version: packageVersion,
+		generated_at: new Date().toISOString(),
+		agents,
+	};
+}
+
+function getDriftReport(manifest, packageFiles) {
+	const items = [];
+	if (!manifest) {
+		return { ok: false, items: [{ id: "*", kind: "missing_on_disk" }] };
+	}
+	for (const [id, file] of packageFiles) {
+		const expected = manifest.agents[id];
+		const actual = sha256Content(file.content);
+		if (!expected) {
+			items.push({ id, kind: "missing_in_manifest" });
+			continue;
+		}
+		if (expected.sha256 !== actual) {
+			items.push({ id, kind: "hash_mismatch", expected: expected.sha256, actual });
+		}
+	}
+	for (const id of Object.keys(manifest.agents)) {
+		if (!packageFiles.has(id)) {
+			items.push({ id, kind: "missing_on_disk" });
+		}
+	}
+	return { ok: items.length === 0, items };
+}
+
+async function loadPackageFiles() {
+	const files = new Map();
+	walkAgentsDir(PACKAGE_AGENTS, "package", files);
+	for (const id of files.keys()) {
+		if (!isSafeAgentId(id)) files.delete(id);
+	}
+	return files;
+}
+
+async function main() {
+	const mode = process.argv.includes("--check") ? "check" : "write";
+	const { name, version } = await readPackageMeta();
+	const packageFiles = await loadPackageFiles();
+	const built = buildManifest(packageFiles, name, version);
+
+	if (mode === "write") {
+		await writeFile(MANIFEST_PATH, `${JSON.stringify(built, null, 2)}\n`, "utf-8");
+		console.log(
+			`Wrote ${MANIFEST_PATH} (${Object.keys(built.agents).length} agents)`,
+		);
+		return;
+	}
+
+	let onDisk;
+	try {
+		onDisk = JSON.parse(await readFile(MANIFEST_PATH, "utf-8"));
+	} catch {
+		console.error("agents.manifest.json missing — run with --write");
+		process.exit(1);
+	}
+
+	const drift = getDriftReport(onDisk, packageFiles);
+	if (!drift.ok) {
+		for (const item of drift.items) {
+			console.error(`drift: ${item.id} (${item.kind})`);
+		}
+		process.exit(1);
+	}
+
+	if (onDisk.package_version !== version) {
+		console.error(
+			`package_version mismatch: manifest=${onDisk.package_version} package=${version}`,
+		);
+		process.exit(1);
+	}
+
+	console.log(`agents.manifest.json OK (${Object.keys(built.agents).length} agents)`);
+}
+
+main().catch((err) => {
+	console.error(err);
+	process.exit(1);
+});

package/.pi/scripts/harness-cli-verify.sh

@@ -153,13 +153,62 @@ verify_agent_browser() {
 	fi
 }
 
-verify_firecrawl() {
-	log "[firecrawl-cli]"
-	npm_global_install "firecrawl-cli@latest" "firecrawl" || { fail "firecrawl-cli npm install"; return; }
-	if firecrawl --status &>/dev/null; then
-		pass "firecrawl $(firecrawl --status 2>/dev/null | head -1 || echo ok)"
+scrapling_installed() {
+	command -v scrapling &>/dev/null && return 0
+	command -v uv &>/dev/null && uv tool list 2>/dev/null | grep -qE '(^|[[:space:]])scrapling([[:space:]]|$)' && return 0
+	return 1
+}
+
+install_scrapling() {
+	if command -v uv &>/dev/null; then
+		log "  installing scrapling via uv tool..."
+		uv tool install "scrapling[fetchers]" || return 1
+	elif command -v pip3 &>/dev/null; then
+		log "  installing scrapling via pip3 --user..."
+		pip3 install --user "scrapling[fetchers]" || return 1
+	elif command -v pip &>/dev/null; then
+		pip install --user "scrapling[fetchers]" || return 1
+	else
+		fail "need uv or pip to install scrapling"
+		return 1
+	fi
+	export PATH="${HOME}/.local/bin:${PATH}"
+	return 0
+}
+
+verify_scrapling() {
+	log "[scrapling / harness-web]"
+	ensure_linux_browser_deps 2>/dev/null || true
+	if [ "$FORCE" = true ] || ! scrapling_installed; then
+		install_scrapling || { fail 'scrapling install (run: uv tool install "scrapling[fetchers]")'; return; }
+	fi
+	if ! scrapling_installed; then
+		fail "scrapling not on PATH after install"
+		return
+	fi
+	if ! scrapling --help &>/dev/null; then
+		fail "scrapling --help failed"
+		return
+	fi
+	pass "scrapling CLI"
+	if [ "$FORCE" = true ]; then
+		scrapling install 2>/dev/null || warn "scrapling install (browsers) failed — use harness-web scrape --fast for smoke"
+	fi
+	_hw="${ROOT}/.pi/scripts/harness-web.py"
+	if [ ! -f "$_hw" ]; then
+		warn "harness-web.py missing in package"
+		return
+	fi
+	mkdir -p .web
+	if python3 "$_hw" search "ultimate-pi harness" -o .web/verify-search.json --limit 2 2>/dev/null | grep -q wrote; then
+		pass "harness-web search smoke"
+	else
+		fail "harness-web search smoke failed"
+	fi
+	if python3 "$_hw" scrape "https://example.com" -o .web/verify-page.md --fast 2>/dev/null | grep -q wrote; then
+		pass "harness-web scrape --fast smoke"
 	else
-		fail "firecrawl --status failed (run: firecrawl login)"
+		warn "harness-web scrape smoke failed (stealth needs: scrapling install + OS browser libs)"
 	fi
 }
 
@@ -259,10 +308,10 @@ verify_sentrux() {
 		return
 	fi
 	sentrux plugin add-standard 2>/dev/null || warn "sentrux plugin add-standard skipped"
-	_sync_script="$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd)/sentrux-rules-sync.mjs"
-	if [ -f "$_sync_script" ]; then
-		node "$_sync_script" --force 2>/dev/null ||
-			warn "sentrux rules sync failed (see .pi/scripts/README.md)"
+	_bootstrap="$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd)/harness-sentrux-bootstrap.mjs"
+	if [ -f "$_bootstrap" ]; then
+		node "$_bootstrap" --force 2>/dev/null ||
+			warn "sentrux rules bootstrap failed (see harness-sentrux-setup skill)"
 	fi
 	if sentrux check . &>/dev/null; then
 		pass "sentrux $(sentrux --version 2>/dev/null | head -1)"
@@ -274,7 +323,7 @@ verify_sentrux() {
 log "Harness CLI verification (cwd: $ROOT)"
 log ""
 
-verify_firecrawl
+verify_scrapling
 verify_ctx7
 verify_agent_browser
 verify_ck

package/.pi/scripts/harness-generate-model-router.mjs

@@ -0,0 +1,242 @@
+#!/usr/bin/env node
+/**
+ * Generate `.pi/model-router.json` from Pi's authenticated providers (auth.json + env),
+ * not from raw env-var heuristics alone.
+ *
+ * Uses @mariozechner/pi-coding-agent ModelRegistry.getAvailable() — same source as /login.
+ *
+ * Usage: node harness-generate-model-router.mjs [--force] [--dry-run]
+ *   --force    overwrite existing .pi/model-router.json
+ *   --dry-run  print JSON to stdout, do not write
+ *
+ * Requires @mariozechner/pi-coding-agent (peer of ultimate-pi; bundled with pi).
+ */
+
+import { existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import { dirname, join } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+
+const SCRIPT_DIR = dirname(fileURLToPath(import.meta.url));
+const UP_PKG = join(SCRIPT_DIR, "..", "..");
+const OUT_PATH = join(process.cwd(), ".pi", "model-router.json");
+
+const PROVIDER_PRIORITY = [
+	"opencode-go",
+	"anthropic",
+	"openai",
+	"google",
+	"openrouter",
+	"groq",
+	"mistral",
+	"amazon",
+];
+
+/** Substring hints per tier (first match in available ids wins). */
+const TIER_HINTS = {
+	high: [
+		"deepseek-v4-pro",
+		"gpt-5.4-pro",
+		"claude-opus",
+		"sonnet-4",
+		"gemini-2.5-pro",
+		"pro",
+	],
+	medium: [
+		"qwen3.6-plus",
+		"kimi-k2.6",
+		"gpt-5.4",
+		"claude-sonnet",
+		"gemini-flash",
+		"plus",
+	],
+	low: [
+		"deepseek-v4-flash",
+		"gpt-5.4-nano",
+		"haiku",
+		"flash-lite",
+		"flash",
+		"mini",
+	],
+};
+
+function fail(msg) {
+	console.error(`harness-generate-model-router: ${msg}`);
+	process.exit(1);
+}
+
+async function loadPiCodingAgent() {
+	const agentRoots = [
+		join(UP_PKG, "node_modules", "@mariozechner", "pi-coding-agent"),
+		join(UP_PKG, ".pi", "npm", "node_modules", "@mariozechner", "pi-coding-agent"),
+	];
+	for (const root of agentRoots) {
+		const entry = join(root, "dist", "index.js");
+		if (existsSync(entry)) {
+			return import(pathToFileURL(entry).href);
+		}
+	}
+	for (const base of [UP_PKG, process.cwd()]) {
+		try {
+			const req = createRequire(join(base, "package.json"));
+			return req("@mariozechner/pi-coding-agent");
+		} catch {
+			/* try next */
+		}
+	}
+	fail(
+		"@mariozechner/pi-coding-agent not found (install pi or npm i in ultimate-pi). Peer: @mariozechner/pi-coding-agent",
+	);
+}
+
+function canonicalRef(provider, modelId) {
+	return `${provider}/${modelId}`;
+}
+
+function pickTierModel(models, tier) {
+	const hints = TIER_HINTS[tier];
+	const ids = models.map((m) => m.id);
+	for (const hint of hints) {
+		const match = models.find((m) => m.id.includes(hint));
+		if (match) return canonicalRef(match.provider, match.id);
+	}
+	if (models.length === 0) return null;
+	if (tier === "high") {
+		const reasoning = models.find((m) => m.reasoning);
+		if (reasoning) return canonicalRef(reasoning.provider, reasoning.id);
+	}
+	if (tier === "low") {
+		return canonicalRef(models[models.length - 1].provider, models[models.length - 1].id);
+	}
+	return canonicalRef(models[0].provider, models[0].id);
+}
+
+function choosePrimaryProvider(available) {
+	const byProvider = new Map();
+	for (const m of available) {
+		if (!byProvider.has(m.provider)) byProvider.set(m.provider, []);
+		byProvider.get(m.provider).push(m);
+	}
+	for (const p of PROVIDER_PRIORITY) {
+		if (byProvider.has(p)) return { provider: p, models: byProvider.get(p) };
+	}
+	const first = [...byProvider.keys()].sort()[0];
+	return { provider: first, models: byProvider.get(first) ?? [] };
+}
+
+function buildFallbacks(available, primaryProvider, highModel) {
+	const fallbacks = [];
+	for (const p of ["anthropic", "google", "openai"]) {
+		if (p === primaryProvider) continue;
+		const alt = available.filter((m) => m.provider === p);
+		if (alt.length === 0) continue;
+		const ref = pickTierModel(alt, "medium");
+		if (ref && ref !== highModel) fallbacks.push(ref);
+	}
+	return fallbacks.slice(0, 3);
+}
+
+async function main() {
+	const force = process.argv.includes("--force");
+	const dryRun = process.argv.includes("--dry-run");
+
+	if (existsSync(OUT_PATH) && !force) {
+		console.log(
+			"✓ .pi/model-router.json already exists — preserving (use --force to regenerate)",
+		);
+		process.exit(0);
+	}
+
+	const { AuthStorage, ModelRegistry } = await loadPiCodingAgent();
+	const authStorage = AuthStorage.create();
+	const modelRegistry = ModelRegistry.create(authStorage);
+	const available = await modelRegistry.getAvailable();
+
+	if (available.length === 0) {
+		console.log(
+			"✗ No authenticated Pi providers — skip model-router.json",
+		);
+		console.log(
+			"  Log in inside pi: /login (or set API keys in ~/.pi/agent/auth.json)",
+		);
+		const providers = authStorage.list();
+		if (providers.length > 0) {
+			console.log(
+				`  Stored providers in auth.json (may need refresh): ${providers.join(", ")}`,
+			);
+		}
+		process.exit(0);
+	}
+
+	const { provider: primaryProvider, models: primaryModels } =
+		choosePrimaryProvider(available);
+
+	const highModel = pickTierModel(primaryModels, "high");
+	const mediumModel = pickTierModel(primaryModels, "medium");
+	const lowModel = pickTierModel(primaryModels, "low");
+
+	if (!highModel || !mediumModel || !lowModel) {
+		fail("could not assign tier models from available registry");
+	}
+
+	const fallbacks = buildFallbacks(available, primaryProvider, highModel);
+
+	const config = {
+		defaultProfile: "auto",
+		debug: false,
+		classifierModel: mediumModel,
+		phaseBias: 0.5,
+		maxSessionBudget: 1.0,
+		largeContextThreshold: 100000,
+		rules: [
+			{
+				matches: ["deploy", "production", "release"],
+				tier: "high",
+				reason: "Safety check for production tasks",
+			},
+			{ matches: "changelog", tier: "low" },
+		],
+		profiles: {
+			auto: {
+				high: { model: highModel, thinking: "high", fallbacks },
+				medium: { model: mediumModel, thinking: "medium" },
+				low: { model: lowModel, thinking: "low" },
+			},
+			cheap: {
+				high: { model: mediumModel, thinking: "low" },
+				medium: { model: lowModel, thinking: "off" },
+				low: { model: lowModel, thinking: "off" },
+			},
+			deep: {
+				high: { model: highModel, thinking: "xhigh", fallbacks },
+				medium: { model: mediumModel, thinking: "medium" },
+				low: { model: lowModel, thinking: "low" },
+			},
+		},
+	};
+
+	const json = `${JSON.stringify(config, null, 2)}\n`;
+	const providerSet = [...new Set(available.map((m) => m.provider))].sort();
+
+	if (dryRun) {
+		process.stdout.write(json);
+		process.exit(0);
+	}
+
+	mkdirSync(dirname(OUT_PATH), { recursive: true });
+	writeFileSync(OUT_PATH, json, "utf8");
+
+	console.log("✓ Generated .pi/model-router.json from Pi authenticated providers:");
+	console.log(`  Primary provider: ${primaryProvider}`);
+	console.log(`  Authenticated providers: ${providerSet.join(", ")}`);
+	console.log(`  Available models: ${available.length}`);
+	console.log(`  High tier: ${highModel}`);
+	console.log(`  Medium tier: ${mediumModel}`);
+	console.log(`  Low tier: ${lowModel}`);
+	if (fallbacks.length) console.log(`  Fallbacks: ${fallbacks.join(", ")}`);
+}
+
+main().catch((err) => {
+	console.error(err);
+	process.exit(1);
+});

package/.pi/scripts/harness-graphify-bootstrap.sh

@@ -58,13 +58,8 @@ install_graphify() {
 }
 
 graphify_platform_install() {
+	# Pi harness only — no codex/cursor installs (codex writes .codex/hooks.json).
 	graphify install --platform pi 2>/dev/null || graphify pi install 2>/dev/null || true
-	if [ -d .cursor ]; then
-		graphify cursor install 2>/dev/null || true
-	fi
-	if [ -f AGENTS.md ] || [ -d .pi ]; then
-		graphify codex install 2>/dev/null || true
-	fi
 }
 
 graph_is_valid() {

package/.pi/scripts/harness-resolve-up-pkg.mjs

@@ -0,0 +1,71 @@
+#!/usr/bin/env node
+/**
+ * Print absolute path to the installed ultimate-pi package root (UP_PKG).
+ * Used by /harness-setup and shell scripts in external repos.
+ *
+ * Resolution order:
+ * 1. ULTIMATE_PI_PKG env override
+ * 2. require.resolve('ultimate-pi/package.json') from cwd
+ * 3. Global npm prefix: $(npm root -g)/ultimate-pi
+ * 4. Script location (this file ships inside the package)
+ *
+ * Exit 0 and prints path; exit 1 if not found.
+ */
+
+import { createRequire } from "node:module";
+import { existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { execSync } from "node:child_process";
+
+const requireFromCwd = createRequire(join(process.cwd(), "package.json"));
+
+const SCRIPT_UP_PKG = join(
+	dirname(fileURLToPath(import.meta.url)),
+	"..",
+	"..",
+);
+
+function hasHarnessScripts(root) {
+	return existsSync(join(root, ".pi", "scripts", "harness-cli-verify.sh"));
+}
+
+function tryResolveUltimatePi() {
+	if (process.env.ULTIMATE_PI_PKG) {
+		const envRoot = process.env.ULTIMATE_PI_PKG;
+		if (hasHarnessScripts(envRoot)) return envRoot;
+	}
+
+	try {
+		const pkg = requireFromCwd.resolve("ultimate-pi/package.json");
+		const root = dirname(pkg);
+		if (hasHarnessScripts(root)) return root;
+	} catch {
+		/* continue */
+	}
+
+	try {
+		const globalRoot = execSync("npm root -g", {
+			encoding: "utf8",
+			stdio: ["ignore", "pipe", "ignore"],
+		}).trim();
+		const globalPkg = join(globalRoot, "ultimate-pi");
+		if (hasHarnessScripts(globalPkg)) return globalPkg;
+	} catch {
+		/* continue */
+	}
+
+	if (hasHarnessScripts(SCRIPT_UP_PKG)) return SCRIPT_UP_PKG;
+
+	return null;
+}
+
+const root = tryResolveUltimatePi();
+if (!root) {
+	console.error(
+		"harness-resolve-up-pkg: ultimate-pi not found. Install: pi install npm:ultimate-pi (or npm i -g ultimate-pi)",
+	);
+	process.exit(1);
+}
+
+process.stdout.write(root);

package/.pi/scripts/harness-seed-project-contracts.mjs

@@ -11,16 +11,40 @@
  * (the script always lives under the shipped ultimate-pi package).
  */
 
-import { copyFile, mkdir, readdir } from "node:fs/promises";
+import { copyFile, mkdir, readdir, access } from "node:fs/promises";
+import { constants } from "node:fs";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 
 const SCRIPT_DIR = dirname(fileURLToPath(import.meta.url));
 const UP_PKG = join(SCRIPT_DIR, "..", "..");
 const SPEC_SRC = join(UP_PKG, ".pi", "harness", "specs");
+const SENTRUX_TEMPLATE = join(
+	UP_PKG,
+	".pi",
+	"harness",
+	"sentrux",
+	"architecture.manifest.json",
+);
 
 const projectRoot = process.argv[2] || process.cwd();
 const specDest = join(projectRoot, ".pi", "harness", "specs");
+const sentruxDest = join(
+	projectRoot,
+	".pi",
+	"harness",
+	"sentrux",
+	"architecture.manifest.json",
+);
+
+async function fileExists(path) {
+	try {
+		await access(path, constants.R_OK);
+		return true;
+	} catch {
+		return false;
+	}
+}
 
 async function main() {
 	const names = await readdir(SPEC_SRC);
@@ -41,6 +65,14 @@ async function main() {
 	console.log(
 		`harness-seed-project-contracts: copied ${toCopy.length} file(s) -> ${specDest}`,
 	);
+
+	if (!(await fileExists(sentruxDest)) && (await fileExists(SENTRUX_TEMPLATE))) {
+		await mkdir(dirname(sentruxDest), { recursive: true });
+		await copyFile(SENTRUX_TEMPLATE, sentruxDest);
+		console.log(
+			`harness-seed-project-contracts: seeded Sentrux manifest -> ${sentruxDest} (run harness-sentrux-bootstrap.mjs to sync rules.toml)`,
+		);
+	}
 }
 
 main().catch((err) => {