Retire the CLI, reduce the tool menu to eight entries, and fix four provider bugs

.agents/skills/release/SKILL.md

@@ -1,12 +1,17 @@
 ---
 name: release
-description: Prepare and publish @onkernel/cua-ai, @onkernel/cua-agent, and @onkernel/cua-cli npm releases from kernel/cua. Use when checking release readiness, choosing package versions, writing package changelogs, committing release metadata to main, pushing package-prefixed tags, or monitoring release workflows.
+description: Prepare and publish @onkernel/cua-ai, @onkernel/cua-agent, and @onkernel/cua-pi-extension npm releases from kernel/cua. Use when checking release readiness, choosing package versions, writing package changelogs, committing release metadata to main, pushing package-prefixed tags, or monitoring release workflows.
 ---
 
 # Release
 
 Use this workflow to release `@onkernel/cua-ai`, `@onkernel/cua-agent`, and
-`@onkernel/cua-cli`. The packages do not need to release in lockstep.
+`@onkernel/cua-pi-extension`. The packages do not need to release in lockstep.
+
+`@onkernel/cua-pi-extension` has no release workflow yet, and that is
+deliberate: it merges into the renamed single package, and a first publish under
+a new name is manual regardless, because npm binds a trusted publisher to a
+(repository, workflow filename) pair and a brand-new package name has none.
 
 If a release run hits an unexpected bump, unclear decision, missing command, or
 avoidable manual step, update this skill as part of the release cleanup. Keep
@@ -19,11 +24,9 @@ error-prone.
 | --- | --- | --- | --- |
 | `@onkernel/cua-ai` | `packages/ai` | `cua-ai/v` | `release-cua-ai.yml` |
 | `@onkernel/cua-agent` | `packages/agent` | `cua-agent/v` | `release-cua-agent.yml` |
-| `@onkernel/cua-cli` | `packages/cli` | `cua-cli/v` | `release-cua-cli.yml` |
+| `@onkernel/cua-pi-extension` | `packages/pi-extension` | — | none yet (manual) |
 
-When all three change, release in dependency order: `cua-ai`, then `cua-agent`,
-then `cua-cli`. The CLI production workflow verifies that its exact AI and agent
-dependency versions already exist on npm.
+When both change, release in dependency order: `cua-ai`, then `cua-agent`.
 
 ## Quick Start
 
@@ -41,18 +44,15 @@ git fetch --tags origin
 git status --short
 npm view @onkernel/cua-ai versions --json
 npm view @onkernel/cua-agent versions --json
-npm view @onkernel/cua-cli versions --json
 test -f .github/workflows/release-cua-ai.yml
 test -f .github/workflows/release-cua-agent.yml
-test -f .github/workflows/release-cua-cli.yml
 ```
 
 3. For each package, find the previous release tag:
 
 ```bash
 git tag --list "cua-ai/v*" --sort=-v:refname | head -1
 git tag --list "cua-agent/v*" --sort=-v:refname | head -1
-git tag --list "cua-cli/v*" --sort=-v:refname | head -1
 ```
 
 If no tag exists, treat the next release as the package's current
@@ -66,9 +66,6 @@ git diff --name-status <last-tag>..HEAD -- packages/ai package.json package-lock
 
 git log --oneline <last-tag>..HEAD -- packages/agent packages/ai package.json package-lock.json tsconfig.base.json
 git diff --name-status <last-tag>..HEAD -- packages/agent packages/ai package.json package-lock.json tsconfig.base.json
-
-git log --oneline <last-tag>..HEAD -- packages/cli packages/agent packages/ai package.json package-lock.json tsconfig.base.json
-git diff --name-status <last-tag>..HEAD -- packages/cli packages/agent packages/ai package.json package-lock.json tsconfig.base.json
 ```
 
 For a dependent package, include upstream package changes only when they affect
@@ -98,7 +95,7 @@ has at most one unreleased section:
 
 - `packages/ai/CHANGELOG.md`
 - `packages/agent/CHANGELOG.md`
-- `packages/cli/CHANGELOG.md`
+- `packages/pi-extension/CHANGELOG.md`
 
 Releasing renames that heading in place — do not add a second top entry:
 
@@ -132,12 +129,11 @@ Set versions explicitly:
 ```bash
 npm pkg set version=<version> --workspace @onkernel/cua-ai
 npm pkg set version=<version> --workspace @onkernel/cua-agent
-npm pkg set version=<version> --workspace @onkernel/cua-cli
 ```
 
 Ensure exact internal dependencies point at the versions that will be published
-first: agent to AI, and CLI to both AI and agent. Edit the package manifests
-directly if `npm pkg set` is awkward for scoped dependency keys.
+first: agent to AI. Edit the package manifests directly if `npm pkg set` is
+awkward for scoped dependency keys.
 
 Refresh the lockfile:
 
@@ -165,17 +161,6 @@ npm test --workspace @onkernel/cua-agent
 npm pack --workspace @onkernel/cua-agent --dry-run
 ```
 
-For `@onkernel/cua-cli`:
-
-```bash
-npm run build --workspace @onkernel/cua-ai
-npm run build --workspace @onkernel/cua-agent
-npm run build --workspace @onkernel/ptywright
-npm run build --workspace @onkernel/cua-cli
-PTYWRIGHT_REQUIRED=1 npm test --workspace @onkernel/cua-cli
-npm pack --workspace @onkernel/cua-cli --dry-run
-```
-
 Run the full unit suites — do not pass individual test files. `cua-ai`
 excludes integration/live tests by default (`npm run test:integration
 --workspace @onkernel/cua-ai` runs them separately), and the `cua-agent` live
@@ -190,7 +175,7 @@ limited to package versions, changelogs, and `package-lock.json`.
 
 ```bash
 git status --short
-git add package-lock.json packages/ai/package.json packages/ai/CHANGELOG.md packages/agent/package.json packages/agent/CHANGELOG.md packages/cli/package.json packages/cli/CHANGELOG.md
+git add package-lock.json packages/ai/package.json packages/ai/CHANGELOG.md packages/agent/package.json packages/agent/CHANGELOG.md
 git commit -m "Release CUA packages"
 git push origin main
 ```
@@ -213,13 +198,9 @@ For the agent package:
 ```bash
 git tag -a cua-agent/v<version> -m "@onkernel/cua-agent v<version>"
 git push origin cua-agent/v<version>
-
-git tag -a cua-cli/v<version> -m "@onkernel/cua-cli v<version>"
-git push origin cua-cli/v<version>
 ```
 
-Push and verify each dependency tag before the next one: AI, then agent, then
-CLI.
+Push and verify the AI tag before the agent tag.
 
 ## Monitor
 
@@ -231,9 +212,6 @@ gh run watch <run-id> --exit-status
 
 gh run list --workflow release-cua-agent.yml --json databaseId,status,conclusion,headBranch,displayTitle,url --limit 10
 gh run watch <run-id> --exit-status
-
-gh run list --workflow release-cua-cli.yml --json databaseId,status,conclusion,headBranch,displayTitle,url --limit 10
-gh run watch <run-id> --exit-status
 ```
 
 After a workflow succeeds, verify npm:
@@ -243,8 +221,6 @@ npm view @onkernel/cua-ai@<version> version
 npm dist-tag ls @onkernel/cua-ai
 npm view @onkernel/cua-agent@<version> version
 npm dist-tag ls @onkernel/cua-agent
-npm view @onkernel/cua-cli@<version> version
-npm dist-tag ls @onkernel/cua-cli
 ```
 
 Then verify the published artifact actually imports — `npm view` only proves
@@ -258,8 +234,7 @@ node --input-type=module -e "import('@onkernel/cua-ai').then((m) => { if (typeof
 ```
 
 For `@onkernel/cua-agent`, install `@onkernel/cua-agent@<version>` the same
-way and check `typeof m.attach === "function"`. For the CLI, install it in a
-fresh directory and verify `./node_modules/.bin/cua --help` prints `Usage:`.
+way and check `typeof m.attach === "function"`.
 
 If a workflow fails after a tag is pushed, do not reuse the same package
 version unless npm did not publish it. Fix forward with a new commit and a new

.agents/skills/update-docs/SKILL.md

@@ -41,10 +41,10 @@ For every doc update:
 Start with these source-of-truth checks:
 
 - Package topology: `package.json`, `tsconfig.json`, and `packages/*/package.json`.
-- Design invariants: `@onkernel/cua-ai` owns provider-specific policy (catalog, tool schemas, payload transforms); `@onkernel/cua-agent` is provider-neutral runtime glue around `pi-agent-core` (no provider names in `packages/agent/src`); provider differences reach the agent as compiled `CuaToolCatalog` data; `@onkernel/cua-cli` composes both for orchestration.
+- Design invariants: `@onkernel/cua-ai` owns provider-specific policy (catalog, tool schemas, payload transforms); `@onkernel/cua-agent` is provider-neutral runtime glue around `pi-agent-core` (no provider names in `packages/agent/src`); provider differences reach the agent as compiled `CuaToolCatalog` data; `@onkernel/cua-pi-extension` composes both inside a pi session.
 - Model layer: `packages/ai/src/index.ts`, `cua.ts`, `tool-catalog.ts`, `getCuaModel`/`listCuaModels`/`parseCuaModelRef`, provider adapters, and `api-keys.ts`.
-- Execution layer: `packages/agent/src/index.ts`, `CuaAgent` and `CuaAgentHarness` wiring, and the canonical CUA tool executors against `@onkernel/sdk`.
-- CLI runtime flow: `packages/cli/src/cli.ts`, `cli-harness.ts`, `harness.ts`, `harness-browser.ts`, `harness-models.ts`, `harness-sessions.ts`, `harness-named-sessions.ts`, `harness-skills.ts`, `print.ts`, `output/harness-jsonl.ts`, `action/`, and `tui/`.
+- Execution layer: `packages/agent/src/index.ts`, `attach.ts`, `tool-manager.ts`, `resources.ts`, and the canonical CUA tool executors against `@onkernel/sdk`.
+- Extension runtime flow: `packages/pi-extension/src/index.ts`, `selection.ts`, `browser-runtime.ts`, `state.ts`, and `render.ts`.
 - TUI test infrastructure: `packages/ptywright/package.json`, `src/index.ts`, `src/session.ts`, `src/terminal.ts`, and `README.md`.
 - External drift: provider computer-use docs, `@earendil-works/pi-*` versions, and `@onkernel/sdk` versions in package manifests.
 
@@ -53,7 +53,7 @@ Questions `architecture.md` should answer after each update:
 - What owns the canonical action vocabulary and the model catalog?
 - Where is the cua-ai vs cua-agent ownership boundary, and how do provider differences reach the agent without provider conditionals in `packages/agent/src`?
 - Where does Kernel SDK browser execution happen?
-- What does the CLI compose at runtime via `buildCuaHarness`?
+- What does the pi extension compose at runtime, and which selectors does it offer?
 - Which package is dev/test infrastructure only?
 
 ## Validation

.github/workflows/ci.yml

@@ -62,7 +62,7 @@ jobs:
       - name: Pi extension unit tests
         run: npm test --workspace @onkernel/cua-pi-extension
 
-  cli-unit:
+  typecheck-and-ptywright:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     env:
@@ -99,36 +99,14 @@ jobs:
           key: ptywright-${{ runner.os }}-${{ hashFiles('packages/ptywright/GHOSTTY_UPSTREAM', 'packages/ptywright/native/**', 'packages/ptywright/scripts/**') }}
       - run: npm run build --workspace @onkernel/cua-ai
       - run: npm run build --workspace @onkernel/cua-agent
+      # The only job that typechecks the whole project graph rather than one
+      # package, and the only one that builds and tests ptywright.
       - name: Typecheck workspace
         run: npx tsc -b
       - name: Build ptywright (native binding)
         run: npm run build --workspace @onkernel/ptywright
       - name: Ptywright tests
         run: npm test --workspace @onkernel/ptywright
-      - name: CLI unit tests
-        env:
-          PTYWRIGHT_REQUIRED: "1"
-        run: npm test --workspace @onkernel/cua-cli
-      - name: Build cua-cli
-        run: npm run build --workspace @onkernel/cua-cli
-      - name: Pack tarballs
-        # Pack the workspace dependencies too so the smoke install resolves
-        # them from the tarballs instead of the registry, where the versions
-        # under development are not published yet.
-        run: |
-          npm pack --workspace @onkernel/cua-ai --pack-destination "$RUNNER_TEMP"
-          npm pack --workspace @onkernel/cua-agent --pack-destination "$RUNNER_TEMP"
-          npm pack --workspace @onkernel/cua-cli --pack-destination "$RUNNER_TEMP"
-      - name: CLI bin smoke test
-        run: |
-          SMOKE_DIR=$(mktemp -d)
-          cd "$SMOKE_DIR"
-          npm init -y > /dev/null
-          npm install "$RUNNER_TEMP"/onkernel-cua-ai-*.tgz "$RUNNER_TEMP"/onkernel-cua-agent-*.tgz "$RUNNER_TEMP"/onkernel-cua-cli-*.tgz
-          OUTPUT=$(./node_modules/.bin/cua --help)
-          echo "$OUTPUT"
-          echo "$OUTPUT" | grep -q "Usage:"
-          echo "$OUTPUT" | grep -q "cua \[options\] \[prompt\.\.\.\]"
 
   integration:
     runs-on: ubuntu-latest