feat: add first-class Pi package support

Author: bx33661

CHANGELOG.md

@@ -2,6 +2,9 @@
 
 ## Unreleased
 
+## v1.1.0 - 2026-07-23
+
+- Added first-class Pi package support with native `pi.skills` discovery, documented `/skill:omv-*` invocation, and bilingual install guidance.
 - Fixed research workspace resolution so commands run from under `.omv/` (for example `.omv/checkouts/<pkg>`) reuse the owning project instead of creating a nested empty `.omv`. Supports `OMV_PROJECT_ROOT` / `OMV_ROOT` and global `--root <path>`.
 - Fixed `omv dashboard` / `omv campaign list` treating AttackSurfaceList sidecars (`*.surfaces.yaml`) as Campaign.v1 files, which produced hard validation errors after `surfaces propose`.
 - Confirmed evidence `file:line` checks now accept inclusive ranges (`path/file.go:12-18`) as well as column forms.

README.md

@@ -2,7 +2,7 @@
 
 # oh-my-vul
 
-**Evidence-first vulnerability research for Codex and Claude Code.**
+**Evidence-first vulnerability research for Pi, Codex, and Claude Code.**
 
 Plan the research, trace the evidence, reproduce locally, and turn confirmed findings into review-ready reports.
 
@@ -16,7 +16,7 @@ Plan the research, trace the evidence, reproduce locally, and turn confirmed fin
 
 ---
 
-`oh-my-vul` combines agent skills with a local CLI to make open-source vulnerability research repeatable in Codex and Claude Code:
+`oh-my-vul` combines agent skills with a local CLI to make open-source vulnerability research repeatable in Pi, Codex, and Claude Code:
 
 - **Start with a clear scope.** Campaigns and attack-surface cards turn a broad target into focused research questions.
 - **Keep claims tied to evidence.** Findings record the tested version, source, sink, guards, reproduction, and remaining unknowns.
@@ -26,7 +26,26 @@ Research state stays in a private `.omv/` workspace. The project is designed for
 
 ## Quick Start
 
-**Requirements:** [Codex](https://developers.openai.com/codex/) or [Claude Code](https://docs.anthropic.com/en/docs/claude-code), Node.js 22 or later, and Python 3 for bundled Skill helpers. The deterministic report renderer additionally uses its pinned PyYAML dependency. Windows, Linux, and macOS are supported; on Windows, use a modern Windows Terminal or PowerShell for the Ink workspace.
+**Requirements:** [Pi](https://pi.dev/), [Codex](https://developers.openai.com/codex/), or [Claude Code](https://docs.anthropic.com/en/docs/claude-code), Node.js 22 or later, and Python 3 for bundled Skill helpers. The deterministic report renderer additionally uses its pinned PyYAML dependency. Windows, Linux, and macOS are supported; on Windows, use a modern Windows Terminal or PowerShell for the Ink workspace.
+
+### Pi
+
+Install the package directly into Pi:
+
+```sh
+pi install npm:oh-my-vul
+```
+
+Pi discovers all 10 bundled Skills. Invoke the project manager with `/skill:omv`, or call a focused Skill such as `/skill:omv-find` or `/skill:omv-audit`. For the complete local `.omv/` workspace, deterministic validation, and Ink dashboard, install the matching CLI as well:
+
+```sh
+npm install --global oh-my-vul@latest
+omv start
+```
+
+Pi manages the Skills itself, so Pi users should not run `omv setup`. Use `pi install npm:oh-my-vul -l` instead when the package should be enabled only for the current project.
+
+### Codex and Claude Code
 
 Install the CLI and add the skills to Codex:
 
@@ -55,7 +74,7 @@ Open that project in Codex, then invoke the Skill (or choose it from `/skills`):
 $omv
 ```
 
-Claude Code users invoke `/omv`. The Skill applies the evidence and review gates, shows the active queue, and recommends the next action. From an interactive terminal, bare `omv` opens the Ink research workspace.
+Pi users invoke `/skill:omv`; Claude Code users invoke `/omv`. The Skill applies the evidence and review gates, shows the active queue, and recommends the next action. From an interactive terminal, bare `omv` opens the Ink research workspace.
 
 ## Interactive Workspace
 

README.zh-CN.md

@@ -2,7 +2,7 @@
 
 # oh-my-vul
 
-**面向 Codex 与 Claude Code 的证据优先漏洞研究工作台。**
+**面向 Pi、Codex 与 Claude Code 的证据优先漏洞研究工作台。**
 
 从研究范围到报告草稿，每个结论都能回到本地证据。
 
@@ -26,7 +26,26 @@
 
 ## 快速开始
 
-**环境要求：** [Codex](https://developers.openai.com/codex/) 或 [Claude Code](https://docs.anthropic.com/en/docs/claude-code)、Node.js 22 或更高版本，以及供内置 Skill 辅助脚本使用的 Python 3。确定性报告渲染器还使用自身固定版本的 PyYAML 依赖。支持 Windows、Linux 和 macOS；Windows 建议使用新版 Windows Terminal 或 PowerShell 运行 Ink 工作台。
+**环境要求：** [Pi](https://pi.dev/)、[Codex](https://developers.openai.com/codex/) 或 [Claude Code](https://docs.anthropic.com/en/docs/claude-code)、Node.js 22 或更高版本，以及供内置 Skill 辅助脚本使用的 Python 3。确定性报告渲染器还使用自身固定版本的 PyYAML 依赖。支持 Windows、Linux 和 macOS；Windows 建议使用新版 Windows Terminal 或 PowerShell 运行 Ink 工作台。
+
+### Pi
+
+直接把 package 安装到 Pi：
+
+```sh
+pi install npm:oh-my-vul
+```
+
+Pi 会发现内置的全部 10 个 Skills。使用 `/skill:omv` 打开项目管理入口，也可以直接调用 `/skill:omv-find`、`/skill:omv-audit` 等专用 Skill。若要使用完整的本地 `.omv/` 工作区、确定性校验和 Ink 工作台，还需要安装配套 CLI：
+
+```sh
+npm install --global oh-my-vul@latest
+omv start
+```
+
+Pi 会自行管理 Skills，因此 Pi 用户不需要运行 `omv setup`。如果只想在当前项目启用，可使用 `pi install npm:oh-my-vul -l`。
+
+### Codex 与 Claude Code
 
 全局安装 CLI，并把 Skills 装入 Codex：
 
@@ -55,7 +74,7 @@ omv start --vuln xss,auth --no-interactive
 $omv
 ```
 
-Claude Code 用户调用 `/omv`。Skill 会自动启用证据与审查门槛，并显示正在处理的 finding 和下一步建议。在交互式终端中直接运行 `omv`，会打开 Ink 研究工作台。
+Pi 用户调用 `/skill:omv`；Claude Code 用户调用 `/omv`。Skill 会自动启用证据与审查门槛，并显示正在处理的 finding 和下一步建议。在交互式终端中直接运行 `omv`，会打开 Ink 研究工作台。
 
 ## 交互式工作台
 

package-lock.json

@@ -1,10 +1,15 @@
 {
   "name": "oh-my-vul",
-  "version": "1.0.0",
-  "description": "Evidence-first vulnerability research skills for Codex and Claude Code",
+  "version": "1.1.0",
+  "description": "Evidence-first vulnerability research skills and CLI for Pi, Codex, and Claude Code",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
+  "pi": {
+    "skills": [
+      "./skills"
+    ]
+  },
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
@@ -72,6 +77,9 @@
     "registry.yaml"
   ],
   "keywords": [
+    "pi-package",
+    "pi",
+    "pi-skill",
     "claude-code",
     "codex",
     "security",
@@ -83,10 +91,10 @@
   "author": "bx33661",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/bx33661/oh-my-vul.git",
-    "homepage": "https://github.com/bx33661/oh-my-vul#readme",
-    "bugs": "https://github.com/bx33661/oh-my-vul/issues"
+    "url": "git+https://github.com/bx33661/oh-my-vul.git"
   },
+  "homepage": "https://github.com/bx33661/oh-my-vul#readme",
+  "bugs": "https://github.com/bx33661/oh-my-vul/issues",
   "license": "MIT",
   "devDependencies": {
     "@types/node": "^25.6.2",

package.json

@@ -2,7 +2,7 @@
 # Lists all skills in this collection with their invocation, status, and contract bindings.
 
 name: oh-my-vul
-version: "1.0.0"
+version: "1.1.0"
 platform: codex,claude-code
 updated: "2026-07-11"
 

registry.yaml

@@ -179,6 +179,14 @@ def main() -> None:
     if not isinstance(exports, dict) or set(exports) != {".", "./package.json"}:
         fail("package exports must contain only the root API and package.json")
 
+    keywords = package_json.get("keywords")
+    if not isinstance(keywords, list) or "pi-package" not in keywords:
+        fail("package keywords must include pi-package for Pi gallery discovery")
+
+    pi_manifest = package_json.get("pi")
+    if not isinstance(pi_manifest, dict) or pi_manifest.get("skills") != ["./skills"]:
+        fail("package pi.skills must declare the canonical ./skills directory")
+
     package = npm_pack()
     files = package.get("files", [])
     if not isinstance(files, list):
@@ -189,6 +197,16 @@ def main() -> None:
     if missing:
         fail(f"missing required npm files: {', '.join(missing)}")
 
+    pi_skill_entries = {
+        path.relative_to(REPO_ROOT).as_posix()
+        for path in (REPO_ROOT / "skills").glob("*/SKILL.md")
+    }
+    missing_pi_skills = sorted(pi_skill_entries - paths)
+    if missing_pi_skills:
+        fail(f"missing Pi skill entries: {', '.join(missing_pi_skills)}")
+    if len(pi_skill_entries) != 10:
+        fail(f"expected 10 canonical Pi skills, found {len(pi_skill_entries)}")
+
     missing_patterns = sorted(expected_pattern_pack_files() - paths)
     if missing_patterns:
         fail(f"missing PatternPack npm files: {', '.join(missing_patterns[:12])}")
@@ -226,6 +244,7 @@ def main() -> None:
                 "version": package.get("version"),
                 "filename": package.get("filename"),
                 "files": len(paths),
+                "piSkills": len(pi_skill_entries),
                 "size": package.get("size"),
                 "unpackedSize": package.get("unpackedSize"),
             },

scripts/check_npm_pack.py

@@ -14,7 +14,6 @@ Each pack is a discovery filter plus a source -> sink -> guard checklist. Use it
 | `config-loader` | `yaml`, `proto`, `deser`, `auth`, `crypto` | config, yaml, json, dotenv, rc, schema, plugin config | config files, environment maps, CLI overrides, JSON/YAML objects | unsafe loader, deep merge, object hook, secret/key parsing | schema validation, safe loader, key denylist, null-prototype objects, secret handling |
 | `media-tool` | `ssrf`, `upload`, `overflow`, `infoleak`, `xxe` | image, svg, pdf, video, thumbnail, metadata, exif | uploaded files, remote media URLs, embedded metadata, SVG/XML | remote fetch, parser decode, thumbnailer shell, XML parser, native bindings | URL allowlist, file magic, parser sandbox, DTD disabled, bounded decode |
 | `webhook-client` | `ssrf`, `redirect`, `auth`, `crypto` | webhook, callback, integration, notifier, bot, oauth | user-provided webhook URLs, callback targets, token config | HTTP client, redirect follow, signature verifier, callback redirect | scheme/host allowlist, private-IP block, redirect policy, signature validation |
-| `ssrf-filter` | `ssrf`, `redirect` | ssrf, private ip, request filter, filtering agent, ipaddr, metadata | caller URL/options, DNS results, redirects | agent createConnection, fetch agent, socket connect, unix socket | non-unicast block after DNS, metadata/link-local reject, redirect and socketPath policy |
 | `upload-handler` | `upload`, `traversal`, `race`, `infoleak` | upload, multipart, avatar, import, attachment, file manager | multipart filenames, content types, temp files, user-supplied paths | extension checks, move/write, public storage, post-process parser | extension allowlist, content sniffing, hash rename, quarantine, atomic move |
 
 ## Discovery Rules

skills/omv-find/references/pattern-packs.md

@@ -1,11 +1,13 @@
 ---
 name: omv
-description: oh-my-vul local-first vulnerability research project manager. Shows workspace status, next actions, installed omv-* skills, registry info, and delegates .omv findings lifecycle commands. Use when the user types /omv, asks what to do next, or manages local findings.
+description: oh-my-vul local-first vulnerability research project manager for Pi, Codex, and Claude Code. Shows workspace status, next actions, installed omv-* skills, registry info, and delegates .omv findings lifecycle commands. Use when the user invokes /skill:omv, $omv, or /omv; asks what to do next; or manages local findings.
 ---
 
 # omv
 
-oh-my-vul local-first vulnerability research project manager for Codex and Claude Code.
+oh-my-vul local-first vulnerability research project manager for Pi, Codex, and Claude Code.
+
+Invocation depends on the active platform: Pi uses `/skill:omv [args]`, Codex uses `$omv [args]`, and Claude Code uses `/omv [args]`. The command table below uses `/omv` as shorthand for the active platform's project-manager invocation.
 
 **Process first:** For any vulnerability research session (find / audit / report / “what next”), apply `using-omv` discipline — evidence before claims, CLI gates before “confirmed” or “ready to submit”, prefer campaign + attack-surface cards before bulk hypotheses. Do not invent parallel workflows outside `.omv/` + `omv` CLI.
 
@@ -50,16 +52,16 @@ oh-my-vul local-first vulnerability research project manager for Codex and Claud
 /omv help                   — show this help text
 ```
 
-The first word after `/omv` is treated as the subcommand. Unknown subcommands show the help text.
+The first word after the platform-specific project-manager invocation is treated as the subcommand. Unknown subcommands show the help text.
 
 ## Skills in This Collection
 
 | Skill | Invocation | Purpose |
 |---|---|---|
-| omv-find | `/omv-find` | Find and rank open-source packages worth auditing |
-| omv-audit | `/omv-audit` | Deep-audit a candidate finding, prove or disprove the vulnerability |
-| omv-repro | `/omv-repro` | Guide local reproduction, fill evidence.observed_result |
-| omv-report | `/omv-report` | Generate VulDB/CVE/GHSA/OSV advisory reports |
+| omv-find | `/skill:omv-find` on Pi; `$omv-find` on Codex; `/omv-find` on Claude Code | Find and rank open-source packages worth auditing |
+| omv-audit | `/skill:omv-audit` on Pi; `$omv-audit` on Codex; `/omv-audit` on Claude Code | Deep-audit a candidate finding, prove or disprove the vulnerability |
+| omv-repro | `/skill:omv-repro` on Pi; `$omv-repro` on Codex; `/omv-repro` on Claude Code | Guide local reproduction, fill evidence.observed_result |
+| omv-report | `/skill:omv-report` on Pi; `$omv-report` on Codex; `/omv-report` on Claude Code | Generate VulDB/CVE/GHSA/OSV advisory reports |
 
 ## Registry
 
@@ -96,7 +98,7 @@ Use `omv help`, `omv help review`, `omv help findings`, `omv help repro`, or `om
 - `/omv restore <id>` -> `omv findings restore <id>`
 - `/omv findings ...` -> `omv findings ...`
 
-**If `omv` is not found on PATH**, output: "`omv` is not installed. Run `npm install --global oh-my-vul`, then `omv setup --platform codex` in Codex or `omv setup --platform claude-code` in Claude Code."
+**If `omv` is not found on PATH**, output: "`omv` is not installed. Run `npm install --global oh-my-vul`. Pi users already have the Skills and should not run `omv setup`; Codex and Claude Code users should then run `omv setup --platform codex|claude-code` for their platform."
 
 ### Subcommand reference
 

skills/omv/SKILL.md

@@ -2,7 +2,7 @@
 # Lists all skills in this collection with their invocation, status, and contract bindings.
 
 name: oh-my-vul
-version: "1.0.0"
+version: "1.1.0"
 platform: codex,claude-code
 updated: "2026-07-11"