Extension audit workflow

Workflow overview

Four extension scopes are audited in parallel, followed by an integration cross-check and a prioritized maintainer plan.

• Audit: review extension groups against pi APIs and project conventions.
• Cross-check: verify consequential findings and identify cross-extension risks.
• Plan: synthesize evidence into an ordered implementation plan.

Full workflow script

export const meta = {
  name: 'extension-audit',
  description: 'Audit every local pi extension for bugs and simplification opportunities, then synthesize a prioritized implementation plan.',
  phases: [
    { title: 'Audit', detail: 'Review extension groups in parallel against pi extension APIs and project conventions.' },
    { title: 'Cross-check', detail: 'Look for integration risks, duplicated abstractions, and missing tests across groups.' },
    { title: 'Plan', detail: 'Produce a concrete prioritized simplification and bug-fix plan.' }
  ]
}

const AUDIT = {
  type: 'object',
  properties: {
    scope: { type: 'string' },
    filesReviewed: { type: 'array', items: { type: 'string' } },
    findings: {
      type: 'array',
      items: {
        type: 'object',
        properties: {
          severity: { type: 'string', enum: ['critical', 'high', 'medium', 'low'] },
          category: { type: 'string', enum: ['bug', 'simplification', 'testing', 'maintainability', 'performance', 'security'] },
          title: { type: 'string' },
          evidence: { type: 'string' },
          recommendation: { type: 'string' },
          files: { type: 'array', items: { type: 'string' } }
        },
        required: ['severity', 'category', 'title', 'evidence', 'recommendation', 'files']
      }
    },
    strengths: { type: 'array', items: { type: 'string' } }
  },
  required: ['scope', 'filesReviewed', 'findings', 'strengths']
}

const root = '/Users/davis/.pi/agent'
const docs = '/Users/davis/.vite-plus/js_runtime/node/24.18.0/lib/node_modules/@earendil-works/pi-coding-agent'
const common = `You are auditing TypeScript extensions in ${root}. Read ${root}/AGENTS.md. Because these are pi extensions, read ${docs}/docs/extensions.md COMPLETELY and follow relevant markdown cross-references into ${docs}/docs and examples under ${docs}/examples/extensions as needed. Inspect every assigned source and test file. Do not edit anything. Identify only evidence-backed bugs, simplifications, missing tests, maintainability/performance/security risks. Include exact file paths and line references in evidence where possible. Check repository status and package scripts/config where relevant. Distinguish real defects from stylistic preferences.`

phase('Audit')
const audits = await parallel([
  () => agent(`${common}\nAudit all smaller extension groups and their related prompt/support files: ${root}/extensions/ask-user, ${root}/extensions/firecrawl-search, ${root}/extensions/git-info, ${root}/extensions/model-info, ${root}/extensions/ui-customization, and ${root}/extensions/copy-all.ts. Ensure every file in those scopes is reviewed.`, { label: 'audit:surface-extensions', phase: 'Audit', schema: AUDIT, effort: 'high' }),
  () => agent(`${common}\nAudit every file under ${root}/extensions/shared, including all tests. Focus especially on lifecycle, cancellation, timeout, state ownership, and duplicated abstractions.`, { label: 'audit:shared', phase: 'Audit', schema: AUDIT, effort: 'high' }),
  () => agent(`${common}\nAudit every file under ${root}/extensions/subagents, including all tests and its use of shared modules. Focus on concurrency, cancellation, session cleanup, delivery correctness, takeover behavior, and UI state.`, { label: 'audit:subagents', phase: 'Audit', schema: AUDIT, effort: 'high' }),
  () => agent(`${common}\nAudit every file under ${root}/extensions/workflows, including sandbox-child.cjs and all tests. Focus on sandbox security/correctness, orchestration concurrency, cancellation, serialization, artifacts, lifecycle cleanup, and over-complexity.`, { label: 'audit:workflows', phase: 'Audit', schema: AUDIT, effort: 'high' })
], { concurrency: 4 })

const usable = audits.filter((r) => r.ok).map((r) => r.structured)
const failures = audits.filter((r) => !r.ok).map((r) => r.error)

phase('Cross-check')
const cross = await agent(`${common}\nYou are the integration reviewer. Here are independent audit results:\n${JSON.stringify(usable)}\nAudit cross-extension interactions in ${root}/extensions, verify the most consequential claims directly in source, discover duplicated infrastructure or inconsistent lifecycle semantics spanning groups, and note findings the partitioned reviews missed. Do not edit. Return evidence-backed findings only.`, { label: 'cross-check:integration', phase: 'Cross-check', schema: AUDIT, effort: 'high' })

phase('Plan')
const plan = await agent(`Act as a senior maintainer. Build a concise, actionable implementation plan from the extension audit below. The codebase is ${root}. Do not invent issues and do not edit files. Deduplicate overlapping findings, discard claims not supported by concrete evidence, and prioritize correctness/security before simplification. Group work into 3-6 ordered phases. For each item include: priority (P0-P3), exact files, the change, rationale/observed failure mode, tests to add/update, dependencies, and rough effort (S/M/L). Explicitly list low-value suggestions to defer and explain why. Also include an audit coverage summary and any audit failures. Output polished Markdown ready to send directly to the user.\n\nPartition audits:\n${JSON.stringify(usable)}\n\nIntegration review:\n${cross.ok ? JSON.stringify(cross.structured) : `FAILED: ${cross.error}`}\n\nAudit failures:\n${JSON.stringify(failures)}`, { label: 'plan:maintainer', phase: 'Plan', effort: 'high' })

return {
  auditCount: usable.length,
  auditFailures: failures,
  integrationReviewOk: cross.ok,
  plan: plan.ok ? plan.output : `Plan synthesis failed: ${plan.error}`
}