De-vendor pi-agent-core and slim cua-agent to a light wrapper

[rgarcia]

Summary

• Deletes the vendored pi-agent-core snapshot (27 files, ~6.7k lines) plus the vendoring script, and depends on the published @earendil-works/pi-agent-core@0.79.1 instead. pi deps are exact-pinned (pi-agent-core 0.79.1, pi-ai 0.79.1 in both packages/ai and packages/agent) so the workspace resolves a single deduped pi-ai and the provider registry stays unified. The full pi surface is still re-exported, now tracking npm; NodeExecutionEnv is re-exported from the /node subpath so existing imports keep working.
• Collapses CuaRuntimeController: removes the always-true ownsTools branches, caches the resolved runtime spec instead of re-resolving per provider request, holds one long-lived translator rebuilt on model change, and unifies the harness env-key default into a shared helper.
• Moves the yutori screenshot payload append out of cua-agent into @onkernel/cua-ai's payload middleware: CuaPayloadContext gains optional getScreenshot, and the new yutoriCuaOnPayload hook owns both native tool-set mapping and the screenshot append (with tests for idempotency and skip conditions).
• tools.ts adopts pi's throw-on-failure tool contract: failed browser actions throw (Actions failed: ... / <action> failed: ... with cause) instead of triple-encoding errors into content, details, and a re-thrown object; dead translator types and the direct typebox dep are removed.
• ESM packaging fix: packages/agent dist/ is now bundled with tsdown (single ESM file, deps external including the pi-agent-core /node subpath; source keeps extensionless imports, tsc -b stays for typechecking via a gitignored dist-tsc/) so it resolves under plain Node; the release workflow now runs an explicit tsc -b typecheck step (tsdown does not run the full checker), the full unit suite (excluding live tests), and packs both workspace tarballs for an ESM import smoke test before publishing.
• Releases as @onkernel/cua-agent 0.3.0 with CHANGELOG notes for the breaking re-export drift (vendored snapshot replaced, harness.agent removed, async steer/followUp/nextTurn/setStreamOptions, model_select/thinking_level_select event renames, queue-mode accessors became methods, Result-based ExecutionEnv, Node >= 22.19.0).

Rebased onto main after #18 merged (cua-ai 0.2.0, tsdown packaging, Node 22 CI). Publishing order still matters: @onkernel/cua-ai@0.2.0 must be on the registry before tagging cua-agent/v0.3.0 — the workflow's dependency check and ESM smoke enforce this.

Test plan

• npm ci from a clean tree resolves a single deduped @earendil-works/pi-ai@0.79.1
• npm run build for both @onkernel/cua-ai and @onkernel/cua-agent
• npm test --workspace @onkernel/cua-agent -- --exclude "**/*.live.test.ts" (25/25)
• npm test --workspace @onkernel/cua-ai post-rebase (87 passed / 13 files, including the new yutori screenshot-middleware tests on top of the 0.2.0 API)
• Packed both workspace tarballs from this branch (post-rebase), installed them into a clean temp dir, and verified CuaAgent, CuaAgentHarness, createCuaComputerTools, NodeExecutionEnv, and the wildcard pi re-exports import under plain Node ESM
• npm run typecheck --workspace @onkernel/cua-agent (tsc -b project references) — green after the tsdown switch
• Run the opt-in live provider matrix (CUA_E2E_LIVE=1, packages/agent/test/e2e.live.test.ts) before publishing 0.3.0

🤖 Generated with Claude Code

---

Note

High Risk
Major dependency swap and multiple documented harness/API breaks; publish order requires @onkernel/cua-ai@0.2.0 on npm first, and consumers must upgrade Node and await new harness APIs.

Overview
@onkernel/cua-agent 0.3.0 drops the vendored pi-agent-core tree (~6.7k lines) and depends on @earendil-works/pi-agent-core@0.79.1 (with matching pi-ai 0.79.1). The package still re-exports the full pi surface plus NodeExecutionEnv from the /node subpath. Node is now >=22.19.0, builds use tsdown instead of plain tsc, and dist uses explicit .js imports for plain Node ESM.

Runtime behavior: CuaRuntimeController is slimmer—one cached runtime spec, one translator rebuilt on model change, no vendored-only ownsTools branches. Yutori screenshot injection moves to @onkernel/cua-ai via CuaPayloadContext.getScreenshot and yutoriCuaOnPayload. Browser tools throw on failure (pi contract) instead of encoding errors in tool result content/details.

Breaking for harness consumers: removed harness.agent; async steer/followUp/nextTurn/setStreamOptions; event renames model_select → model_update, thinking_level_select → thinking_level_update; queue mode getters/setters → methods; ExecutionEnv is Result-based.

Release CI adds typecheck, runs unit tests excluding *.live.test.ts, packs cua-ai + cua-agent, and runs an ESM import smoke test before publish. Docs/architecture now reference the published pi package instead of vendored core.

^{Reviewed by Cursor Bugbot for commit 8981cd7. Bugbot is set up for automated code reviews on this repo. Configure here.}

[firetiger-agent]

Firetiger deploy monitoring skipped

This PR didn't match the auto-monitor filter configured on your GitHub connection:

PRs in the kernel, infra, hypeman, and hypeship repos. kernel is a ~mono repo with many logical services underneath, ensure to focus on the implicated service for the PR

Reason: PR affects cua-agent and cua-ai packages which are not listed in the deploy-monitoring filter (kernel, infra, hypeman, hypeship repos); please opt in manually if deploy monitoring is needed.

To monitor this PR anyway, reply with @firetiger monitor this.