@companion-ai/feynman 0.5.15 → 0.5.17

package/.feynman/agents/researcher.md

@@ -3,7 +3,6 @@ name: researcher
 description: Gather primary evidence across papers, web sources, repos, docs, and local artifacts.
 thinking: high
 tools: read, write, edit, bash, grep, find, ls, web_search, fetch_content, get_search_content, feynman_science_database_search, hf_dataset_info, hf_repo_files, hf_repo_read_file
-output: research.md
 defaultProgress: true
 async: true
 ---
@@ -94,7 +93,7 @@ Numbered list matching the evidence table:
 - If you were assigned multiple questions, track them explicitly in the file and mark each as `done`, `blocked`, or `needs follow-up`. Do not silently skip questions.
 
 ## Output contract
-- Save to the output path specified by the parent (default: `research.md`).
+- Save to the path the parent specifies, relative to the workspace. If none is given, return the complete artifact in your final response.
 - Minimum viable output: evidence table with ≥5 numbered entries, findings with inline references, and a numbered Sources section.
 - Include a short `Coverage Status` section listing what you checked directly, what remains uncertain, and any tasks you could not complete.
 - Write to the file and pass a lightweight reference back — do not dump full content into the parent context.

package/.feynman/agents/reviewer.md

@@ -2,7 +2,6 @@
 name: reviewer
 description: Run tough but constructive internal research critique of an AI research artifact.
 thinking: high
-output: review.md
 defaultProgress: true
 ---
 
@@ -88,5 +87,5 @@ Reference the weakness/question IDs from Part 1 so annotations link back to the
 - End with a `Sources` section containing direct URLs for anything additionally inspected during review.
 
 ## Output contract
-- Save the main artifact to the output path specified by the parent (default: `review.md`).
+- Save to the path the parent specifies, relative to the workspace. If none is given, return the complete artifact in your final response.
 - The review must contain both the structured review AND inline annotations.

package/.feynman/agents/verifier.md

@@ -3,7 +3,6 @@ name: verifier
 description: Post-process a draft to add inline citations and verify every source URL.
 thinking: medium
 tools: read, bash, grep, find, ls, write, edit, web_search, fetch_content, get_search_content, feynman_science_database_search
-output: cited.md
 defaultProgress: true
 async: true
 ---
@@ -57,6 +56,6 @@ Before saving the final document, scan for:
 For each item, verify that it maps to a source URL, research note, raw artifact path, or script path. If not, remove it or replace it with a TODO. Add a short `Removed Unsupported Claims` section only when you remove material.
 
 ## Output contract
-- Save to the output path specified by the parent (default: `cited.md`).
+- Save to the path the parent specifies, relative to the workspace. If none is given, return the complete artifact in your final response.
 - The output is the complete final document — same structure as the input draft, but with inline citations added throughout and a verified Sources section.
 - Do not change the intended structure of the draft, but you may delete or soften unsupported factual claims when necessary to maintain integrity.

package/.feynman/agents/writer.md

@@ -3,7 +3,6 @@ name: writer
 description: Turn research notes into clear, structured briefs and drafts.
 thinking: medium
 tools: read, bash, grep, find, ls, write, edit
-output: draft.md
 defaultProgress: true
 ---
 
@@ -52,5 +51,5 @@ Unresolved issues, disagreements between sources, gaps in evidence.
 - Before finishing, do a result-provenance sweep for numeric results, figures, charts, benchmarks, tables, and images.
 
 ## Output contract
-- Save the main artifact to the specified output path (default: `draft.md`).
+- Save to the path the parent specifies, relative to the workspace. If none is given, return the complete artifact in your final response.
 - Focus on clarity, structure, and evidence traceability.

package/RELEASES.md

@@ -6,6 +6,22 @@ GitHub release notes are generated from the matching `## vX.Y.Z` section in this
 
 ## Unreleased
 
+## v0.5.17 - 2026-09-30
+
+- **`feynman model login openai` works again.** Since Pi 0.99, Sign in with ChatGPT needs a stable ID for the installation, which Feynman did not pass, so the login failed at once with "requires a device ID (UUID)". Feynman now shares the `deviceId` Pi's own `/login` keeps in `~/.feynman/agent/settings.json`.
+- **Windows finds per-user Git Bash.** Pi looks for Git Bash only under Program Files and on PATH, but a per-user Git for Windows install puts only `Git\cmd` on PATH, so shell commands failed with "No bash shell found" (about one in five Windows installs that run tools). Feynman now finds that Git Bash and gives it to Pi. When there is no Bash at all, Feynman says so before the session starts, and `feynman doctor` reports the `bash` it found.
+- Pressing Enter at the "paste the authorization code / redirect URL" login prompt no longer ends the login with "Missing authorization code"; Feynman asks again, and finishing in the browser still works.
+- API keys are now masked as you paste them during setup, and a key with non-ASCII characters (for example typed with a non-Latin keyboard layout) is rejected with an explanation instead of failing every request with "Cannot convert argument to a ByteString".
+- A rejected `SEMANTIC_SCHOLAR_API_KEY` now says so instead of `request failed: 403 Forbidden`.
+
+## v0.5.16 - 2026-09-30
+
+- **Subagent research files land in the workspace.** When a workflow gave a subagent a relative output path such as `outputs/.drafts/<slug>-research-web.md`, pi-subagents saved it under `~/.feynman/sessions/subagent-artifacts/outputs/<run>/` instead, so the lead agent could not find the research notes, citations, or verification it asked for (about one in seven installs running research workflows hit this in the last week). Relative subagent outputs now resolve against the workspace, the researcher, reviewer, verifier, and writer no longer default to generic file names such as `research.md`, and `/deepresearch` and `/lit` name every subagent file under `outputs/.drafts/`. If you set `singleRunOutputBaseDir` in `~/.feynman/agent/extensions/subagent/config.json`, Feynman keeps your value.
+- `feynman packages remove <preset>` (also `rm` and `uninstall`) removes an optional package such as `memory`.
+- On Windows, Feynman no longer fails to start when another Feynman start is copying `keybindings.json` (`EBUSY: resource busy or locked`).
+- pi-web-access 0.34.0: `fetch_content` falls back to your other fetch providers on Cloudflare "Just a moment..." pages, web tools start available on models such as DeepSeek without costing a prompt-cache miss, and its undici moves to 8.11.2.
+- Security: three brace-expansion advisories published on 2026-09-29 affect the 5.0.9 that Pi 0.99.1's shrinkwrap locks, which Feynman cannot override. Pi uses it only for package filters and model patterns from your own settings and flags; the next Pi release that ships 5.0.12 replaces it. pi-subagents has still not released its undici fix.
+
 ## v0.5.15 - 2026-09-29
 
 - **Pi 0.99.1, pinned.** Feynman accepted any Pi version, so npm installs picked up Pi 0.99.1 the day it was released, untested, and Pi 0.99 warns on every launch about how Feynman declared it. Feynman now runs on Pi 0.99.1, which adds MCP server support (`/mcp`), declared the way Pi asks, and pinned so new Pi releases arrive only after they pass Feynman's checks. If npm has `legacy-peer-deps` on, it skips Pi; `feynman` now says to reinstall with `--legacy-peer-deps=false` instead of failing on a missing package.

package/dist/bootstrap/home.js

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { copyFileSync, existsSync, readFileSync, renameSync, rmSync } from "node:fs";
+import { constants, copyFileSync, existsSync, readFileSync, renameSync, rmSync } from "node:fs";
 import { resolve } from "node:path";
 import { getBootstrapStatePath } from "../config/paths.js";
 const LEGACY_SYNCED_SCOPES = { themes: "themes", agents: "agents", skills: "skills" };
@@ -41,6 +41,12 @@ export function ensureFeynmanAgentDir(appRoot, home, agentDir) {
     }
     const keybindingsPath = resolve(agentDir, "keybindings.json");
     if (!existsSync(keybindingsPath)) {
-        copyFileSync(resolve(appRoot, ".feynman", "config", "keybindings.json"), keybindingsPath);
+        try {
+            copyFileSync(resolve(appRoot, ".feynman", "config", "keybindings.json"), keybindingsPath, constants.COPYFILE_EXCL);
+        }
+        catch {
+            // Another Feynman start may be writing it (Windows reports EBUSY). Pi
+            // uses its default keys without the file, and the next start copies it.
+        }
     }
 }

package/dist/cli.js

@@ -18,9 +18,9 @@ import { verifyAlphaAuthStatus } from "./alpha-auth-status.js";
 import { ensureFeynmanAgentDir } from "./bootstrap/home.js";
 import { ensureFeynmanHome, getDefaultSessionDir, getFeynmanAgentDir, getFeynmanHome } from "./config/paths.js";
 import { getLastPiStderr, launchPiChat, runPi } from "./pi/launch.js";
-import { installPiPackage, listOptionalPackagePresets, normalizeOptionalPackagePresetName, resolvePackageSource, updatePiPackages, } from "./pi/packages.js";
+import { installPiPackage, removePiPackage, listOptionalPackagePresets, normalizeOptionalPackagePresetName, resolvePackageSource, updatePiPackages, } from "./pi/packages.js";
 import { canonicalizeModelSpec, ensureFeynmanSettings, normalizeThinkingLevel, readJson, } from "./pi/settings.js";
-import { BUNDLED_PI_PACKAGES, buildPiEnv } from "./pi/runtime.js";
+import { BUNDLED_PI_PACKAGES, buildPiEnv, findWindowsBash, WINDOWS_BASH_MISSING_NOTICE } from "./pi/runtime.js";
 import { getConfiguredServiceTier, normalizeServiceTier, setConfiguredServiceTier } from "./model/service-tier.js";
 import { authenticateModelProvider, getCurrentModelSpec, isLocalModelProvider, loginModelProvider, logoutModelProvider, printModelList, selectDefaultModel, setDefaultModelSpec, } from "./model/commands.js";
 import { buildModelStatusSnapshotFromRecords, getAuthenticatedModelRecords, isProClassModelSpec, getSupportedModelRecords, } from "./model/catalog.js";
@@ -267,18 +267,27 @@ async function handlePackagesCommand(subcommand, args, piOptions) {
         printInfo(`Install with: feynman packages install <${optionalPresets.map((preset) => preset.name).join("|")}>`);
         return;
     }
-    if (subcommand !== "install") {
-        throw new Error(`Unknown packages command: ${subcommand}`);
+    const remove = subcommand === "remove" || subcommand === "rm" || subcommand === "uninstall";
+    if (subcommand !== "install" && !remove) {
+        throw new Error(`Unknown packages command: ${subcommand}\nUse: feynman packages list, install <preset>, or remove <preset>.`);
     }
     const target = args[0];
     if (!target) {
-        throw new Error(`Usage: feynman packages install <${listOptionalPackagePresets().map((preset) => preset.name).join("|")}>`);
+        throw new Error(`Usage: feynman packages ${remove ? "remove" : "install"} <${listOptionalPackagePresets().map((preset) => preset.name).join("|")}>`);
     }
     const presetName = normalizeOptionalPackagePresetName(target);
     if (!presetName) {
         throw new Error(`Unknown package preset: ${target}`);
     }
     const source = resolvePackageSource(presetName);
+    if (remove) {
+        if (!configuredSources.has(source)) {
+            console.log(`${source} is not installed`);
+            return;
+        }
+        process.exitCode = await removePiPackage(piOptions, source);
+        return;
+    }
     if (configuredSources.has(source)) {
         console.log(`${source} already installed`);
         return;
@@ -672,6 +681,12 @@ async function runMain(input) {
             preLaunchNotice = buildLocalModelWorkflowNotice(effectiveSpec, command);
         }
     }
+    if (process.platform === "win32" && mode !== "rpc" && mode !== "json" && process.stdout.isTTY) {
+        const shellPath = readJson(feynmanSettingsPath).shellPath;
+        if (typeof shellPath !== "string" && !findWindowsBash()) {
+            preLaunchNotice = [preLaunchNotice, WINDOWS_BASH_MISSING_NOTICE].filter(Boolean).join("\n");
+        }
+    }
     await launchPiChat({
         ...piOptions,
         mode,

package/dist/model/commands.js

@@ -1,8 +1,10 @@
 import { readFileSync, writeFileSync } from "node:fs";
 import { exec as execCallback } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import { dirname, resolve } from "node:path";
 import { promisify } from "node:util";
 import { readJson } from "../pi/settings.js";
-import { promptChoice, promptSelect, promptText } from "../setup/prompts.js";
+import { promptChoice, promptSecret, promptSelect, promptText, validateApiKeyInput } from "../setup/prompts.js";
 import { openUrl } from "../system/open-url.js";
 import { printInfo, printSection, printSuccess, printWarning } from "../ui/terminal.js";
 import { buildModelStatusSnapshotFromRecords, chooseRecommendedModel, getAuthenticatedModelRecords, getAvailableModelRecords, getSupportedModelRecords, isProClassModelSpec, } from "./catalog.js";
@@ -624,7 +626,7 @@ async function configureApiKeyProvider(authPath, providerId) {
     if (provider.envVar) {
         printInfo(`Tip: to avoid writing secrets to disk, set ${provider.envVar} in your shell or .env.`);
     }
-    const apiKey = await promptText("Paste API key (leave empty to use env var instead)", "");
+    const apiKey = await promptSecret("Paste API key (leave empty to use env var instead)", undefined, validateApiKeyInput);
     if (!apiKey) {
         if (provider.envVar) {
             printInfo(`Set ${provider.envVar} and rerun setup (or run \`feynman model list\`).`);
@@ -729,6 +731,17 @@ export async function authenticateModelProvider(authPath, settingsPath) {
     printInfo("Authentication cancelled.");
     return false;
 }
+// Sign in with ChatGPT sends a stable installation ID. Pi's own /login keeps it
+// as `deviceId` in the agent settings.json; share that one.
+export function getOrCreateDeviceId(authPath) {
+    const settingsPath = resolve(dirname(authPath), "settings.json");
+    const settings = readJson(settingsPath);
+    if (typeof settings.deviceId === "string" && settings.deviceId)
+        return settings.deviceId;
+    const deviceId = randomUUID();
+    writeFileSync(settingsPath, `${JSON.stringify({ ...settings, deviceId }, null, 2)}\n`, "utf8");
+    return deviceId;
+}
 export async function loginModelProvider(authPath, providerId, settingsPath) {
     if (providerId) {
         const resolvedProvider = await resolveModelProviderForCommand(authPath, providerId);
@@ -762,7 +775,13 @@ export async function loginModelProvider(authPath, providerId, settingsPath) {
                     hint: option.description,
                 })), undefined, prompt.signal);
             }
-            return promptText(prompt.message, "", prompt.placeholder, prompt.signal);
+            if (prompt.type === "secret") {
+                return promptSecret(prompt.message, prompt.signal);
+            }
+            // An empty answer here fails the login with "Missing authorization code";
+            // keep asking, since the browser callback can still finish meanwhile.
+            const required = prompt.type === "manual_code" ? "Paste the redirect URL or code, or finish signing in in the browser." : undefined;
+            return promptText(prompt.message, "", prompt.placeholder, prompt.signal, required);
         },
         notify: (event) => {
             if (event.type === "auth_url") {
@@ -790,7 +809,7 @@ export async function loginModelProvider(authPath, providerId, settingsPath) {
             }
         },
         signal: abortController.signal,
-    });
+    }, { getDeviceId: () => getOrCreateDeviceId(authPath) });
     printSuccess(`Model provider login complete: ${provider.id}`);
     await maybeSetRecommendedDefaultModel(settingsPath, authPath);
     return true;

package/dist/pi/packages.js

@@ -27,6 +27,9 @@ export function resolvePackageSource(name) {
 export async function installPiPackage(options, source) {
     return runPi(options, ["install", source], buildPiEnv(options));
 }
+export async function removePiPackage(options, source) {
+    return runPi(options, ["remove", source], buildPiEnv(options));
+}
 export async function updatePiPackages(options, source) {
     return runPi(options, source ? ["update", source] : ["update", "--extensions"], buildPiEnv(options));
 }

package/dist/pi/runtime.js

@@ -1,6 +1,6 @@
 import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { createRequire } from "node:module";
-import { delimiter, dirname, resolve } from "node:path";
+import { delimiter, dirname, resolve, win32 } from "node:path";
 import { BROWSER_FALLBACK_PATHS, MERMAID_FALLBACK_PATHS, PANDOC_FALLBACK_PATHS, resolveExecutable, } from "../system/executables.js";
 import { getPostHogChildEnv } from "../telemetry/posthog.js";
 // Pi packages shipped as Feynman dependencies and loaded from their install
@@ -116,6 +116,31 @@ export function buildPiArgs(options) {
     }
     return args;
 }
+// Pi looks for Git Bash only under Program Files and for bash.exe on PATH. A
+// per-user Git for Windows install (%LOCALAPPDATA%\Programs\Git) puts only
+// Git\cmd on PATH, so Pi reports "No bash shell found" although Git Bash is
+// installed. `addDir` is the Git\bin directory to add to Pi's PATH in that case.
+export function findWindowsBash(env = process.env, exists = existsSync) {
+    const pathDirs = (env.PATH ?? env.Path ?? "").split(";").filter(Boolean);
+    const known = [env.ProgramFiles, env["ProgramFiles(x86)"]]
+        .filter((dir) => Boolean(dir))
+        .map((dir) => win32.join(dir, "Git", "bin", "bash.exe"));
+    const found = [...known, ...pathDirs.map((dir) => win32.join(dir, "bash.exe"))].find(exists);
+    if (found)
+        return { path: found };
+    const gitRoots = [
+        // git.exe lives in Git\cmd or Git\mingw64\bin.
+        ...pathDirs.filter((dir) => exists(win32.join(dir, "git.exe"))).flatMap((dir) => [win32.dirname(dir), win32.dirname(win32.dirname(dir))]),
+        ...(env.LOCALAPPDATA ? [win32.join(env.LOCALAPPDATA, "Programs", "Git")] : []),
+    ];
+    for (const root of gitRoots) {
+        const bash = win32.join(root, "bin", "bash.exe");
+        if (exists(bash))
+            return { path: bash, addDir: win32.join(root, "bin") };
+    }
+    return undefined;
+}
+export const WINDOWS_BASH_MISSING_NOTICE = "No Bash found: Feynman runs shell commands with Bash, so they will fail. Install Git for Windows (https://git-scm.com/download/win), or set shellPath in ~/.feynman/agent/settings.json to another bash.exe.";
 export function buildPiEnv(options, executables) {
     const binPath = [getFeynmanCommandShimDir(options.feynmanAgentDir), resolve(options.appRoot, "node_modules", ".bin")].join(delimiter);
     const pandocPath = process.env.PANDOC_PATH ?? executables?.pandoc ?? resolveExecutable("pandoc", PANDOC_FALLBACK_PATHS);
@@ -123,7 +148,9 @@ export function buildPiEnv(options, executables) {
     const browserPath = process.env.PUPPETEER_EXECUTABLE_PATH ?? executables?.browser ?? resolveExecutable("google-chrome", BROWSER_FALLBACK_PATHS);
     return {
         ...process.env,
-        PATH: `${binPath}${delimiter}${process.env.PATH ?? ""}`,
+        PATH: [binPath, process.env.PATH ?? "", process.platform === "win32" ? findWindowsBash()?.addDir : undefined]
+            .filter(Boolean)
+            .join(delimiter),
         FEYNMAN_VERSION: options.feynmanVersion,
         FEYNMAN_NODE_EXECUTABLE: process.execPath,
         FEYNMAN_BIN_PATH: getFeynmanCliBinPath(options.appRoot),

package/dist/pi/settings.js

@@ -95,7 +95,13 @@ function prepareSubagentDefaults(settingsPath) {
             throw new Error(`Invalid subagent config at ${path}: ${key} must be a boolean. The file was not changed.`);
         }
     }
-    if (missions.enabled !== undefined && config.fleetView !== undefined && config.asyncByDefault !== undefined) {
+    if (config.singleRunOutputBaseDir !== undefined && typeof config.singleRunOutputBaseDir !== "string") {
+        throw new Error(`Invalid subagent config at ${path}: singleRunOutputBaseDir must be a string. The file was not changed.`);
+    }
+    if (missions.enabled !== undefined &&
+        config.fleetView !== undefined &&
+        config.asyncByDefault !== undefined &&
+        config.singleRunOutputBaseDir !== undefined) {
         return undefined;
     }
     const next = {
@@ -103,6 +109,10 @@ function prepareSubagentDefaults(settingsPath) {
         missions: { ...missions, enabled: missions.enabled ?? false },
         fleetView: config.fleetView ?? false,
         asyncByDefault: config.asyncByDefault ?? true,
+        // pi-subagents otherwise saves a relative `output` such as
+        // outputs/.drafts/x.md under the session's subagent-artifacts folder, where
+        // the lead agent never looks. "." resolves against Pi's cwd, the workspace.
+        singleRunOutputBaseDir: config.singleRunOutputBaseDir ?? ".",
     };
     return { path, original: existing?.source, content: `${JSON.stringify(next, null, 2)}\n` };
 }

package/dist/setup/doctor.js

@@ -5,7 +5,7 @@ import { verifyAlphaAuthStatus } from "../alpha-auth-status.js";
 import { formatPiWebAccessDoctorLines, getPiWebAccessStatus } from "../pi/web-access.js";
 import { BROWSER_FALLBACK_PATHS, PANDOC_FALLBACK_PATHS, resolveExecutable } from "../system/executables.js";
 import { readJson } from "../pi/settings.js";
-import { validatePiInstallation } from "../pi/runtime.js";
+import { findWindowsBash, validatePiInstallation, WINDOWS_BASH_MISSING_NOTICE } from "../pi/runtime.js";
 import { isTelemetryDisabled } from "../telemetry/posthog.js";
 import { printInfo, printPanel, printSection } from "../ui/terminal.js";
 import { getCurrentModelSpec } from "../model/commands.js";
@@ -163,6 +163,10 @@ export async function runDoctor(options) {
         }
     }
     console.log(`pandoc: ${pandocPath ?? "missing"}`);
+    if (process.platform === "win32") {
+        const shellPath = settings.shellPath;
+        console.log(`bash: ${typeof shellPath === "string" ? `${shellPath} (shellPath)` : findWindowsBash()?.path ?? `missing. ${WINDOWS_BASH_MISSING_NOTICE}`}`);
+    }
     console.log(`browser preview runtime: ${browserPath ?? "missing"}`);
     for (const line of formatPiWebAccessDoctorLines()) {
         console.log(line);

package/dist/setup/prompts.js

@@ -1,4 +1,4 @@
-import { confirm as clackConfirm, intro as clackIntro, isCancel, multiselect as clackMultiselect, outro as clackOutro, select as clackSelect, text as clackText, } from "@clack/prompts";
+import { confirm as clackConfirm, intro as clackIntro, isCancel, multiselect as clackMultiselect, outro as clackOutro, password as clackPassword, select as clackSelect, text as clackText, } from "@clack/prompts";
 export class SetupCancelledError extends Error {
     constructor(message = "setup cancelled") {
         super(message);
@@ -36,17 +36,30 @@ export async function promptOutro(message) {
     ensureInteractiveTerminal();
     clackOutro(message);
 }
-export async function promptText(question, defaultValue = "", placeholder, signal) {
+export async function promptText(question, defaultValue = "", placeholder, signal, requiredMessage) {
     ensureInteractiveTerminal();
     const value = guardCancelled(await clackText({
         message: question,
         initialValue: defaultValue || undefined,
         placeholder: placeholder ?? (defaultValue || undefined),
         signal,
+        validate: requiredMessage ? (input) => (input?.trim() ? undefined : requiredMessage) : undefined,
     }));
     const normalized = String(value ?? "").trim();
     return normalized || defaultValue;
 }
+export async function promptSecret(question, signal, validate) {
+    ensureInteractiveTerminal();
+    const value = guardCancelled(await clackPassword({ message: question, signal, validate: validate ? (input) => validate((input ?? "").trim()) : undefined }));
+    return String(value ?? "").trim();
+}
+// API keys are printable ASCII. A key typed with a non-Latin keyboard layout
+// fails every request with "Cannot convert argument to a ByteString".
+export function validateApiKeyInput(value) {
+    return /^[\x21-\x7e]*$/.test(value)
+        ? undefined
+        : "API keys contain only ASCII letters, digits, and symbols. Check your keyboard input language and paste the key again.";
+}
 export async function promptSelect(question, options, initialValue, signal) {
     ensureInteractiveTerminal();
     const selection = guardCancelled(await clackSelect({

package/extensions/research-tools/science-databases.ts

@@ -270,6 +270,9 @@ async function fetchSemanticScholar(url: URL): Promise<unknown> {
 		try {
 			return await fetchJson(url, headers);
 		} catch (error) {
+			if (apiKey && error instanceof ScienceDatabaseRequestError && error.status === 403) {
+				throw new ScienceDatabaseRequestError("Semantic Scholar rejected SEMANTIC_SCHOLAR_API_KEY (HTTP 403). Check the key, or unset it to use the shared pool; search with source openalex meanwhile.", 403);
+			}
 			if (!(error instanceof ScienceDatabaseRequestError) || error.status !== 429) throw error;
 			if (attempt >= 1) {
 				throw new ScienceDatabaseRequestError(apiKey

package/metadata/commands.mjs

@@ -137,6 +137,7 @@ export const cliCommandSections = [
 		commands: [
 			{ usage: "feynman packages list", description: "Show core and optional Pi package presets." },
 			{ usage: "feynman packages install <preset>", description: "Install optional package presets on demand." },
+			{ usage: "feynman packages remove <preset>", description: "Remove an installed optional package preset." },
 			{ usage: "feynman search status", description: "Show Pi web-access status and config path." },
 			{ usage: "feynman search set <provider> [api-key]", description: "Set the web search provider and optionally save its API key." },
 			{ usage: "feynman search clear", description: "Reset web search provider to auto while preserving API keys." },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@companion-ai/feynman",
-  "version": "0.5.15",
+  "version": "0.5.17",
   "description": "Research-first CLI agent built on Pi and alphaXiv",
   "license": "MIT",
   "type": "module",
@@ -83,7 +83,7 @@
     "pi-btw": "0.6.1",
     "pi-docparser": "4.0.0",
     "pi-subagents": "0.73.1",
-    "pi-web-access": "0.33.0",
+    "pi-web-access": "0.34.0",
     "posthog-node": "^5.53.0",
     "undici": "^8.11.2"
   },

package/prompts/deepresearch.md

@@ -76,13 +76,13 @@ Example shape:
 
 ```json
 {
-  "workflowScript": "return await runs.all([{key:'web',agent:'researcher',task:'Read outputs/.plans/<slug>-T1.md and write <slug>-research-web.md.',output:'<slug>-research-web.md'},{key:'papers',agent:'researcher',task:'Read outputs/.plans/<slug>-T2.md and write <slug>-research-papers.md.',output:'<slug>-research-papers.md'}]);",
+  "workflowScript": "return await runs.all([{key:'web',agent:'researcher',task:'Read outputs/.plans/<slug>-T1.md and write outputs/.drafts/<slug>-research-web.md.',output:'outputs/.drafts/<slug>-research-web.md'},{key:'papers',agent:'researcher',task:'Read outputs/.plans/<slug>-T2.md and write outputs/.drafts/<slug>-research-papers.md.',output:'outputs/.drafts/<slug>-research-papers.md'}]);",
   "async": true,
   "globalConcurrencyLimit": 4
 }
 ```
 
-Continue independent work after launch, then consume completion results before synthesis. Use the returned output references to locate managed child files; verify them on disk and copy them to the planned research paths when necessary. After evidence gathering, update the plan ledger and verification log. If research failed, record exactly what failed and proceed with a blocked or partial draft.
+Continue independent work after launch, then consume completion results before synthesis. Relative output paths resolve against the workspace, so each child writes its declared path; verify each file on disk, and use the returned output reference for any that is missing. After evidence gathering, update the plan ledger and verification log. If research failed, record exactly what failed and proceed with a blocked or partial draft.
 
 ## Step 4: Draft
 
@@ -123,7 +123,7 @@ Use this shape:
 }
 ```
 
-Wait for the verifier's completion result before review, not merely the async launch receipt. Verify on disk that `outputs/.drafts/<slug>-cited.md` exists. If managed output routing wrote elsewhere, use the returned output reference to find the cited file and move or copy it to `outputs/.drafts/<slug>-cited.md`.
+Wait for the verifier's completion result before review, not merely the async launch receipt. Verify on disk that `outputs/.drafts/<slug>-cited.md` exists. If it is missing, use the returned output reference to find the cited file and copy it there.
 
 ## Step 6: Review
 
@@ -142,7 +142,7 @@ Use this shape:
   "agent": "reviewer",
   "async": true,
   "task": "Verify outputs/.drafts/<slug>-cited.md. Flag unsupported claims, logical gaps, single-source critical claims, and overstated confidence. This is a verification pass, not a peer review.",
-  "output": "<slug>-verification.md"
+  "output": "outputs/.drafts/<slug>-verification.md"
 }
 ```
 

package/prompts/lit.md

@@ -12,7 +12,7 @@ Derive a short slug from the topic (lowercase, hyphens, no filler words, ≤5 wo
 
 1. **Plan** — Outline the scope: key questions, source types to search (papers, web, repos), time period, expected sections, and a small task ledger plus verification log. When the input appears to name a lab, PI, author, institution lab page, or author profile, run the review as a publication-corpus review: find the lab/author identity first, collect the reachable publication list, then map the research trajectory across that corpus. Write the plan to `outputs/.plans/<slug>.md`. Briefly summarize the plan to the user and continue immediately in the same turn with the next tool call; never end a turn with a message that only announces what you will do next. Do not ask for confirmation or wait for a proceed response unless the user explicitly requested plan review.
    - When updating the plan ledger later, keep edits small and valid. If an `edit` tool call fails with a JSON parse error or the replacement would require embedding a large markdown block, rewrite the full corrected plan file with the file-writing tool instead, then continue to final artifact/provenance verification.
-2. **Gather** — Use the `researcher` subagent when the sweep is wide enough to benefit from delegated paper triage before synthesis. For narrow topics, search directly. Researcher outputs go to `<slug>-research-*.md`. For publication-corpus reviews, the lead agent owns identity resolution and writes `notes/<slug>-publications.md` with reachable titles, years, venues, URLs/DOIs, and gaps before delegating trajectory synthesis. Prefer lab publication pages, author profiles, arXiv/OpenReview/Semantic Scholar pages, and paper search results that expose stable source URLs. Do not silently skip assigned questions; mark them `done`, `blocked`, or `superseded`.
+2. **Gather** — Use the `researcher` subagent when the sweep is wide enough to benefit from delegated paper triage before synthesis. For narrow topics, search directly. Researcher outputs go to `outputs/.drafts/<slug>-research-*.md`; pass that path as each researcher's `output`. For publication-corpus reviews, the lead agent owns identity resolution and writes `notes/<slug>-publications.md` with reachable titles, years, venues, URLs/DOIs, and gaps before delegating trajectory synthesis. Prefer lab publication pages, author profiles, arXiv/OpenReview/Semantic Scholar pages, and paper search results that expose stable source URLs. Do not silently skip assigned questions; mark them `done`, `blocked`, or `superseded`.
 3. **Synthesize** — Separate consensus, disagreements, and open questions. For publication-corpus reviews, also identify 3-5 research trajectories and the 3-5 papers that most changed the corpus direction; rank them by contrastive originality, methodology strength, and relationship to prior art rather than by author prestige alone. When useful, propose concrete next experiments or follow-up reading. Use Mermaid diagrams for taxonomies, method pipelines, or lab trajectory maps when the structure is source-supported and changes the reader's research decision. Keep the output to research evidence, source coverage, and next research decisions; do not create non-research operational artifacts from a literature review run.
 4. **Cite** — Spawn the `verifier` agent to add inline citations and verify every source URL in the draft.
 5. **Verify** — Spawn the `reviewer` agent to check the cited draft for unsupported claims, logical gaps, zombie sections, and single-source critical findings. Fix FATAL issues before delivering. Note MAJOR issues in Open Questions. If FATAL issues were found, run one more verification pass after the fixes.

package/prompts/summarize.md

@@ -126,7 +126,7 @@ Use one async workflow with a stable key for each chunk and a concurrency limit
 }
 ```
 
-Consume completion results before aggregation. `runs.all` returns an ordered array including ordinary child failures; inspect each `ok` and error. A validation or infrastructure failure can still fail the workflow. Use actual returned output/artifact references to locate child files, verify them on disk, and copy them to the expected chunk-summary paths when necessary. Record missing or failed chunks rather than treating an async launch receipt as a finished summary.
+Consume completion results before aggregation. `runs.all` returns an ordered array including ordinary child failures; inspect each `ok` and error. A validation or infrastructure failure can still fail the workflow. Relative output paths resolve against the workspace; verify each chunk summary on disk, and use the returned output reference for any that is missing. Record missing or failed chunks rather than treating an async launch receipt as a finished summary.
 
 ### 3d. Aggregate