@companion-ai/feynman 0.5.16 → 0.5.17

package/RELEASES.md

@@ -6,6 +6,14 @@ GitHub release notes are generated from the matching `## vX.Y.Z` section in this
 
 ## Unreleased
 
+## v0.5.17 - 2026-09-30
+
+- **`feynman model login openai` works again.** Since Pi 0.99, Sign in with ChatGPT needs a stable ID for the installation, which Feynman did not pass, so the login failed at once with "requires a device ID (UUID)". Feynman now shares the `deviceId` Pi's own `/login` keeps in `~/.feynman/agent/settings.json`.
+- **Windows finds per-user Git Bash.** Pi looks for Git Bash only under Program Files and on PATH, but a per-user Git for Windows install puts only `Git\cmd` on PATH, so shell commands failed with "No bash shell found" (about one in five Windows installs that run tools). Feynman now finds that Git Bash and gives it to Pi. When there is no Bash at all, Feynman says so before the session starts, and `feynman doctor` reports the `bash` it found.
+- Pressing Enter at the "paste the authorization code / redirect URL" login prompt no longer ends the login with "Missing authorization code"; Feynman asks again, and finishing in the browser still works.
+- API keys are now masked as you paste them during setup, and a key with non-ASCII characters (for example typed with a non-Latin keyboard layout) is rejected with an explanation instead of failing every request with "Cannot convert argument to a ByteString".
+- A rejected `SEMANTIC_SCHOLAR_API_KEY` now says so instead of `request failed: 403 Forbidden`.
+
 ## v0.5.16 - 2026-09-30
 
 - **Subagent research files land in the workspace.** When a workflow gave a subagent a relative output path such as `outputs/.drafts/<slug>-research-web.md`, pi-subagents saved it under `~/.feynman/sessions/subagent-artifacts/outputs/<run>/` instead, so the lead agent could not find the research notes, citations, or verification it asked for (about one in seven installs running research workflows hit this in the last week). Relative subagent outputs now resolve against the workspace, the researcher, reviewer, verifier, and writer no longer default to generic file names such as `research.md`, and `/deepresearch` and `/lit` name every subagent file under `outputs/.drafts/`. If you set `singleRunOutputBaseDir` in `~/.feynman/agent/extensions/subagent/config.json`, Feynman keeps your value.

package/dist/cli.js

@@ -20,7 +20,7 @@ import { ensureFeynmanHome, getDefaultSessionDir, getFeynmanAgentDir, getFeynman
 import { getLastPiStderr, launchPiChat, runPi } from "./pi/launch.js";
 import { installPiPackage, removePiPackage, listOptionalPackagePresets, normalizeOptionalPackagePresetName, resolvePackageSource, updatePiPackages, } from "./pi/packages.js";
 import { canonicalizeModelSpec, ensureFeynmanSettings, normalizeThinkingLevel, readJson, } from "./pi/settings.js";
-import { BUNDLED_PI_PACKAGES, buildPiEnv } from "./pi/runtime.js";
+import { BUNDLED_PI_PACKAGES, buildPiEnv, findWindowsBash, WINDOWS_BASH_MISSING_NOTICE } from "./pi/runtime.js";
 import { getConfiguredServiceTier, normalizeServiceTier, setConfiguredServiceTier } from "./model/service-tier.js";
 import { authenticateModelProvider, getCurrentModelSpec, isLocalModelProvider, loginModelProvider, logoutModelProvider, printModelList, selectDefaultModel, setDefaultModelSpec, } from "./model/commands.js";
 import { buildModelStatusSnapshotFromRecords, getAuthenticatedModelRecords, isProClassModelSpec, getSupportedModelRecords, } from "./model/catalog.js";
@@ -681,6 +681,12 @@ async function runMain(input) {
             preLaunchNotice = buildLocalModelWorkflowNotice(effectiveSpec, command);
         }
     }
+    if (process.platform === "win32" && mode !== "rpc" && mode !== "json" && process.stdout.isTTY) {
+        const shellPath = readJson(feynmanSettingsPath).shellPath;
+        if (typeof shellPath !== "string" && !findWindowsBash()) {
+            preLaunchNotice = [preLaunchNotice, WINDOWS_BASH_MISSING_NOTICE].filter(Boolean).join("\n");
+        }
+    }
     await launchPiChat({
         ...piOptions,
         mode,

package/dist/model/commands.js

@@ -1,8 +1,10 @@
 import { readFileSync, writeFileSync } from "node:fs";
 import { exec as execCallback } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import { dirname, resolve } from "node:path";
 import { promisify } from "node:util";
 import { readJson } from "../pi/settings.js";
-import { promptChoice, promptSelect, promptText } from "../setup/prompts.js";
+import { promptChoice, promptSecret, promptSelect, promptText, validateApiKeyInput } from "../setup/prompts.js";
 import { openUrl } from "../system/open-url.js";
 import { printInfo, printSection, printSuccess, printWarning } from "../ui/terminal.js";
 import { buildModelStatusSnapshotFromRecords, chooseRecommendedModel, getAuthenticatedModelRecords, getAvailableModelRecords, getSupportedModelRecords, isProClassModelSpec, } from "./catalog.js";
@@ -624,7 +626,7 @@ async function configureApiKeyProvider(authPath, providerId) {
     if (provider.envVar) {
         printInfo(`Tip: to avoid writing secrets to disk, set ${provider.envVar} in your shell or .env.`);
     }
-    const apiKey = await promptText("Paste API key (leave empty to use env var instead)", "");
+    const apiKey = await promptSecret("Paste API key (leave empty to use env var instead)", undefined, validateApiKeyInput);
     if (!apiKey) {
         if (provider.envVar) {
             printInfo(`Set ${provider.envVar} and rerun setup (or run \`feynman model list\`).`);
@@ -729,6 +731,17 @@ export async function authenticateModelProvider(authPath, settingsPath) {
     printInfo("Authentication cancelled.");
     return false;
 }
+// Sign in with ChatGPT sends a stable installation ID. Pi's own /login keeps it
+// as `deviceId` in the agent settings.json; share that one.
+export function getOrCreateDeviceId(authPath) {
+    const settingsPath = resolve(dirname(authPath), "settings.json");
+    const settings = readJson(settingsPath);
+    if (typeof settings.deviceId === "string" && settings.deviceId)
+        return settings.deviceId;
+    const deviceId = randomUUID();
+    writeFileSync(settingsPath, `${JSON.stringify({ ...settings, deviceId }, null, 2)}\n`, "utf8");
+    return deviceId;
+}
 export async function loginModelProvider(authPath, providerId, settingsPath) {
     if (providerId) {
         const resolvedProvider = await resolveModelProviderForCommand(authPath, providerId);
@@ -762,7 +775,13 @@ export async function loginModelProvider(authPath, providerId, settingsPath) {
                     hint: option.description,
                 })), undefined, prompt.signal);
             }
-            return promptText(prompt.message, "", prompt.placeholder, prompt.signal);
+            if (prompt.type === "secret") {
+                return promptSecret(prompt.message, prompt.signal);
+            }
+            // An empty answer here fails the login with "Missing authorization code";
+            // keep asking, since the browser callback can still finish meanwhile.
+            const required = prompt.type === "manual_code" ? "Paste the redirect URL or code, or finish signing in in the browser." : undefined;
+            return promptText(prompt.message, "", prompt.placeholder, prompt.signal, required);
         },
         notify: (event) => {
             if (event.type === "auth_url") {
@@ -790,7 +809,7 @@ export async function loginModelProvider(authPath, providerId, settingsPath) {
             }
         },
         signal: abortController.signal,
-    });
+    }, { getDeviceId: () => getOrCreateDeviceId(authPath) });
     printSuccess(`Model provider login complete: ${provider.id}`);
     await maybeSetRecommendedDefaultModel(settingsPath, authPath);
     return true;

package/dist/pi/runtime.js

@@ -1,6 +1,6 @@
 import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { createRequire } from "node:module";
-import { delimiter, dirname, resolve } from "node:path";
+import { delimiter, dirname, resolve, win32 } from "node:path";
 import { BROWSER_FALLBACK_PATHS, MERMAID_FALLBACK_PATHS, PANDOC_FALLBACK_PATHS, resolveExecutable, } from "../system/executables.js";
 import { getPostHogChildEnv } from "../telemetry/posthog.js";
 // Pi packages shipped as Feynman dependencies and loaded from their install
@@ -116,6 +116,31 @@ export function buildPiArgs(options) {
     }
     return args;
 }
+// Pi looks for Git Bash only under Program Files and for bash.exe on PATH. A
+// per-user Git for Windows install (%LOCALAPPDATA%\Programs\Git) puts only
+// Git\cmd on PATH, so Pi reports "No bash shell found" although Git Bash is
+// installed. `addDir` is the Git\bin directory to add to Pi's PATH in that case.
+export function findWindowsBash(env = process.env, exists = existsSync) {
+    const pathDirs = (env.PATH ?? env.Path ?? "").split(";").filter(Boolean);
+    const known = [env.ProgramFiles, env["ProgramFiles(x86)"]]
+        .filter((dir) => Boolean(dir))
+        .map((dir) => win32.join(dir, "Git", "bin", "bash.exe"));
+    const found = [...known, ...pathDirs.map((dir) => win32.join(dir, "bash.exe"))].find(exists);
+    if (found)
+        return { path: found };
+    const gitRoots = [
+        // git.exe lives in Git\cmd or Git\mingw64\bin.
+        ...pathDirs.filter((dir) => exists(win32.join(dir, "git.exe"))).flatMap((dir) => [win32.dirname(dir), win32.dirname(win32.dirname(dir))]),
+        ...(env.LOCALAPPDATA ? [win32.join(env.LOCALAPPDATA, "Programs", "Git")] : []),
+    ];
+    for (const root of gitRoots) {
+        const bash = win32.join(root, "bin", "bash.exe");
+        if (exists(bash))
+            return { path: bash, addDir: win32.join(root, "bin") };
+    }
+    return undefined;
+}
+export const WINDOWS_BASH_MISSING_NOTICE = "No Bash found: Feynman runs shell commands with Bash, so they will fail. Install Git for Windows (https://git-scm.com/download/win), or set shellPath in ~/.feynman/agent/settings.json to another bash.exe.";
 export function buildPiEnv(options, executables) {
     const binPath = [getFeynmanCommandShimDir(options.feynmanAgentDir), resolve(options.appRoot, "node_modules", ".bin")].join(delimiter);
     const pandocPath = process.env.PANDOC_PATH ?? executables?.pandoc ?? resolveExecutable("pandoc", PANDOC_FALLBACK_PATHS);
@@ -123,7 +148,9 @@ export function buildPiEnv(options, executables) {
     const browserPath = process.env.PUPPETEER_EXECUTABLE_PATH ?? executables?.browser ?? resolveExecutable("google-chrome", BROWSER_FALLBACK_PATHS);
     return {
         ...process.env,
-        PATH: `${binPath}${delimiter}${process.env.PATH ?? ""}`,
+        PATH: [binPath, process.env.PATH ?? "", process.platform === "win32" ? findWindowsBash()?.addDir : undefined]
+            .filter(Boolean)
+            .join(delimiter),
         FEYNMAN_VERSION: options.feynmanVersion,
         FEYNMAN_NODE_EXECUTABLE: process.execPath,
         FEYNMAN_BIN_PATH: getFeynmanCliBinPath(options.appRoot),

package/dist/setup/doctor.js

@@ -5,7 +5,7 @@ import { verifyAlphaAuthStatus } from "../alpha-auth-status.js";
 import { formatPiWebAccessDoctorLines, getPiWebAccessStatus } from "../pi/web-access.js";
 import { BROWSER_FALLBACK_PATHS, PANDOC_FALLBACK_PATHS, resolveExecutable } from "../system/executables.js";
 import { readJson } from "../pi/settings.js";
-import { validatePiInstallation } from "../pi/runtime.js";
+import { findWindowsBash, validatePiInstallation, WINDOWS_BASH_MISSING_NOTICE } from "../pi/runtime.js";
 import { isTelemetryDisabled } from "../telemetry/posthog.js";
 import { printInfo, printPanel, printSection } from "../ui/terminal.js";
 import { getCurrentModelSpec } from "../model/commands.js";
@@ -163,6 +163,10 @@ export async function runDoctor(options) {
         }
     }
     console.log(`pandoc: ${pandocPath ?? "missing"}`);
+    if (process.platform === "win32") {
+        const shellPath = settings.shellPath;
+        console.log(`bash: ${typeof shellPath === "string" ? `${shellPath} (shellPath)` : findWindowsBash()?.path ?? `missing. ${WINDOWS_BASH_MISSING_NOTICE}`}`);
+    }
     console.log(`browser preview runtime: ${browserPath ?? "missing"}`);
     for (const line of formatPiWebAccessDoctorLines()) {
         console.log(line);

package/dist/setup/prompts.js

@@ -1,4 +1,4 @@
-import { confirm as clackConfirm, intro as clackIntro, isCancel, multiselect as clackMultiselect, outro as clackOutro, select as clackSelect, text as clackText, } from "@clack/prompts";
+import { confirm as clackConfirm, intro as clackIntro, isCancel, multiselect as clackMultiselect, outro as clackOutro, password as clackPassword, select as clackSelect, text as clackText, } from "@clack/prompts";
 export class SetupCancelledError extends Error {
     constructor(message = "setup cancelled") {
         super(message);
@@ -36,17 +36,30 @@ export async function promptOutro(message) {
     ensureInteractiveTerminal();
     clackOutro(message);
 }
-export async function promptText(question, defaultValue = "", placeholder, signal) {
+export async function promptText(question, defaultValue = "", placeholder, signal, requiredMessage) {
     ensureInteractiveTerminal();
     const value = guardCancelled(await clackText({
         message: question,
         initialValue: defaultValue || undefined,
         placeholder: placeholder ?? (defaultValue || undefined),
         signal,
+        validate: requiredMessage ? (input) => (input?.trim() ? undefined : requiredMessage) : undefined,
     }));
     const normalized = String(value ?? "").trim();
     return normalized || defaultValue;
 }
+export async function promptSecret(question, signal, validate) {
+    ensureInteractiveTerminal();
+    const value = guardCancelled(await clackPassword({ message: question, signal, validate: validate ? (input) => validate((input ?? "").trim()) : undefined }));
+    return String(value ?? "").trim();
+}
+// API keys are printable ASCII. A key typed with a non-Latin keyboard layout
+// fails every request with "Cannot convert argument to a ByteString".
+export function validateApiKeyInput(value) {
+    return /^[\x21-\x7e]*$/.test(value)
+        ? undefined
+        : "API keys contain only ASCII letters, digits, and symbols. Check your keyboard input language and paste the key again.";
+}
 export async function promptSelect(question, options, initialValue, signal) {
     ensureInteractiveTerminal();
     const selection = guardCancelled(await clackSelect({

package/extensions/research-tools/science-databases.ts

@@ -270,6 +270,9 @@ async function fetchSemanticScholar(url: URL): Promise<unknown> {
 		try {
 			return await fetchJson(url, headers);
 		} catch (error) {
+			if (apiKey && error instanceof ScienceDatabaseRequestError && error.status === 403) {
+				throw new ScienceDatabaseRequestError("Semantic Scholar rejected SEMANTIC_SCHOLAR_API_KEY (HTTP 403). Check the key, or unset it to use the shared pool; search with source openalex meanwhile.", 403);
+			}
 			if (!(error instanceof ScienceDatabaseRequestError) || error.status !== 429) throw error;
 			if (attempt >= 1) {
 				throw new ScienceDatabaseRequestError(apiKey

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@companion-ai/feynman",
-  "version": "0.5.16",
+  "version": "0.5.17",
   "description": "Research-first CLI agent built on Pi and alphaXiv",
   "license": "MIT",
   "type": "module",