@companion-ai/feynman 0.5.41 → 0.5.42

package/.feynman/settings.json

@@ -2,5 +2,6 @@
   "theme": "feynman",
   "quietStartup": true,
   "collapseChangelog": true,
-  "editorPaddingX": 1
+  "editorPaddingX": 1,
+  "showHardwareCursor": true
 }

package/.feynman/themes/feynman.json

@@ -1,5 +1,5 @@
 {
-  "$schema": "https://raw.githubusercontent.com/earendil-works/pi/main/packages/coding-agent/src/modes/interactive/theme/theme-schema.json",
+  "$schema": "https://pi.dev/schemas/theme.schema.json",
   "name": "feynman",
   "vars": {
     "ink": "#d3c6aa",

package/RELEASES.md

@@ -6,6 +6,21 @@ GitHub release notes are generated from the matching `## vX.Y.Z` section in this
 
 ## Unreleased
 
+## v0.5.42 - 2026-10-13
+
+- **Pi 1.2.0 and pi-subagents 0.78.0.**
+  - With an OpenRouter key, `/model` lists only the models that key can use, with their real context sizes and prices.
+  - "The upstream provider returned an error" is retried instead of ending the turn, and Anthropic requests rejected for too many strict tools are retried once.
+  - `feynman -p` warns and exits 1 when the answer was cut off at the model's output limit.
+  - On Windows, reading or writing saved logins no longer fails with `EPERM` while an old lock is cleaned up.
+  - Pressing `Esc` keeps a research run stopped; a subagent finishing a moment later no longer restarts it.
+  - Reports are no longer overwritten when a subagent run is resumed, and a timed-out subagent's partial output reaches the lead agent.
+  - The `workflowScript contains dynamic child launches` warning no longer prints on every parallel run.
+- **`feynman model login` offers every provider Pi supports with an API key.** That is 41 providers instead of Feynman's own list of 16, adding DeepSeek, Fireworks, Together, NVIDIA, Google Vertex, Cloudflare, Qwen and others. Pi now asks for what each provider needs, so Cloudflare's extra fields and Bedrock's profile or bearer-token options work. Pressing Enter on an empty key no longer saves an empty credential.
+- **Turning off Feynman's telemetry also turns off Pi's.** `FEYNMAN_TELEMETRY=off` (or `DO_NOT_TRACK=1`) now sets Pi's own `PI_TELEMETRY=0` for its install reporting.
+- Feynman now honors Pi's own `sessionDir` setting and `PI_CODING_AGENT_SESSION_DIR` when you don't pass `--session-dir`.
+- `feynman model set` and the default-model check use Pi's settings API, so they match what Pi launches with (including trusted project settings).
+
 ## v0.5.41 - 2026-10-12
 
 - **A fresh `npm install` works again.** Pi 1.2.0, released today, made new npm installs of Feynman 0.5.40 fail on every command except `-v` (`does not provide an export named 'MCP_TYPESCRIPT_PREAMBLE'`). Pi 1.1.0 asks for its own sub-packages with open version ranges, so npm pulled Pi 1.2.0's copies. Feynman now pins those sub-packages to the Pi version it ships. The curl and PowerShell installers were not affected.

package/dist/cli.js

@@ -29,6 +29,7 @@ import { fetchLatestFeynmanVersion, getFeynmanUpgradeLines, isNewerVersion } fro
 import { runDoctor, runStatus } from "./setup/doctor.js";
 import { setupPreviewDependencies } from "./setup/preview.js";
 import { runSetup } from "./setup/setup.js";
+import { SettingsManager } from "@earendil-works/pi-coding-agent";
 import { noModelMessage } from "./setup/prompts.js";
 import { captureTelemetryEvent, captureTelemetryException, getCliTelemetryMetadata, initializePostHogTelemetry, shutdownPostHogTelemetry, telemetryErrorProperties, telemetryFirstRunNotice, } from "./telemetry/posthog.js";
 import { ASH, printAsciiHeader, printInfo, printPanel, printSection, RESET, SAGE } from "./ui/terminal.js";
@@ -516,7 +517,12 @@ async function runMain(input) {
         throw new Error("Unable to determine the installed Feynman version.");
     }
     const workingDir = resolve(values.cwd ?? process.cwd());
-    const sessionDir = resolve(values["session-dir"] ?? getDefaultSessionDir(feynmanHome));
+    // Pi's order: --session-dir, then PI_CODING_AGENT_SESSION_DIR, then the sessionDir
+    // setting; Feynman's own default comes last.
+    const sessionDir = resolve(workingDir, values["session-dir"] ??
+        process.env.PI_CODING_AGENT_SESSION_DIR ??
+        SettingsManager.create(workingDir, feynmanAgentDir).getSessionDir() ??
+        getDefaultSessionDir(feynmanHome));
     const feynmanSettingsPath = resolve(feynmanAgentDir, "settings.json");
     const feynmanAuthPath = resolve(feynmanAgentDir, "auth.json");
     const { defaultThinkingLevel, launchThinkingLevel } = resolveThinkingConfig(values.thinking ?? process.env.FEYNMAN_THINKING);

package/dist/model/commands.js

@@ -1,9 +1,8 @@
 import { SettingsManager } from "@earendil-works/pi-coding-agent";
-import { readFileSync, writeFileSync } from "node:fs";
+import { readFileSync } from "node:fs";
 import { exec as execCallback } from "node:child_process";
 import { dirname } from "node:path";
 import { promisify } from "node:util";
-import { readJson } from "../pi/settings.js";
 import { promptChoice, promptSecret, promptSelect, promptText, SetupCancelledError, validateApiKeyInput } from "../setup/prompts.js";
 import { openUrl } from "../system/open-url.js";
 import { printInfo, printSection, printSuccess, printWarning } from "../ui/terminal.js";
@@ -54,19 +53,32 @@ async function selectOAuthProvider(authPath, action) {
     }
     return selection;
 }
-function resolveApiKeyProvider(input) {
+// Endpoints Pi has no API-key sign-in for: Feynman writes their models.json entry.
+const LOCAL_API_KEY_SETUPS = MODEL_API_KEY_PROVIDERS.filter((provider) => ["lm-studio", "litellm", "__custom__"].includes(provider.id));
+// Every provider Pi can sign in to with an API key (its own list, labels and
+// prompts), plus Feynman's local and custom endpoint setups.
+export async function listApiKeyProviders(authPath) {
+    const envVars = new Map(MODEL_API_KEY_PROVIDERS.map((provider) => [provider.id, provider.envVar]));
+    const piProviders = (await createModelRuntime(authPath))
+        .getProviders()
+        .filter((provider) => provider.auth.apiKey)
+        .map((provider) => ({ id: provider.id, label: provider.name, envVar: envVars.get(provider.id) }))
+        .sort((left, right) => left.label.localeCompare(right.label));
+    return [...piProviders, ...LOCAL_API_KEY_SETUPS];
+}
+async function resolveApiKeyProvider(authPath, input) {
     const normalizedInput = normalizeProviderId(input);
     if (!normalizedInput) {
         return undefined;
     }
-    return MODEL_API_KEY_PROVIDERS.find((provider) => provider.id === normalizedInput);
+    return (await listApiKeyProviders(authPath)).find((provider) => provider.id === normalizedInput);
 }
 export async function resolveModelProviderForCommand(authPath, input) {
     const oauthProvider = await resolveOAuthProvider(authPath, input);
     if (oauthProvider) {
         return { kind: "oauth", id: oauthProvider.id };
     }
-    const apiKeyProvider = resolveApiKeyProvider(input);
+    const apiKeyProvider = await resolveApiKeyProvider(authPath, input);
     if (apiKeyProvider) {
         return { kind: "api-key", id: apiKeyProvider.id };
     }
@@ -84,14 +96,15 @@ function apiKeyProviderHint(provider) {
     }
     return provider.envVar ?? provider.id;
 }
-async function selectApiKeyProvider() {
-    const options = MODEL_API_KEY_PROVIDERS.map((provider) => ({
+async function selectApiKeyProvider(authPath) {
+    const providers = await listApiKeyProviders(authPath);
+    const options = providers.map((provider) => ({
         value: provider,
         label: provider.label,
         hint: apiKeyProviderHint(provider),
     }));
     options.push({ value: "cancel", label: "Cancel" });
-    const defaultProvider = MODEL_API_KEY_PROVIDERS.find((provider) => provider.id === "openai") ?? MODEL_API_KEY_PROVIDERS[0];
+    const defaultProvider = providers.find((provider) => provider.id === "openai") ?? providers[0];
     const selection = await promptSelect("Choose an API-key provider:", options, defaultProvider);
     if (selection === "cancel") {
         return undefined;
@@ -501,36 +514,6 @@ async function verifyCustomProvider(setup, authPath) {
     }
     printInfo("Verification: skipped network probe for this API mode.");
 }
-async function verifyBedrockCredentialChain() {
-    const { defaultProvider } = await import("@aws-sdk/credential-provider-node");
-    const credentials = await defaultProvider({})();
-    if (!credentials?.accessKeyId || !credentials?.secretAccessKey) {
-        throw new Error("AWS credential chain resolved without usable Bedrock credentials.");
-    }
-}
-async function configureBedrockProvider(authPath) {
-    printSection("AWS Credentials: Amazon Bedrock");
-    printInfo("Feynman will verify the AWS SDK credential chain used by Pi's Bedrock provider.");
-    printInfo("Supported sources include AWS_PROFILE, ~/.aws credentials/config, SSO, ECS/IRSA, and EC2 instance roles.");
-    try {
-        await verifyBedrockCredentialChain();
-        const modelRuntime = await createModelRuntime(authPath);
-        if (!(await modelRuntime.checkAuth("amazon-bedrock"))) {
-            throw new Error("Pi could not resolve the verified AWS credential chain for Amazon Bedrock.");
-        }
-        printSuccess("Verified the AWS credential chain used by Amazon Bedrock.");
-        printInfo("Use `feynman model list` to see available Bedrock models.");
-        return true;
-    }
-    catch (error) {
-        printWarning(`AWS credential verification failed: ${error instanceof Error ? error.message : String(error)}`);
-        printInfo("Configure AWS credentials first, for example:");
-        printInfo("  export AWS_PROFILE=default");
-        printInfo("  # or set AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY");
-        printInfo("  # or use an EC2/ECS/IRSA role with valid Bedrock access");
-        return false;
-    }
-}
 async function maybeSetRecommendedDefaultModel(settingsPath, authPath) {
     if (!settingsPath) {
         return;
@@ -546,7 +529,7 @@ async function maybeSetRecommendedDefaultModel(settingsPath, authPath) {
     }
 }
 async function configureApiKeyProvider(authPath, providerId) {
-    const provider = providerId ? resolveApiKeyProvider(providerId) : await selectApiKeyProvider();
+    const provider = providerId ? await resolveApiKeyProvider(authPath, providerId) : await selectApiKeyProvider(authPath);
     if (!provider) {
         if (providerId) {
             throw new Error(`Unknown API-key model provider: ${providerId}`);
@@ -554,9 +537,6 @@ async function configureApiKeyProvider(authPath, providerId) {
         printInfo("API key setup cancelled.");
         return false;
     }
-    if (provider.id === "amazon-bedrock") {
-        return configureBedrockProvider(authPath);
-    }
     if (provider.id === "lm-studio") {
         const setup = await promptLmStudioProviderSetup();
         if (!setup) {
@@ -627,22 +607,34 @@ async function configureApiKeyProvider(authPath, providerId) {
     if (provider.envVar) {
         printInfo(`Tip: to avoid writing secrets to disk, set ${provider.envVar} in your shell or .env.`);
     }
-    const apiKey = await promptSecret("Paste API key (leave empty to use env var instead)", undefined, validateApiKeyInput);
-    if (!apiKey) {
-        if (provider.envVar) {
-            printInfo(`Set ${provider.envVar} and rerun setup (or run \`feynman model list\`).`);
-        }
-        else {
-            printInfo("No API key provided.");
-        }
-        return false;
-    }
+    // Pi asks for whatever this provider needs (a key, or e.g. Cloudflare's account
+    // and gateway, Bedrock's profile or token). Esc cancels.
     const modelRuntime = await createModelRuntime(authPath);
-    await modelRuntime.login(provider.id, "api_key", {
-        prompt: async () => apiKey,
-        notify: () => undefined,
+    const interaction = terminalAuthInteraction(provider.label, new AbortController().signal);
+    const signedIn = await modelRuntime
+        .login(provider.id, "api_key", {
+        ...interaction,
+        prompt: async (prompt) => {
+            if (prompt.type !== "secret")
+                return interaction.prompt(prompt);
+            const secret = await promptSecret(prompt.message, prompt.signal, validateApiKeyInput);
+            // An empty key would be saved as a credential that fails every request.
+            if (!secret)
+                throw new SetupCancelledError("no API key entered");
+            return secret;
+        },
+    })
+        .then(() => true)
+        .catch((error) => {
+        if (!(error instanceof SetupCancelledError))
+            throw error;
+        if (provider.envVar)
+            printInfo(`Or set ${provider.envVar} and run feynman again.`);
+        return false;
     });
-    printSuccess(`Saved API key for ${provider.id} in auth storage.`);
+    if (!signedIn)
+        return false;
+    printSuccess(`Saved ${provider.label} credentials in auth storage.`);
     const baseUrl = await promptText("Base URL override (optional, include /v1 for OpenAI-compatible endpoints)", "");
     if (baseUrl) {
         const modelsJsonPath = getModelsJsonPath(authPath);
@@ -683,12 +675,12 @@ async function resolveAvailableModelSpec(authPath, input) {
     }
     return undefined;
 }
+// The default model Pi will launch with, read through Pi's SettingsManager.
 export function getCurrentModelSpec(settingsPath) {
-    const settings = readJson(settingsPath);
-    if (typeof settings.defaultProvider === "string" && typeof settings.defaultModel === "string") {
-        return `${settings.defaultProvider}/${settings.defaultModel}`;
-    }
-    return undefined;
+    const settings = SettingsManager.create(process.cwd(), dirname(settingsPath));
+    const provider = settings.getDefaultProvider();
+    const model = settings.getDefaultModel();
+    return provider && model ? `${provider}/${model}` : undefined;
 }
 export async function printModelList(settingsPath, authPath) {
     const status = await collectModelStatus(settingsPath, authPath);
@@ -758,32 +750,9 @@ export function describeOAuthLoginFailure(providerId, error) {
 async function refreshProviderModels(modelRuntime, providerId) {
     await modelRuntime.refresh({ providers: [providerId], allowNetwork: true, signal: AbortSignal.timeout(15_000) }).catch(() => undefined);
 }
-export async function loginModelProvider(authPath, providerId, settingsPath) {
-    if (providerId) {
-        const resolvedProvider = await resolveModelProviderForCommand(authPath, providerId);
-        if (!resolvedProvider) {
-            throw new Error(`Unknown model provider: ${providerId}`);
-        }
-        if (resolvedProvider.kind === "api-key") {
-            const configured = await configureApiKeyProvider(authPath, resolvedProvider.id);
-            if (configured) {
-                await maybeSetRecommendedDefaultModel(settingsPath, authPath);
-            }
-            return configured;
-        }
-    }
-    const provider = providerId ? await resolveOAuthProvider(authPath, providerId) : await selectOAuthProvider(authPath, "login");
-    if (!provider) {
-        if (providerId) {
-            throw new Error(`Unknown model provider: ${providerId}`);
-        }
-        printInfo("Login cancelled.");
-        return false;
-    }
-    const modelRuntime = await createModelRuntime(authPath);
-    const abortController = new AbortController();
-    const deviceId = await getOrCreateDeviceId(authPath);
-    await modelRuntime.login(provider.id, "oauth", {
+// Runs Pi's own login prompts (selects, secrets, text, browser URLs) in the terminal.
+function terminalAuthInteraction(providerLabel, signal) {
+    return {
         prompt: async (prompt) => {
             if (prompt.type === "select") {
                 return promptSelect(prompt.message, prompt.options.map((option) => ({
@@ -802,7 +771,7 @@ export async function loginModelProvider(authPath, providerId, settingsPath) {
         },
         notify: (event) => {
             if (event.type === "auth_url") {
-                printSection(`Login: ${provider.name ?? provider.id}`);
+                printSection(`Login: ${providerLabel}`);
                 if (openUrl(event.url)) {
                     printInfo("Opened the login URL in your browser.");
                 }
@@ -816,7 +785,7 @@ export async function loginModelProvider(authPath, providerId, settingsPath) {
                 return;
             }
             if (event.type === "device_code") {
-                printSection(`Login: ${provider.name ?? provider.id}`);
+                printSection(`Login: ${providerLabel}`);
                 printInfo(`Visit ${event.verificationUri} and enter code: ${event.userCode}`);
                 openUrl(event.verificationUri);
                 return;
@@ -825,8 +794,35 @@ export async function loginModelProvider(authPath, providerId, settingsPath) {
                 printInfo(event.message);
             }
         },
-        signal: abortController.signal,
-    }, { getDeviceId: () => deviceId }).catch((error) => {
+        signal,
+    };
+}
+export async function loginModelProvider(authPath, providerId, settingsPath) {
+    if (providerId) {
+        const resolvedProvider = await resolveModelProviderForCommand(authPath, providerId);
+        if (!resolvedProvider) {
+            throw new Error(`Unknown model provider: ${providerId}`);
+        }
+        if (resolvedProvider.kind === "api-key") {
+            const configured = await configureApiKeyProvider(authPath, resolvedProvider.id);
+            if (configured) {
+                await maybeSetRecommendedDefaultModel(settingsPath, authPath);
+            }
+            return configured;
+        }
+    }
+    const provider = providerId ? await resolveOAuthProvider(authPath, providerId) : await selectOAuthProvider(authPath, "login");
+    if (!provider) {
+        if (providerId) {
+            throw new Error(`Unknown model provider: ${providerId}`);
+        }
+        printInfo("Login cancelled.");
+        return false;
+    }
+    const modelRuntime = await createModelRuntime(authPath);
+    const abortController = new AbortController();
+    const deviceId = await getOrCreateDeviceId(authPath);
+    await modelRuntime.login(provider.id, "oauth", terminalAuthInteraction(provider.name ?? provider.id, abortController.signal), { getDeviceId: () => deviceId }).catch((error) => {
         throw describeOAuthLoginFailure(provider.id, error);
     });
     printSuccess(`Model provider login complete: ${provider.id}`);
@@ -888,11 +884,10 @@ export async function setDefaultModelSpec(settingsPath, authPath, spec) {
         throw new Error(await describeUnavailableModelSpec(authPath, spec));
     }
     const [provider, ...rest] = resolvedSpec.split("/");
-    const modelId = rest.join("/");
-    const settings = readJson(settingsPath);
-    settings.defaultProvider = provider;
-    settings.defaultModel = modelId;
-    writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + "\n", "utf8");
+    // Pi's SettingsManager merges only the changed keys under its lock.
+    const settings = SettingsManager.create(process.cwd(), dirname(settingsPath));
+    settings.setDefaultModelAndProvider(provider, rest.join("/"));
+    await settings.flush();
     printSuccess(`Research default model set to ${resolvedSpec}`);
 }
 export async function selectDefaultModel(settingsPath, authPath) {

package/dist/pi/runtime.js

@@ -2,7 +2,7 @@ import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "n
 import { createRequire } from "node:module";
 import { delimiter, dirname, resolve, win32 } from "node:path";
 import { MERMAID_FALLBACK_PATHS, PANDOC_FALLBACK_PATHS, resolveBrowser, resolveExecutable, } from "../system/executables.js";
-import { getPostHogChildEnv } from "../telemetry/posthog.js";
+import { getPostHogChildEnv, isTelemetryDisabled } from "../telemetry/posthog.js";
 // Pi packages shipped as Feynman dependencies and loaded from their install
 // paths through settings.json `packages` (Pi's documented local-path source).
 export const BUNDLED_PI_PACKAGES = ["pi-subagents", "pi-web-access", "pi-docparser", "pi-btw"];
@@ -156,8 +156,9 @@ export function buildPiEnv(options, executables) {
         FEYNMAN_BIN_PATH: getFeynmanCliBinPath(options.appRoot),
         PI_CODING_AGENT_DIR: options.feynmanAgentDir,
         PANDOC_PATH: pandocPath,
-        PI_HARDWARE_CURSOR: process.env.PI_HARDWARE_CURSOR ?? "1",
         PI_SKIP_VERSION_CHECK: process.env.PI_SKIP_VERSION_CHECK ?? "1",
+        // A Feynman telemetry opt-out also turns off Pi's install telemetry (docs/environment-variables.md).
+        ...(isTelemetryDisabled() && process.env.PI_TELEMETRY === undefined ? { PI_TELEMETRY: "0" } : {}),
         MERMAID_CLI_PATH: mermaidPath,
         PUPPETEER_EXECUTABLE_PATH: browserPath,
         ...getPostHogChildEnv(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@companion-ai/feynman",
-  "version": "0.5.41",
+  "version": "0.5.42",
   "description": "The open source AI research agent.",
   "license": "MIT",
   "type": "module",
@@ -79,21 +79,20 @@
   "dependencies": {
     "@clack/prompts": "^1.8.1",
     "@companion-ai/alpha-hub": "0.1.7",
-    "@earendil-works/chord": "1.1.0",
-    "@earendil-works/pi-codemode": "1.1.0",
-    "@earendil-works/pi-mcp": "1.1.0",
-    "@earendil-works/pi-telemetry": "1.1.0",
+    "@earendil-works/pi-codemode": "1.2.0",
+    "@earendil-works/pi-mcp": "1.2.0",
+    "@earendil-works/pi-telemetry": "1.2.0",
     "fast-xml-parser": "5.11.1",
     "pi-btw": "0.8.0",
     "pi-docparser": "4.0.0",
-    "pi-subagents": "0.77.0",
+    "pi-subagents": "0.78.0",
     "pi-web-access": "0.39.0",
     "posthog-node": "^5.53.0"
   },
   "peerDependencies": {
-    "@earendil-works/pi-agent-core": "1.1.0",
-    "@earendil-works/pi-ai": "1.1.0",
-    "@earendil-works/pi-coding-agent": "1.1.0",
+    "@earendil-works/pi-agent-core": "1.2.0",
+    "@earendil-works/pi-ai": "1.2.0",
+    "@earendil-works/pi-coding-agent": "1.2.0",
     "@earendil-works/pi-tui": "*",
     "typebox": "*"
   },