@companion-ai/feynman 0.5.68 → 0.5.70

package/README.md

@@ -59,7 +59,7 @@ Results are saved to `outputs/` (drafts to `papers/`). `/lit`, `/deepresearch`,
 
 ## Sources
 
-Feynman searches alphaXiv, Semantic Scholar, OpenAlex, arXiv, PubMed, Europe PMC, bioRxiv, medRxiv, Crossref, the web, and Hugging Face, and reads local PDFs and documents. Free `OPENALEX_API_KEY` and `SEMANTIC_SCHOLAR_API_KEY` keys avoid the shared rate limits. It runs on stock [Pi](https://github.com/earendil-works/pi) with four research agents: researcher, verifier, reviewer, and writer. Add your own tools, such as a Zotero library, with `feynman mcp add`.
+Feynman searches alphaXiv, Semantic Scholar, OpenAlex, arXiv, PubMed, Europe PMC, bioRxiv, medRxiv, Crossref, the web, and Hugging Face, and reads local PDFs and documents. Free `OPENALEX_API_KEY` and `SEMANTIC_SCHOLAR_API_KEY` keys avoid the shared rate limits. PubMed and Europe PMC full-text snippets preserve inline scientific terms and paragraph boundaries. It runs on stock [Pi](https://github.com/earendil-works/pi) with four research agents: researcher, verifier, reviewer, and writer. Add your own tools, such as a Zotero library, with `feynman mcp add`.
 
 ## Telemetry
 

package/RELEASES.md

@@ -6,6 +6,16 @@ GitHub release notes are generated from the matching `## vX.Y.Z` section in this
 
 ## Unreleased
 
+## v0.5.70 - 2026-11-14
+
+- **Security patch: fast-xml-parser 5.12.1 and fast-xml-builder 1.3.2.** Fixes a quadratic-time attribute scan in the XML validator ([GHSA-7cfw-w2rf-f3jc](https://github.com/advisories/GHSA-7cfw-w2rf-f3jc)) and an uncontrolled recursion crash in the XML builder ([GHSA-g62r-xqpr-7fwx](https://github.com/advisories/GHSA-g62r-xqpr-7fwx)). arXiv, PubMed, and Europe PMC results parse the same as before.
+
+## v0.5.69 - 2026-11-13
+
+- **pi-subagents 0.88.1.** A permission prompt or other dialog that opens while the fleet inspector is up is no longer hidden behind it. `status` and `stop` no longer report a cleanly finishing background subagent as having ended without proof, and a manual `/compact` no longer wakes an idle parent while background subagents run.
+- **Preserve JATS inline text.** PubMed and Europe PMC full-text results keep words inside inline markup in their original order, including subscripts and superscripts, without joining adjacent paragraphs. Section snippet limits and metadata are unchanged.
+- **Patched hono.** Alpha Hub's MCP SDK now resolves hono 4.13.18 and @hono/node-server 2.1.8, which fix advisories published on November 12 (GHSA-4m76-xfj5-7975, GHSA-46wx-v44x-9hh2, GHSA-4h7h-rv7c-7m2v, GHSA-qv5m-9pm6-hqp3, GHSA-jpvv-r467-5p4w).
+
 ## v0.5.68 - 2026-11-11
 
 - **pi-subagents 0.88.0.** A child waiting for your answer no longer runs out its `timeoutMs` while it waits, and a reply cut off at the model's output limit now fails instead of passing as a success. The subagent widget and `status` show the latest progress a running child reported. Copies of the parent session written by forked subagents are now deleted after `artifactConfig.cleanupDays`, so they no longer fill the disk. Also fixes Windows machines that block PowerShell and gateways that require a prompt cache key.

package/extensions/research-tools/jats-text.ts

@@ -0,0 +1,65 @@
+import { XMLParser } from "fast-xml-parser";
+
+// Keep mixed content in document order; object-mode XML groups repeated tags
+// and moves their surrounding text into a separate #text property.
+const parser = new XMLParser({
+	preserveOrder: true,
+	ignoreAttributes: false,
+	removeNSPrefix: true,
+	trimValues: false,
+	parseTagValue: false,
+});
+
+const blockTags = new Set([
+	"abstract", "sec", "title", "p", "caption", "label", "list", "list-item",
+	"def-list", "def-item", "term", "def", "disp-quote", "verse-line", "break",
+	"tr", "td", "th",
+]);
+
+function entries(value: unknown): Array<[string, unknown]> {
+	return value && typeof value === "object" && !Array.isArray(value)
+		? Object.entries(value).filter(([key]) => key !== ":@" && !key.startsWith("?"))
+		: [];
+}
+
+export function parseOrderedJats(xml: string): unknown {
+	return parser.parse(xml);
+}
+
+export function jatsChildren(value: unknown, tag: string): unknown[] {
+	return (Array.isArray(value) ? value : [value]).flatMap((node) =>
+		entries(node).filter(([key]) => key === tag).map(([, children]) => children));
+}
+
+export function jatsNodes(value: unknown, tag: string): unknown[] {
+	if (Array.isArray(value)) return value.flatMap((node) => jatsNodes(node, tag));
+	return entries(value).flatMap(([key, children]) => [
+		...(key === tag ? [value] : []),
+		...jatsNodes(children, tag),
+	]);
+}
+
+export function jatsDescendants(value: unknown, tag: string): unknown[] {
+	return jatsNodes(value, tag).flatMap((node) => jatsChildren(node, tag));
+}
+
+export function jatsAttribute(node: unknown, name: string): string | undefined {
+	if (!node || typeof node !== "object") return undefined;
+	const attributes = (node as Record<string, unknown>)[":@"];
+	if (!attributes || typeof attributes !== "object") return undefined;
+	const value = (attributes as Record<string, unknown>)[`@_${name}`];
+	return typeof value === "string" && value.trim() ? value.trim() : undefined;
+}
+
+export function jatsText(value: unknown, excludedTags = new Set<string>()): string {
+	function text(node: unknown): string {
+		if (typeof node === "string" || typeof node === "number") return String(node);
+		if (Array.isArray(node)) return node.map(text).join("");
+		return entries(node).map(([tag, children]) => {
+			if (excludedTags.has(tag)) return " ";
+			const content = text(children);
+			return blockTags.has(tag) ? ` ${content} ` : content;
+		}).join("");
+	}
+	return text(value).replace(/\s+/g, " ").trim();
+}

package/extensions/research-tools/science-database-europepmc-fulltext.ts

@@ -2,6 +2,8 @@ export type EuropePmcFullTextSearchParams = { limit?: number; query: string };
 
 import { XMLParser } from "fast-xml-parser";
 
+import { jatsAttribute, jatsChildren, jatsDescendants, jatsNodes, jatsText, parseOrderedJats } from "./jats-text.js";
+
 const DEFAULT_LIMIT = 2;
 const MAX_LIMIT = 5;
 const REQUEST_TIMEOUT_MS = 30_000;
@@ -246,19 +248,6 @@ async function availabilityFor(input: InputId): Promise<{ endpoint: string; reco
 	};
 }
 
-function nodeText(value: unknown, excludedKeys = new Set<string>()): string {
-	if (typeof value === "string" || typeof value === "number") return String(value);
-	if (Array.isArray(value)) return value.map((item) => nodeText(item, excludedKeys)).join(" ");
-	const record = recordValue(value);
-	return Object.entries(record)
-		.filter(([key]) => key === "#text" || (!key.startsWith("@_") && key !== "#text"))
-		.filter(([key]) => !excludedKeys.has(key))
-		.map(([, item]) => nodeText(item, excludedKeys))
-		.join(" ")
-		.replace(/\s+/g, " ")
-		.trim();
-}
-
 function findFirst(value: unknown, key: string): unknown {
 	const record = recordValue(value);
 	if (Object.prototype.hasOwnProperty.call(record, key)) return record[key];
@@ -327,10 +316,15 @@ function parseJats(xml: string): Record<string, unknown> {
 	const article = recordValue(parsed.article);
 	const body = recordValue(findFirst(article, "body"));
 	const sectionNodes = arrayValue(body.sec);
+	const orderedArticle = jatsChildren(parseOrderedJats(xml), "article")[0];
+	const orderedBody = jatsDescendants(orderedArticle, "body")[0];
+	const orderedSections = jatsChildren(orderedBody, "sec");
+	const orderedFigures = jatsNodes(orderedArticle, "fig");
+	const orderedTables = jatsNodes(orderedArticle, "table-wrap");
 	const sections = sectionNodes.map((section, index) => {
 		const record = recordValue(section);
-		const title = truncateText(nodeText(record.title), 240);
-		const text = nodeText(record, new Set(["fig", "table-wrap", "ref-list"]));
+		const title = truncateText(jatsText(jatsChildren(orderedSections[index], "title")[0]), 240);
+		const text = jatsText(orderedSections[index], new Set(["fig", "table-wrap", "ref-list"]));
 		return {
 			index,
 			title,
@@ -340,26 +334,25 @@ function parseJats(xml: string): Record<string, unknown> {
 			textSnippet: truncateText(text, SECTION_TEXT_SNIPPET_CHARS),
 		};
 	});
-	const figureCaptions = collectNodes(article, "fig").slice(0, MAX_CAPTIONS_RETURNED).map((node) => {
-		const record = recordValue(node);
+	const figureCaptions = orderedFigures.slice(0, MAX_CAPTIONS_RETURNED).map((node) => {
+		const children = jatsChildren(node, "fig")[0];
 		return {
-			id: stringValue(record["@_id"]),
-			label: truncateText(nodeText(record.label), 80),
-			caption: truncateText(nodeText(record.caption), 600),
+			id: jatsAttribute(node, "id"),
+			label: truncateText(jatsText(jatsChildren(children, "label")[0]), 80),
+			caption: truncateText(jatsText(jatsChildren(children, "caption")[0]), 600),
 		};
 	});
-	const tableCaptions = collectNodes(article, "table-wrap").slice(0, MAX_CAPTIONS_RETURNED).map((node) => {
-		const record = recordValue(node);
+	const tableCaptions = orderedTables.slice(0, MAX_CAPTIONS_RETURNED).map((node) => {
+		const children = jatsChildren(node, "table-wrap")[0];
 		return {
-			id: stringValue(record["@_id"]),
-			label: truncateText(nodeText(record.label), 80),
-			caption: truncateText(nodeText(record.caption), 600),
+			id: jatsAttribute(node, "id"),
+			label: truncateText(jatsText(jatsChildren(children, "label")[0]), 80),
+			caption: truncateText(jatsText(jatsChildren(children, "caption")[0]), 600),
 		};
 	});
-	const abstractCandidates = arrayValue(findFirst(article, "abstract"));
-	const abstract = truncateText(nodeText(abstractCandidates[0]), ABSTRACT_SNIPPET_CHARS);
+	const abstract = truncateText(jatsText(jatsDescendants(orderedArticle, "abstract")[0]), ABSTRACT_SNIPPET_CHARS);
 	return {
-		title: truncateText(nodeText(findFirst(article, "article-title")), 500),
+		title: truncateText(jatsText(jatsDescendants(orderedArticle, "article-title")[0]), 500),
 		abstract,
 		sectionCount: sections.length,
 		sectionInventory: sections.map((section) => ({

package/extensions/research-tools/science-database-pubmed-parsers.ts

@@ -1,5 +1,7 @@
 import { XMLParser } from "fast-xml-parser";
 
+import { jatsChildren, jatsText, parseOrderedJats } from "./jats-text.js";
+
 const SECTION_TEXT_SNIPPET_CHARS = 1_200;
 const MAX_SECTIONS_RETURNED = 10;
 
@@ -214,29 +216,23 @@ function truncateText(value: string | undefined, limit: number): string | undefi
 	return clean.length > limit ? `${clean.slice(0, limit).trimEnd()}...` : clean;
 }
 
-function sectionText(section: unknown): string {
-	const record = recordValue(section);
-	const title = textValue(record.title);
-	const bodyParts = Object.entries(record)
-		.filter(([key]) => !key.startsWith("@_") && !["title", "fig", "table-wrap", "sec"].includes(key))
-		.map(([, value]) => textValue(value))
-		.filter((value): value is string => Boolean(value));
-	return [title, ...bodyParts].filter(Boolean).join(" ").replace(/\s+/g, " ").trim();
-}
-
 export function parseFullTextXml(xml: string, pmcid: string, fallback: Record<string, unknown> = {}): Record<string, unknown> {
 	const parsed = recordValue(xmlParser.parse(xml));
 	const article = recordValue(parsed.article);
 	const meta = recordValue(recordValue(article.front)["article-meta"]);
-	const body = recordValue(article.body);
-	const sections = listValue(body.sec)
+	const orderedArticle = jatsChildren(parseOrderedJats(xml), "article")[0];
+	const orderedFront = jatsChildren(orderedArticle, "front")[0];
+	const orderedMeta = jatsChildren(orderedFront, "article-meta")[0];
+	const orderedBody = jatsChildren(orderedArticle, "body")[0];
+	const orderedTitleGroup = jatsChildren(orderedMeta, "title-group")[0];
+	const orderedAbstract = jatsChildren(orderedMeta, "abstract")[0];
+	const sections = jatsChildren(orderedBody, "sec")
 		.map((section, index) => {
-			const record = recordValue(section);
-			const title = textValue(record.title) ?? `Section ${index + 1}`;
+			const title = jatsText(jatsChildren(section, "title")[0]) || `Section ${index + 1}`;
 			return {
 				index: index + 1,
 				title,
-				textSnippet: truncateText(sectionText(section), SECTION_TEXT_SNIPPET_CHARS),
+				textSnippet: truncateText(jatsText(section, new Set(["fig", "table-wrap", "sec"])), SECTION_TEXT_SNIPPET_CHARS),
 			};
 		})
 		.filter((section) => section.textSnippet)
@@ -250,8 +246,8 @@ export function parseFullTextXml(xml: string, pmcid: string, fallback: Record<st
 		pmcid,
 		pmid: jatsArticleId(meta, "pmid") ?? stringValue(fallback.pmid),
 		doi: jatsArticleId(meta, "doi") ?? stringValue(fallback.doi),
-		title: textValue(recordValue(meta["title-group"])["article-title"]) ?? stringValue(fallback.title),
-		abstract: truncateText(textValue(recordValue(meta.abstract).p), 2_000) ?? stringValue(fallback.abstractText),
+		title: jatsText(jatsChildren(orderedTitleGroup, "article-title")[0]) || stringValue(fallback.title),
+		abstract: truncateText(jatsChildren(orderedAbstract, "p").map((p) => jatsText(p)).join(" "), 2_000) ?? stringValue(fallback.abstractText),
 		fullTextStatus: "retrieved",
 		fullTextAvailable: true,
 		sectionCount: sections.length,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@companion-ai/feynman",
-  "version": "0.5.68",
+  "version": "0.5.70",
   "description": "The open source AI research agent.",
   "license": "MIT",
   "type": "module",
@@ -82,10 +82,10 @@
     "@earendil-works/pi-codemode": "1.5.2",
     "@earendil-works/pi-mcp": "1.5.2",
     "@earendil-works/pi-telemetry": "1.5.2",
-    "fast-xml-parser": "5.12.0",
+    "fast-xml-parser": "5.12.1",
     "pi-btw": "0.8.1",
     "pi-docparser": "4.0.0",
-    "pi-subagents": "0.88.0",
+    "pi-subagents": "0.88.1",
     "pi-web-access": "0.47.0",
     "posthog-node": "^5.53.0",
     "undici": "^8.12.3"