@demigodmode/pi-web-agent 1.7.0 → 1.7.2

package/CHANGELOG.md

@@ -18,6 +18,35 @@ The format is intentionally simple and release-oriented.
 ### Breaking
 - None.
 
+## [1.7.2] - 2026-08-12
+### Added
+- None.
+
+### Changed
+- None.
+
+### Fixed
+- Candidate scoring now matches GitHub sources by parsed hostname instead of a `url.includes('github.com/')` substring check that could also match unrelated hosts like `evil.com/github.com/`.
+- `decodeHtmlEntities` now decodes `&amp;` last so an already-encoded entity such as `&amp;lt;` no longer collapses into `<` (double-unescape).
+- The CI workflow now sets an explicit read-only default `GITHUB_TOKEN` permission.
+- Bumped transitive `postcss`, `undici`, and `brace-expansion` in the lockfile to clear reported advisories.
+
+### Breaking
+- None.
+
+## [1.7.1] - 2026-07-31
+### Added
+- None.
+
+### Changed
+- None.
+
+### Fixed
+- The issue #34 Pi-loader compatibility patch now resolves hoisted and nested `tr46` and `cssstyle` installations correctly instead of assuming they live inside `pi-web-agent/node_modules`.
+
+### Breaking
+- None.
+
 ## [1.7.0] - 2026-07-17
 ### Added
 - Exa is now available as a hosted search backend for `web_explore`, aimed at research-quality source discovery. Set `EXA_API_KEY` in the environment and choose `exa` from **Settings → Backends**. Closes #2.

package/dist/extract/readability.js

@@ -25,18 +25,24 @@ export function extractReadableContent(html, maxLength = 4000) {
         text
     };
 }
+const NAMED_ENTITIES = {
+    ' ': ' ',
+    '&': '&',
+    '&lt;': '<',
+    '&gt;': '>',
+    '&quot;': '"'
+};
 function decodeHtmlEntities(text) {
-    return text
-        .replace(/&nbsp;/gi, ' ')
-        .replace(/&amp;/gi, '&')
-        .replace(/&lt;/gi, '<')
-        .replace(/&gt;/gi, '>')
-        .replace(/&quot;/gi, '"')
-        .replace(/&#39;/gi, "'")
-        .replace(/&#x27;/gi, "'")
-        .replace(/&#x2F;/gi, '/')
-        .replace(/&#(\d+);/g, (_, code) => String.fromCharCode(Number(code)))
-        .replace(/&#x([\da-f]+);/gi, (_, code) => String.fromCharCode(parseInt(code, 16)));
+    // Single pass so each entity is decoded exactly once. A multi-pass decode
+    // rescans its own output, which double-unescapes either &amp;lt; -> < or
+    // &#38;amp; -> & depending on the pass order. One pass avoids both.
+    return text.replace(/&(?:#(\d+)|#x([\da-f]+)|nbsp|amp|lt|gt|quot);/gi, (match, dec, hex) => {
+        if (dec !== undefined)
+            return String.fromCharCode(Number(dec));
+        if (hex !== undefined)
+            return String.fromCharCode(parseInt(hex, 16));
+        return NAMED_ENTITIES[match.toLowerCase()] ?? match;
+    });
 }
 function extractTitle(html) {
     const match = html.match(/<title[^>]*>([\s\S]*?)<\/title>/i);

package/dist/orchestration/candidate-selector.js

@@ -1,9 +1,10 @@
-import { classifySourceProfile } from './source-profile.js';
+import { classifySourceProfile, hostOf } from './source-profile.js';
 function wantsDiscussionSources(query = '') {
     return /reddit|forum|forums|discussion|thread|comments|community|user experience|people recommend/i.test(query);
 }
 function candidateScore(result, query) {
-    const url = result.url.toLowerCase();
+    const host = hostOf(result.url);
+    const isGithub = host === 'github.com' || (host?.endsWith('.github.com') ?? false);
     const profile = classifySourceProfile(result.url);
     const wantsThreads = wantsDiscussionSources(query);
     if (profile.kind === 'official-docs')
@@ -15,7 +16,7 @@ function candidateScore(result, query) {
             return 2;
         if (profile.kind === 'issue-thread')
             return 3;
-        if (url.includes('github.com/'))
+        if (isGithub)
             return 4;
         if (profile.kind === 'package-page')
             return 6;
@@ -23,7 +24,7 @@ function candidateScore(result, query) {
     }
     if (profile.kind === 'issue-thread')
         return 2;
-    if (url.includes('github.com/'))
+    if (isGithub)
         return 3;
     if (profile.kind === 'package-page')
         return 5;

package/dist/orchestration/source-profile.d.ts

@@ -5,4 +5,5 @@ export type SourceProfile = {
     sourceKind: ResearchSourceKind;
     shouldPreferHeadlessWhenWeak: boolean;
 };
+export declare function hostOf(rawUrl: string): string | undefined;
 export declare function classifySourceProfile(rawUrl: string): SourceProfile;

package/dist/orchestration/source-profile.js

@@ -10,6 +10,9 @@ function parseUrl(rawUrl) {
         return undefined;
     }
 }
+export function hostOf(rawUrl) {
+    return parseUrl(rawUrl)?.hostname.toLowerCase().replace(/^www\./, '');
+}
 function isOfficialApi(host, path) {
     return ((host === 'playwright.dev' && path.startsWith('/docs/api/')) ||
         (host === 'vitest.dev' && path.startsWith('/config/')));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@demigodmode/pi-web-agent",
-  "version": "1.7.0",
+  "version": "1.7.2",
   "description": "Pi package for reliable web access with explicit search, fetch, and headless boundaries.",
   "type": "module",
   "main": "./dist/extension.js",

package/scripts/patch-jiti-compat.mjs

@@ -11,14 +11,30 @@
 // Safe to run multiple times and safe to no-op if the target files or
 // patterns are missing (e.g. a future dependency bump changes the shape).
 import { readFileSync, writeFileSync, existsSync } from "node:fs";
-import { fileURLToPath } from "node:url";
-import { dirname, join } from "node:path";
+import { createRequire } from "node:module";
+import { dirname, join, relative, sep } from "node:path";
 
-const __dirname = dirname(fileURLToPath(import.meta.url));
-const nodeModules = join(__dirname, "..", "node_modules");
+const resolveFromHere = createRequire(import.meta.url).resolve;
+
+function findPackageRoot(entryFile, packageName) {
+  let directory = dirname(entryFile);
+  while (true) {
+    const manifestFile = join(directory, "package.json");
+    if (existsSync(manifestFile)) {
+      const manifest = JSON.parse(readFileSync(manifestFile, "utf8"));
+      if (manifest.name === packageName) return directory;
+    }
+
+    const parent = dirname(directory);
+    if (parent === directory) {
+      throw new Error(`could not find the ${packageName} package root from ${entryFile}`);
+    }
+    directory = parent;
+  }
+}
 
 function patchTr46() {
-  const file = join(nodeModules, "tr46", "index.js");
+  const file = resolveFromHere("tr46");
   if (!existsSync(file)) {
     console.debug("patch-jiti-compat: tr46/index.js not found, skipping");
     return;
@@ -45,13 +61,14 @@ module.exports[Symbol.iterator] = Set.prototype[Symbol.iterator].bind(module.exp
 `;
 
 function patchCssstyleSetExports() {
+  const packageRoot = findPackageRoot(resolveFromHere("cssstyle"), "cssstyle");
   const files = [
-    join(nodeModules, "cssstyle", "lib", "allExtraProperties.js"),
-    join(nodeModules, "cssstyle", "lib", "generated", "allProperties.js"),
-    join(nodeModules, "cssstyle", "lib", "generated", "implementedProperties.js"),
+    join(packageRoot, "lib", "allExtraProperties.js"),
+    join(packageRoot, "lib", "generated", "allProperties.js"),
+    join(packageRoot, "lib", "generated", "implementedProperties.js"),
   ];
   for (const file of files) {
-    const label = `cssstyle/${file.slice(nodeModules.length + 1)}`;
+    const label = `cssstyle/${relative(packageRoot, file).split(sep).join("/")}`;
     if (!existsSync(file)) {
       console.debug(`patch-jiti-compat: ${label} not found, skipping`);
       continue;
@@ -67,10 +84,15 @@ function patchCssstyleSetExports() {
   }
 }
 
-try {
-  patchTr46();
-  patchCssstyleSetExports();
-} catch (err) {
-  // Never fail the install over a best-effort compat patch.
-  console.warn("patch-jiti-compat: skipped, non-fatal error:", err.message);
+function runBestEffort(label, patch) {
+  try {
+    patch();
+  } catch (err) {
+    // Never fail the install over a best-effort compat patch.
+    const message = err instanceof Error ? err.message : String(err);
+    console.warn(`patch-jiti-compat: ${label} skipped, non-fatal error: ${message}`);
+  }
 }
+
+runBestEffort("tr46", patchTr46);
+runBestEffort("cssstyle", patchCssstyleSetExports);