@demigodmode/pi-web-agent 1.7.1 → 1.7.2

package/CHANGELOG.md

@@ -18,6 +18,22 @@ The format is intentionally simple and release-oriented.
 ### Breaking
 - None.
 
+## [1.7.2] - 2026-08-12
+### Added
+- None.
+
+### Changed
+- None.
+
+### Fixed
+- Candidate scoring now matches GitHub sources by parsed hostname instead of a `url.includes('github.com/')` substring check that could also match unrelated hosts like `evil.com/github.com/`.
+- `decodeHtmlEntities` now decodes `&amp;` last so an already-encoded entity such as `&amp;lt;` no longer collapses into `<` (double-unescape).
+- The CI workflow now sets an explicit read-only default `GITHUB_TOKEN` permission.
+- Bumped transitive `postcss`, `undici`, and `brace-expansion` in the lockfile to clear reported advisories.
+
+### Breaking
+- None.
+
 ## [1.7.1] - 2026-07-31
 ### Added
 - None.

package/dist/extract/readability.js

@@ -25,18 +25,24 @@ export function extractReadableContent(html, maxLength = 4000) {
         text
     };
 }
+const NAMED_ENTITIES = {
+    ' ': ' ',
+    '&': '&',
+    '&lt;': '<',
+    '&gt;': '>',
+    '&quot;': '"'
+};
 function decodeHtmlEntities(text) {
-    return text
-        .replace(/&nbsp;/gi, ' ')
-        .replace(/&amp;/gi, '&')
-        .replace(/&lt;/gi, '<')
-        .replace(/&gt;/gi, '>')
-        .replace(/&quot;/gi, '"')
-        .replace(/&#39;/gi, "'")
-        .replace(/&#x27;/gi, "'")
-        .replace(/&#x2F;/gi, '/')
-        .replace(/&#(\d+);/g, (_, code) => String.fromCharCode(Number(code)))
-        .replace(/&#x([\da-f]+);/gi, (_, code) => String.fromCharCode(parseInt(code, 16)));
+    // Single pass so each entity is decoded exactly once. A multi-pass decode
+    // rescans its own output, which double-unescapes either &amp;lt; -> < or
+    // &#38;amp; -> & depending on the pass order. One pass avoids both.
+    return text.replace(/&(?:#(\d+)|#x([\da-f]+)|nbsp|amp|lt|gt|quot);/gi, (match, dec, hex) => {
+        if (dec !== undefined)
+            return String.fromCharCode(Number(dec));
+        if (hex !== undefined)
+            return String.fromCharCode(parseInt(hex, 16));
+        return NAMED_ENTITIES[match.toLowerCase()] ?? match;
+    });
 }
 function extractTitle(html) {
     const match = html.match(/<title[^>]*>([\s\S]*?)<\/title>/i);

package/dist/orchestration/candidate-selector.js

@@ -1,9 +1,10 @@
-import { classifySourceProfile } from './source-profile.js';
+import { classifySourceProfile, hostOf } from './source-profile.js';
 function wantsDiscussionSources(query = '') {
     return /reddit|forum|forums|discussion|thread|comments|community|user experience|people recommend/i.test(query);
 }
 function candidateScore(result, query) {
-    const url = result.url.toLowerCase();
+    const host = hostOf(result.url);
+    const isGithub = host === 'github.com' || (host?.endsWith('.github.com') ?? false);
     const profile = classifySourceProfile(result.url);
     const wantsThreads = wantsDiscussionSources(query);
     if (profile.kind === 'official-docs')
@@ -15,7 +16,7 @@ function candidateScore(result, query) {
             return 2;
         if (profile.kind === 'issue-thread')
             return 3;
-        if (url.includes('github.com/'))
+        if (isGithub)
             return 4;
         if (profile.kind === 'package-page')
             return 6;
@@ -23,7 +24,7 @@ function candidateScore(result, query) {
     }
     if (profile.kind === 'issue-thread')
         return 2;
-    if (url.includes('github.com/'))
+    if (isGithub)
         return 3;
     if (profile.kind === 'package-page')
         return 5;

package/dist/orchestration/source-profile.d.ts

@@ -5,4 +5,5 @@ export type SourceProfile = {
     sourceKind: ResearchSourceKind;
     shouldPreferHeadlessWhenWeak: boolean;
 };
+export declare function hostOf(rawUrl: string): string | undefined;
 export declare function classifySourceProfile(rawUrl: string): SourceProfile;

package/dist/orchestration/source-profile.js

@@ -10,6 +10,9 @@ function parseUrl(rawUrl) {
         return undefined;
     }
 }
+export function hostOf(rawUrl) {
+    return parseUrl(rawUrl)?.hostname.toLowerCase().replace(/^www\./, '');
+}
 function isOfficialApi(host, path) {
     return ((host === 'playwright.dev' && path.startsWith('/docs/api/')) ||
         (host === 'vitest.dev' && path.startsWith('/config/')));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@demigodmode/pi-web-agent",
-  "version": "1.7.1",
+  "version": "1.7.2",
   "description": "Pi package for reliable web access with explicit search, fetch, and headless boundaries.",
   "type": "module",
   "main": "./dist/extension.js",