@herbertgao/pi-extensions 2026.9.15 → 2026.9.17

package/node_modules/pi-lens/rules/ast-grep-rules/rule-tests/no-boolean-in-except-test.yml

@@ -15,6 +15,21 @@ valid:
         x()
     except:
         pass
+  - |
+    # #3211: body-only `or` must not be flagged — the handler condition
+    # itself is a plain exception type, only the return value uses `or`.
+    try:
+        x()
+    except Exception:
+        return 2 or 3
+  - |
+    # #3211: same shape one level deeper (an `if` inside the handler
+    # body) — still not a boolean-in-except-clause target.
+    try:
+        x()
+    except Exception:
+        if cond:
+            x = a or b
 invalid:
   - |
     try:
@@ -26,3 +41,14 @@ invalid:
         x()
     except ValueError and KeyError:
         pass
+  - |
+    # #3211: a nested try whose OWN except clause has the boolean
+    # condition must still be flagged, even though it sits inside an
+    # outer handler whose body also contains an `or`.
+    try:
+        outer()
+    except Exception:
+        try:
+            inner()
+        except (A or B):
+            return 3 or 4

package/node_modules/pi-lens/rules/ast-grep-rules/rule-tests/no-http-headers-bracket-access-test.yml

@@ -2,6 +2,16 @@ id: no-http-headers-bracket-access
 valid:
   - "auth = request.headers.get('Authorization')"
   - "auth = request.headers.get('Authorization', '')"
+  - |
+    # #3211: a plain assignment through the bracket sets the header —
+    # it cannot raise KeyError, so it is not a read-site false positive.
+    resp.headers["X"] = "v"
+  - |
+    # #3211: augmented assignment is still a write, not a read.
+    resp.headers["X"] += "b"
+  - |
+    # #3211: `del` removes the key; it never raises KeyError either.
+    del resp.headers["Y"]
 invalid:
   - 'auth = request.headers["Authorization"]'
   - 'auth = response.headers["X-Request-Id"]'

package/node_modules/pi-lens/rules/ast-grep-rules/rule-tests/unchecked-numeric-parse-python-test.yml

@@ -0,0 +1,18 @@
+id: unchecked-numeric-parse-python
+valid:
+  - |
+    # #3211: already-converted-by-construction — Decimal raises
+    # decimal.InvalidOperation, not ValueError, and is excluded here.
+    x = float(Decimal("1.5"))
+  - |
+    # #3211: a numeric literal argument can never raise ValueError.
+    x = int(3.7)
+  - |
+    try:
+        g = int(s)
+    except ValueError:
+        pass
+invalid:
+  - 'int("42")'
+  - 'float("3.14")'
+  - 'int(user_input)'

package/node_modules/pi-lens/rules/ast-grep-rules/rule-tests/unchecked-throwing-call-python-test.yml

@@ -12,12 +12,13 @@ valid:
     except OSError:
         return None
   - 'CONSTANT = 42'
+  - |
+    # #3211: int()/float() moved to unchecked-numeric-parse-python — this
+    # rule no longer fires on the numeric-parse shape.
+    x = int(s)
 invalid:
   - 'data = json.loads(raw)'
   - 'f = open(path)'
   - 'os.remove(path)'
   - 'os.stat(path)'
   - 'shutil.rmtree(path)'
-  - 'int("42")'
-  - 'float("3.14")'
-  - 'int(user_input)'

package/node_modules/pi-lens/rules/ast-grep-rules/rules/go-no-fmt-println.yml

@@ -26,8 +26,8 @@ constraints:
 ignores:
   - "**/*_test.go"
   - "**/examples/**"
-  - "tests/fixtures/**"
-  - "cases/**"
+  - "**/tests/fixtures/**"
+  - "**/cases/**"
 tags:
   - go
   - idiom

package/node_modules/pi-lens/rules/ast-grep-rules/rules/no-assert-tuple.yml

@@ -1,24 +1,34 @@
 id: no-assert-tuple
 language: Python
 message: "Assert should not be called on a tuple literal"
-severity: error
+severity: warning
 note: |
   Port of SonarCloud python:S5905.
 
   `assert (a, b)` is always truthy because the tuple `(a, b)` is a
-  non-empty object. This is almost always a bug — the developer
-  probably meant `assert a, b` (two separate arguments) or
-  `assert (a == b)`.
+  non-empty object. The developer probably meant `assert a, b` (an
+  assertion with a message) or `assert (a == b)`.
 
-  The rule matches `assert` followed by a tuple literal. In Python
-  AST, `assert (1, 2)` parses as `assert_statement` whose test
-  is a `tuple` node (not parenthesized — the parens are just
-  grouping).
+  Bind the assertion's condition separately from its optional message,
+  then require that condition to be a tuple or a parentheses-only chain
+  ending in a tuple. Comparisons, calls, comprehensions, containers, and
+  tuple-valued assertion messages remain valid. The rule remains a
+  warning pending the multi-corpus false-positive audit required for
+  error severity.
 metadata:
   sonar: S5905
 rule:
-  all:
-    - kind: assert_statement
-    - has:
-        kind: tuple
-        stopBy: end
+  pattern: assert $COND
+constraints:
+  COND:
+    any:
+      - kind: tuple
+      - all:
+          - kind: parenthesized_expression
+          - has:
+              kind: tuple
+              stopBy:
+                not:
+                  any:
+                    - kind: parenthesized_expression
+                    - kind: tuple

package/node_modules/pi-lens/rules/ast-grep-rules/rules/no-boolean-in-except.yml

@@ -11,8 +11,12 @@ note: |
   developer meant `except (ValueError, KeyError):` (a tuple of
   exception types).
 
-  Matches an `except_clause` whose direct children contain a
-  `boolean_operator` (and/or) node.
+  Matches an `except_clause` whose search for a `boolean_operator`
+  (and/or) descendant stops at the handler's own `block` — the
+  clause's condition, not anything inside the handler's body (a
+  `return x or y` or an `x = a or b` in the body is not a false
+  target; a nested `try`'s own `except` clause is checked on its
+  own merits when the walk reaches it).
 metadata:
   sonar: S5714
 rule:
@@ -20,4 +24,4 @@ rule:
     - kind: except_clause
     - has:
         kind: boolean_operator
-        stopBy: end
+        stopBy: { kind: block }

package/node_modules/pi-lens/rules/ast-grep-rules/rules/no-console-except-error-js.yml

@@ -11,8 +11,8 @@ note: |
   just trains users to ignore the rule; `ignores` below carves those paths
   out while application/library code elsewhere still gets flagged (#965).
 ignores:
-  - "scripts/**"
-  - "bin/**"
+  - "**/scripts/**"
+  - "**/bin/**"
   - "**/logger.ts"
   - "**/logger.js"
   - "**/logger.mjs"

package/node_modules/pi-lens/rules/ast-grep-rules/rules/no-console-except-error.yml

@@ -11,8 +11,8 @@ note: |
   just trains users to ignore the rule; `ignores` below carves those paths
   out while application/library code elsewhere still gets flagged (#965).
 ignores:
-  - "scripts/**"
-  - "bin/**"
+  - "**/scripts/**"
+  - "**/bin/**"
   - "**/logger.ts"
   - "**/logger.js"
   - "**/logger.mjs"

package/node_modules/pi-lens/rules/ast-grep-rules/rules/no-http-headers-bracket-access.yml

@@ -9,14 +9,19 @@ note: |
   missing. Use `request.headers.get("X-Foo")` (returns None) or
   `request.headers["X-Foo"]` after a guard check.
 
-  Matches bracket-style subscript on a `headers` attribute. The
-  call shape `request.headers[...]` and `response.headers[...]`
-  are the most common cases.
+  Matches bracket-style subscript READS on a `headers` attribute
+  (`$REQ.headers[$KEY]` already subsumes the `request.`/`response.`-
+  named forms). A write through the same bracket syntax —
+  `resp.headers["X"] = v`, `resp.headers["X"] += v`, or
+  `del resp.headers["X"]` — sets or removes the header and can never
+  raise KeyError, so those are excluded.
 metadata:
   sonar: S8371
 rule:
-  any:
+  all:
     - pattern: "$REQ.headers[$KEY]"
-    - pattern: "$RES.headers[$KEY]"
-    - pattern: "request.headers[$KEY]"
-    - pattern: "response.headers[$KEY]"
+    - not:
+        any:
+          - inside: { kind: assignment, field: left }
+          - inside: { kind: augmented_assignment, field: left }
+          - inside: { kind: delete_statement }

package/node_modules/pi-lens/rules/ast-grep-rules/rules/unchecked-numeric-parse-python.yml

@@ -0,0 +1,44 @@
+id: unchecked-numeric-parse-python
+language: Python
+severity: warning
+message: "int()/float() without try/except — raises ValueError on non-numeric input"
+note: |
+  Split out of `unchecked-throwing-call-python` (#3211): `int()`/`float()`
+  raise `ValueError` on non-numeric strings, but whether a given call CAN
+  raise depends on the argument's runtime type — often undecidable from
+  syntax alone — so this ships at `warning`, separate from the
+  syntactically-certain `error`-level calls (open/json/os/shutil).
+
+  Excluded as already-safe by construction: a numeric literal argument
+  (`int(3.7)`), and an argument that is itself a call to `int()`/
+  `float()`/`Decimal()` (already-converted, or a `Decimal` — which raises
+  `decimal.InvalidOperation`, not `ValueError`, and is out of scope here).
+
+  Residual, undecidable false positive: a call whose argument is a typed
+  parameter already known to be numeric, e.g.
+
+    def f(valor: Decimal):
+        return float(valor)  # valor is a Decimal, not a raw string
+
+  The rule cannot see the parameter's declared type from the call site.
+  Suppress that shape explicitly:
+
+    return float(valor)  # pi-lens-ignore: unchecked-numeric-parse-python
+rule:
+  any:
+    - pattern: int($EXPR)
+    - pattern: float($EXPR)
+  not:
+    any:
+      - inside:
+          stopBy: end
+          kind: try_statement
+      - has:
+          field: arguments
+          has:
+            any:
+              - kind: integer
+              - kind: float
+              - pattern: Decimal($$$)
+              - pattern: int($$$)
+              - pattern: float($$$)

package/node_modules/pi-lens/rules/ast-grep-rules/rules/unchecked-throwing-call-python.yml

@@ -9,7 +9,11 @@ note: |
   json.loads(): raises json.JSONDecodeError on malformed JSON
   os.stat():    raises FileNotFoundError, PermissionError
   os.remove():  raises FileNotFoundError, PermissionError
-  int()/float():raises ValueError on non-numeric strings
+
+  `int()`/`float()` are a separate rule, `unchecked-numeric-parse-python`
+  (#3211): whether they can raise depends on the argument's runtime type,
+  which is often undecidable from syntax alone (a typed parameter, a prior
+  guard), so they ship at `warning` instead of `error` here.
 
   ✅ WRAP IN TRY/EXCEPT:
     try:
@@ -40,8 +44,6 @@ rule:
     - pattern: shutil.copy($$$)
     - pattern: shutil.move($$$)
     - pattern: shutil.rmtree($$$)
-    - pattern: int($EXPR)
-    - pattern: float($EXPR)
   not:
     inside:
       stopBy: end

package/node_modules/pi-lens/rules/tree-sitter-queries/typescript/console-statement.yml

@@ -29,8 +29,8 @@ post_filter: not_in_test_block  # skip test blocks — no-console-in-tests handl
 # trains users to ignore the rule (#965). Application/library code outside
 # these paths still gets flagged.
 ignore_paths:
-  - "scripts/**"
-  - "bin/**"
+  - "**/scripts/**"
+  - "**/bin/**"
   - "**/logger.ts"
   - "**/logger.js"
   - "**/logger.mjs"

package/node_modules/pi-lens/scripts/install-selftest.mjs

@@ -50,6 +50,7 @@ import * as path from "node:path";
 import { fileURLToPath } from "node:url";
 import { HOST_PROVIDED_PACKAGES } from "./lib/host-provided-deps.mjs";
 import { collectSkillEntryPaths } from "./lib/skills-predicate.mjs";
+import { resolveWebTreeSitterPackageDir } from "./lib/web-tree-sitter-dir.mjs";
 
 const here = path.dirname(fileURLToPath(import.meta.url));
 const pkgRoot = path.resolve(here, "..");
@@ -220,28 +221,31 @@ try {
 }
 
 // tree-sitter grammars — download-grammars.js postinstall writes them into
-// node_modules/web-tree-sitter/grammars/. Locate that dir via the resolved
-// web-tree-sitter package (matches tree-sitter-client's runtime strategy).
+// node_modules/web-tree-sitter/grammars/. Locate that dir through the SAME
+// shared ladder the extension runtime uses (#3409 round 1, R3418-2): this probe
+// used to resolve the BARE `web-tree-sitter` specifier and walk up, which throws
+// MODULE_NOT_FOUND inside a `bun build --compile` host — so on the very hosts pi
+// ships as, it reported the grammar asset missing while the exported wasm
+// subpath resolved fine. One ladder, one answer, for the client, the pasted
+// install fingerprint and this script.
 let grammarDetail = "tree-sitter-*.wasm missing (postinstall skipped?)";
 let hasCoreGrammar = false;
-try {
-	// web-tree-sitter restricts `exports`, so resolve its main entry and walk
-	// up to the package root (the dir literally named web-tree-sitter), where
-	// download-grammars.js writes grammars/.
-	let dir = path.dirname(require.resolve("web-tree-sitter"));
-	while (
-		path.basename(dir) !== "web-tree-sitter" &&
-		dir !== path.dirname(dir)
-	) {
-		dir = path.dirname(dir);
-	}
-	const grammarDir = path.join(dir, "grammars");
+const webTreeSitterDir = resolveWebTreeSitterPackageDir({
+	resolve: (specifier) => require.resolve(specifier),
+	packageRoot: () => pkgRoot,
+	cwd: () => process.cwd(),
+});
+if (!webTreeSitterDir) {
+	grammarDetail =
+		"web-tree-sitter package dir unresolvable (module resolver, package root and cwd)";
+} else {
+	const grammarDir = path.join(webTreeSitterDir, "grammars");
 	hasCoreGrammar = fs.existsSync(
 		path.join(grammarDir, "tree-sitter-typescript.wasm"),
 	);
-	if (hasCoreGrammar) grammarDetail = grammarDir;
-} catch (err) {
-	grammarDetail = `web-tree-sitter unresolved: ${err?.message || err}`;
+	grammarDetail = hasCoreGrammar
+		? grammarDir
+		: `tree-sitter-*.wasm missing in ${grammarDir} (postinstall skipped?)`;
 }
 record("tree-sitter grammars", "asset", hasCoreGrammar, grammarDetail);
 

package/node_modules/pi-lens/scripts/lib/web-tree-sitter-dir.mjs

@@ -0,0 +1,123 @@
+/**
+ * Where web-tree-sitter is installed — ONE ladder, for every caller that needs
+ * the answer (#3409).
+ *
+ * Callers: `clients/tree-sitter-client.ts` (the grammar read path and the
+ * lazy-fetch write target), `clients/install-diagnostics.ts` (the pasted
+ * environment fingerprint) and `scripts/install-selftest.mjs` (the installed
+ * host's own diagnostic). Each used to spell its own rungs, and the two that led
+ * with a BARE specifier were unconditionally broken on the host pi ships: inside
+ * a `bun build --compile` binary `require.resolve("web-tree-sitter")` throws
+ * MODULE_NOT_FOUND while `require.resolve("web-tree-sitter/tree-sitter.wasm")` —
+ * an explicit file subpath — still resolves.
+ *
+ * It lives in `scripts/lib/` rather than `clients/` because the installed
+ * selftest is packaged (`files[]`) without `clients/`, and this is the house
+ * pattern for logic a packaged .mjs script and the TypeScript runtime share
+ * (`scripts/lib/skills-predicate.mjs`, `scripts/lib/process-scan.mjs`). It
+ * imports nothing but `node:fs` and `node:path`, so it loads even on the hosts
+ * whose broken dependency graph the selftest exists to report.
+ */
+
+import * as fs from "node:fs";
+import * as path from "node:path";
+
+/** The package this module is about. Also the name its manifest must carry. */
+const WEB_TREE_SITTER = "web-tree-sitter";
+
+/**
+ * The wasm the runtime loads, at the package root — where 0.25.10's `exports`
+ * map puts it (`"./tree-sitter.wasm": "./tree-sitter.wasm"`). If a later release
+ * moves it (#381's 0.26 migration), the two FALLBACK rungs below stop matching
+ * and the resolver rungs, which ask Node for that same subpath, keep working;
+ * this constant is then the one line to update.
+ */
+const RUNTIME_WASM = "tree-sitter.wasm";
+
+/**
+ * True when `dir` IS an installed web-tree-sitter package: its own manifest
+ * names it, and the wasm the runtime loads is in it.
+ *
+ * Round 1 review of #3409 (R3418-1): the constructed rungs used to accept any
+ * directory that merely EXISTED at `<base>/node_modules/web-tree-sitter`, so an
+ * empty or foreign directory of that name became the runtime fetch's write
+ * target and a downloaded grammar would land in an unrelated tree. Existence is
+ * not identity. The manifest name is the identity; the wasm is what makes the
+ * directory the right place to put grammars, since a grammar is only loadable by
+ * the web-tree-sitter runtime sitting next to it (the ABI drift #1564 is about).
+ */
+export function isWebTreeSitterPackageDir(dir) {
+	try {
+		if (!fs.existsSync(path.join(dir, RUNTIME_WASM))) return false;
+		const manifest = JSON.parse(
+			fs.readFileSync(path.join(dir, "package.json"), "utf8"),
+		);
+		return manifest?.name === WEB_TREE_SITTER;
+	} catch {
+		return false;
+	}
+}
+
+/**
+ * The package directory owning `resolvedFile`: walk up until a directory passes
+ * the identity check, or the filesystem root is reached. The walk exists because
+ * an `exports` map may point into a subdirectory, so the file's own parent is
+ * not necessarily the package; the identity check is what stops the walk, so a
+ * resolver that answers outside any web-tree-sitter package yields nothing
+ * rather than an unrelated ancestor.
+ */
+function packageDirOf(resolvedFile) {
+	let dir = path.dirname(resolvedFile);
+	for (;;) {
+		if (isWebTreeSitterPackageDir(dir)) return dir;
+		const parent = path.dirname(dir);
+		if (parent === dir) return undefined;
+		dir = parent;
+	}
+}
+
+/**
+ * web-tree-sitter's installed package directory, or undefined.
+ *
+ * Rung order, most authoritative first:
+ *  1. the `tree-sitter.wasm` SUBPATH, which resolves on a compiled host as well
+ *     as a plain one. This is the rung that makes the non-core grammars
+ *     fetchable there at all.
+ *  2. the BARE specifier, for a future web-tree-sitter whose exports map no
+ *     longer carries `./tree-sitter.wasm`.
+ *  3. pi-lens's own package root, for the temp-dir compile layout (#20) where
+ *     the resolver's context is a temp directory but the package root still has
+ *     the right `node_modules`.
+ *  4. the working directory, the pre-#3409 last resort.
+ *
+ * Rungs 1-2 are the resolver's answer and outrank the constructed guesses: the
+ * grammars must come from the SAME package whose wasm the runtime loaded. Every
+ * rung's candidate passes `isWebTreeSitterPackageDir` before it is returned.
+ *
+ * `resolve`, `packageRoot` and `cwd` are injected, never defaulted: the caller's
+ * resolver context and package root are what differ on a compiled host, so they
+ * must not be silently replaced by this module's — and a rung nothing can vary
+ * is a rung no test can drive.
+ */
+export function resolveWebTreeSitterPackageDir(deps) {
+	for (const specifier of [
+		`${WEB_TREE_SITTER}/${RUNTIME_WASM}`,
+		WEB_TREE_SITTER,
+	]) {
+		try {
+			const dir = packageDirOf(deps.resolve(specifier));
+			if (dir) return dir;
+		} catch {
+			/* next rung */
+		}
+	}
+	for (const base of [deps.packageRoot, deps.cwd]) {
+		try {
+			const candidate = path.join(base(), "node_modules", WEB_TREE_SITTER);
+			if (isWebTreeSitterPackageDir(candidate)) return candidate;
+		} catch {
+			/* next rung */
+		}
+	}
+	return undefined;
+}

package/node_modules/pi-mcp-adapter/CHANGELOG.md

@@ -7,6 +7,35 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.38.0] - 2026-09-26
+
+### Highlights
+
+- Search-mode tools become full direct tools after a successful proxy call, without requiring a separate search first.
+- Runtime-registered keep-alive servers now publish their tools even when Pi starts with no enabled MCP servers.
+- Compact `mcpScript` results show which tools ran, how often they ran, and how many calls failed.
+- Stdio configurations support home-relative paths, and MCP UI windows can open in Orca.
+- OpenCode v2 imports, OAuth credential access, and Rust MCP schemas are more reliable.
+
+### Added
+
+- A successful `mcp({ tool })` call now activates a held `directTools: "search"` tool, so later calls use its full schema even if the model skipped search. Thanks to [@chiptoe-svg](https://github.com/chiptoe-svg) for [PR #670](https://github.com/nicobailon/pi-mcp-adapter/pull/670).
+- MCP stdio server commands, arguments, and working directories now support home-relative paths. Thanks to [@FRFlo](https://github.com/FRFlo) for [PR #655](https://github.com/nicobailon/pi-mcp-adapter/pull/655).
+- Set `MCP_UI_VIEWER=orca` to open MCP UI windows in Orca. Thanks to [@jaesimio](https://github.com/jaesimio) for [PR #654](https://github.com/nicobailon/pi-mcp-adapter/pull/654).
+
+### Fixed
+
+- Keep-alive servers registered at runtime now connect and publish their tools even when no configured servers are enabled at startup. Thanks to [@ahodges22](https://github.com/ahodges22) for [issue #671](https://github.com/nicobailon/pi-mcp-adapter/issues/671).
+- Valid `ancestorConfigRoots` entries that do not contain the current working directory are ignored without warnings. Invalid entries still warn. Thanks to [@TheEdgeOfRage](https://github.com/TheEdgeOfRage) for [issue #668](https://github.com/nicobailon/pi-mcp-adapter/issues/668) and [PR #669](https://github.com/nicobailon/pi-mcp-adapter/pull/669).
+- Collapsed `mcpScript` results now show the tools called, repeat counts, and a visible failure count instead of only the first output line. Unsafe or ambiguous tool names are quoted and escaped, and script code remains hidden. Thanks to [@sargismarkosyan](https://github.com/sargismarkosyan) for [PR #666](https://github.com/nicobailon/pi-mcp-adapter/pull/666).
+- Metadata refreshes no longer reactivate an `mcp` gateway tool removed by the host. On hosts without `unregisterTool`, the adapter can still hide the gateway when direct tools cover the server and restore it when needed. Thanks to [@xulongwu4](https://github.com/xulongwu4) for [PR #665](https://github.com/nicobailon/pi-mcp-adapter/pull/665).
+- `mcpScript` no longer asks models to load its intentionally hidden manual skill. Thanks to [@k03mad](https://github.com/k03mad) for [#659](https://github.com/nicobailon/pi-mcp-adapter/issues/659).
+- OAuth credential reads now reuse a healthy keyring Entry without retaining secret values, avoiding repeated native sessions while still observing external updates. Thanks to [@mmarabel](https://github.com/mmarabel) for [#657](https://github.com/nicobailon/pi-mcp-adapter/issues/657).
+- Suppressing MCP UI windows with `MCP_UI_VIEWER=none` / `off` / `disabled` no longer prints raw output into the TUI. Thanks to [@andreafspeziale](https://github.com/andreafspeziale) for [#656](https://github.com/nicobailon/pi-mcp-adapter/issues/656).
+- The published package now includes the OAuth guide linked from the README. Thanks to [@dajiaohuang](https://github.com/dajiaohuang) for [PR #653](https://github.com/nicobailon/pi-mcp-adapter/pull/653).
+- OpenCode v2 configs now import. Servers under `mcp.servers` are picked up, `disabled: true` servers are skipped, and the snake_case OAuth fields `client_id`, `client_secret`, and `auth_server_metadata_url` are mapped. OpenCode v1 configs keep working. Thanks to [@sleroq](https://github.com/sleroq) for [PR #650](https://github.com/nicobailon/pi-mcp-adapter/pull/650).
+- Tools from Rust MCP servers, such as DBX, no longer print Ajv `unknown format "uint64" ignored` warnings on every call. Number formats like `uint64`, `uint32`, `uint`, and `uint8` are now recognized, and `type`/`minimum` still validate the values. Thanks to [@nightlitten](https://github.com/nightlitten) for [#649](https://github.com/nicobailon/pi-mcp-adapter/issues/649).
+
 ## [2.37.0] - 2026-09-23
 
 ### Highlights