@herbertgao/pi-extensions 2026.9.18 → 2026.9.19

package/README.md

@@ -18,29 +18,28 @@ When migrating from `pi-mcp-adapter`, remove any standalone adapter install as w
 
 ## Bundled extensions
 
-The package bundles 6 active `@herbertgao/*` child packages—`pi-bark`, `pi-cc-extensions`, `resume-from`, `pi-subagents`, `sol-pi`, and the maintained Antigravity provider mirror—plus the following upstream packages under their original names:
-
-- `pi-antigravity@0.7.2`
-- `@dietrichgebert/ponytail@4.9.0`
-- `@juicesharp/rpiv-ask-user-question@2.8.0`
-- `@narumitw/pi-btw@0.61.0`
-
-- `@narumitw/pi-caffeinate@0.49.7`
-- `@pi-plugins/fast-mode@0.1.10`
-- `@tifan/pi-copy-response@0.2.6`
+The package bundles 5 active `@herbertgao/*` child packages—`pi-bark`, `pi-cc-extensions`, `resume-from`, `pi-subagents`, and `sol-pi`—plus the following upstream packages under their original names:
+
+- `pi-antigravity@0.8.1`
+- `@dietrichgebert/ponytail@4.10.0`
+- `@juicesharp/rpiv-ask-user-question@2.11.0`
+- `@narumitw/pi-btw@0.61.1`
+- `@narumitw/pi-caffeinate@0.49.8`
+- `@pi-plugins/fast-mode@0.1.12`
+- `@tifan/pi-copy-response@0.2.7`
 - `@tifan/pi-handoff@2.2.2`
-- `@tifan/pi-inline-skills@1.0.5`
-- `@tifan/pi-mermaid-open@0.2.0`
-- `@tifan/pi-preferred-thinking@1.0.1`
-- `@tifan/pi-recap@0.4.6`
+- `@tifan/pi-inline-skills@1.0.6`
+- `@tifan/pi-mermaid-open@0.2.1`
+- `@tifan/pi-preferred-thinking@1.0.2`
+- `@tifan/pi-recap@0.4.7`
 - `@tifan/pi-rename@0.6.0`
-- `pi-typesafe@0.8.0`
+- `pi-typesafe@0.8.1`
 - `pi-multi-account@1.23.2`
 - `pi-next-cue@1.0.7`
 - `pi-footer@0.5.1`
 - `pi-jev-auto-mode@0.5.0`
-- `pi-lens@4.2.1`
-- `pi-web-access@0.27.0`
+- `pi-lens@4.3.0`
+- `pi-web-access@0.34.0`
 - `remote-pi@0.7.0`
 
 Pi loads their extensions and skills through `node_modules/` paths inside one package root. The upstream companions are pinned and bundled, not forked or renamed.
@@ -49,11 +48,11 @@ Pi loads their extensions and skills through `node_modules/` paths inside one pa
 
 `@herbertgao/pi-bark` sends localized Bark pushes when a user-facing Pi run fully settles or `@juicesharp/rpiv-ask-user-question` needs an answer. Notifications include emoji-labeled machine/path metadata and support the bundled official Pi badge through Bark's `icon` parameter. Configure it in `$PI_CODING_AGENT_DIR/bark.json` (normally `~/.pi/agent/bark.json`); see the [package README](../pi-bark/README.md). Without a valid endpoint it stays inactive.
 
-`@narumitw/pi-caffeinate@0.49.7` uses the host platform's sleep inhibitor during each Pi agent run. On macOS, `/caffeinate sleep` keeps the system awake while allowing the display to sleep; `/caffeinate display` also keeps the display awake. It releases the inhibitor when the run or session ends.
+`@narumitw/pi-caffeinate@0.49.8` uses the host platform's sleep inhibitor during each Pi agent run. On macOS, `/caffeinate sleep` keeps the system awake while allowing the display to sleep; `/caffeinate display` also keeps the display awake. It releases the inhibitor when the run or session ends.
 
-`pi-jev-auto-mode@0.5.0` adds fail-closed Jev safety gates for shell commands and file changes. `pi-typesafe@0.8.0` adds the `/typesafe` command and `typesafe_evaluate` tool for explicit structured decisions; both use the TypeSafe API after login.
+`pi-jev-auto-mode@0.5.0` adds fail-closed Jev safety gates for shell commands and file changes. `pi-typesafe@0.8.1` adds the `/typesafe` command and `typesafe_evaluate` tool for explicit structured decisions; both use the TypeSafe API after login.
 
-`@herbertgao/resume-from@0.2.0` keeps Claude Code sessions associated with their original repository when the active transcript later moves into a nested cwd. `@herbertgao/sol-pi@0.1.0` adds opt-in Action Fusion, ObservationPack, Evidence-Preserving Reducer, and Online Context Compact; see its [configuration guide](../sol-pi/docs/configuration.md). `pi-lens@4.2.1` expands language routing and bounds retained diagnostic facts across multi-root sessions. `pi-web-access@0.27.0` adds configurable fetch deadlines and answer models plus isolated GitHub clone runtimes. Preferred Thinking 1.0.1 preserves an explicit subagent `--thinking` choice. Deprecated `@tifan/pi-titlebar-spinner` is no longer bundled; Rename remains the single owner of Herdr tab naming.
+`@herbertgao/resume-from@0.2.0` keeps Claude Code sessions associated with their original repository when the active transcript later moves into a nested cwd. `@herbertgao/sol-pi@0.1.0` adds opt-in Action Fusion, ObservationPack, Evidence-Preserving Reducer, and Online Context Compact; see its [configuration guide](../sol-pi/docs/configuration.md). `pi-lens@4.3.0` expands language routing and bounds retained diagnostic facts across multi-root sessions. `pi-web-access@0.34.0` provides configurable web search and fetch tools; its `toolActivation` defaults to `auto`, choosing eager or dynamic tool activation per model. `pi-antigravity@0.8.1` reads Pi 0.86+ transcript system messages, so Antigravity requests carry Pi's system prompt and tools; it also registers `google_search` and `generate_image` tools that use the signed-in Antigravity account. Preferred Thinking 1.0.2 preserves an explicit subagent `--thinking` choice. Deprecated `@tifan/pi-titlebar-spinner` is no longer bundled; Rename remains the single owner of Herdr tab naming.
 
 `pi-stash` is no longer bundled: `/btw` already preserves the main editor draft while handling side questions outside the main conversation. Prior `@herbertgao/pi-stash` releases remain available but are no longer maintained here.
 

package/THIRD_PARTY_NOTICES.md

@@ -86,7 +86,7 @@ THE SOFTWARE.
 
 ## `pi-antigravity`
 
-The aggregate bundles the MIT-licensed [`pi-antigravity`](https://github.com/Rahularya01/pi-antigravity) package version 0.7.2 under its original attribution:
+The aggregate bundles the MIT-licensed [`pi-antigravity`](https://github.com/Rahularya01/pi-antigravity) package version 0.8.1 under its original attribution:
 
 MIT License
 

package/node_modules/@herbertgao/pi-cc-extensions/extensions/feature/shell/working-message.ts

@@ -98,18 +98,30 @@ export default function (pi: ExtensionAPI): void {
 		return parts.length ? `Working... (${parts.join(" · ")})` : "";
 	}
 
+	function workingUiAvailable(): boolean {
+		try {
+			return activeCtx?.hasUI === true;
+		} catch {
+			// A stale ctx after session replacement/reload throws from its getter; stop driving the footer.
+			turnActive = false;
+			activeCtx = null;
+			stopRefreshLoop();
+			return false;
+		}
+	}
+
 	function restoreDefaultWorkingMessage(): void {
 		lastMessage = null;
-		if (!activeCtx?.hasUI) return;
+		if (!workingUiAvailable()) return;
 		try {
-			activeCtx.ui.setWorkingMessage();
+			activeCtx?.ui.setWorkingMessage();
 		} catch {
 			// Noop when the TUI is unavailable.
 		}
 	}
 
 	function syncWorkingMessage(force = false): void {
-		if (!activeCtx?.hasUI) return;
+		if (!workingUiAvailable()) return;
 		const next = buildWorkingMessage();
 		if (!next) {
 			if (force) restoreDefaultWorkingMessage();
@@ -118,7 +130,7 @@ export default function (pi: ExtensionAPI): void {
 		if (!force && next === lastMessage) return;
 		lastMessage = next;
 		try {
-			activeCtx.ui.setWorkingMessage(next);
+			activeCtx?.ui.setWorkingMessage(next);
 		} catch {
 			// Noop when the TUI is unavailable.
 		}
@@ -130,9 +142,12 @@ export default function (pi: ExtensionAPI): void {
 			refreshTimer = null;
 			try {
 				syncWorkingMessage();
-			} finally {
-				scheduleRefreshTick();
+			} catch {
+				// An exception here would become an uncaughtException and kill Pi; stop the decorative refresh.
+				turnActive = false;
+				return;
 			}
+			scheduleRefreshTick();
 		}, REFRESH_INTERVAL_MS);
 		refreshTimer.unref?.();
 	}

package/node_modules/@herbertgao/pi-cc-extensions/extensions/renderer/index.ts

@@ -216,10 +216,21 @@ export default function (
 	});
 
 	pi.on("session_start", async (_event, ctx) => {
-		// 延迟到 session_start 注册 write override：加载阶段 getAllTools 不可用且其他扩展
-		// 尚未注册工具，无法检测外部 write 所有者（如 pi-spark），直接注册会与对方撞名。
-		// session_start 时所有扩展已加载完毕，installWriteOverride 内部会检测并让位。
-		installWriteOverride(pi, writeExecutionMetadata);
+		// Confirm write ownership one tick after every extension's session_start has run:
+		// others register tools in their own session_start, and registering first would
+		// silently drop their write (first registration wins).
+		setTimeout(() => {
+			installWriteOverride(pi, writeExecutionMetadata, (owner) => {
+				try {
+					ctx.ui?.notify?.(
+						`ccstyle: write is owned by ${owner.path || owner.source}; rich diff yields`,
+						"warning",
+					);
+				} catch {
+					// ctx may be stale by the next tick; the notice is decorative.
+				}
+			});
+		}, 0);
 		const hooks = ensureTuiInstallation(ctx);
 		// 鼠标交互独立于渲染层：fullscreen 渲染层让位（hooks undefined）但
 		// 工具点击/回到底部适配仍需安装；保持在渲染层安装之后以维持原顺序。

package/node_modules/@herbertgao/pi-cc-extensions/extensions/renderer/tool/diff/index.ts

@@ -59,6 +59,8 @@ export function renderRichToolResult(
 		);
 	}
 	if (toolName !== "write") return undefined;
+	// Yield point: when another extension owns write there is no execution metadata; fall back to the plain result row.
+	if (!ownsWriteTool()) return undefined;
 
 	const metadata = writeMetadata.get(context?.toolCallId);
 	if (!metadata) {
@@ -83,24 +85,58 @@ export function renderRichToolResult(
 	);
 }
 
-function hasExternalWriteOwner(pi: ExtensionAPI): boolean {
+/** Extension currently owning write, reported in the conflict notice. */
+export type ExternalWriteOwner = { source: string; path: string };
+
+const WRITE_OWNERSHIP_SLOT = Symbol.for("pi.ccstyle.write-ownership");
+/** Parameters object of the write override registered by this module; identifies our own tool in getAllTools(). */
+let ownWriteParameters: unknown;
+
+function writeOwnership(): { owned?: boolean } {
+	const slots = globalThis as any;
+	slots[WRITE_OWNERSHIP_SLOT] ??= {};
+	return slots[WRITE_OWNERSHIP_SLOT];
+}
+
+/** Whether this package executes write; unknown ownership keeps the existing rich-diff behavior. */
+export function ownsWriteTool(): boolean {
+	return writeOwnership().owned !== false;
+}
+
+function findExternalWriteOwner(pi: ExtensionAPI): ExternalWriteOwner | undefined {
 	try {
-		const tools = pi.getAllTools();
-		const write = tools.find((tool: any) => tool?.name === "write") as any;
-		const source = write?.sourceInfo?.source;
-		return Boolean(write && typeof source === "string" && source !== "builtin");
+		const tools = pi.getAllTools() as any[];
+		const write = tools?.find((tool: any) => tool?.name === "write") as any;
+		const sourceInfo = write?.sourceInfo;
+		const source = sourceInfo?.source;
+		if (!write || typeof source !== "string" || source === "builtin") return undefined;
+		// Our own override from an earlier session_start in this runtime.
+		if (ownWriteParameters !== undefined && write.parameters === ownWriteParameters)
+			return undefined;
+		return { source, path: typeof sourceInfo?.path === "string" ? sourceInfo.path : "" };
 	} catch {
 		// getAllTools is unavailable before the extension runtime is bound.
-		return false;
+		return undefined;
 	}
 }
 
 export function installWriteOverride(
 	pi: ExtensionAPI,
 	store = new WriteExecutionMetadataStore(),
+	/** Called when another extension already owns write. */
+	onExternalOwner?: (owner: ExternalWriteOwner) => void,
 ): WriteExecutionMetadataStore {
-	if (typeof (pi as any).registerTool !== "function" || hasExternalWriteOwner(pi)) return store;
+	if (typeof (pi as any).registerTool !== "function") return store;
+	const state = writeOwnership();
+	const external = findExternalWriteOwner(pi);
+	if (external) {
+		state.owned = false;
+		onExternalOwner?.(external);
+		return store;
+	}
+	state.owned = true;
 	const nativeWrite = createWriteToolDefinition(process.cwd()) as any;
+	ownWriteParameters = nativeWrite.parameters;
 	pi.registerTool({
 		...nativeWrite,
 		async execute(

package/node_modules/@herbertgao/pi-cc-extensions/extensions/renderer/tool/grouping.ts

@@ -8,7 +8,12 @@ import {
 } from "@earendil-works/pi-tui";
 import { TOOL_LOADING_INTERVAL_MS, toolLoadingIcon } from "../../utils/tool-loading-icon.ts";
 import { sanitizeToolResultText } from "../../utils/tool-result-sanitize.ts";
-import { fitToolCallSummary, pathSummary, type ToolCallSummary } from "./result.ts";
+import {
+	fitToolCallSummary,
+	pathSummary,
+	toolViewportWidth,
+	type ToolCallSummary,
+} from "./result.ts";
 import { isToolTuiFullscreen, showMoreHintText } from "../show-more-hint.ts";
 
 const PATCH_KEY = Symbol.for("pi.ccstyle.tool-grouping-patch");
@@ -444,7 +449,7 @@ export class ToolGroupComponent extends Container {
 			"",
 			truncateToWidth(
 				` ${fg(overallColor, "●")} ${label}: ${countText}${nameList} ${hint}`,
-				width,
+				toolViewportWidth(width),
 				"…",
 			),
 		];

package/node_modules/@herbertgao/pi-cc-extensions/extensions/renderer/tool/result.ts

@@ -566,8 +566,8 @@ export type ToolCallSummary = {
 };
 
 function pathApi(value: string) {
-	if (win32.isAbsolute(value)) return win32;
 	if (posix.isAbsolute(value)) return posix;
+	if (win32.isAbsolute(value)) return win32;
 	return undefined;
 }
 

package/node_modules/@herbertgao/pi-cc-extensions/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@herbertgao/pi-cc-extensions",
-  "version": "0.9.6",
+  "version": "0.9.7",
   "license": "MIT",
   "description": "A Pi productivity suite with Claude Code-style UI, context inspection, and agent/session references",
   "type": "module",
@@ -70,7 +70,7 @@
   "x-upstream": {
     "package": "pi-cc-extensions",
     "version": "0.8.71",
-    "reviewedVersion": "0.9.5",
+    "reviewedVersion": "0.9.9",
     "repository": "https://github.com/minuque/pi-cc-extensions",
     "commit": "e43e0041b59f5d7f03be9b9d103a5f9e954e4c11"
   }

package/node_modules/pi-antigravity/README.md

@@ -1,6 +1,7 @@
 # pi-antigravity
 
 [![npm version](https://img.shields.io/npm/v/pi-antigravity?logo=npm)](https://www.npmjs.com/package/pi-antigravity)
+[![npm downloads](https://img.shields.io/npm/dm/pi-antigravity?logo=npm)](https://www.npmjs.com/package/pi-antigravity)
 [![license](https://img.shields.io/npm/l/pi-antigravity)](LICENSE)
 [![Sponsor](https://img.shields.io/badge/Sponsor-GitHub-ea4aaa?logo=github)](https://github.com/sponsors/Rahularya01)
 
@@ -44,6 +45,8 @@ Or install the latest repository version:
 pi install git:github.com/Rahularya01/pi-antigravity
 ```
 
+On Oh My Pi, install the same package with `omp plugin install npm:pi-antigravity`.
+
 Restart Pi (or run `/reload`) after installation. To update the npm package later, use `pi update npm:pi-antigravity`.
 
 ## Quick start
@@ -58,6 +61,17 @@ Restart Pi (or run `/reload`) after installation. To update the npm package late
 
 4. Start working. If a request fails, run `/antigravity.doctor` for sanitized diagnostics.
 
+To link another account without losing the existing one, run `/login antigravity`
+again and complete Google sign-in with the other account. Manage linked accounts with:
+
+```text
+/antigravity.accounts
+/antigravity.accounts switch <index|email>
+/antigravity.accounts remove <index|email>
+```
+
+On a hard quota wall (HTTP 429 with a reset hint), the provider automatically tries the next linked account.
+
 ## Authentication and credential safety
 
 The provider uses the OAuth 2.0 Authorization Code flow with PKCE, so credentials are only ever exchanged with Google — never typed into Pi.
@@ -65,8 +79,9 @@ The provider uses the OAuth 2.0 Authorization Code flow with PKCE, so credential
 1. `/login antigravity` opens Google sign-in and starts a temporary callback listener at `http://localhost:51121/oauth-callback`.
 2. After you approve access, Pi exchanges the callback code for tokens and stores the provider credentials in Pi's auth store (normally `~/.pi/agent/auth.json`).
 3. Pi refreshes access tokens automatically when they expire — you shouldn't need to sign in again unless a token is revoked.
+4. Successful logins and token rotations are also kept in `~/.pi/agent/antigravity-accounts.json` with owner-only permissions so linked accounts can be switched without re-authenticating.
 
-The callback listener binds only to a loopback host, so it isn't reachable from outside your machine. The auth file it writes to contains sensitive access and refresh tokens: **do not commit it, paste it into issues, or share its contents.**
+The callback listener binds only to a loopback host, so it isn't reachable from outside your machine. The auth and account files it writes to contain sensitive access and refresh tokens: **do not commit them, paste them into issues, or share their contents.**
 
 Signing in requests these Google OAuth scopes:
 
@@ -90,15 +105,19 @@ Review these permissions before approving access. If your credentials expire or
 | `/model antigravity/<model-id>` | Choose a registered Antigravity model. |
 | `/antigravity.usage` | Show the server-reported shared quota groups and reset times. |
 | `/antigravity.models` | List available runtime models, remaining shared-pool quota, and capabilities. |
+| `/antigravity.accounts` | List linked accounts; use `switch` or `remove` with an index or email to manage them. |
 | `/antigravity.models all` | Include tab/chat models normally hidden from the model list. |
 | `/antigravity.refresh` | Force refresh the dynamic model catalog from Antigravity. |
 | `/antigravity.doctor` | Show sanitized provider diagnostics, including the endpoint, status, and resolved runtime model. |
 | `/antigravity.image <prompt>` | Generate an image via Antigravity and save it under `.pi/generated-images/`. Optional `--ratio 16:9`, `--model`, `--path`. |
+| `/antigravity.search <query>` | Search the web using Google Search Grounding via Antigravity. Optional `--thinking`, `--url <url>`. |
 
 Model availability, entitlement, quota groups, and resets are returned by the service and can differ by account. The quota percentage shown for a model can represent a shared pool, not a private per-model allowance.
 
 The extension also registers a `generate_image` tool the model can call. Images are written inside the project directory (default `.pi/generated-images/`). Image models such as `gemini-3-pro-image` are account-dependent; `/antigravity.image` falls back to other advertised Gemini image IDs on 404.
 
+It also registers a `google_search` tool allowing models to perform real-time web search and URL analysis using Google Search Grounding over Cloud Code Assist (powered by `gemini-3-flash` with dynamic fallback). It supports optional lead agent directives (`instruction`), specific target URLs (`urls`), and deep reasoning (`thinking: true`).
+
 ## Models and routing
 
 After you sign in, the provider refreshes its catalog from Antigravity (`fetchAvailableModels`) and groups runtime thinking variants into public Pi model IDs. Newly enabled models — for example a new Gemini Flash generation — become selectable after that refresh without waiting for an extension release. A last-known-good cache is kept for offline/cold start; the static table below is only the conservative fallback and a routing reference.
@@ -154,13 +173,13 @@ All primary environment variables start with `ANTIGRAVITY_`. The legacy `NOAGY_`
 | `ANTIGRAVITY_CLIENT_ID` | Use a custom Google OAuth client ID. |
 | `ANTIGRAVITY_CLIENT_SECRET` | Use a custom Google OAuth client secret. Keep it out of source control and shell history. |
 | `ANTIGRAVITY_NO_KEEPALIVE` | Set to `1` to skip the keep-alive connection pool. |
-| `ANTIGRAVITY_NO_PREWARM` | Set to `1` to skip the TLS pre-warm request made when the extension loads. |
+| `ANTIGRAVITY_NO_PREWARM` | Set to `1` to skip the TLS pre-warm request made on the first Antigravity request. |
 
 By default, the provider tries `https://daily-cloudcode-pa.googleapis.com`, then the sandbox host, then `https://cloudcode-pa.googleapis.com`. Prefer the built-in OAuth client unless you have a reason to use your own credentials.
 
 ### Latency
 
-Provider requests reuse a keep-alive connection pool when the runtime supports it, so consecutive turns do not repeat the DNS, TCP, and TLS handshake. When `HTTP_PROXY`, `HTTPS_PROXY`, or `ALL_PROXY` is set, that pool is skipped so Pi's proxy-aware dispatcher is used instead. The connection is also opened when the extension loads so the first message of a session skips the handshake too. For the lowest time-to-first-token, pick a fast runtime: `gemini-3.8-flash` with reasoning off routes to `gemini-3.8-flash-low` at thinking level `LOW`. Setting `ANTIGRAVITY_PROJECT_ID` also removes the project-discovery round-trip when credentials do not already carry a project ID.
+Provider requests reuse a keep-alive connection pool when the runtime supports it, so consecutive turns do not repeat the DNS, TCP, and TLS handshake. When `HTTP_PROXY`, `HTTPS_PROXY`, or `ALL_PROXY` is set, that pool is skipped so Pi's proxy-aware dispatcher is used instead. The connection is opened on the first Antigravity request rather than at Pi startup, so other extensions are not stalled by an unauthenticated handshake. For the lowest time-to-first-token, pick a fast runtime: `gemini-3.8-flash` with reasoning off routes to `gemini-3.8-flash-low` at thinking level `LOW`. Setting `ANTIGRAVITY_PROJECT_ID` also removes the project-discovery round-trip when credentials do not already carry a project ID.
 
 ## Troubleshooting
 
@@ -173,16 +192,20 @@ Provider requests reuse a keep-alive connection pool when the runtime supports i
 - **Claude/GPT tool-call schema error:** Upgrade to the latest package release. The provider adapts Pi's JSON Schema tool definitions for the Cloud Code Assist custom-tool bridge.
 - **Quota or rate limit:** Run `/antigravity.usage`. A `429` response usually indicates quota or rate limiting; changing models may still draw from the same shared pool.
 - **Need a safe diagnostic:** `/antigravity.doctor` redacts recognized secrets from its error output. Still review output before sharing it publicly.
+- **Oh My Pi says `registerApiProvider` is not exported:** Upgrade to 0.8.1 or later. Older builds statically import a Pi compat export that Oh My Pi's bundled runtime does not provide. The provider still registers through `pi.registerProvider` on that host.
 
 ## Development
 
-This repo uses [Bun](https://bun.sh) for install, scripts, and CI. The published extension itself runs on Node (Pi's CLI).
+This repo uses [Yarn 4](https://yarnpkg.com/) via Corepack for install, scripts, and CI. The published extension itself runs on Node (Pi's CLI).
 
 ```bash
-bun install
-bun run check
+corepack enable
+yarn install
+yarn check
 ```
 
+Installs are hardened against common supply-chain attacks: lifecycle scripts are off, lockfile checksums must match the npm registry, and package versions younger than three days are rejected. Do not add a second registry or enable `enableScripts` without a review.
+
 The package declares its Pi extension in `package.json` under `pi.extensions`. See the [Pi package documentation](https://pi.dev/docs/latest/packages) for package installation, manifest, and gallery conventions.
 
 ## Support the project

package/node_modules/pi-antigravity/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-antigravity",
-  "version": "0.7.2",
+  "version": "0.8.1",
   "description": "Personal Antigravity / Cloud Code Assist provider for Pi Coding Agent",
   "author": "Rahul Arya",
   "license": "MIT",
@@ -28,18 +28,22 @@
     "src",
     "tsconfig.json"
   ],
-  "packageManager": "bun@1.4.0",
+  "packageManager": "yarn@4.18.0+sha512.fcb8716fe7cd0eece141ffc18b92193a9df9204c1ba83189c288835223fc0bbe64af473bab0d5e9927a7daeb5caf2bb07eb2787cc9338ca040ea125f2a1f2f7e",
+  "engines": {
+    "node": ">=22.15.0"
+  },
   "scripts": {
     "typecheck": "tsc --noEmit",
     "lint": "eslint src",
     "lint:fix": "eslint src --fix",
     "format": "prettier --write .",
     "format:check": "prettier --check .",
-    "security-check": "bun scripts/security-check.ts",
-    "test": "bun scripts/test-model-routing.ts && bun scripts/test-model-discovery.ts && bun scripts/test-usage-formatter.ts && bun scripts/test-stream-sse.ts && bun scripts/test-stream-header-deadline.ts && bun scripts/test-http-proxy.ts && bun scripts/test-image-gen.ts",
-    "smoke:tools": "bun scripts/smoke-tool-schema.ts",
-    "smoke:models": "bun scripts/smoke-all-models.mjs",
-    "check": "bun run typecheck && bun run lint && bun run format:check && bun run security-check && bun run test"
+    "security-check": "node scripts/run-ts.mjs scripts/security-check.ts",
+    "test": "node scripts/run-ts.mjs scripts/test-model-routing.ts && node scripts/run-ts.mjs scripts/test-model-discovery.ts && node scripts/run-ts.mjs scripts/test-usage-formatter.ts && node scripts/run-ts.mjs scripts/test-stream-sse.ts && node scripts/run-ts.mjs scripts/test-stream-header-deadline.ts && node scripts/run-ts.mjs scripts/test-http-proxy.ts && node scripts/run-ts.mjs scripts/test-image-gen.ts && node scripts/run-ts.mjs scripts/test-transcript-context.ts && node scripts/run-ts.mjs scripts/test-accounts.ts && node scripts/run-ts.mjs scripts/test-search.ts",
+    "smoke:tools": "node scripts/run-ts.mjs scripts/smoke-tool-schema.ts",
+    "smoke:models": "node scripts/run-ts.mjs scripts/smoke-all-models.mjs",
+    "audit": "yarn npm audit --environment production --recursive && yarn npm audit --severity high --all --recursive",
+    "check": "yarn typecheck && yarn lint && yarn format:check && yarn security-check && yarn test && yarn audit"
   },
   "pi": {
     "extensions": [
@@ -52,6 +56,7 @@
   },
   "devDependencies": {
     "@earendil-works/pi-ai": "^0.84.2",
+    "@earendil-works/pi-coding-agent": "^0.84.2",
     "@eslint/js": "^10.0.1",
     "@types/node": "^26.1.1",
     "eslint": "^10.7.0",