@herbertgao/pi-extensions 2026.9.18 → 2026.9.20

package/node_modules/@herbertgao/pi-cc-extensions/extensions/utils/format.ts

@@ -0,0 +1,28 @@
+import { truncateToWidth, visibleWidth } from "@earendil-works/pi-tui";
+import { sanitizeToolResultText } from "./tool-result-sanitize.ts";
+
+/** 毫秒 → "1h 2m 3s"/"2m 3s"/"3s"；低于 1 秒返回 ""（省略）。 */
+export function formatDuration(ms: number): string {
+	const totalSec = Math.floor(ms / 1000);
+	if (totalSec < 1) return "";
+	const hours = Math.floor(totalSec / 3600);
+	const minutes = Math.floor((totalSec % 3600) / 60);
+	const seconds = totalSec % 60;
+	if (hours > 0) return `${hours}h ${minutes}m ${seconds}s`;
+	if (minutes > 0) return `${minutes}m ${seconds}s`;
+	return `${seconds}s`;
+}
+
+/** 文本单行化：去换行空白，超宽截断加省略号。 */
+export function oneLine(value: unknown, max = 96): string {
+	const text = sanitizeToolResultText(String(value ?? ""), 4096)
+		.replace(/\s+/g, " ")
+		.trim();
+	return text.length > max ? `${text.slice(0, max - 1)}…` : text;
+}
+
+/** 把一行文本补齐到固定可见宽度，超宽时截断并追加省略号。 */
+export function padLine(text: string, width: number): string {
+	const truncated = truncateToWidth(text, width, "…");
+	return truncated + " ".repeat(Math.max(0, width - visibleWidth(truncated)));
+}

package/node_modules/@herbertgao/pi-cc-extensions/extensions/utils/fullscreen-detect.ts

@@ -1,3 +1,6 @@
+import { TuiMainScreen } from "@earendil-works/pi-tui";
+import { MAIN_SCREEN_DO_RENDER_PATCH, patchRegistry } from "./patch-keys.ts";
+
 /**
  * 官方 0.84+ 的 tui 引用是惰性 Proxy（createInteractiveTuiReference）：
  * 函数属性每次 get 都返回新包装，执行时才解析到当前实现。
@@ -9,3 +12,51 @@ export function isLazyProxyTui(tui: any): boolean {
 	const probe = tui.requestRender;
 	return typeof probe === "function" && probe !== tui.requestRender;
 }
+
+type MainScreenDoRenderPatch = {
+	active: boolean;
+	original: (lines: string[]) => string[];
+	installed: (lines: string[]) => string[];
+};
+
+/**
+ * regular（TuiMainScreen）模式的 doRender 走差分绘制：一旦第一个变化行落在
+ * previousViewportTop 之上（终端写不进 scrollback 的区域），只能
+ * fullRender(true)——\x1b[2J\x1b[H\x1b[3J 清屏并清掉整段 scrollback。
+ * compact 直播式回合的摘要行动画与流式正文渲染在回合工具卡/diff 面板上方；
+ * diff 面板一落地把下方内容撑过屏高，之后每帧重绘都命中该分支：scrollback
+ * 被反复清空，滚动条回弹、视口钉住，直到输出结束才恢复。
+ *
+ * 视口上方的行本就无法重写，只剩「清回滚重打」与「scrollback 保留旧文本」
+ * 两条路。这里选后者：applyLineResets 是差分比较前最后一个拿到整帧的环节，
+ * 把 previousLines 的视口上方前缀直接对齐新帧，差分只看到可写区域，照常增量
+ * 绘制。代价仅是 scrollback 里那几行停留在最后一次实际写入的内容。
+ */
+export function installMainScreenDoRenderPatch(): void {
+	const prototype = TuiMainScreen.prototype as any;
+	if (typeof prototype?.applyLineResets !== "function") return;
+	const previous = patchRegistry.get<MainScreenDoRenderPatch>(MAIN_SCREEN_DO_RENDER_PATCH);
+	if (previous) previous.active = false;
+	const original =
+		previous && prototype.applyLineResets === previous.installed
+			? previous.original
+			: prototype.applyLineResets;
+	const patch: MainScreenDoRenderPatch = {
+		active: true,
+		original,
+		installed(this: any, lines: string[]) {
+			const result = original.call(this, lines);
+			if (!patch.active) return result;
+			const prev = this.previousLines;
+			if (!Array.isArray(prev)) return result;
+			const top = Math.min(
+				Math.max(0, Math.floor(Number(this.previousViewportTop) || 0)),
+				result.length,
+			);
+			for (let i = 0; i < top; i++) prev[i] = result[i];
+			return result;
+		},
+	};
+	prototype.applyLineResets = patch.installed;
+	patchRegistry.install(MAIN_SCREEN_DO_RENDER_PATCH, patch);
+}

package/node_modules/@herbertgao/pi-cc-extensions/extensions/utils/patch-keys.ts

@@ -0,0 +1,124 @@
+/**
+ * ccstyle 补丁所有权与跨模块协调键的单一来源（single source of truth）。
+ *
+ * 全部使用 Symbol.for（全局注册表）：/reload 后新模块实例拿到的是同一个 symbol，
+ * 这是跨 reload 识别/让渡补丁所有权的关键。切勿把这些 Symbol.for 改成模块局部 Symbol。
+ *
+ * 两类用途：
+ * 1. globalThis 槽位：安装补丁时写 host[KEY] = patch，dispose 时按所有权判断还原。
+ * 2. 实例/函数标记：把补丁包装器或组件实例标记在某个 symbol 属性上，供跨模块识别。
+ *
+ * PatchRegistry 把第 1 类的读写收口为带所有权语义的 install/dispose 生命周期；
+ * 底层仍是 globalThis[symbol]，因此外部（含测试）直接读 globalThis 槽不受影响。
+ */
+
+// ── compact / compact-thinking 协调 ──
+export const COMPACT_MODE_PATCH_KEY = Symbol.for("pi.ccstyle.compact-mode-patch");
+export const COMPACT_THINKING_PATCH_KEY = Symbol.for("pi.ccstyle.compact-thinking-update");
+export const PROTOTYPE_ORIGINAL_KEY = Symbol.for("pi.ccstyle.prototype-original");
+export const COMPACT_THINKING_OWNER = Symbol.for("pi.ccstyle.compact-thinking-owner");
+
+// ── assistant 展开状态（实例标记） ──
+export const ASSISTANT_SET_EXPANDED_KEY = Symbol.for("pi.ccstyle.compact-assistant-set-expanded");
+export const ASSISTANT_TOGGLE_ROUND_KEY = Symbol.for("pi.ccstyle.compact-assistant-toggle-round");
+export const ASSISTANT_REENTRY_KEY = Symbol.for("pi.ccstyle.compact-assistant-reentry");
+
+// ── 工具渲染补丁 ──
+export const GLOBAL_TOOL_RENDER_PATCH = Symbol.for("pi.ccstyle.global-tool-render-patch");
+export const COMPONENT_TOOL_RENDER_MODE = Symbol.for("pi.ccstyle.component-tool-render-mode");
+export const TOOL_EXPANDED_BACKGROUND_PATCH = Symbol.for(
+	"pi.ccstyle.tool-expanded-background-patch",
+);
+// write 归属：注册期确认一次，渲染期据此决定是否提供 rich diff。
+export const WRITE_OWNERSHIP_SLOT = Symbol.for("pi.ccstyle.write-ownership");
+
+// ── 消息组件补丁 ──
+export const MESSAGE_DISPLAY_PATCH = Symbol.for("pi.ccstyle.message-display-patch");
+
+// ── 工具分组 ──
+export const TOOL_GROUPING_PATCH_KEY = Symbol.for("pi.ccstyle.tool-grouping-patch");
+export const TOOL_GROUPING_PARENT_KEY = Symbol.for("pi.ccstyle.tool-grouping-parent");
+export const TOOL_GROUPING_GENERATION_KEY = Symbol.for("pi.ccstyle.tool-grouping-generation");
+
+// ── regular 主屏渲染补丁 ──
+export const MAIN_SCREEN_DO_RENDER_PATCH = Symbol.for("pi.ccstyle.main-screen-do-render-patch");
+
+// ── 鼠标交互 ──
+export const TOOL_MOUSE_OWNER_KEY = Symbol.for("pi.ccstyle.tool-mouse-owner");
+export const TOOL_MOUSE_TUI_SLOT = Symbol.for("pi.ccstyle.tool-mouse-tui");
+export const SCROLL_BUTTON_STATE_SLOT = Symbol.for("pi.ccstyle.scroll-button-state");
+export const OFFICIAL_SCROLL_TO_END_KEY = Symbol.for("pi.ccstyle.official-scroll-to-end");
+export const FLUSH_DOCKED_BASH_PATCH = Symbol.for("pi.ccstyle.flush-docked-bash-patch");
+export const EARLY_STARTUP_HEADER_PATCH = Symbol.for("pi.ccstyle.early-startup-header-patch");
+export const EARLY_STARTUP_HEADER_SWAP_KEY = Symbol.for("pi.ccstyle.early-startup-header-swap");
+export const TOOL_HOVER_STATE_KEY = Symbol.for("pi.ccstyle.tool-hover-state");
+
+// ── rich diff 组件标记 ──
+export const RICH_DIFF_COMPONENT = Symbol.for("pi.ccstyle.rich-diff-component");
+
+// ── PatchRegistry：所有权生命周期统一收口 ──
+
+/**
+ * host 上的补丁槽位读写器。把散落各处的
+ * `host[KEY] = patch` / `if (host[KEY] === patch) delete host[KEY]` 收口为
+ * 带所有权语义的 install/dispose 生命周期：
+ *
+ * - install：覆盖写入并返回被替换的旧值（不自动让旧值失效——部分安装器
+ *   需要先读旧补丁以链接下游方法，由调用方决定如何 inactivate）。
+ * - dispose：所有权守卫删除——仅当槽位仍 === 该值才删除，防止 /reload 后
+ *   旧模块误删新模块的补丁。
+ * - owns：判断槽位是否仍由某值持有（恒等比较）。
+ * - ensure：惰性状态槽（??= 语义），用于无所有权的跨模块共享状态。
+ */
+export class PatchRegistry {
+	readonly host: Record<PropertyKey, unknown>;
+
+	constructor(
+		host: Record<PropertyKey, unknown> = globalThis as unknown as Record<PropertyKey, unknown>,
+	) {
+		this.host = host;
+	}
+
+	/** 读取槽位当前值。 */
+	get<T = unknown>(key: symbol): T | undefined {
+		return this.host[key] as T | undefined;
+	}
+
+	/** 是否仍由 value 持有（恒等比较）。 */
+	owns(key: symbol, value: unknown): boolean {
+		return this.host[key] === value;
+	}
+
+	/** 覆盖写入并返回被替换的旧值；不自动让旧值失效。 */
+	install<T = unknown>(key: symbol, value: T): T | undefined {
+		const previous = this.host[key] as T | undefined;
+		this.host[key] = value;
+		return previous;
+	}
+
+	/** 所有权守卫删除：仅当槽位仍 === value 时删除。返回是否删除。 */
+	dispose(key: symbol, value: unknown): boolean {
+		if (!this.owns(key, value)) return false;
+		delete this.host[key];
+		return true;
+	}
+
+	/** 惰性槽位：无值（null/undefined）时用 init() 初始化并缓存。 */
+	ensure<T>(key: symbol, init: () => T): T {
+		const current = this.host[key];
+		if (current !== null && current !== undefined) return current as T;
+		const value = init();
+		this.host[key] = value;
+		return value;
+	}
+
+	/** 无条件删除槽位（不判断所有权）。返回是否实际删除了键。 */
+	delete(key: symbol): boolean {
+		if (!(key in this.host)) return false;
+		delete this.host[key];
+		return true;
+	}
+}
+
+/** 全局单例：host 固定为 globalThis，跨 /reload 与 jiti 重载稳定。 */
+export const patchRegistry = new PatchRegistry();

package/node_modules/@herbertgao/pi-cc-extensions/extensions/utils/sgr-mouse.ts

@@ -0,0 +1,70 @@
+/**
+ * SGR 鼠标协议解析（共享）。
+ *
+ * 收敛 feature/_util.ts 的单包解析与 renderer/mouse/packets.ts 的批量解析。
+ */
+
+/** SGR 鼠标协议包（code;col;row + M/m 终结符）。 */
+export type SgrMousePacket = {
+	code: number;
+	col: number;
+	row: number;
+	final: "M" | "m";
+};
+
+/** 解析单个完整 SGR 鼠标包（整段数据必须恰好是一个包）。 */
+export function parseSgrMousePacket(data: string): SgrMousePacket | null {
+	const match = data.match(/^\x1b\[<(\d+);(\d+);(\d+)([Mm])$/);
+	if (!match) return null;
+	return {
+		code: Number(match[1]),
+		col: Number(match[2]),
+		row: Number(match[3]),
+		final: match[4] as "M" | "m",
+	};
+}
+
+/**
+ * 解析整段终端输入为 SGR 鼠标包序列；数据必须完全由连续 SGR 包组成
+ * （夹杂其他字节返回 null，交由常规输入链处理）。
+ */
+export function parseSgrMousePackets(data: string): SgrMousePacket[] | null {
+	const pattern = /\x1b\[<(\d+);(\d+);(\d+)([Mm])/g;
+	const packets: SgrMousePacket[] = [];
+	let offset = 0;
+
+	for (const match of data.matchAll(pattern)) {
+		if (match.index !== offset) return null;
+		offset = match.index + match[0].length;
+		packets.push({
+			code: Number(match[1]),
+			col: Number(match[2]),
+			row: Number(match[3]),
+			final: match[4] as "M" | "m",
+		});
+	}
+
+	return packets.length > 0 && offset === data.length ? packets : null;
+}
+
+/** 是否为左键按下（排除修饰键、32 表示 motion 事件）。 */
+export function isSgrLeftPress(packet: SgrMousePacket): boolean {
+	const baseButton = mouseBaseButton(packet.code);
+	return packet.final === "M" && baseButton === 0 && (packet.code & 32) === 0;
+}
+
+/** 是否为左键松开。 */
+export function isSgrLeftRelease(packet: SgrMousePacket): boolean {
+	const baseButton = mouseBaseButton(packet.code);
+	return packet.final === "m" && baseButton === 0 && (packet.code & 32) === 0;
+}
+
+/** 无按键按住的指针移动（DECSET 1003 的 35）。左键拖动（32，文本选区）不是 hover。 */
+export function isSgrIdleMotion(packet: SgrMousePacket): boolean {
+	return packet.final === "M" && (packet.code & 32) !== 0 && mouseBaseButton(packet.code) === 3;
+}
+
+/** 剥离修饰键位（4/8/16/32：shift/meta/ctrl/motion），得到基础按键码。 */
+export function mouseBaseButton(code: number): number {
+	return code & ~(4 | 8 | 16 | 32);
+}

package/node_modules/@herbertgao/pi-cc-extensions/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@herbertgao/pi-cc-extensions",
-  "version": "0.9.6",
+  "version": "0.10.0",
   "license": "MIT",
   "description": "A Pi productivity suite with Claude Code-style UI, context inspection, and agent/session references",
   "type": "module",
@@ -36,12 +36,12 @@
       "./themes/cc-dark.json",
       "./themes/cc-light.json"
     ],
-    "image": "https://raw.githubusercontent.com/HerbertGao/pi-extensions/master/packages/pi-cc-extensions/assets/readme/welcome.webp",
-    "video": "https://github.com/user-attachments/assets/debf76ea-a9dc-4f34-977f-aae344a9a7f8"
+    "image": "https://raw.githubusercontent.com/HerbertGao/pi-extensions/master/packages/pi-cc-extensions/assets/readme/preview.webp",
+    "video": "https://github.com/minuque/pi-cc-extensions/releases/download/v0.9.4/demo.mp4"
   },
   "scripts": {
-    "test": "node --test tests/**/*.test.ts",
-    "typecheck": "node scripts/typecheck.mjs",
+    "test": "node scripts/test.mjs",
+    "typecheck": "tsc --noEmit",
     "format": "biome format --write .",
     "format:check": "biome format ."
   },
@@ -69,9 +69,9 @@
   },
   "x-upstream": {
     "package": "pi-cc-extensions",
-    "version": "0.8.71",
-    "reviewedVersion": "0.9.5",
+    "version": "0.9.9",
+    "reviewedVersion": "0.9.9",
     "repository": "https://github.com/minuque/pi-cc-extensions",
-    "commit": "e43e0041b59f5d7f03be9b9d103a5f9e954e4c11"
+    "commit": "17d294bcdc5e9a7e68771f0c550440ed22738457"
   }
 }

package/node_modules/pi-antigravity/README.md

@@ -1,6 +1,7 @@
 # pi-antigravity
 
 [![npm version](https://img.shields.io/npm/v/pi-antigravity?logo=npm)](https://www.npmjs.com/package/pi-antigravity)
+[![npm downloads](https://img.shields.io/npm/dm/pi-antigravity?logo=npm)](https://www.npmjs.com/package/pi-antigravity)
 [![license](https://img.shields.io/npm/l/pi-antigravity)](LICENSE)
 [![Sponsor](https://img.shields.io/badge/Sponsor-GitHub-ea4aaa?logo=github)](https://github.com/sponsors/Rahularya01)
 
@@ -44,6 +45,8 @@ Or install the latest repository version:
 pi install git:github.com/Rahularya01/pi-antigravity
 ```
 
+On Oh My Pi, install the same package with `omp plugin install npm:pi-antigravity`.
+
 Restart Pi (or run `/reload`) after installation. To update the npm package later, use `pi update npm:pi-antigravity`.
 
 ## Quick start
@@ -58,6 +61,17 @@ Restart Pi (or run `/reload`) after installation. To update the npm package late
 
 4. Start working. If a request fails, run `/antigravity.doctor` for sanitized diagnostics.
 
+To link another account without losing the existing one, run `/login antigravity`
+again and complete Google sign-in with the other account. Manage linked accounts with:
+
+```text
+/antigravity.accounts
+/antigravity.accounts switch <index|email>
+/antigravity.accounts remove <index|email>
+```
+
+On a hard quota wall (HTTP 429 with a reset hint), the provider automatically tries the next linked account.
+
 ## Authentication and credential safety
 
 The provider uses the OAuth 2.0 Authorization Code flow with PKCE, so credentials are only ever exchanged with Google — never typed into Pi.
@@ -65,8 +79,9 @@ The provider uses the OAuth 2.0 Authorization Code flow with PKCE, so credential
 1. `/login antigravity` opens Google sign-in and starts a temporary callback listener at `http://localhost:51121/oauth-callback`.
 2. After you approve access, Pi exchanges the callback code for tokens and stores the provider credentials in Pi's auth store (normally `~/.pi/agent/auth.json`).
 3. Pi refreshes access tokens automatically when they expire — you shouldn't need to sign in again unless a token is revoked.
+4. Successful logins and token rotations are also kept in `~/.pi/agent/antigravity-accounts.json` with owner-only permissions so linked accounts can be switched without re-authenticating.
 
-The callback listener binds only to a loopback host, so it isn't reachable from outside your machine. The auth file it writes to contains sensitive access and refresh tokens: **do not commit it, paste it into issues, or share its contents.**
+The callback listener binds only to a loopback host, so it isn't reachable from outside your machine. The auth and account files it writes to contain sensitive access and refresh tokens: **do not commit them, paste them into issues, or share their contents.**
 
 Signing in requests these Google OAuth scopes:
 
@@ -90,15 +105,19 @@ Review these permissions before approving access. If your credentials expire or
 | `/model antigravity/<model-id>` | Choose a registered Antigravity model. |
 | `/antigravity.usage` | Show the server-reported shared quota groups and reset times. |
 | `/antigravity.models` | List available runtime models, remaining shared-pool quota, and capabilities. |
+| `/antigravity.accounts` | List linked accounts; use `switch` or `remove` with an index or email to manage them. |
 | `/antigravity.models all` | Include tab/chat models normally hidden from the model list. |
 | `/antigravity.refresh` | Force refresh the dynamic model catalog from Antigravity. |
 | `/antigravity.doctor` | Show sanitized provider diagnostics, including the endpoint, status, and resolved runtime model. |
 | `/antigravity.image <prompt>` | Generate an image via Antigravity and save it under `.pi/generated-images/`. Optional `--ratio 16:9`, `--model`, `--path`. |
+| `/antigravity.search <query>` | Search the web using Google Search Grounding via Antigravity. Optional `--thinking`, `--url <url>`. |
 
 Model availability, entitlement, quota groups, and resets are returned by the service and can differ by account. The quota percentage shown for a model can represent a shared pool, not a private per-model allowance.
 
 The extension also registers a `generate_image` tool the model can call. Images are written inside the project directory (default `.pi/generated-images/`). Image models such as `gemini-3-pro-image` are account-dependent; `/antigravity.image` falls back to other advertised Gemini image IDs on 404.
 
+It also registers a `google_search` tool allowing models to perform real-time web search and URL analysis using Google Search Grounding over Cloud Code Assist (powered by `gemini-3-flash` with dynamic fallback). It supports optional lead agent directives (`instruction`), specific target URLs (`urls`), and deep reasoning (`thinking: true`).
+
 ## Models and routing
 
 After you sign in, the provider refreshes its catalog from Antigravity (`fetchAvailableModels`) and groups runtime thinking variants into public Pi model IDs. Newly enabled models — for example a new Gemini Flash generation — become selectable after that refresh without waiting for an extension release. A last-known-good cache is kept for offline/cold start; the static table below is only the conservative fallback and a routing reference.
@@ -154,13 +173,13 @@ All primary environment variables start with `ANTIGRAVITY_`. The legacy `NOAGY_`
 | `ANTIGRAVITY_CLIENT_ID` | Use a custom Google OAuth client ID. |
 | `ANTIGRAVITY_CLIENT_SECRET` | Use a custom Google OAuth client secret. Keep it out of source control and shell history. |
 | `ANTIGRAVITY_NO_KEEPALIVE` | Set to `1` to skip the keep-alive connection pool. |
-| `ANTIGRAVITY_NO_PREWARM` | Set to `1` to skip the TLS pre-warm request made when the extension loads. |
+| `ANTIGRAVITY_NO_PREWARM` | Set to `1` to skip the TLS pre-warm request made on the first Antigravity request. |
 
 By default, the provider tries `https://daily-cloudcode-pa.googleapis.com`, then the sandbox host, then `https://cloudcode-pa.googleapis.com`. Prefer the built-in OAuth client unless you have a reason to use your own credentials.
 
 ### Latency
 
-Provider requests reuse a keep-alive connection pool when the runtime supports it, so consecutive turns do not repeat the DNS, TCP, and TLS handshake. When `HTTP_PROXY`, `HTTPS_PROXY`, or `ALL_PROXY` is set, that pool is skipped so Pi's proxy-aware dispatcher is used instead. The connection is also opened when the extension loads so the first message of a session skips the handshake too. For the lowest time-to-first-token, pick a fast runtime: `gemini-3.8-flash` with reasoning off routes to `gemini-3.8-flash-low` at thinking level `LOW`. Setting `ANTIGRAVITY_PROJECT_ID` also removes the project-discovery round-trip when credentials do not already carry a project ID.
+Provider requests reuse a keep-alive connection pool when the runtime supports it, so consecutive turns do not repeat the DNS, TCP, and TLS handshake. When `HTTP_PROXY`, `HTTPS_PROXY`, or `ALL_PROXY` is set, that pool is skipped so Pi's proxy-aware dispatcher is used instead. The connection is opened on the first Antigravity request rather than at Pi startup, so other extensions are not stalled by an unauthenticated handshake. For the lowest time-to-first-token, pick a fast runtime: `gemini-3.8-flash` with reasoning off routes to `gemini-3.8-flash-low` at thinking level `LOW`. Setting `ANTIGRAVITY_PROJECT_ID` also removes the project-discovery round-trip when credentials do not already carry a project ID.
 
 ## Troubleshooting
 
@@ -173,16 +192,20 @@ Provider requests reuse a keep-alive connection pool when the runtime supports i
 - **Claude/GPT tool-call schema error:** Upgrade to the latest package release. The provider adapts Pi's JSON Schema tool definitions for the Cloud Code Assist custom-tool bridge.
 - **Quota or rate limit:** Run `/antigravity.usage`. A `429` response usually indicates quota or rate limiting; changing models may still draw from the same shared pool.
 - **Need a safe diagnostic:** `/antigravity.doctor` redacts recognized secrets from its error output. Still review output before sharing it publicly.
+- **Oh My Pi says `registerApiProvider` is not exported:** Upgrade to 0.8.1 or later. Older builds statically import a Pi compat export that Oh My Pi's bundled runtime does not provide. The provider still registers through `pi.registerProvider` on that host.
 
 ## Development
 
-This repo uses [Bun](https://bun.sh) for install, scripts, and CI. The published extension itself runs on Node (Pi's CLI).
+This repo uses [Yarn 4](https://yarnpkg.com/) via Corepack for install, scripts, and CI. The published extension itself runs on Node (Pi's CLI).
 
 ```bash
-bun install
-bun run check
+corepack enable
+yarn install
+yarn check
 ```
 
+Installs are hardened against common supply-chain attacks: lifecycle scripts are off, lockfile checksums must match the npm registry, and package versions younger than three days are rejected. Do not add a second registry or enable `enableScripts` without a review.
+
 The package declares its Pi extension in `package.json` under `pi.extensions`. See the [Pi package documentation](https://pi.dev/docs/latest/packages) for package installation, manifest, and gallery conventions.
 
 ## Support the project

package/node_modules/pi-antigravity/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-antigravity",
-  "version": "0.7.2",
+  "version": "0.8.1",
   "description": "Personal Antigravity / Cloud Code Assist provider for Pi Coding Agent",
   "author": "Rahul Arya",
   "license": "MIT",
@@ -28,18 +28,22 @@
     "src",
     "tsconfig.json"
   ],
-  "packageManager": "bun@1.4.0",
+  "packageManager": "yarn@4.18.0+sha512.fcb8716fe7cd0eece141ffc18b92193a9df9204c1ba83189c288835223fc0bbe64af473bab0d5e9927a7daeb5caf2bb07eb2787cc9338ca040ea125f2a1f2f7e",
+  "engines": {
+    "node": ">=22.15.0"
+  },
   "scripts": {
     "typecheck": "tsc --noEmit",
     "lint": "eslint src",
     "lint:fix": "eslint src --fix",
     "format": "prettier --write .",
     "format:check": "prettier --check .",
-    "security-check": "bun scripts/security-check.ts",
-    "test": "bun scripts/test-model-routing.ts && bun scripts/test-model-discovery.ts && bun scripts/test-usage-formatter.ts && bun scripts/test-stream-sse.ts && bun scripts/test-stream-header-deadline.ts && bun scripts/test-http-proxy.ts && bun scripts/test-image-gen.ts",
-    "smoke:tools": "bun scripts/smoke-tool-schema.ts",
-    "smoke:models": "bun scripts/smoke-all-models.mjs",
-    "check": "bun run typecheck && bun run lint && bun run format:check && bun run security-check && bun run test"
+    "security-check": "node scripts/run-ts.mjs scripts/security-check.ts",
+    "test": "node scripts/run-ts.mjs scripts/test-model-routing.ts && node scripts/run-ts.mjs scripts/test-model-discovery.ts && node scripts/run-ts.mjs scripts/test-usage-formatter.ts && node scripts/run-ts.mjs scripts/test-stream-sse.ts && node scripts/run-ts.mjs scripts/test-stream-header-deadline.ts && node scripts/run-ts.mjs scripts/test-http-proxy.ts && node scripts/run-ts.mjs scripts/test-image-gen.ts && node scripts/run-ts.mjs scripts/test-transcript-context.ts && node scripts/run-ts.mjs scripts/test-accounts.ts && node scripts/run-ts.mjs scripts/test-search.ts",
+    "smoke:tools": "node scripts/run-ts.mjs scripts/smoke-tool-schema.ts",
+    "smoke:models": "node scripts/run-ts.mjs scripts/smoke-all-models.mjs",
+    "audit": "yarn npm audit --environment production --recursive && yarn npm audit --severity high --all --recursive",
+    "check": "yarn typecheck && yarn lint && yarn format:check && yarn security-check && yarn test && yarn audit"
   },
   "pi": {
     "extensions": [
@@ -52,6 +56,7 @@
   },
   "devDependencies": {
     "@earendil-works/pi-ai": "^0.84.2",
+    "@earendil-works/pi-coding-agent": "^0.84.2",
     "@eslint/js": "^10.0.1",
     "@types/node": "^26.1.1",
     "eslint": "^10.7.0",