@herbertgao/pi-extensions 2026.9.20 → 2026.10.1

package/node_modules/pi-typesafe/dist/usage.js

@@ -1,4 +1,4 @@
-import { chmodSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { chmodSync, closeSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { piTypesafeDir } from "./credentials.js";
 /**
@@ -37,21 +37,45 @@ function totalsOf(value) {
         outputTokens: count(raw.outputTokens),
     };
 }
+function dayOf(value) {
+    const raw = (value ?? {});
+    const costUsd = raw.costUsd;
+    const costedInputTokens = raw.costedInputTokens;
+    const costed = typeof costUsd === "number" && Number.isFinite(costUsd) && costUsd >= 0
+        && typeof costedInputTokens === "number" && Number.isSafeInteger(costedInputTokens) && costedInputTokens >= 0;
+    return costed ? { ...totalsOf(value), costUsd, costedInputTokens } : totalsOf(value);
+}
+/** Longest an update waits for the ledger lock. A request that cannot get it keeps its delta and adds it with the next update. */
+export const LOCK_WAIT_MS = 200;
+/** A lock this old belongs to a process that died while holding it; the next update takes it over. */
+export const LOCK_STALE_MS = 5_000;
+const LOCK_RETRY_MS = 2;
+/**
+ * The days stored in the file: `{}` for a missing or corrupt file, `undefined` when the file exists but cannot be read,
+ * so the caller never replaces a ledger it could not see.
+ */
 function readDays(path) {
+    let text;
     try {
-        const parsed = JSON.parse(readFileSync(path, "utf8"));
+        text = readFileSync(path, "utf8");
+    }
+    catch (error) {
+        return error.code === "ENOENT" ? {} : undefined;
+    }
+    try {
+        const parsed = JSON.parse(text);
         const days = parsed && typeof parsed === "object" ? parsed.days : undefined;
         if (!days || typeof days !== "object" || Array.isArray(days))
             return {};
         const result = {};
         for (const [day, totals] of Object.entries(days)) {
             if (/^\d{4}-\d{2}-\d{2}$/.test(day))
-                result[day] = totalsOf(totals);
+                result[day] = dayOf(totals);
         }
         return result;
     }
     catch {
-        // A missing, unreadable, or corrupt ledger restarts today's count; it never blocks a request.
+        // A corrupt ledger restarts the count; it never blocks a request.
         return {};
     }
 }
@@ -63,7 +87,21 @@ function keepRecent(days, today) {
     result[today] = days[today] ?? emptyTotals();
     return result;
 }
-/** Owner-only, atomic, and best-effort: a ledger this process cannot write never fails a request. */
+/** `base` plus `delta`. Cost fields appear once either side has them, so a day from an older file stays as it was until a cost is recorded. */
+function addDay(base, delta) {
+    return {
+        requestsStarted: base.requestsStarted + delta.requestsStarted,
+        requestsSucceeded: base.requestsSucceeded + delta.requestsSucceeded,
+        requestsFailed: base.requestsFailed + delta.requestsFailed,
+        inputTokens: base.inputTokens + delta.inputTokens,
+        outputTokens: base.outputTokens + delta.outputTokens,
+        ...(delta.costUsd === undefined && base.costUsd === undefined ? {} : {
+            costUsd: Math.round(((base.costUsd ?? 0) + (delta.costUsd ?? 0)) * 1e12) / 1e12,
+            costedInputTokens: (base.costedInputTokens ?? 0) + (delta.costedInputTokens ?? 0),
+        }),
+    };
+}
+/** Owner-only and atomic. Returns false when the file could not be written: a ledger this process cannot write never fails a request. */
 function writeDays(path, days) {
     const file = { version: USAGE_VERSION, days };
     const temporary = `${path}.${process.pid}.tmp`;
@@ -72,12 +110,58 @@ function writeDays(path, days) {
         writeFileSync(temporary, `${JSON.stringify(file, null, 2)}\n`, { mode: 0o600, flag: "w" });
         chmodSync(temporary, 0o600);
         renameSync(temporary, path);
+        return true;
     }
     catch {
         try {
             rmSync(temporary, { force: true });
         }
         catch { /* best-effort cleanup only */ }
+        return false;
+    }
+}
+function pause(ms) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+/**
+ * Take the lock file next to the ledger, created exclusively. Waits at most LOCK_WAIT_MS; a lock older than
+ * LOCK_STALE_MS is taken over. Returns the release function, or undefined when the lock could not be taken.
+ */
+function takeLock(lock) {
+    const deadline = Date.now() + LOCK_WAIT_MS;
+    try {
+        mkdirSync(dirname(lock), { recursive: true, mode: 0o700 });
+        for (;;) {
+            try {
+                closeSync(openSync(lock, "wx", 0o600));
+                return () => { try {
+                    unlinkSync(lock);
+                }
+                catch { /* already gone */ } };
+            }
+            catch (error) {
+                if (error.code !== "EEXIST")
+                    return undefined;
+            }
+            try {
+                if (Date.now() - statSync(lock).mtimeMs > LOCK_STALE_MS) {
+                    unlinkSync(lock);
+                    continue;
+                }
+            }
+            catch (error) {
+                // The holder released it, or another process took it over, between our open and our stat.
+                if (error.code !== "ENOENT")
+                    return undefined;
+                continue;
+            }
+            if (Date.now() >= deadline)
+                return undefined;
+            pause(LOCK_RETRY_MS);
+        }
+    }
+    catch {
+        return undefined;
     }
 }
 /** The caps a headless run may set without code: `PI_TYPESAFE_MAX_USD_PER_DAY` and its siblings. */
@@ -113,54 +197,75 @@ export function mergeCaps(explicit, environment) {
 }
 export function openUsageLedger(options = {}) {
     const path = options.path ?? usagePath();
+    const lock = `${path}.lock`;
     const now = options.now ?? (() => new Date());
-    const usdPerMTok = options.usdPerMTok && options.usdPerMTok > 0 ? options.usdPerMTok : DEFAULT_USD_PER_MTOK;
-    let day = localDay(now());
-    let days = keepRecent(readDays(path), day);
-    let totals = days[day];
+    const usdPerMTok = options.usdPerMTok !== undefined && Number.isFinite(options.usdPerMTok) && options.usdPerMTok >= 0 ? options.usdPerMTok : DEFAULT_USD_PER_MTOK;
+    /** Deltas this process has recorded and the file does not hold yet, by day. */
+    let pending = {};
+    /** Recorded costs plus an estimate for the input tokens that have none. */
+    const costOf = (value) => Math.round(((value.costUsd ?? 0) + estimateUsd(Math.max(0, value.inputTokens - (value.costedInputTokens ?? 0)), usdPerMTok)) * 1e6) / 1e6;
     const report = (value, name) => ({
-        ...value, day: name, estimatedUsd: estimateUsd(value.inputTokens, usdPerMTok),
+        requestsStarted: value.requestsStarted,
+        requestsSucceeded: value.requestsSucceeded,
+        requestsFailed: value.requestsFailed,
+        inputTokens: value.inputTokens,
+        outputTokens: value.outputTokens,
+        day: name,
+        estimatedUsd: costOf(value),
     });
-    const save = () => {
-        days = keepRecent({ ...days, [day]: totals }, day);
-        writeDays(path, days);
+    /** The file's current content for today, plus whatever this process still holds. */
+    const current = () => {
+        const day = localDay(now());
+        const stored = readDays(path)?.[day] ?? emptyTotals();
+        return { day, totals: pending[day] === undefined ? stored : addDay(stored, pending[day]) };
     };
-    const roll = () => {
-        const current = localDay(now());
-        if (current === day)
+    const flush = () => {
+        const owed = Object.entries(pending);
+        if (owed.length === 0)
+            return;
+        const release = takeLock(lock);
+        if (!release)
             return;
-        day = current;
-        totals = days[day] ?? emptyTotals();
-        days = keepRecent(days, day);
+        try {
+            const stored = readDays(path);
+            if (!stored)
+                return;
+            for (const [name, delta] of owed)
+                stored[name] = addDay(stored[name] ?? emptyTotals(), delta);
+            if (writeDays(path, keepRecent(stored, localDay(now()))))
+                pending = {};
+        }
+        finally {
+            release();
+        }
     };
     const add = (delta) => {
-        roll();
-        totals = {
-            requestsStarted: totals.requestsStarted + (delta.requestsStarted ?? 0),
-            requestsSucceeded: totals.requestsSucceeded + (delta.requestsSucceeded ?? 0),
-            requestsFailed: totals.requestsFailed + (delta.requestsFailed ?? 0),
-            inputTokens: totals.inputTokens + (delta.inputTokens ?? 0),
-            outputTokens: totals.outputTokens + (delta.outputTokens ?? 0),
-        };
-        save();
+        const day = localDay(now());
+        pending[day] = addDay(pending[day] ?? emptyTotals(), { ...emptyTotals(), ...delta });
+        flush();
     };
     return {
         path,
         usdPerMTok,
-        today: () => { roll(); return report(totals, day); },
+        today: () => { const { day, totals } = current(); return report(totals, day); },
         recordStart: () => add({ requestsStarted: 1 }),
-        recordSuccess: (inputTokens, outputTokens) => add({
-            requestsSucceeded: 1,
-            inputTokens: Number.isSafeInteger(inputTokens) && inputTokens > 0 ? inputTokens : 0,
-            outputTokens: Number.isSafeInteger(outputTokens) && outputTokens > 0 ? outputTokens : 0,
-        }),
+        recordSuccess: (inputTokens, outputTokens, usd) => {
+            const input = Number.isSafeInteger(inputTokens) && inputTokens > 0 ? inputTokens : 0;
+            add({
+                requestsSucceeded: 1,
+                inputTokens: input,
+                outputTokens: Number.isSafeInteger(outputTokens) && outputTokens > 0 ? outputTokens : 0,
+                ...(usd !== undefined && Number.isFinite(usd) && usd >= 0 ? { costUsd: usd, costedInputTokens: input } : {}),
+            });
+        },
         recordFailure: () => add({ requestsFailed: 1 }),
+        flush,
         blocked: (caps) => {
-            roll();
+            const { day, totals } = current();
             const checks = [
                 ["requestsPerDay", caps.maxRequestsPerDay, totals.requestsStarted],
                 ["inputTokensPerDay", caps.maxInputTokensPerDay, totals.inputTokens],
-                ["usdPerDay", caps.maxUsdPerDay, estimateUsd(totals.inputTokens, usdPerMTok)],
+                ["usdPerDay", caps.maxUsdPerDay, costOf(totals)],
             ];
             for (const [cap, limit, used] of checks) {
                 if (limit !== undefined && used >= limit)
@@ -169,14 +274,14 @@ export function openUsageLedger(options = {}) {
             return undefined;
         },
         describe: (caps = {}) => {
-            roll();
-            const current = report(totals, day);
+            const { day, totals } = current();
+            const today = report(totals, day);
             const limits = [
-                caps.maxRequestsPerDay === undefined ? undefined : `${current.requestsStarted}/${caps.maxRequestsPerDay} requests`,
-                caps.maxInputTokensPerDay === undefined ? undefined : `${current.inputTokens}/${caps.maxInputTokensPerDay} input tokens`,
-                caps.maxUsdPerDay === undefined ? undefined : `$${current.estimatedUsd.toFixed(4)}/$${caps.maxUsdPerDay.toFixed(2)}`,
+                caps.maxRequestsPerDay === undefined ? undefined : `${today.requestsStarted}/${caps.maxRequestsPerDay} requests`,
+                caps.maxInputTokensPerDay === undefined ? undefined : `${today.inputTokens}/${caps.maxInputTokensPerDay} input tokens`,
+                caps.maxUsdPerDay === undefined ? undefined : `$${today.estimatedUsd.toFixed(4)}/$${caps.maxUsdPerDay.toFixed(2)}`,
             ].filter((part) => part !== undefined);
-            return `${current.requestsStarted} requests today (${current.requestsSucceeded} ok, ${current.requestsFailed} failed), ${current.inputTokens} input / ${current.outputTokens} output tokens, ~$${current.estimatedUsd.toFixed(4)}${limits.length ? `; caps ${limits.join(", ")}` : "; no daily cap"}`;
+            return `${today.requestsStarted} requests today (${today.requestsSucceeded} ok, ${today.requestsFailed} failed), ${today.inputTokens} input / ${today.outputTokens} output tokens, ~$${today.estimatedUsd.toFixed(4)}${limits.length ? `; caps ${limits.join(", ")}` : "; no daily cap"}`;
         },
     };
 }

package/node_modules/pi-typesafe/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-typesafe",
-  "version": "0.8.1",
+  "version": "0.9.1",
   "description": "TypeSafe AI (Jev) decisions for Pi: batched Choice/Score/Noul evaluation tool, terminal playground, and a typed API other extensions build on.",
   "type": "module",
   "license": "MIT",

package/node_modules/pi-web-access/CHANGELOG.md

@@ -4,6 +4,71 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+## [0.37.0] - 2026-10-05
+
+### Highlights
+
+- Search through degoog, a self-hosted or public metasearch engine, with no API key needed.
+- Perplexity search results now include real page snippets and cost less per search.
+- Pi `codemode` scripts can work with search results and fetched pages as data instead of reading formatted text.
+- Failed tool calls are now marked as errors, so Pi and MCP clients can tell a failure from a success.
+
+### Added
+
+- New degoog search provider for a self-hosted or public [degoog](https://degoog.org) metasearch instance, used only when you select it. It works without an API key and uses `https://degoog.org` by default. Set `degoogBaseUrl` or `DEGOOG_URL` to use your own instance, `degoogApiKey` or `DEGOOG_API_KEY` if your instance requires a key, and `degoogEngines` to limit which engines it queries. It supports domain and recency filters, routing, and the curator. Thanks to [@zhouzhuojie](https://github.com/zhouzhuojie) for [PR #515](https://github.com/nicobailon/pi-web-access/pull/515).
+- In Pi `codemode` scripts, `web_search` and `fetch_content` return data instead of the text the model sees: each query's results and errors, and each URL's full content and error, even when the call fails. Searches from a script don't open the curator unless the script asks for it, and `includeContent` waits for the pages instead of fetching them in the background. What the model sees and the MCP output are unchanged. See "In codemode scripts" in the README. [Issue #516](https://github.com/nicobailon/pi-web-access/issues/516).
+
+### Changed
+
+- Perplexity `web_search` results now come from Perplexity's Search API, so each result has a real page snippet instead of an empty one, and searches cost less ($1 per 1,000 searches, with no token billing). Results no longer include an answer written by Sonar. YouTube summaries still use Sonar. Thanks to [@DWalland](https://github.com/DWalland) for [issue #512](https://github.com/nicobailon/pi-web-access/issues/512).
+- Failed tool calls are now marked as errors (`isError: true`) in Pi and over MCP. This covers invalid arguments and calls where nothing succeeded, such as a `web_search` or `source_check` where every search failed. Pi versions before 1.0 ignore the marker. `fetch_content` called without a URL now names the parameters to use, as `web_search` already did. Other messages are unchanged. Thanks to [@j-koester](https://github.com/j-koester) for [PR #514](https://github.com/nicobailon/pi-web-access/pull/514).
+
+## [0.36.0] - 2026-10-04
+
+### Highlights
+
+- Use pi-web-access's search and fetch tools from Claude Code, Codex, Cursor, and other MCP clients with `npx -y pi-web-access`.
+- Docs sites that publish markdown versions of their pages now come back as clean markdown.
+- Brave prepaid keys keep working after the first search, and OpenAI search shows the real error, such as a usage limit.
+- Keep Firecrawl PDF costs down by reading only the first few pages of each PDF.
+- New Keenable search provider that works without an API key.
+
+### Added
+
+- The search and fetch tools (`web_search`, `fetch_content`, `get_search_content`, and `source_check`) run as a local MCP server for Claude Code, Codex, Cursor, and other MCP clients. Start it with `npx -y pi-web-access`. It reads the same `web-search.json` and provider keys as the Pi extension and does not need Pi installed. Pi-only features such as the curator, summaries, and Kimi search are not available there. See "Use from other agents (MCP)" in the README. Thanks to [@Avg8888](https://github.com/Avg8888) for [issue #496](https://github.com/nicobailon/pi-web-access/issues/496).
+- `fetch_content` asks servers for markdown first, so sites that publish markdown versions of pages (Cloudflare, Mintlify, and other docs hosts) return clean markdown directly. `mode: "raw"` still asks for the server's normal representation. Thanks to [@erwinkramer](https://github.com/erwinkramer) for [issue #495](https://github.com/nicobailon/pi-web-access/issues/495).
+- `web_search` can restrict Exa results to a category such as `news` or `research paper` with the new `category` parameter. Other providers ignore it. Without an Exa API key, if Exa's filtered search is unavailable, the category is added to the query text instead. Thanks to [@SuTang-vain](https://github.com/SuTang-vain) for [PR #493](https://github.com/nicobailon/pi-web-access/pull/493).
+- New Keenable search provider, used only when you select it. It works without an API key through Keenable's public endpoint; set `keenableApiKey` or `KEENABLE_API_KEY` for higher limits. It supports domain and recency filters, routing, and the curator. Thanks to [@ilya-bogin-keenable](https://github.com/ilya-bogin-keenable) for [PR #506](https://github.com/nicobailon/pi-web-access/pull/506).
+- Set `firecrawlPdfMaxPages` to have Firecrawl read only the first N pages of each PDF, which caps per-page PDF billing on fetches and `includeContent` searches. Cut-off PDFs end with a note giving both page counts. Leaving it unset keeps the current behavior. Thanks to [@Dangooy](https://github.com/Dangooy) for [issue #507](https://github.com/nicobailon/pi-web-access/issues/507).
+
+### Fixed
+
+- Brave search with a prepaid (pay-as-you-go) key no longer fails every call after the first with "quota exhausted; estimated reset in ~702h". Prepaid plans report a monthly rate limit of 0, which was read as an exhausted quota. Thanks to [@kk-code-lab](https://github.com/kk-code-lab) for [issue #501](https://github.com/nicobailon/pi-web-access/issues/501).
+- OpenAI web search shows the server's real error when a response fails partway, such as a ChatGPT subscription usage limit, instead of "no parseable response output". Falling back to the next provider still works. Thanks to [@ShinoharaHaruna](https://github.com/ShinoharaHaruna) for [PR #505](https://github.com/nicobailon/pi-web-access/pull/505).
+- `web_search` with `includeContent` keeps page content the search provider already returned and only fetches the pages it didn't cover. Before, it fetched every page again, and a failed fetch replaced usable content.
+- `web_search` accepts `provider`, `queries`, and `domainFilter` lists that the model sent as a JSON string, such as `provider: "[\"parallel-mcp\"]"`. Before, these calls were rejected before the search ran. Thanks to [@advaitpaliwal](https://github.com/advaitpaliwal) for [PR #491](https://github.com/nicobailon/pi-web-access/pull/491).
+- `fetch_content` reports a tool error when its only URL failed or every URL in a batch failed. Before, Pi recorded these as successful calls even though the text said `Error: ...`. Batches where some URLs succeed are unchanged. Thanks to [@MDGChamomile](https://github.com/MDGChamomile) for [PR #504](https://github.com/nicobailon/pi-web-access/pull/504).
+- `get_search_content` reads a fetched page without `url` or `urlIndex` when the fetch holds only one page. Before, calls like `{ responseId, findText }` failed with "No URL specified" and the model had to retry with `urlIndex: 0`. Thanks to [@j-koester](https://github.com/j-koester) for [PR #494](https://github.com/nicobailon/pi-web-access/pull/494).
+- When the model reads a long `source_check` result with `get_search_content`, each page now says how to get the next one, as search and fetch pages already did.
+- Local video analysis through the Gemini Web cookie fallback no longer comes back as "garbled characters", because uploads now send the file's type and name. Thanks to [@leonzyb](https://github.com/leonzyb) for [issue #508](https://github.com/nicobailon/pi-web-access/issues/508).
+
+## [0.35.0] - 2026-09-30
+
+### Highlights
+
+- Tell the summarizer what matters to you, such as keeping prices, limits, and versions exactly as written.
+- Brave search holds up on low-rate plans instead of failing when several searches run at once.
+- OpenAI web search works when you signed in to Pi with your ChatGPT account.
+
+### Added
+
+- Add your own instructions to search summaries with `summaryInstructions` in `web-search.json`, for example "keep prices, limits, and versions verbatim." They apply to summaries from the curator and the `auto-summary` workflow, and the built-in safety rules still apply. Thanks to [@rcharrisg](https://github.com/rcharrisg) for [PR #489](https://github.com/nicobailon/pi-web-access/pull/489).
+
+### Fixed
+
+- Brave searches now wait their turn according to the rate limits Brave reports, so running several searches at once no longer overruns low-rate plans. If Brave says to slow down and the wait is short, the search retries once. If the wait is long, it fails right away and later searches respect the same wait. The 30-second search timeout includes this waiting. Thanks to [@saschaSpoonbill](https://github.com/saschaSpoonbill) for [PR #487](https://github.com/nicobailon/pi-web-access/pull/487).
+- OpenAI web search now works when you signed in to Pi with "Sign in with ChatGPT" on the `openai` provider. Searches go to OpenAI's official API, and `auto` search tries OpenAI first for this login, as it already did for `openai-codex`. With an `openai` API key, `auto` still tries Exa first. Thanks to [@kasumikira](https://github.com/kasumikira) for [issue #488](https://github.com/nicobailon/pi-web-access/issues/488).
+
 ## [0.34.0] - 2026-09-30
 
 ### Highlights