@humain/terminal 0.0.3-beta.3 → 0.0.4-beta.2

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@humain/terminal",
-	"version": "0.0.3-beta.3",
+	"version": "0.0.4-beta.2",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"type": "module",
 	"humainTerminalConfig": {
@@ -9,7 +9,7 @@
 		"configDir": ".humain-terminal",
 		"envPrefix": "HUMAIN_TERMINAL",
 		"firstTimeSetup": true,
-		"upstreamPiVersion": "0.84.1"
+		"upstreamPiVersion": "0.84.2"
 	},
 	"piConfig": {
 		"name": "humain-terminal",
@@ -61,49 +61,49 @@
 		"prepublishOnly": "npm run clean && npm run build && npm run shrinkwrap"
 	},
 	"dependencies": {
-		"@aws-sdk/client-bedrock-runtime": "3.1048.0",
-		"@earendil-works/pi-agent-core": "0.84.1",
-		"@earendil-works/pi-ai": "0.84.1",
-		"@earendil-works/pi-client": "0.84.1",
-		"@earendil-works/pi-protocol": "0.84.1",
-		"@earendil-works/pi-tui": "0.84.1",
+		"@aws-sdk/client-bedrock-runtime": "3.1114.0",
+		"@earendil-works/pi-agent-core": "0.84.2",
+		"@earendil-works/pi-ai": "0.84.2",
+		"@earendil-works/pi-client": "0.84.2",
+		"@earendil-works/pi-protocol": "0.84.2",
+		"@earendil-works/pi-tui": "0.84.2",
 		"@modelcontextprotocol/client": "2.0.0",
 		"@modelcontextprotocol/core": "2.0.0",
 		"@modelcontextprotocol/ext-apps": "1.7.5",
 		"@mozilla/readability": "0.6.0",
 		"@napi-rs/keyring": "1.3.0",
 		"@silvia-odwyer/photon-node": "0.3.4",
-		"@smithy/node-http-handler": "4.7.3",
-		"chalk": "5.6.2",
+		"@smithy/node-http-handler": "4.11.2",
+		"chalk": "6.0.0",
 		"ajv": "8.20.0",
 		"ajv-formats": "3.0.1",
 		"cross-spawn": "7.0.6",
-		"diff": "8.0.4",
+		"diff": "9.0.0",
 		"glob": "13.0.6",
-		"grok-mermaid": "0.2.2",
-		"highlight.js": "10.7.3",
-		"hosted-git-info": "9.0.3",
-		"ignore": "7.0.5",
-		"http-proxy-agent": "7.0.2",
-		"https-proxy-agent": "7.0.6",
+		"grok-mermaid": "0.2.3",
+		"highlight.js": "11.12.0",
+		"hosted-git-info": "10.1.1",
+		"ignore": "7.0.6",
+		"http-proxy-agent": "9.1.0",
+		"https-proxy-agent": "9.1.0",
 		"jiti": "2.7.0",
-		"linkedom": "0.16.11",
-		"minimatch": "10.2.5",
-		"p-limit": "6.1.0",
+		"linkedom": "0.18.13",
+		"minimatch": "10.2.6",
+		"p-limit": "7.3.1",
 		"partial-json": "0.1.7",
-		"open": "10.2.0",
+		"open": "11.0.1",
 		"promise.try": "2.0.1",
 		"proper-lockfile": "4.1.2",
 		"recheck": "4.5.0",
-		"semver": "7.8.0",
+		"semver": "7.8.5",
 		"smol-toml": "1.8.0",
 		"strip-json-comments": "5.0.3",
-		"turndown": "7.2.0",
-		"typebox": "1.3.7",
-		"undici": "8.9.0",
-		"unpdf": "1.6.2",
+		"turndown": "7.2.4",
+		"typebox": "1.3.16",
+		"undici": "8.10.0",
+		"unpdf": "1.8.1",
 		"yaml": "2.9.0",
-		"zod": "3.25.76"
+		"zod": "4.4.3"
 	},
 	"overrides": {
 		"protobufjs": "7.6.5",
@@ -117,16 +117,16 @@
 	},
 	"devDependencies": {
 		"@types/cross-spawn": "6.0.6",
-		"@types/diff": "7.0.2",
+		"@types/diff": "8.0.0",
 		"@types/hosted-git-info": "3.0.5",
 		"@types/ms": "2.1.0",
-		"@types/node": "24.12.4",
+		"@types/node": "26.2.0",
 		"@types/proper-lockfile": "4.1.4",
-		"@types/semver": "7.7.1",
+		"@types/semver": "7.8.0",
 		"@types/turndown": "5.0.6",
 		"shx": "0.4.0",
-		"typescript": "5.9.3",
-		"vitest": "4.1.9"
+		"typescript": "7.0.2",
+		"vitest": "4.1.11"
 	},
 	"keywords": [
 		"humain-terminal",
@@ -146,6 +146,6 @@
 		"directory": "packages/coding-agent"
 	},
 	"engines": {
-		"node": ">=22.19.0"
+		"node": ">=22.22.2"
 	}
 }

package/src/humain/mcp-adapter/UPSTREAM.md

@@ -1,7 +1,7 @@
 # pi-mcp-adapter upstream tracking
 
 HUMAIN Terminal vendors [`pi-mcp-adapter`](https://github.com/nicobailon/pi-mcp-adapter)
-version `2.26.0` so MCP support is available without a separate VM installation.
+version `2.27.0` so MCP support is available without a separate VM installation.
 
 The unmodified upstream package is recorded in `upstream.json`. During updates:
 

package/src/humain/mcp-adapter/upstream.json

@@ -1,7 +1,7 @@
 {
   "name": "pi-mcp-adapter",
   "repository": "https://github.com/nicobailon/pi-mcp-adapter",
-  "version": "2.26.0",
-  "tarball": "https://registry.npmjs.org/pi-mcp-adapter/-/pi-mcp-adapter-2.26.0.tgz",
-  "integrity": "sha512-S1L1cTvYdDUIkNGvg/dR1v3ljfxeq6nAA8ffnB+xB5nZH4DSU8Ks9KdmKgmEH4TAEsSxGgv194i6WYORHF0Clg=="
+  "version": "2.27.0",
+  "tarball": "https://registry.npmjs.org/pi-mcp-adapter/-/pi-mcp-adapter-2.27.0.tgz",
+  "integrity": "sha512-IM9dfGhou5Q5AJqwkm1kW1+WXyMsvL53GEO4JVYukzvTxNPHn2b+Zi49+JAnOhlaOpEq5vEodUSJXmpghik+lw=="
 }

package/src/humain/mcp-adapter/vendor/CHANGELOG.md

@@ -7,6 +7,42 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.27.0] - 2026-08-20
+
+### Highlights
+- MCP servers can now come from packages, runtime extension APIs, or the usual config files.
+- Static bearer tokens can use the OS credential store, with a stdin-only CLI for safer token management.
+- Long-lived sessions recover better when remote MCP servers are slow, refreshed, or reconnected.
+- OAuth flows clean up their callback listener when idle and work better inside nested terminal UI prompts.
+- Search, metadata cache writes, direct-tool counts, and UI stream pruning now do less repeated work.
+
+### Added
+- `/pi-mcp` now works as an alias for `/mcp` when a host reserves `/mcp`. Thanks to [@inxeoz](https://github.com/inxeoz) for #391.
+- `registerMcpServer({ pi, name, definition })` lets other extensions register and dispose session-scoped MCP servers at runtime. Registrations are proxy-tool-only, never persisted, and duplicate names fail closed. Thanks to [@bendavis78](https://github.com/bendavis78) and [@fmoda3](https://github.com/fmoda3) for the runtime API request in #376/#382.
+- Pi packages can ship prefixed MCP server definitions with `pi.mcp` manifest entries, without asking users to edit MCP config files. Thanks to [@bendavis78](https://github.com/bendavis78) for #376 and [@fmoda3](https://github.com/fmoda3) for the manifest design.
+- Static bearer tokens can opt into OS credential-store lookup with URL-bound records by setting `bearerTokenStore: true`. The new `pi-mcp-adapter token set|status|remove <server>` CLI reads tokens from stdin and never accepts a token as an argument. Thanks to [@AlexanderBartash](https://github.com/AlexanderBartash) for issue #366.
+
+### Changed
+- Search ranking now reuses normalized MCP tool fields and keyword tokens per catalog.
+- Per-request header commands collect process cleanup data in one snapshot per pass, reducing cold HTTP connect overhead.
+- Metadata cache saves write compact JSON while preserving atomic replacement and cross-process merges.
+- High-frequency UI stream event-log pruning tracks the latest checkpoint event ID instead of rescanning retained patches.
+- The MCP panel reuses direct-tool counts and token totals across renders while keeping toggle and reconnect updates immediate.
+
+### Fixed
+- Short-lived `mcpScript` workers no longer emit false unmanaged file-descriptor warnings on Node 24. Thanks to [@blalor](https://github.com/blalor) for PR #407.
+- OAuth callback listeners are released after idle auth flows, and MCP pickers stay hidden while nested OAuth input is active. Thanks to [@trevorleibert-mixpanel](https://github.com/trevorleibert-mixpanel) for PRs #403 and #404.
+- Request-header command cleanup can scan large process lists without overflowing `spawnSync`'s 1 MiB default buffer, which previously caused spurious `HTTP request headers command cleanup failed: ps exited with code unknown` refresh failures on busy hosts. Thanks to [@rtfpessoa](https://github.com/rtfpessoa) for PR #399.
+- Slow but healthy remote keep-alive servers are no longer marked failed when a bounded tools/list refresh times out. Thanks to [@brightmeowso](https://github.com/brightmeowso) for #400.
+- Cached metadata reconstruction now reuses one selector candidate index, avoiding repeated scans of large cached catalogs at startup.
+- MCP status consumers no longer see a connected catalog before Pi's model-facing tool surface is current. The first connected status snapshot now waits for direct-tool synchronization. Thanks to [@dmorn](https://github.com/dmorn) for PR #380.
+- JSON-string MCP tool-call arguments are normalized before approval and transport, preserving all fields and embedded quotes. Thanks to [@sebbean](https://github.com/sebbean) for PR #377.
+- Session tool approvals are scoped to the approved argument payload instead of every later call to the same tool. Thanks to [@spaceshipmike](https://github.com/spaceshipmike) for #367.
+- MCP panel commands no longer hang in RPC, JSON, and print modes when terminal-only custom UI is unavailable. Thanks to [@shixin-guo](https://github.com/shixin-guo) for PR #365.
+- Compact MCP rows now show a bounded tool-input preview and skip leading blank output lines in collapsed result previews.
+- MCP gateway requests nested inside proxy `args` are recovered instead of silently showing status, and invalid nested gateway requests now fail with guidance. Thanks to [@ibrmora](https://github.com/ibrmora) for #363.
+- Remote keep-alive tool catalogs refresh before user input, adapter-triggered turns, and health checks. Expired Streamable HTTP sessions reconnect so long-lived Pi sessions can discover replacement catalogs without restarting. Thanks to [@dmorn](https://github.com/dmorn) for #369 and PR #370.
+
 ## [2.26.0] - 2026-08-14
 
 ### Added

package/src/humain/web-access/UPSTREAM.md

@@ -1,7 +1,7 @@
 # pi-web-access upstream tracking
 
 The vendored implementation in `vendor/` is based on
-[`pi-web-access`](https://github.com/nicobailon/pi-web-access) version `0.23.0`
+[`pi-web-access`](https://github.com/nicobailon/pi-web-access) version `0.24.1`
 and remains licensed under the upstream MIT license in `vendor/LICENSE`.
 
 `upstream.json` records the npm tarball URL, SHA-1 shasum, SHA-512 integrity,

package/src/humain/web-access/upstream.json

@@ -1,10 +1,10 @@
 {
 	"name": "pi-web-access",
 	"repository": "https://github.com/nicobailon/pi-web-access",
-	"version": "0.23.0",
-	"tarball": "https://registry.npmjs.org/pi-web-access/-/pi-web-access-0.23.0.tgz",
-	"shasum": "342020d636c49c956044a2ea2713d677c67c923f",
-	"integrity": "sha512-RrMaR/1iI1E7LNBkthUzD8yaPmMhAYY/EzBm+bAN9QA1I8g5YBpLVrD97+d6ezsGN6qdOX0E++psBj12i74kRw==",
+	"version": "0.24.1",
+	"tarball": "https://registry.npmjs.org/pi-web-access/-/pi-web-access-0.24.1.tgz",
+	"shasum": "78449966e7f682f707bb9964c3e62d5f04318d8c",
+	"integrity": "sha512-kNYVqPT2wbWbDKD2mfMsrCie1DyVsE/KYNVgpp7yqq072sG2PciKAB28PG4h0+klSO3MtCFRoPWAyA+l0CS7/A==",
 	"humainPatches": [
 		"extract.ts",
 		"gemini-search.ts",

package/examples/extensions/subagent/agents.ts

@@ -1,126 +0,0 @@
-/**
- * Agent discovery and configuration
- */
-
-import * as fs from "node:fs";
-import * as path from "node:path";
-import { CONFIG_DIR_NAME, getAgentDir, parseFrontmatter } from "@humain/terminal";
-
-export type AgentScope = "user" | "project" | "both";
-
-export interface AgentConfig {
-	name: string;
-	description: string;
-	tools?: string[];
-	model?: string;
-	systemPrompt: string;
-	source: "user" | "project";
-	filePath: string;
-}
-
-export interface AgentDiscoveryResult {
-	agents: AgentConfig[];
-	projectAgentsDir: string | null;
-}
-
-function loadAgentsFromDir(dir: string, source: "user" | "project"): AgentConfig[] {
-	const agents: AgentConfig[] = [];
-
-	if (!fs.existsSync(dir)) {
-		return agents;
-	}
-
-	let entries: fs.Dirent[];
-	try {
-		entries = fs.readdirSync(dir, { withFileTypes: true });
-	} catch {
-		return agents;
-	}
-
-	for (const entry of entries) {
-		if (!entry.name.endsWith(".md")) continue;
-		if (!entry.isFile() && !entry.isSymbolicLink()) continue;
-
-		const filePath = path.join(dir, entry.name);
-		let content: string;
-		try {
-			content = fs.readFileSync(filePath, "utf-8");
-		} catch {
-			continue;
-		}
-
-		const { frontmatter, body } = parseFrontmatter<Record<string, string>>(content);
-
-		if (!frontmatter.name || !frontmatter.description) {
-			continue;
-		}
-
-		const tools = frontmatter.tools
-			?.split(",")
-			.map((t: string) => t.trim())
-			.filter(Boolean);
-
-		agents.push({
-			name: frontmatter.name,
-			description: frontmatter.description,
-			tools: tools && tools.length > 0 ? tools : undefined,
-			model: frontmatter.model,
-			systemPrompt: body,
-			source,
-			filePath,
-		});
-	}
-
-	return agents;
-}
-
-function isDirectory(p: string): boolean {
-	try {
-		return fs.statSync(p).isDirectory();
-	} catch {
-		return false;
-	}
-}
-
-function findNearestProjectAgentsDir(cwd: string): string | null {
-	let currentDir = cwd;
-	while (true) {
-		const candidate = path.join(currentDir, CONFIG_DIR_NAME, "agents");
-		if (isDirectory(candidate)) return candidate;
-
-		const parentDir = path.dirname(currentDir);
-		if (parentDir === currentDir) return null;
-		currentDir = parentDir;
-	}
-}
-
-export function discoverAgents(cwd: string, scope: AgentScope): AgentDiscoveryResult {
-	const userDir = path.join(getAgentDir(), "agents");
-	const projectAgentsDir = findNearestProjectAgentsDir(cwd);
-
-	const userAgents = scope === "project" ? [] : loadAgentsFromDir(userDir, "user");
-	const projectAgents = scope === "user" || !projectAgentsDir ? [] : loadAgentsFromDir(projectAgentsDir, "project");
-
-	const agentMap = new Map<string, AgentConfig>();
-
-	if (scope === "both") {
-		for (const agent of userAgents) agentMap.set(agent.name, agent);
-		for (const agent of projectAgents) agentMap.set(agent.name, agent);
-	} else if (scope === "user") {
-		for (const agent of userAgents) agentMap.set(agent.name, agent);
-	} else {
-		for (const agent of projectAgents) agentMap.set(agent.name, agent);
-	}
-
-	return { agents: Array.from(agentMap.values()), projectAgentsDir };
-}
-
-export function formatAgentList(agents: AgentConfig[], maxItems: number): { text: string; remaining: number } {
-	if (agents.length === 0) return { text: "none", remaining: 0 };
-	const listed = agents.slice(0, maxItems);
-	const remaining = agents.length - listed.length;
-	return {
-		text: listed.map((a) => `${a.name} (${a.source}): ${a.description}`).join("; "),
-		remaining,
-	};
-}