@humain/terminal 0.0.6 → 0.0.8

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@humain/terminal",
-	"version": "0.0.6",
+	"version": "0.0.8",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"type": "module",
 	"humainTerminalConfig": {
@@ -9,7 +9,7 @@
 		"configDir": ".humain-terminal",
 		"envPrefix": "HUMAIN_TERMINAL",
 		"firstTimeSetup": true,
-		"upstreamPiVersion": "0.84.2"
+		"upstreamPiVersion": "0.84.4"
 	},
 	"piConfig": {
 		"name": "humain-terminal",
@@ -17,9 +17,9 @@
 		"configDir": ".humain-terminal"
 	},
 	"bin": {
-		"humain-terminal": "dist/cli.js",
-		"humain": "dist/cli.js",
-		"hc": "dist/cli.js"
+		"humain-terminal": "dist/bundle/cli.js",
+		"humain": "dist/bundle/cli.js",
+		"hc": "dist/bundle/cli.js"
 	},
 	"main": "./dist/index.js",
 	"types": "./dist/index.d.ts",
@@ -29,7 +29,7 @@
 			"import": "./dist/index.js"
 		},
 		"./rpc-entry": {
-			"import": "./dist/rpc-entry.js"
+			"import": "./dist/bundle/rpc-entry.js"
 		},
 		"./client": {
 			"types": "./dist/client/index.d.ts",
@@ -52,8 +52,9 @@
 	],
 	"scripts": {
 		"clean": "shx rm -rf dist",
-		"build": "tsgo -p tsconfig.build.json && shx chmod +x dist/cli.js dist/rpc-entry.js && npm run copy-assets",
-		"build:binary": "npm --prefix ../tui run build && npm --prefix ../telemetry run build && npm --prefix ../ai run build && npm --prefix ../agent run build && npm --prefix ../protocol run build && npm --prefix ../client run build && npm run build && bun build --compile --no-compile-autoload-bunfig ./dist/bun/cli.js ./src/utils/image-resize-worker.ts --outfile dist/pi && npm run copy-binary-assets",
+		"build": "npm run build:unbundled && node ../../scripts/build-coding-agent-bundle.mjs",
+		"build:unbundled": "tsgo -p tsconfig.build.json && shx chmod +x dist/cli.js dist/rpc-entry.js && npm run copy-assets",
+		"build:binary": "npm --prefix ../tui run build && npm --prefix ../telemetry run build && npm --prefix ../ai run build && npm --prefix ../agent run build && npm --prefix ../protocol run build && npm --prefix ../client run build && npm run build && bun build --compile --no-compile-autoload-bunfig ./src/bun/cli.ts ./src/utils/image-resize-worker.ts --outfile dist/pi && npm run copy-binary-assets",
 		"copy-assets": "shx mkdir -p dist/modes/interactive/theme && shx cp src/modes/interactive/theme/*.json dist/modes/interactive/theme/ && shx mkdir -p dist/modes/interactive/assets && shx cp src/modes/interactive/assets/*.png dist/modes/interactive/assets/ && shx mkdir -p dist/core/export-html/vendor && shx cp src/core/export-html/template.html src/core/export-html/template.css src/core/export-html/template.js dist/core/export-html/ && shx cp src/core/export-html/vendor/*.js dist/core/export-html/vendor/ && shx mkdir -p dist/humain/mcp-adapter/vendor && shx cp -r src/humain/mcp-adapter/vendor/* dist/humain/mcp-adapter/vendor/ && shx mkdir -p dist/humain/bedrock-provider/vendor && shx cp -r src/humain/bedrock-provider/vendor/* dist/humain/bedrock-provider/vendor/",
 		"copy-binary-assets": "shx cp package.json dist/ && shx cp README.md dist/ && shx cp CHANGELOG.md dist/ && shx mkdir -p dist/theme && shx cp src/modes/interactive/theme/*.json dist/theme/ && shx mkdir -p dist/assets && shx cp src/modes/interactive/assets/*.png dist/assets/ && shx mkdir -p dist/export-html/vendor && shx cp src/core/export-html/template.html dist/export-html/ && shx cp src/core/export-html/vendor/*.js dist/export-html/vendor/ && shx cp -r docs dist/ && shx cp -r examples dist/ && shx cp ../../node_modules/@silvia-odwyer/photon-node/photon_rs_bg.wasm dist/",
 		"test": "vitest --run",
@@ -61,23 +62,25 @@
 		"prepublishOnly": "npm run clean && npm run build && npm run shrinkwrap"
 	},
 	"dependencies": {
-		"@aws-sdk/client-bedrock-runtime": "3.1114.0",
-		"@earendil-works/pi-agent-core": "0.84.2",
-		"@earendil-works/pi-ai": "0.84.2",
-		"@earendil-works/pi-client": "0.84.2",
-		"@earendil-works/pi-protocol": "0.84.2",
-		"@earendil-works/pi-tui": "0.84.2",
+		"@humain/terminal-contracts": "0.0.1",
+		"@aws-sdk/client-bedrock-runtime": "3.1119.0",
+		"@earendil-works/pi-agent-core": "0.84.4",
+		"@earendil-works/pi-ai": "0.84.4",
+		"@earendil-works/pi-client": "0.84.4",
+		"@earendil-works/pi-protocol": "0.84.4",
+		"@earendil-works/pi-tui": "0.84.4",
 		"@modelcontextprotocol/client": "2.0.0",
 		"@modelcontextprotocol/core": "2.0.0",
 		"@modelcontextprotocol/ext-apps": "1.7.5",
 		"@mozilla/readability": "0.6.0",
 		"@napi-rs/keyring": "1.3.0",
 		"@silvia-odwyer/photon-node": "0.3.4",
-		"@smithy/node-http-handler": "4.11.2",
+		"@smithy/node-http-handler": "4.11.3",
 		"chalk": "6.0.0",
 		"ajv": "8.20.0",
 		"ajv-formats": "3.0.1",
 		"cross-spawn": "7.0.6",
+		"defuddle": "0.19.3",
 		"diff": "9.0.0",
 		"glob": "13.0.6",
 		"grok-mermaid": "0.2.3",
@@ -99,11 +102,11 @@
 		"smol-toml": "1.8.0",
 		"strip-json-comments": "5.0.3",
 		"turndown": "7.2.4",
-		"typebox": "1.3.16",
+		"typebox": "1.3.19",
 		"undici": "8.10.0",
 		"unpdf": "1.8.1",
 		"yaml": "2.9.0",
-		"zod": "4.4.3"
+		"zod": "4.5.2"
 	},
 	"overrides": {
 		"protobufjs": "7.6.5",
@@ -120,7 +123,7 @@
 		"@types/diff": "8.0.0",
 		"@types/hosted-git-info": "3.0.5",
 		"@types/ms": "2.1.0",
-		"@types/node": "26.2.0",
+		"@types/node": "26.4.0",
 		"@types/proper-lockfile": "4.1.4",
 		"@types/semver": "7.8.0",
 		"@types/turndown": "5.0.6",

package/src/humain/mcp-adapter/UPSTREAM.md

@@ -1,15 +1,25 @@
 # pi-mcp-adapter upstream tracking
 
 HUMAIN Terminal vendors [`pi-mcp-adapter`](https://github.com/nicobailon/pi-mcp-adapter)
-version `2.27.0` so MCP support is available without a separate VM installation.
+version `2.31.0` so MCP support is available without a separate VM installation.
 
-The unmodified upstream package is recorded in `upstream.json`. During updates:
+The unmodified upstream package is recorded in `upstream.json`, including the
+registry integrity and source `gitHead`. The release currentness gate resolves
+that exact version from npm and rejects provenance drift before checking whether
+a newer version exists.
 
-1. Fetch and verify the recorded npm tarball integrity.
+The HUMAIN wrapper establishes Terminal's package manifest as `PI_PACKAGE_DIR`
+before returning the vendored factory, so its dynamic config and credential
+lookups stay under `.humain-terminal/agent`. An explicit `PI_PACKAGE_DIR`
+remains authoritative for downstream distributions and Nix/Guix layouts.
+
+During updates:
+
+1. Fetch and verify the recorded npm tarball integrity and `gitHead`.
 2. Review upstream source, dependency, lifecycle, and asset changes.
 3. Replace `vendor/` from the reviewed tarball.
 4. Reapply the documented HUMAIN host import in `vendor/mcp-panel.ts` and
    normalize trailing whitespace in vendored TypeScript for repository checks.
-5. Regenerate `vendor/index.bundle.js` with the repository MCP bundle script.
-6. Update pinned runtime dependencies, `upstream.json`, and this document.
+5. Regenerate `vendor/index.bundle.mjs` with the repository MCP bundle script.
+6. Update pinned runtime dependencies, every provenance field in `upstream.json`, and this document.
 7. Run `npm run check:mcp-adapter-upstream`, the MCP bundle tests, and local Node/Bun release smoke tests.

package/src/humain/mcp-adapter/upstream.json

@@ -1,7 +1,8 @@
 {
   "name": "pi-mcp-adapter",
   "repository": "https://github.com/nicobailon/pi-mcp-adapter",
-  "version": "2.27.0",
-  "tarball": "https://registry.npmjs.org/pi-mcp-adapter/-/pi-mcp-adapter-2.27.0.tgz",
-  "integrity": "sha512-IM9dfGhou5Q5AJqwkm1kW1+WXyMsvL53GEO4JVYukzvTxNPHn2b+Zi49+JAnOhlaOpEq5vEodUSJXmpghik+lw=="
+  "version": "2.31.0",
+  "tarball": "https://registry.npmjs.org/pi-mcp-adapter/-/pi-mcp-adapter-2.31.0.tgz",
+  "integrity": "sha512-yKPgHWFLQY6FT7ukCgEp5KvkAZ4ZC1pl7+8Tdq+j4evfTtjhHXPuIpi0joNN7lIIKuJD1cjlTb+hu6IxRpseoA==",
+  "gitHead": "eca6e8e14746f2a093e5d3085ccc244832962d71"
 }

package/src/humain/mcp-adapter/vendor/CHANGELOG.md

@@ -7,6 +7,88 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.31.0] - 2026-08-28
+
+### Highlights
+- MCP Apps-aware servers can now recognize Pi as a UI-capable host and expose interactive resources.
+- UI capability advertising works consistently across legacy and modern MCP protocol negotiation.
+- Manual OAuth callback completion now supports HTTPS redirect URLs for pre-registered clients.
+
+### Added
+
+- Pi now advertises MCP Apps UI support with the `io.modelcontextprotocol/ui` extension capability, so compatible servers can expose UI resources. Thanks to [@VikashLoomba](https://github.com/VikashLoomba) for #465.
+
+### Fixed
+
+- Pre-registered OAuth clients can use HTTPS callback URLs through manual callback completion instead of being rejected as non-local redirects. Thanks to [@jluisrojas](https://github.com/jluisrojas) for PR #464.
+
+## [2.30.0] - 2026-08-28
+
+### Highlights
+- Other extensions can safely inspect one runtime MCP server without seeing the whole MCP config.
+- OAuth setup works better with providers that publish authorization metadata at a custom URL.
+- MCP tool names are safer for providers, including servers with non-ASCII names.
+- Token CLI commands and Windows request-header cleanup are less fragile in installed packages and long-running sessions.
+
+### Added
+
+- Added a fail-closed API for child extensions to inspect one selected runtime MCP server without exporting configured servers or persisting the registration. (#453)
+- Added `oauth.authServerMetadataUrl` for servers whose authorization-server metadata cannot be discovered through MCP protected-resource metadata. Thanks to [@fmoda3](https://github.com/fmoda3) for #458.
+
+### Fixed
+
+- Namespace proxy tool names now use provider-safe characters without making encoded-looking server names collide with non-ASCII server names. Thanks to [@nyankosama](https://github.com/nyankosama) for PR #463.
+- npm-installed token CLI commands now load their credential, config, and utility helpers from the published JavaScript build instead of package-local TypeScript files. Thanks to [@Qhilm](https://github.com/Qhilm) for #456.
+- Server-scoped MCP calls now resolve raw upstream tool names before normalized fallbacks without weakening ambiguity checks. Thanks to [@MikeLP](https://github.com/MikeLP) for #452.
+- Windows request-header command cleanup now treats an already-exited process (`taskkill` exit code 128) as successful cleanup. Thanks to [@peterxcx](https://github.com/peterxcx) for #457.
+
+## [2.29.0] - 2026-08-26
+
+### Highlights
+- `/mcp setup` can now add Parallel Search as an opt-in preset.
+- Users can try web search and page fetching without first creating an API key.
+- MCP status updates work better in non-TUI hosts that provide plain theme values.
+
+### Added
+- Added an opt-in Parallel Search preset to `/mcp setup` for web search and page fetching without an API key. Thanks to [@georgeatparallel](https://github.com/georgeatparallel) for PR #448.
+
+### Fixed
+- MCP status updates now use plain text when a non-TUI host provides a theme without styling methods. Thanks to [@jinnnyang](https://github.com/jinnnyang) for #449.
+
+## [2.28.0] - 2026-08-26
+
+### Highlights
+- MCP connections are less fragile when servers fail, recover, move slowly, or refresh their catalogs.
+- Direct MCP tools are safer to expose, with stricter input checks and bounded result details when hosts opt in.
+- Other Pi extensions can register MCP servers at runtime without sharing module state.
+- Proxy calls now show live server progress in the interactive UI.
+- Package installs and public helper imports are easier to use from downstream hosts.
+
+### Added
+- Persistent metadata cache entries now honor server `ttlMs` hints without extending the default max age. Thanks to [@Seinra](https://github.com/Seinra) for #431.
+- Proxy tool calls now forward server progress notifications to the interactive UI. Thanks to [@Seinra](https://github.com/Seinra) for PR #440 and for mapping the area in #431.
+- Added a pure `mcp:` reference resolver API for consumers that validate adapter tool names from explicit config and cache inputs. Thanks to [@abdwhb-png](https://github.com/abdwhb-png) for PR #420.
+- Direct tools can opt into strict advertised-schema validation with one-layer JSON recovery for object and array properties. Thanks to [@4ndr3wxh1ll](https://github.com/4ndr3wxh1ll) for PR #430.
+- Direct tools can opt into guarded raw MCP result details, retaining bounded structured fields while summarizing oversized values.
+- Embedding hosts can import the configuration loader and metadata cache helpers from public package subpaths, and can validate cached metadata against an explicit private process environment.
+
+### Fixed
+- Runtime MCP registration now works across separately loaded Pi extensions through a versioned shared event contract. Thanks to [@fmoda3](https://github.com/fmoda3) for #443.
+- Stdio MCP startup errors now identify a configured missing or non-directory `cwd` instead of blaming the executable. Thanks to [@SoyElf](https://github.com/SoyElf) for #442.
+- Package installs with `--omit=dev` no longer run the public helper build during `prepare`; Git installs and package tarballs still include the built public exports. Thanks to [@KripaMishra](https://github.com/KripaMishra) for #441.
+- MCP gateway descriptions now stay stable across metadata-only refreshes and keep live counts behind `mcp({})`. Thanks to [@voidfreud](https://github.com/voidfreud) for PR #432.
+- Failed MCP servers in active backoff no longer remain advertised through cached direct tools, gateway list/search/describe results, or status tool counts. Thanks to [@voidfreud](https://github.com/voidfreud) for PR #434.
+- OAuth token invalidation now preserves credentials replaced by another Pi process instead of letting a stale refresh delete newly authorized shared credentials. Thanks to [@mjlbach](https://github.com/mjlbach) for PR #422.
+- Failed first-time MCP initialization no longer leaves the session permanently stuck with only `MCP not initialized`; the gateway keeps the failure reason and retries initialization on the next `mcp(...)` call. Thanks to [@hara-seihun](https://github.com/hara-seihun) for #428.
+- HTTP 202 and unauthenticated HTTP 401 endpoint probes now report ambiguous endpoint shape instead of claiming the URL is not MCP. Thanks to [@jayshah5696](https://github.com/jayshah5696) for #415.
+- Expanded `mcpScript` calls now show bounded submitted code. Thanks to [@DenisBalan](https://github.com/DenisBalan) for #413.
+- Gateway parameters nested inside `args` now fail with top-level guidance instead of dispatching inconsistently. Thanks to [@voidfreud](https://github.com/voidfreud) for PR #417.
+- Large direct-tool advisories now explain how to hide them with `settings.warnOnLargeDirectTools: false`. Thanks to [@afrodao2394](https://github.com/afrodao2394) for #412.
+- Namespace proxy tools now use valid cached metadata, include resource-only proxy servers, clean up only prior namespace registrations, follow `MCP_DIRECT_TOOLS` selection, and skip ambiguous normalized server names. Thanks to [@abdwhb-png](https://github.com/abdwhb-png) for PR #414.
+- Kept transient HTTP 503 connection failures as availability errors without multiplying gateway retries or misdiagnosing the endpoint as non-MCP. Thanks to [@elkaix](https://github.com/elkaix) for PR #411.
+- Preserved cached keep-alive catalogs during transient 503 refresh outages while deferred recovery continues with bounded backoff.
+- Startup connections that fail with a transient HTTP 503 now surface one quiet "temporarily unavailable; retry later" warning instead of the full hard failure; documented lifecycle behavior is unchanged, and keep-alive health checks continue their existing self-healing path. Thanks to [@elkaix](https://github.com/elkaix) for PR #424.
+
 ## [2.27.0] - 2026-08-20
 
 ### Highlights

package/src/humain/web-access/UPSTREAM.md

@@ -1,7 +1,7 @@
 # pi-web-access upstream tracking
 
 The vendored implementation in `vendor/` is based on
-[`pi-web-access`](https://github.com/nicobailon/pi-web-access) version `0.24.2`
+[`pi-web-access`](https://github.com/nicobailon/pi-web-access) version `0.27.0`
 and remains licensed under the upstream MIT license in `vendor/LICENSE`.
 
 `upstream.json` records the npm tarball URL, SHA-1 shasum, SHA-512 integrity,

package/src/humain/web-access/upstream.json

@@ -1,14 +1,16 @@
 {
 	"name": "pi-web-access",
 	"repository": "https://github.com/nicobailon/pi-web-access",
-	"version": "0.24.2",
-	"tarball": "https://registry.npmjs.org/pi-web-access/-/pi-web-access-0.24.2.tgz",
-	"shasum": "a03f40ee3bfa239da692540d0a44279e8982cd88",
-	"integrity": "sha512-wpw1XJLITrLY5epZCjiGxdF75HlKgZTrK1UM3TG/AVRzRrFqvNoc4bLYaCFFjYUG8QNEo6dIpYbCJyAUkLz/QA==",
+	"version": "0.27.0",
+	"tarball": "https://registry.npmjs.org/pi-web-access/-/pi-web-access-0.27.0.tgz",
+	"shasum": "f97ea9371f81d44c9bb34e43e1868db32e2c21ae",
+	"integrity": "sha512-D/z7ILwbnJeDjzFPC1j3G1OvO+j2vl2H13ByYcH5FLbrJ1yBdbBwTBcl96Bbt2NEqH5vdmoZ/EpbDG8BTF9W7Q==",
 	"humainPatches": [
 		"extract.ts",
+		"gemini-adc.ts",
 		"gemini-search.ts",
 		"index.ts",
+		"kimi-search.ts",
 		"openai-search.ts",
 		"page-query.ts",
 		"rsc-extract.ts",