@lincoln504/pi-research 1.0.8 → 1.0.9

package/dist/cli.mjs

@@ -2485,7 +2485,7 @@ function createConfig(env, processEnv) {
     SEARCH_TIMEOUT_MS: parseEnvNumber(e, "PI_RESEARCH_SEARCH_TIMEOUT_MS", DEFAULTS.SEARCH_TIMEOUT_MS, 5e3, 12e4),
     TUI_REFRESH_DEBOUNCE_MS: parseEnvNumber(e, "PI_RESEARCH_TUI_REFRESH_DEBOUNCE_MS", DEFAULTS.TUI_REFRESH_DEBOUNCE_MS, 0, 1e3),
     BROWSER_TASK_TIMEOUT_MS: parseEnvNumber(e, "PI_RESEARCH_BROWSER_TASK_TIMEOUT_MS", DEFAULTS.BROWSER_TASK_TIMEOUT_MS, 2e3, 12e4),
-    LLM_TIMEOUT_MS: parseEnvNumber(e, "PI_RESEARCH_LLM_TIMEOUT_MS", DEFAULTS.LLM_TIMEOUT_MS, 6e4, 6e5),
+    LLM_TIMEOUT_MS: parseEnvNumber(e, "PI_RESEARCH_LLM_TIMEOUT_MS", DEFAULTS.LLM_TIMEOUT_MS, 6e4, 18e5),
     LLM_THINKING_LEVEL: parseEnvEnum(e, "PI_RESEARCH_LLM_THINKING_LEVEL", ["off", "minimal", "low", "medium", "high"], DEFAULTS.LLM_THINKING_LEVEL),
     PLANNING_MAX_TOKENS: parseEnvNumber(e, "PI_RESEARCH_PLANNING_MAX_TOKENS", DEFAULTS.PLANNING_MAX_TOKENS, 1024, 131072),
     SYNTHESIS_MAX_TOKENS: parseEnvNumber(e, "PI_RESEARCH_SYNTHESIS_MAX_TOKENS", DEFAULTS.SYNTHESIS_MAX_TOKENS, 1024, 131072),
@@ -2641,9 +2641,13 @@ var init_config = __esm({
        *  never killed before it has used its full nav budget plus time waiting in the queue.
        *  (default: 10000) */
       BROWSER_TASK_TIMEOUT_MS: Type.Number({ minimum: 2e3, maximum: 12e4, default: 1e4 }),
-      /** Timeout for coordinator/evaluator/repair/knowledge LLM calls in ms (default: 300000 = 5 min, range: 60s-600s).
-       *  Not exposed in TUI — controlled via PI_RESEARCH_LLM_TIMEOUT_MS env var. */
-      LLM_TIMEOUT_MS: Type.Number({ minimum: 6e4, maximum: 6e5, default: 3e5 }),
+      /** Timeout for coordinator/evaluator/repair/knowledge LLM calls in ms (default: 300000 = 5 min, range: 60s-30min).
+       *  Not exposed in TUI — controlled via PI_RESEARCH_LLM_TIMEOUT_MS env var.
+       *  Ceiling raised to 30min (matching RESEARCHER_TIMEOUT_MS): a slow model on a
+       *  large-context synthesis/plan call can legitimately run >10min, and the old
+       *  600000 ceiling silently clamped an explicit PI_RESEARCH_LLM_TIMEOUT_MS
+       *  (e.g. 900000), causing those calls to time out mid-generation. */
+      LLM_TIMEOUT_MS: Type.Number({ minimum: 6e4, maximum: 18e5, default: 3e5 }),
       /** Chain-of-thought "thinking" level for the engine's own LLM calls (coordinator,
        *  evaluator, synthesis, JSON-repair, knowledge extraction) AND the researcher
        *  sub-agents. Default 'off': these calls emit structured JSON / cited reports, not
@@ -3201,7 +3205,8 @@ var init_agentic_repair = __esm({
 });
 
 // src/core/llm/model-registry-factory.ts
-import { AuthStorage, ModelRegistry, getAgentDir } from "@earendil-works/pi-coding-agent";
+import { ModelRegistry, ModelRuntime, getAgentDir } from "@earendil-works/pi-coding-agent";
+import { InMemoryCredentialStore } from "@earendil-works/pi-ai";
 import * as path6 from "node:path";
 import * as fs5 from "node:fs";
 function safeGetAll(registry) {
@@ -3243,27 +3248,27 @@ function buildHeaders(provider) {
   if (provider === "openrouter") return { "HTTP-Referer": "https://pi.ai", "X-Title": "pi-research" };
   return {};
 }
-function buildModelRegistry(apiKey, provider) {
+async function buildModelRegistry(apiKey, provider) {
   const agentDir = getAgentDir();
   const modelsJsonPath = path6.join(agentDir, "models.json");
   const authPath = path6.join(agentDir, "auth.json");
+  const hasModels = fs5.existsSync(modelsJsonPath);
+  const hasAuth = fs5.existsSync(authPath);
+  const runtime = await ModelRuntime.create({
+    authPath: hasAuth ? authPath : void 0,
+    credentials: hasAuth ? void 0 : new InMemoryCredentialStore(),
+    modelsPath: hasModels ? modelsJsonPath : null,
+    allowModelNetwork: false
+  });
   if (apiKey && provider) {
-    const authStorage = AuthStorage.inMemory({
-      [provider]: { type: "api_key", key: apiKey }
-    });
-    return ModelRegistry.create(
-      authStorage,
-      fs5.existsSync(modelsJsonPath) ? modelsJsonPath : void 0
-    );
-  }
-  if (fs5.existsSync(authPath) || fs5.existsSync(modelsJsonPath)) {
-    const authStorage = AuthStorage.create(authPath);
-    return ModelRegistry.create(
-      authStorage,
-      fs5.existsSync(modelsJsonPath) ? modelsJsonPath : void 0
-    );
+    await runtime.setRuntimeApiKey(provider, apiKey, { allowNetwork: false });
   }
-  return ModelRegistry.inMemory(AuthStorage.inMemory());
+  const registry = new ModelRegistry(runtime);
+  registryRuntimes.set(registry, runtime);
+  return registry;
+}
+function getRuntimeForRegistry(registry) {
+  return registry instanceof Object ? registryRuntimes.get(registry) : void 0;
 }
 function constructMinimalModel(provider, modelId, _apiKey) {
   return {
@@ -3355,10 +3360,12 @@ function pickPreferredAvailable(available, providerOrder) {
   }
   return available[0];
 }
+var registryRuntimes;
 var init_model_registry_factory = __esm({
   "src/core/llm/model-registry-factory.ts"() {
     "use strict";
     init_logger();
+    registryRuntimes = /* @__PURE__ */ new WeakMap();
   }
 });
 
@@ -14770,7 +14777,7 @@ async function performSearch(queries, config, signal, onProgress, container = ge
   metrics.increment("browser_search_orchestrations_total", 1);
   logger.log(`[Search] Orchestrating ${queries.length} queries across ${maxWorkers} worker processes...`);
   if (onProgress) onProgress(0);
-  const QUERY_TIMEOUT_MS = config?.SEARCH_TIMEOUT_MS ?? 45e3;
+  const QUERY_TIMEOUT_MS = (config?.SEARCH_TIMEOUT_MS ?? 45e3) + (config?.BROWSER_TASK_TIMEOUT_MS ?? 1e4);
   const filteredQueries = queries.filter((q) => q.trim());
   let timeoutCount = 0;
   let errorCount = 0;
@@ -14815,7 +14822,7 @@ async function performSearch(queries, config, signal, onProgress, container = ge
       metrics.observe("browser_search_query_duration_ms", queryDuration, { status });
       metrics.increment("browser_search_queries_total", 1, { status });
       if (isTimeout) {
-        logger.warn(`[Search] Query timed out after ${QUERY_TIMEOUT_MS}ms (likely blocked or slow startup): "${query}"`);
+        logger.warn(`[Search] Query timed out after ${QUERY_TIMEOUT_MS}ms \u2014 likely starved waiting for a free browser worker under concurrent load, or a slow/blocked search provider: "${query}"`);
       } else {
         const msg2 = error instanceof Error ? error.message : String(error);
         if (msg2 !== "Aborted") {
@@ -19635,40 +19642,9 @@ function createResearchTools(options) {
 }
 
 // src/utils/make-resource-loader.ts
+import { createExtensionRuntime } from "@earendil-works/pi-coding-agent";
 function makeResourceLoader(systemPromptText) {
-  const mockRuntime = {
-    flagValues: /* @__PURE__ */ new Map(),
-    pendingProviderRegistrations: [],
-    registerProvider: () => {
-    },
-    unregisterProvider: () => {
-    },
-    sendMessage: async () => {
-    },
-    sendUserMessage: async () => {
-    },
-    appendEntry: async () => {
-    },
-    setSessionName: () => void 0,
-    getSessionName: () => void 0,
-    setLabel: async () => {
-    },
-    getActiveTools: () => [],
-    getAllTools: () => [],
-    setActiveTools: () => {
-    },
-    refreshTools: () => {
-    },
-    getCommands: () => [],
-    setModel: async () => true,
-    getThinkingLevel: () => "off",
-    setThinkingLevel: () => {
-    },
-    assertActive: () => {
-    },
-    invalidate: () => {
-    }
-  };
+  const mockRuntime = createExtensionRuntime();
   return {
     getExtensions: () => ({ extensions: [], errors: [], runtime: mockRuntime }),
     getSkills: () => ({ skills: [], diagnostics: [] }),
@@ -19822,6 +19798,7 @@ function createDefaultToolLimits(config) {
 // src/orchestration/researcher.ts
 init_logger();
 init_research_model_resolver();
+init_model_registry_factory();
 async function createResearcherSession(options) {
   const {
     cwd,
@@ -19889,7 +19866,17 @@ async function createResearcherSession(options) {
       // Each researcher gets its own isolated session
       settingsManager: researcherSettings,
       model: modelToUse,
-      modelRegistry,
+      // pi 0.80.8 replaced the SDK's `modelRegistry`/`authStorage` session options
+      // with the async `modelRuntime`. Pass the runtime backing OUR registry when
+      // this run built one (standalone CLI/SDK): it carries any explicit API key
+      // seeded via setRuntimeApiKey, which the session's own default runtime
+      // (auto-built from ~/.pi/agent/{auth,models}.json) would never see — without
+      // this, standalone PI_RESEARCH_API_KEY users fail auth on every researcher
+      // LLM call despite passing pre-flight. For registries we did NOT build
+      // (the pi host's ExtensionContext.modelRegistry), this resolves to
+      // undefined and the host auto-builds from its own agent dir — correct
+      // in-host, where auth lives in the host's config.
+      modelRuntime: getRuntimeForRegistry(modelRegistry),
       resourceLoader: makeResourceLoader(systemPrompt),
       // Thinking/reasoning is disabled for researcher agents: they do retrieval and
       // synthesis from scraped pages, not open-ended reasoning. Keeping it off reduces
@@ -22332,7 +22319,7 @@ async function _doInit(options = {}) {
   if (globalApiKey && !parsedProvider) {
     throw new Error("Provider must be specified when using an explicit API key (set provider option or PI_RESEARCH_PROVIDER).");
   }
-  globalRegistry = buildModelRegistry(globalApiKey, parsedProvider);
+  globalRegistry = await buildModelRegistry(globalApiKey, parsedProvider);
   try {
     if (effectiveModel && typeof effectiveModel === "object" && effectiveModel.id) {
       globalModel = effectiveModel;
@@ -22940,16 +22927,16 @@ function fileExists(p) {
     return false;
   }
 }
-function piKeysAvailable(piAuthPresent, provider) {
+async function piKeysAvailable(piAuthPresent, provider) {
   try {
-    const available = safeGetAvailable(buildModelRegistry(void 0, void 0));
+    const available = safeGetAvailable(await buildModelRegistry(void 0, void 0));
     if (!provider) return available.length > 0;
     return available.some((m) => m.provider === provider);
   } catch {
     return piAuthPresent;
   }
 }
-function detectCredentials(explicitModel) {
+async function detectCredentials(explicitModel) {
   const paths = resolvedConfigPaths();
   const piAuthPresent = fileExists(paths.piAuth);
   const piModelsPresent = fileExists(paths.piModels);
@@ -22960,7 +22947,7 @@ function detectCredentials(explicitModel) {
   const model = explicitModel ?? modelEnv ?? modelConfig;
   const modelFrom = explicitModel ? "--model" : modelEnv ? "PI_RESEARCH_MODEL" : modelConfig ? "config.env" : "unset";
   const provider = providerEnv ?? (model && model.includes("/") ? model.slice(0, model.indexOf("/")) : void 0);
-  const piKeysUsable = piKeysAvailable(piAuthPresent, provider);
+  const piKeysUsable = await piKeysAvailable(piAuthPresent, provider);
   if (apiKey) {
     if (!provider) {
       return {
@@ -23052,7 +23039,7 @@ function configBlock(det, extraNote) {
   return lines.join("\n");
 }
 async function cmdResearch(args) {
-  const det = detectCredentials(args.model);
+  const det = await detectCredentials(args.model);
   if (det.problem) {
     if (args.json) toStdout(pretty({ ok: false, error: det.problem, exitCode: EXIT.CONFIG }));
     else toStderr(`
@@ -23125,7 +23112,7 @@ Error: ${vmsg}
       toStdout(report.endsWith("\n") ? report : report + "\n");
     }
   } catch (err) {
-    exit = reportError(err, "research", args.json);
+    exit = await reportError(err, "research", args.json);
   } finally {
     if (activeResearchAbortController === abortController) activeResearchAbortController = null;
     await safeShutdown();
@@ -23133,7 +23120,7 @@ Error: ${vmsg}
   return exit;
 }
 async function cmdKnowledge(queries, json) {
-  const det = detectCredentials();
+  const det = await detectCredentials();
   if (det.problem) {
     if (json) {
       toStdout(pretty({ ok: false, error: det.problem, exitCode: EXIT.CONFIG }));
@@ -23187,7 +23174,7 @@ Configure in:
   return exit;
 }
 async function cmdStatus(json) {
-  const det = detectCredentials();
+  const det = await detectCredentials();
   const paths = resolvedConfigPaths();
   const cfg = getConfig(process.cwd(), "cli");
   const summary = {
@@ -23401,7 +23388,7 @@ function describeUninstall(r) {
       return r.status;
   }
 }
-function reportError(err, what, json) {
+async function reportError(err, what, json) {
   const msg2 = err instanceof Error ? err.message : String(err);
   const lower = msg2.toLowerCase();
   const isTaggedResearchStop = err?.code === RESEARCH_STOPPED_ERROR_CODE;
@@ -23427,7 +23414,7 @@ Error: pi-research ${what} halted: provider rate limit reached. Wait a moment an
     toStderr(`
 Error: pi-research ${what} failed: ${msg2}
 
-${configBlock(detectCredentials())}
+${configBlock(await detectCredentials())}
 `);
     return exitCode;
   }

package/dist/thread-worker.mjs

@@ -2278,9 +2278,13 @@ var ConfigSchema = Type.Object({
    *  never killed before it has used its full nav budget plus time waiting in the queue.
    *  (default: 10000) */
   BROWSER_TASK_TIMEOUT_MS: Type.Number({ minimum: 2e3, maximum: 12e4, default: 1e4 }),
-  /** Timeout for coordinator/evaluator/repair/knowledge LLM calls in ms (default: 300000 = 5 min, range: 60s-600s).
-   *  Not exposed in TUI — controlled via PI_RESEARCH_LLM_TIMEOUT_MS env var. */
-  LLM_TIMEOUT_MS: Type.Number({ minimum: 6e4, maximum: 6e5, default: 3e5 }),
+  /** Timeout for coordinator/evaluator/repair/knowledge LLM calls in ms (default: 300000 = 5 min, range: 60s-30min).
+   *  Not exposed in TUI — controlled via PI_RESEARCH_LLM_TIMEOUT_MS env var.
+   *  Ceiling raised to 30min (matching RESEARCHER_TIMEOUT_MS): a slow model on a
+   *  large-context synthesis/plan call can legitimately run >10min, and the old
+   *  600000 ceiling silently clamped an explicit PI_RESEARCH_LLM_TIMEOUT_MS
+   *  (e.g. 900000), causing those calls to time out mid-generation. */
+  LLM_TIMEOUT_MS: Type.Number({ minimum: 6e4, maximum: 18e5, default: 3e5 }),
   /** Chain-of-thought "thinking" level for the engine's own LLM calls (coordinator,
    *  evaluator, synthesis, JSON-repair, knowledge extraction) AND the researcher
    *  sub-agents. Default 'off': these calls emit structured JSON / cited reports, not

package/docs/CHANGELOG.md

@@ -5,7 +5,28 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [1.0.8] - 2024-07-17
+## [1.0.9] - 2026-07-28
+
+### Fixed
+- **pi ≥ 0.81.0 researcher crash** — every researcher session died with `pendingNativeProviderRegistrations is not iterable` under pi 0.81.0+ ("no source material was collected"). The hand-maintained `ExtensionRuntime` mock in the resource loader was frozen at a pre-0.81 contract; it is replaced with pi's own `createExtensionRuntime()`, which always satisfies the running host's contract and cannot drift again.
+- **pi 0.80.8+ ModelRuntime migration** — `buildModelRegistry` migrated off the removed `AuthStorage`/`ModelRegistry.create()` APIs to `ModelRuntime.create()` + the synchronous `ModelRegistry` facade. The `@earendil-works/*` dependency floor and the in-host version self-check are both raised to 0.80.8 to match.
+- **Explicit-API-key auth now reaches researcher LLM calls** — researcher sessions are created with the `modelRuntime` backing our own registry (pi 0.80.8 removed the old `modelRegistry` session option). Without this, standalone `PI_RESEARCH_API_KEY` users with no `~/.pi/agent/auth.json` passed pre-flight and then failed auth on every researcher call.
+- **Explicit-API-key pre-flight hang** — seeding a runtime API key triggered a model-catalog refresh whose default options open live network connections with no timeout; in network-restricted environments the CLI pre-flight hung indefinitely. The refresh is now pinned offline (`allowNetwork: false`).
+- **No filesystem side effects on read-only commands** — the migrated runtime's default file-backed credential store created `~/.pi/agent/auth.json` at construction, so every CLI invocation (including `status`) silently created a pi config dir on machines without pi and hard-failed where `$HOME` is read-only. An in-memory credential store is used when no `auth.json` exists; env-var provider keys are unaffected.
+- **Search-timeout cascade under concurrent load** — the per-query hard cap in browser search started at enqueue with only the nav budget, so a query stuck in a saturated worker queue burned its whole budget waiting and aborted with zero work ("Query timed out … likely blocked or slow startup"). The cap now includes the queue-wait margin, matching the scheduler's own ceiling.
+- **`PI_RESEARCH_LLM_TIMEOUT_MS` ceiling raised 10 → 30 min** — an explicit higher value was silently clamped to 600000, timing out large-context synthesis calls mid-generation.
+- **CHANGELOG dates corrected** — release dates in this file wrongly said 2024; corrected to the actual git release dates (2026).
+
+### Security
+- **protobufjs override 7.6.4 → 7.6.5** — clears GHSA-j3f2-48v5-ccww (DoS) and its whole moderate advisory chain through `@google/genai`/pi-ai.
+- **adm-zip forced to 0.6.0 via override** — clears GHSA-xcpc-8h2w-3j85 (crafted-ZIP 4 GB allocation) in the camoufox-js subtree; extraction APIs camoufox uses verified compatible.
+- **Audit gate hardened with a reviewed exception list** — CI and the release publish gate now run `scripts/audit-gate.cjs`: any moderate+ advisory in the shipped tree fails the build unless explicitly allowlisted in `config/tooling/audit-exceptions.json` with an upstream-blocked justification, a clears-when condition, and a review date. Current exceptions: `brace-expansion` (frozen inside pi-coding-agent's npm-shrinkwrap; fix released upstream) and `sharp` (unused image pipeline of the embeddings-only transformers dependency).
+
+### Changed
+- **Dependencies**: pi ecosystem lockfile refreshed to 0.82.1 (matching the current pi host); `pdf-oxide-wasm` 0.3.77; `undici` ^8.9; devDependencies refreshed (eslint 10.8, typescript-eslint 8.65, vitest 4.1.10, dependency-cruiser 17.4.3). Deliberate pins unchanged (typebox 1.1.38, playwright-core 1.60.0, camoufox-js 0.10.x, lancedb 0.29, apache-arrow 21.1.0, transformers 4.2, impit 0.13).
+- **Docs**: `PI_RESEARCH_LLM_TIMEOUT_MS` range updated in CONFIGURATION.md.
+
+## [1.0.8] - 2026-07-17
 
 ### Added
 - **CHANGELOG** — Added comprehensive CHANGELOG.md documenting all versions from 0.1.13 through 1.0.7
@@ -15,7 +36,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **Topic consolidation guidance** — Emphasized that topics can likely be consolidated to fit the 4-call maximum, with strategies for grouping related subtopics
 - **Package structure** — CHANGELOG.md now included in published package (docs/CHANGELOG.md)
 
-## [1.0.7] - 2024-07-14
+## [1.0.7] - 2026-07-14
 
 ### Fixed
 - **Browser-pool leader-election race** - Fixed a critical bug where a single client's transient socket error could force-clear shared leader state, causing a live, healthy leader to self-destruct via the leadership-miss watchdog. The fix reserves the "unreachable, force clear" path for cases where liveness probes actually confirm the registered leader PID or port is gone.
@@ -34,7 +55,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - Socket drain on Content-Length pre-screen throws
   - Observer isolation improvements
 
-## [1.0.6] - 2024-07-01
+## [1.0.6] - 2026-07-04
 
 ### Fixed
 - **Observer isolation** - Fixed `makeSafeObserver` proxying the observer directly, which could cause state leakage.
@@ -43,7 +64,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Corrected depth-0 availability documentation
 - Fixed migration.ts attribution in architecture docs
 
-## [1.0.5] - 2024-06-28
+## [1.0.5] - 2026-07-04
 
 ### Fixed
 - **Content-Length pre-screen throws** - Added proper body draining to prevent resource leaks
@@ -52,13 +73,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Fixed
 - **YouTube transcript provenance** - Fixed transcript provenance tracking in final report citations
 
-## [1.0.4] - 2024-06-25
+## [1.0.4] - 2026-07-04
 
 ### Fixed
 - **Credential detection** - Detect pi keys by pi's own semantics, not file presence; registry no longer gated on auth.json
 - **Configuration clarity** - Updated docs to reflect that pi has configuration files, not a named 'auth' feature
 
-## [1.0.3] - 2024-06-20
+## [1.0.3] - 2026-07-04
 
 ### Fixed
 - **Model resolution** - Require a configured model on the standalone CLI/skill; align SDK session model with RESEARCH_MODEL
@@ -67,19 +88,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Documentation
 - Updated installation and configuration documentation
 
-## [1.0.2] - 2024-06-15
+## [1.0.2] - 2026-07-04
 
 ### Fixed
 - **Timeout robustness** - Improved timeout handling for long-running operations
 - De-emphasized the markdown-conversion fallback in favor of native HTML-to-markdown conversion
 
-## [1.0.1] - 2024-06-10
+## [1.0.1] - 2026-07-04
 
 ### Fixed
 - Initial stable release after rebuild against current pi APIs
 - Stealth-browser stack integration
 
-## [0.1.13] - 2024-04-15
+## [0.1.13] - 2026-04-15
 
 ### Added
 - Initial research functionality

package/docs/CONFIGURATION.md

@@ -97,7 +97,7 @@ Timeouts
 
 | Variable | Default | Range | Description |
 |----------|---------|-------|-------------|
-| `PI_RESEARCH_LLM_TIMEOUT_MS` | `300000` | 60000–600000 | Coordinator / evaluator / repair / knowledge LLM call timeout. |
+| `PI_RESEARCH_LLM_TIMEOUT_MS` | `300000` | 60000–1800000 | Coordinator / evaluator / repair / knowledge LLM call timeout. |
 | `PI_RESEARCH_SCRAPE_TIMEOUT_MS` | `15000` | 5000–120000 | Per-page scrape (page-load) timeout. |
 | `PI_RESEARCH_SEARCH_TIMEOUT_MS` | `45000` | 5000–120000 | Browser search page timeout. |
 | `PI_RESEARCH_BROWSER_TASK_TIMEOUT_MS` | `10000` | 2000–120000 | Queue-wait / overhead margin added to each browser op's own timeout (a search task ceiling is `SEARCH_TIMEOUT_MS` + this; a scrape is `SCRAPE_TIMEOUT_MS` + this). |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lincoln504/pi-research",
-  "version": "1.0.8",
+  "version": "1.0.9",
   "description": "A set of web research tools (search, scrape, and others) and research agent system that uses them safely and efficiently.",
   "type": "module",
   "private": false,
@@ -110,9 +110,9 @@
     "image": "https://raw.githubusercontent.com/Lincoln504/pi-research/main/docs/media/hero.png"
   },
   "dependencies": {
-    "@earendil-works/pi-ai": ">=0.80.7 <1",
-    "@earendil-works/pi-coding-agent": ">=0.80.7 <1",
-    "@earendil-works/pi-tui": ">=0.80.7 <1",
+    "@earendil-works/pi-ai": ">=0.80.8 <1",
+    "@earendil-works/pi-coding-agent": ">=0.80.8 <1",
+    "@earendil-works/pi-tui": ">=0.80.8 <1",
     "@huggingface/transformers": "4.2.0",
     "@kreuzberg/html-to-markdown-node": "^3.5.5",
     "@lancedb/lancedb": "0.29.0",
@@ -123,11 +123,11 @@
     "impit": "0.13.0",
     "jsdom": "^29.1.1",
     "node-html-markdown": "^2.0.0",
-    "pdf-oxide-wasm": "^0.3.70",
+    "pdf-oxide-wasm": "^0.3.75",
     "playwright-core": "1.60.0",
     "poolifier": "^5.3.2",
     "typebox": "1.1.38",
-    "undici": "^8.6.0",
+    "undici": "^8.9.0",
     "youtubei.js": "^17.2.0"
   },
   "optionalDependencies": {
@@ -140,20 +140,21 @@
     "onnxruntime-web": "1.24.3",
     "node-domexception": "npm:@nolyfill/domexception@^1.0.28",
     "ua-parser-js": "^1.0.41",
-    "protobufjs": "7.6.4",
-    "vite": "^8.0.16"
+    "protobufjs": "7.6.5",
+    "vite": "^8.0.16",
+    "adm-zip": "^0.6.0"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
     "@types/jsdom": "^28.0.3",
-    "@typescript-eslint/eslint-plugin": "^8.60.0",
-    "@typescript-eslint/parser": "^8.60.0",
-    "@vitest/coverage-v8": "^4.1.7",
-    "dependency-cruiser": "^17.4.2",
+    "@typescript-eslint/eslint-plugin": "^8.65.0",
+    "@typescript-eslint/parser": "^8.65.0",
+    "@vitest/coverage-v8": "^4.1.10",
+    "dependency-cruiser": "^17.4.3",
     "depngn": "^0.6.0",
-    "eslint": "^10.4.0",
-    "npm-check-updates": "^22.2.1",
+    "eslint": "^10.8.0",
+    "npm-check-updates": "^22.2.9",
     "typescript": ">=6.0.3 <6.1.0",
-    "vitest": "^4.1.7"
+    "vitest": "^4.1.10"
   }
 }

package/skills/pi-research/SKILL.md

@@ -2,7 +2,7 @@
 name: pi-research
 description: "Multi-agent web research for any coding agent. Use for anything requiring current information from the internet — news, trends, product/service/company facts, statistics, people, places, events, APIs, library behavior, or 'what is X / how does X work' questions. Also use to search a local knowledge store of previously researched findings before doing live research. Powered by the pi-research engine (search, stealth scraping, security databases, Stack Exchange). Not for reading local files, running project commands, or analyzing this repository's own source."
 license: MIT
-metadata: { "author": "Lincoln Deen", "version": "1.0.8", "package": "@lincoln504/pi-research", "engine": "pi-research-sdk", "openclaw": { "requires": { "bins": ["node"] } } }
+metadata: { "author": "Lincoln Deen", "version": "1.0.9", "package": "@lincoln504/pi-research", "engine": "pi-research-sdk", "openclaw": { "requires": { "bins": ["node"] } } }
 allowed-tools: Bash(node:*)
 ---
 

package/src/cli.ts

@@ -240,9 +240,9 @@ function fileExists(p: string): boolean {
  * OPENAI_API_KEY. File presence alone is neither necessary (keys can live in
  * models.json / env with no auth.json) nor sufficient (auth.json can be `{}`).
  */
-function piKeysAvailable(piAuthPresent: boolean, provider?: string): boolean {
+async function piKeysAvailable(piAuthPresent: boolean, provider?: string): Promise<boolean> {
   try {
-    const available = safeGetAvailable(buildModelRegistry(undefined, undefined));
+    const available = safeGetAvailable(await buildModelRegistry(undefined, undefined));
     if (!provider) return available.length > 0;
     // Provider known (from the configured provider/model-id): keys must exist
     // for THAT provider — a key for some other provider would pass pre-flight
@@ -282,7 +282,7 @@ export interface CredentialDetection {
  * blocks a valid `--model` run). An explicit PI_RESEARCH_PROVIDER still wins:
  * it names the provider the configured key belongs to.
  */
-function detectCredentials(explicitModel?: string): CredentialDetection {
+async function detectCredentials(explicitModel?: string): Promise<CredentialDetection> {
   const paths = resolvedConfigPaths();
   const piAuthPresent = fileExists(paths.piAuth);
   const piModelsPresent = fileExists(paths.piModels);
@@ -299,7 +299,7 @@ function detectCredentials(explicitModel?: string): CredentialDetection {
     providerEnv ?? (model && model.includes('/') ? model.slice(0, model.indexOf('/')) : undefined);
   // Provider-aware when the configured model names one: a key for a DIFFERENT
   // provider must not greenlight this run.
-  const piKeysUsable = piKeysAvailable(piAuthPresent, provider);
+  const piKeysUsable = await piKeysAvailable(piAuthPresent, provider);
 
   // --- Explicit API-key path -------------------------------------------------
   if (apiKey) {
@@ -440,7 +440,7 @@ interface ResearchArgs {
 async function cmdResearch(args: ResearchArgs): Promise<number> {
   // Pre-flight with the per-run --model flag folded in: it satisfies the
   // model-required check and steers the provider-aware key detection.
-  const det = detectCredentials(args.model);
+  const det = await detectCredentials(args.model);
   if (det.problem) {
     if (args.json) toStdout(pretty({ ok: false, error: det.problem, exitCode: EXIT.CONFIG }));
     else toStderr(`\nError: ${det.problem}\n\n${configBlock(det)}\n`);
@@ -531,7 +531,7 @@ async function cmdResearch(args: ResearchArgs): Promise<number> {
       toStdout(report.endsWith('\n') ? report : report + '\n');
     }
   } catch (err) {
-    exit = reportError(err, 'research', args.json);
+    exit = await reportError(err, 'research', args.json);
   } finally {
     if (activeResearchAbortController === abortController) activeResearchAbortController = null;
     await safeShutdown();
@@ -545,7 +545,7 @@ async function cmdResearch(args: ResearchArgs): Promise<number> {
  * research.
  */
 async function cmdKnowledge(queries: string[], json?: boolean): Promise<number> {
-  const det = detectCredentials();
+  const det = await detectCredentials();
   if (det.problem) {
     if (json) { toStdout(pretty({ ok: false, error: det.problem, exitCode: EXIT.CONFIG })); return EXIT.CONFIG; }
     toStderr(`\nError: ${det.problem}\n\n${configBlock(det)}\n`);
@@ -595,7 +595,7 @@ async function cmdKnowledge(queries: string[], json?: boolean): Promise<number>
  * run, without initializing the SDK. Machine-readable with --json.
  */
 async function cmdStatus(json?: boolean): Promise<number> {
-  const det = detectCredentials();
+  const det = await detectCredentials();
   const paths = resolvedConfigPaths();
   const cfg = getConfig(process.cwd(), 'cli');
   const summary = {
@@ -815,7 +815,7 @@ function describeUninstall(r: { status: string; path: string; message?: string }
 // ---------------------------------------------------------------------------
 
 /** Distinguish setup errors from runtime errors and print a clean, located message. */
-export function reportError(err: unknown, what: string, json?: boolean): number {
+export async function reportError(err: unknown, what: string, json?: boolean): Promise<number> {
   const msg = err instanceof Error ? err.message : String(err);
   const lower = msg.toLowerCase();
 
@@ -865,7 +865,7 @@ export function reportError(err: unknown, what: string, json?: boolean): number
     return exitCode;
   }
   if (isConfigError) {
-    toStderr(`\nError: pi-research ${what} failed: ${msg}\n\n${configBlock(detectCredentials())}\n`);
+    toStderr(`\nError: pi-research ${what} failed: ${msg}\n\n${configBlock(await detectCredentials())}\n`);
     return exitCode;
   }
   toStderr(`\nError: pi-research ${what} failed: ${msg}\n`);

package/src/config.ts

@@ -87,9 +87,13 @@ export const ConfigSchema = Type.Object({
    *  never killed before it has used its full nav budget plus time waiting in the queue.
    *  (default: 10000) */
   BROWSER_TASK_TIMEOUT_MS: Type.Number({ minimum: 2000, maximum: 120000, default: 10000 }),
-  /** Timeout for coordinator/evaluator/repair/knowledge LLM calls in ms (default: 300000 = 5 min, range: 60s-600s).
-   *  Not exposed in TUI — controlled via PI_RESEARCH_LLM_TIMEOUT_MS env var. */
-  LLM_TIMEOUT_MS: Type.Number({ minimum: 60000, maximum: 600000, default: 300000 }),
+  /** Timeout for coordinator/evaluator/repair/knowledge LLM calls in ms (default: 300000 = 5 min, range: 60s-30min).
+   *  Not exposed in TUI — controlled via PI_RESEARCH_LLM_TIMEOUT_MS env var.
+   *  Ceiling raised to 30min (matching RESEARCHER_TIMEOUT_MS): a slow model on a
+   *  large-context synthesis/plan call can legitimately run >10min, and the old
+   *  600000 ceiling silently clamped an explicit PI_RESEARCH_LLM_TIMEOUT_MS
+   *  (e.g. 900000), causing those calls to time out mid-generation. */
+  LLM_TIMEOUT_MS: Type.Number({ minimum: 60000, maximum: 1800000, default: 300000 }),
   /** Chain-of-thought "thinking" level for the engine's own LLM calls (coordinator,
    *  evaluator, synthesis, JSON-repair, knowledge extraction) AND the researcher
    *  sub-agents. Default 'off': these calls emit structured JSON / cited reports, not
@@ -945,7 +949,7 @@ export function createConfig(env: Record<string, string | undefined>, processEnv
     SEARCH_TIMEOUT_MS: parseEnvNumber(e, 'PI_RESEARCH_SEARCH_TIMEOUT_MS', DEFAULTS.SEARCH_TIMEOUT_MS, 5000, 120000),
     TUI_REFRESH_DEBOUNCE_MS: parseEnvNumber(e, 'PI_RESEARCH_TUI_REFRESH_DEBOUNCE_MS', DEFAULTS.TUI_REFRESH_DEBOUNCE_MS, 0, 1000),
     BROWSER_TASK_TIMEOUT_MS: parseEnvNumber(e, 'PI_RESEARCH_BROWSER_TASK_TIMEOUT_MS', DEFAULTS.BROWSER_TASK_TIMEOUT_MS, 2000, 120000),
-    LLM_TIMEOUT_MS: parseEnvNumber(e, 'PI_RESEARCH_LLM_TIMEOUT_MS', DEFAULTS.LLM_TIMEOUT_MS, 60000, 600000),
+    LLM_TIMEOUT_MS: parseEnvNumber(e, 'PI_RESEARCH_LLM_TIMEOUT_MS', DEFAULTS.LLM_TIMEOUT_MS, 60000, 1800000),
     LLM_THINKING_LEVEL: parseEnvEnum(e, 'PI_RESEARCH_LLM_THINKING_LEVEL', ['off', 'minimal', 'low', 'medium', 'high'] as const, DEFAULTS.LLM_THINKING_LEVEL),
     PLANNING_MAX_TOKENS: parseEnvNumber(e, 'PI_RESEARCH_PLANNING_MAX_TOKENS', DEFAULTS.PLANNING_MAX_TOKENS, 1024, 131072),
     SYNTHESIS_MAX_TOKENS: parseEnvNumber(e, 'PI_RESEARCH_SYNTHESIS_MAX_TOKENS', DEFAULTS.SYNTHESIS_MAX_TOKENS, 1024, 131072),

package/src/core/llm/model-registry-factory.ts

@@ -8,7 +8,8 @@
  * Previously this logic was duplicated (#29) — any bug fix now updates both paths.
  */
 
-import { AuthStorage, ModelRegistry, getAgentDir } from '@earendil-works/pi-coding-agent';
+import { ModelRegistry, ModelRuntime, getAgentDir } from '@earendil-works/pi-coding-agent';
+import { InMemoryCredentialStore } from '@earendil-works/pi-ai';
 import type { Model } from '@earendil-works/pi-ai';
 import * as path from 'node:path';
 import * as fs from 'node:fs';
@@ -103,42 +104,93 @@ function buildHeaders(provider?: string): Record<string, string> {
 /**
  * Create a ModelRegistry with the given credentials.
  *
+ * pi 0.80.8 replaced `AuthStorage`/`ModelRegistry.create()` with the async
+ * `ModelRuntime`: `ModelRegistry` is now a SYNCHRONOUS compatibility facade that
+ * wraps a `ModelRuntime` and still exposes `getAll`/`getAvailable`/`find`/
+ * `getApiKeyAndHeaders` — so every consumer of the registry (resolveModel,
+ * safeGet*, the research-model resolver) stays synchronous. Only this factory
+ * became async (constructing the ModelRuntime is inherently async) and its two
+ * callers await it. Mirrors how pi itself builds a registry
+ * (`sdk.js`: `await ModelRuntime.create({ authPath, modelsPath })`).
+ *
  * @param apiKey  - Optional explicit API key
  * @param provider - Optional provider name to key the API key under
  * @returns A configured ModelRegistry
  */
-export function buildModelRegistry(apiKey?: string, provider?: string): ModelRegistry {
+export async function buildModelRegistry(apiKey?: string, provider?: string): Promise<ModelRegistry> {
   const agentDir = getAgentDir();
   const modelsJsonPath = path.join(agentDir, 'models.json');
   const authPath = path.join(agentDir, 'auth.json');
+  const hasModels = fs.existsSync(modelsJsonPath);
+  const hasAuth = fs.existsSync(authPath);
+
+  // Build the runtime from the user's pi config (models.json + auth.json) when
+  // EITHER file is present, otherwise a bare runtime that reads env-var keys and
+  // built-in providers. allowModelNetwork:false preserves the prior behavior of
+  // NOT doing a network model-catalog refresh at construction (the old
+  // ModelRegistry.create only read the local files). Env provider keys
+  // (e.g. OPENAI_API_KEY) are resolved via pi-ai's provider auth CONTEXT, not the
+  // credential store, so they are honored in every branch below; embedded
+  // models.json apiKeys likewise — auth.json presence must not gate models.json.
+  //
+  // When auth.json does NOT exist, an explicit in-memory credential store is
+  // passed instead of letting ModelRuntime default to the file at authPath:
+  // AuthStorage's file backend CREATES ~/.pi/agent/ and an empty auth.json as a
+  // construction side effect (mkdir+write). Without this, every CLI invocation —
+  // including read-only ones like `status` — would silently create a pi config
+  // dir on machines that never installed pi, and would hard-fail in read-only-
+  // $HOME environments (containers/CI) where the old in-memory path needed no
+  // filesystem write access at all.
+  const runtime = await ModelRuntime.create({
+    authPath: hasAuth ? authPath : undefined,
+    credentials: hasAuth ? undefined : new InMemoryCredentialStore(),
+    modelsPath: hasModels ? modelsJsonPath : null,
+    allowModelNetwork: false,
+  });
 
+  // Explicit key: seed it on the runtime after construction. NOTE: unlike the old
+  // AuthStorage.inMemory({ [provider]: ... }) seeding, this MERGES — the explicit
+  // key wins for its own provider (runtime overrides are checked first), but any
+  // providers already configured in auth.json remain visible in getAvailable().
+  // That broadening is acceptable because explicit-key flows always pair the key
+  // with an explicit model (enforced in cli.ts pre-flight), so resolution never
+  // falls back to "first available".
   if (apiKey && provider) {
-    // Explicit key: seed InMemory storage under the correct provider name.
-    const authStorage = AuthStorage.inMemory({
-      [provider]: { type: 'api_key', key: apiKey },
-    });
-    return ModelRegistry.create(
-      authStorage,
-      fs.existsSync(modelsJsonPath) ? modelsJsonPath : undefined,
-    );
+    // allowNetwork:false is REQUIRED here, not just consistent with create():
+    // setRuntimeApiKey triggers a model-catalog refresh for the newly configured
+    // provider, and its default options open live catalog connections — verified
+    // to hang indefinitely (no timeout at this layer) in network-restricted
+    // environments, which would wedge every explicit-API-key pre-flight.
+    await runtime.setRuntimeApiKey(provider, apiKey, { allowNetwork: false });
   }
 
-  // No explicit key: use the user's pi configuration when EITHER file exists.
-  // ModelRegistry.create() reads embedded apiKeys from models.json providers
-  // directly (via providerRequestConfigs), so custom providers with embedded
-  // keys work with no auth.json at all — auth.json presence must not gate
-  // models.json (AuthStorage.create tolerates a missing file). Env provider
-  // keys (e.g. OPENAI_API_KEY) are honored by AuthStorage in every branch.
-  if (fs.existsSync(authPath) || fs.existsSync(modelsJsonPath)) {
-    const authStorage = AuthStorage.create(authPath);
-    return ModelRegistry.create(
-      authStorage,
-      fs.existsSync(modelsJsonPath) ? modelsJsonPath : undefined,
-    );
-  }
+  // The sync facade all our resolvers consume. getAvailable()/getApiKeyAndHeaders()
+  // read a cached snapshot populated by create(), so the sync reads below work
+  // without further awaits.
+  const registry = new ModelRegistry(runtime);
+  registryRuntimes.set(registry, runtime);
+  return registry;
+}
 
-  // Last resort: in-memory with nothing — will fail at LLM call time with actionable error
-  return ModelRegistry.inMemory(AuthStorage.inMemory());
+/**
+ * The ModelRuntime backing each registry this factory built. Researcher sessions
+ * must be created with `modelRuntime` (pi 0.80.8+ replaced the old
+ * `modelRegistry` session option): without it, createAgentSession() builds its
+ * OWN runtime from the default ~/.pi/agent paths, which never sees an explicit
+ * API key seeded via setRuntimeApiKey above — standalone PI_RESEARCH_API_KEY
+ * users with no (or a different-provider) auth.json would pass pre-flight and
+ * then fail auth on every researcher LLM call.
+ */
+const registryRuntimes = new WeakMap<ModelRegistry, ModelRuntime>();
+
+/**
+ * Return the ModelRuntime behind a registry built by {@link buildModelRegistry},
+ * or undefined for registries built elsewhere (e.g. the pi host's own
+ * ExtensionContext.modelRegistry — for those, createAgentSession()'s default
+ * runtime construction from the host's agent dir is exactly right).
+ */
+export function getRuntimeForRegistry(registry: unknown): ModelRuntime | undefined {
+  return registry instanceof Object ? registryRuntimes.get(registry as ModelRegistry) : undefined;
 }
 
 /**

package/src/index.ts

@@ -90,10 +90,14 @@ function extractResultText(result: AgentToolResult<unknown>): string {
  * Pi Research Extension
  */
 export default async function (pi: ExtensionAPI) {
-  // Runtime version check — must match the @earendil-works/* dependency minimum (>=0.80.2).
-  // 0.80.2 is the floor because the AuthStorage credential discriminator pi-research
-  // passes (`type: 'api_key'`, model-registry-factory.ts) only became correct in 0.80.2
-  // (it was `api-key` before); the pi-ai `/compat` entrypoint also exists from 0.80.0.
+  // Runtime version check — must match the @earendil-works/* dependency minimum (>=0.80.8).
+  // 0.80.8 is the floor because pi 0.80.8 introduced ModelRuntime and removed
+  // AuthStorage/ModelRegistry.create(); buildModelRegistry (model-registry-factory.ts)
+  // unconditionally calls ModelRuntime.create(), and createAgentSession() is invoked
+  // without the removed `modelRegistry` option (researcher.ts), relying on the
+  // 0.80.8+ host auto-building its ModelRuntime. This in-host check is the real
+  // enforcement point: when running as an extension the host's version is NOT
+  // constrained by npm's resolution of our own package.json range.
   const versionParts = PI_VERSION.split('.').map(Number);
   const major = versionParts[0] ?? 0;
   const minor = versionParts[1] ?? 0;
@@ -104,7 +108,7 @@ export default async function (pi: ExtensionAPI) {
       `Please ensure pi-coding-agent is installed correctly.`,
     );
   }
-  const minMajor = 0, minMinor = 80, minPatch = 2;
+  const minMajor = 0, minMinor = 80, minPatch = 8;
   const tooOld = major < minMajor
     || (major === minMajor && minor < minMinor)
     || (major === minMajor && minor === minMinor && patch < minPatch);

package/src/infrastructure/browser/thread-worker.mjs

@@ -2278,9 +2278,13 @@ var ConfigSchema = Type.Object({
    *  never killed before it has used its full nav budget plus time waiting in the queue.
    *  (default: 10000) */
   BROWSER_TASK_TIMEOUT_MS: Type.Number({ minimum: 2e3, maximum: 12e4, default: 1e4 }),
-  /** Timeout for coordinator/evaluator/repair/knowledge LLM calls in ms (default: 300000 = 5 min, range: 60s-600s).
-   *  Not exposed in TUI — controlled via PI_RESEARCH_LLM_TIMEOUT_MS env var. */
-  LLM_TIMEOUT_MS: Type.Number({ minimum: 6e4, maximum: 6e5, default: 3e5 }),
+  /** Timeout for coordinator/evaluator/repair/knowledge LLM calls in ms (default: 300000 = 5 min, range: 60s-30min).
+   *  Not exposed in TUI — controlled via PI_RESEARCH_LLM_TIMEOUT_MS env var.
+   *  Ceiling raised to 30min (matching RESEARCHER_TIMEOUT_MS): a slow model on a
+   *  large-context synthesis/plan call can legitimately run >10min, and the old
+   *  600000 ceiling silently clamped an explicit PI_RESEARCH_LLM_TIMEOUT_MS
+   *  (e.g. 900000), causing those calls to time out mid-generation. */
+  LLM_TIMEOUT_MS: Type.Number({ minimum: 6e4, maximum: 18e5, default: 3e5 }),
   /** Chain-of-thought "thinking" level for the engine's own LLM calls (coordinator,
    *  evaluator, synthesis, JSON-repair, knowledge extraction) AND the researcher
    *  sub-agents. Default 'off': these calls emit structured JSON / cited reports, not

package/src/orchestration/researcher.ts

@@ -22,6 +22,7 @@ import type { Config } from '../config.ts';
 import { logger } from '../logger.ts';
 
 import { resolveResearchModel } from '../core/llm/research-model-resolver.ts';
+import { getRuntimeForRegistry } from '../core/llm/model-registry-factory.ts';
 
 export interface CreateResearcherSessionOptions {
   cwd: string;
@@ -137,7 +138,17 @@ export async function createResearcherSession(options: CreateResearcherSessionOp
       sessionManager: SessionManager.inMemory(), // Each researcher gets its own isolated session
       settingsManager: researcherSettings,
       model: modelToUse,
-      modelRegistry,
+      // pi 0.80.8 replaced the SDK's `modelRegistry`/`authStorage` session options
+      // with the async `modelRuntime`. Pass the runtime backing OUR registry when
+      // this run built one (standalone CLI/SDK): it carries any explicit API key
+      // seeded via setRuntimeApiKey, which the session's own default runtime
+      // (auto-built from ~/.pi/agent/{auth,models}.json) would never see — without
+      // this, standalone PI_RESEARCH_API_KEY users fail auth on every researcher
+      // LLM call despite passing pre-flight. For registries we did NOT build
+      // (the pi host's ExtensionContext.modelRegistry), this resolves to
+      // undefined and the host auto-builds from its own agent dir — correct
+      // in-host, where auth lives in the host's config.
+      modelRuntime: getRuntimeForRegistry(modelRegistry),
       resourceLoader: makeResourceLoader(systemPrompt),
       // Thinking/reasoning is disabled for researcher agents: they do retrieval and
       // synthesis from scraped pages, not open-ended reasoning. Keeping it off reduces

package/src/sdk.ts

@@ -286,7 +286,7 @@ async function _doInit(options: ResearchSDKOptions = {}): Promise<void> {
   }
 
   // Build and cache the registry (one instance for the lifetime of this init cycle).
-  globalRegistry = sharedBuildModelRegistry(globalApiKey, parsedProvider);
+  globalRegistry = await sharedBuildModelRegistry(globalApiKey, parsedProvider);
 
   try {
     // Resolve the model. Precedence: explicit option (a Model object is used

package/src/utils/make-resource-loader.ts

@@ -5,31 +5,21 @@
  * Both files use identical ResourceLoader implementations.
  */
 
-import type { ResourceLoader, ExtensionRuntime } from '@earendil-works/pi-coding-agent';
+import { createExtensionRuntime, type ResourceLoader } from '@earendil-works/pi-coding-agent';
 
 export function makeResourceLoader(systemPromptText: string): ResourceLoader {
-  const mockRuntime: ExtensionRuntime = {
-    flagValues: new Map(),
-    pendingProviderRegistrations: [],
-    registerProvider: () => {},
-    unregisterProvider: () => {},
-    sendMessage: async () => {},
-    sendUserMessage: async () => {},
-    appendEntry: async () => {},
-    setSessionName: () => undefined,
-    getSessionName: () => undefined,
-    setLabel: async () => {},
-    getActiveTools: () => [],
-    getAllTools: () => [],
-    setActiveTools: () => {},
-    refreshTools: () => {},
-    getCommands: () => [],
-    setModel: async () => true,
-    getThinkingLevel: () => 'off',
-    setThinkingLevel: () => {},
-    assertActive: () => {},
-    invalidate: () => {},
-  };
+  // Use pi's own createExtensionRuntime() instead of hand-maintaining a mock.
+  //
+  // A literal mock object drifted out of sync with the ExtensionRuntime contract:
+  // pi 0.81.0 ("Full provider extensions") added `pendingNativeProviderRegistrations`
+  // + `registerNativeProvider`, which this mock omitted. Under pi >= 0.81.0 the
+  // host's runner.bindCore() / createAgentSessionServices() iterate that field —
+  // `for (... of runtime.pendingNativeProviderRegistrations)` — and an `undefined`
+  // field threw `this.runtime.pendingNativeProviderRegistrations is not iterable`,
+  // aborting EVERY researcher session ("Research produced no report — no source
+  // material was collected"). createExtensionRuntime() always returns a runtime
+  // that satisfies the current host's full contract, so this can't drift again.
+  const mockRuntime = createExtensionRuntime();
 
   return {
     getExtensions: () => ({ extensions: [], errors: [], runtime: mockRuntime }),

package/src/web-research/browser-search.ts

@@ -61,10 +61,22 @@ export async function performSearch(
     if (onProgress) onProgress(0);
 
     // Hard cap per query so a single Cloudflare block or hung browser worker
-    // cannot stall the entire Promise.all burst. Derived from the configured
-    // search timeout (default 45s) so raising SEARCH_TIMEOUT_MS actually takes
-    // effect here instead of being silently overridden by a lower literal.
-    const QUERY_TIMEOUT_MS = config?.SEARCH_TIMEOUT_MS ?? 45_000;
+    // cannot stall the entire Promise.all burst.
+    //
+    // The budget is the worker's nav budget (SEARCH_TIMEOUT_MS) PLUS the
+    // queue-wait/overhead margin (BROWSER_TASK_TIMEOUT_MS), mirroring the
+    // scheduler's own task-timeout ceiling in BrowserTaskScheduler.runSearch
+    // (= SEARCH_TIMEOUT_MS + BROWSER_TASK_TIMEOUT_MS). This clock starts at
+    // ENQUEUE (before runWorkerSearch queues onto the shared browser pool), so
+    // a budget of only SEARCH_TIMEOUT_MS would let a query that sat in the
+    // saturated worker queue burn its ENTIRE nav budget waiting for a slot and
+    // abort with zero actual search work — exactly the "Query timed out after
+    // 45000ms (likely blocked or slow startup)" cascade observed under
+    // concurrent load. Including the margin lets a queued query still use its
+    // full nav budget once a worker picks it up, and keeps this layer's hard
+    // cap coherent with the scheduler's so it never preempts the worker's own
+    // (post-dequeue) deadline.
+    const QUERY_TIMEOUT_MS = (config?.SEARCH_TIMEOUT_MS ?? 45_000) + (config?.BROWSER_TASK_TIMEOUT_MS ?? 10_000);
 
     const filteredQueries = queries.filter(q => q.trim());
     let timeoutCount = 0;
@@ -133,7 +145,7 @@ export async function performSearch(
             metrics.increment('browser_search_queries_total', 1, { status });
             
             if (isTimeout) {
-                logger.warn(`[Search] Query timed out after ${QUERY_TIMEOUT_MS}ms (likely blocked or slow startup): "${query}"`);
+                logger.warn(`[Search] Query timed out after ${QUERY_TIMEOUT_MS}ms — likely starved waiting for a free browser worker under concurrent load, or a slow/blocked search provider: "${query}"`);
             } else {
                 const msg = error instanceof Error ? error.message : String(error);
                 if (msg !== 'Aborted') {