@lincoln504/pi-research 1.3.2 → 1.3.3

package/dist/cli.mjs

@@ -3565,7 +3565,7 @@ async function buildModelRegistry(apiKey, provider) {
     allowModelNetwork: false
   });
   if (apiKey && provider) {
-    await runtime.setRuntimeApiKey(provider, apiKey, { allowNetwork: false });
+    await runtime.setRuntimeApiKey(provider, apiKey);
   }
   const registry = new ModelRegistry(runtime);
   registryRuntimes.set(registry, runtime);

package/docs/CHANGELOG.md

@@ -5,6 +5,29 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.3.3] - 2026-08-07
+
+pi 0.84.1 compatibility. Triggered by updating the local `pi` install and
+auditing `@earendil-works/pi-coding-agent`'s CHANGELOG in full — not just
+grepped — from 0.84.1 back through 0.79.2 (the full range since this
+package's own last-tested line, plus further back for context) for anything
+that requires a fix or is worth adopting.
+
+### Fixed
+
+- **`ModelRuntime.setRuntimeApiKey()`'s `allowNetwork` option was removed in pi 0.84.0.** `buildModelRegistry`'s explicit-API-key path passed `{ allowNetwork: false }` to prevent a live model-catalog network connection from hanging indefinitely in network-restricted environments (verified previously). 0.84.0 narrowed `setRuntimeApiKey`'s own options to just `{ signal? }` — but its internal `synchronizeCredentialState()` now hardcodes that same `allowNetwork: false` unconditionally on every call, confirmed by reading pi-coding-agent's `model-runtime.js` directly rather than trusting the changelog prose alone. The now-invalid option is removed from the call; the behavior it protected is preserved by pi itself.
+- **`getApiKeyAndHeaders()`'s returned headers can now legitimately be `null`-valued.** pi 0.84.0 widened `ProviderHeaders` to `Record<string, string | null>` (`null` suppresses a provider/API default header with that name) — pi-research's own structural mirror of the auth-result type (kept separate from importing the real pi-coding-agent type, so a host version skew can't break the build) still declared `Record<string, string>`, which both fails to compile against 0.84.x's real type and would have mishandled a `null` header value. Widened at the one source type and its three downstream consumers (`agentic-repair.ts`, `research-knowledge-search.ts`); the `null` values flow through to `completeSimple()`'s own `SimpleStreamOptions.headers`, which already documents and handles them.
+
+### Changed
+
+- Raised the minimum supported pi version from 0.80.8 to 0.84.0 (`PI_MIN_VERSION` in `src/core/pi-version.ts`, and the `@earendil-works/pi-ai`/`pi-coding-agent`/`pi-tui` dependency floors in package.json) — the `setRuntimeApiKey` fix above only holds on 0.84.0+; an already-resolved older host would silently lose the network-hang protection. Bumped `PI_TESTED_MAX_VERSION` to 0.84.1 (actually installed and exercised: full unit + integration suite, including live SDK lifecycle tests against the real `ModelRuntime`).
+- Cleared three now-resolved `npm audit` exceptions (two `brace-expansion` GHSAs, one location-scoped `undici` exception) from `config/tooling/audit-exceptions.json`: pi-coding-agent@0.84.1's `npm-shrinkwrap.json` now pins `brace-expansion@5.0.9` and `undici@8.9.0`, the exact versions each exception's own `clearsWhen` condition named — verified directly against the installed shrinkwrap, not assumed. The `sharp` (libvips) exception remains; it is unrelated to this pi bump and still unfixed upstream in `@huggingface/transformers`.
+
+Patch, not minor: matches this project's established precedent for pi-floor
+compatibility bumps (1.0.9, 1.0.10) — raising the floor changes which HOST/
+dependency versions are supported, not pi-research's own CLI, tool, or SDK
+contract.
+
 ## [1.3.2] - 2026-08-07
 
 A full-tree re-audit of 1.3.1: 10 independent reviews, each assigned a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lincoln504/pi-research",
-  "version": "1.3.2",
+  "version": "1.3.3",
   "description": "A set of web research tools (search, scrape, and others) and research agent system that uses them safely and efficiently.",
   "type": "module",
   "private": false,
@@ -111,9 +111,9 @@
     "image": "https://raw.githubusercontent.com/Lincoln504/pi-research/main/docs/media/hero.png"
   },
   "dependencies": {
-    "@earendil-works/pi-ai": ">=0.80.8 <1",
-    "@earendil-works/pi-coding-agent": ">=0.80.8 <1",
-    "@earendil-works/pi-tui": ">=0.80.8 <1",
+    "@earendil-works/pi-ai": ">=0.84.0 <1",
+    "@earendil-works/pi-coding-agent": ">=0.84.0 <1",
+    "@earendil-works/pi-tui": ">=0.84.0 <1",
     "@huggingface/transformers": "4.2.0",
     "@kreuzberg/html-to-markdown-node": "^3.5.5",
     "@lancedb/lancedb": "0.29.0",

package/skills/pi-research/SKILL.md

@@ -2,7 +2,7 @@
 name: pi-research
 description: "Multi-agent web research for any coding agent. Use for anything requiring current information from the internet — news, trends, product/service/company facts, statistics, people, places, events, APIs, library behavior, or 'what is X / how does X work' questions. Also use to search a local knowledge store of previously researched findings before doing live research. Powered by the pi-research engine (search, stealth scraping, security databases, Stack Exchange). Not for reading local files, running project commands, or analyzing this repository's own source."
 license: MIT
-metadata: { "author": "Lincoln Deen", "version": "1.3.2", "package": "@lincoln504/pi-research", "engine": "pi-research-sdk", "openclaw": { "requires": { "bins": ["node"] } } }
+metadata: { "author": "Lincoln Deen", "version": "1.3.3", "package": "@lincoln504/pi-research", "engine": "pi-research-sdk", "openclaw": { "requires": { "bins": ["node"] } } }
 allowed-tools: Bash(node:*)
 ---
 

package/src/core/llm/agentic-repair.ts

@@ -63,7 +63,11 @@ export type LlmCompleter = (
 export async function repairJsonWithLlm<T = any>(
   text: string,
   completer: LlmCompleter,
-  auth: { apiKey: string; headers?: Record<string, string> },
+  // headers values are string | null to match pi-ai's ProviderHeaders — a null
+  // entry suppresses a provider/API default header with that name, and is
+  // forwarded to `completer`'s SimpleStreamOptions.headers unchanged, where
+  // pi-ai already treats it as documented.
+  auth: { apiKey: string; headers?: Record<string, string | null> },
   options: JsonRepairOptions
 ): Promise<T | null> {
   const { model, context, schema, serviceName = 'RepairService', signal, maxTokens = 16384, thinkingLevel = 'off' } = options;

package/src/core/llm/model-registry-factory.ts

@@ -36,9 +36,15 @@ export interface ModelRegistryLike {
  * Structural result of {@link ModelRegistryLike.getApiKeyAndHeaders}. Mirrors the
  * pi-coding-agent `ApiKeyAndHeaders` discriminated union without importing it, so
  * a host skew on the concrete type can't break our build.
+ *
+ * `headers` values are `string | null` (not just `string`) as of pi 0.84.0's
+ * `ProviderHeaders` type — `null` is a legitimate header-DELETION marker (e.g.
+ * stripping a placeholder credential before it reaches a gateway), not an
+ * absent value. Every consumer of `headers` below must treat `null` as "omit
+ * this header," not coerce it to the literal string `"null"`.
  */
 export type AuthResultLike =
-  | { ok: true; apiKey?: string; headers?: Record<string, string> }
+  | { ok: true; apiKey?: string; headers?: Record<string, string | null> }
   | { ok: false; error: string };
 
 /** Safe `getAll()` — returns [] if the host registry lacks the method. */
@@ -156,12 +162,16 @@ export async function buildModelRegistry(apiKey?: string, provider?: string): Pr
   // with an explicit model (enforced in cli.ts pre-flight), so resolution never
   // falls back to "first available".
   if (apiKey && provider) {
-    // allowNetwork:false is REQUIRED here, not just consistent with create():
-    // setRuntimeApiKey triggers a model-catalog refresh for the newly configured
-    // provider, and its default options open live catalog connections — verified
-    // to hang indefinitely (no timeout at this layer) in network-restricted
-    // environments, which would wedge every explicit-API-key pre-flight.
-    await runtime.setRuntimeApiKey(provider, apiKey, { allowNetwork: false });
+    // pi 0.84.0 removed `allowNetwork` from setRuntimeApiKey's own options
+    // (AuthOperationOptions is now just `{ signal? }`) — but its internal
+    // synchronizeCredentialState() now hardcodes `refresh({ allowNetwork:
+    // false, ... })` unconditionally on every call, so the "no live catalog
+    // connection, no indefinite hang in network-restricted environments"
+    // guarantee this call originally needed still holds without asking for
+    // it. Confirmed by reading pi-coding-agent's model-runtime.js directly,
+    // not just the changelog prose — verify this again on the next pi bump
+    // before assuming it's still unconditional.
+    await runtime.setRuntimeApiKey(provider, apiKey);
   }
 
   // The sync facade all our resolvers consume. getAvailable()/getApiKeyAndHeaders()

package/src/core/pi-version.ts

@@ -61,8 +61,21 @@ export function compareVersions(a: SemverParts, b: SemverParts): number {
  * `ModelRegistry.create()`. `buildModelRegistry` calls `ModelRuntime.create()`
  * unconditionally, and `createAgentSession()` is invoked without the removed
  * `modelRegistry` option, relying on the 0.80.8+ host to build its own.
+ *
+ * 0.84.0 removed `allowNetwork` from `ModelRuntime.setRuntimeApiKey()`'s own
+ * options (`AuthOperationOptions` is now just `{ signal? }`) — but its
+ * internal `synchronizeCredentialState()` now hardcodes `refresh({
+ * allowNetwork: false, ... })` unconditionally on every call, so
+ * `buildModelRegistry`'s explicit-API-key path (model-registry-factory.ts)
+ * no longer passes `allowNetwork` at all, RELYING on 0.84.0+'s own
+ * unconditional internal guard against a live network catalog connection.
+ * On an already-resolved pre-0.84.0 host, `setRuntimeApiKey`'s default
+ * (unspecified) network behavior applies instead — reintroducing the
+ * indefinite-hang-in-network-restricted-environments bug that explicit
+ * option originally existed to prevent. The floor moved to close that gap,
+ * not just because the type changed.
  */
-export const PI_MIN_VERSION: SemverParts = { major: 0, minor: 80, patch: 8 };
+export const PI_MIN_VERSION: SemverParts = { major: 0, minor: 84, patch: 0 };
 
 /**
  * Newest host line this release was actually exercised against (CI + a real run).
@@ -70,7 +83,7 @@ export const PI_MIN_VERSION: SemverParts = { major: 0, minor: 80, patch: 8 };
  * Compared on MAJOR.MINOR only: a patch bump within a tested line is not a new
  * surface, and warning on it would be noise.
  */
-export const PI_TESTED_MAX_VERSION: SemverParts = { major: 0, minor: 83, patch: 0 };
+export const PI_TESTED_MAX_VERSION: SemverParts = { major: 0, minor: 84, patch: 1 };
 
 export type PiCompatibilityLevel = 'ok' | 'unparseable' | 'too-old' | 'untested';
 

package/src/tools/research-knowledge-search.ts

@@ -412,7 +412,9 @@ export function isTransientSynthesisError(message: string): boolean {
 /** Exported for unit testing of the transient-retry loop. */
 export async function runBackgroundExtraction(
   model: Model<any>,
-  auth: { apiKey: string; headers?: Record<string, string> },
+  // headers values are string | null (pi-ai's ProviderHeaders) — forwarded
+  // to completeSimple's own SimpleStreamOptions.headers unchanged.
+  auth: { apiKey: string; headers?: Record<string, string | null> },
   conversationHistory: string,
   queries: string[],
   referenceDocuments: string,
@@ -561,7 +563,9 @@ export async function runBackgroundExtraction(
  */
 export async function triageRelevantUrls(
   model: Model<any>,
-  auth: { apiKey: string; headers?: Record<string, string> },
+  // headers values are string | null (pi-ai's ProviderHeaders) — forwarded
+  // to completeSimple's own SimpleStreamOptions.headers unchanged.
+  auth: { apiKey: string; headers?: Record<string, string | null> },
   conversationHistory: string,
   queries: string[],
   candidates: KnowledgeCandidate[],