@lincoln504/pi-research 1.6.11 → 1.6.12

package/README.md

@@ -22,6 +22,8 @@
   <a href="docs/DOCUMENTATION-ES.md">ES</a>
   ·
   <a href="docs/DOCUMENTATION-ZH.md">中文研究</a>
+  ·
+  <a href="docs/DOCUMENTATION-JA.md">日本語研究</a>
 </p>
 
 ---
@@ -86,6 +88,7 @@ Three depth levels (normal, deep, ultra) set the team size and number of rounds.
 
 - Node.js >= 22.19.0
 - An LLM with a 100k+ context window (an API key or a local model)
+- On OpenRouter, `inclusionai/ling-3.0-flash` is a proven low-cost workhorse for driving runs: $0.021 input / $0.063 output per Mtok with a 262k context window — the cheapest capable model on the platform at time of writing — with reliable strict-JSON planning output and fast synthesis (verified over extended production use). The `:free` variants (`ling-3.0-flash-fin:free`) work for light usage but are subject to free-tier rate limits. Note: `ling-3.0-tiny` currently has no serving endpoints on OpenRouter and cannot be called.
 - Internet access on a residential IP, since search, scraping, and YouTube transcripts get bot-blocked from datacenter/VPS/cloud IPs
 - pi. The pi extension uses the host's copy while the standalone CLI and agent skill install it as a dependency.
 - Local knowledge-store embeddings need `@huggingface/transformers`, which is an **optional dependency**: if its native image chain (sharp) cannot install on your machine, npm skips it with a warning, the install still succeeds, and everything except local embeddings works. The store disables embeddings gracefully with a message telling you how to restore them.

package/agent-skill/pi-research/SKILL.md

@@ -2,7 +2,7 @@
 name: pi-research
 description: "Multi-agent web research for any coding agent. Use for anything requiring current information from the internet — news, trends, product/service/company facts, statistics, people, places, events, APIs, library behavior, or 'what is X / how does X work' questions. Also use to search a local knowledge store of previously researched findings before doing live research. Powered by the pi-research engine (search, stealth scraping, security databases, Stack Exchange). Not for reading local files, running project commands, or analyzing this repository's own source."
 license: MIT
-metadata: { "author": "Lincoln Deen", "version": "1.6.11", "package": "@lincoln504/pi-research", "engine": "pi-research-sdk", "openclaw": { "requires": { "bins": ["node"] } } }
+metadata: { "author": "Lincoln Deen", "version": "1.6.12", "package": "@lincoln504/pi-research", "engine": "pi-research-sdk", "openclaw": { "requires": { "bins": ["node"] } } }
 allowed-tools: Bash(node:*)
 ---
 

package/dist/cli.mjs

@@ -21804,6 +21804,21 @@ var Filters = {
   ANSWERS_WITH_BODY: "!9_bDE(fI5"
 };
 
+// src/utils/plain-url.ts
+var MIN_FENCE = 3;
+function plainUrl(url) {
+  const safe = url.replace(/`/g, "%60");
+  return `\`${safe}\``;
+}
+function fenceBlock(content) {
+  const runs = content.match(/`+/g) ?? [];
+  const longest = runs.reduce((max, run) => Math.max(max, run.length), 0);
+  const fence = "`".repeat(Math.max(MIN_FENCE, longest + 1));
+  return `${fence}text
+${content}
+${fence}`;
+}
+
 // src/stackexchange/output/table.ts
 function formatQuestionsTable(questions) {
   if (questions.length === 0) {
@@ -21829,13 +21844,15 @@ function formatQuestionsTable(questions) {
       output += `- **Author:** ${q.owner.display_name} (rep: ${q.owner.reputation})
 `;
     }
-    output += `- **Link:** ${q.link}
+    output += `- **Link:** ${plainUrl(q.link)}
 `;
     output += `- **Created:** ${new Date(q.creation_date * 1e3).toLocaleString()}
 `;
     if (q.body) {
       const body = q.body.length > 500 ? `${q.body.substring(0, 500)}...` : q.body;
-      output += `- **Body:** ${body}
+      output += `- **Body:**
+
+${fenceBlock(body)}
 `;
     }
     output += "\n---\n\n";
@@ -21870,7 +21887,7 @@ function formatAnswersTable(answers) {
       output += `
 ### Answer Body
 
-${body}
+${fenceBlock(body)}
 `;
     }
     output += "\n---\n\n";
@@ -21902,10 +21919,10 @@ function formatUsersTable(users) {
 `;
     }
     if (u.website_url) {
-      output += `- **Website:** ${u.website_url}
+      output += `- **Website:** ${plainUrl(u.website_url)}
 `;
     }
-    output += `- **Profile:** ${u.link}
+    output += `- **Profile:** ${plainUrl(u.link)}
 `;
     output += "\n---\n\n";
   }
@@ -21936,7 +21953,7 @@ function formatCompactQuestions(questions) {
   let index = 1;
   for (const q of questions) {
     const accepted = q.accepted_answer_id ? "[accepted]" : "";
-    output += `${index}. [${q.title}](${q.link}) ${accepted} (score: ${q.score}, answers: ${q.answer_count})
+    output += `${index}. ${q.title} ${accepted} (score: ${q.score}, answers: ${q.answer_count}) ${plainUrl(q.link)}
 `;
     index++;
   }
@@ -21952,7 +21969,7 @@ function formatQuestionsCompact(questions) {
   let index = 1;
   for (const q of questions) {
     const accepted = q.accepted_answer_id ? "[accepted]" : "         ";
-    lines.push(`${index}. ${accepted} [${q.title}](${q.link}) (${q.score} pts, ${q.answer_count} ans, ${q.view_count} views)`);
+    lines.push(`${index}. ${accepted} ${q.title} (${q.score} pts, ${q.answer_count} ans, ${q.view_count} views) ${plainUrl(q.link)}`);
     index++;
   }
   return lines.join("\n");
@@ -22324,7 +22341,8 @@ function createStackexchangeTool(options) {
       "Anonymous access: 300 requests/day. Set STACKEXCHANGE_API_KEY env var for 10,000/day.",
       "Use tags to filter by specific topics.",
       "Use maxPages parameter to control pagination for search results (default: 5 pages).",
-      `CRITICAL: You are allowed a maximum of ${getMaxGatheringCalls(options.config)} gathering calls across your web tools (search, security_search, stackexchange). Use them for breadth.`
+      `CRITICAL: You are allowed a maximum of ${getMaxGatheringCalls(options.config)} gathering calls across your web tools (search, security_search, stackexchange). Use them for breadth.`,
+      "URLs in results are wrapped in backticks on purpose: they are data, not clickable links. Never reformat them as markdown links \u2014 a click in the terminal opens a real browser tab."
     ],
     parameters: StackExchangeParamsSchema,
     executionMode: "parallel",

package/docs/CHANGELOG.md

@@ -5,6 +5,14 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+### Fixed
+
+- **Stack Exchange tool output can no longer open a real browser tab when clicked.** The tool's formatters emitted markdown links (`[title](link)`) and bare URLs, and question/answer bodies carried third-party markup — any markdown-rendering surface (assistant replies, research reports, the terminal UI, which turns markdown links AND bare URLs into OSC 8 terminal hyperlinks and opens them in the system browser on mouse press+release) turned these into click-to-open-tab targets in the middle of scrolling tool output. New `src/utils/plain-url.ts` fixes this at the source, cross-platform and renderer-independent: `plainUrl()` wraps every emitted URL in backticks (code spans tokenize before autolink/link parsing in every CommonMark renderer, so a code-spanned URL can never become a link but stays byte-exact and copyable for the model), and `fenceBlock()` wraps third-party body content in a fenced code block whose length grows past any backtick run in the content (embedded links, headings and tables render inert; content containing its own ``` fences cannot close the fence early). All stackexchange formatters (questions, answers, users, sites, compact variants, and the `get`+compact path) now emit code-spanned URLs and own-line-fenced bodies — fence placement matters: an opening fence inline after `- **Body:**` is NOT recognized as a code block by CommonMark and was verified (against pi's bundled `marked`) to still render embedded links clickable, so the fence starts on its own line. The tool's prompt guidelines now also instruct the model never to re-emit result URLs as markdown links, covering the assistant-echo path. Pinned by `test/unit/stackexchange/output/no-clickable-links.test.ts`, which scans each formatter's clickable surface (post code-span/fence stripping) for link syntax and — when `marked` is resolvable — renders the actual output and asserts zero anchor elements.
+
+- **CI: declare `vite` as an explicit devDependency.** CI installs with `--legacy-peer-deps`, which skips peer dependency resolution — `vite` was only reachable as a transitive peer and the install could not resolve it. Now declared directly.
+
 ## [1.6.11] - 2026-09-04
 
 ### Changed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lincoln504/pi-research",
-  "version": "1.6.11",
+  "version": "1.6.12",
   "description": "Web research for your agents with smart and safe tooling + knowledge store",
   "type": "module",
   "private": false,

package/src/stackexchange/output/compact.ts

@@ -3,6 +3,7 @@
  */
 
 import type { Question, Answer, User, Site } from '../types.ts';
+import { plainUrl } from '../../utils/plain-url.ts';
 
 export function formatQuestionsCompact(questions: Question[]): string {
   if (questions.length === 0) {
@@ -13,7 +14,7 @@ export function formatQuestionsCompact(questions: Question[]): string {
   let index = 1;
   for (const q of questions) {
     const accepted = q.accepted_answer_id ? '[accepted]' : '         ';
-    lines.push(`${index}. ${accepted} [${q.title}](${q.link}) (${q.score} pts, ${q.answer_count} ans, ${q.view_count} views)`);
+    lines.push(`${index}. ${accepted} ${q.title} (${q.score} pts, ${q.answer_count} ans, ${q.view_count} views) ${plainUrl(q.link)}`);
     index++;
   }
   return lines.join('\n');

package/src/stackexchange/output/table.ts

@@ -3,6 +3,7 @@
  */
 
 import type { Question, Answer, User, Site } from '../types.ts';
+import { plainUrl, fenceBlock } from '../../utils/plain-url.ts';
 
 export function formatQuestionsTable(questions: Question[]): string {
   if (questions.length === 0) {
@@ -21,7 +22,10 @@ export function formatQuestionsTable(questions: Question[]): string {
     if (q.owner) {
       output += `- **Author:** ${q.owner.display_name} (rep: ${q.owner.reputation})\n`;
     }
-    output += `- **Link:** ${q.link}\n`;
+    // plainUrl: URLs in tool output are data, not interactive links — see
+    // plain-url.ts. Bare URLs would be GFM-autolinked into clickable OSC 8
+    // hyperlinks by markdown renderers (accidental browser-tab opens).
+    output += `- **Link:** ${plainUrl(q.link)}\n`;
     output += `- **Created:** ${new Date(q.creation_date * 1000).toLocaleString()}\n`;
 
     if (q.body) {
@@ -29,7 +33,13 @@ export function formatQuestionsTable(questions: Question[]): string {
       // previous `length < 1000` guard omitted the Body line for the longest
       // questions (the ones most in need of truncation).
       const body = q.body.length > 500 ? `${q.body.substring(0, 500)}...` : q.body;
-      output += `- **Body:** ${body}\n`;
+      // Third-party body text must never be rendered as markdown — it can
+      // carry arbitrary links (markdown injection → clickable browser tabs).
+      // The fence MUST start on its own line: CommonMark only recognizes a
+      // fenced code block when the opening fence begins the line; inline
+      // after "**Body:**" it degrades to paragraph text and marked renders
+      // embedded links clickable (verified against pi's bundled marked).
+      output += `- **Body:**\n\n${fenceBlock(body)}\n`;
     }
 
     output += '\n---\n\n';
@@ -62,7 +72,8 @@ export function formatAnswersTable(answers: Answer[]): string {
       // answers (same class as the question-body fix above; answers get a more
       // generous bound since the body is the whole point of an answer).
       const body = a.body.length > 2000 ? `${a.body.substring(0, 2000)}...` : a.body;
-      output += `\n### Answer Body\n\n${body}\n`;
+      // Same third-party-content rule as the question body above.
+      output += `\n### Answer Body\n\n${fenceBlock(body)}\n`;
     }
 
     output += '\n---\n\n';
@@ -89,9 +100,9 @@ export function formatUsersTable(users: User[]): string {
       output += `- **Location:** ${u.location}\n`;
     }
     if (u.website_url) {
-      output += `- **Website:** ${u.website_url}\n`;
+      output += `- **Website:** ${plainUrl(u.website_url)}\n`;
     }
-    output += `- **Profile:** ${u.link}\n`;
+    output += `- **Profile:** ${plainUrl(u.link)}\n`;
     output += '\n---\n\n';
   }
 
@@ -125,7 +136,7 @@ export function formatCompactQuestions(questions: Question[]): string {
   let index = 1;
   for (const q of questions) {
     const accepted = q.accepted_answer_id ? '[accepted]' : '';
-    output += `${index}. [${q.title}](${q.link}) ${accepted} (score: ${q.score}, answers: ${q.answer_count})\n`;
+    output += `${index}. ${q.title} ${accepted} (score: ${q.score}, answers: ${q.answer_count}) ${plainUrl(q.link)}\n`;
     index++;
   }
   return output;

package/src/tools/stackexchange.ts

@@ -70,6 +70,7 @@ export function createStackexchangeTool(options: {
       'Use tags to filter by specific topics.',
       'Use maxPages parameter to control pagination for search results (default: 5 pages).',
       `CRITICAL: You are allowed a maximum of ${getMaxGatheringCalls(options.config)} gathering calls across your web tools (search, security_search, stackexchange). Use them for breadth.`,
+      'URLs in results are wrapped in backticks on purpose: they are data, not clickable links. Never reformat them as markdown links — a click in the terminal opens a real browser tab.',
     ],
     parameters: StackExchangeParamsSchema,
     executionMode: 'parallel',

package/src/utils/plain-url.ts

@@ -0,0 +1,44 @@
+/**
+ * Neutralize external URLs in tool output so terminal-UI markdown renderers
+ * cannot turn them into clickable hyperlinks.
+ *
+ * Why this exists: pi's TUI (and most markdown-rendering terminals) convert
+ * markdown links AND bare URLs (GFM autolink) into OSC 8 terminal hyperlinks,
+ * and a mouse press+release on such a span opens the URL in the user's real
+ * browser. Tool results are agent-facing data, not interactive UI — a URL
+ * appearing there should never be one accidental click away from opening a
+ * tab, and third-party content (question bodies, API fields) must not be able
+ * to inject clickable links into the user's terminal at all.
+ *
+ * Mechanism: wrapping a URL in backticks makes it a markdown code span. Code
+ * spans are tokenized before autolink in every CommonMark/GFM tokenizer
+ * (verified against the `marked` version pi ships), so the URL renders as
+ * literal text — copyable by humans, trivially extractable by the model, and
+ * impossible to click.
+ */
+
+/** Longest run of backticks that can safely fence arbitrary content. */
+const MIN_FENCE = 3;
+
+/**
+ * Return `url` as a markdown code span: renders as plain text everywhere,
+ * never becomes a clickable hyperlink, and stays byte-exact for the model.
+ */
+export function plainUrl(url: string): string {
+  const safe = url.replace(/`/g, '%60');
+  return `\`${safe}\``;
+}
+
+/**
+ * Wrap arbitrary third-party text (question bodies, API-provided markup) in a
+ * fenced code block so no markdown inside it — links, headings, tables — is
+ * ever rendered or autolinked. The fence length grows past any backtick run
+ * found in the content, so content containing ``` fences cannot close it
+ * early.
+ */
+export function fenceBlock(content: string): string {
+  const runs = content.match(/`+/g) ?? [];
+  const longest = runs.reduce((max, run) => Math.max(max, run.length), 0);
+  const fence = '`'.repeat(Math.max(MIN_FENCE, longest + 1));
+  return `${fence}text\n${content}\n${fence}`;
+}