@lincoln504/pi-research 1.6.12 → 1.6.14

package/README.md

@@ -34,6 +34,8 @@
 
 Search and scraping run locally through a stealth browser with no search provider and no monthly cap. The only cost is LLM tokens.
 
+**Current recommended model:** [`inclusionai/ling-3.0-flash`](https://openrouter.ai/inclusionai/ling-3.0-flash) on OpenRouter: cheap, intelligent, and fast.
+
 ### Install
 
 As a [Pi](https://github.com/earendil-works/pi) Coding Agent extension:
@@ -68,7 +70,7 @@ A research run loops through agent teams: a coordinator plans and starts with a
 
 Three depth levels (normal, deep, ultra) set the team size and number of rounds. A natural-language request is enough; the tool picks the right one:
 
-![Prompt-driven multi-round research in the pi TUI](https://raw.githubusercontent.com/Lincoln504/pi-research/main/docs/media/02-prompt-research.gif)
+![Two research runs in parallel in the pi TUI](https://raw.githubusercontent.com/Lincoln504/pi-research/main/docs/media/hero.png)
 
 ### Use cases
 
@@ -81,14 +83,13 @@ Three depth levels (normal, deep, ultra) set the team size and number of rounds.
 
 - **No quota and no monthly fee.** Most AI search providers cap free searches and then charge, with results served from their index on their servers. pi-research searches and scrapes locally through DuckDuckGo in a stealth browser.
 - **The index is local.** Every finding can be saved to a local [LanceDB](https://lancedb.com) knowledge store that seeds future runs, so repeat questions get faster and cheaper answers.
-- **Read-only by design.** The research agent cannot run shell commands or write, edit, or delete anything, which is the right shape for an agent whose whole job is reading untrusted web pages. Prompt injection picked up mid-run has nothing to act on.
+- **Read-only by design.** The research agent cannot run shell commands or write, edit, or delete anything. Prompt injection picked up mid-run has nothing to act on.
 - **Search a little or a lot.** Depth levels range from a quick pass to a large-scale investigation.
 
 ### Requirements / limitations
 
 - Node.js >= 22.19.0
 - An LLM with a 100k+ context window (an API key or a local model)
-- On OpenRouter, `inclusionai/ling-3.0-flash` is a proven low-cost workhorse for driving runs: $0.021 input / $0.063 output per Mtok with a 262k context window — the cheapest capable model on the platform at time of writing — with reliable strict-JSON planning output and fast synthesis (verified over extended production use). The `:free` variants (`ling-3.0-flash-fin:free`) work for light usage but are subject to free-tier rate limits. Note: `ling-3.0-tiny` currently has no serving endpoints on OpenRouter and cannot be called.
 - Internet access on a residential IP, since search, scraping, and YouTube transcripts get bot-blocked from datacenter/VPS/cloud IPs
 - pi. The pi extension uses the host's copy while the standalone CLI and agent skill install it as a dependency.
 - Local knowledge-store embeddings need `@huggingface/transformers`, which is an **optional dependency**: if its native image chain (sharp) cannot install on your machine, npm skips it with a warning, the install still succeeds, and everything except local embeddings works. The store disables embeddings gracefully with a message telling you how to restore them.
@@ -96,7 +97,7 @@ Three depth levels (normal, deep, ultra) set the team size and number of rounds.
 
 ### Channels
 
-npm (`npm:@lincoln504/pi-research`) is the stable channel and is kept current with breaking pi changes. A git install is the development channel. It has the latest commits and breaks first.
+npm (`npm:@lincoln504/pi-research`) is the stable channel and is kept current with breaking pi changes. A git install is the development channel. It has the latest commits, and receives breaking changes first.
 
 ### License
 

package/agent-skill/pi-research/SKILL.md

@@ -2,7 +2,7 @@
 name: pi-research
 description: "Multi-agent web research for any coding agent. Use for anything requiring current information from the internet — news, trends, product/service/company facts, statistics, people, places, events, APIs, library behavior, or 'what is X / how does X work' questions. Also use to search a local knowledge store of previously researched findings before doing live research. Powered by the pi-research engine (search, stealth scraping, security databases, Stack Exchange). Not for reading local files, running project commands, or analyzing this repository's own source."
 license: MIT
-metadata: { "author": "Lincoln Deen", "version": "1.6.12", "package": "@lincoln504/pi-research", "engine": "pi-research-sdk", "openclaw": { "requires": { "bins": ["node"] } } }
+metadata: { "author": "Lincoln Deen", "version": "1.6.14", "package": "@lincoln504/pi-research", "engine": "pi-research-sdk", "openclaw": { "requires": { "bins": ["node"] } } }
 allowed-tools: Bash(node:*)
 ---
 

package/docs/CHANGELOG.md

@@ -7,12 +7,36 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.6.14] - 2026-09-08
+
+### Changed
+
+- **README: the hero image (the two-parallel-runs screenshot from the pi extension page) is now the README's feature image.** The static frame extracted from the deleted GIF lasted one day; the bundled `docs/media/hero.png` — two simultaneous research runs with the per-researcher panels — is the image actually representative of the tool, and the now-unneeded `prompt-research.png` frame is removed.
+
+## [1.6.13] - 2026-09-08
+
+### Changed
+
+- **README: the model recommendation moved to the top and shrank to one sentence.** The long RESEARCH_MODEL paragraph that sat inside Requirements/limitations since the 2026-09-07 commit is now a bold "**Current recommended model:** [`inclusionai/ling-3.0-flash`](https://openrouter.ai/inclusionai/ling-3.0-flash) on OpenRouter — cheap, intelligent, and fast." line above Install; the pricing/rate-limit detail was dropped.
+
+- **README: the prompt-research GIF was replaced by a static frame.** `02-prompt-research.gif` (2.8 MB) is removed from the repo; `docs/media/prompt-research.png` (23 KB, the frame showing the "Research in depth the history of apples" prompt and the run kicking off) takes its place. The GIF was referenced only by README.md, so no other docs change; the tarball gets ~2.8 MB lighter.
+
+- **Dependency refresh, lockfile-only: `@earendil-works/*` 0.85.0→0.85.1 and `@typescript-eslint/*` 8.69→8.70.** Both are within the existing package.json ranges, so consumer installs are unaffected by the lockfile change itself — a fresh install already resolves 0.85.1 (verified by packing the tarball and installing it into a clean project: pi 0.85.1 resolves, the documented dual apache-arrow layout reproduces, `pi-research --help` boots). `PI_TESTED_MAX_VERSION` compares on major.minor only, so the patch stays inside the tested window with no warning. Deliberate holds unchanged: apache-arrow 21.1.0 (LanceDB IPC), playwright-core 1.60.0 (camoufox < 1.61), typescript < 6.1.0 (eslint peer ceiling).
+
+- **README prose fixes: the last abstraction-speak is gone.** The "Read-only by design" bullet no longer claims the tool is "the right shape" for anything (a metaphor with no referent); it now states the two facts plainly: the research agent cannot run shell commands or write, edit, or delete anything, and prompt injection picked up mid-run has nothing to act on. "Breaks first" on the git-install channel is spelled out as "receives breaking changes first", and the model-recommendation line's stray em dash (the README was purged of them in the 1.6.9 cycle) is a colon now.
+
 ### Fixed
 
+- **`npm ci` under npm 12 rejected the lockfile an `npm update` had rewritten** (this release cycle's own dep refresh): the rewrite dropped the `node-domexception@1.0.28` alias entry backing the `@nolyfill/domexception` override while leaving a stale real `node-domexception@1.0.0` copy nested under `@earendil-works/pi-coding-agent`. npm 11 (the local dev npm) accepted the tree; CI's npm 12 is stricter and failed every `npm ci --legacy-peer-deps` leg. The lockfile was regenerated with npm 12 itself, which collapses the stale nested copy so the override is the only resolution; `npm ci --legacy-peer-deps` now validates clean under both npm 11 and npm 12, and CI is green cross-OS.
+
 - **Stack Exchange tool output can no longer open a real browser tab when clicked.** The tool's formatters emitted markdown links (`[title](link)`) and bare URLs, and question/answer bodies carried third-party markup — any markdown-rendering surface (assistant replies, research reports, the terminal UI, which turns markdown links AND bare URLs into OSC 8 terminal hyperlinks and opens them in the system browser on mouse press+release) turned these into click-to-open-tab targets in the middle of scrolling tool output. New `src/utils/plain-url.ts` fixes this at the source, cross-platform and renderer-independent: `plainUrl()` wraps every emitted URL in backticks (code spans tokenize before autolink/link parsing in every CommonMark renderer, so a code-spanned URL can never become a link but stays byte-exact and copyable for the model), and `fenceBlock()` wraps third-party body content in a fenced code block whose length grows past any backtick run in the content (embedded links, headings and tables render inert; content containing its own ``` fences cannot close the fence early). All stackexchange formatters (questions, answers, users, sites, compact variants, and the `get`+compact path) now emit code-spanned URLs and own-line-fenced bodies — fence placement matters: an opening fence inline after `- **Body:**` is NOT recognized as a code block by CommonMark and was verified (against pi's bundled `marked`) to still render embedded links clickable, so the fence starts on its own line. The tool's prompt guidelines now also instruct the model never to re-emit result URLs as markdown links, covering the assistant-echo path. Pinned by `test/unit/stackexchange/output/no-clickable-links.test.ts`, which scans each formatter's clickable surface (post code-span/fence stripping) for link syntax and — when `marked` is resolvable — renders the actual output and asserts zero anchor elements.
 
 - **CI: declare `vite` as an explicit devDependency.** CI installs with `--legacy-peer-deps`, which skips peer dependency resolution — `vite` was only reachable as a transitive peer and the install could not resolve it. Now declared directly.
 
+### Verified
+
+- 3,064 unit tests over 242 files, ESLint clean, all four type-checks (TS 6 src + tests, TS 7 native src + tests), dependency-cruiser and madge clean (190 modules, no circular dependencies), build, and `npm ci --dry-run` manifest verification; `npm audit` reports 0 vulnerabilities. The packed tarball was installed into a clean project: pi 0.85.1 resolves fresh, the documented dual apache-arrow layout (21.1.0 nested / 18.1.0 hoisted for LanceDB) reproduces, and the installed CLI boots. CI green cross-OS (ubuntu ×2, macOS, Windows) including the consumer fresh-install and Arrow/LanceDB interop legs. For this cycle additionally: the tarball installed and the CLI booted under npm 10, npm 11, and npm 12 alike, with the dual apache-arrow layout identical across all three.
+
 ## [1.6.11] - 2026-09-04
 
 ### Changed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lincoln504/pi-research",
-  "version": "1.6.12",
+  "version": "1.6.14",
   "description": "Web research for your agents with smart and safe tooling + knowledge store",
   "type": "module",
   "private": false,