@lincoln504/pi-research 1.6.17 → 1.6.18

package/README.md

@@ -34,8 +34,6 @@
 
 Search and scraping run locally in a stealth browser, with no search provider and no monthly cap. The only cost is LLM tokens.
 
-Currently recommended model to configure for research: [`openrouter/inclusionai/ling-3.0-flash`](https://openrouter.ai/inclusionai/ling-3.0-flash).
-
 ### Install
 
 As a [Pi](https://github.com/earendil-works/pi) Coding Agent extension:
@@ -89,7 +87,7 @@ Three depth levels (normal, deep, ultra) set the team size and number of rounds.
 - pi. The pi extension uses the host's copy while the standalone CLI and agent skill install it as a dependency.
 - Local knowledge-store embeddings need `@huggingface/transformers`, an optional dependency. If its native image chain (sharp) cannot install, npm skips it with a warning and the install still succeeds, so everything works except local embeddings. The store tells you how to restore them.
 - Cloudflare Turnstile and similar systems block scraping on some sites. A run compensates with a wide pool of search results to scrape.
-- npm reports 1 moderate advisory (adm-zip, pulled in by onnxruntime and the camoufox browser downloader). Installs are unaffected; just don't run `npm audit fix --force` (its suggested downgrade reintroduces a high-severity advisory). Details: [docs/AUDIT-GATE.md](docs/AUDIT-GATE.md).
+- No open advisories: adm-zip 0.6.1 (which fixes the 2026 symlink-extraction advisory in the 0.5.9-0.6.0 line) reaches the tree directly, so `npm audit` is clean. History and the full triage runbook: [docs/AUDIT-GATE.md](docs/AUDIT-GATE.md).
 
 ### Channels
 

package/agent-skill/pi-research/SKILL.md

@@ -2,7 +2,7 @@
 name: pi-research
 description: "Multi-agent web research for any coding agent. Use for anything requiring current information from the internet — news, trends, product/service/company facts, statistics, people, places, events, APIs, library behavior, or 'what is X / how does X work' questions. Also use to search a local knowledge store of previously researched findings before doing live research. Powered by the pi-research engine (search, stealth scraping, security databases, Stack Exchange). Not for reading local files, running project commands, or analyzing this repository's own source."
 license: MIT
-metadata: { "author": "Lincoln Deen", "version": "1.6.17", "package": "@lincoln504/pi-research", "engine": "pi-research-sdk", "openclaw": { "requires": { "bins": ["node"] } } }
+metadata: { "author": "Lincoln Deen", "version": "1.6.18", "package": "@lincoln504/pi-research", "engine": "pi-research-sdk", "openclaw": { "requires": { "bins": ["node"] } } }
 allowed-tools: Bash(node:*)
 ---
 

package/dist/cli.mjs

@@ -3615,9 +3615,9 @@ function buildSafeOptions(model, options, defaultCap = 4096, thinkingLevel = "of
     ...options,
     // Ensure maxTokens is never null/None to avoid provider-side crashes
     maxTokens: options.maxTokens ?? Math.min(defaultCap, model.maxTokens || defaultCap),
-    // 'off' is a valid ModelThinkingLevel that pi-ai accepts at runtime even though the
-    // public SimpleStreamOptions.reasoning type narrows to the non-off ThinkingLevel.
-    reasoning: effective
+    // compat API treats any truthy reasoning as thinking-enabled; 'off' has no budget
+    // entry, so it would send maxTokens as NaN. undefined is its no-reasoning value.
+    reasoning: effective === "off" ? void 0 : effective
   };
 }
 function validateAndExtractText(response, label) {

package/docs/CHANGELOG.md

@@ -5,11 +5,20 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased]
+## [1.6.18]
+
+### Fixed
+
+- **`buildSafeOptions` no longer sends the literal `'off'` reasoning level into pi-ai's compat API (merged PR #13 by @lukey03).** pi-ai 0.85.1's compat path treats any truthy `reasoning` as thinking-enabled, and `'off'` has no entry in its thinking-budget table, so `maxTokens` was computed as `NaN` and serialized as `max_tokens: null` — every coordinator/plan call 400'd on providers that validate the cap (observed on Fireworks' anthropic-messages endpoint, where research never got past the first planning call). `'off'` now crosses the boundary as `undefined`, pi-ai's no-reasoning value; explicit non-off levels, caller precedence, and the maxTokens cap are unchanged. The new `build-safe-options.test.ts` drives the real compat `completeSimple` against a stubbed transport and asserts on the actual request body (5 of its 9 tests fail pre-patch); the one coordinator-boundary assertion that expected the literal `'off'` was updated to the compat contract.
+
+### Security
+
+- **The adm-zip allowlist exception is REMOVED — the advisory is fixed upstream and the production audit is clean.** `adm-zip` 0.6.1 (published 2026-09-11) contains the fix for GHSA-vwc7-r8mq-g2x9 / CVE-2026-76845 (cthackers/adm-zip PR #575, commit `eaa35fa`: extraction no longer writes through destination symlinks, plus setuid/setgid/sticky-bit stripping and related symlink hardening) — the exact `clearsWhen` condition the 1.6.16 exception documented. The `adm-zip` override moves `^0.6.0` → `^0.6.1` to pin the floor explicitly; both parents (`onnxruntime-node`, `camoufox-js`) already resolve 0.6.1 from their own `^0.6.0` ranges, so consumers clear the advisory with a fresh install and can drop any suppression they added. `config/tooling/audit-exceptions.json` is now empty and `npm audit --omit=dev` reports zero vulnerabilities; `docs/AUDIT-GATE.md` keeps the worked example as the triage runbook and records the clearance (the GitHub advisory page still read "patched versions: None" as of 2026-09-16 — its last review predates the release by three days).
 
 ### Changed
 
-- **README: the adm-zip limitation bullet is trimmed to its essentials.** It no longer walks through the consumer-CI consequence (`npm audit` exiting nonzero until the upstream fix ships) or re-states the verified mechanics — installs succeed, don't run `npm audit fix --force`, details in `docs/AUDIT-GATE.md` — because pi-research is a research tool, not a CI component, and the full verified impact matrix lives in the runbook. No behavioral or dependency change.
+- **README: the "Currently recommended model" line is removed** (leaving the README with no model endorsement), and the leftover double blank line it left behind is fixed.
+- **Dev dependency lockfile refresh, all in-range: `vitest` 5.0.0 → 5.0.1, `@vitest/coverage-v8` 5.0.0 → 5.0.1, `vite` 8.2.2 → 8.3.0, `dependency-cruiser` 18.2.0 → 18.3.1, `jsdom` 30.0.1 → 30.1.0, `webgpu` 0.6.0 → 0.6.1.** Deliberate holds re-verified and unchanged: `typebox` stays 1.3.7 (lockstep with the host pi 0.85.1 line), `apache-arrow` stays 21.1.0 (21.2.0 breaks LanceDB IPC), `playwright-core` stays 1.60.0 (camoufox-js 0.12.0 peers `<1.61.0`), `typescript` stays `<6.1.0` (@typescript-eslint peer ceiling), and `@huggingface/transformers` stays 4.2.0 (4.3.0 pulls an `onnxruntime-web` dev build, `1.31.0-dev.20260914`, and reshuffles the optional native stack for no needed gain). The full gate suite is green: lint, all four type-checks (TS 6 and TS 7 native, src and tests), 3,073 unit tests, dependency-cruiser, build + manifest verify, and the audit gate with an empty allowlist.
 
 ## [1.6.16] - 2026-09-09
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lincoln504/pi-research",
-  "version": "1.6.17",
+  "version": "1.6.18",
   "description": "Web research for your agents with smart and safe tooling + knowledge store",
   "type": "module",
   "private": false,
@@ -116,8 +116,8 @@
   "dependencies": {
     "@earendil-works/pi-ai": ">=0.85.0 <1",
     "@earendil-works/pi-coding-agent": ">=0.85.0 <1",
-    "@earendil-works/pi-tui": ">=0.85.0 <1",
     "@earendil-works/pi-server": ">=0.85.0 <1",
+    "@earendil-works/pi-tui": ">=0.85.0 <1",
     "@kreuzberg/html-to-markdown-node": "^3.7.2",
     "@lancedb/lancedb": "0.38.0",
     "apache-arrow": "21.1.0",
@@ -125,7 +125,7 @@
     "camoufox-js": "^0.12.0",
     "esbuild": "^0.28.2",
     "impit": "0.14.5",
-    "jsdom": "^30.0.1",
+    "jsdom": "^30.1.0",
     "node-html-markdown": "^2.0.0",
     "pdf-oxide-wasm": "^0.3.77",
     "playwright-core": "1.60.0",
@@ -147,7 +147,7 @@
     "ua-parser-js": "^1.0.41",
     "protobufjs": "7.6.5",
     "vite": "^8.2.2",
-    "adm-zip": "^0.6.0",
+    "adm-zip": "^0.6.1",
     "jsdom": {
       "undici": "^8.10.2"
     },
@@ -158,13 +158,13 @@
     "@types/jsdom": "^30.0.0",
     "@typescript-eslint/eslint-plugin": "^8.70.0",
     "@typescript-eslint/parser": "^8.70.0",
-    "@vitest/coverage-v8": "^5.0.0",
+    "@vitest/coverage-v8": "^5.0.1",
     "dependency-cruiser": "^18.2.0",
     "depngn": "^0.6.0",
     "eslint": "^10.10.0",
     "npm-check-updates": "^23.1.0",
     "typescript": ">=6.0.3 <6.1.0",
     "vite": "^8.2.2",
-    "vitest": "^5.0.0"
+    "vitest": "^5.0.1"
   }
 }

package/src/core/llm/llm-utils.ts

@@ -14,10 +14,8 @@ import { completeSimple } from './pi-ai-completion.ts';
  *
  * - Ensures maxTokens is always set (satisfies providers that reject a null cap),
  *   clamped to the model's own ceiling so a large requested cap is never invalid.
- * - Sets the chain-of-thought "thinking" level, defaulting to 'off'. This is passed
- *   straight to pi-ai, which clamps it to whatever the specific model/provider
- *   supports (disabling thinking where an off state exists, omitting the parameter
- *   where it does not). The fix is therefore model-agnostic — pi-ai owns the
+ * - Sets the chain-of-thought "thinking" level, defaulting to 'off' (normalized to
+ *   undefined at the compat boundary, see the reasoning line below). pi-ai owns the
  *   per-provider translation; this code never hardcodes a provider-specific payload.
  *   'off' is deliberate: these engine calls emit structured JSON / cited reports, so a
  *   thinking block only consumes the output-token budget (often truncating before the
@@ -47,9 +45,9 @@ export function buildSafeOptions(
     ...options,
     // Ensure maxTokens is never null/None to avoid provider-side crashes
     maxTokens: options.maxTokens ?? Math.min(defaultCap, model.maxTokens || defaultCap),
-    // 'off' is a valid ModelThinkingLevel that pi-ai accepts at runtime even though the
-    // public SimpleStreamOptions.reasoning type narrows to the non-off ThinkingLevel.
-    reasoning: effective as unknown as SimpleStreamOptions['reasoning'],
+    // compat API treats any truthy reasoning as thinking-enabled; 'off' has no budget
+    // entry, so it would send maxTokens as NaN. undefined is its no-reasoning value.
+    reasoning: effective === 'off' ? undefined : (effective as SimpleStreamOptions['reasoning']),
   };
 }