@lincoln504/pi-research 1.6.17 → 1.6.19

package/README.md

@@ -34,8 +34,6 @@
 
 Search and scraping run locally in a stealth browser, with no search provider and no monthly cap. The only cost is LLM tokens.
 
-Currently recommended model to configure for research: [`openrouter/inclusionai/ling-3.0-flash`](https://openrouter.ai/inclusionai/ling-3.0-flash).
-
 ### Install
 
 As a [Pi](https://github.com/earendil-works/pi) Coding Agent extension:
@@ -51,7 +49,7 @@ npm install -g @lincoln504/pi-research
 pi-research skill install
 ```
 
-No extra setup is needed. The package ships ready-made bindings for every platform and runs no install scripts. The stealth browser (~500MB) downloads on first use, so the first scrape takes a few minutes. npm ≥11.19 skips install scripts by default. Leave it that way: nothing needs approving or building. Only Windows with npm older than 11.19 can fail when the install tries to compile from source. Upgrading npm fixes it.
+No extra setup is needed. The package ships ready-made bindings for every platform and runs no install scripts. The stealth browser (1GB+ installed) downloads on first use, so the first scrape takes a few minutes. npm ≥11.19 skips install scripts by default. Leave it that way: nothing needs approving or building. Only Windows with npm older than 11.19 can fail when the install tries to compile from source. Upgrading npm fixes it.
 
 In pi, the extension works out of the box on the session's model and pi's configuration. Standalone use ([agent skill](docs/AGENT-SKILL.md) or [SDK](docs/SDK.md)) needs a model configured. See [Configuration](docs/CONFIGURATION.md).
 
@@ -83,13 +81,12 @@ Three depth levels (normal, deep, ultra) set the team size and number of rounds.
 
 ### Requirements / limitations
 
-- Node.js >= 22.19.0
+- Node.js >= 22.22.2
 - An LLM with a 100k+ context window (an API key or a local model)
 - Internet access on a residential IP, since search, scraping, and YouTube transcripts get bot-blocked from datacenter/VPS/cloud IPs
 - pi. The pi extension uses the host's copy while the standalone CLI and agent skill install it as a dependency.
 - Local knowledge-store embeddings need `@huggingface/transformers`, an optional dependency. If its native image chain (sharp) cannot install, npm skips it with a warning and the install still succeeds, so everything works except local embeddings. The store tells you how to restore them.
 - Cloudflare Turnstile and similar systems block scraping on some sites. A run compensates with a wide pool of search results to scrape.
-- npm reports 1 moderate advisory (adm-zip, pulled in by onnxruntime and the camoufox browser downloader). Installs are unaffected; just don't run `npm audit fix --force` (its suggested downgrade reintroduces a high-severity advisory). Details: [docs/AUDIT-GATE.md](docs/AUDIT-GATE.md).
 
 ### Channels
 

package/agent-skill/pi-research/README.md

@@ -38,7 +38,7 @@ model/key is missing.
 
 ### Prerequisites
 
-- Node.js >= 22.19.0
+- Node.js >= 22.22.2
 - `pi-research` installed somewhere the launcher can find it, and a configured
   model (`PI_RESEARCH_MODEL`) + API key. See [`references/configuration.md`](references/configuration.md).
 

package/agent-skill/pi-research/SKILL.md

@@ -2,7 +2,7 @@
 name: pi-research
 description: "Multi-agent web research for any coding agent. Use for anything requiring current information from the internet — news, trends, product/service/company facts, statistics, people, places, events, APIs, library behavior, or 'what is X / how does X work' questions. Also use to search a local knowledge store of previously researched findings before doing live research. Powered by the pi-research engine (search, stealth scraping, security databases, Stack Exchange). Not for reading local files, running project commands, or analyzing this repository's own source."
 license: MIT
-metadata: { "author": "Lincoln Deen", "version": "1.6.17", "package": "@lincoln504/pi-research", "engine": "pi-research-sdk", "openclaw": { "requires": { "bins": ["node"] } } }
+metadata: { "author": "Lincoln Deen", "version": "1.6.19", "package": "@lincoln504/pi-research", "engine": "pi-research-sdk", "openclaw": { "requires": { "bins": ["node"] } } }
 allowed-tools: Bash(node:*)
 ---
 

package/dist/cli.mjs

@@ -3615,9 +3615,9 @@ function buildSafeOptions(model, options, defaultCap = 4096, thinkingLevel = "of
     ...options,
     // Ensure maxTokens is never null/None to avoid provider-side crashes
     maxTokens: options.maxTokens ?? Math.min(defaultCap, model.maxTokens || defaultCap),
-    // 'off' is a valid ModelThinkingLevel that pi-ai accepts at runtime even though the
-    // public SimpleStreamOptions.reasoning type narrows to the non-off ThinkingLevel.
-    reasoning: effective
+    // compat API treats any truthy reasoning as thinking-enabled; 'off' has no budget
+    // entry, so it would send maxTokens as NaN. undefined is its no-reasoning value.
+    reasoning: effective === "off" ? void 0 : effective
   };
 }
 function validateAndExtractText(response, label) {

package/docs/AGENT-SKILL.md

@@ -125,7 +125,7 @@ Manual. Symlink the directory into any agent's skills folder yourself:
 
 ### Prerequisites
 
-- Node.js >= 22.19.0
+- Node.js >= 22.22.2
 - `pi-research` installed where the launcher can find it, plus a configured model
   (`PI_RESEARCH_MODEL`) + API key. See [Configuration](CONFIGURATION.md).
 

package/docs/CHANGELOG.md

@@ -5,7 +5,37 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased]
+## [1.6.19] - 2026-09-18
+
+### Added
+
+- **`scripts/verify-changelog.cjs`: a release gate that the tagged commit carries a dated changelog section for its version.** The release path validated the tag against `package.json` and `SKILL.md` but never against `docs/CHANGELOG.md`, so a release could be tagged with its changes still sitting under `## [Unreleased]` — which happened twice. `v1.6.12`'s block was later folded into `[1.6.13]` (misattributing it), and `v1.6.17`'s was overwritten by the next release and lost outright. The gate fails closed on a missing, undated, empty, duplicated, or non-newest section; it is unit-tested (`test/unit/scripts/verify-changelog.test.ts`, 11 cases) and runs in CI's lint job and in the release workflow's pre-publish job. The two historical gaps are repaired in the same pass: `[1.6.17]` is restored from git, `[1.6.12]` is reconstructed from the commits in `v1.6.11..v1.6.12` (the Stack Exchange clickable-link fix and the explicit `vite` devDependency, both of which `[1.6.13]` had absorbed, plus the previously undocumented Japanese translation), and `[1.6.18]` gains its missing date.
+
+### Changed
+
+- **README: the adm-zip advisory bullet is removed from the requirements/limitations list.** It only asserted the absence of advisories, which is the audit gate's job (`docs/AUDIT-GATE.md`), not a user-facing limitation. The stealth-browser size claim is corrected from "~500MB" to "1GB+ installed" (the Linux asset downloads at ~630MB and unpacks to ~1.3GB).
+- **Supported Node floor raised from 22.19.0 to 22.22.2** (`engines.node`, `.nvmrc`, README, `docs/AGENT-SKILL.md`, `docs/SDK.md`, all three translations, the `agent-skill` README, the `scripts/setup.cjs` check + warning, and the lockfile root). `jsdom` 30 — a production dependency — and `npm` 12, which CI's install jobs run, both declare `^22.22.2 || ^24.15.0 || >=26.0.0`, so the old floor installed a tree outside its own dependency's support. CI's npm upgrade moved to a separate-prefix install as a result (see Fixed).
+- **Two stale in-code comments that still named the pre-0.85.0 pi floor are corrected to 0.85.0** (`src/core/pi-version.ts`, `src/index.ts`). No behavioral or dependency change.
+
+### Fixed
+
+- **CI no longer upgrades npm by replacing the bundled npm in place.** Node 22.22.2 bundles npm 10.9.7, which cannot install a new npm over itself: the reify deletes npm's own `node_modules` entries while the running process still needs them, and it dies with `Cannot find module 'promise-retry'` (reproduced locally on v22.22.2; CI runs 35414345489 and 35414867837, the ubuntu/macOS unit-test and validate legs). `--force`, `--ignore-scripts` and `--no-audit` all reproduce it, so `--force` was never the fix and the original comment's engines rationale was wrong. `scripts/use-npm12.cjs` installs npm 12 into a separate prefix and puts it on PATH; the release workflow's `publish` job does the same inline for npm 11, which self-upgraded on the same Node and would otherwise have failed the publish.
+
+## [1.6.18] - 2026-09-16
+### Fixed
+
+- **`buildSafeOptions` no longer sends the literal `'off'` reasoning level into pi-ai's compat API (merged PR #13 by @lukey03).** pi-ai 0.85.1's compat path treats any truthy `reasoning` as thinking-enabled, and `'off'` has no entry in its thinking-budget table, so `maxTokens` was computed as `NaN` and serialized as `max_tokens: null` — every coordinator/plan call 400'd on providers that validate the cap (observed on Fireworks' anthropic-messages endpoint, where research never got past the first planning call). `'off'` now crosses the boundary as `undefined`, pi-ai's no-reasoning value; explicit non-off levels, caller precedence, and the maxTokens cap are unchanged. The new `build-safe-options.test.ts` drives the real compat `completeSimple` against a stubbed transport and asserts on the actual request body (5 of its 9 tests fail pre-patch); the one coordinator-boundary assertion that expected the literal `'off'` was updated to the compat contract.
+
+### Security
+
+- **The adm-zip allowlist exception is REMOVED — the advisory is fixed upstream and the production audit is clean.** `adm-zip` 0.6.1 (published 2026-09-11) contains the fix for GHSA-vwc7-r8mq-g2x9 / CVE-2026-76845 (cthackers/adm-zip PR #575, commit `eaa35fa`: extraction no longer writes through destination symlinks, plus setuid/setgid/sticky-bit stripping and related symlink hardening) — the exact `clearsWhen` condition the 1.6.16 exception documented. The `adm-zip` override moves `^0.6.0` → `^0.6.1` to pin the floor explicitly; both parents (`onnxruntime-node`, `camoufox-js`) already resolve 0.6.1 from their own `^0.6.0` ranges, so consumers clear the advisory with a fresh install and can drop any suppression they added. `config/tooling/audit-exceptions.json` is now empty and `npm audit --omit=dev` reports zero vulnerabilities; `docs/AUDIT-GATE.md` keeps the worked example as the triage runbook and records the clearance (the GitHub advisory page still read "patched versions: None" as of 2026-09-16 — its last review predates the release by three days).
+
+### Changed
+
+- **README: the "Currently recommended model" line is removed** (leaving the README with no model endorsement), and the leftover double blank line it left behind is fixed.
+- **Dev dependency lockfile refresh, all in-range: `vitest` 5.0.0 → 5.0.1, `@vitest/coverage-v8` 5.0.0 → 5.0.1, `vite` 8.2.2 → 8.3.0, `dependency-cruiser` 18.2.0 → 18.3.1, `jsdom` 30.0.1 → 30.1.0, `webgpu` 0.6.0 → 0.6.1.** Deliberate holds re-verified and unchanged: `typebox` stays 1.3.7 (lockstep with the host pi 0.85.1 line), `apache-arrow` stays 21.1.0 (21.2.0 breaks LanceDB IPC), `playwright-core` stays 1.60.0 (camoufox-js 0.12.0 peers `<1.61.0`), `typescript` stays `<6.1.0` (@typescript-eslint peer ceiling), and `@huggingface/transformers` stays 4.2.0 (4.3.0 pulls an `onnxruntime-web` dev build, `1.31.0-dev.20260914`, and reshuffles the optional native stack for no needed gain). The full gate suite is green: lint, all four type-checks (TS 6 and TS 7 native, src and tests), 3,073 unit tests, dependency-cruiser, build + manifest verify, and the audit gate with an empty allowlist.
+
+## [1.6.17] - 2026-09-09
 
 ### Changed
 
@@ -55,14 +85,22 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - **`npm ci` under npm 12 rejected the lockfile an `npm update` had rewritten** (this release cycle's own dep refresh): the rewrite dropped the `node-domexception@1.0.28` alias entry backing the `@nolyfill/domexception` override while leaving a stale real `node-domexception@1.0.0` copy nested under `@earendil-works/pi-coding-agent`. npm 11 (the local dev npm) accepted the tree; CI's npm 12 is stricter and failed every `npm ci --legacy-peer-deps` leg. The lockfile was regenerated with npm 12 itself, which collapses the stale nested copy so the override is the only resolution; `npm ci --legacy-peer-deps` now validates clean under both npm 11 and npm 12, and CI is green cross-OS.
 
-- **Stack Exchange tool output can no longer open a real browser tab when clicked.** The tool's formatters emitted markdown links (`[title](link)`) and bare URLs, and question/answer bodies carried third-party markup — any markdown-rendering surface (assistant replies, research reports, the terminal UI, which turns markdown links AND bare URLs into OSC 8 terminal hyperlinks and opens them in the system browser on mouse press+release) turned these into click-to-open-tab targets in the middle of scrolling tool output. New `src/utils/plain-url.ts` fixes this at the source, cross-platform and renderer-independent: `plainUrl()` wraps every emitted URL in backticks (code spans tokenize before autolink/link parsing in every CommonMark renderer, so a code-spanned URL can never become a link but stays byte-exact and copyable for the model), and `fenceBlock()` wraps third-party body content in a fenced code block whose length grows past any backtick run in the content (embedded links, headings and tables render inert; content containing its own ``` fences cannot close the fence early). All stackexchange formatters (questions, answers, users, sites, compact variants, and the `get`+compact path) now emit code-spanned URLs and own-line-fenced bodies — fence placement matters: an opening fence inline after `- **Body:**` is NOT recognized as a code block by CommonMark and was verified (against pi's bundled `marked`) to still render embedded links clickable, so the fence starts on its own line. The tool's prompt guidelines now also instruct the model never to re-emit result URLs as markdown links, covering the assistant-echo path. Pinned by `test/unit/stackexchange/output/no-clickable-links.test.ts`, which scans each formatter's clickable surface (post code-span/fence stripping) for link syntax and — when `marked` is resolvable — renders the actual output and asserts zero anchor elements.
-
-- **CI: declare `vite` as an explicit devDependency.** CI installs with `--legacy-peer-deps`, which skips peer dependency resolution — `vite` was only reachable as a transitive peer and the install could not resolve it. Now declared directly.
-
 ### Verified
 
 - 3,064 unit tests over 242 files, ESLint clean, all four type-checks (TS 6 src + tests, TS 7 native src + tests), dependency-cruiser and madge clean (190 modules, no circular dependencies), build, and `npm ci --dry-run` manifest verification; `npm audit` reports 0 vulnerabilities. The packed tarball was installed into a clean project: pi 0.85.1 resolves fresh, the documented dual apache-arrow layout (21.1.0 nested / 18.1.0 hoisted for LanceDB) reproduces, and the installed CLI boots. CI green cross-OS (ubuntu ×2, macOS, Windows) including the consumer fresh-install and Arrow/LanceDB interop legs. For this cycle additionally: the tarball installed and the CLI booted under npm 10, npm 11, and npm 12 alike, with the dual apache-arrow layout identical across all three.
 
+## [1.6.12] - 2026-09-07
+
+### Added
+
+- **Consolidated Japanese translation** (`docs/DOCUMENTATION-JA.md`), listed after the zh-CN doc in the README.
+
+### Fixed
+
+- **Stack Exchange tool output can no longer open a real browser tab when clicked.** The tool's formatters emitted markdown links (`[title](link)`) and bare URLs, and question/answer bodies carried third-party markup — any markdown-rendering surface (assistant replies, research reports, the terminal UI, which turns markdown links AND bare URLs into OSC 8 terminal hyperlinks and opens them in the system browser on mouse press+release) turned these into click-to-open-tab targets in the middle of scrolling tool output. New `src/utils/plain-url.ts` fixes this at the source, cross-platform and renderer-independent: `plainUrl()` wraps every emitted URL in backticks (code spans tokenize before autolink/link parsing in every CommonMark renderer, so a code-spanned URL can never become a link but stays byte-exact and copyable for the model), and `fenceBlock()` wraps third-party body content in a fenced code block whose length grows past any backtick run in the content (embedded links, headings and tables render inert; content containing its own ``` fences cannot close the fence early). All stackexchange formatters (questions, answers, users, sites, compact variants, and the `get`+compact path) now emit code-spanned URLs and own-line-fenced bodies — fence placement matters: an opening fence inline after `- **Body:**` is NOT recognized as a code block by CommonMark and was verified (against pi's bundled `marked`) to still render embedded links clickable, so the fence starts on its own line. The tool's prompt guidelines now also instruct the model never to re-emit result URLs as markdown links, covering the assistant-echo path. Pinned by `test/unit/stackexchange/output/no-clickable-links.test.ts`, which scans each formatter's clickable surface (post code-span/fence stripping) for link syntax and — when `marked` is resolvable — renders the actual output and asserts zero anchor elements.
+
+- **CI: declare `vite` as an explicit devDependency.** CI installs with `--legacy-peer-deps`, which skips peer dependency resolution — `vite` was only reachable as a transitive peer and the install could not resolve it. Now declared directly.
+
 ## [1.6.11] - 2026-09-04
 
 ### Changed

package/docs/SDK.md

@@ -50,7 +50,7 @@ global file entirely and run purely from defaults + `process.env` + `options.con
 > `ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING`. That applies to
 > `--experimental-transform-types` exactly as it does to
 > `--experimental-strip-types`, so neither flag helps here; a loader (or the pi
-> host) is mandatory. (`engines.node` is `>=22.19.0`.)
+> host) is mandatory. (`engines.node` is `>=22.22.2`.)
 
 ```typescript
 import {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lincoln504/pi-research",
-  "version": "1.6.17",
+  "version": "1.6.19",
   "description": "Web research for your agents with smart and safe tooling + knowledge store",
   "type": "module",
   "private": false,
@@ -73,7 +73,7 @@
     "access": "public"
   },
   "engines": {
-    "node": ">=22.19.0"
+    "node": ">=22.22.2"
   },
   "scripts": {
     "lint": "npx eslint --config config/tooling/eslint.config.js src/",
@@ -104,6 +104,7 @@
     "install:system-deps": "node scripts/setup.cjs --system-deps",
     "deps:check": "depcruise --config config/tooling/dependency-cruiser.cjs --output-type err-long src",
     "deps:generate": "npx --yes madge@8.0.0 --image docs/deps.svg src/index.ts",
+    "verify:changelog": "node scripts/verify-changelog.cjs",
     "analyze:dependencies": "ncu",
     "analyze:compatibility": "depngn"
   },
@@ -116,8 +117,8 @@
   "dependencies": {
     "@earendil-works/pi-ai": ">=0.85.0 <1",
     "@earendil-works/pi-coding-agent": ">=0.85.0 <1",
-    "@earendil-works/pi-tui": ">=0.85.0 <1",
     "@earendil-works/pi-server": ">=0.85.0 <1",
+    "@earendil-works/pi-tui": ">=0.85.0 <1",
     "@kreuzberg/html-to-markdown-node": "^3.7.2",
     "@lancedb/lancedb": "0.38.0",
     "apache-arrow": "21.1.0",
@@ -125,7 +126,7 @@
     "camoufox-js": "^0.12.0",
     "esbuild": "^0.28.2",
     "impit": "0.14.5",
-    "jsdom": "^30.0.1",
+    "jsdom": "^30.1.0",
     "node-html-markdown": "^2.0.0",
     "pdf-oxide-wasm": "^0.3.77",
     "playwright-core": "1.60.0",
@@ -147,7 +148,7 @@
     "ua-parser-js": "^1.0.41",
     "protobufjs": "7.6.5",
     "vite": "^8.2.2",
-    "adm-zip": "^0.6.0",
+    "adm-zip": "^0.6.1",
     "jsdom": {
       "undici": "^8.10.2"
     },
@@ -158,13 +159,13 @@
     "@types/jsdom": "^30.0.0",
     "@typescript-eslint/eslint-plugin": "^8.70.0",
     "@typescript-eslint/parser": "^8.70.0",
-    "@vitest/coverage-v8": "^5.0.0",
+    "@vitest/coverage-v8": "^5.0.1",
     "dependency-cruiser": "^18.2.0",
     "depngn": "^0.6.0",
     "eslint": "^10.10.0",
     "npm-check-updates": "^23.1.0",
     "typescript": ">=6.0.3 <6.1.0",
     "vite": "^8.2.2",
-    "vitest": "^5.0.0"
+    "vitest": "^5.0.1"
   }
 }

package/scripts/setup.cjs

@@ -23,9 +23,12 @@ const isLinux = process.platform === 'linux';
 const isDarwin = process.platform === 'darwin';
 const isWindows = process.platform === 'win32';
 
-const [nodeMajor, nodeMinor] = process.version.replace('v', '').split('.').map((n) => parseInt(n, 10));
-if (nodeMajor < 22 || (nodeMajor === 22 && nodeMinor < 19)) {
-  console.warn(`WARNING: Node.js ${process.version} is below the minimum (>=22.19.0). Upgrade to 22.19.0+.`);
+const [nodeMajor, nodeMinor, nodePatch] = process.version.replace('v', '').split('.').map((n) => parseInt(n, 10));
+// Minimum is 22.22.2 — the floor `jsdom` 30 (a runtime dependency) and npm 12 both declare.
+const belowMinimum =
+  nodeMajor < 22 || (nodeMajor === 22 && (nodeMinor < 22 || (nodeMinor === 22 && nodePatch < 2)));
+if (belowMinimum) {
+  console.warn(`WARNING: Node.js ${process.version} is below the minimum (>=22.22.2). Upgrade to 22.22.2+.`);
 }
 
 /**

package/src/core/llm/llm-utils.ts

@@ -14,10 +14,8 @@ import { completeSimple } from './pi-ai-completion.ts';
  *
  * - Ensures maxTokens is always set (satisfies providers that reject a null cap),
  *   clamped to the model's own ceiling so a large requested cap is never invalid.
- * - Sets the chain-of-thought "thinking" level, defaulting to 'off'. This is passed
- *   straight to pi-ai, which clamps it to whatever the specific model/provider
- *   supports (disabling thinking where an off state exists, omitting the parameter
- *   where it does not). The fix is therefore model-agnostic — pi-ai owns the
+ * - Sets the chain-of-thought "thinking" level, defaulting to 'off' (normalized to
+ *   undefined at the compat boundary, see the reasoning line below). pi-ai owns the
  *   per-provider translation; this code never hardcodes a provider-specific payload.
  *   'off' is deliberate: these engine calls emit structured JSON / cited reports, so a
  *   thinking block only consumes the output-token budget (often truncating before the
@@ -47,9 +45,9 @@ export function buildSafeOptions(
     ...options,
     // Ensure maxTokens is never null/None to avoid provider-side crashes
     maxTokens: options.maxTokens ?? Math.min(defaultCap, model.maxTokens || defaultCap),
-    // 'off' is a valid ModelThinkingLevel that pi-ai accepts at runtime even though the
-    // public SimpleStreamOptions.reasoning type narrows to the non-off ThinkingLevel.
-    reasoning: effective as unknown as SimpleStreamOptions['reasoning'],
+    // compat API treats any truthy reasoning as thinking-enabled; 'off' has no budget
+    // entry, so it would send maxTokens as NaN. undefined is its no-reasoning value.
+    reasoning: effective === 'off' ? undefined : (effective as SimpleStreamOptions['reasoning']),
   };
 }
 

package/src/core/pi-version.ts

@@ -7,7 +7,7 @@
  *
  *   - As a pi EXTENSION, the host supplies `@earendil-works/*`. Our package.json
  *     range never constrains it, so an in-process check is the only enforcement.
- *   - As a standalone CLI/SDK, the range is `>=0.84.0 <1` and published tarballs
+ *   - As a standalone CLI/SDK, the range is `>=0.85.0 <1` and published tarballs
  *     carry no lockfile, so every fresh install resolves the newest 0.x at that
  *     instant. pi is pre-1.0: a minor bump may break anything under semver, and
  *     already has (0.83.0 extended the ResourceLoader contract).

package/src/index.ts

@@ -91,9 +91,10 @@ function extractResultText(result: AgentToolResult<unknown>): string {
  * Pi Research Extension
  */
 export default async function (pi: ExtensionAPI) {
-  // Runtime version check — must match the @earendil-works/* dependency minimum (>=0.84.0).
-  // The floor is 0.84.0 because setRuntimeApiKey() lost its `allowNetwork` option there
-  // and only 0.84.0+ hardcodes the equivalent guard internally (see pi-version.ts). The
+  // Runtime version check — must match the @earendil-works/* dependency minimum (>=0.85.0).
+  // The floor was raised to 0.84.0 because setRuntimeApiKey() lost its `allowNetwork` option
+  // there and only 0.84.0+ hardcodes the equivalent guard internally (see pi-version.ts), then
+  // to 0.85.0 to track the pi extension package line. The
   // APIs it rests on arrived in 0.80.8, which introduced ModelRuntime and removed
   // AuthStorage/ModelRegistry.create(); buildModelRegistry (model-registry-factory.ts)
   // unconditionally calls ModelRuntime.create(), and createAgentSession() is invoked