@lincoln504/pi-research 1.7.3 → 1.7.4

package/agent-skill/pi-research/SKILL.md

@@ -2,7 +2,7 @@
 name: pi-research
 description: "Multi-agent web research for any coding agent. Use for anything requiring current information from the internet — news, trends, product/service/company facts, statistics, people, places, events, APIs, library behavior, or 'what is X / how does X work' questions. Also use to search a local knowledge store of previously researched findings before doing live research. Powered by the pi-research engine (search, stealth scraping, security databases, Stack Exchange). Not for reading local files, running project commands, or analyzing this repository's own source."
 license: MIT
-metadata: { "author": "Lincoln Deen", "version": "1.7.3", "package": "@lincoln504/pi-research", "engine": "pi-research-sdk", "openclaw": { "requires": { "bins": ["node"] } } }
+metadata: { "author": "Lincoln Deen", "version": "1.7.4", "package": "@lincoln504/pi-research", "engine": "pi-research-sdk", "openclaw": { "requires": { "bins": ["node"] } } }
 allowed-tools: Bash(node:*)
 ---
 

package/docs/ARCHITECTURE.md

@@ -384,16 +384,35 @@ validates with. Bump it in lockstep with the pi host, not independently. (`undic
 contrast, tracks the host's major — the host is on undici 8, and pi-research only uses the
 stable `Agent` connector API, so it follows `^8`.)
 
-Pinned embedding runtime — `@huggingface/transformers` is exact at `4.2.0`. Tried `4.3.0`
-on 2026-10-01 and did not take it: it moves the native stack with it (onnxruntime-node
-`1.24.3` → `1.30.0`, onnxruntime-web `1.26.0-dev.20260416` → `1.31.0-dev.20260914`) and
-reshapes the tree (`roarr`, `boolean` and `detect-node` leave `global-agent`'s subtree). The
-knowledge-store unit suite (26 files, 322 tests) and the integration suites
-(`knowledge-stack`, `knowledge-models`, `research-knowledge-search`; 33 tests, 25 run, 8
-skipped) pass on both versions, so those suites do not decide it — they mock the backend or
-run against an already-cached model, and neither exercises a real model download and backend
-selection. Bump it only with a live embedding check (model load, CPU and WebGPU backends) on
-the new ONNX Runtime.
+Pinned embedding runtime — `@huggingface/transformers` is exact at `4.3.0`. The hold at `4.2.0`
+was lifted on 2026-10-01 for a security reason, not a feature one: `4.2.0` declares
+`sharp ^0.34.5` and pins `onnxruntime-node 1.24.3`, whose `adm-zip ^0.5.16` resolves to the
+advisory-ridden `0.5.18`, and neither range can be lifted downstream (npm ignores a published
+dependency's `overrides`, so the repository's own `sharp`/`adm-zip` overrides reach only the
+tree rooted here). `4.3.0` ships `sharp ^0.35.4` and `onnxruntime-node 1.30.0`
+(`adm-zip ^0.6.0`), which clears both advisory groups for consumers as well. It also moves the
+native stack with it (onnxruntime-web `1.26.0-dev.20260416` → `1.31.0-dev.20260914`, left
+overridden at the stable `1.24.3` as before) and reshapes the tree (`global-agent` 3.0.0 →
+4.1.3, dropping seven packages from its old subtree: `roarr`, `boolean`, `detect-node`, `es6-error`,
+`json-stringify-safe`, `semver-compare`, `sprintf-js`).
+
+The unit suite (26 knowledge files, 322 tests) and the integration suites (`knowledge-stack`,
+`knowledge-models`, `knowledge-migrations`, `research-knowledge-search`; 44 tests, 36 run, 8
+skipped) pass on both versions, so those suites do NOT decide a bump — they mock the backend or
+run against an already-cached model, and neither exercises real model load and backend
+selection. What decided this one was a live embedding check against the real backend, run on
+both release candidates with `onnx-community/granite-embedding-small-english-r2-ONNX`:
+
+dimension 384 on both backends; CPU `initialize` 536 ms (4.2.0) vs 524 ms (4.3.0) and
+`embedMany` of 3 texts 48 ms vs 39 ms; WebGPU (Dawn/Vulkan) `initialize` 1003 ms vs 1409 ms and
+`embedMany` 110 ms vs 71 ms; cosine between the two related sentences 0.90431857 (4.2.0 CPU) vs
+0.90431858 (4.3.0 CPU) against 0.70265303 vs 0.70265297 for the unrelated one; embedding the
+same text twice returns cosine 1.0; and a full store round-trip (two documents written through
+the real embedder, then a hybrid vector + FTS + RRF `search` on both devices) returns the
+expected top hit. The shipped `dist/webgpu-probe.mjs` answers `PROBE_OK 384` on the new runtime.
+The remaining hold condition is unchanged: bump this package only with a live embedding check
+(model load, CPU and WebGPU backends, and a store round-trip) on the new ONNX Runtime, because
+nothing in the test suite fails when the backend is broken.
 
 Transient-failure resilience — every LLM call is a potential single point of failure on a
 streaming endpoint that can drop mid-response (undici surfaces this as `terminated`). The

package/docs/CHANGELOG.md

@@ -5,6 +5,19 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.7.4] - 2026-09-30
+
+### Changed
+
+- **`@huggingface/transformers` moves 4.2.0 → 4.3.0, which closes the `adm-zip` advisory group for consumers.** The hold was lifted for a security reason, not a feature one. `4.2.0` declares `sharp ^0.34.5` and pins `onnxruntime-node` 1.24.3, whose `adm-zip ^0.5.16` resolves to the advisory-ridden `0.5.18`, and no downstream lever could lift either range: npm ignores a published dependency's `overrides`, so this repository's own `sharp` and `adm-zip` overrides reached only the tree rooted here, and the audit gate (which audits that tree) stayed green while consumers resolved the vulnerable versions. `4.3.0` ships `sharp ^0.35.4` and `onnxruntime-node` 1.30.0 (`adm-zip ^0.6.0`), so a consumer install of the published tarball drops from 7 HIGH advisories to 5, or 4 on the peer-skipping shape `pi install` uses. What remains is the `sharp 0.33.5` copy that `@lancedb/lancedb` 0.39.0's hard-pinned `@huggingface/transformers` 3.0.2 brings, clearable only by a consumer-side `overrides: {"sharp": "^0.35.4"}` (verified: 0 on the `pi install` shape), plus the host shrinkwrap's `brace-expansion`. The bump also moves the native stack with it (onnxruntime-web `1.26.0-dev.20260416` → `1.31.0-dev.20260914`, still overridden to the stable `1.24.3`) and reshapes the tree (`global-agent` 3.0.0 → 4.1.3, which drops seven packages from its old subtree: `roarr`, `boolean`, `detect-node`, `es6-error`, `json-stringify-safe`, `semver-compare`, `sprintf-js`).
+- **Incidental in-range dev refresh from the same install:** `@types/node` 26.4.1 → 26.6.3. `npm outdated` afterwards reports only the four documented holds: `apache-arrow` 21.1.0 (21.2.0 breaks LanceDB 0.39.0 IPC reads), `playwright-core` 1.60.0 (camoufox-js 0.12.0 peer cap `<1.61.0`), `typebox` 1.3.27 (lockstep with pi 0.99.2's own pin) and `typescript` 6.0.3.
+  - Decided by a live embedding check, which is the only thing that can decide it: the unit suite and the four knowledge integration suites (44 tests, 36 run, 8 skipped) pass on both versions because they mock the backend or run against an already-cached model. Against `onnx-community/granite-embedding-small-english-r2-ONNX` the new stack gives dimension 384 on both backends, CPU `initialize` 536 ms → 524 ms and `embedMany` of three texts 48 ms → 39 ms, WebGPU (Dawn/Vulkan) `initialize` 1003 ms → 1409 ms and `embedMany` 110 ms → 71 ms, related-sentence cosine 0.90431857 → 0.90431858 against 0.70265303 → 0.70265297 for the unrelated one, same-input cosine 1.0, a full store round-trip (two documents written through the real embedder, then a hybrid vector + FTS + RRF search) returning the expected top hit on both devices, and the shipped `dist/webgpu-probe.mjs` answering `PROBE_OK 384`.
+
+### Fixed
+
+- **The audit-gate runbook's claim that consumers see zero vulnerabilities was false and is withdrawn.** `docs/AUDIT-GATE.md` stated that a consumer's `npm audit --omit=dev` reported zero vulnerabilities since 2026-09-16, on the strength of an empirical run. Measured again on 2026-10-01 against the published tarball, a consumer saw 7 HIGH (adm-zip 0.5.18, sharp 0.34.5 and 0.33.5, brace-expansion 5.0.9), because the gate audits the tree rooted in this repository, where `package.json`'s `overrides` apply, and npm honors those only at the root of an install. The section now carries the measured table for all four install shapes, the consumer-side override recipe that reaches zero, the two groups that remain unfixable downstream (`sharp` via LanceDB's hard-pinned `transformers` 3.0.2, and `brace-expansion` 5.0.9 inside the pi host's `npm-shrinkwrap.json`, which survives even an explicit consumer override), and an explicit statement that a green gate says nothing about a consumer's tree. The same section's claim that both adm-zip pinning parents require `^0.6.0` is corrected: `onnxruntime-node` 1.24.3, the copy `transformers` 4.2.0 pinned, required `adm-zip ^0.5.16`.
+- **`docs/ARCHITECTURE.md`'s embedding-runtime rationale was rewritten around the new pin.** It recorded 4.3.0 as tried and rejected, and told a future maintainer that the knowledge-store suites decide a bump. They do not, since they mock the backend or use a cached model. It now records the security reason the hold was lifted, the measured before-and-after numbers for both backends, and the standing rule that a bump needs a live check (model load, CPU and WebGPU backends, store round-trip) rather than the suite.
+
 ## [1.7.3] - 2026-09-30
 
 ### Changed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lincoln504/pi-research",
-  "version": "1.7.3",
+  "version": "1.7.4",
   "description": "Web research for your agents with smart and safe tooling + knowledge store",
   "type": "module",
   "private": false,
@@ -137,7 +137,7 @@
     "@earendil-works/pi-tui": ">=0.99.0 <1"
   },
   "optionalDependencies": {
-    "@huggingface/transformers": "4.2.0",
+    "@huggingface/transformers": "4.3.0",
     "webgpu": "^0.6.0"
   },
   "overrides": {