@lincoln504/pi-research 1.7.9 → 1.7.10

package/README.md

@@ -49,7 +49,7 @@ npm install -g @lincoln504/pi-research
 pi-research skill install
 ```
 
-No extra setup is needed. The package ships ready-made bindings for every platform and declares no build step, so there is nothing to approve or compile. The stealth browser (1GB+ installed) is fetched by the `postinstall` script when npm runs install scripts, which it does by default up to npm 11.18 — that is the bundled npm on the Node 22.22.2 floor this package requires, so expect the fetch during install. Newer npm (11.19+) skips install scripts by default, and the browser is then fetched lazily on the first scrape instead. Either way the first scrape takes a few minutes until it is in place. Set `PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1` to defer the fetch deliberately. Only Windows with npm older than 11.19 can fail when the install tries to compile from source. Upgrading npm fixes it.
+No extra setup is needed. The package ships ready-made bindings for every platform and declares no build step, so there is nothing to approve or compile. The stealth browser (1GB+ installed) is fetched by the `postinstall` script whenever npm runs dependency install scripts — which is npm 10 through 11.19 (11.16–11.19 print a warning) — and that includes the npm bundled with the Node 22.22.2 floor this package requires (10.9.7) and the npm bundled with Node 24/25 (11.19.0), so expect the fetch during install. npm 12, the current npm, blocks dependency install scripts by default, and the browser is then fetched lazily on the first scrape instead. Either way the first scrape takes a few minutes until it is in place. Set `PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1` to defer the fetch deliberately.
 
 The `@earendil-works/pi-*` host packages are **peer dependencies**. pi supplies its own copies when it loads this as an extension, and npm ≥7 installs them automatically for a standalone (global or project) install. An install that skips peers does not get them: `npm install --legacy-peer-deps`, yarn classic, and `pi install` itself (it passes that flag on purpose) are all in that group. The standalone engine and the agent-skill launcher then stop with a message naming the missing package; add it with:
 
@@ -61,6 +61,10 @@ Standalone use needs that package on disk because the CLI and SDK import it dire
 
 In pi, the extension works out of the box on the session's model and pi's configuration. Standalone use ([agent skill](docs/AGENT-SKILL.md) or [SDK](docs/SDK.md)) needs a model configured. See [Configuration](docs/CONFIGURATION.md).
 
+### Update
+
+`pi update --extensions` moves every installed extension to its newest published version; `pi update npm:@lincoln504/pi-research` targets only this one. A versioned source (`npm:@lincoln504/pi-research@1.7.9`) is pinned and never updates — remove and reinstall it to move versions.
+
 ### Uninstall
 
 `pi remove npm:@lincoln504/pi-research` removes the extension. `npm uninstall -g @lincoln504/pi-research` removes the standalone engine. npm 7+ no longer runs `preuninstall`, so nothing else is removed on its own: skill links into other agents (Claude Code, Codex, …), the state directory (`~/.pi/research/state`), and the cache (`~/.cache/pi-research`, including any downloaded embedding models) stay in place. Remove the skill links first with `pi-research skill uninstall` (or `/research-config` → Remove from External Agents), then remove the rest with `pi-research cleanup`: The shared stealth-browser cache (`~/.cache/camoufox`) is preserved unless `PI_RESEARCH_PURGE_BROWSERS=1`. See [AGENT-SKILL.md](docs/AGENT-SKILL.md#installation-flow) for the full picture.

package/agent-skill/pi-research/SKILL.md

@@ -2,7 +2,7 @@
 name: pi-research
 description: "Multi-agent web research for any coding agent. Use for anything requiring current information from the internet — news, trends, product/service/company facts, statistics, people, places, events, APIs, library behavior, or 'what is X / how does X work' questions. Also use to search a local knowledge store of previously researched findings before doing live research. Powered by the pi-research engine (search, stealth scraping, security databases, Stack Exchange). Not for reading local files, running project commands, or analyzing this repository's own source."
 license: MIT
-metadata: { "author": "Lincoln Deen", "version": "1.7.9", "package": "@lincoln504/pi-research", "engine": "pi-research-sdk", "openclaw": { "requires": { "bins": ["node"] } } }
+metadata: { "author": "Lincoln Deen", "version": "1.7.10", "package": "@lincoln504/pi-research", "engine": "pi-research-sdk", "openclaw": { "requires": { "bins": ["node"] } } }
 allowed-tools: Bash(node:*)
 ---
 

package/dist/cli.mjs

@@ -16625,7 +16625,7 @@ init_logger();
 import { spawn as spawn2 } from "node:child_process";
 import { createRequire as createRequire6 } from "node:module";
 import { createHash as createHash2 } from "node:crypto";
-import { existsSync as existsSync8, fstatSync, openSync as openSync4, closeSync as closeSync4, rmSync as rmSync2, readFileSync as readFileSync5 } from "node:fs";
+import { existsSync as existsSync8, fstatSync, openSync as openSync4, closeSync as closeSync4, rmSync as rmSync2, readFileSync as readFileSync5, createWriteStream } from "node:fs";
 import { join as join12, dirname as dirname9 } from "node:path";
 import { tmpdir as tmpdir2, platform as platform3, homedir as homedir5 } from "node:os";
 var FETCH_TIMEOUT_MS = 45 * 60 * 1e3;
@@ -16671,18 +16671,36 @@ function runFetch() {
     delete env["CAMOUFOX_INSTALL_DIR"];
     delete env["PLAYWRIGHT_BROWSERS_PATH"];
     logger.info(`[ensure-browser] Camoufox not found; fetching the browser (this runs once, ~1.3GB): ${process.execPath} ${cli} fetch`);
-    const child = spawn2(process.execPath, [cli, "fetch"], { stdio: "inherit", env });
+    const outLogPath = join12(tmpdir2(), `pi-research-camoufox-fetch-${process.pid}-${Date.now()}.log`);
+    const outStream = createWriteStream(outLogPath, { mode: 384 });
+    const child = spawn2(process.execPath, [cli, "fetch"], { stdio: ["ignore", "pipe", "inherit"], env });
+    if (child.stdout) {
+      child.stdout.pipe(outStream);
+    }
     const timer = setTimeout(() => {
       child.kill("SIGKILL");
       reject(new Error(`camoufox fetch timed out after ${FETCH_TIMEOUT_MS}ms`));
     }, FETCH_TIMEOUT_MS);
-    child.on("error", (err) => {
+    const finish = (err, ok) => {
       clearTimeout(timer);
-      reject(err);
+      void outStream.close();
+      if (err) reject(err);
+      else resolve9(ok);
+    };
+    child.on("error", (err) => {
+      const message = err instanceof Error ? err.message : String(err);
+      finish(new Error(`${message} (fetch output logged at ${outLogPath})`), false);
     });
     child.on("exit", (code) => {
-      clearTimeout(timer);
-      resolve9(code === 0);
+      if (code === 0) {
+        try {
+          rmSync2(outLogPath, { force: true });
+        } catch {
+        }
+        finish(null, true);
+      } else {
+        finish(new Error(`camoufox fetch exited with code ${code} (fetch output logged at ${outLogPath})`), false);
+      }
     });
   });
 }

package/docs/AGENT-SKILL.md

@@ -21,10 +21,12 @@ npm install -g @lincoln504/pi-research   # the engine (puts `pi-research` on PAT
 pi-research skill install                # link the skill into every detected agent
 ```
 
-On npm ≥11.19 (and npm 12) dependency install scripts are skipped by default — and
+npm 12, the current npm, blocks dependency install scripts by default — and
 none are needed: the only native piece on the launch path is `impit`, which ships
 prebuilt binaries, and the stealth browser self-provisions on its first use (the first
-scrape takes a few minutes). No approval is required (see the [README](../README.md#install)).
+scrape takes a few minutes). On npm 10 through 11.19 the `postinstall` fetch runs
+during install instead; that is the npm bundled with Node 24/25 (11.19.0) and with
+the Node 22.22.2 floor (10.9.7). No approval is required (see the [README](../README.md#install)).
 
 The global install also brings the `@earendil-works/pi-*` host packages in as peer
 dependencies (npm ≥7 resolves them). If your install skips peers

package/docs/ARCHITECTURE.md

@@ -387,7 +387,7 @@ warns on every startup when a host-provided package (`typebox`, `@sinclair/typeb
 loader and create a second live module instance (`resource-loader.js`,
 `collectExtensionPackageWarnings`; pi `docs/packages.md`). Under pi the host's own copy is used,
 so the two agree on `Value.Check`/`Convert` by construction. `@earendil-works/pi-ai` and
-`@earendil-works/pi-coding-agent` 1.0.0 through 1.0.3 all pin `1.3.27` (re-checked 2026-10-05 in
+`@earendil-works/pi-coding-agent` 1.0.0 through 1.1.0 all pin `1.3.27` (re-checked 2026-10-08 in
 the installed packages' `package.json`), which is why the devDependency, and so every test run and
 the type-check, stays on exactly that version: bump it in lockstep with the pi host, not
 independently. A standalone CLI/SDK install resolves the peer automatically on npm >= 7; the

package/docs/CHANGELOG.md

@@ -5,6 +5,26 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.7.10] - 2026-10-08
+
+### Changed
+
+- **The pi host dev dependencies move 1.0.4 → 1.1.0** (`@earendil-works/pi-ai`, `pi-coding-agent`, `pi-tui`; the peer range stays `>=0.99.0 <2`). The 1.0.4 → 1.1.0 diff is additive for this package (declaration diff of the installed packages, 2026-10-08): `pi-coding-agent` adds `durationMs` on the tool render context and `tool_execution_end`, `aborted` on `agent_settled` events, and the `+name`/`-name` tool modifiers; `pi-ai` adds the Decisions-API classifier surface and an optional `AuthProvider.agentName`; `pi-tui` adds the OSC 7501 program-status helpers and `Text.setPaddingX`. `docs/extensions.md` is unchanged and nothing was removed or re-signed, so the 0.99.0 floor is unchanged too. `PI_TESTED_MAX_VERSION` moves to 1.1.0 (`src/core/pi-version.ts`), so a pi 1.1.x host runs without the "newer than the tested ceiling" notice; `npm audit` stays at 0 and type-check (TypeScript 6 and 7), lint and the full unit suite (3305) pass against 1.1.0.
+- **The npm install-script boundary is corrected across every user-facing surface and CI comment.** npm 10 through 11.19 run dependency install scripts (11.16–11.19 print a warning); npm 12, the current npm, blocks them by default — the npm bundled with Node 24/25 is 11.19.0, which still runs them, so a stock Node install fetches the browser during install. The old "11.19+ skips install scripts" wording in `README.md`, `docs/AGENT-SKILL.md`, `docs/SDK.md`, the ES/JA/ZH docs and the `ci.yml` comments was wrong — verified against the npm 11.19.0 source (arborist skips a script only when it is explicitly denied; `strict-allow-scripts` is opt-in) and consistent with this repo's own earlier measurement that 11.16–11.19 "warn but still run". The stale "compile from source on Windows" / `better-sqlite3` 13 references that survived the 1.7.9 launcher swap are gone with it.
+- **Update guidance is documented** (README and `docs/PI-EXTENSION.md`): `pi update --extensions` moves every installed extension to its newest published version, `pi update npm:@lincoln504/pi-research` targets only this one, and a versioned source (`npm:@lincoln504/pi-research@1.7.9`) is pinned and never updates — remove and reinstall it to move versions.
+- **`setup.cjs` announces the ~1.3 GB fetch before it starts**, so the postinstall fetch that runs inside `pi install` / `pi update --extensions` on script-running npm (10–11.19) no longer looks like a hang.
+- In-range dev refresh: `vite` 8.3.2 → 8.3.4.
+
+### Fixed
+
+- **The in-host lazy browser fetch no longer writes raw to the terminal.** `ensureBrowserInstalled()` spawned its `camoufox fetch` child with `stdio: 'inherit'`; a child with an inherited fd 1 bypasses pi's JS-level stdout redirection (pi's `takeOverStdout` rewrites `process.stdout.write` for the TUI) and interleaves the download's progress with the host's output stream — in print/JSON/RPC modes stdout is the protocol itself, so raw child output could corrupt it. The child's stdout is now captured in a temp file (its path is logged on failure, the file is removed on success) and stderr stays inherited, so real errors remain visible. Pinned by a test asserting `stdio: ['ignore', 'pipe', 'inherit']` on the fetch child.
+
+### Also shipped since 1.7.9
+
+- **`source-map-js` 1.2.2** in the production tree clears GHSA-68fv-2mgg-jv7q from the audit gate (`npm audit`: 0).
+- **The unit suite stops leaking throwaway tmpdirs.**
+- **`docs/AUDIT-GATE.md` records** that a shipped host `npm-shrinkwrap.json` does not propagate a consumer-side `sharp` override (consumer advisory note).
+
 ## [1.7.9] - 2026-10-05
 
 ### Changed

package/docs/PI-EXTENSION.md

@@ -83,6 +83,10 @@ coding agents detected on this machine so they can run web research through the
 CLI, and remove it again — with exact, manifest-tracked cleanup. See
 [AGENT-SKILL.md](AGENT-SKILL.md) for the full installation flow.
 
+### Update
+
+`pi update --extensions` moves every installed extension to its newest published version; `pi update npm:@lincoln504/pi-research` targets only this one. A versioned source (`npm:@lincoln504/pi-research@1.7.9`) is pinned and never updates — remove and reinstall it to move versions.
+
 ### Lifecycle
 
 - `activate` — registers commands, tools, the TUI controller, and initializes services.

package/docs/SDK.md

@@ -21,9 +21,11 @@ classic — the SDK cannot import them, so add the one it loads directly:
 npm install @earendil-works/pi-coding-agent
 ```
 
-On npm ≥11.19 (and npm 12), dependency install scripts are skipped by default. Nothing
+npm 12, the current npm, blocks dependency install scripts by default. Nothing
 here needs them: the only native piece on the launch path is `impit`, which ships
-prebuilt binaries, and the stealth browser self-provisions on its first use. (The
+prebuilt binaries, and the stealth browser self-provisions on its first use. On npm 10
+through 11.19 the `postinstall` fetch runs during install instead; that is the npm
+bundled with Node 24/25 (11.19.0) and with the Node 22.22.2 floor (10.9.7). (The
 `npm approve-scripts better-sqlite3` + `npm rebuild` pair documented by earlier
 releases repaired the old `camoufox-js` launcher, whose `better-sqlite3` binding came
 from an install script — the 2026-10-05 move to `@camoufox/camoufox` removed that

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lincoln504/pi-research",
-  "version": "1.7.9",
+  "version": "1.7.10",
   "description": "Web research for your agents with smart and safe tooling + knowledge store",
   "type": "module",
   "private": false,

package/scripts/setup.cjs

@@ -135,6 +135,7 @@ if (process.env.PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD === '1') {
       return true;
     };
 
+    console.log('pi-research: downloading the ~1.3 GB Camoufox browser — this can take several minutes on a slow link…');
     const pkgRoot = layout.findPackageRoot(projectRoot);
     const result = layout.provisionBrowser(cachePath, runFetch, (m) => console.log(m), pkgRoot ? layout.loadPin(pkgRoot) : null);
     if (result.status === 'failed') {

package/src/core/pi-version.ts

@@ -122,8 +122,16 @@ export const PI_MIN_VERSION: SemverParts = { major: 0, minor: 99, patch: 0 };
  * modes), the `builtin:<name>` naming for built-in extensions and tools, and
  * `--no-extensions` now also disabling the built-in extensions. None of them
  * change what this package does.
+ *
+ * 1.1.0 (2026-10-07) is additive for this package. Diffed against 1.0.4 on 2026-10-08:
+ * `@earendil-works/pi-coding-agent` adds `durationMs` on the tool render context and
+ * `tool_execution_end`, `aborted` on `agent_settled` events, and the `+name`/`-name`
+ * tool modifiers; `@earendil-works/pi-ai` adds the Decisions-API classifier surface
+ * and an optional `AuthProvider.agentName`; `@earendil-works/pi-tui` adds the OSC 7501
+ * program-status helpers and `Text.setPaddingX`. `docs/extensions.md` is unchanged,
+ * and nothing was removed or re-signed, so the 0.99.0 floor is unchanged too.
  */
-export const PI_TESTED_MAX_VERSION: SemverParts = { major: 1, minor: 0, patch: 0 };
+export const PI_TESTED_MAX_VERSION: SemverParts = { major: 1, minor: 1, patch: 0 };
 
 export type PiCompatibilityLevel = 'ok' | 'unparseable' | 'too-old' | 'untested';
 

package/src/infrastructure/browser/ensure-browser.ts

@@ -21,7 +21,7 @@
 import { spawn } from 'node:child_process';
 import { createRequire } from 'node:module';
 import { createHash } from 'node:crypto';
-import { existsSync, fstatSync, openSync, closeSync, rmSync, readFileSync } from 'node:fs';
+import { existsSync, fstatSync, openSync, closeSync, rmSync, readFileSync, createWriteStream } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { tmpdir, platform, homedir } from 'node:os';
 import { logger } from '../../logger.ts';
@@ -89,6 +89,14 @@ const delay = (ms: number): Promise<void> => new Promise((r) => setTimeout(r, ms
  * spawn error / timeout. Runs the CLI's JS entry with process.execPath and an argv array:
  * no shell, so neither a spaced Windows path nor a metacharacter in an install directory
  * can be reinterpreted.
+ *
+ * The child's stdout is captured in a temp file, not inherited: a child with an
+ * inherited fd 1 writes raw to the terminal, which inside a pi session bypasses the
+ * host's JS-level stdout redirection (pi redirects `process.stdout.write` for its TUI)
+ * and interleaves the download's progress with the host's output stream — in
+ * print/JSON/RPC modes stdout is the protocol itself, so raw child output corrupts it.
+ * The launcher's progress is noise either way; its errors go to stderr, which stays
+ * inherited and is therefore still visible.
  */
 function runFetch(): Promise<boolean> {
   return new Promise<boolean>((resolve, reject) => {
@@ -106,19 +114,35 @@ function runFetch(): Promise<boolean> {
     delete env['PLAYWRIGHT_BROWSERS_PATH'];
     logger.info(`[ensure-browser] Camoufox not found; fetching the browser (this runs once, ~1.3GB): ${process.execPath} ${cli} fetch`);
 
-    const child = spawn(process.execPath, [cli, 'fetch'], { stdio: 'inherit', env });
+    const outLogPath = join(tmpdir(), `pi-research-camoufox-fetch-${process.pid}-${Date.now()}.log`);
+    const outStream = createWriteStream(outLogPath, { mode: 0o600 });
+    const child = spawn(process.execPath, [cli, 'fetch'], { stdio: ['ignore', 'pipe', 'inherit'], env });
+    if (child.stdout) {
+      child.stdout.pipe(outStream);
+    }
     const timer = setTimeout(() => {
       child.kill('SIGKILL');
       reject(new Error(`camoufox fetch timed out after ${FETCH_TIMEOUT_MS}ms`));
     }, FETCH_TIMEOUT_MS);
 
-    child.on('error', (err) => {
+    const finish = (err: Error | null, ok: boolean): void => {
       clearTimeout(timer);
-      reject(err);
+      void outStream.close();
+      if (err) reject(err);
+      else resolve(ok);
+    };
+
+    child.on('error', (err) => {
+      const message = err instanceof Error ? err.message : String(err);
+      finish(new Error(`${message} (fetch output logged at ${outLogPath})`), false);
     });
     child.on('exit', (code) => {
-      clearTimeout(timer);
-      resolve(code === 0);
+      if (code === 0) {
+        try { rmSync(outLogPath, { force: true }); } catch { /* best-effort */ }
+        finish(null, true);
+      } else {
+        finish(new Error(`camoufox fetch exited with code ${code} (fetch output logged at ${outLogPath})`), false);
+      }
     });
   });
 }