mercury-agent 0.9.1 → 0.11.0

package/README.md

@@ -422,6 +422,8 @@ Supported OAuth providers: Anthropic, GitHub Copilot, Google Gemini CLI, Antigra
 | `MERCURY_TRIGGER_MATCH` | `mention` | `mention`, `prefix`, `always` |
 | `MERCURY_TRIGGER_PATTERNS` | `@Mercury,Mercury` | Trigger patterns |
 | `MERCURY_ADMINS` | — | Pre-seeded admin user IDs |
+| `MERCURY_AMBIENT_TTL_DAYS` | `14` | Days before overheard (ambient) group messages are aged out |
+| `MERCURY_AMBIENT_CONTEXT_ROWS` | `30` | Max ambient rows injected into a single prompt |
 
 ### DM Auto-Space
 

package/docs/configuration.md

@@ -39,6 +39,15 @@ context:
 
 Per-space overrides via `mrctl config set context.<key> <value>` always win over YAML defaults; YAML re-reads on restart do not overwrite an existing space row.
 
+## Ambient group context
+
+In linked group chats, messages that don't trigger the bot are stored as **ambient context** (author-attributed) so it can answer questions about conversation it overheard. Every message in a linked group becomes a row, bounded on both ends:
+
+- **`MERCURY_AMBIENT_TTL_DAYS`** (default `14`) — days before ambient rows are aged out by the storage cleanup. Real user/assistant turns are never touched.
+- **`MERCURY_AMBIENT_CONTEXT_ROWS`** (default `30`) — max ambient rows injected into a single prompt. Ambient has its own budget, so overheard chatter can't crowd real turns out of the context window.
+
+Per-space: `mrctl config set ambient.enabled false` disables capture entirely (tag-only mode).
+
 You may also set a top-level **`model_chain`** array as an alias for `model.chain`.
 
 ## Container env passthrough (`agent.env_passthrough`)
@@ -86,6 +95,104 @@ In YAML, use a list of `{ provider, model }` objects under `model.chain` (max 4
 
 Optional **`model.capabilities`** may be a mapping; it is applied like `MERCURY_MODEL_CAPABILITIES` JSON.
 
+### Custom endpoints (`models.json`)
+
+A model leg is `{ provider, model }` and carries no host, so it cannot on its own
+reach an endpoint pi does not already know about — a metering gateway, a local
+model server (Ollama, LM Studio, vLLM), or a private/regional deployment.
+
+pi solves this with its own config file, and Mercury mounts it. Drop a
+`models.json` into the **global dir** (`<dataDir>/global/`, alongside
+`AGENTS.md`); it is bind-mounted read-only at `PI_CODING_AGENT_DIR` and pi reads
+it natively. No Mercury config key is involved, and the model-chain schema is
+unchanged.
+
+**Repoint an existing provider** — keeps pi's model metadata, costs and
+capabilities, and every `provider: openai` leg goes to the new host:
+
+```json
+{ "providers": { "openai": { "baseUrl": "https://gateway.example.com/v1" } } }
+```
+
+**Define custom models** — here pi requires `baseUrl`, and `api` is effectively
+mandatory too: pi silently skips any model whose wire format it cannot resolve,
+so omitting it makes the model vanish without an error.
+
+```json
+{
+  "providers": {
+    "mygateway": {
+      "baseUrl": "https://gateway.example.com/v1",
+      "api": "openai-completions",
+      "apiKey": "$MYGATEWAY_API_KEY",
+      "models": [{ "id": "openai/gpt-4o-mini", "contextWindow": 128000 }]
+    }
+  }
+}
+```
+
+### Credentials in `models.json`
+
+Which credential path applies depends on which shape you used:
+
+- **Repointing a built-in provider** (`openai`, `anthropic`, …) changes nothing:
+  the key keeps travelling as `MERCURY_<PROVIDER>_API_KEY`, exactly as before.
+- **A provider that exists only in `models.json`** is unknown to pi's env-var
+  map, so no `*_API_KEY` variable is read for it. Its key must come from the
+  provider entry — written as a **reference**, never a literal:
+  `"apiKey": "$MYGATEWAY_API_KEY"` (`${VAR}` and `!some-command` also work).
+  Pass the secret itself as `MERCURY_MYGATEWAY_API_KEY` and it reaches the
+  container through the usual passthrough. This assumes the default
+  `agent.env_passthrough: all`; under `claimed`, only the provider variables
+  Mercury knows about are forwarded, and a custom provider's key is not among
+  them, so pi fails to resolve it.
+
+> ⚠️ **Never store a credential literally.** Mercury refuses to mount a
+> `models.json` that has a literal value in `apiKey`, in a credential-shaped
+> field or header (`Authorization`, `x-api-key`, anything containing
+> key/token/secret/auth/cookie/credential/passw), or as userinfo or a
+> credential-shaped query parameter in a `baseUrl` — provider-level and
+> per-model alike — and logs an error naming the fields. Every other entry
+> mounted into the agent container is a resource kind that cannot hold a secret
+> (`auth.json` is excluded precisely so the OAuth refresh token never reaches
+> the least-trusted part of the system), and `models.json` is held to the same
+> rule.
+>
+> **References are fine**, and so is a value that merely *contains* one:
+> `"Bearer $GW_KEY"` is the ordinary spelling of a bearer header, because pi
+> interpolates rather than matching whole values. What is left over once the
+> references are removed still has to look like configuration — stapling an
+> unused `$VAR` onto a pasted key does not buy passage.
+>
+> This is a guardrail against accident, not a control against a hostile writer:
+> the bind source is live, so anyone able to write the global dir could change
+> the file after the check. Anyone who can do that can already do worse.
+>
+> A file that cannot be read or parsed is refused for the same reason — its
+> contents are unverifiable. The check parses exactly what pi parses: `//` line
+> comments and trailing commas are fine, **`/* … */` block comments are not** —
+> pi cannot read those either, so a file containing one is refused rather than
+> mounted and then silently ignored by pi.
+>
+> **What refusal costs depends on the shape.** A repointed built-in provider
+> falls back to its default endpoint, so traffic quietly leaves your gateway; a
+> provider defined only in `models.json` stops resolving altogether. Either way,
+> grep the logs for `Ignoring models.json`.
+
+**Capabilities for a custom provider.** Capability detection is host-side and
+registry-based, so a provider that exists only in `models.json` is invisible to
+it and the leg resolves to `DEFAULT_CAPABILITIES` (`tools: true`, everything
+else false). This degrades gracefully: tool use — the one that matters — stays
+on, and a `false` from an unresolved model is treated as *unknown* rather than
+*unsupported*, so capability-gated extensions and skills still install. To state
+capabilities explicitly, add the model to `<dataDir>/model-capabilities.yaml`,
+which is consulted before the registry.
+
+The **override-only** shape mostly avoids the question, since the provider stays
+a known one — but only for model ids that are themselves in pi's registry.
+Repointing `openai`'s `baseUrl` and then naming a model pi has never heard of
+lands back in `default`.
+
 ### Removed: `provider: cursor`
 
 The **Cursor Agent CLI** integration has been removed. All model legs use **pi** with standard providers (`anthropic`, `openai`, `google`, `mistral`, `groq`, `openrouter`, etc.).

package/docs/dashboard.md

@@ -29,7 +29,7 @@ Lists all memory spaces with platform badges, conversation count, message count,
 | **Conversations** | View linked conversations, unlink them |
 | **Roles** | Promote members to admin, demote admins |
 | **Mutes** | Mute/unmute users with optional duration and reason |
-| **Triggers & Ambient** | Set `trigger.match` (mention/prefix/always), patterns, case sensitivity, media-in-groups, and ambient mode |
+| **Triggers & Ambient** | Set `trigger.match` (mention/prefix/always), patterns, case sensitivity, media-in-groups, `trigger.mention_always` (verified @-mentions trigger regardless of patterns), and ambient mode |
 | **Context** | Choose context mode (clear/context), window size, reply-chain depth |
 | **Rate limits** | Set burst-per-minute and daily caps for members and admins |
 | **Voice** | Configure per-space STT (transcription preset or custom model) and TTS (on-demand vs auto) |

package/docs/pipeline.md

@@ -20,7 +20,8 @@ Platform (WhatsApp / Discord / Telegram / Slack)
   ├─► Unified handler (src/core/handler.ts)
   │     • Parse platform thread into an external conversation ID
   │     • Resolve/create conversation in DB
-  │     • Ignore unlinked conversations
+  │     • Ignore unlinked conversations (seeded admins may `/spaces list`
+  │       and `/spaces switch <id>` to re-link; everything else is dropped)
   │     • Pre-route trigger check (cheap, sync)
   │     • Start typing indicator if matched
   │     • Call bridge.normalize(..., spaceId) → IngressMessage
@@ -29,7 +30,8 @@ Platform (WhatsApp / Discord / Telegram / Slack)
   ├─► core.handleRawInput(IngressMessage)
   │     • Route: trigger match, permissions, command detection
   │     • If triggered → queue → container run → ContainerResult
-  │     • If not triggered → store as ambient context
+  │     • If not triggered → store as ambient context (author-attributed,
+  │       aged out after `ambientTtlDays`)
   │     • If command → execute immediately (stop, compact)
   │     • If denied → return reason
   │
@@ -196,6 +198,10 @@ All platforms share the same trigger engine. A pre-route check runs before `norm
 
 DMs always match regardless of mode.
 
+**Verified @-mentions always trigger.** When a platform confirms the bot was tagged (matched on the mention's JID, not on text), the message triggers regardless of `trigger.patterns` — a space that defines its own patterns replaces the default list, which used to silently drop the auto-injected `@<botUsername>` and ignore genuine tags. Set per-space `trigger.mention_always=false` to require the trigger word even when tagged. Wired for WhatsApp; Discord's structured mention is not yet carried through.
+
+**Slash commands bypass the trigger gate.** A `/`-prefixed message naming a real command (e.g. `/spaces list`, `/stop`) executes untagged in groups. Unknown slash words (`/shrug`) still fall through to ambient.
+
 **Attachment-only in groups** (voice note, image with no caption): by default these do **not** match `mention` or `prefix` — use `trigger.match=always`, reply to the bot’s message, or set per-space `trigger.media_in_groups=true` so voice/media alone can trigger without spamming text-only noise.
 
 ### Reply-to-Bot

package/docs/scheduler.md

@@ -61,27 +61,31 @@ TaskScheduler.start()
         │
         ├─► Query DB for due tasks (active=1, next_run_at <= now)
         │
-        ├─► For each due task:
+        ├─► For each due task (skipped if a run is already in flight):
         │     │
-        │     ├─► [Cron task]
-        │     │     ├─► Compute next run time from cron expression
-        │     │     ├─► Update next_run_at in DB
-        │     │     └─► Execute handler
+        │     ├─► Execute handler
+        │     ├─► Record the outcome on the task row
         │     │
-        │     └─► [At task]
-        │           ├─► Execute handler
-        │           └─► Delete task from DB
+        │     ├─► [Failed, retries left]
+        │     │     └─► Set next_run_at to the retry time — schedule untouched
+        │     │
+        │     └─► [Succeeded, or out of retries]
+        │           ├─► Report the failure to the space (failures only)
+        │           ├─► [Cron task] Compute and store the next run time
+        │           └─► [At task]   Delete task from DB
         │
         └─► Schedule next poll
 ```
 
 Tasks are processed sequentially within a poll cycle. Each task runs as if the `createdBy` user sent the prompt.
 
+The schedule is consumed **after** the attempt, not before. A task therefore stays "due" for the whole time it is running; the in-flight guard is what stops the poll starting a second run, and it is also why a long run shows as `now` in the dashboard's Next Run column until it finishes.
+
 **At-task lifecycle:**
 1. Created with a future timestamp
 2. Waits until scheduled time
-3. Executes once
-4. Auto-deletes (regardless of success/failure)
+3. Executes once, plus any retries
+4. Auto-deletes once it succeeds or runs out of retries
 
 ## Creating Tasks
 
@@ -185,6 +189,9 @@ CREATE TABLE tasks (
   silent INTEGER NOT NULL DEFAULT 0,
   next_run_at INTEGER NOT NULL,
   created_by TEXT NOT NULL,
+  last_run_at INTEGER,                -- Epoch ms of the last completed attempt
+  last_status TEXT,                   -- 'ok' | 'error'
+  last_error TEXT,                    -- Failure message, capped at 500 chars
   created_at INTEGER NOT NULL,
   updated_at INTEGER NOT NULL
 );
@@ -197,6 +204,11 @@ CREATE INDEX idx_tasks_next ON tasks(active, next_run_at);
 | `cron` | Cron expression for recurring tasks (null for at-tasks) |
 | `at` | ISO 8601 timestamp for one-shot tasks (null for cron-tasks) |
 | `silent` | If 1, task runs but doesn't post results to chat |
+| `last_run_at` | When the last attempt finished. Null until the task has run |
+| `last_status` | `ok` or `error`. Written for every attempt, retries included |
+| `last_error` | Why the last attempt failed; null after a success |
+
+The last-run columns are shown in the dashboard's task table (**Last Run**), with the error text as the cell's tooltip. Existing rows are not backfilled — a task that has never run since the upgrade reads as `never`.
 
 ## Permissions
 
@@ -241,13 +253,29 @@ The scheduler stops cleanly on shutdown — no orphaned timers.
 ### `TaskScheduler`
 
 ```typescript
-const scheduler = new TaskScheduler(db, pollIntervalMs);
+const scheduler = new TaskScheduler(db, pollIntervalMs, {
+  retryAttempts,  // extra attempts after the first failure
+  retryDelayMs,   // how long to wait before one
+});
 
-scheduler.start(handler);    // Begin polling
-scheduler.stop();            // Stop polling
+scheduler.start(handler, onFailure);   // Begin polling
+scheduler.stop();                      // Stop polling
 scheduler.computeNextRun(cron, from);  // Get next run time for cron tasks
 ```
 
+`onFailure` is optional and is called **once per due cycle**, only after the retries are spent — never once per attempt.
+
+```typescript
+type TaskFailure = {
+  id: number;
+  spaceId: string;
+  name: string | null;
+  silent: boolean;   // the task's flag; the reporter decides whether to honour it
+  error: string;     // capped at 500 chars
+  attempts: number;  // attempts made this cycle, including the first
+};
+```
+
 ### Handler Signature
 
 ```typescript
@@ -276,13 +304,47 @@ db.setTaskActive(id, active); // Pause/resume
 db.deleteTask(id, spaceId);   // Delete task (with space check)
 db.deleteTaskById(id);        // Delete task (no space check, for scheduler)
 db.updateTaskNextRun(id, nextRunAt);  // Update next execution time
+db.recordTaskRun(id, status, error?); // Record one attempt's outcome
 ```
 
 ## Error Handling
 
-If a task handler fails:
-- Error is logged
-- Task is not retried in the same cycle
-- **Cron tasks:** `next_run_at` is already updated, so it will run again at the next scheduled time
-- **At tasks:** Still deleted after execution (one-shot behavior preserved)
-- Other tasks in the cycle continue to execute
+A task that fails is retried, then reported. Nothing about a failure is silent.
+
+When a handler throws:
+
+1. The error is logged and written to the task row (`last_status = 'error'`, `last_error`).
+2. If attempts remain, `next_run_at` is set to the retry time and the poll picks the task up again. Nothing is posted to the space — a pending retry is not news yet.
+3. Once the attempts are spent, the space is told (see below) and only **then** is the schedule consumed: a cron task advances to its next occurrence, a one-shot task is deleted.
+4. Other tasks in the cycle are unaffected.
+
+The retry time is `now + retry_delay_ms`, **clamped to the task's own next occurrence** — a 5-minute delay on an every-minute task must not swallow four scheduled runs.
+
+### The failure notice
+
+On a final failure Mercury posts one message into the task's space:
+
+> ⚠️ Scheduled task "Daily football" failed and produced nothing (attempts: 2). Reason: Container timed out for group 19
+
+`silent` is **not** honoured here. It suppresses a task's routine output, and a silent task that fails is exactly the one whose failure nobody would otherwise discover. Set `scheduling.notify_on_failure: false` to turn the notices off entirely.
+
+The message is locale-aware (`messages.locale`, `en` and `he`), like every other host-generated system message.
+
+### Configuration
+
+| YAML | Env | Default | What |
+|------|-----|---------|------|
+| `scheduling.retry_attempts` | `MERCURY_TASK_RETRY_ATTEMPTS` | `1` | Extra attempts after the first failure. `0` disables retrying |
+| `scheduling.retry_delay_ms` | `MERCURY_TASK_RETRY_DELAY_MS` | `300000` (5 min) | Wait before a retry. Minimum 60 000 — an agent run costs tokens and a container slot, so retrying a systematic failure fast is worse than not retrying |
+| `scheduling.notify_on_failure` | `MERCURY_TASK_NOTIFY_ON_FAILURE` | `true` | Post the notice above |
+
+```yaml
+scheduling:
+  retry_attempts: 1
+  retry_delay_ms: 300000
+  notify_on_failure: true
+```
+
+### Unparseable cron expressions
+
+A task whose cron cannot be parsed has no next occurrence to advance to. Rather than leave `next_run_at` in the past — which would make the poll re-run it, and spend a full agent turn, every few seconds — the scheduler **pauses the task** and logs why. Fix the expression and resume it.

package/examples/extensions/docs/index.ts

@@ -0,0 +1,28 @@
+export default function (mercury: {
+  cli(opts: { name: string; install: string }): void;
+  skill(relativePath: string): void;
+  permission(opts: { defaultRoles: string[] }): void;
+  requires(
+    capabilities: (
+      | "tools"
+      | "vision"
+      | "audio_input"
+      | "audio_output"
+      | "extended_thinking"
+    )[],
+  ): void;
+}) {
+  // NOTE: never put a backtick anywhere in this install string. It sits inside
+  // a template literal when the image builder assembles the Dockerfile, so a
+  // stray backtick terminates the literal and the whole extension stops
+  // loading — which surfaces in the dashboard as "uninstalled", not as a
+  // syntax error. Run "mercury extensions validate docs" after editing.
+  mercury.cli({
+    name: "docs",
+    install:
+      "apt-get update && apt-get install -y --no-install-recommends pandoc && python3 -m pip install --break-system-packages python-docx openpyxl odfpy && echo '#!/bin/sh' > /usr/local/bin/docs && echo 'echo \"docs extension dependencies installed. Use the docs skill from the agent.\"' >> /usr/local/bin/docs && chmod +x /usr/local/bin/docs && rm -rf /var/lib/apt/lists/*",
+  });
+  mercury.permission({ defaultRoles: ["admin", "member"] });
+  mercury.requires(["tools"]);
+  mercury.skill("./skill");
+}

package/examples/extensions/docs/skill/SKILL.md

@@ -0,0 +1,114 @@
+---
+name: docs
+description: Use this skill whenever the user asks for a document, a Word file, a .docx, a spreadsheet, an .xlsx, an ODF file, or asks you to "write up", "put together", or "send me" something they will open in Word, Google Docs, Excel, or LibreOffice. Activate when document output is requested, not when merely discussing text.
+---
+
+# Documents Skill
+
+Produce real office files — `.docx`, `.xlsx`, `.odt` — and deliver them in chat.
+
+Without this skill the honest answer to "make me a doc" is markdown in a chat
+bubble, or an `.html` attachment the user has to convert themselves. Do not do
+that any more. Produce the actual file.
+
+## Deliver by writing to `outbox/`
+
+Anything written to `outbox/` is sent to the user as an attachment when the
+turn ends. That is the whole delivery mechanism — there is nothing to call.
+
+```python
+from docx import Document
+
+doc = Document()
+doc.add_heading("Trip plan", level=1)
+doc.add_paragraph("Flights land Thursday morning.")
+doc.save("outbox/trip-plan.docx")
+```
+
+Use a filename the user would recognise. `outbox/trip-plan.docx` beats
+`outbox/output.docx`.
+
+## Pick the right tool
+
+| Ask | Use |
+|---|---|
+| A document, letter, report, notes | `python-docx` → `.docx` |
+| Existing markdown you already wrote | `pandoc` → `.docx` |
+| A table of numbers, a budget, a list to sort | `openpyxl` → `.xlsx` |
+| LibreOffice/OpenOffice specifically | `odfpy` → `.odt` |
+
+`.docx` is the default. It opens in Word, Google Docs, LibreOffice, and the
+WhatsApp document viewer.
+
+### Markdown you already have → .docx
+
+Fastest path when you have composed the content as markdown already:
+
+```bash
+pandoc notes.md -o outbox/notes.docx
+```
+
+Pandoc handles headings, lists, tables, bold/italic, and links. Reach for
+`python-docx` instead when you need control it does not give you.
+
+### Structured document
+
+```python
+from docx import Document
+from docx.shared import Pt
+
+doc = Document()
+doc.add_heading("Quarterly summary", level=1)
+doc.add_paragraph("Prepared for the team.")
+
+doc.add_heading("Numbers", level=2)
+table = doc.add_table(rows=1, cols=2)
+table.style = "Light Grid Accent 1"
+head = table.rows[0].cells
+head[0].text, head[1].text = "Item", "Amount"
+for item, amount in [("Flights", "1,200"), ("Hotel", "900")]:
+    row = table.add_row().cells
+    row[0].text, row[1].text = item, amount
+
+doc.save("outbox/quarterly-summary.docx")
+```
+
+### Spreadsheet
+
+```python
+from openpyxl import Workbook
+
+wb = Workbook()
+ws = wb.active
+ws.title = "Budget"
+ws.append(["Item", "Amount"])
+for row in [("Flights", 1200), ("Hotel", 900)]:
+    ws.append(row)
+wb.save("outbox/budget.xlsx")
+```
+
+## Right-to-left text
+
+Hebrew and Arabic need the paragraph marked RTL, or Word renders the alignment
+wrong even though the characters are correct:
+
+```python
+from docx import Document
+from docx.enum.text import WD_ALIGN_PARAGRAPH
+
+doc = Document()
+p = doc.add_paragraph("שלום, זה מסמך לדוגמה")
+p.alignment = WD_ALIGN_PARAGRAPH.RIGHT
+doc.save("outbox/hebrew.docx")
+```
+
+## Rules
+
+1. **Never claim you produced a file you did not write.** Save it to `outbox/`,
+   confirm the file exists, and only then say you have sent it.
+2. **Do not hand over markdown or HTML as a substitute** for a requested
+   document and ask the user to convert it. Produce the real format.
+3. **Do not promise a Google Docs link.** You produce files, not Drive
+   documents. A `.docx` opens in Google Docs, so offer that instead.
+4. Keep documents short unless asked otherwise — these are usually read on a
+   phone.

package/examples/extensions/pinchtab/index.ts

@@ -8,7 +8,7 @@ export default function (mercury: {
   mercury.cli({
     name: "pinchtab",
     install:
-      'npm install -g pinchtab@0.13.2 playwright && npx playwright install --with-deps chromium && CHROMIUM=$(NODE_PATH="$(npm root -g)" node -e "try{process.stdout.write(require(\'playwright\').chromium.executablePath())}catch(e){}" 2>/dev/null) && { test -x "$CHROMIUM" || CHROMIUM=$(find /home/mercury/.cache/ms-playwright -type f -path \'*/chrome-linux/chrome\' ! -path \'*headless_shell*\' 2>/dev/null | head -1); } && test -n "$CHROMIUM" && test -x "$CHROMIUM" && ln -sf "$CHROMIUM" /usr/local/bin/chromium && ln -sf "$CHROMIUM" /usr/bin/chromium && rm -rf /var/lib/apt/lists/*',
+      'npm install -g pinchtab@0.13.2 playwright && npx playwright install --with-deps chromium && CHROMIUM=$(NODE_PATH="$(npm root -g)" node -e "try{process.stdout.write(require(\'playwright\').chromium.executablePath())}catch(e){}" 2>/dev/null) && { test -x "$CHROMIUM" || CHROMIUM=$(find /home/mercury/.cache/ms-playwright -type f -path \'*/chrome-linux/chrome\' ! -path \'*headless_shell*\' 2>/dev/null | head -1); } && test -n "$CHROMIUM" && test -x "$CHROMIUM" && ln -sf "$CHROMIUM" /usr/local/bin/chromium && ln -sf "$CHROMIUM" /usr/bin/chromium && HOME=/home/mercury pinchtab config set security.allowedDomains "*" && chown -R mercury:mercury /home/mercury/.pinchtab && rm -rf /var/lib/apt/lists/*',
   });
   mercury.permission({ defaultRoles: ["admin", "member"] });
   mercury.skill("./skill");
@@ -23,6 +23,10 @@ export default function (mercury: {
   local log="\${PINCHTAB_LOG:-/tmp/pinchtab.log}"
   local max_wait="\${1:-120}"
   mkdir -p "$(dirname "$log")" 2>/dev/null || true
+  # Belt and braces alongside the container-level "--ulimit core=0": Chromium
+  # helper processes segfault under the sandbox and each dump is ~300 MB landing
+  # in the agent workspace. Navigation succeeds regardless.
+  ulimit -c 0 2>/dev/null || true
   : >"$log"
   if [ ! -x "\${CHROME_BINARY:-}" ]; then
     for _c in /usr/local/bin/chromium /usr/bin/chromium; do
@@ -33,12 +37,31 @@ export default function (mercury: {
     echo "No executable Chromium (CHROME_BINARY=\${CHROME_BINARY:-}; tried /usr/local/bin/chromium, /usr/bin/chromium). Rebuild mercury-agent-ext (restart Mercury)." | tee -a "$log"
     return 1
   fi
-  _pinchtab_port_open() { (echo >/dev/tcp/$bind/$port) 2>/dev/null; }
+  # /dev/tcp is a bash builtin that dash does not implement. pi currently runs
+  # the agent shell as bash, so this is portability insurance rather than a live
+  # fix: under dash the redirect always fails and the caller would burn the full
+  # max_wait against an already-READY daemon. Any HTTP response, 404 included,
+  # proves the port is listening.
+  _pinchtab_port_open() {
+    if command -v curl >/dev/null 2>&1; then
+      curl -s -o /dev/null --max-time 2 "http://$bind:$port/" >/dev/null 2>&1
+      return $?
+    fi
+    (echo >/dev/tcp/$bind/$port) 2>/dev/null
+  }
   if command -v pinchtab >/dev/null 2>&1 && _pinchtab_port_open; then
     return 0
   fi
   pkill -f '[p]inchtab' 2>/dev/null || true
-  nohup pinchtab >>"$log" 2>&1 &
+  # pinchtab >=0.13 ships IDPI enforcing with a loopback-only website
+  # whitelist, so every public URL is refused with 403 idpi_domain_blocked --
+  # including the Brave search this skill tells the agent to run. Widen the
+  # allowlist but keep IDPI strict mode and the content guard ON, so fetched
+  # pages still arrive wrapped in untrusted_web_content tags. Do NOT use
+  # "pinchtab security down" -- that turns the prompt-injection guard off too.
+  # NOTE: no backticks in this comment. It is inside a TS template literal.
+  pinchtab config set security.allowedDomains "*" >/dev/null 2>&1 || true
+  nohup pinchtab server >>"$log" 2>&1 &
   local pid=$!
   sleep 2
   if ! kill -0 "$pid" 2>/dev/null; then

package/examples/extensions/pinchtab/skill/SKILL.md

@@ -17,7 +17,7 @@ The 30-second pattern for browser tasks:
 
 ```bash
 # 1. Start Pinchtab (runs forever, local on :9867)
-pinchtab &
+pinchtab server &
 
 # 2. In your agent, follow this loop:
 #    a) Navigate to a URL
@@ -31,7 +31,7 @@ pinchtab &
 
 ## Mercury / Docker (required)
 
-In the Mercury agent container, `pinchtab &` plus a short `sleep` often races the HTTP bridge: the CLI then hits `127.0.0.1:9867` before the daemon listens (`connection refused`). The host injects `CHROME_BINARY` and `CHROME_FLAGS` (`--no-sandbox` as root). **Always** wait until the port is open and capture daemon logs.
+In the Mercury agent container, `pinchtab server &` plus a short `sleep` often races the HTTP bridge: the CLI then hits `127.0.0.1:9867` before the daemon listens (`connection refused`). The host injects `CHROME_BINARY` and `CHROME_FLAGS` (`--no-sandbox` as root). **Always** wait until the port is open and capture daemon logs.
 
 ```bash
 pinchtab_ensure() {
@@ -40,6 +40,9 @@ pinchtab_ensure() {
   local log="${PINCHTAB_LOG:-/tmp/pinchtab.log}"
   local max_wait="${1:-120}"
   mkdir -p "$(dirname "$log")" 2>/dev/null || true
+  # Chromium helper processes segfault under the container sandbox; each dump is
+  # ~300 MB landing in the agent workspace. Navigation succeeds regardless.
+  ulimit -c 0 2>/dev/null || true
   : >"$log"
   if [ ! -x "${CHROME_BINARY:-}" ]; then
     for _c in /usr/local/bin/chromium /usr/bin/chromium; do
@@ -50,12 +53,21 @@ pinchtab_ensure() {
     echo "No executable Chromium (CHROME_BINARY=${CHROME_BINARY:-}; tried /usr/local/bin/chromium, /usr/bin/chromium). Rebuild mercury-agent-ext (restart Mercury)." | tee -a "$log"
     return 1
   fi
-  _pinchtab_port_open() { (echo >/dev/tcp/$bind/$port) 2>/dev/null; }
+  # /dev/tcp is bash-only. pi runs the agent shell as bash today, so this is
+  # portability insurance. Any HTTP response (404 included) proves the port is
+  # listening.
+  _pinchtab_port_open() {
+    if command -v curl >/dev/null 2>&1; then
+      curl -s -o /dev/null --max-time 2 "http://$bind:$port/" >/dev/null 2>&1
+      return $?
+    fi
+    (echo >/dev/tcp/$bind/$port) 2>/dev/null
+  }
   if command -v pinchtab >/dev/null 2>&1 && _pinchtab_port_open; then
     return 0
   fi
   pkill -f '[p]inchtab' 2>/dev/null || true
-  nohup pinchtab >>"$log" 2>&1 &
+  nohup pinchtab server >>"$log" 2>&1 &
   local pid=$!
   sleep 2
   if ! kill -0 "$pid" 2>/dev/null; then
@@ -100,7 +112,7 @@ If `pinchtab_ensure` fails, show the user the tail of `/tmp/pinchtab.log`; do no
 BRIDGE_BIND=127.0.0.1 \
 BRIDGE_TOKEN="your-strong-secret" \
 BRIDGE_PROFILE=~/.pinchtab/automation-profile \
-pinchtab &
+pinchtab server &
 ```
 
 **Never expose to 0.0.0.0 without a token. Never point at your daily Chrome profile.**
@@ -109,16 +121,16 @@ pinchtab &
 
 ```bash
 # Headless (default) — no visible window
-pinchtab &
+pinchtab server &
 
 # Headed — visible Chrome window for human debugging
-BRIDGE_HEADLESS=false pinchtab &
+BRIDGE_HEADLESS=false pinchtab server &
 
 # With auth token
-BRIDGE_TOKEN="your-secret-token" pinchtab &
+BRIDGE_TOKEN="your-secret-token" pinchtab server &
 
 # Custom port
-BRIDGE_PORT=8080 pinchtab &
+BRIDGE_PORT=8080 pinchtab server &
 ```
 
 Default: **port 9867**, no auth required (local). Set `BRIDGE_TOKEN` for remote access.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mercury-agent",
-  "version": "0.9.1",
+  "version": "0.11.0",
   "description": "Personal AI assistant for chat platforms (WhatsApp, Slack, Discord, Telegram)",
   "license": "MIT",
   "author": "Avishai Tsabari",
@@ -84,13 +84,13 @@
     "@chat-adapter/slack": "^4.14.0",
     "@chat-adapter/teams": "^4.17.0",
     "@chat-adapter/telegram": "^4.26.0",
-    "@earendil-works/pi-agent-core": "~0.79.6",
-    "@earendil-works/pi-ai": "~0.79.10",
-    "@earendil-works/pi-coding-agent": "~0.79.6",
+    "@earendil-works/pi-agent-core": "~0.83.0",
+    "@earendil-works/pi-ai": "~0.83.0",
+    "@earendil-works/pi-coding-agent": "~0.83.0",
     "@whiskeysockets/baileys": "^7.0.0-rc.9",
     "axios": "^1.15.1",
     "chat": "^4.14.0",
-    "commander": "^14.0.3",
+    "commander": "^15.0.0",
     "cron-parser": "^5.5.0",
     "discord.js": "^14.26.3",
     "hono": "^4.12.34",
@@ -100,10 +100,10 @@
   },
   "devDependencies": {
     "@biomejs/biome": "^2.4.12",
-    "@types/node": "^25.6.0",
+    "@types/node": "^26.1.2",
     "@types/qrcode-terminal": "^0.12.2",
     "bun-types": "^1.3.5",
-    "typescript": "^5.8.0"
+    "typescript": "^7.0.2"
   },
   "engines": {
     "bun": ">=1.2.0"