paper-mono 0.62.0 → 0.62.2

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Release notes
 
+## 0.62.2 — 2026-08-28
+
+- Made fresh-cache `npx --yes paper-mono` startup fast by carrying the Pi runtime in the public artifact and reducing npm's install closure to four small runtime dependencies.
+- Preserved Pi's supported provider and OAuth flows in the bundled runtime, including real interactive login-backed model execution.
+- Added fail-closed bridge, dependency-closure, unpacked-size, file-count, installed-provider, and clean-start regression coverage for the optimized artifact.
+
+## 0.62.1 — 2026-08-28
+
+- Made bare `paper` and `npx paper-mono` the canonical specialist launch paths across help, workflow metadata, clean-room release proof, and public documentation.
+- Kept `paper mono` as a compatibility-only route without exposing it in primary onboarding or help.
+- Let Pi load project instructions, skills, cwd, and generic tool guidance exactly once, while preserving repository-relative provider metadata for Pi-loaded context.
+
 ## 0.62.0 — 2026-08-28
 
 - Added equivalent public `paper` and `paper-mono` binaries with deterministic Paper reads, screenshots, diagnostics, and the guarded specialist.

package/DEPENDENCIES.json

@@ -1,54 +1,22 @@
 {
   "schemaVersion": "paper-mono-dependencies.v1",
-  "package": "paper-mono@0.62.0",
+  "package": "paper-mono@0.62.2",
   "external": [
-    {
-      "name": "@earendil-works/pi-agent-core",
-      "version": "0.84.3"
-    },
-    {
-      "name": "@earendil-works/pi-ai",
-      "version": "0.84.3"
-    },
-    {
-      "name": "@earendil-works/pi-coding-agent",
-      "version": "0.84.3"
-    },
-    {
-      "name": "@earendil-works/pi-tui",
-      "version": "0.84.3"
-    },
     {
       "name": "@silvia-odwyer/photon-node",
       "version": "0.3.4"
     },
-    {
-      "name": "@sinclair/typebox",
-      "version": "0.34.48"
-    },
-    {
-      "name": "chalk",
-      "version": "5.6.2"
-    },
     {
       "name": "cli-highlight",
       "version": "2.1.11"
     },
     {
-      "name": "debug",
-      "version": "4.4.3"
-    },
-    {
-      "name": "undici",
-      "version": "7.29.0"
-    },
-    {
-      "name": "yaml",
-      "version": "2.9.0"
+      "name": "data-uri-to-buffer",
+      "version": "4.0.1"
     },
     {
-      "name": "yauzl",
-      "version": "3.4.0"
+      "name": "ignore",
+      "version": "7.0.5"
     }
   ],
   "bundledInternal": [
@@ -70,36 +38,316 @@
     }
   ],
   "bundledThirdParty": [
+    {
+      "name": "@anthropic-ai/sdk",
+      "version": "0.91.1",
+      "license": "MIT"
+    },
     {
       "name": "@borewit/text-codec",
       "version": "0.2.2",
       "license": "MIT"
     },
+    {
+      "name": "@earendil-works/pi-agent-core",
+      "version": "0.84.3",
+      "license": "MIT"
+    },
+    {
+      "name": "@earendil-works/pi-ai",
+      "version": "0.84.3",
+      "license": "MIT"
+    },
+    {
+      "name": "@earendil-works/pi-coding-agent",
+      "version": "0.84.3",
+      "license": "MIT"
+    },
+    {
+      "name": "@earendil-works/pi-telemetry",
+      "version": "0.84.3",
+      "license": "MIT"
+    },
+    {
+      "name": "@earendil-works/pi-tui",
+      "version": "0.84.3",
+      "license": "MIT"
+    },
+    {
+      "name": "@google/genai",
+      "version": "1.52.0",
+      "license": "Apache-2.0"
+    },
+    {
+      "name": "@sinclair/typebox",
+      "version": "0.34.52",
+      "license": "MIT"
+    },
     {
       "name": "@tokenizer/inflate",
       "version": "0.4.1",
       "license": "MIT"
     },
+    {
+      "name": "agent-base",
+      "version": "7.1.4",
+      "license": "MIT"
+    },
     {
       "name": "ansi-regex",
       "version": "6.2.2",
       "license": "MIT"
     },
+    {
+      "name": "balanced-match",
+      "version": "4.0.4",
+      "license": "MIT"
+    },
+    {
+      "name": "base64-js",
+      "version": "1.5.1",
+      "license": "MIT"
+    },
+    {
+      "name": "bignumber.js",
+      "version": "9.3.1",
+      "license": "MIT"
+    },
+    {
+      "name": "brace-expansion",
+      "version": "5.0.7",
+      "license": "MIT"
+    },
+    {
+      "name": "buffer-equal-constant-time",
+      "version": "1.0.1",
+      "license": "BSD-3-Clause"
+    },
+    {
+      "name": "chalk",
+      "version": "5.6.2",
+      "license": "MIT"
+    },
+    {
+      "name": "cross-spawn",
+      "version": "7.0.6",
+      "license": "MIT"
+    },
+    {
+      "name": "debug",
+      "version": "4.4.3",
+      "license": "MIT"
+    },
     {
       "name": "diff",
       "version": "8.0.4",
       "license": "BSD-3-Clause"
     },
+    {
+      "name": "ecdsa-sig-formatter",
+      "version": "1.0.11",
+      "license": "Apache-2.0"
+    },
+    {
+      "name": "extend",
+      "version": "3.0.2",
+      "license": "MIT"
+    },
+    {
+      "name": "fetch-blob",
+      "version": "3.2.0",
+      "license": "MIT"
+    },
     {
       "name": "file-type",
       "version": "21.3.4",
       "license": "MIT"
     },
+    {
+      "name": "formdata-polyfill",
+      "version": "4.0.10",
+      "license": "MIT"
+    },
+    {
+      "name": "gaxios",
+      "version": "7.3.0",
+      "license": "Apache-2.0"
+    },
+    {
+      "name": "gcp-metadata",
+      "version": "8.1.2",
+      "license": "Apache-2.0"
+    },
+    {
+      "name": "get-east-asian-width",
+      "version": "1.6.0",
+      "license": "MIT"
+    },
+    {
+      "name": "google-auth-library",
+      "version": "10.9.1",
+      "license": "Apache-2.0"
+    },
+    {
+      "name": "google-logging-utils",
+      "version": "1.1.3",
+      "license": "Apache-2.0"
+    },
+    {
+      "name": "graceful-fs",
+      "version": "4.2.11",
+      "license": "ISC"
+    },
+    {
+      "name": "grok-mermaid",
+      "version": "0.2.2",
+      "license": "Apache-2.0"
+    },
+    {
+      "name": "has-flag",
+      "version": "4.0.0",
+      "license": "MIT"
+    },
+    {
+      "name": "highlight.js",
+      "version": "10.7.3",
+      "license": "BSD-3-Clause"
+    },
+    {
+      "name": "hosted-git-info",
+      "version": "9.0.3",
+      "license": "ISC"
+    },
+    {
+      "name": "https-proxy-agent",
+      "version": "7.0.6",
+      "license": "MIT"
+    },
     {
       "name": "ieee754",
       "version": "1.2.1",
       "license": "BSD-3-Clause"
     },
+    {
+      "name": "isexe",
+      "version": "2.0.0",
+      "license": "ISC"
+    },
+    {
+      "name": "jiti",
+      "version": "2.7.0",
+      "license": "MIT"
+    },
+    {
+      "name": "json-bigint",
+      "version": "1.0.0",
+      "license": "MIT"
+    },
+    {
+      "name": "jwa",
+      "version": "2.0.1",
+      "license": "MIT"
+    },
+    {
+      "name": "jws",
+      "version": "4.0.1",
+      "license": "MIT"
+    },
+    {
+      "name": "lru-cache",
+      "version": "11.5.2",
+      "license": "BlueOak-1.0.0"
+    },
+    {
+      "name": "marked",
+      "version": "18.0.5",
+      "license": "MIT"
+    },
+    {
+      "name": "minimatch",
+      "version": "10.2.5",
+      "license": "BlueOak-1.0.0"
+    },
+    {
+      "name": "ms",
+      "version": "2.1.3",
+      "license": "MIT"
+    },
+    {
+      "name": "node-domexception",
+      "version": "1.0.0",
+      "license": "MIT"
+    },
+    {
+      "name": "node-fetch",
+      "version": "3.3.2",
+      "license": "MIT"
+    },
+    {
+      "name": "openai",
+      "version": "6.40.0",
+      "license": "Apache-2.0"
+    },
+    {
+      "name": "p-retry",
+      "version": "4.6.2",
+      "license": "MIT"
+    },
+    {
+      "name": "partial-json",
+      "version": "0.1.7",
+      "license": "MIT"
+    },
+    {
+      "name": "path-key",
+      "version": "3.1.1",
+      "license": "MIT"
+    },
+    {
+      "name": "pend",
+      "version": "1.2.0",
+      "license": "MIT"
+    },
+    {
+      "name": "proper-lockfile",
+      "version": "4.1.2",
+      "license": "MIT"
+    },
+    {
+      "name": "retry",
+      "version": "0.12.0",
+      "license": "MIT"
+    },
+    {
+      "name": "retry",
+      "version": "0.13.1",
+      "license": "MIT"
+    },
+    {
+      "name": "safe-buffer",
+      "version": "5.2.1",
+      "license": "MIT"
+    },
+    {
+      "name": "semver",
+      "version": "7.8.0",
+      "license": "ISC"
+    },
+    {
+      "name": "shebang-command",
+      "version": "2.0.0",
+      "license": "MIT"
+    },
+    {
+      "name": "shebang-regex",
+      "version": "3.0.0",
+      "license": "MIT"
+    },
+    {
+      "name": "signal-exit",
+      "version": "3.0.7",
+      "license": "ISC"
+    },
     {
       "name": "strip-ansi",
       "version": "7.2.0",
@@ -110,6 +358,11 @@
       "version": "10.3.5",
       "license": "MIT"
     },
+    {
+      "name": "supports-color",
+      "version": "8.1.1",
+      "license": "MIT"
+    },
     {
       "name": "token-types",
       "version": "6.1.2",
@@ -120,10 +373,50 @@
       "version": "1.1.38",
       "license": "MIT"
     },
+    {
+      "name": "typebox",
+      "version": "1.3.7",
+      "license": "MIT"
+    },
     {
       "name": "uint8array-extras",
       "version": "1.5.0",
       "license": "MIT"
+    },
+    {
+      "name": "undici",
+      "version": "7.29.0",
+      "license": "MIT"
+    },
+    {
+      "name": "undici",
+      "version": "8.9.0",
+      "license": "MIT"
+    },
+    {
+      "name": "web-streams-polyfill",
+      "version": "3.3.3",
+      "license": "MIT"
+    },
+    {
+      "name": "which",
+      "version": "2.0.2",
+      "license": "ISC"
+    },
+    {
+      "name": "ws",
+      "version": "8.21.1",
+      "license": "MIT"
+    },
+    {
+      "name": "yaml",
+      "version": "2.9.0",
+      "license": "ISC"
+    },
+    {
+      "name": "yauzl",
+      "version": "3.4.0",
+      "license": "MIT"
     }
   ],
   "runtimeAssets": [

package/README.md

@@ -11,12 +11,15 @@ You need Node.js 22.19.0 or newer, Paper Desktop, a Paper document open, and use
 Open a terminal in the destination repository root before starting the specialist. That current working directory becomes the brief's project boundary for inspection, approved edit/write paths, command approval, and verification. An `@file` attachment must be a regular file inside that repository after symlink resolution; its contents are sent to the selected model provider as prompt context. Edit and write tools enforce approved project paths. An approved shell command must exactly match the brief and launches from the repository root, but it runs in the normal host shell—not an operating-system sandbox. Review every proposed command for absolute paths, parent traversal, redirection, subprocesses, and package lifecycle scripts that could reach outside the repository.
 
 ```bash
+# Run the complete specialist now; no global install required
+npx --yes paper-mono
+
+# Keep the short `paper` command
 npm install -g paper-mono
-paper doctor
-paper mono
+paper
 ```
 
-On first use, enter `/login` inside `paper mono` and choose a supported model provider. Then tell Paper Mono which reference and destination surface to inspect.
+The `--yes` flag only answers npm's first-run install confirmation; it does not bypass Paper Mono's brief or mutation approval gates. On first use, enter `/login` inside Paper Mono and choose a supported model provider. Then tell it which reference and destination surface to inspect.
 
 The default workflow is deliberately gated:
 
@@ -40,22 +43,16 @@ It is not a hosted design service, a Paper replacement, a Chrome automation tool
 Reference-to-code is the default. Two explicit alternatives are available:
 
 ```bash
-paper mono --audit-only
-paper mono --copilot
+paper --audit-only
+paper --copilot
 ```
 
 - `--audit-only` is permanently read-only and can never unlock mutation.
 - `--copilot` can propose guarded work inside Paper, but the same brief approval boundary still applies.
 
-`paper mono --list-models` is a model-inventory helper, not a fourth workflow.
-
-For a one-command trial without a global install, use:
-
-```bash
-npx paper-mono mono
-```
+`paper --list-models` is a model-inventory helper, not a fourth workflow.
 
-`npx` uses npm-managed cache and Paper Mono may create normal local state under `~/.paper/agent`; it only avoids a global package install. The package exposes equivalent `paper` and `paper-mono` binaries. Documentation uses `paper` as the canonical command.
+The quick-start `npx --yes paper-mono` command runs the same complete specialist as `paper`. It uses npm-managed cache and may create normal local state under `~/.paper/agent`; it only avoids a global package install. The public artifact carries the Pi runtime with it, so npm installs only four small runtime dependencies instead of reifying Pi's full nested dependency tree on every fresh cache. The package exposes equivalent `paper` and `paper-mono` binaries. Documentation uses `paper` as the canonical command after installation.
 
 ## Paper Snapshot
 
@@ -75,33 +72,32 @@ paper selection --json
 paper tree --json
 paper node "replace-with-node-id" --json
 paper screenshot --out reference --json
-paper mono --help
 ```
 
-Machine-readable commands emit JSON without decorative stdout. Screenshot exports require an explicit `--node` or exactly one current selection, append the verified image extension when needed, and refuse to overwrite an existing path. Deterministic owner commands reject unknown subcommands, and the specialist rejects unsupported flags, invalid option values, path-like `--session` values, and conflicting session actions with a nonzero exit and an actionable error. Bare positional text on `paper mono` is prompt input. Use `paper mono -- --version` or the same `--` terminator for prompt text that looks like an option. The short `paper` specialist form reserves the owner command words `show`, `info`, `selection`, `tree`, `node`, `screenshot`, `doctor`, `page`, and `help`; use `paper mono` when prompt text could be mistaken for one of them.
+Machine-readable commands emit JSON without decorative stdout. Screenshot exports require an explicit `--node` or exactly one current selection, append the verified image extension when needed, and refuse to overwrite an existing path. Deterministic owner commands reject unknown subcommands, and the specialist rejects unsupported flags, invalid option values, path-like `--session` values, and conflicting session actions with a nonzero exit and an actionable error. Positional text on `paper` is prompt input unless its first word is a reserved owner command: `show`, `info`, `selection`, `tree`, `node`, `screenshot`, `doctor`, `page`, or `help`. Put `--` before option-shaped or reserved-word prompt text; for example, `paper -- --version` or `paper -- info about this layout`.
 
 ## Model authentication
 
-Run `paper mono`, enter `/login`, and choose a provider. You may instead use that provider's documented environment variable. `paper mono --list-models` shows available model IDs; Paper Mono never prints credential values in diagnostics.
+Run `paper`, enter `/login`, and choose a provider. You may instead use that provider's documented environment variable. `paper --list-models` shows available model IDs; Paper Mono never prints credential values in diagnostics.
 
 Credentials, settings, and sessions stay under `~/.paper/agent` by default. Set `PAPER_CODING_AGENT_DIR` before the first run to use another local directory. `--session <id>` accepts a verified session ID only; public v1 rejects path-like values before session activation. Use `--fork <path-or-id>` when you explicitly intend to import a transcript into a new session scoped to the current project. `--session-dir <dir>` overrides session storage and lookup only; it may place transcripts outside the agent home and uses the runtime's explicit-directory lookup instead of Paper Mono's hardened implicit-session verification path. Use only a directory you trust. A resumed session is mutation-locked again until the current brief is reconfirmed.
 
 Resume a previous interactive session with:
 
 ```bash
-paper mono -r
+paper -r
 ```
 
 ## Privacy and network boundaries
 
 Paper document reads travel over the loopback MCP endpoint at `127.0.0.1`. Paper Mono disables the inherited install ping, automatic version polling, provider-attribution telemetry, and executable downloader before startup; it adds no product telemetry or hidden backend and does not silently phone home. The public TUI also disables inherited `/debug`, `/export`, `/import`, and `/share` commands, so a locked session cannot write a raw debug log or export, replace itself from a file, or send a transcript to an external sharing service. Generated provider metadata names the current project as `<repository-root>` and uses repository-relative labels for attached and context files; Paper Mono does not add the absolute local project path to the model request. User-authored prompts, attached file contents, imported instructions, tool results, or approved commands can still contain paths. Prompts, relevant code/reference context, and tool results needed for reasoning are sent to the model provider you select, so that provider's privacy and retention terms apply.
 
-Use `PAPER_OFFLINE=1` or `paper mono --offline` to disable startup network operations. Local deterministic Paper reads remain available, but model work still requires a reachable configured provider unless you use a local one.
+Use `PAPER_OFFLINE=1` or `paper --offline` to disable startup network operations. Local deterministic Paper reads remain available, but model work still requires a reachable configured provider unless you use a local one.
 
 ## Compatibility and current limits
 
 - Node.js 22.19.0 or newer is required.
-- `fd` (or `fdfind`) and `rg` must already be executable on `PATH` before `paper mono` starts. Missing tools fail with install guidance in both default and offline modes; Paper Mono does not acquire them.
+- `fd` (or `fdfind`) and `rg` must already be executable on `PATH` before `paper` starts. Missing tools fail with install guidance in both default and offline modes; Paper Mono does not acquire them.
 - Paper Desktop must be running with a document open for live MCP reads.
 - Clean-room installation and offline CLI behavior are exercised on Apple-silicon macOS with Node.js 22.23.1. That receipt does not claim live Paper Desktop integration on any operating system. The package declares no OS restriction, but Linux and Windows live integration remain unproven.
 - A static Snapshot cannot prove original motion, hidden application state, backend behavior, or inaccessible assets. The brief labels those details as unknown instead of inventing them.
@@ -112,7 +108,7 @@ Use `PAPER_OFFLINE=1` or `paper mono --offline` to disable startup network opera
 
 - **Paper is closed or no file is open:** open Paper Desktop and a document, then rerun `paper doctor --json`. Reinstallation is unnecessary.
 - **MCP is unreachable:** confirm the document is open and that another process is not interfering with `127.0.0.1:29979`, then rerun doctor. Restart Paper only if the local endpoint still does not recover.
-- **Model authentication is missing:** start `paper mono`, enter `/login`, or configure the selected provider's documented environment variable. A missing key should produce guidance, not a stack trace.
+- **Model authentication is missing:** start `paper`, enter `/login`, or configure the selected provider's documented environment variable. A missing key should produce guidance, not a stack trace.
 - **The Snapshot is too large:** select or name one artboard, rerun bounded inspection, use scale 1, and request JSX/styles for a smaller subtree. Paper Mono suppresses over-budget rich parts whole; it never returns partial JSON, JSX, or base64.
 - **The wrong file, page, or artboard is active:** run `paper info --json` and `paper selection --json`, switch to the intended target in Paper, and request a fresh brief. Existing approval does not carry across target drift.
 - **The imported structure is malformed or incomplete:** provide a narrower node or screenshot and let the brief record unsupported details explicitly.