paper-mono 0.62.1 → 0.62.2

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Release notes
 
+## 0.62.2 — 2026-08-28
+
+- Made fresh-cache `npx --yes paper-mono` startup fast by carrying the Pi runtime in the public artifact and reducing npm's install closure to four small runtime dependencies.
+- Preserved Pi's supported provider and OAuth flows in the bundled runtime, including real interactive login-backed model execution.
+- Added fail-closed bridge, dependency-closure, unpacked-size, file-count, installed-provider, and clean-start regression coverage for the optimized artifact.
+
 ## 0.62.1 — 2026-08-28
 
 - Made bare `paper` and `npx paper-mono` the canonical specialist launch paths across help, workflow metadata, clean-room release proof, and public documentation.

package/DEPENDENCIES.json

@@ -1,54 +1,22 @@
 {
   "schemaVersion": "paper-mono-dependencies.v1",
-  "package": "paper-mono@0.62.1",
+  "package": "paper-mono@0.62.2",
   "external": [
-    {
-      "name": "@earendil-works/pi-agent-core",
-      "version": "0.84.3"
-    },
-    {
-      "name": "@earendil-works/pi-ai",
-      "version": "0.84.3"
-    },
-    {
-      "name": "@earendil-works/pi-coding-agent",
-      "version": "0.84.3"
-    },
-    {
-      "name": "@earendil-works/pi-tui",
-      "version": "0.84.3"
-    },
     {
       "name": "@silvia-odwyer/photon-node",
       "version": "0.3.4"
     },
-    {
-      "name": "@sinclair/typebox",
-      "version": "0.34.48"
-    },
-    {
-      "name": "chalk",
-      "version": "5.6.2"
-    },
     {
       "name": "cli-highlight",
       "version": "2.1.11"
     },
     {
-      "name": "debug",
-      "version": "4.4.3"
-    },
-    {
-      "name": "undici",
-      "version": "7.29.0"
-    },
-    {
-      "name": "yaml",
-      "version": "2.9.0"
+      "name": "data-uri-to-buffer",
+      "version": "4.0.1"
     },
     {
-      "name": "yauzl",
-      "version": "3.4.0"
+      "name": "ignore",
+      "version": "7.0.5"
     }
   ],
   "bundledInternal": [
@@ -70,36 +38,316 @@
     }
   ],
   "bundledThirdParty": [
+    {
+      "name": "@anthropic-ai/sdk",
+      "version": "0.91.1",
+      "license": "MIT"
+    },
     {
       "name": "@borewit/text-codec",
       "version": "0.2.2",
       "license": "MIT"
     },
+    {
+      "name": "@earendil-works/pi-agent-core",
+      "version": "0.84.3",
+      "license": "MIT"
+    },
+    {
+      "name": "@earendil-works/pi-ai",
+      "version": "0.84.3",
+      "license": "MIT"
+    },
+    {
+      "name": "@earendil-works/pi-coding-agent",
+      "version": "0.84.3",
+      "license": "MIT"
+    },
+    {
+      "name": "@earendil-works/pi-telemetry",
+      "version": "0.84.3",
+      "license": "MIT"
+    },
+    {
+      "name": "@earendil-works/pi-tui",
+      "version": "0.84.3",
+      "license": "MIT"
+    },
+    {
+      "name": "@google/genai",
+      "version": "1.52.0",
+      "license": "Apache-2.0"
+    },
+    {
+      "name": "@sinclair/typebox",
+      "version": "0.34.52",
+      "license": "MIT"
+    },
     {
       "name": "@tokenizer/inflate",
       "version": "0.4.1",
       "license": "MIT"
     },
+    {
+      "name": "agent-base",
+      "version": "7.1.4",
+      "license": "MIT"
+    },
     {
       "name": "ansi-regex",
       "version": "6.2.2",
       "license": "MIT"
     },
+    {
+      "name": "balanced-match",
+      "version": "4.0.4",
+      "license": "MIT"
+    },
+    {
+      "name": "base64-js",
+      "version": "1.5.1",
+      "license": "MIT"
+    },
+    {
+      "name": "bignumber.js",
+      "version": "9.3.1",
+      "license": "MIT"
+    },
+    {
+      "name": "brace-expansion",
+      "version": "5.0.7",
+      "license": "MIT"
+    },
+    {
+      "name": "buffer-equal-constant-time",
+      "version": "1.0.1",
+      "license": "BSD-3-Clause"
+    },
+    {
+      "name": "chalk",
+      "version": "5.6.2",
+      "license": "MIT"
+    },
+    {
+      "name": "cross-spawn",
+      "version": "7.0.6",
+      "license": "MIT"
+    },
+    {
+      "name": "debug",
+      "version": "4.4.3",
+      "license": "MIT"
+    },
     {
       "name": "diff",
       "version": "8.0.4",
       "license": "BSD-3-Clause"
     },
+    {
+      "name": "ecdsa-sig-formatter",
+      "version": "1.0.11",
+      "license": "Apache-2.0"
+    },
+    {
+      "name": "extend",
+      "version": "3.0.2",
+      "license": "MIT"
+    },
+    {
+      "name": "fetch-blob",
+      "version": "3.2.0",
+      "license": "MIT"
+    },
     {
       "name": "file-type",
       "version": "21.3.4",
       "license": "MIT"
     },
+    {
+      "name": "formdata-polyfill",
+      "version": "4.0.10",
+      "license": "MIT"
+    },
+    {
+      "name": "gaxios",
+      "version": "7.3.0",
+      "license": "Apache-2.0"
+    },
+    {
+      "name": "gcp-metadata",
+      "version": "8.1.2",
+      "license": "Apache-2.0"
+    },
+    {
+      "name": "get-east-asian-width",
+      "version": "1.6.0",
+      "license": "MIT"
+    },
+    {
+      "name": "google-auth-library",
+      "version": "10.9.1",
+      "license": "Apache-2.0"
+    },
+    {
+      "name": "google-logging-utils",
+      "version": "1.1.3",
+      "license": "Apache-2.0"
+    },
+    {
+      "name": "graceful-fs",
+      "version": "4.2.11",
+      "license": "ISC"
+    },
+    {
+      "name": "grok-mermaid",
+      "version": "0.2.2",
+      "license": "Apache-2.0"
+    },
+    {
+      "name": "has-flag",
+      "version": "4.0.0",
+      "license": "MIT"
+    },
+    {
+      "name": "highlight.js",
+      "version": "10.7.3",
+      "license": "BSD-3-Clause"
+    },
+    {
+      "name": "hosted-git-info",
+      "version": "9.0.3",
+      "license": "ISC"
+    },
+    {
+      "name": "https-proxy-agent",
+      "version": "7.0.6",
+      "license": "MIT"
+    },
     {
       "name": "ieee754",
       "version": "1.2.1",
       "license": "BSD-3-Clause"
     },
+    {
+      "name": "isexe",
+      "version": "2.0.0",
+      "license": "ISC"
+    },
+    {
+      "name": "jiti",
+      "version": "2.7.0",
+      "license": "MIT"
+    },
+    {
+      "name": "json-bigint",
+      "version": "1.0.0",
+      "license": "MIT"
+    },
+    {
+      "name": "jwa",
+      "version": "2.0.1",
+      "license": "MIT"
+    },
+    {
+      "name": "jws",
+      "version": "4.0.1",
+      "license": "MIT"
+    },
+    {
+      "name": "lru-cache",
+      "version": "11.5.2",
+      "license": "BlueOak-1.0.0"
+    },
+    {
+      "name": "marked",
+      "version": "18.0.5",
+      "license": "MIT"
+    },
+    {
+      "name": "minimatch",
+      "version": "10.2.5",
+      "license": "BlueOak-1.0.0"
+    },
+    {
+      "name": "ms",
+      "version": "2.1.3",
+      "license": "MIT"
+    },
+    {
+      "name": "node-domexception",
+      "version": "1.0.0",
+      "license": "MIT"
+    },
+    {
+      "name": "node-fetch",
+      "version": "3.3.2",
+      "license": "MIT"
+    },
+    {
+      "name": "openai",
+      "version": "6.40.0",
+      "license": "Apache-2.0"
+    },
+    {
+      "name": "p-retry",
+      "version": "4.6.2",
+      "license": "MIT"
+    },
+    {
+      "name": "partial-json",
+      "version": "0.1.7",
+      "license": "MIT"
+    },
+    {
+      "name": "path-key",
+      "version": "3.1.1",
+      "license": "MIT"
+    },
+    {
+      "name": "pend",
+      "version": "1.2.0",
+      "license": "MIT"
+    },
+    {
+      "name": "proper-lockfile",
+      "version": "4.1.2",
+      "license": "MIT"
+    },
+    {
+      "name": "retry",
+      "version": "0.12.0",
+      "license": "MIT"
+    },
+    {
+      "name": "retry",
+      "version": "0.13.1",
+      "license": "MIT"
+    },
+    {
+      "name": "safe-buffer",
+      "version": "5.2.1",
+      "license": "MIT"
+    },
+    {
+      "name": "semver",
+      "version": "7.8.0",
+      "license": "ISC"
+    },
+    {
+      "name": "shebang-command",
+      "version": "2.0.0",
+      "license": "MIT"
+    },
+    {
+      "name": "shebang-regex",
+      "version": "3.0.0",
+      "license": "MIT"
+    },
+    {
+      "name": "signal-exit",
+      "version": "3.0.7",
+      "license": "ISC"
+    },
     {
       "name": "strip-ansi",
       "version": "7.2.0",
@@ -110,6 +358,11 @@
       "version": "10.3.5",
       "license": "MIT"
     },
+    {
+      "name": "supports-color",
+      "version": "8.1.1",
+      "license": "MIT"
+    },
     {
       "name": "token-types",
       "version": "6.1.2",
@@ -120,10 +373,50 @@
       "version": "1.1.38",
       "license": "MIT"
     },
+    {
+      "name": "typebox",
+      "version": "1.3.7",
+      "license": "MIT"
+    },
     {
       "name": "uint8array-extras",
       "version": "1.5.0",
       "license": "MIT"
+    },
+    {
+      "name": "undici",
+      "version": "7.29.0",
+      "license": "MIT"
+    },
+    {
+      "name": "undici",
+      "version": "8.9.0",
+      "license": "MIT"
+    },
+    {
+      "name": "web-streams-polyfill",
+      "version": "3.3.3",
+      "license": "MIT"
+    },
+    {
+      "name": "which",
+      "version": "2.0.2",
+      "license": "ISC"
+    },
+    {
+      "name": "ws",
+      "version": "8.21.1",
+      "license": "MIT"
+    },
+    {
+      "name": "yaml",
+      "version": "2.9.0",
+      "license": "ISC"
+    },
+    {
+      "name": "yauzl",
+      "version": "3.4.0",
+      "license": "MIT"
     }
   ],
   "runtimeAssets": [

package/README.md

@@ -11,11 +11,15 @@ You need Node.js 22.19.0 or newer, Paper Desktop, a Paper document open, and use
 Open a terminal in the destination repository root before starting the specialist. That current working directory becomes the brief's project boundary for inspection, approved edit/write paths, command approval, and verification. An `@file` attachment must be a regular file inside that repository after symlink resolution; its contents are sent to the selected model provider as prompt context. Edit and write tools enforce approved project paths. An approved shell command must exactly match the brief and launches from the repository root, but it runs in the normal host shell—not an operating-system sandbox. Review every proposed command for absolute paths, parent traversal, redirection, subprocesses, and package lifecycle scripts that could reach outside the repository.
 
 ```bash
+# Run the complete specialist now; no global install required
+npx --yes paper-mono
+
+# Keep the short `paper` command
 npm install -g paper-mono
 paper
 ```
 
-On first use, enter `/login` inside `paper` and choose a supported model provider. Then tell Paper Mono which reference and destination surface to inspect.
+The `--yes` flag only answers npm's first-run install confirmation; it does not bypass Paper Mono's brief or mutation approval gates. On first use, enter `/login` inside Paper Mono and choose a supported model provider. Then tell it which reference and destination surface to inspect.
 
 The default workflow is deliberately gated:
 
@@ -48,13 +52,7 @@ paper --copilot
 
 `paper --list-models` is a model-inventory helper, not a fourth workflow.
 
-For a one-command trial without a global install, use:
-
-```bash
-npx paper-mono
-```
-
-`npx` uses npm-managed cache and Paper Mono may create normal local state under `~/.paper/agent`; it only avoids a global package install. The package exposes equivalent `paper` and `paper-mono` binaries. Documentation uses `paper` as the canonical command.
+The quick-start `npx --yes paper-mono` command runs the same complete specialist as `paper`. It uses npm-managed cache and may create normal local state under `~/.paper/agent`; it only avoids a global package install. The public artifact carries the Pi runtime with it, so npm installs only four small runtime dependencies instead of reifying Pi's full nested dependency tree on every fresh cache. The package exposes equivalent `paper` and `paper-mono` binaries. Documentation uses `paper` as the canonical command after installation.
 
 ## Paper Snapshot