pi-advisor-flow 0.3.3 → 0.3.4

package/CHANGELOG.md

@@ -4,6 +4,20 @@ All notable changes to this project are documented here.
 
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## 0.3.4
+
+### Changed
+
+- Updated the development toolchain and Pi compatibility test matrix to the current supported patch releases.
+- Added pull-request validation and made release tags wait for frozen-install, typecheck, test, lint, package, and security-audit checks.
+- Kept Bun security auditing outside the publish workflow so an audit failure prevents a new tag instead of invalidating an existing release tag.
+- Added a package allowlist check for the published tarball and retained npm provenance publishing.
+
+### Security
+
+- Confirmed the Socket URL-string findings for `advisor-preferences.md` and `notification.show` are intentional command/path identifiers, not network endpoints.
+- Retained the constrained filesystem access required for explicit repository-file handoff; no new Socket issues were reported for 0.3.3.
+
 ## 0.3.3
 
 ### Added
@@ -15,6 +29,12 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and
 - Kept Scout history within the Advisor's remaining context budget, including zero-budget behavior, and kept pending Advisor drafts and attachment paths outside Scout's input.
 - Included the current repeated tool invocation in automatic-gate Scout context.
 
+## 0.3.2
+
+### Release status
+
+- Not published because the release validation workflow failed three tests before publication.
+
 ## 0.3.1
 
 ### Changed

package/README.md

@@ -24,7 +24,7 @@ The idea is simple: keep implementation on a fast model and borrow frontier reas
 
 ## Install
 
-Current release: **0.3.2**. Requires Pi 0.84.1 or later and is compatible with Herdr 0.8.0. The extension installs no dependencies of its own; Pi supplies its runtime modules.
+Current release: **0.3.4**. Requires Pi 0.84.1 or later and is compatible with Herdr 0.8.0. The extension installs no dependencies of its own; Pi supplies its runtime modules.
 
 ```bash
 # npm

package/package.json

@@ -1,24 +1,60 @@
 {
   "name": "pi-advisor-flow",
-  "version": "0.3.3",
-  "author": "Philip Brembeck",
+  "version": "0.3.4",
+  "description": "Advanced Executor/Advisor flow for Pi, fully configurable and extendable.",
+  "keywords": [
+    "pi-package",
+    "pi-extension",
+    "pi-coding-agent",
+    "advisor",
+    "pi-advisor",
+    "herdr"
+  ],
+  "homepage": "https://github.com/philipbrembeck/pi-advisor",
   "repository": {
     "type": "git",
     "url": "https://github.com/philipbrembeck/pi-advisor.git"
   },
+  "license": "MIT",
+  "author": "Philip Brembeck",
+  "type": "module",
   "main": "extensions/index.ts",
+  "types": "extensions/index.ts",
+  "files": [
+    "extensions",
+    "src",
+    "CHANGELOG.md",
+    "LICENSE",
+    "README.md"
+  ],
+  "scripts": {
+    "format": "bunx ultracite fix --linter-enabled=false",
+    "lint": "bunx ultracite check",
+    "lint:fix": "bunx ultracite fix",
+    "package:check": "node scripts/check-package.mjs",
+    "prepare": "husky",
+    "test": "bun test",
+    "typecheck": "tsc --noEmit"
+  },
+  "lint-staged": {
+    "*.{json,jsonc,ts}": "bun run lint:fix --"
+  },
+  "overrides": {
+    "brace-expansion": "5.0.9",
+    "undici": "8.9.0"
+  },
   "devDependencies": {
-    "@biomejs/biome": "2.5.3",
-    "@earendil-works/pi-ai": "^0.84.1",
-    "@earendil-works/pi-coding-agent": "^0.84.1",
-    "@earendil-works/pi-tui": "^0.84.1",
+    "@biomejs/biome": "2.5.8",
+    "@earendil-works/pi-ai": "^0.84.2",
+    "@earendil-works/pi-coding-agent": "^0.84.2",
+    "@earendil-works/pi-tui": "^0.84.2",
     "@types/node": "^20.11.0",
     "bun-types": "^1.0.0",
     "husky": "^9.1.7",
-    "lint-staged": "^17.1.0",
-    "typebox": "^1.1.38",
+    "lint-staged": "^17.3.0",
+    "typebox": "^1.3.14",
     "typescript": "^5.3.3",
-    "ultracite": "7.9.4"
+    "ultracite": "7.10.4"
   },
   "peerDependencies": {
     "@earendil-works/pi-ai": "^0.84.1",
@@ -40,46 +76,10 @@
       "optional": true
     }
   },
-  "description": "Advanced Executor/Advisor flow for Pi, fully configurable and extendable.",
-  "files": [
-    "extensions",
-    "src",
-    "CHANGELOG.md",
-    "LICENSE",
-    "README.md"
-  ],
-  "homepage": "https://github.com/philipbrembeck/pi-advisor",
-  "keywords": [
-    "pi-package",
-    "pi-extension",
-    "pi-coding-agent",
-    "advisor",
-    "pi-advisor",
-    "herdr"
-  ],
-  "license": "MIT",
-  "lint-staged": {
-    "*.{json,jsonc,ts}": "bun run lint:fix --"
-  },
-  "overrides": {
-    "brace-expansion": "5.0.9",
-    "undici": "8.9.0"
-  },
   "pi": {
     "extensions": [
       "./extensions/index.ts"
     ],
     "image": "https://raw.githubusercontent.com/philipbrembeck/pi-advisor/refs/heads/main/assets/hero.png"
-  },
-  "scripts": {
-    "test": "bun test",
-    "typecheck": "tsc --noEmit",
-    "format": "bunx ultracite fix --linter-enabled=false",
-    "lint": "bunx ultracite check",
-    "lint:fix": "bunx ultracite fix",
-    "package:check": "npm pack --dry-run --json >/dev/null",
-    "prepare": "husky"
-  },
-  "type": "module",
-  "types": "extensions/index.ts"
+  }
 }

package/src/outcomes.ts

@@ -126,16 +126,16 @@ export const appendOutcome = async (
 ) => {
   const path = outcomeLogPath();
   await mkdir(getAgentDir(), { mode: 0o700, recursive: true });
-  const next: OutcomeRecord = {
-    adoption: record.adoption,
-    adviceHash: adviceDigest(record.advice, await salt()),
-    timestamp: new Date().toISOString(),
-    trigger: record.trigger,
-    v: 1,
-    validationStatus: record.validationStatus,
-  };
-  const line = `${JSON.stringify(next)}\n`;
-  await withOutcomeLock(async () => {
+  return withOutcomeLock(async () => {
+    const next: OutcomeRecord = {
+      adoption: record.adoption,
+      adviceHash: adviceDigest(record.advice, await salt()),
+      timestamp: new Date().toISOString(),
+      trigger: record.trigger,
+      v: 1,
+      validationStatus: record.validationStatus,
+    };
+    const line = `${JSON.stringify(next)}\n`;
     const currentBytes = await stat(path)
       .then((value) => value.size)
       .catch((error: NodeJS.ErrnoException) => {
@@ -150,6 +150,6 @@ export const appendOutcome = async (
       await appendFile(path, line, { encoding: "utf8", mode: 0o600 });
     }
     await chmod(path, 0o600);
+    return next;
   });
-  return next;
 };