pi-lean-dimension 0.3.0 → 0.3.2

package/node_modules/pi-lean-portal/README.md

@@ -691,12 +691,10 @@ When creating navigation guides with `web-learn`:
 
 ### Security
 
-- URLs are validated against private IP ranges (10.x, 172.16-31.x,
-  192.168.x, 127.x, 169.254.169.254) — localhost and internal networks
-  are blocked by default
-- Dangerous URL schemes are blocked: `file:`, `ftp:`, `data:`,
-  `javascript:`, `vbscript:`
-- Secrets in URLs are detected heuristically
+- URLs are parsed with `new URL()` as input validation — malformed
+  URLs are rejected, but no SSRF boundary is enforced (a coding agent
+  already has filesystem and shell access, so blocking localhost or
+  private IPs would be theater)
 - Profile state is stored with restricted file permissions (0700 dirs,
   0600 files)
 

package/node_modules/pi-lean-portal/__tests__/browser-toggle.test.ts

@@ -259,26 +259,26 @@ describe("getToggleState / getLearnState", () => {
 //  appendEntry persist keys
 // ==================================================================
 describe("persistence key split", () => {
-	it("appends toolset-state:portal.web on enable", async () => {
+	it("appends toolset-state:pi-lean-dimension.web on enable", async () => {
 		const { pi } = mockPi([]);
 		browserToggle(pi);
 
 		await captureWebHandler(pi)("on", mockCtx());
 
 		const webCalls = (pi.appendEntry as any).mock.calls.filter(
-			(c: any) => c[0] === "toolset-state:portal.web",
+			(c: any) => c[0] === "toolset-state:pi-lean-dimension.web",
 		);
 		expect(webCalls.length).toBeGreaterThanOrEqual(1);
 	});
 
-	it("appends toolset-state:portal.learn on learn", async () => {
+	it("appends toolset-state:pi-lean-dimension.web-learn on learn", async () => {
 		const { pi } = mockPi([]);
 		browserToggle(pi);
 
 		await captureWebHandler(pi)("learn", mockCtx());
 
 		const learnCalls = (pi.appendEntry as any).mock.calls.filter(
-			(c: any) => c[0] === "toolset-state:portal.learn",
+			(c: any) => c[0] === "toolset-state:pi-lean-dimension.web-learn",
 		);
 		expect(learnCalls.length).toBeGreaterThanOrEqual(1);
 	});
@@ -377,7 +377,7 @@ describe("/web focus-mode guard", () => {
 //  Glyph sync on external-plugin changed events
 // ==================================================================
 describe("external-plugin glyph sync", () => {
-	it("re-renders browser glyph off when external plugin fires portal.web disabled", async () => {
+	it("re-renders browser glyph off when external plugin fires pi-lean-dimension.web disabled", async () => {
 		const { pi, handlers, events } = mockPi();
 		browserToggle(pi);
 
@@ -391,7 +391,7 @@ describe("external-plugin glyph sync", () => {
 		// Clear the initial render call so we only see the external-plugin re-render.
 		vi.clearAllMocks();
 
-		// Simulate an external plugin disabling portal.web — it has
+		// Simulate an external plugin disabling pi-lean-dimension.web — it has
 		// already removed browser tools from the active set.
 		const nonBrowser = ALL_TOOLS.map((t) => t.name).filter(
 			(n) => !BROWSER_TOOL_NAMES.has(n),
@@ -399,7 +399,7 @@ describe("external-plugin glyph sync", () => {
 		(pi.getActiveTools as any).mockReturnValue(nonBrowser);
 
 		events.emit(TOOLSET_EVENTS.changed, {
-			id: "portal.web",
+			id: "pi-lean-dimension.web",
 			enabled: false,
 		});
 

package/node_modules/pi-lean-portal/browser-toggle.ts

@@ -15,7 +15,7 @@ import { readMergedSettings } from "./core/shared/settings-reader.js";
 // ---- Toolset specs -----------------------------------------------
 
 const PORTAL_WEB_SPEC: ToolsetSpec = {
-	id: "portal.web",
+	id: "pi-lean-dimension.web",
 	names: new Set([
 		"web-fetch",
 		"browser-navigate",
@@ -29,15 +29,15 @@ const PORTAL_WEB_SPEC: ToolsetSpec = {
 		"browser-inspect",
 		"web-guide",
 	]),
-	persistKey: "toolset-state:portal.web",
+	persistKey: "toolset-state:pi-lean-dimension.web",
 };
 
 const PORTAL_LEARN_SPEC: ToolsetSpec = {
-	id: "portal.learn",
+	id: "pi-lean-dimension.web-learn",
 	names: new Set(["web-learn"]),
-	persistKey: "toolset-state:portal.learn",
+	persistKey: "toolset-state:pi-lean-dimension.web-learn",
 	defaultEnabled: false,
-	requires: ["portal.web"],
+	requires: ["pi-lean-dimension.web"],
 };
 
 // ---- Status bar cached state (derived from library events) ------

package/node_modules/pi-lean-portal/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-lean-portal",
-	"version": "0.3.0",
+	"version": "0.3.2",
 	"description": "Pi extension. Interactive web browsing for Pi — a /web toggle removes the tools from context when switched off, Playwright Chromium/Firefox deliver accessibility-tree snapshots, persistent profiles, cookies, and domain-matched guides; custom/stealth backends (Camoufox) plug in when a site blocks the shipped browsers.",
 	"keywords": [
 		"pi-package",
@@ -56,6 +56,7 @@
 	},
 	"dependencies": {
 		"node-html-parser": "^6.1.0",
+		"pi-tool-masking": "^1.0.0",
 		"playwright": "^1.60.0",
 		"turndown": "^7.2.0"
 	},
@@ -63,7 +64,6 @@
 		"@earendil-works/pi-ai": "*",
 		"@earendil-works/pi-coding-agent": "*",
 		"@earendil-works/pi-tui": "*",
-		"pi-tool-masking": "^1.0.0",
 		"typebox": "*"
 	}
 }

package/node_modules/pi-lean-search/__tests__/web-search.test.ts

@@ -447,15 +447,15 @@ beforeEach(() => {
 });
 
 // ==================================================================
-//  Toolset wiring: portal.web ↔ search.web co-activation mirror
+//  Toolset wiring: pi-lean-dimension.web ↔ pi-lean-dimension.search co-activation mirror
 // ==================================================================
-describe("portal.web co-activation mirror", () => {
-	it("disables search.web when portal.web changed fires with enabled: false", async () => {
+describe("pi-lean-dimension.web co-activation mirror", () => {
+	it("disables pi-lean-dimension.search when pi-lean-dimension.web changed fires with enabled: false", async () => {
 		const { pi, events } = mockSearchPi();
 		searchExtension(pi);
 
 		events.emit(TOOLSET_EVENTS.changed, {
-			id: "portal.web",
+			id: "pi-lean-dimension.web",
 			enabled: false,
 		});
 
@@ -464,12 +464,12 @@ describe("portal.web co-activation mirror", () => {
 		);
 	});
 
-	it("enables search.web when portal.web changed fires with enabled: true", async () => {
+	it("enables pi-lean-dimension.search when pi-lean-dimension.web changed fires with enabled: true", async () => {
 		const { pi, events } = mockSearchPi([]);
 		searchExtension(pi);
 
 		events.emit(TOOLSET_EVENTS.changed, {
-			id: "portal.web",
+			id: "pi-lean-dimension.web",
 			enabled: true,
 		});
 

package/node_modules/pi-lean-search/index.ts

@@ -4,7 +4,7 @@
  * Registers the `web-search` tool and a `/searxng-status` diagnostic command.
  * Manages the `search` status bar slot with health-colored glyphs.
  *
- * Owns the `search.web` toolset (co-activated off `portal.web`):
+ * Owns the `pi-lean-dimension.search` toolset (co-activated off `pi-lean-dimension.web`):
  *   ● searxng  (accent/blue)    — healthy and reachable
  *   ● searxng  (warning/yellow)  — server up but pipeline degraded
  *   ● searxng  (error/red)      — unreachable
@@ -24,9 +24,9 @@ import { webSearchTool } from "./web-search-tool.js";
 // ─── Toolset spec ────────────────────────────────────────────────
 
 const SEARCH_WEB_SPEC: ToolsetSpec = {
-	id: "search.web",
+	id: "pi-lean-dimension.search",
 	names: new Set(["web-search"]),
-	persistKey: "toolset-state:search.web",
+	persistKey: "toolset-state:pi-lean-dimension.search",
 	defaultEnabled: true,
 };
 
@@ -35,7 +35,7 @@ const SEARCH_WEB_SPEC: ToolsetSpec = {
 /** Cached SearXNG URL (read once at startup, stable mid-session). */
 let _searxngUrl: string | undefined;
 
-/** Last known search.web enabled state (updated by library events). */
+/** Last known pi-lean-dimension.search enabled state (updated by library events). */
 let _lastSearchEnabled = true;
 
 /** Last known health state: true=healthy, false=unreachable, null=unconfigured. */
@@ -128,10 +128,10 @@ function displayUrl(url: string): string {
 /**
  * Render the `search` status slot based on toolset state + health.
  *
- *   search.web off         → ○ searxng
- *   search.web on + healthy → ● searxng (accent/blue)
- *   search.web on + degraded → ● searxng (warning/yellow)
- *   search.web on + unreachable → ● searxng (error/red)
+ *   pi-lean-dimension.search off         → ○ searxng
+ *   pi-lean-dimension.search on + healthy → ● searxng (accent/blue)
+ *   pi-lean-dimension.search on + degraded → ● searxng (warning/yellow)
+ *   pi-lean-dimension.search on + unreachable → ● searxng (error/red)
  *   unconfigured           → (clear slot)
  */
 function renderSearchGlyph(ctx: {
@@ -154,13 +154,13 @@ function renderSearchGlyph(ctx: {
 		return;
 	}
 
-	// search.web disabled — show off state
+	// pi-lean-dimension.search disabled — show off state
 	if (!_lastSearchEnabled) {
 		safeSetStatus("○ searxng");
 		return;
 	}
 
-	// search.web enabled — show health-colored glyph
+	// pi-lean-dimension.search enabled — show health-colored glyph
 	if (!_lastHealth) {
 		safeSetStatus(ctx.ui.theme.fg("error", "●") + " searxng");
 		return;
@@ -193,15 +193,15 @@ export default function (pi: ExtensionAPI) {
 	// ── Register the web-search tool ─────────────────────────
 	pi.registerTool(webSearchTool);
 
-	// ── Define the search.web toolset ────────────────────────
+	// ── Define the pi-lean-dimension.search toolset ───────────
 	// Registers restore handler on session_start / session_tree.
 	const searchToolset = defineToolset(pi, SEARCH_WEB_SPEC);
 
-	// ── Co-activation: mirror portal.web changed events ──────
+	// ── Co-activation: mirror pi-lean-dimension.web changed events ─
 	// Listen on changed ONLY, not restored (§10.1).
 	pi.events.on(TOOLSET_EVENTS.changed, (data: unknown) => {
 		const event = data as ToolsetChangedEvent;
-		if (event.id === "portal.web") {
+		if (event.id === "pi-lean-dimension.web") {
 			if (event.enabled) {
 				searchToolset.enable(pi);
 			} else {
@@ -213,7 +213,7 @@ export default function (pi: ExtensionAPI) {
 	// ── Keep cached state in sync with library events ────────
 	const syncSearchState = (data: unknown) => {
 		const event = data as ToolsetChangedEvent;
-		if (event.id === "search.web") {
+		if (event.id === "pi-lean-dimension.search") {
 			_lastSearchEnabled = event.enabled;
 			if (_lastCtx) renderSearchGlyph(_lastCtx);
 		}

package/node_modules/pi-lean-search/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-lean-search",
-	"version": "0.3.0",
+	"version": "0.3.2",
 	"description": "Pi extension. SearXNG search tool for Pi — pairs with pi-lean-portal's /web toggle; search-only installs are valid, or add it to a portal install for the full web-tools suite.",
 	"keywords": [
 		"pi-package",
@@ -37,12 +37,14 @@
 		"prepack": "cp ../../LICENSE ./LICENSE",
 		"test": "vitest run"
 	},
+	"dependencies": {
+		"pi-tool-masking": "^1.0.0"
+	},
 	"peerDependencies": {
 		"@earendil-works/pi-ai": "*",
 		"@earendil-works/pi-coding-agent": "*",
 		"@earendil-works/pi-tui": "*",
 		"pi-lean-portal": "*",
-		"pi-tool-masking": "^1.0.0",
 		"typebox": "*"
 	},
 	"peerDependenciesMeta": {