pi-para 0.6.0 → 0.6.2

package/ARCHITECTURE.md

@@ -138,15 +138,6 @@ Tool API contracts and behavioral guidance are separated:
 - `src/tools.ts`: host registration, schemas, rendering, and execution only.
 - `src/context.ts`: injects the shared guidance once with wiki context so agents learn when to search, verify stale pages, and self-heal with `wiki_edit`.
 
-## GEPA optimizer
-
-GEPA lives in two layers:
-
-- `src/gepa/index.ts`: TypeScript target extraction/orchestration and CLI.
-- `scripts/gepa/`: Python/uv DSPy program, metric, dataset, custom LMs.
-
-It uses DSPy GEPA, not a custom TypeScript optimizer, and uses custom `dspy.BaseLM` providers for Anthropic OAuth/MiniMax/OpenRouter.
-
 ## Compatibility surfaces
 
 Kept temporarily:

package/CHANGELOG.md

@@ -2,6 +2,28 @@
 
 ## Unreleased
 
+## [0.6.2] — 2026-07-14
+
+### Added
+- `/wiki-settings` gained a `[Secrets]` menu (creates `~/.pi/para/secrets.json` with 0600 permissions on first save; add/update/remove API keys with redacted listing) and preset-based provider selection for embedding/rerank profiles (OpenAI, OpenRouter, Gemini, Mistral, Voyage, Jina, Ollama — base URL/API format/default model prefilled, with inline API key entry), plus `custom` manual entry.
+
+### Fixed
+- **Embeddings were never generated automatically.** Pi startup opens the QMD store with `backgroundEmbed: false` (for fast print-mode exits) and nothing called `embedIfNeeded()` afterwards, so searches silently stayed BM25-only even with a correct remote embedding provider. A new deduplicated `qmd-embed` scheduler task (cross-process lease, gated by `qmd.embedEnabled`) now drains the `needsEmbedding` backlog at interactive session startup and is chained after every `wiki-maintenance` reindex. Provider failures are recorded and retried with backoff; BM25 keeps working regardless. Print mode is unaffected.
+- `pi-para doctor` now reports vector-index availability, pending embedding count, and the active embedding provider/model/endpoint host (never credentials).
+
+## [0.6.1] — 2026-07-14
+
+### Removed
+- **GEPA prompt optimizer removed entirely** (`pi-para gepa` CLI, `src/gepa/`, the Python/uv DSPy pipeline under `scripts/gepa/`, bundled optimized prompts, and the `gepa` config section). It added Python/uv overhead to the package for a rarely used offline workflow. Existing `gepa` keys in user config files are ignored harmlessly.
+
+### Fixed
+- **npm 0.6.0 tarball shipped without `dist/`** (the tag-triggered publish workflow ran `npm publish` on a fresh checkout without building), which broke `npx pi-para setup`, the PowerShell installer, and the `pi-para` bin on all platforms. The publish workflow now runs `npm ci` + typecheck + tests + build, packs a tarball, asserts `dist/cli.js`/`dist/index.js` exist inside it, smoke-runs `setup --yes --dry-run` from the packed tarball, and publishes that exact tarball.
+- Added a `prepack` script (`npm run build`) as a second safeguard so `npm pack`/`npm publish` can never produce a dist-less artifact again.
+- Documentation now uses the correct Pi command `pi install npm:pi-para` (bare `pi install pi-para` is interpreted as a local path by Pi 0.80+).
+
+### Security
+- npm publishing now runs in the `npm-publish` GitHub environment (required reviewer approval + `v*` tag deployment policy), and a repository ruleset restricts `v*` tag creation/update/deletion to repo admins.
+
 ## [0.6.0] — 2026-07-14
 
 ### Breaking

package/CONFIGURATION.md

@@ -66,15 +66,6 @@ Planned/project-level overrides may use `<project>/.pi/para.jsonc` in a later sl
     "host": "127.0.0.1",
     "port": 10973,
     "launch": "manual"
-  },
-  "gepa": {
-    "useOptimized": false,
-    "studentModel": "anthropic/claude-sonnet-4-20250514",
-    "teacherModel": "anthropic/claude-opus-4-6",
-    "judgeModel": "anthropic/claude-sonnet-4-20250514",
-    "auto": "light",
-    "threads": 2,
-    "seed": 42
   }
 }
 ```
@@ -129,6 +120,11 @@ pi-para providers set-secret embedding <key>
 pi-para providers set-secret rerank <key>
 ```
 
+Or interactively inside Pi via `/wiki-settings`:
+
+- `[Secrets]` — lists stored keys (redacted), adds/updates/removes API keys. `~/.pi/para/secrets.json` is created automatically (0600) on first save.
+- `[Embedding]` / `[Rerank]` → `Provider` — pick from presets (OpenAI, OpenRouter, Gemini, Mistral, Voyage, Jina, Ollama) to prefill base URL/API format/default model, then optionally paste the API key in the same flow; or choose `custom` for a manual provider id + base URL.
+
 Inspect without leaking values:
 
 ```bash
@@ -218,20 +214,6 @@ Optional browser UI.
 | `port` | Port |
 | `launch` | `manual` or `disabled` |
 
-### `gepa`
-
-DSPy GEPA optimizer defaults.
-
-| Field | Meaning |
-|---|---|
-| `useOptimized` | Load optimized prompt overrides |
-| `studentModel` | Proxy/evaluation model |
-| `teacherModel` | Reflection/mutation model |
-| `judgeModel` | LLM-as-judge model |
-| `auto` | Budget preset: `light`, `medium`, `heavy` |
-| `threads` | Parallel eval threads |
-| `seed` | Reproducibility seed |
-
 ## Diagnostics
 
 ```bash

package/README.md

@@ -7,7 +7,7 @@ pi-para runs as a normal Pi extension: no required daemon, no `systemd`, and no
 ## Install
 
 ```bash
-pi install pi-para
+pi install npm:pi-para
 # or, for npm/npx setup flows:
 npx pi-para@latest setup
 ```
@@ -26,12 +26,14 @@ irm https://raw.githubusercontent.com/picassio/pi-para/main/scripts/install.ps1
 
 Restart Pi after installing or changing extension registration.
 
-Then run:
+Then run diagnostics:
 
 ```bash
-pi-para doctor
+npx -y pi-para@latest doctor
 ```
 
+> The `pi-para` command is only on your `PATH` after a global install (`npm install -g pi-para`). After `pi install npm:pi-para` or an `npx` setup, invoke the CLI with `npx -y pi-para@latest <command>` instead.
+
 ## What pi-para creates
 
 Default user files:
@@ -67,6 +69,8 @@ Legacy files such as `~/.pi/wiki/config.json`, `~/.pi/wiki/.daemon.sqlite`, and
 
 ### CLI
 
+Run these as `pi-para <command>` (global install) or `npx -y pi-para@latest <command>`:
+
 ```bash
 pi-para setup [--yes] [--dry-run] [--local PATH]
 pi-para doctor [--fix] [--json] [--test-capture-model]
@@ -79,7 +83,6 @@ pi-para capture-recent --hours 24
 pi-para providers
 pi-para providers set-secret <name> <value>
 pi-para providers remove-secret <name>
-pi-para gepa optimize --target capture-prompt
 ```
 
 `pi-para-daemon` remains as a temporary compatibility binary, but the primary runtime is the in-process scheduler. Legacy daemon status is available as `pi-para legacy-status` for troubleshooting old installs.
@@ -149,33 +152,6 @@ The optional web wiki can be enabled from `/wiki-settings`:
 
 It serves the wiki viewer/editor/graph on the configured host/port.
 
-## GEPA Prompt Optimizer
-
-pi-para can optimize prompts/tools/skills using DSPy GEPA via `uv` and custom DSPy `BaseLM` providers.
-
-Recommended roles:
-
-| Role | Default |
-|---|---|
-| Student | `anthropic/claude-sonnet-4-20250514` |
-| Teacher/reflection | `anthropic/claude-opus-4-6` |
-| Judge | `anthropic/claude-sonnet-4-20250514` |
-
-Examples:
-
-```bash
-pi-para gepa targets
-pi-para gepa optimize --target capture-prompt
-pi-para gepa optimize --target skill-para \
-  --student-model anthropic/claude-sonnet-4-20250514 \
-  --teacher-model anthropic/claude-opus-4-6 \
-  --judge-model anthropic/claude-sonnet-4-20250514
-pi-para gepa list
-pi-para gepa compare --target capture-prompt
-```
-
-GEPA uses `~/.pi/agent/auth.json`/custom providers; it does not use LiteLLM.
-
 ## Obsidian compatibility
 
 The wiki is plain markdown with YAML frontmatter and `[[wikilinks]]`. You can open `~/.pi/wiki/` as an Obsidian vault.

package/SETUP.md

@@ -11,7 +11,7 @@ This is the current setup flow for pi-para. It is cross-platform and does not re
 ## Standard install
 
 ```bash
-pi install pi-para
+pi install npm:pi-para
 ```
 
 Then restart Pi.
@@ -19,15 +19,17 @@ Then restart Pi.
 Run diagnostics:
 
 ```bash
-pi-para doctor
+npx -y pi-para@latest doctor
 ```
 
 If needed, apply safe repairs:
 
 ```bash
-pi-para doctor --fix
+npx -y pi-para@latest doctor --fix
 ```
 
+> `pi install npm:pi-para` and the `npx` setup flow do not put a global `pi-para` command on your `PATH`. Use `npx -y pi-para@latest <command>`, or `npm install -g pi-para` if you prefer the bare `pi-para` form used in the examples below.
+
 ## npx setup flow
 
 For a fresh machine or scripted install:

package/STRUCTURE.md

@@ -13,7 +13,6 @@ SETUP_SETTINGS_FLOW_PLAN.md
 package.json
 src/
 test/
-scripts/gepa/
 skills/
 ```
 
@@ -77,14 +76,6 @@ src/scheduler/
 └── session-capture.ts # completed-session registry and capture task handler
 ```
 
-### GEPA
-
-```text
-src/gepa/index.ts       # TS orchestration/CLI integration
-src/templates/prompts.ts
-scripts/gepa/           # uv/DSPy Python optimizer
-```
-
 ### Legacy/compatibility
 
 | Path | Purpose |

package/dist/atomic-write.d.ts

@@ -0,0 +1,2 @@
+export declare function atomicWriteFile(path: string, content: string, mode?: number): Promise<void>;
+//# sourceMappingURL=atomic-write.d.ts.map

package/dist/atomic-write.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"atomic-write.d.ts","sourceRoot":"","sources":["../src/atomic-write.ts"],"names":[],"mappings":"AAKA,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAWjG"}

package/dist/atomic-write.js

@@ -0,0 +1,18 @@
+import { closeSync, fsyncSync, openSync, renameSync, writeFileSync } from "node:fs";
+import { mkdir } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { randomUUID } from "node:crypto";
+export async function atomicWriteFile(path, content, mode) {
+    await mkdir(dirname(path), { recursive: true });
+    const tempPath = join(dirname(path), `.${randomUUID()}.tmp`);
+    const fd = openSync(tempPath, "w", mode);
+    try {
+        writeFileSync(fd, content, "utf-8");
+        fsyncSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+    renameSync(tempPath, path);
+}
+//# sourceMappingURL=atomic-write.js.map

package/dist/atomic-write.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"atomic-write.js","sourceRoot":"","sources":["../src/atomic-write.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACpF,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,OAAe,EAAE,IAAa;IAChF,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,UAAU,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACzC,IAAI,CAAC;QACH,aAAa,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACpC,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;IACD,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;AAC7B,CAAC"}

package/dist/capture.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Session knowledge capture — extracts insights from sessions into the wiki.
+ *
+ * Two modes:
+ * - Auto-capture on session_shutdown (standalone Agent with wiki tools)
+ * - Explicit capture via /wiki-capture command (standalone Agent)
+ *
+ * Both are fully automatic — no user confirmation prompts.
+ */
+import type { Model } from "@earendil-works/pi-ai";
+import type { AgentMessage } from "@earendil-works/pi-agent-core";
+import type { ModelRegistry } from "@earendil-works/pi-coding-agent";
+import type { QMDStore } from "qmd-engine";
+import type { ProjectScope } from "./scope.js";
+import type { PageRef } from "./wiki.js";
+import type { SessionDigest } from "./raw.js";
+export interface CaptureResult {
+    pagesCreated: PageRef[];
+    pagesUpdated: PageRef[];
+    skipped: boolean;
+    reason?: string;
+    digestEntry?: SessionDigest;
+}
+/**
+ * Called automatically on session_shutdown.
+ * Spins up a standalone Agent with wiki tools, aborts after timeoutMs.
+ */
+export declare function autoCapture(wikiDir: string, store: QMDStore, messages: AgentMessage[], scope: ProjectScope, sessionFile: string, model: Model<any>, modelRegistry: ModelRegistry, timeoutMs?: number, alreadyCaptured?: string[]): Promise<CaptureResult>;
+/**
+ * Called when user explicitly requests capture mid-session via /wiki-capture.
+ * Spins up a standalone Agent with wiki tools.
+ */
+export declare function explicitCapture(wikiDir: string, store: QMDStore, topic: string | undefined, messages: AgentMessage[], scope: ProjectScope, sessionFile: string, model: Model<any>, modelRegistry: ModelRegistry, alreadyCaptured?: string[]): Promise<CaptureResult>;
+//# sourceMappingURL=capture.d.ts.map

package/dist/capture.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capture.d.ts","sourceRoot":"","sources":["../src/capture.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAEnD,OAAO,KAAK,EAAE,YAAY,EAAc,MAAM,+BAA+B,CAAC;AAC9E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAAE,OAAO,EAAgB,MAAM,WAAW,CAAC;AAGvD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAO9C,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,OAAO,EAAE,CAAC;IACxB,YAAY,EAAE,OAAO,EAAE,CAAC;IACxB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,aAAa,CAAC;CAC7B;AAqMD;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,QAAQ,EACf,QAAQ,EAAE,YAAY,EAAE,EACxB,KAAK,EAAE,YAAY,EACnB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EACjB,aAAa,EAAE,aAAa,EAC5B,SAAS,CAAC,EAAE,MAAM,EAClB,eAAe,CAAC,EAAE,MAAM,EAAE,GACzB,OAAO,CAAC,aAAa,CAAC,CAkJxB;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,QAAQ,EACf,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,QAAQ,EAAE,YAAY,EAAE,EACxB,KAAK,EAAE,YAAY,EACnB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EACjB,aAAa,EAAE,aAAa,EAC5B,eAAe,CAAC,EAAE,MAAM,EAAE,GACzB,OAAO,CAAC,aAAa,CAAC,CAqHxB"}