specpi 0.21.0 → 0.22.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +12 -0
- package/NPM_RELEASE.md +15 -12
- package/README.md +65 -17
- package/SECURITY_MODEL.md +4 -4
- package/THIRD_PARTY.md +16 -13
- package/package.json +1 -1
- package/scripts/specpi.mjs +1 -1
- package/templates/AGENTS.md +3 -1
- package/templates/settings.json +9 -10
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,17 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## 0.22.0 - 2026-09-14
|
|
4
|
+
|
|
5
|
+
- Remove `pi-background-tasks` from the default setup to avoid its Anthropic message-history errors. Updates remove unchanged entries added by SpecPi and preserve user-managed installations. The other seven package versions stay the same.
|
|
6
|
+
- Pair this release with SpecPi Chat 0.8.0, which adds editable permission settings.
|
|
7
|
+
- Ask agents to keep replies, commits, and pull requests brief and written in plain language.
|
|
8
|
+
|
|
9
|
+
## 0.21.1 - 2026-09-14
|
|
10
|
+
|
|
11
|
+
- Restore the website's original typography, colors, Chat preview, theme switcher, and improvement diagram while keeping the new package base.
|
|
12
|
+
- Bring back the README's logo, product preview, badges, and navigation, and make detailed command instructions collapsible.
|
|
13
|
+
- Give npm's registry processing up to five minutes to finish before the publication readback check fails. Version 0.21.0 published correctly but became available after the previous one-minute check expired.
|
|
14
|
+
|
|
3
15
|
## 0.21.0 - 2026-09-14
|
|
4
16
|
|
|
5
17
|
This release resets SpecPi's base and removes previously shipped harness features. Both retained Pi extensions ship as part of SpecPi 0.21.0. SpecPi Chat 0.7.1 remains the separately packaged VS Code frontend and is aligned with the new base.
|
package/NPM_RELEASE.md
CHANGED
|
@@ -7,18 +7,19 @@ Publishing, tags, deprecation, ownership changes and GitHub Releases require exp
|
|
|
7
7
|
1. Choose an unused version; update `package.json`, the dated `CHANGELOG.md` entry, README, and the website. Check Chat's version and VSIX download links. Preserve historical changelog entries.
|
|
8
8
|
2. Validate:
|
|
9
9
|
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
10
|
+
```sh
|
|
11
|
+
npm install --ignore-scripts --omit=peer --no-package-lock
|
|
12
|
+
npm run check
|
|
13
|
+
npm run check:pi-package
|
|
14
|
+
npm run check:base
|
|
15
|
+
npm run check:site
|
|
16
|
+
npm publish --dry-run --ignore-scripts --provenance=false
|
|
17
|
+
npm pack --dry-run --json
|
|
18
|
+
git diff --check
|
|
19
|
+
```
|
|
20
|
+
|
|
21
|
+
Installer/Pi lifecycle tests must use disposable state, never a live profile. `check:base` requires network access and verifies the real seven-package base with isolated home/configuration paths. Review all default version changes, upstream lifecycle scripts, compatibility, and notices in `THIRD_PARTY.md`. Local dry runs disable provenance because they lack GitHub OIDC.
|
|
22
|
+
|
|
22
23
|
3. Review the diff, exact package manifest and artifact; obtain fresh read-only review for lifecycle, permissions and packaging changes.
|
|
23
24
|
4. After approval and passing PR checks, merge to `main`, then create the matching `v<version>` tag at the merge commit. Build Chat's VSIX with `npm --prefix vscode run package` and attach it to the GitHub Release. Publish the release to start the npm workflow and approve the protected `npm` environment if it requests review. Verify the website deployment and download links. If publication cannot complete, revert the release merge and use a new version for the next attempt.
|
|
24
25
|
|
|
@@ -26,6 +27,8 @@ Publishing, tags, deprecation, ownership changes and GitHub Releases require exp
|
|
|
26
27
|
|
|
27
28
|
`.github/workflows/npm-publish.yml` builds one immutable, checksummed candidate; validates that same tarball on Ubuntu, Windows and macOS; then publishes through approved GitHub OIDC with provenance. Stable releases use `latest`, prereleases `next`. Runs are serialized, existing versions are rejected and the candidate must advance its dist-tag. Registry readback must match version, integrity, dist-tag and attestation.
|
|
28
29
|
|
|
30
|
+
Registry processing can take several minutes after npm accepts a publication. The workflow polls for up to five minutes. If that readback times out, inspect the registry and verify the published artifact before taking further action; do not rerun publication for a version that already exists.
|
|
31
|
+
|
|
29
32
|
After publication, install the registry artifact into disposable state and exercise plan/install/doctor/uninstall. Check package-page links/images, license, provenance and dist-tag before announcing.
|
|
30
33
|
|
|
31
34
|
## First publication only
|
package/README.md
CHANGED
|
@@ -1,10 +1,38 @@
|
|
|
1
|
-
|
|
1
|
+
<p align="center">
|
|
2
|
+
<img src="https://tannermidd.github.io/SpecPi/logo.svg" width="88" alt="SpecPi logo">
|
|
3
|
+
</p>
|
|
2
4
|
|
|
3
|
-
|
|
5
|
+
<h1 align="center">SpecPi</h1>
|
|
4
6
|
|
|
5
|
-
|
|
7
|
+
<p align="center">Pi, beside your code.<br>Scope your work. Choose what improves. Keep your own Pi setup.</p>
|
|
6
8
|
|
|
7
|
-
|
|
9
|
+
<p align="center">
|
|
10
|
+
<a href="https://www.npmjs.com/package/specpi"><img src="https://img.shields.io/npm/v/specpi?style=flat-square&color=084bdb" alt="npm version"></a>
|
|
11
|
+
<a href="https://github.com/TannerMidd/SpecPi/actions/workflows/ci.yml"><img src="https://github.com/TannerMidd/SpecPi/actions/workflows/ci.yml/badge.svg?branch=main" alt="Build status"></a>
|
|
12
|
+
<a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-084bdb?style=flat-square" alt="MIT license"></a>
|
|
13
|
+
</p>
|
|
14
|
+
|
|
15
|
+
<p align="center">
|
|
16
|
+
<a href="#install">Install</a> · <a href="https://tannermidd.github.io/SpecPi/">Website</a> · <a href="https://tannermidd.github.io/SpecPi/wiki/">Documentation</a> · <a href="#vs-code">VS Code</a> · <a href="https://github.com/TannerMidd/SpecPi/releases">Releases</a>
|
|
17
|
+
</p>
|
|
18
|
+
|
|
19
|
+
<p align="center">
|
|
20
|
+
<a href="https://tannermidd.github.io/SpecPi/#vscode-chat">
|
|
21
|
+
<picture>
|
|
22
|
+
<source media="(prefers-color-scheme: dark)" srcset="https://tannermidd.github.io/SpecPi/media/specpi-chat.png">
|
|
23
|
+
<img src="https://tannermidd.github.io/SpecPi/media/specpi-chat-light.png" width="1100" alt="SpecPi Chat beside a file in VS Code, discussing a focused code change with a file attached.">
|
|
24
|
+
</picture>
|
|
25
|
+
</a>
|
|
26
|
+
</p>
|
|
27
|
+
<p align="center"><sub>SpecPi Chat · Example workspace</sub></p>
|
|
28
|
+
|
|
29
|
+
SpecPi is a small base for the [Pi coding agent](https://pi.dev/). Its own extensions provide **scope control** and a **harness improvement loop**. Seven upstream packages handle the supporting tools, and **SpecPi Chat 0.8.0** brings them into VS Code.
|
|
30
|
+
|
|
31
|
+
| Keep the work focused | Improve what gets in the way | Work beside your code |
|
|
32
|
+
| --------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------- |
|
|
33
|
+
| Declare files and directories with `/scope`. Review drift as the task progresses. | Record recurring problems locally. Choose a change through `/harness-improvement` and verify it. | Chat, attach files, follow subagents, review approvals, and inspect changes in VS Code. |
|
|
34
|
+
|
|
35
|
+
> **Moving from 0.20 or earlier?** The 0.21 base removes the old custom tools, extra commands, themes, and shell profiles. Read [updating and removal](#update-and-remove) before switching.
|
|
8
36
|
|
|
9
37
|
## Install
|
|
10
38
|
|
|
@@ -19,22 +47,26 @@ specpi doctor
|
|
|
19
47
|
|
|
20
48
|
Inspect the plan, confirm the install, then restart Pi. SpecPi installs two first-party extensions, the improvement skill, a marked working agreement, and the packages below using `pi install`. Provider and model settings are preserved. There are no additional SpecPi extensions, themes, shell profiles, tool wrappers, or browser bootstrap scripts.
|
|
21
49
|
|
|
50
|
+
<details>
|
|
51
|
+
<summary>Source checkouts, alternate Pi paths, and core-only installs</summary>
|
|
52
|
+
|
|
22
53
|
For this checkout, run `node scripts/specpi.mjs` in place of `specpi`. `PI_CODING_AGENT_DIR` selects an alternate destination; `SPECPI_PI` selects a Pi CLI path. `specpi install --skip-package-install` installs only the first-party core for offline use and testing. A plain `pi install npm:specpi` loads only the packaged first-party resources; use the SpecPi installer above for the complete base, and avoid installing the same first-party resources both ways.
|
|
23
54
|
|
|
55
|
+
</details>
|
|
56
|
+
|
|
24
57
|
## Default packages
|
|
25
58
|
|
|
26
59
|
These are installed on every normal install and update. Exact versions live in [`templates/settings.json`](templates/settings.json); SpecPi merges only the package entries, preserving unrelated configuration and existing resource filters.
|
|
27
60
|
|
|
28
|
-
| Package
|
|
29
|
-
|
|
|
30
|
-
| [pi-web-access](https://github.com/nicobailon/pi-web-access)
|
|
31
|
-
| [betterwright](https://github.com/BetterWright/betterwright)
|
|
32
|
-
| [pi-subagents](https://github.com/nicobailon/pi-subagents)
|
|
33
|
-
| [pi-lens](https://github.com/apmantza/pi-lens)
|
|
34
|
-
| [pi-
|
|
35
|
-
| [pi-
|
|
36
|
-
| [@
|
|
37
|
-
| [@gotgenes/pi-permission-system](https://github.com/gotgenes/pi-packages/tree/main/packages/pi-permission-system) | 32.0.2 | Tool permission policies |
|
|
61
|
+
| Package | Pinned version | Purpose |
|
|
62
|
+
| ----------------------------------------------------------------------------------------------------------------- | -------------- | ------------------------------------------------------ |
|
|
63
|
+
| [pi-web-access](https://github.com/nicobailon/pi-web-access) | 0.29.0 | Web search and page retrieval |
|
|
64
|
+
| [betterwright](https://github.com/BetterWright/betterwright) | 2.8.1 | Browser automation |
|
|
65
|
+
| [pi-subagents](https://github.com/nicobailon/pi-subagents) | 0.67.0 | Subagents and delegation |
|
|
66
|
+
| [pi-lens](https://github.com/apmantza/pi-lens) | 4.1.6 | Language diagnostics, navigation, and structural tools |
|
|
67
|
+
| [pi-goal-x](https://github.com/tmonk/pi-goal-x) | 0.31.2 | Persistent goals and progress |
|
|
68
|
+
| [@sreetej510/pi-usage](https://github.com/Sreetej510/pi-extensions/tree/main/extensions/pi-usage) | 0.10.0 | Provider usage reporting |
|
|
69
|
+
| [@gotgenes/pi-permission-system](https://github.com/gotgenes/pi-packages/tree/main/packages/pi-permission-system) | 32.0.2 | Tool permission policies |
|
|
38
70
|
|
|
39
71
|
The effective commands are `pi install npm:<package>@<version>` for each row, including the scoped names. These packages supply their own extensions, tools, skills, and prompts according to their upstream defaults. SpecPi does not add a second implementation or configure their policies.
|
|
40
72
|
|
|
@@ -44,12 +76,19 @@ BetterWright's browser is a separate upstream setup step: install Bun 1.4+ and r
|
|
|
44
76
|
|
|
45
77
|
## VS Code
|
|
46
78
|
|
|
47
|
-
[SpecPi Chat](https://github.com/TannerMidd/SpecPi/blob/main/vscode/README.md) provides the chat sidebar, file and image attachments, conversation history, tool output, package commands, and approval dialogs. Version **0.
|
|
79
|
+
[SpecPi Chat](https://github.com/TannerMidd/SpecPi/blob/main/vscode/README.md) provides the chat sidebar, file and image attachments, conversation history, tool output, package commands, and approval dialogs. Version **0.8.0** lets you edit global or project permission settings, confirm changes, and keep a backup. The VSIX remains separate from the npm harness package.
|
|
48
80
|
|
|
49
|
-
Download the [0.
|
|
81
|
+
Download the [0.8.0 VSIX](https://github.com/TannerMidd/SpecPi/releases/download/v0.22.0/specpi-chat-0.8.0.vsix), then run **Extensions: Install from VSIX…** in VS Code. Install/update SpecPi separately, then restart Pi in Chat to reload its extensions.
|
|
82
|
+
|
|
83
|
+
[Download Chat](https://github.com/TannerMidd/SpecPi/releases/download/v0.22.0/specpi-chat-0.8.0.vsix) · [Chat guide](https://github.com/TannerMidd/SpecPi/blob/main/vscode/GUIDE.md) · [Build from source](https://github.com/TannerMidd/SpecPi/blob/main/vscode/DEVELOPMENT.md)
|
|
50
84
|
|
|
51
85
|
## Scope
|
|
52
86
|
|
|
87
|
+
Declare the files and directories a task should touch with `/scope set`, then use `/scope status` to review drift.
|
|
88
|
+
|
|
89
|
+
<details>
|
|
90
|
+
<summary>Scope commands</summary>
|
|
91
|
+
|
|
53
92
|
- `/scope set`: declare project-relative files or directories, one per line.
|
|
54
93
|
- `/scope status`: review declared paths, pending drift, and snapshot uncertainty.
|
|
55
94
|
- `/scope add <path>` or `/scope remove <path>`: change the declared scope.
|
|
@@ -58,10 +97,17 @@ Download the [0.7.1 VSIX](https://github.com/TannerMidd/SpecPi/releases/download
|
|
|
58
97
|
- `/scope clear`: turn monitoring off.
|
|
59
98
|
- `/scope task`: import the active improvement contract's paths explicitly.
|
|
60
99
|
|
|
100
|
+
</details>
|
|
101
|
+
|
|
61
102
|
Interactive writes and edits outside scope ask before proceeding. In headless mode they are recorded as pending. Other tools are checked afterward against bounded Git snapshots. Scope is a drift monitor, not a sandbox: shell commands and custom tools can already have changed files when drift is reported. State follows the current Pi session branch.
|
|
62
103
|
|
|
63
104
|
## Harness improvement loop
|
|
64
105
|
|
|
106
|
+
<picture>
|
|
107
|
+
<source media="(prefers-color-scheme: dark)" srcset="https://tannermidd.github.io/SpecPi/media/improvement-workflow-dark.svg">
|
|
108
|
+
<img src="https://tannermidd.github.io/SpecPi/media/improvement-workflow.svg" width="1200" alt="Observe a recurring gap, select one change, modify the harness, test it, retire with evidence, and review later outcomes.">
|
|
109
|
+
</picture>
|
|
110
|
+
|
|
65
111
|
1. Enable local observations with `/wishlist on`; collection is off by default. `/wishlist off` stops it.
|
|
66
112
|
2. Review recurring gaps with `/wishlist` and select one through `/harness-improvement` in a complete SpecPi source checkout.
|
|
67
113
|
3. Follow the `specpi-improve` skill: record a bounded contract, implement the smallest sufficient change, and gather direct acceptance evidence.
|
|
@@ -82,6 +128,8 @@ specpi uninstall
|
|
|
82
128
|
|
|
83
129
|
Install, update, and uninstall require confirmation; `--yes` supplies it for automation. Modified retained resources require `update --force`. Managed configuration and resources are backed up and checksum-tracked. `update --skip-package-install` preserves an existing base without invoking Pi's package installer. Normal updates reapply the reviewed pins.
|
|
84
130
|
|
|
131
|
+
`pi-background-tasks` is no longer included by default because its Anthropic wrapper can reject changing message context. A normal update removes an unchanged package entry originally added by SpecPi; pre-existing or user-modified entries and downloaded files remain. `--skip-package-install` preserves the old base. To remove a separately retained installation, run `pi remove npm:pi-background-tasks` in its installation scope, then restart Pi.
|
|
132
|
+
|
|
85
133
|
Updating from the larger harness retires its recorded extra resources, restores legacy settings that still match ownership records, removes its shell marker block, and installs the new package base. Modified retired files and old runtime directories are preserved under `<agent-dir>/specpi/backups/`. Restart Pi to unload the old extensions. Unrelated configuration and local improvement evidence remain intact.
|
|
86
134
|
|
|
87
135
|
Uninstall restores package entries that still match SpecPi's recorded changes and preserves subsequent user edits. Downloaded packages, npm caches, upstream configuration, and private evidence remain on disk. A failed install rolls back SpecPi-managed files and configuration; package downloads and upstream install-script effects cannot be rolled back. `doctor` checks the core, package settings, and installed top-level package versions without activating upstream tools.
|
|
@@ -96,7 +144,7 @@ npm run check:pi-package
|
|
|
96
144
|
npm run check:base
|
|
97
145
|
```
|
|
98
146
|
|
|
99
|
-
Installer tests use disposable Pi directories. `check:base` requires network access, installs the real
|
|
147
|
+
Installer tests use disposable Pi directories. `check:base` requires network access, installs the real seven packages in isolated state, loads them together through Pi 0.84.4, verifies Chat RPC startup and explicit permission replies, and checks removal. It does not send model requests or run browser tasks. Never test against a live Pi installation. Publication remains explicit and uses the [release procedure](NPM_RELEASE.md).
|
|
100
148
|
|
|
101
149
|
The website is static HTML and CSS in `site/`. After installing the pinned Playwright browser with `npx --no-install playwright install chromium`, run `npm run check:site` to check versions, links, and desktop, tablet, and mobile layouts. GitHub Pages deploys it from `main` after those checks pass.
|
|
102
150
|
|
package/SECURITY_MODEL.md
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
# Security model
|
|
2
2
|
|
|
3
|
-
SpecPi provides scope monitoring and an explicit harness improvement loop, and installs
|
|
3
|
+
SpecPi provides scope monitoring and an explicit harness improvement loop, and installs seven upstream packages as its default base. Extensions run as trusted code with Pi's permissions. Scope is not an OS sandbox or a general command guard. Use OS isolation for hostile code.
|
|
4
4
|
|
|
5
5
|
## Scope monitoring
|
|
6
6
|
|
|
@@ -20,7 +20,7 @@ Wishlist records remain local under `<agent-dir>/specpi/`. Sanitization and salt
|
|
|
20
20
|
|
|
21
21
|
Package acquisition requests exact npm dependency saves through the child process environment and verifies the installed top-level versions before completing the transaction. A mismatch fails the operation and triggers managed-state rollback. Upstream transitive dependency ranges remain outside this pinning guarantee.
|
|
22
22
|
|
|
23
|
-
`plan` is read-only. Installation, updates, and removal require confirmation or `--yes`. SpecPi manages its two first-party extension families, improvement skill, manifest, AGENTS marker block, and the
|
|
23
|
+
`plan` is read-only. Installation, updates, and removal require confirmation or `--yes`. SpecPi manages its two first-party extension families, improvement skill, manifest, AGENTS marker block, and the seven package entries listed in `templates/settings.json`. Normal install/update runs `pi install npm:<name>@<pin>` for every default package. Only package entries are merged; existing resource filters and unrelated settings are retained. `--skip-package-install` allows a core-only install or preserves an already configured base during update. No new shell profile integration is installed.
|
|
24
24
|
|
|
25
25
|
Managed configuration and files are locked and backed up before mutation; first-party writes are atomic and checksum-tracked. Failure restores the saved configuration and first-party files. Package acquisition runs upstream package-manager scripts and may leave downloads, dependency changes, or external script effects even after configuration rollback. Those effects are outside SpecPi's transaction. Updates require `--force` before replacing modified retained resources. Retired resources are backed up before deactivation; pre-install files are restored where ownership records identify them. Old runtime directories are moved into backups without inspecting their contents. Backups and private evidence remain after uninstall and can contain sensitive local material.
|
|
26
26
|
|
|
@@ -30,11 +30,11 @@ Legacy migration restores only recorded settings ownership, preserves differing
|
|
|
30
30
|
|
|
31
31
|
SpecPi Chat is a separate VSIX, retained alongside the npm harness. It launches Pi only in a trusted filesystem workspace and communicates over local RPC. Provider credentials stay with Pi. The frontend manages only its own workspace-storage conversation catalog and sessions for user-directed history, branching, and export; it does not import unrelated Pi histories. Attachments, images, webview messages, and file navigation are validated and bounded. Rendered model and tool output is untrusted text, never executable HTML.
|
|
32
32
|
|
|
33
|
-
Approval replies are tied to the current conversation, client, and request ID. Disconnect, cancellation, and expiry never grant permission. Multiline package approval context is shown in the dialog body; requests exceeding the display budget are cancelled rather than approved against incomplete context. The Permissions
|
|
33
|
+
Approval replies are tied to the current conversation, client, and request ID. Disconnect, cancellation, and expiry never grant permission. Multiline package approval context is shown in the dialog body; requests exceeding the display budget are cancelled rather than approved against incomplete context. The Permissions editor can change only the package's documented global/project `config.json`, with bounded UTF-8/schema validation, explicit native confirmation, connection/scope binding, stale-revision checks, private backups, and atomic replacement. It reads no permission logs, trust decisions, credentials, or agent frontmatter. Symlinks, hardlinks, and special files are refused. Backups remain local and may contain sensitive policy; another same-user process can still race filesystem operations. Saving does not claim runtime activation: the user can restart the selected chat and inspect `/permission-system show`. Global/project changes may affect other chats as upstream reloads them; session approvals are cleared by restart. pi-subagents activity comes from a read-only, connection-local public event adapter that registers no tools or commands. The VSIX does not install packages or duplicate their enforcement; only Permission System configuration has an explicit editing UI. TUI-only custom components are outside Pi's RPC rendering support.
|
|
34
34
|
|
|
35
35
|
## Upstream package boundary
|
|
36
36
|
|
|
37
|
-
The
|
|
37
|
+
The seven packages add their own extensions, tools, prompts, skills, network connections, filesystem operations, and subprocesses under their upstream defaults. They are not confined by the improvement loop's selection requirement. Permission System owns tool policies; SpecPi does not inject a duplicate guard or claim its coverage. Pi Lens can apply configured formatting/autofixes. Subagents can start other processes. `pi-background-tasks` and its Anthropic provider wrapper are no longer part of the default base; independently retained installations remain trusted upstream code. Web access and usage reporting can contact services and use credentials through their upstream implementations. SpecPi's local-only wishlist collection policy does not describe all activity of those packages.
|
|
38
38
|
|
|
39
39
|
Top-level versions are pinned; upstream transitive dependency ranges are not frozen by SpecPi. `doctor` reads configured pins and installed package metadata without invoking tools or validating provider access. `check:base` acquires the packages, checks combined resource loading and Chat RPC startup, and exercises upstream approval, denial, and cancellation with synthetic context. It uses temporary home/configuration directories and sends no model prompt. Browser setup, authenticated services, OS isolation, and every upstream tool's behavior are outside that check. See [THIRD_PARTY.md](THIRD_PARTY.md) for sources and compatibility limits.
|
|
40
40
|
|
package/THIRD_PARTY.md
CHANGED
|
@@ -11,23 +11,26 @@ Development formatting uses Prettier **3.9.6** (MIT), ESLint **10.9.1** (MIT), `
|
|
|
11
11
|
|
|
12
12
|
## Default upstream packages
|
|
13
13
|
|
|
14
|
-
Reviewed on 2026-09-14 against published npm metadata and integrity-verified source archives. All
|
|
14
|
+
Reviewed on 2026-09-14 against published npm metadata and integrity-verified source archives. All seven top-level packages declare the MIT license. Pins are authoritative in `templates/settings.json`.
|
|
15
15
|
|
|
16
16
|
SpecPi requests exact npm dependency saves for these pins and checks installed top-level versions before completing installation. The override applies to package acquisition without changing the user's global npm configuration.
|
|
17
17
|
|
|
18
|
-
| Package
|
|
19
|
-
|
|
|
20
|
-
| pi-web-access
|
|
21
|
-
| betterwright
|
|
22
|
-
| pi-subagents
|
|
23
|
-
| pi-lens
|
|
24
|
-
| pi-
|
|
25
|
-
| pi-
|
|
26
|
-
| @
|
|
27
|
-
| @gotgenes/pi-permission-system | 32.0.2 | [gotgenes/pi-packages](https://github.com/gotgenes/pi-packages) |
|
|
18
|
+
| Package | Version | Upstream |
|
|
19
|
+
| ------------------------------ | ------- | ------------------------------------------------------------------------- |
|
|
20
|
+
| pi-web-access | 0.29.0 | [nicobailon/pi-web-access](https://github.com/nicobailon/pi-web-access) |
|
|
21
|
+
| betterwright | 2.8.1 | [BetterWright/betterwright](https://github.com/BetterWright/betterwright) |
|
|
22
|
+
| pi-subagents | 0.67.0 | [nicobailon/pi-subagents](https://github.com/nicobailon/pi-subagents) |
|
|
23
|
+
| pi-lens | 4.1.6 | [apmantza/pi-lens](https://github.com/apmantza/pi-lens) |
|
|
24
|
+
| pi-goal-x | 0.31.2 | [tmonk/pi-goal-x](https://github.com/tmonk/pi-goal-x) |
|
|
25
|
+
| @sreetej510/pi-usage | 0.10.0 | [Sreetej510/pi-extensions](https://github.com/Sreetej510/pi-extensions) |
|
|
26
|
+
| @gotgenes/pi-permission-system | 32.0.2 | [gotgenes/pi-packages](https://github.com/gotgenes/pi-packages) |
|
|
28
27
|
|
|
29
28
|
Transitive dependencies and their notices remain in Pi's npm installation tree. Top-level pins do not freeze upstream dependency ranges or constitute a full transitive security audit. Pi invokes npm with its upstream package-management semantics, including dependency lifecycle scripts. BetterWright has no browser-download install hook; its separate setup requires Bun 1.4+ and fetches its managed browser. Pi Lens includes native structural tooling and bundled grammars; configured diagnostics and autofixes may invoke additional tools. Pi Subagents includes `@earendil-works/pi-server`. Usage reporting and web packages make their own provider/service connections. Consult upstream licenses and security policies before redistributing their components.
|
|
30
29
|
|
|
31
|
-
The combined base is tested with Pi 0.84.4. Pi Goal X declares Pi `>=0.83.0 <0.85.0`; compatibility with newer hosts is not assumed. SpecPi's former custom browser, structural-search, delegation, background-task, and command-guard implementations, DonSeTch,
|
|
30
|
+
The combined base is tested with Pi 0.84.4. Pi Goal X declares Pi `>=0.83.0 <0.85.0`; compatibility with newer hosts is not assumed. SpecPi's former custom browser, structural-search, delegation, background-task, and command-guard implementations, DonSeTch, and Pi themes have been removed. Removal restores owned package settings but does not delete downloaded upstream packages or tools. Retired private runtimes remain in local backups with their notices.
|
|
32
31
|
|
|
33
|
-
|
|
32
|
+
## Website and README
|
|
33
|
+
|
|
34
|
+
The website uses the bundled IBM Plex Sans and Plex Mono fonts under the SIL Open Font License 1.1; see [`site/fonts/LICENSE.txt`](https://github.com/TannerMidd/SpecPi/blob/main/site/fonts/LICENSE.txt). The website's scripts and diagrams are first-party code and assets. The README loads public package/license badges from Shields.io and build status from GitHub. Website fonts and media are not included in the npm package.
|
|
35
|
+
|
|
36
|
+
SpecPi Chat 0.8.0 is a separately packaged VS Code extension with no bundled runtime dependencies. It uses VS Code's host APIs and Pi's RPC protocol. Its read-only pi-subagents adapter consumes the upstream `fleetStatus` v1 contract reviewed at 0.67.0. Generic tool output, visible custom messages, widgets, and dialogs stay owned by their upstream packages. Playwright **1.62.1** (Apache-2.0, [Microsoft Playwright](https://github.com/microsoft/playwright)) is a pinned development dependency for Chat's rendering tests; its browser is installed only for those checks and is not shipped in either artifact.
|
package/package.json
CHANGED
package/scripts/specpi.mjs
CHANGED
|
@@ -56,7 +56,7 @@ Usage:
|
|
|
56
56
|
specpi doctor
|
|
57
57
|
specpi uninstall [--yes]
|
|
58
58
|
|
|
59
|
-
Installs /scope, the harness improvement loop, and
|
|
59
|
+
Installs /scope, the harness improvement loop, and seven pinned upstream packages.
|
|
60
60
|
The base is tested with Pi 0.84.4. Run specpi plan to see package versions.
|
|
61
61
|
--skip-package-install installs only the core, or preserves an existing base on update.
|
|
62
62
|
--force replaces modified retained resources after backing them up.
|
package/templates/AGENTS.md
CHANGED
|
@@ -2,8 +2,10 @@
|
|
|
2
2
|
|
|
3
3
|
- Keep changes small, testable, reversible, and tied to the human's request. Inspect existing code and guidance before editing; avoid adjacent feature accumulation.
|
|
4
4
|
- Prefer direct work and existing project tools. Ask concise questions only when material requirements are unclear.
|
|
5
|
+
- Keep replies brief and human-readable. Lead with the answer, use plain language, and avoid jargon, technical babble, and repetitive progress updates. Include technical detail only when it helps the human decide or act.
|
|
6
|
+
- Write commits and pull requests the same way: a short, clear title and a brief explanation of what changed, why, and what was tested. Avoid boilerplate, inflated claims, and unnecessary implementation detail.
|
|
5
7
|
- When `/scope` is active, keep outside-scope findings pending until the human allows once, acknowledges them with `/scope accept`, expands scope with `/scope add`, or clears it. Acknowledgement does not widen scope.
|
|
6
8
|
- Treat wishlist observations as leads, not authorization. Start a wishlist-sourced change only from an exact `/harness-improvement` selection and follow `specpi-improve`. Record its contract before editing and retire only after its verification gate passes.
|
|
7
9
|
- Never inspect Pi authentication, provider credentials, trust decisions, sessions, missions, or history to improve the harness. Use only the active extension context and intended local improvement records.
|
|
8
10
|
- Use observed files, diffs, tests, and runtime behavior as evidence. Run relevant checks, inspect the final diff, and obtain fresh read-only review when risk warrants it. Report results and residual risks without claiming more than the checks prove.
|
|
9
|
-
- Do not commit, push, publish, deploy, or alter remote state unless explicitly requested.
|
|
11
|
+
- Do not commit, push, publish, deploy, or alter remote state unless explicitly requested.
|
package/templates/settings.json
CHANGED
|
@@ -1,12 +1,11 @@
|
|
|
1
1
|
{
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
]
|
|
2
|
+
"packages": [
|
|
3
|
+
"npm:pi-web-access@0.29.0",
|
|
4
|
+
"npm:betterwright@2.8.1",
|
|
5
|
+
"npm:pi-subagents@0.67.0",
|
|
6
|
+
"npm:pi-lens@4.1.6",
|
|
7
|
+
"npm:pi-goal-x@0.31.2",
|
|
8
|
+
"npm:@sreetej510/pi-usage@0.10.0",
|
|
9
|
+
"npm:@gotgenes/pi-permission-system@32.0.2"
|
|
10
|
+
]
|
|
12
11
|
}
|