specpi 0.22.0 → 0.22.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +5 -0
- package/NPM_RELEASE.md +1 -1
- package/README.md +8 -7
- package/SECURITY_MODEL.md +3 -3
- package/THIRD_PARTY.md +5 -4
- package/package.json +1 -1
- package/scripts/specpi.mjs +1 -1
- package/templates/settings.json +0 -1
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,10 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## 0.22.1 - 2026-09-14
|
|
4
|
+
|
|
5
|
+
- Remove `pi-lens` from the default base. The other six package pins are unchanged. Normal managed updates remove unchanged Lens entries added by SpecPi; pre-existing or user-modified entries and downloaded files remain. `--skip-package-install` preserves the old base. Restart Pi and Chat connections to unload Lens.
|
|
6
|
+
- Align package documentation and release links with SpecPi Chat 0.8.1; no Chat UI or host behavior changes.
|
|
7
|
+
|
|
3
8
|
## 0.22.0 - 2026-09-14
|
|
4
9
|
|
|
5
10
|
- Remove `pi-background-tasks` from the default setup to avoid its Anthropic message-history errors. Updates remove unchanged entries added by SpecPi and preserve user-managed installations. The other seven package versions stay the same.
|
package/NPM_RELEASE.md
CHANGED
|
@@ -18,7 +18,7 @@ Publishing, tags, deprecation, ownership changes and GitHub Releases require exp
|
|
|
18
18
|
git diff --check
|
|
19
19
|
```
|
|
20
20
|
|
|
21
|
-
Installer/Pi lifecycle tests must use disposable state, never a live profile. `check:base` requires network access and verifies the real
|
|
21
|
+
Installer/Pi lifecycle tests must use disposable state, never a live profile. `check:base` requires network access and verifies the real six-package base with isolated home/configuration paths. Review all default version changes, upstream lifecycle scripts, compatibility, and notices in `THIRD_PARTY.md`. Local dry runs disable provenance because they lack GitHub OIDC.
|
|
22
22
|
|
|
23
23
|
3. Review the diff, exact package manifest and artifact; obtain fresh read-only review for lifecycle, permissions and packaging changes.
|
|
24
24
|
4. After approval and passing PR checks, merge to `main`, then create the matching `v<version>` tag at the merge commit. Build Chat's VSIX with `npm --prefix vscode run package` and attach it to the GitHub Release. Publish the release to start the npm workflow and approve the protected `npm` environment if it requests review. Verify the website deployment and download links. If publication cannot complete, revert the release merge and use a new version for the next attempt.
|
package/README.md
CHANGED
|
@@ -26,7 +26,7 @@
|
|
|
26
26
|
</p>
|
|
27
27
|
<p align="center"><sub>SpecPi Chat · Example workspace</sub></p>
|
|
28
28
|
|
|
29
|
-
SpecPi is a small base for the [Pi coding agent](https://pi.dev/). Its own extensions provide **scope control** and a **harness improvement loop**.
|
|
29
|
+
SpecPi is a small base for the [Pi coding agent](https://pi.dev/). Its own extensions provide **scope control** and a **harness improvement loop**. Six upstream packages handle the supporting tools, and **SpecPi Chat 0.8.1** brings them into VS Code.
|
|
30
30
|
|
|
31
31
|
| Keep the work focused | Improve what gets in the way | Work beside your code |
|
|
32
32
|
| --------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------- |
|
|
@@ -63,7 +63,6 @@ These are installed on every normal install and update. Exact versions live in [
|
|
|
63
63
|
| [pi-web-access](https://github.com/nicobailon/pi-web-access) | 0.29.0 | Web search and page retrieval |
|
|
64
64
|
| [betterwright](https://github.com/BetterWright/betterwright) | 2.8.1 | Browser automation |
|
|
65
65
|
| [pi-subagents](https://github.com/nicobailon/pi-subagents) | 0.67.0 | Subagents and delegation |
|
|
66
|
-
| [pi-lens](https://github.com/apmantza/pi-lens) | 4.1.6 | Language diagnostics, navigation, and structural tools |
|
|
67
66
|
| [pi-goal-x](https://github.com/tmonk/pi-goal-x) | 0.31.2 | Persistent goals and progress |
|
|
68
67
|
| [@sreetej510/pi-usage](https://github.com/Sreetej510/pi-extensions/tree/main/extensions/pi-usage) | 0.10.0 | Provider usage reporting |
|
|
69
68
|
| [@gotgenes/pi-permission-system](https://github.com/gotgenes/pi-packages/tree/main/packages/pi-permission-system) | 32.0.2 | Tool permission policies |
|
|
@@ -72,15 +71,15 @@ The effective commands are `pi install npm:<package>@<version>` for each row, in
|
|
|
72
71
|
|
|
73
72
|
SpecPi requests exact npm dependency saves for these installs and verifies installed versions before completing the transaction. This keeps later package installs from advancing an earlier pin through npm's default version ranges.
|
|
74
73
|
|
|
75
|
-
BetterWright's browser is a separate upstream setup step: install Bun 1.4+ and run `bunx betterwright@2.8.1 setup` before using browser tools. See [BetterWright setup](https://github.com/BetterWright/betterwright/blob/main/SETUP.md). The default package installation does not install Bun or download its browser. Provider credentials, web-service configuration,
|
|
74
|
+
BetterWright's browser is a separate upstream setup step: install Bun 1.4+ and run `bunx betterwright@2.8.1 setup` before using browser tools. See [BetterWright setup](https://github.com/BetterWright/betterwright/blob/main/SETUP.md). The default package installation does not install Bun or download its browser. Provider credentials, web-service configuration, and permission rules remain governed by each package's documentation. Package installation and extension loading do not prove that every external service or tool is ready.
|
|
76
75
|
|
|
77
76
|
## VS Code
|
|
78
77
|
|
|
79
|
-
[SpecPi Chat](https://github.com/TannerMidd/SpecPi/blob/main/vscode/README.md) provides the chat sidebar, file and image attachments, conversation history, tool output, package commands, and approval dialogs. Version **0.8.
|
|
78
|
+
[SpecPi Chat](https://github.com/TannerMidd/SpecPi/blob/main/vscode/README.md) provides the chat sidebar, file and image attachments, conversation history, tool output, package commands, and approval dialogs. Version **0.8.1** lets you edit global or project permission settings, confirm changes, and keep a backup. The VSIX remains separate from the npm harness package.
|
|
80
79
|
|
|
81
|
-
Download the [0.8.
|
|
80
|
+
Download the [0.8.1 VSIX](https://github.com/TannerMidd/SpecPi/releases/download/v0.22.1/specpi-chat-0.8.1.vsix), then run **Extensions: Install from VSIX…** in VS Code. Install/update SpecPi separately, then restart Pi in Chat to reload its extensions.
|
|
82
81
|
|
|
83
|
-
[Download Chat](https://github.com/TannerMidd/SpecPi/releases/download/v0.22.
|
|
82
|
+
[Download Chat](https://github.com/TannerMidd/SpecPi/releases/download/v0.22.1/specpi-chat-0.8.1.vsix) · [Chat guide](https://github.com/TannerMidd/SpecPi/blob/main/vscode/GUIDE.md) · [Build from source](https://github.com/TannerMidd/SpecPi/blob/main/vscode/DEVELOPMENT.md)
|
|
84
83
|
|
|
85
84
|
## Scope
|
|
86
85
|
|
|
@@ -128,6 +127,8 @@ specpi uninstall
|
|
|
128
127
|
|
|
129
128
|
Install, update, and uninstall require confirmation; `--yes` supplies it for automation. Modified retained resources require `update --force`. Managed configuration and resources are backed up and checksum-tracked. `update --skip-package-install` preserves an existing base without invoking Pi's package installer. Normal updates reapply the reviewed pins.
|
|
130
129
|
|
|
130
|
+
`pi-lens` is no longer included by default. A normal managed update removes unchanged Lens entries originally added by SpecPi; pre-existing or user-modified entries and downloaded files remain. `--skip-package-install` preserves the old base. Restart Pi and each Chat connection to unload Lens. Independently retained installations require separate user management (`pi remove npm:pi-lens` in their installation scope).
|
|
131
|
+
|
|
131
132
|
`pi-background-tasks` is no longer included by default because its Anthropic wrapper can reject changing message context. A normal update removes an unchanged package entry originally added by SpecPi; pre-existing or user-modified entries and downloaded files remain. `--skip-package-install` preserves the old base. To remove a separately retained installation, run `pi remove npm:pi-background-tasks` in its installation scope, then restart Pi.
|
|
132
133
|
|
|
133
134
|
Updating from the larger harness retires its recorded extra resources, restores legacy settings that still match ownership records, removes its shell marker block, and installs the new package base. Modified retired files and old runtime directories are preserved under `<agent-dir>/specpi/backups/`. Restart Pi to unload the old extensions. Unrelated configuration and local improvement evidence remain intact.
|
|
@@ -144,7 +145,7 @@ npm run check:pi-package
|
|
|
144
145
|
npm run check:base
|
|
145
146
|
```
|
|
146
147
|
|
|
147
|
-
Installer tests use disposable Pi directories. `check:base` requires network access, installs the real
|
|
148
|
+
Installer tests use disposable Pi directories. `check:base` requires network access, installs the real six packages in isolated state, loads them together through Pi 0.84.4, verifies Chat RPC startup and explicit permission replies, and checks removal. It does not send model requests or run browser tasks. Never test against a live Pi installation. Publication remains explicit and uses the [release procedure](NPM_RELEASE.md).
|
|
148
149
|
|
|
149
150
|
The website is static HTML and CSS in `site/`. After installing the pinned Playwright browser with `npx --no-install playwright install chromium`, run `npm run check:site` to check versions, links, and desktop, tablet, and mobile layouts. GitHub Pages deploys it from `main` after those checks pass.
|
|
150
151
|
|
package/SECURITY_MODEL.md
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
# Security model
|
|
2
2
|
|
|
3
|
-
SpecPi provides scope monitoring and an explicit harness improvement loop, and installs
|
|
3
|
+
SpecPi provides scope monitoring and an explicit harness improvement loop, and installs six upstream packages as its default base. Extensions run as trusted code with Pi's permissions. Scope is not an OS sandbox or a general command guard. Use OS isolation for hostile code.
|
|
4
4
|
|
|
5
5
|
## Scope monitoring
|
|
6
6
|
|
|
@@ -20,7 +20,7 @@ Wishlist records remain local under `<agent-dir>/specpi/`. Sanitization and salt
|
|
|
20
20
|
|
|
21
21
|
Package acquisition requests exact npm dependency saves through the child process environment and verifies the installed top-level versions before completing the transaction. A mismatch fails the operation and triggers managed-state rollback. Upstream transitive dependency ranges remain outside this pinning guarantee.
|
|
22
22
|
|
|
23
|
-
`plan` is read-only. Installation, updates, and removal require confirmation or `--yes`. SpecPi manages its two first-party extension families, improvement skill, manifest, AGENTS marker block, and the
|
|
23
|
+
`plan` is read-only. Installation, updates, and removal require confirmation or `--yes`. SpecPi manages its two first-party extension families, improvement skill, manifest, AGENTS marker block, and the six package entries listed in `templates/settings.json`. Normal install/update runs `pi install npm:<name>@<pin>` for every default package. Only package entries are merged; existing resource filters and unrelated settings are retained. `--skip-package-install` allows a core-only install or preserves an already configured base during update. No new shell profile integration is installed.
|
|
24
24
|
|
|
25
25
|
Managed configuration and files are locked and backed up before mutation; first-party writes are atomic and checksum-tracked. Failure restores the saved configuration and first-party files. Package acquisition runs upstream package-manager scripts and may leave downloads, dependency changes, or external script effects even after configuration rollback. Those effects are outside SpecPi's transaction. Updates require `--force` before replacing modified retained resources. Retired resources are backed up before deactivation; pre-install files are restored where ownership records identify them. Old runtime directories are moved into backups without inspecting their contents. Backups and private evidence remain after uninstall and can contain sensitive local material.
|
|
26
26
|
|
|
@@ -34,7 +34,7 @@ Approval replies are tied to the current conversation, client, and request ID. D
|
|
|
34
34
|
|
|
35
35
|
## Upstream package boundary
|
|
36
36
|
|
|
37
|
-
The
|
|
37
|
+
The six packages add their own extensions, tools, prompts, skills, network connections, filesystem operations, and subprocesses under their upstream defaults. They are not confined by the improvement loop's selection requirement. Permission System owns tool policies; SpecPi does not inject a duplicate guard or claim its coverage. Subagents can start other processes. `pi-lens` and `pi-background-tasks` (including its Anthropic provider wrapper) are no longer part of the default base. Normal updates remove only unchanged entries originally added by SpecPi; pre-existing or modified entries and downloaded bytes remain. `--skip-package-install` preserves the old base. Restart Pi and Chat connections to unload retired extensions. Independently retained installations remain trusted upstream code; retained Pi Lens can still apply configured formatting/autofixes. Web access and usage reporting can contact services and use credentials through their upstream implementations. SpecPi's local-only wishlist collection policy does not describe all activity of those packages.
|
|
38
38
|
|
|
39
39
|
Top-level versions are pinned; upstream transitive dependency ranges are not frozen by SpecPi. `doctor` reads configured pins and installed package metadata without invoking tools or validating provider access. `check:base` acquires the packages, checks combined resource loading and Chat RPC startup, and exercises upstream approval, denial, and cancellation with synthetic context. It uses temporary home/configuration directories and sends no model prompt. Browser setup, authenticated services, OS isolation, and every upstream tool's behavior are outside that check. See [THIRD_PARTY.md](THIRD_PARTY.md) for sources and compatibility limits.
|
|
40
40
|
|
package/THIRD_PARTY.md
CHANGED
|
@@ -11,7 +11,7 @@ Development formatting uses Prettier **3.9.6** (MIT), ESLint **10.9.1** (MIT), `
|
|
|
11
11
|
|
|
12
12
|
## Default upstream packages
|
|
13
13
|
|
|
14
|
-
Reviewed on 2026-09-14 against published npm metadata and integrity-verified source archives. All
|
|
14
|
+
Reviewed on 2026-09-14 against published npm metadata and integrity-verified source archives. All six top-level packages declare the MIT license. Pins are authoritative in `templates/settings.json`.
|
|
15
15
|
|
|
16
16
|
SpecPi requests exact npm dependency saves for these pins and checks installed top-level versions before completing installation. The override applies to package acquisition without changing the user's global npm configuration.
|
|
17
17
|
|
|
@@ -20,12 +20,13 @@ SpecPi requests exact npm dependency saves for these pins and checks installed t
|
|
|
20
20
|
| pi-web-access | 0.29.0 | [nicobailon/pi-web-access](https://github.com/nicobailon/pi-web-access) |
|
|
21
21
|
| betterwright | 2.8.1 | [BetterWright/betterwright](https://github.com/BetterWright/betterwright) |
|
|
22
22
|
| pi-subagents | 0.67.0 | [nicobailon/pi-subagents](https://github.com/nicobailon/pi-subagents) |
|
|
23
|
-
| pi-lens | 4.1.6 | [apmantza/pi-lens](https://github.com/apmantza/pi-lens) |
|
|
24
23
|
| pi-goal-x | 0.31.2 | [tmonk/pi-goal-x](https://github.com/tmonk/pi-goal-x) |
|
|
25
24
|
| @sreetej510/pi-usage | 0.10.0 | [Sreetej510/pi-extensions](https://github.com/Sreetej510/pi-extensions) |
|
|
26
25
|
| @gotgenes/pi-permission-system | 32.0.2 | [gotgenes/pi-packages](https://github.com/gotgenes/pi-packages) |
|
|
27
26
|
|
|
28
|
-
Transitive dependencies and their notices remain in Pi's npm installation tree. Top-level pins do not freeze upstream dependency ranges or constitute a full transitive security audit. Pi invokes npm with its upstream package-management semantics, including dependency lifecycle scripts. BetterWright has no browser-download install hook; its separate setup requires Bun 1.4+ and fetches its managed browser. Pi
|
|
27
|
+
Transitive dependencies and their notices remain in Pi's npm installation tree. Top-level pins do not freeze upstream dependency ranges or constitute a full transitive security audit. Pi invokes npm with its upstream package-management semantics, including dependency lifecycle scripts. BetterWright has no browser-download install hook; its separate setup requires Bun 1.4+ and fetches its managed browser. Pi Subagents includes `@earendil-works/pi-server`. Usage reporting and web packages make their own provider/service connections. Consult upstream licenses and security policies before redistributing their components.
|
|
28
|
+
|
|
29
|
+
Pi Lens is no longer a default package. Normal updates retire only unchanged entries added by SpecPi; independent or modified entries and downloaded bytes remain, with their upstream notices. Restart Pi to unload Lens.
|
|
29
30
|
|
|
30
31
|
The combined base is tested with Pi 0.84.4. Pi Goal X declares Pi `>=0.83.0 <0.85.0`; compatibility with newer hosts is not assumed. SpecPi's former custom browser, structural-search, delegation, background-task, and command-guard implementations, DonSeTch, and Pi themes have been removed. Removal restores owned package settings but does not delete downloaded upstream packages or tools. Retired private runtimes remain in local backups with their notices.
|
|
31
32
|
|
|
@@ -33,4 +34,4 @@ The combined base is tested with Pi 0.84.4. Pi Goal X declares Pi `>=0.83.0 <0.8
|
|
|
33
34
|
|
|
34
35
|
The website uses the bundled IBM Plex Sans and Plex Mono fonts under the SIL Open Font License 1.1; see [`site/fonts/LICENSE.txt`](https://github.com/TannerMidd/SpecPi/blob/main/site/fonts/LICENSE.txt). The website's scripts and diagrams are first-party code and assets. The README loads public package/license badges from Shields.io and build status from GitHub. Website fonts and media are not included in the npm package.
|
|
35
36
|
|
|
36
|
-
SpecPi Chat 0.8.
|
|
37
|
+
SpecPi Chat 0.8.1 is a separately packaged VS Code extension with no bundled runtime dependencies. It uses VS Code's host APIs and Pi's RPC protocol. Its read-only pi-subagents adapter consumes the upstream `fleetStatus` v1 contract reviewed at 0.67.0. Generic tool output, visible custom messages, widgets, and dialogs stay owned by their upstream packages. Playwright **1.62.1** (Apache-2.0, [Microsoft Playwright](https://github.com/microsoft/playwright)) is a pinned development dependency for Chat's rendering tests; its browser is installed only for those checks and is not shipped in either artifact.
|
package/package.json
CHANGED
package/scripts/specpi.mjs
CHANGED
|
@@ -56,7 +56,7 @@ Usage:
|
|
|
56
56
|
specpi doctor
|
|
57
57
|
specpi uninstall [--yes]
|
|
58
58
|
|
|
59
|
-
Installs /scope, the harness improvement loop, and
|
|
59
|
+
Installs /scope, the harness improvement loop, and six pinned upstream packages.
|
|
60
60
|
The base is tested with Pi 0.84.4. Run specpi plan to see package versions.
|
|
61
61
|
--skip-package-install installs only the core, or preserves an existing base on update.
|
|
62
62
|
--force replaces modified retained resources after backing them up.
|