specpi 0.22.0 → 0.23.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +12 -0
- package/NPM_RELEASE.md +4 -2
- package/README.md +21 -12
- package/SECURITY_MODEL.md +9 -5
- package/THIRD_PARTY.md +11 -6
- package/package.json +2 -1
- package/scripts/packages.mjs +40 -0
- package/scripts/specpi.mjs +24 -6
- package/templates/settings.json +1 -2
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,17 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## 0.23.0 - 2026-09-14
|
|
4
|
+
|
|
5
|
+
- Replace the BetterWright default with independently published `specpi-browser-qa@0.1.0`: 14 QA-focused interaction, accessibility, diagnostic, and visual-regression tools, not general-browser feature parity. The other five package pins and Chat 0.8.1 are unchanged.
|
|
6
|
+
- Confirmed install/update runs the installed package's Node bin for Chromium setup and offline readiness checks. `--skip-browser-install` now skips that setup; `--skip-package-install` still skips all acquisition and preserves an existing base. Doctor checks real rendering, pixel comparison, and accessibility without downloads. OS libraries require manual installation; Bun is neither required nor removed.
|
|
7
|
+
- Migrate BetterWright entries using existing package ownership restoration: remove only unchanged SpecPi additions, restore pre-existing entries, and preserve user edits and downloaded tools. No personal browser/profile/cookie or private Pi data migration. Managed configuration rolls back on failure; package and browser-cache bytes may survive failure and uninstall.
|
|
8
|
+
- The Browser QA source was extracted and released independently as 0.1.0 before this integration; its published package is unchanged.
|
|
9
|
+
|
|
10
|
+
## 0.22.1 - 2026-09-14
|
|
11
|
+
|
|
12
|
+
- Remove `pi-lens` from the default base. The other six package pins are unchanged. Normal managed updates remove unchanged Lens entries added by SpecPi; pre-existing or user-modified entries and downloaded files remain. `--skip-package-install` preserves the old base. Restart Pi and Chat connections to unload Lens.
|
|
13
|
+
- Align package documentation and release links with SpecPi Chat 0.8.1; no Chat UI or host behavior changes.
|
|
14
|
+
|
|
3
15
|
## 0.22.0 - 2026-09-14
|
|
4
16
|
|
|
5
17
|
- Remove `pi-background-tasks` from the default setup to avoid its Anthropic message-history errors. Updates remove unchanged entries added by SpecPi and preserve user-managed installations. The other seven package versions stay the same.
|
package/NPM_RELEASE.md
CHANGED
|
@@ -1,10 +1,12 @@
|
|
|
1
1
|
# npm release
|
|
2
2
|
|
|
3
|
+
This guide covers the root `specpi` package. Browser QA has an independent [release process](packages/browser-qa/NPM_RELEASE.md), `browser-qa-v*` tags and `browser-qa-publish.yml` workflow. Package-only releases do not invoke the root publisher.
|
|
4
|
+
|
|
3
5
|
Publishing, tags, deprecation, ownership changes and GitHub Releases require explicit human approval. Publication is a post-merge operation: never publish from an unmerged commit. npm versions are immutable.
|
|
4
6
|
|
|
5
7
|
## Prepare
|
|
6
8
|
|
|
7
|
-
1. Choose an unused version; update `package.json`, the dated `CHANGELOG.md` entry, README, and the website. Check Chat's version and VSIX download links. Preserve historical changelog entries.
|
|
9
|
+
1. This candidate is SpecPi **0.23.0**, paired with the unchanged Chat **0.8.1** VSIX. Browser QA **0.1.0** is already independently published; do not republish or edit its source as part of this release. Choose an unused version; update `package.json`, the dated `CHANGELOG.md` entry, README, and the website. Check Chat's version and VSIX download links. Preserve historical changelog entries.
|
|
8
10
|
2. Validate:
|
|
9
11
|
|
|
10
12
|
```sh
|
|
@@ -18,7 +20,7 @@ Publishing, tags, deprecation, ownership changes and GitHub Releases require exp
|
|
|
18
20
|
git diff --check
|
|
19
21
|
```
|
|
20
22
|
|
|
21
|
-
Installer/Pi lifecycle tests must use disposable state, never a live profile. `check:base` requires network access and verifies the real
|
|
23
|
+
Installer/Pi lifecycle tests must use disposable state, never a live profile. `check:base` requires network access and verifies the real six-package base with isolated home/configuration paths. The base check now invokes the installed Browser QA Node bin for Chromium setup and offline doctor checks; scope `PLAYWRIGHT_BROWSERS_PATH` to a disposable test cache. Verify setup skip, core-only behavior, failure rollback, and BetterWright ownership migration in the installer regressions. Browser-cache/package bytes are outside managed rollback and uninstall. Review all default version changes, upstream lifecycle scripts, compatibility, and notices in `THIRD_PARTY.md`. Local dry runs disable provenance because they lack GitHub OIDC.
|
|
22
24
|
|
|
23
25
|
3. Review the diff, exact package manifest and artifact; obtain fresh read-only review for lifecycle, permissions and packaging changes.
|
|
24
26
|
4. After approval and passing PR checks, merge to `main`, then create the matching `v<version>` tag at the merge commit. Build Chat's VSIX with `npm --prefix vscode run package` and attach it to the GitHub Release. Publish the release to start the npm workflow and approve the protected `npm` environment if it requests review. Verify the website deployment and download links. If publication cannot complete, revert the release merge and use a new version for the next attempt.
|
package/README.md
CHANGED
|
@@ -26,7 +26,7 @@
|
|
|
26
26
|
</p>
|
|
27
27
|
<p align="center"><sub>SpecPi Chat · Example workspace</sub></p>
|
|
28
28
|
|
|
29
|
-
SpecPi is a small base for the [Pi coding agent](https://pi.dev/). Its own extensions provide **scope control** and a **harness improvement loop**.
|
|
29
|
+
SpecPi is a small base for the [Pi coding agent](https://pi.dev/). Its own extensions provide **scope control** and a **harness improvement loop**. Six pinned packages handle the supporting tools, and **SpecPi Chat 0.8.1** brings them into VS Code.
|
|
30
30
|
|
|
31
31
|
| Keep the work focused | Improve what gets in the way | Work beside your code |
|
|
32
32
|
| --------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------- |
|
|
@@ -45,12 +45,12 @@ specpi install
|
|
|
45
45
|
specpi doctor
|
|
46
46
|
```
|
|
47
47
|
|
|
48
|
-
Inspect the plan, confirm the install, then restart Pi. SpecPi installs two first-party extensions, the improvement skill, a marked working agreement, and the packages below using `pi install`. Provider and model settings are preserved. There are no additional
|
|
48
|
+
Inspect the plan, confirm the install, then restart Pi. SpecPi installs two first-party extensions, the improvement skill, a marked working agreement, and the packages below using `pi install`. Provider and model settings are preserved. Confirmed install/update also runs the installed Browser QA package's Node setup to download Chromium and verify readiness. No Bun or OS libraries are installed. There are no additional harness extensions, themes, shell profiles, or tool wrappers.
|
|
49
49
|
|
|
50
50
|
<details>
|
|
51
51
|
<summary>Source checkouts, alternate Pi paths, and core-only installs</summary>
|
|
52
52
|
|
|
53
|
-
For this checkout, run `node scripts/specpi.mjs` in place of `specpi`. `PI_CODING_AGENT_DIR` selects an alternate destination; `SPECPI_PI` selects a Pi CLI path. `specpi install --skip-package-install` installs only the first-party core for offline use and testing. A plain `pi install npm:specpi` loads only the packaged first-party resources; use the SpecPi installer above for the complete base, and avoid installing the same first-party resources both ways.
|
|
53
|
+
For this checkout, run `node scripts/specpi.mjs` in place of `specpi`. `PI_CODING_AGENT_DIR` selects an alternate destination; `SPECPI_PI` selects a Pi CLI path. `specpi install --skip-package-install` installs only the first-party core for offline use and testing. `--skip-browser-install` skips Chromium setup while still acquiring all six packages; `doctor` still checks browser readiness. `--skip-package-install` skips both package acquisition and Chromium setup. A plain `pi install npm:specpi` loads only the packaged first-party resources; use the SpecPi installer above for the complete base, and avoid installing the same first-party resources both ways.
|
|
54
54
|
|
|
55
55
|
</details>
|
|
56
56
|
|
|
@@ -61,9 +61,8 @@ These are installed on every normal install and update. Exact versions live in [
|
|
|
61
61
|
| Package | Pinned version | Purpose |
|
|
62
62
|
| ----------------------------------------------------------------------------------------------------------------- | -------------- | ------------------------------------------------------ |
|
|
63
63
|
| [pi-web-access](https://github.com/nicobailon/pi-web-access) | 0.29.0 | Web search and page retrieval |
|
|
64
|
-
| [
|
|
64
|
+
| [specpi-browser-qa](https://www.npmjs.com/package/specpi-browser-qa) | 0.1.0 | Browser interaction, accessibility and visual QA |
|
|
65
65
|
| [pi-subagents](https://github.com/nicobailon/pi-subagents) | 0.67.0 | Subagents and delegation |
|
|
66
|
-
| [pi-lens](https://github.com/apmantza/pi-lens) | 4.1.6 | Language diagnostics, navigation, and structural tools |
|
|
67
66
|
| [pi-goal-x](https://github.com/tmonk/pi-goal-x) | 0.31.2 | Persistent goals and progress |
|
|
68
67
|
| [@sreetej510/pi-usage](https://github.com/Sreetej510/pi-extensions/tree/main/extensions/pi-usage) | 0.10.0 | Provider usage reporting |
|
|
69
68
|
| [@gotgenes/pi-permission-system](https://github.com/gotgenes/pi-packages/tree/main/packages/pi-permission-system) | 32.0.2 | Tool permission policies |
|
|
@@ -72,15 +71,21 @@ The effective commands are `pi install npm:<package>@<version>` for each row, in
|
|
|
72
71
|
|
|
73
72
|
SpecPi requests exact npm dependency saves for these installs and verifies installed versions before completing the transaction. This keeps later package installs from advancing an earlier pin through npm's default version ranges.
|
|
74
73
|
|
|
75
|
-
|
|
74
|
+
Browser QA setup uses the installed package's pinned Playwright and the standard browser cache (or `PLAYWRIGHT_BROWSERS_PATH`). If setup fails, managed configuration rolls back; install missing OS libraries manually and retry `specpi install` (or `specpi update` for an existing installation). `specpi doctor` runs offline rendering, pixel-comparison, and accessibility checks without downloading anything. Provider credentials, web-service configuration, and permission rules remain governed by each package's documentation. Package installation and extension loading do not prove that every external service or tool is ready.
|
|
75
|
+
|
|
76
|
+
## Browser QA
|
|
77
|
+
|
|
78
|
+
[`specpi-browser-qa@0.1.0`](https://www.npmjs.com/package/specpi-browser-qa/v/0.1.0) is independently published and now included in the default base. Its 14 tools cover interactions, responsive screenshots, visual comparison, diagnostics, and accessibility checks in an ephemeral browser context. It is QA-focused, not general-browser feature parity with BetterWright. No personal browser, profile, cookie, or private Pi data is migrated.
|
|
79
|
+
|
|
80
|
+
BetterWright remains an optional manual install, with its own [Bun-based setup](https://github.com/BetterWright/betterwright/blob/main/SETUP.md). SpecPi does not uninstall Bun or user-owned tools.
|
|
76
81
|
|
|
77
82
|
## VS Code
|
|
78
83
|
|
|
79
|
-
[SpecPi Chat](https://github.com/TannerMidd/SpecPi/blob/main/vscode/README.md) provides the chat sidebar, file and image attachments, conversation history, tool output, package commands, and approval dialogs. Version **0.8.
|
|
84
|
+
[SpecPi Chat](https://github.com/TannerMidd/SpecPi/blob/main/vscode/README.md) provides the chat sidebar, file and image attachments, conversation history, tool output, package commands, and approval dialogs. Version **0.8.1** lets you edit global or project permission settings, confirm changes, and keep a backup. The VSIX remains separate from the npm harness package.
|
|
80
85
|
|
|
81
|
-
Download the [0.8.
|
|
86
|
+
Download the [0.8.1 VSIX](https://github.com/TannerMidd/SpecPi/releases/download/v0.23.0/specpi-chat-0.8.1.vsix), then run **Extensions: Install from VSIX…** in VS Code. Install/update SpecPi separately, then restart Pi in Chat to reload its extensions.
|
|
82
87
|
|
|
83
|
-
[Download Chat](https://github.com/TannerMidd/SpecPi/releases/download/v0.
|
|
88
|
+
[Download Chat](https://github.com/TannerMidd/SpecPi/releases/download/v0.23.0/specpi-chat-0.8.1.vsix) · [Chat guide](https://github.com/TannerMidd/SpecPi/blob/main/vscode/GUIDE.md) · [Build from source](https://github.com/TannerMidd/SpecPi/blob/main/vscode/DEVELOPMENT.md)
|
|
84
89
|
|
|
85
90
|
## Scope
|
|
86
91
|
|
|
@@ -126,13 +131,17 @@ specpi doctor
|
|
|
126
131
|
specpi uninstall
|
|
127
132
|
```
|
|
128
133
|
|
|
129
|
-
Install, update, and uninstall require confirmation; `--yes` supplies it for automation. Modified retained resources require `update --force`. Managed configuration and resources are backed up and checksum-tracked. `update --skip-package-install` preserves an existing base without invoking Pi's package installer. Normal updates reapply the reviewed pins.
|
|
134
|
+
Install, update, and uninstall require confirmation; `--yes` supplies it for automation. Modified retained resources require `update --force`. Managed configuration and resources are backed up and checksum-tracked. `update --skip-package-install` preserves an existing base without invoking Pi's package installer. Normal updates reapply the reviewed pins and run Chromium setup unless `--skip-browser-install` is supplied.
|
|
135
|
+
|
|
136
|
+
BetterWright is no longer a default package. Normal updates use recorded ownership to remove only unchanged SpecPi-added entries or restore pre-existing entries. User-modified entries and downloaded bytes survive; `--skip-package-install` preserves the old base. Restart Pi and each Chat connection to unload retired extensions. Independently retained BetterWright installs require separate user management.
|
|
137
|
+
|
|
138
|
+
`pi-lens` is no longer included by default. A normal managed update removes unchanged Lens entries originally added by SpecPi; pre-existing or user-modified entries and downloaded files remain. `--skip-package-install` preserves the old base. Restart Pi and each Chat connection to unload Lens. Independently retained installations require separate user management (`pi remove npm:pi-lens` in their installation scope).
|
|
130
139
|
|
|
131
140
|
`pi-background-tasks` is no longer included by default because its Anthropic wrapper can reject changing message context. A normal update removes an unchanged package entry originally added by SpecPi; pre-existing or user-modified entries and downloaded files remain. `--skip-package-install` preserves the old base. To remove a separately retained installation, run `pi remove npm:pi-background-tasks` in its installation scope, then restart Pi.
|
|
132
141
|
|
|
133
142
|
Updating from the larger harness retires its recorded extra resources, restores legacy settings that still match ownership records, removes its shell marker block, and installs the new package base. Modified retired files and old runtime directories are preserved under `<agent-dir>/specpi/backups/`. Restart Pi to unload the old extensions. Unrelated configuration and local improvement evidence remain intact.
|
|
134
143
|
|
|
135
|
-
Uninstall restores package entries that still match SpecPi's recorded changes and preserves subsequent user edits. Downloaded packages, npm caches, upstream configuration, and private evidence remain on disk. A failed install rolls back SpecPi-managed files and configuration; package downloads and upstream install-script effects cannot be rolled back. `doctor` checks the core, package settings,
|
|
144
|
+
Uninstall restores package entries that still match SpecPi's recorded changes and preserves subsequent user edits. Downloaded packages, browser caches, npm caches, upstream configuration, and private evidence remain on disk. A failed install rolls back SpecPi-managed files and configuration; package/browser downloads and upstream install-script effects cannot be rolled back. `doctor` checks the core, package settings, installed top-level versions, and actual Browser QA readiness. Core-only installations do not run browser checks.
|
|
136
145
|
|
|
137
146
|
## Development
|
|
138
147
|
|
|
@@ -144,7 +153,7 @@ npm run check:pi-package
|
|
|
144
153
|
npm run check:base
|
|
145
154
|
```
|
|
146
155
|
|
|
147
|
-
Installer tests use disposable Pi directories. `check:base` requires network access, installs the real
|
|
156
|
+
Installer tests use disposable Pi directories. `check:base` requires network access, installs the real six packages in isolated state, loads them together through Pi 0.84.4, verifies Chat RPC startup and explicit permission replies, and checks removal. It also runs Chromium setup and offline Browser QA smoke checks, without sending model requests. Set `PLAYWRIGHT_BROWSERS_PATH` to a disposable test cache to avoid touching the normal browser cache. Never test against a live Pi installation. Publication remains explicit and uses the [release procedure](NPM_RELEASE.md).
|
|
148
157
|
|
|
149
158
|
The website is static HTML and CSS in `site/`. After installing the pinned Playwright browser with `npx --no-install playwright install chromium`, run `npm run check:site` to check versions, links, and desktop, tablet, and mobile layouts. GitHub Pages deploys it from `main` after those checks pass.
|
|
150
159
|
|
package/SECURITY_MODEL.md
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
# Security model
|
|
2
2
|
|
|
3
|
-
SpecPi provides scope monitoring and an explicit harness improvement loop, and installs
|
|
3
|
+
SpecPi provides scope monitoring and an explicit harness improvement loop, and installs six pinned packages as its default base. Extensions run as trusted code with Pi's permissions. Scope is not an OS sandbox or a general command guard. Use OS isolation for hostile code.
|
|
4
4
|
|
|
5
5
|
## Scope monitoring
|
|
6
6
|
|
|
@@ -20,12 +20,16 @@ Wishlist records remain local under `<agent-dir>/specpi/`. Sanitization and salt
|
|
|
20
20
|
|
|
21
21
|
Package acquisition requests exact npm dependency saves through the child process environment and verifies the installed top-level versions before completing the transaction. A mismatch fails the operation and triggers managed-state rollback. Upstream transitive dependency ranges remain outside this pinning guarantee.
|
|
22
22
|
|
|
23
|
-
`plan` is read-only. Installation, updates, and removal require confirmation or `--yes`. SpecPi manages its two first-party extension families, improvement skill, manifest, AGENTS marker block, and the
|
|
23
|
+
`plan` is read-only. Installation, updates, and removal require confirmation or `--yes`. SpecPi manages its two first-party extension families, improvement skill, manifest, AGENTS marker block, and the six package entries listed in `templates/settings.json`. Normal install/update runs `pi install npm:<name>@<pin>` for every default package. Only package entries are merged; existing resource filters and unrelated settings are retained. `--skip-package-install` allows a core-only install or preserves an already configured base during update, skipping Chromium setup too. Confirmed install/update otherwise invokes the installed Browser QA Node bin with bounded subprocesses to download Chromium and check readiness. `--skip-browser-install` skips that setup only; doctor still checks readiness. SpecPi never passes `--with-deps`, auto-installs OS libraries, or installs/removes Bun. No new shell profile integration is installed.
|
|
24
24
|
|
|
25
|
-
Managed configuration and files are locked and backed up before mutation; first-party writes are atomic and checksum-tracked. Failure restores the saved configuration and first-party files. Package acquisition runs upstream package-manager scripts and may leave downloads, dependency changes, or external script effects even after configuration rollback. Those effects are outside SpecPi's transaction. Updates require `--force` before replacing modified retained resources. Retired resources are backed up before deactivation; pre-install files are restored where ownership records identify them. Old runtime directories are moved into backups without inspecting their contents. Backups and private evidence remain after uninstall and can contain sensitive local material.
|
|
25
|
+
Managed configuration and files are locked and backed up before mutation; first-party writes are atomic and checksum-tracked. Failure restores the saved configuration and first-party files. Package acquisition runs upstream package-manager scripts and may leave downloads, dependency changes, or external script effects even after configuration rollback. Those effects, including downloaded browser-cache bytes, are outside SpecPi's transaction and survive uninstall. Updates require `--force` before replacing modified retained resources. Retired resources are backed up before deactivation; pre-install files are restored where ownership records identify them. Old runtime directories are moved into backups without inspecting their contents. Backups and private evidence remain after uninstall and can contain sensitive local material.
|
|
26
26
|
|
|
27
27
|
Legacy migration restores only recorded settings ownership, preserves differing user values, and removes only the SpecPi shell marker block before applying the new base. The installer does not enumerate or modify authentication, provider credential stores, trust, sessions, missions, history, or unrelated private evidence. Normal updates deliberately reapply the default package pins, retaining the original entry for removal. Uninstall restores only package entries that still match the last installed value; user edits are preserved. Downloaded packages and tools are not deleted. Resources that SpecPi never owned require separate human management.
|
|
28
28
|
|
|
29
|
+
## Browser QA package
|
|
30
|
+
|
|
31
|
+
`packages/browser-qa` is an independently released Node-native Pi package extracted from the retired browser tools. The installer acquires the immutable `specpi-browser-qa@0.1.0` release through Pi; its source and dependencies are not bundled in SpecPi's npm artifact. Its explicit setup downloads Playwright Chromium, and its doctor performs offline rendering, image-comparison and accessibility smoke checks. It uses package-local dependency resolution and the standard Playwright browser cache rather than SpecPi's retired managed runtime. No Pi settings, credentials or personal profiles are migrated. The ephemeral context is not OS/network isolation; pages can reach localhost and private networks. See the package's [security documentation](packages/browser-qa/SECURITY.md) for artifact retention, best-effort redaction, permission and cleanup limits. This is QA tooling, not general-browser feature parity. BetterWright remains optional/manual. Normal updates restore recorded pre-existing entries and remove only unchanged SpecPi-added BetterWright entries; modified entries, personal browsers, profiles, cookies, and user-owned tools are not migrated or deleted.
|
|
32
|
+
|
|
29
33
|
## VS Code frontend
|
|
30
34
|
|
|
31
35
|
SpecPi Chat is a separate VSIX, retained alongside the npm harness. It launches Pi only in a trusted filesystem workspace and communicates over local RPC. Provider credentials stay with Pi. The frontend manages only its own workspace-storage conversation catalog and sessions for user-directed history, branching, and export; it does not import unrelated Pi histories. Attachments, images, webview messages, and file navigation are validated and bounded. Rendered model and tool output is untrusted text, never executable HTML.
|
|
@@ -34,8 +38,8 @@ Approval replies are tied to the current conversation, client, and request ID. D
|
|
|
34
38
|
|
|
35
39
|
## Upstream package boundary
|
|
36
40
|
|
|
37
|
-
The
|
|
41
|
+
The six packages add their own extensions, tools, prompts, skills, network connections, filesystem operations, and subprocesses under their upstream defaults. They are not confined by the improvement loop's selection requirement. Permission System owns tool policies; SpecPi does not inject a duplicate guard or claim its coverage. Subagents can start other processes. `pi-lens` and `pi-background-tasks` (including its Anthropic provider wrapper) are no longer part of the default base. Normal updates remove only unchanged entries originally added by SpecPi; pre-existing or modified entries and downloaded bytes remain. `--skip-package-install` preserves the old base. Restart Pi and Chat connections to unload retired extensions. Independently retained installations remain trusted upstream code; retained Pi Lens can still apply configured formatting/autofixes. Web access and usage reporting can contact services and use credentials through their upstream implementations. SpecPi's local-only wishlist collection policy does not describe all activity of those packages.
|
|
38
42
|
|
|
39
|
-
Top-level versions are pinned; upstream transitive dependency ranges are not frozen by SpecPi. `doctor` reads configured pins and installed package metadata
|
|
43
|
+
Top-level versions are pinned; upstream transitive dependency ranges are not frozen by SpecPi. `doctor` reads configured pins and installed package metadata, then invokes the installed Browser QA bin for real offline rendering, pixel-comparison, and accessibility checks when the managed base includes it. Doctor never downloads a browser, and missing Chromium or OS libraries fail with recovery guidance. It does not validate provider access or browser readiness for independently retained BetterWright. Core-only installations do not run browser checks. `check:base` acquires the packages, checks combined resource loading and Chat RPC startup, and exercises upstream approval, denial, and cancellation with synthetic context. It uses temporary home/configuration directories and sends no model prompt. The base check also exercises Node-only Chromium setup and offline Browser QA readiness; authenticated services, OS isolation, and every upstream tool's behavior remain outside that check. See [THIRD_PARTY.md](THIRD_PARTY.md) for sources and compatibility limits.
|
|
40
44
|
|
|
41
45
|
Manifests, source checkouts, Pi, dependencies, and the operating system are trusted inputs. Validation rejects unexpected managed resource paths and symlinked managed paths; it does not claim protection against another process changing files during an operation. Repository and release checks use isolated temporary Pi directories.
|
package/THIRD_PARTY.md
CHANGED
|
@@ -9,28 +9,33 @@ Development fixtures pin Pi packages to **0.84.4** and TypeBox to **1.3.7**. Hos
|
|
|
9
9
|
|
|
10
10
|
Development formatting uses Prettier **3.9.6** (MIT), ESLint **10.9.1** (MIT), `@stylistic/eslint-plugin` **5.10.0** (MIT), `@typescript-eslint/parser` **8.68.0** (BSD-2-Clause), and TypeScript **6.0.3** (Apache-2.0). Exact versions are recorded in `package.json`; installed packages retain upstream notices. Git and Node.js are external prerequisites.
|
|
11
11
|
|
|
12
|
-
## Default
|
|
12
|
+
## Default packages
|
|
13
13
|
|
|
14
|
-
Reviewed on 2026-09-14 against published npm metadata and integrity-verified source archives. All
|
|
14
|
+
Reviewed on 2026-09-14 against published npm metadata and integrity-verified source archives. All six top-level packages declare the MIT license. Pins are authoritative in `templates/settings.json`.
|
|
15
15
|
|
|
16
16
|
SpecPi requests exact npm dependency saves for these pins and checks installed top-level versions before completing installation. The override applies to package acquisition without changing the user's global npm configuration.
|
|
17
17
|
|
|
18
18
|
| Package | Version | Upstream |
|
|
19
19
|
| ------------------------------ | ------- | ------------------------------------------------------------------------- |
|
|
20
20
|
| pi-web-access | 0.29.0 | [nicobailon/pi-web-access](https://github.com/nicobailon/pi-web-access) |
|
|
21
|
-
|
|
|
21
|
+
| specpi-browser-qa | 0.1.0 | [TannerMidd/SpecPi](https://github.com/TannerMidd/SpecPi/tree/browser-qa-v0.1.0/packages/browser-qa) |
|
|
22
22
|
| pi-subagents | 0.67.0 | [nicobailon/pi-subagents](https://github.com/nicobailon/pi-subagents) |
|
|
23
|
-
| pi-lens | 4.1.6 | [apmantza/pi-lens](https://github.com/apmantza/pi-lens) |
|
|
24
23
|
| pi-goal-x | 0.31.2 | [tmonk/pi-goal-x](https://github.com/tmonk/pi-goal-x) |
|
|
25
24
|
| @sreetej510/pi-usage | 0.10.0 | [Sreetej510/pi-extensions](https://github.com/Sreetej510/pi-extensions) |
|
|
26
25
|
| @gotgenes/pi-permission-system | 32.0.2 | [gotgenes/pi-packages](https://github.com/gotgenes/pi-packages) |
|
|
27
26
|
|
|
28
|
-
Transitive dependencies and their notices remain in Pi's npm installation tree. Top-level pins do not freeze upstream dependency ranges or constitute a full transitive security audit. Pi invokes npm with its upstream package-management semantics, including dependency lifecycle scripts.
|
|
27
|
+
Transitive dependencies and their notices remain in Pi's npm installation tree. Top-level pins do not freeze upstream dependency ranges or constitute a full transitive security audit. Pi invokes npm with its upstream package-management semantics, including dependency lifecycle scripts. Browser QA has no install hook: confirmed SpecPi install/update explicitly invokes its installed Node setup bin, unless acquisition or browser setup is skipped. It downloads package-pinned Chromium without installing OS libraries. BetterWright is optional/manual and retains its own Bun-based setup; SpecPi neither removes Bun nor deletes user-owned tools. Pi Subagents includes `@earendil-works/pi-server`. Usage reporting and web packages make their own provider/service connections. Consult upstream licenses and security policies before redistributing their components.
|
|
28
|
+
|
|
29
|
+
Pi Lens is no longer a default package. Normal updates retire only unchanged entries added by SpecPi; independent or modified entries and downloaded bytes remain, with their upstream notices. Restart Pi to unload Lens.
|
|
29
30
|
|
|
30
31
|
The combined base is tested with Pi 0.84.4. Pi Goal X declares Pi `>=0.83.0 <0.85.0`; compatibility with newer hosts is not assumed. SpecPi's former custom browser, structural-search, delegation, background-task, and command-guard implementations, DonSeTch, and Pi themes have been removed. Removal restores owned package settings but does not delete downloaded upstream packages or tools. Retired private runtimes remain in local backups with their notices.
|
|
31
32
|
|
|
33
|
+
## Standalone browser QA
|
|
34
|
+
|
|
35
|
+
The separately released `packages/browser-qa` source reuses the retired QA implementation with Playwright 1.62.1, axe-core and its Playwright adapter 4.13.0, pixelmatch 7.2.0, and pngjs 7.0.0. These are that package's exact runtime dependencies, acquired separately by Pi for the default base, not bundled in SpecPi's npm artifact. See its [dependency notices](packages/browser-qa/THIRD_PARTY.md) and [security boundary](packages/browser-qa/SECURITY.md). Setup uses Node and explicitly downloads Chromium; no Bun or install hook is used. The 0.1.0 registry tarball was integrity-verified against `sha512-lilvlRgSbvNxnueO+CxCvlGI6wqrdtshCLmNkaBAa+P8+6c/aQvB27fP5n3KIFylABchKe7x6vzf3tHleNSikg==`; source tag: `browser-qa-v0.1.0`. Published package bytes are unchanged by this integration. Browser-cache bytes and downloaded packages survive managed rollback and uninstall.
|
|
36
|
+
|
|
32
37
|
## Website and README
|
|
33
38
|
|
|
34
39
|
The website uses the bundled IBM Plex Sans and Plex Mono fonts under the SIL Open Font License 1.1; see [`site/fonts/LICENSE.txt`](https://github.com/TannerMidd/SpecPi/blob/main/site/fonts/LICENSE.txt). The website's scripts and diagrams are first-party code and assets. The README loads public package/license badges from Shields.io and build status from GitHub. Website fonts and media are not included in the npm package.
|
|
35
40
|
|
|
36
|
-
SpecPi Chat 0.8.
|
|
41
|
+
SpecPi Chat 0.8.1 is a separately packaged VS Code extension with no bundled runtime dependencies. It uses VS Code's host APIs and Pi's RPC protocol. Its read-only pi-subagents adapter consumes the upstream `fleetStatus` v1 contract reviewed at 0.67.0. Generic tool output, visible custom messages, widgets, and dialogs stay owned by their upstream packages. Playwright **1.62.1** (Apache-2.0, [Microsoft Playwright](https://github.com/microsoft/playwright)) is a pinned development dependency for Chat's rendering tests; its browser is used for those checks and is not shipped in either artifact. The default Browser QA package independently uses the same pinned Playwright version for its runtime.
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "specpi",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.23.0",
|
|
4
4
|
"description": "Scope control and a human-selected harness improvement loop for Pi",
|
|
5
5
|
"author": "Tanner Middleton",
|
|
6
6
|
"repository": {
|
|
@@ -83,6 +83,7 @@
|
|
|
83
83
|
"check:pi-package": "node scripts/check-pi-package.mjs",
|
|
84
84
|
"check:base": "node scripts/check-base-packages.mjs",
|
|
85
85
|
"check:site": "node scripts/check-site.mjs",
|
|
86
|
+
"check:browser-qa": "npm --prefix packages/browser-qa run check",
|
|
86
87
|
"check:vscode": "npm --prefix vscode run check",
|
|
87
88
|
"prepublishOnly": "npm run check",
|
|
88
89
|
"check": "npm run format:check && npm run check:syntax && npm test && npm run check:package && npm run check:vscode"
|
package/scripts/packages.mjs
CHANGED
|
@@ -8,6 +8,46 @@ export const basePackages = JSON.parse(
|
|
|
8
8
|
fs.readFileSync(new URL("../templates/settings.json", import.meta.url), "utf8"),
|
|
9
9
|
).packages;
|
|
10
10
|
|
|
11
|
+
// Invoke only the installed, pinned package's Node bin; never npx, Bun, or OS dependency setup.
|
|
12
|
+
export function runBrowserQA(agentDir, command) {
|
|
13
|
+
if (!["setup", "doctor"].includes(command)) {
|
|
14
|
+
throw new Error(`Unsupported Browser QA command: ${command}`);
|
|
15
|
+
}
|
|
16
|
+
|
|
17
|
+
const root = path.join(agentDir, "npm", "node_modules", "specpi-browser-qa");
|
|
18
|
+
try {
|
|
19
|
+
const installed = JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf8"));
|
|
20
|
+
if (
|
|
21
|
+
installed.name !== "specpi-browser-qa" ||
|
|
22
|
+
installed.version !== "0.1.0" ||
|
|
23
|
+
installed.bin?.["specpi-browser-qa"] !== "./bin/browser-qa.mjs"
|
|
24
|
+
) {
|
|
25
|
+
throw new Error("Missing or changed pinned Browser QA bin metadata");
|
|
26
|
+
}
|
|
27
|
+
|
|
28
|
+
const bin = path.join(root, "bin", "browser-qa.mjs");
|
|
29
|
+
const relative = path.relative(fs.realpathSync(root), fs.realpathSync(bin));
|
|
30
|
+
if (path.isAbsolute(relative) || relative === ".." || relative.startsWith(`..${path.sep}`)) {
|
|
31
|
+
throw new Error("Browser QA bin escapes its package directory");
|
|
32
|
+
}
|
|
33
|
+
|
|
34
|
+
const result = spawnSync(process.execPath, [bin, command], {
|
|
35
|
+
cwd: agentDir,
|
|
36
|
+
env: { ...process.env, PI_CODING_AGENT_DIR: agentDir },
|
|
37
|
+
stdio: "inherit",
|
|
38
|
+
windowsHide: true,
|
|
39
|
+
timeout: command === "setup" ? 690_000 : 75_000,
|
|
40
|
+
});
|
|
41
|
+
if (result.error || result.status !== 0) {
|
|
42
|
+
throw new Error(result.error?.message || `exit ${result.signal ?? result.status}`);
|
|
43
|
+
}
|
|
44
|
+
} catch (error) {
|
|
45
|
+
throw new Error(
|
|
46
|
+
`Browser QA ${command} failed: ${error.message}. Retry specpi install (or specpi update if already installed) for Chromium setup; install missing OS libraries manually. Doctor never downloads browsers.`,
|
|
47
|
+
);
|
|
48
|
+
}
|
|
49
|
+
}
|
|
50
|
+
|
|
11
51
|
export function packageChanges(before, after) {
|
|
12
52
|
return basePackages.map((source) => {
|
|
13
53
|
const identity = packageIdentity(source);
|
package/scripts/specpi.mjs
CHANGED
|
@@ -22,7 +22,7 @@ import {
|
|
|
22
22
|
import { validateCapabilityRegistry } from "../extensions/tool-wishlist/registry.mjs";
|
|
23
23
|
import { runValidator } from "../extensions/tool-wishlist/validators.mjs";
|
|
24
24
|
import { acquireSpecPiLock } from "./lock.mjs";
|
|
25
|
-
import { basePackages, checkBasePackages, installBasePackages, packageChanges } from "./packages.mjs";
|
|
25
|
+
import { basePackages, checkBasePackages, installBasePackages, packageChanges, runBrowserQA } from "./packages.mjs";
|
|
26
26
|
|
|
27
27
|
const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
|
|
28
28
|
const VERSION = JSON.parse(fs.readFileSync(path.join(repoRoot, "package.json"), "utf8")).version;
|
|
@@ -56,9 +56,10 @@ Usage:
|
|
|
56
56
|
specpi doctor
|
|
57
57
|
specpi uninstall [--yes]
|
|
58
58
|
|
|
59
|
-
Installs /scope, the harness improvement loop, and
|
|
59
|
+
Installs /scope, the harness improvement loop, and six pinned packages.
|
|
60
60
|
The base is tested with Pi 0.84.4. Run specpi plan to see package versions.
|
|
61
61
|
--skip-package-install installs only the core, or preserves an existing base on update.
|
|
62
|
+
--skip-browser-install skips Chromium setup, not package acquisition or doctor checks.
|
|
62
63
|
--force replaces modified retained resources after backing them up.
|
|
63
64
|
SPECPI_PI selects a Pi CLI path instead of pi on PATH.
|
|
64
65
|
PI_CODING_AGENT_DIR overrides the default ~/.pi/agent destination.`);
|
|
@@ -66,7 +67,7 @@ PI_CODING_AGENT_DIR overrides the default ~/.pi/agent destination.`);
|
|
|
66
67
|
|
|
67
68
|
function parseArgs(argv) {
|
|
68
69
|
const command = argv[0] || "help";
|
|
69
|
-
// Obsolete
|
|
70
|
+
// Obsolete tool/shell flags remain accepted for older automation.
|
|
70
71
|
const known = new Set([
|
|
71
72
|
"--yes",
|
|
72
73
|
"--force",
|
|
@@ -86,6 +87,7 @@ function parseArgs(argv) {
|
|
|
86
87
|
yes: argv.includes("--yes"),
|
|
87
88
|
force: argv.includes("--force"),
|
|
88
89
|
skipPackages: argv.includes("--skip-package-install"),
|
|
90
|
+
skipBrowser: argv.includes("--skip-browser-install"),
|
|
89
91
|
};
|
|
90
92
|
}
|
|
91
93
|
|
|
@@ -195,7 +197,12 @@ function printPlan(options = {}) {
|
|
|
195
197
|
}
|
|
196
198
|
|
|
197
199
|
console.log(
|
|
198
|
-
|
|
200
|
+
options.skipPackages || options.skipBrowser
|
|
201
|
+
? "Chromium setup skipped; doctor still checks Browser QA when included in the managed base."
|
|
202
|
+
: "After package acquisition, run the installed Browser QA Node bin to download Chromium and verify offline rendering, pixel comparison, and accessibility. No Bun or OS library installation.",
|
|
203
|
+
);
|
|
204
|
+
console.log(
|
|
205
|
+
"Only package settings are merged. No theme or shell integration. Wishlist collection starts off. Backups precede mutation; downloaded packages, browser-cache bytes and upstream script effects cannot be rolled back or removed by uninstall.",
|
|
199
206
|
);
|
|
200
207
|
}
|
|
201
208
|
|
|
@@ -319,6 +326,10 @@ async function mutate(options, operation) {
|
|
|
319
326
|
throw new Error(packageErrors.join("\n"));
|
|
320
327
|
}
|
|
321
328
|
|
|
329
|
+
if (!options.skipBrowser) {
|
|
330
|
+
runBrowserQA(agentDir, "setup");
|
|
331
|
+
}
|
|
332
|
+
|
|
322
333
|
packageState = {
|
|
323
334
|
basePackages,
|
|
324
335
|
packagesKeyBeforeExists: Object.hasOwn(before, "packages"),
|
|
@@ -416,7 +427,7 @@ async function mutate(options, operation) {
|
|
|
416
427
|
}
|
|
417
428
|
|
|
418
429
|
console.log(
|
|
419
|
-
"Local wishlist and other private evidence were preserved. Restart Pi to unload retired resources.",
|
|
430
|
+
"Local wishlist and other private evidence were preserved. Downloaded packages and browser-cache bytes remain after uninstall. Restart Pi to unload retired resources.",
|
|
420
431
|
);
|
|
421
432
|
} catch (error) {
|
|
422
433
|
const failures = [];
|
|
@@ -437,7 +448,7 @@ async function mutate(options, operation) {
|
|
|
437
448
|
}
|
|
438
449
|
|
|
439
450
|
throw new Error(
|
|
440
|
-
`${transaction ? "SpecPi-managed changes rolled back: " : ""}${error.message}${acquisitionStarted ? "; downloaded packages and upstream install-script effects may remain" : ""}${failures.length ? `; rollback errors: ${failures.join("; ")}` : ""}`,
|
|
451
|
+
`${transaction ? "SpecPi-managed changes rolled back: " : ""}${error.message}${acquisitionStarted ? "; downloaded packages, browser-cache bytes and upstream install-script effects may remain" : ""}${failures.length ? `; rollback errors: ${failures.join("; ")}` : ""}`,
|
|
441
452
|
);
|
|
442
453
|
} finally {
|
|
443
454
|
releaseLock();
|
|
@@ -458,6 +469,13 @@ async function doctor() {
|
|
|
458
469
|
const errors = [];
|
|
459
470
|
if (manifest.basePackages?.length) {
|
|
460
471
|
errors.push(...checkBasePackages(agentDir, readJson(settingsPath, {})));
|
|
472
|
+
if (manifest.basePackages.includes("npm:specpi-browser-qa@0.1.0")) {
|
|
473
|
+
try {
|
|
474
|
+
runBrowserQA(agentDir, "doctor");
|
|
475
|
+
} catch (error) {
|
|
476
|
+
errors.push(error.message);
|
|
477
|
+
}
|
|
478
|
+
}
|
|
461
479
|
} else {
|
|
462
480
|
console.log("Core-only installation: default package installation was skipped.");
|
|
463
481
|
}
|
package/templates/settings.json
CHANGED
|
@@ -1,9 +1,8 @@
|
|
|
1
1
|
{
|
|
2
2
|
"packages": [
|
|
3
3
|
"npm:pi-web-access@0.29.0",
|
|
4
|
-
"npm:
|
|
4
|
+
"npm:specpi-browser-qa@0.1.0",
|
|
5
5
|
"npm:pi-subagents@0.67.0",
|
|
6
|
-
"npm:pi-lens@4.1.6",
|
|
7
6
|
"npm:pi-goal-x@0.31.2",
|
|
8
7
|
"npm:@sreetej510/pi-usage@0.10.0",
|
|
9
8
|
"npm:@gotgenes/pi-permission-system@32.0.2"
|