Refresh research runtime and release stack for 0.3.49

[advaitpaliwal]

Summary

• Update the coordinated research runtime to Pi 0.85.1, personal Alpha Hub 0.1.4, pi-subagents 0.65.1, web access 0.28.0 and LiteParse 2.14.3; retain exact-source safety and model-identity patches.
• Update CLI/scientific/telemetry/site dependencies, native Node 24.20.0 and compatible publisher npm 12.0.2. Preserve user configuration and research-focused defaults.
• Keep the existing package size limits and supported platforms: portable esbuild 0.28.2, verified optional-platform resolution, and source-map-only dependency pruning.
• Repair Node 22 pruning-generation parity and declaration sealing, plus npm global cross-platform installs that leave an empty compiler slot. Recovery uses only verified bytes from the installation's own runtime, canonical manifest fields, strict path/hash checks and rollback.

Latest local qualification

Head: 513b6af76006671bdc2a5548087735f08401e26f.

• Full suite 1205/1205, zero failures/skips; typecheck, architecture and whitespace checks pass.
• Actual lifecycle-enabled dry/real npm packs are byte-identical. Tarball 126,115,551 bytes, within unchanged 131,072,000-byte limit; 452 packaged tracked source files match this clean commit.
• Artifact verification and root/runtime audits pass with zero vulnerabilities.
• Exact failed Linux CI artifact reproduced the global Mac failure. Applying only the reviewed helper repair makes version/help, full installed-runtime, docparser and all four compiler API/CLI/Chord surfaces pass.
• Independent adversarial review cleared the recovery's canonical metadata, captured binary buffer, no-outside-write rules and negative/rollback tests.
• Earlier qualification includes actual detached research-runner model/tool safety, Node 22 cold/warm integrity, Mac native bundle and website checks.

Release gate

Keep draft until all eight required jobs for this exact head pass: source/package, Windows native build and six OS/Node local/global consumer lanes. No 0.3.49 publication is claimed yet; no failing lane may be dropped or bypassed.

Cloudflare production-domain cutover and legacy npm 2FA notices are separate access issues. Daytona's existing key is rejected (401); authenticated GitHub Linux VMs provide the current independent Linux qualification.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
feynman	Ignored		Sep 6, 2026 5:53pm UTC