fix: complete 0.3.6 runtime and research reliability

[Advait Paliwal (advaitpaliwal)]

Summary

• repair alphaXiv OAuth against the current issuer, validate callback state, and keep browser fallback usable on Windows and WSL
• make Windows installation transactional from the first backup move, verify checksums fail-closed, and exercise the candidate under Windows PowerShell 5.1 plus PowerShell Core
• preserve Pi's follow-up action while adding Option+Enter newline input, and add a model-aware /thinking [level] command with supported-level filtering and max
• move fetch_content scratch data into the active project, fix active-org atomicity, package the required source modules, and retain the bundled research package stack
• migrate the runtime to Pi 0.82.1 ModelRuntime, pin the complete runtime graph, repair current Pi/MCP consumer advisories, and verify source plus installed runtime artifacts
• publish only the exact verified tarball after cross-platform consumers and native bundles pass, with deterministic archives, package budgets, exact release-asset reconciliation, and post-publish identity checks

Contributor PR #189 remains included as commit 79aa7b2 with its original authorship and cherry-pick provenance.

PR #200 independently proposed the same user-facing /thinking capability after this branch's implementation was already prepared. This candidate supersedes it with Pi 0.82.1 model-aware levels, direct arguments, completions, non-UI status, and clamp reporting; no co-author attribution is claimed for the independently prepared implementation.

PR #191 and PR #197 remain intentionally excluded because generic extension inventory and hard-coded provider catalog lanes are broader than the owning research-loop defects.

Exact candidate

• head: 93779a97d0138851ccd5c514204fafd8a3d70787
• package: @companion-ai/feynman@0.3.6
• Pi runtime: 0.82.1
• candidate tarball: 112,175,540 bytes, 327,758,702 unpacked bytes, 39,102 files, SHA-256 54d965608f6b3f7ec228a9aee84edd22b691c790841c5715937787962a70efb3
• runtime archive SHA-256: 546fc45b7d46cbe1b8898c0a5d2bd3553ba9a7de073adfeedd277094b50d9de6

The fresh Daytona tarball from the release-impacting installer head and the final GitHub PR artifact are byte-identical. The final commit changes only the PR verifier, its regression, and the lab notebook; none are shipped in the npm package.

Verification

• local Node 24.18.0: focused Windows/native/workflow regressions 9/9; full npm test 650/650; typecheck; build; architecture check; website lint/typecheck/build; root and website production audits; package freshness review; git diff --check; dry pack and package budget
• fresh Daytona at exact detached public-installer head b098c3809b9b148a4bea2829c16faa07bf464015 on Node 24.18.0: full 650/650 tests, source, website, package, clean-consumer, five production audits, source/installed artifact verification, version/help/package/search flows, and Pi RPC extension loading (112 commands, including web-results) passed; the sandbox was deleted after receipts were retained
• prior fresh Daytona on Node 25.9.0 with PATH empty: installed package artifact verification passed without a host tar executable
• GitHub Actions run 30355913177: release candidate, Linux Node 22.22.0/24.18.0/25, macOS Node 24.18.0, Windows Node 24.18.0/25, native Windows build, Windows PowerShell 5.1 installer, and PowerShell Core installer all passed

Tracked issues will be closed with the published 0.3.6 install/release receipt rather than at merge time: #182, #185, #186, #187, #188, #190, #193, #196.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
feynman	Ready	Preview, Comment	Jul 28, 2026 11:43am

[Jose Luis Garcia del Castillo (garciadelcastillo)]

For what is worth, was struggling with alphaxiv login, and simply replaced my local scripts/lib/alpha-hub-auth-patch.mjs with with https://raw.githubusercontent.com/companion-inc/feynman/3f4ffe7b8c46e96182c5641982b809199ce162ad/scripts/lib/alpha-hub-auth-patch.mjs, and was able to login again! 💯💯🎉🎉

companion-inc/alpha-hub#8