Disable checkout credential persistence so repository-controlled code
run by npm ci/test cannot read GITHUB_TOKEN from .git/config, and pin
actions to full commit SHAs to guard against mutable-tag supply-chain
attacks.
resolveSearchDefaults no longer accepts a per-call model override and
SearchParams no longer carries limit; neither was reachable from the
tool schema (limit is applied client-side in formatForLLM). Also fold
asPositiveNumber into asPositiveInteger and simplify recency matching.
The perplexity_search tool no longer prompts for pasted browser
credentials mid-search; /perplexity-login --browser is the single
entry point for that flow. Drop the now-unused promptForBrowserAuth
option and its Cloudflare-challenge fallback from authenticate().
Run Perplexity search and auth requests through pi's Node runtime instead of
shelling out to Bun. Move development and CI commands to npm, add a Node test
build path, and keep OTP auth fail-fast when Set-Cookie headers are not
available.
mock.module() in index-execute.test.ts permanently poisons Bun's
module cache — mock.restore() does not undo it in Bun 1.3.11.
Use cache-busted dynamic imports (../src/mod.ts?t=${Date.now()}) in
beforeEach for the three affected test files so each test gets a
fresh, unpoisoned module instance.
- Re-add isError flag to error details so renderPerplexityResult
shows error styling instead of green success rows
- Use errorMessage() for unknown errors instead of unsafe cast
- Trim whitespace-only PI_PERPLEXITY_MODEL env var values
- Add comment explaining clearToken() on AUTH rejection
The REAL_JWE_TOKEN constant in otp-flow.test.ts contained an actual
token captured from a live Perplexity auth response. Replace with a
structurally valid but non-functional placeholder.
canceledAtEmailPrompt and canceledAtOtpPrompt were closure booleans
set inside prompt callbacks to detect user cancellation after the
fact. Fragile if authenticate ever retries prompts or changes order.
In the command context both prompt functions are always provided, so
AuthError(NO_TOKEN) unambiguously means the user declined to enter
required input. Check the error code directly instead.
renderPerplexityResult was pattern-matching content text prefixes
to decide whether to render in error style. This was tightly coupled
to exact message strings in index.ts — a wording change would
silently break the error styling.
Set isError: true in details on every error return path in execute,
and check details.isError in the renderer instead.
PERPLEXITY_USER_AGENT and PERPLEXITY_API_VERSION were duplicated
in auth/login.ts and search/client.ts. Centralise both so updates
only need to happen in one place.
Ivan Pereira
Ivan PereiraandGitHub