Declare typebox as a peer and update to Pi 0.99

changelog/unreleased/declare-pi-web-tools-as-read-only.md

@@ -0,0 +1,11 @@
+---
+title: Declare Pi web tools as read-only
+type: change
+authors:
+  - mavam
+prs:
+  - 53
+created: 2026-09-29T18:04:46.774918Z
+---
+
+The `web_search`, `web_contents`, `web_answer`, and `web_research` Pi tools now declare themselves as read-only calls that reach the open web. Extensions that gate tool calls, such as permission prompts, can use these hints to decide what needs confirmation. Partial failures are also reported through the tool result itself, so they show as tool errors without a separate event handler. This requires Pi 0.99 or later.

changelog/unreleased/fix-pis-host-provided-package-warning.md

@@ -0,0 +1,11 @@
+---
+title: Fix Pi's host-provided package warning
+type: bugfix
+authors:
+  - mavam
+prs:
+  - 53
+created: 2026-09-29T18:04:46.54454Z
+---
+
+Pi no longer warns that webfox lists `typebox` in `dependencies`. The package now declares `typebox` as a peer dependency, so Pi supplies its own copy to the extension and avoids duplicate runtime modules. Standalone installs of the `web` CLI and TypeScript library keep working because package managers install required peer dependencies automatically.

nix/package.nix

@@ -16,7 +16,7 @@ buildNpmPackage {
 
   nodejs = nodejs_24;
   npmDepsFetcherVersion = 2;
-  npmDepsHash = "sha256-H/giK59DxaxWFeBGW2giGbm5+VJT2rmMpLyQPKhIn9w=";
+  npmDepsHash = "sha256-io1p4R4HvQvUpu8B7VScIjkBg860IqF2Y1bbKYkrAZQ=";
 
   # Root package versions do not affect dependencies. Normalize them in both
   # the fetcher and build so release bumps preserve the dependency cache hash.