Siftpath 2.2.0

Siftpath 2.2.0 release notes

Backward-compatible feature release from 2.1.1. Publication is confirmed by the npm registry and Git release, not this source version. Releases require final candidate CI, package artifact/hash checks, npm authentication and explicit maintainer confirmation.

New providers

• Add an opt-in direct DeepSeek Search API backend (connection.transport: 'deepseek'). It stays disabled by default and does not change saved routes, enable services or switch any intent. No anonymous mode; a query outside the documented limits is rejected rather than rewritten or forwarded to a fallback provider.
• Ship a separately packaged native DeepSeek Harness bundle that registers one search provider and siftpath_read({ url, reader?, focus? }) without replacing DSH source files, hijacking a tool name or selecting Siftpath on installation. The bundle is not published: its pinned host dependency audit fails the High/Critical gate. See DSH.
• Keep the two model-facing MCP tools, the Pi extension, the default routes and the 16,000-character default output budget unchanged.

Output and diagnostics

• Report omittedChars whenever the budget clips a body. An agent can tell it holds a prefix and how much of the end was cut instead of guessing; the count is settled together with the prefix so it can never overflow maxOutputChars.
• Classify an observable upstream 402 as BALANCE_EXHAUSTED and an observable 429 as RATE_LIMITED rather than folding both into UPSTREAM_ERROR. Only a status code is read — structuredContent.error.status, or an HTTP <code> prefix in a text block. Provider wording is never scanned, so no ban, plan or entitlement is inferred, consistent with the existing 403 rule.
• Stop status from contradicting itself. A recorded provider failure now appears in Next: as Last test failed: <provider>(<code>), and an untested or failing service is no longer summarised as healthy. A failure recorded before a package upgrade or configuration change is still listed but labelled with why it may no longer describe the current setup.
• Name every attempt when no provider succeeds: Each attempt failed: jina(BALANCE_EXHAUSTED), jina-backup(AUTH_FAILED). A single generic sentence made users re-check everything when the actionable cause was already known.
• Document multi-account redundancy as configuration rather than a feature: a second account is another provider plus a fallback entry, keeping the failing account visible in warnings. No automatic account rotation and no balance polling are added — whether a 402 means transient throttling, an exhausted plan or genuine non-payment is decided by the operator, not guessed locally.
• Document what Siftpath cannot see, because it forwards reader responses instead of fetching pages itself: a 404 body, an anti-bot block or empty boilerplate still arrives as isError: false; raw HTML is passed through uncleaned; a focus miss is not a NOT_FOUND.

Compatibility and upgrade

The web_search / web_read inputs, default routes, explicit Reader selection and fallback rules are unchanged. Saved Keys, custom bindings, routes and legacy configuration compatibility remain; no configuration rewrite or setup rerun is required. Upgrade the package, then restart Pi or /reload.

Consumers matching output fields or error codes should handle the additive omittedChars field and the new BALANCE_EXHAUSTED / RATE_LIMITED codes where a generic UPSTREAM_ERROR could previously appear. omittedChars is present only when the body was actually clipped. Do not parse human-readable error messages as an API. See diagnostics and migration.

Known limits and acceptance

• The default serialized JSON budget remains 16,000 characters, not tokens. Long bodies can lose decisive evidence; truncated describes local clipping only, not upstream completeness, and omittedChars quantifies the cut without recovering it.
• A supported focus binding, an untruncated response or a successful call does not guarantee complete evidence or an accurate model answer. Source indexes can contain unfetched outgoing links.
• Reader-side failures stay invisible by design. Because no local fetch is performed, Siftpath cannot report an HTTP status the provider never sent.
• The shipped Jina focus window stays at topk: 3, chunk_size: 250. Narrower windows return fewer characters but were observed to drop the sentence answering a single-fact focus while still reporting no clipping; see selective reading.
• Current candidate checks and historical evidence are recorded separately in testing.
• Live acceptance for this candidate covers provider connectivity, a successful read from each configured Reader, omittedChars accuracy on a real clipped page, and the Jina focus-window comparison. It does not include a model-driven agent session: whether a model uses omittedChars or focus correctly is still unverified.

Siftpath 2.1.1

Siftpath 2.1.1 release notes

Maintenance update from 2.1.0. Publication is confirmed by the npm registry and Git release, not this source version. Releases require final candidate CI, package artifact/hash checks, npm authentication and explicit maintainer confirmation.

Fixes and diagnostics

• Classify observable tool-level upstream 401/403 statuses as AUTH_FAILED / UPSTREAM_FORBIDDEN instead of a generic UPSTREAM_ERROR. Raw provider errors and credentials remain private; a 403 does not establish whether the cause is a plan, permission or suspended access. No anonymous credential-error recovery is added.
• Give actionable provider-specific messages for explicit Reader failures and a sole FOCUS_UNSUPPORTED cause. Default-route failures may still return NO_PROVIDER_SUCCEEDED with underlying diagnostics.
• Show whether a saved read binding maps $focus in offline CLI/Pi status. This checks the binding, not whether an upstream extraction will be complete or correctly focused.
• Distinguish historical test results made stale by a package upgrade, a configuration change or an unknown cause. Upgrading no longer falsely tells users their configuration changed.

Dependencies and release checks

• Update the locked dependency tree for the body-parser advisory. Production High/Critical audit findings block release; full-tree findings, including development tooling, are reported separately. An unavailable audit is a failed check.
• Verify the actual tarball both against the repository lockfile and as a clean consumer install without that lockfile. Check production-only dependency isolation, CLI, SDK exports, MCP tool schemas and real Pi 1.4.0 registration without inference. These checks do not call providers or models; consumer installation and auditing can access the npm registry.
• Update TypeScript, esbuild and GitHub Actions tooling. Functional CI covers Linux/Windows × Node 22/24/26, with separate npm 11/12 compatibility checks. Node.js 22 remains the minimum runtime and Node 22 types remain the development baseline.
• Keep MCP SDK v1; no SDK v2 migration, new runtime dependency or new research layer is included. See dependency assessment.

Compatibility and upgrade

The web_search / web_read inputs, default routes, explicit Reader selection and fallback rules are unchanged. Saved Keys, custom bindings, routes and legacy configuration compatibility remain; no configuration rewrite or setup rerun is required. Upgrade the package, then restart Pi or /reload.

Status adds focus and optional lastTestStaleReason. Existing diagnostic history stays readable; records without the new configuration fingerprint are conservatively marked stale with an unknown cause. Consumers matching error codes should handle AUTH_FAILED / UPSTREAM_FORBIDDEN where observable upstream tool errors previously produced UPSTREAM_ERROR. Do not parse human-readable error messages as an API. See diagnostics and migration.

Known limits and acceptance

• The default serialized JSON budget remains 16,000 characters, not tokens. Long bodies can lose decisive evidence; truncated describes local clipping only, not upstream completeness.
• A supported focus binding, an untruncated response or a successful call does not guarantee complete evidence or an accurate model answer. Source indexes can contain unfetched outgoing links.
• This maintenance preparation reuses historical live evidence and does not run paid model/provider acceptance. Current candidate checks and historical evidence are recorded separately in testing.

Siftpath 2.1.0

Siftpath 2.1.0 release notes

Publication is gated on the final main commit passing CI, matching package artifacts, npm authentication and explicit maintainer confirmation. These notes and the package version do not establish publication.

Search and reading

• Recommended search pair: Tavily for general/research and Exa for semantic discovery. Brave remains available in advanced setup; new configurations do not enable it or add fallback routes.
• Two Readers: Jina remains the default; Firecrawl is explicitly selectable. web_read({ url, reader?, focus? }) and CLI read URL --reader ID accept any valid configured provider ID with a read binding, including custom providers. Omitting reader uses saved read routes; selecting one attempts only that provider, without fallback or automatic enablement.
• New authenticated Firecrawl setup uses the official HTTP MCP endpoint https://mcp.firecrawl.dev/v2/mcp with Bearer authentication, native Markdown and onlyMainContent. Existing stdio or custom connections are not rewritten.

Evidence and reliability

• Exact mirrored text/structured output is emitted once; distinct evidence, original URLs, native notes and warnings remain. No fuzzy deduplication or local summarization.
• Known Firecrawl responses preserve optional creditsUsed, cacheState and valid cachedAt metadata within the existing serialized output budget. Missing usage stays unknown; cache hits are not assumed free.
• Focus support is checked against the actual binding before a business request; unsupported focus does not silently become a full-page read. Provider-side extraction downgrades can still occur. Concise tool guidance distinguishes local clipping from completeness and asks for conditions, targeted follow-up or claim-specific uncertainty; it is not a model accuracy guarantee.
• Cold connection initialization is aborted when its final waiting caller cancels or times out, without cancelling other waiters. Impossible calendar timestamps are rejected.
• npm ships runtime files and selected user documentation, not historical experiment/acceptance reports, raw fixtures, source/tests, credentials or development dependencies. Windows fixtures retain their original bytes.

Compatibility

This is a backward-compatible feature release relative to 2.0.1. The two MCP tool names, CLI/SDK entry points, legacy config paths and environment aliases remain. Existing routes, explicit fallback order, Keys and custom bindings are preserved; new recommended defaults do not rewrite old configurations. Environment Keys remain environment-only. Authentication errors never trigger anonymous fallback. The former experimental mode interface was withdrawn before this release and is not a supported API. See migration for precise legacy defaults and narrow Jina binding migration.

Node.js 22+ is required, unchanged from 2.0.1. Upgrade the package, then restart Pi or /reload. Uninstalling does not remove saved credentials.

Known limits and acceptance

• The default 16,000-character serialized JSON budget (not tokens) can clip long bodies and omit decisive evidence. Changing Reader does not solve this limit. truncated reports local clipping only, not upstream completeness.
• Source indexes may include unfetched outgoing links. Focus mapping and successful calls do not prove complete or correct evidence.
• Authenticated business calls to Tavily, Exa, Jina and Firecrawl have succeeded. Real Pi sessions have demonstrated autonomous search, reading, explicit Reader selection and final answers. Historical transport/harness failures remain recorded but no longer describe the latest workflow evidence; see testing and history. Tool-chain success is not a guarantee of answer accuracy.
• Upstream focus may omit exceptions; models can misread evidence that was returned intact or infer unsupported details. These are documented model/upstream limits, not a new research or fact-checking layer in Siftpath. This release preparation reuses existing live evidence and runs no paid model/provider acceptance. Formal publication still requires maintainer confirmation.

Published artifact

• Commit: 0eefb71069ee4b71d8f6d30c58425fb4b15b8662
• npm: @onedotmint/siftpath@2.1.0, tag latest
• Verified local/CI/public npm tarball SHA-256: ad183eeb0ee75add02cebfa65115a05e382e7622ddb9d735b6299c458702cc18
• CI: https://github.com/onedotmint/Siftpath/actions/runs/40351011746 and https://github.com/onedotmint/Siftpath/actions/runs/40351018544