Skip to content

Bump the npm group with 8 updates - #2

Merged
nathanvvong merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-eeeb0aba10
Oct 18, 2026
Merged

Bump the npm group with 8 updates#2
nathanvvong merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-eeeb0aba10

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 17, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm group with 8 updates:

Package From To
@daytonaio/sdk 0.223.0 0.224.0
@types/node 26.6.4 26.6.5
@vercel/sandbox 3.5.1 3.8.0
e2b 2.53.1 2.56.0
@earendil-works/pi-agent-core 1.0.4 1.2.0
@earendil-works/pi-ai 1.0.4 1.2.0
@earendil-works/pi-coding-agent 1.0.4 1.2.0
@earendil-works/pi-tui 1.0.4 1.2.0

Updates @daytonaio/sdk from 0.223.0 to 0.224.0

Release notes

Sourced from @​daytonaio/sdk's releases.

v0.224.0

0.224.0 (2026-10-12)

🚀 Features

  • sdk: per-call region for sandbox and snapshot create (#355)

🩹 Fixes

  • sdk-python: keep the async PTY session alive when a caller cancels wait() (#353, #351)
  • sdk-python,sdk-typescript: keep stream markers that end a log WebSocket message (#352, #350)

Chores

  • sync go.sum for v0.223.1 (#347)
  • sdk-go: bump to v0.224.0 (#359)

❤️ Thank You

v0.223.1

0.223.1 (2026-10-09)

🚀 Features

  • sdk: add set_public to toggle preview URL access after creation (#341)

🩹 Fixes

  • analytics-api-client-python: use wait-for-pypi.sh in publish to dodge stale CDN index (#342)

Chores

  • sync go.sum for v0.223.0 (#339)
  • deps: batch dependabot updates 2026-10-07 (#344)
  • sdk: document preview URL authentication, background processes, shell and resource limits (#340)
  • sdk-go: bump to v0.223.1 (#346)

❤️ Thank You

Commits
  • 9fef984 chore(sdk-go): bump to v0.224.0 (#359)
  • 14232c3 feat(sdk): per-call region for sandbox and snapshot create (#355)
  • dd50b12 fix(sdk-python,sdk-typescript): keep stream markers that end a log WebSocket ...
  • 7d3d8d7 fix(sdk-python): keep the async PTY session alive when a caller cancels wait(...
  • 04f8503 chore: sync go.sum for v0.223.1 (#347)
  • c811437 chore(sdk-go): bump to v0.223.1 (#346)
  • 1247c99 chore(deps): batch dependabot updates 2026-10-07 (#344)
  • 7bb63c3 fix(analytics-api-client-python): use wait-for-pypi.sh in publish to dodge st...
  • bbc91a1 chore(sdk): document preview URL authentication, background processes, shell ...
  • 54e2ca3 feat(sdk): add set_public to toggle preview URL access after creation (#341)
  • Additional commits viewable in compare view

Updates @types/node from 26.6.4 to 26.6.5

Commits

Updates @vercel/sandbox from 3.5.1 to 3.8.0

Release notes

Sourced from @​vercel/sandbox's releases.

@​vercel/sandbox-mock@​3.8.0

Patch Changes

@​vercel/sandbox@​3.8.0

Minor Changes

  • Add a new onStart hook on sandbox.runCommand({ ... }) to be notified when a command is started when not using detached: true (#384)

@​vercel/sandbox-mock@​3.7.0

Patch Changes

@​vercel/sandbox@​3.7.0

Minor Changes

  • Add opt-in stdin for commands. Pass stdin: true to a detached runCommand, then use command.writeStdin(data) and command.closeStdin() while it runs, or pass a Readable such as process.stdin to have it piped to the command. (#365)

Patch Changes

  • Update @vercel/oidc to v4. (#375)

@​vercel/sandbox-mock@​3.6.1

Patch Changes

@​vercel/sandbox@​3.6.1

Patch Changes

  • Preserve UTF-8 characters split across command and log stream chunks so recovery does not skip new output. (#374)

  • Recover from interrupted command wait and log connections, including streams ending with incomplete JSON records, without rerunning commands or duplicating output. (#374)

@​vercel/sandbox-mock@​3.6.0

Minor Changes

  • Add a new Drive.get method to retrieve an existing drive by name. (#367)

Patch Changes

@​vercel/sandbox@​3.6.0

... (truncated)

Changelog

Sourced from @​vercel/sandbox's changelog.

3.8.0

Minor Changes

  • Add a new onStart hook on sandbox.runCommand({ ... }) to be notified when a command is started when not using detached: true (#384)

3.7.0

Minor Changes

  • Add opt-in stdin for commands. Pass stdin: true to a detached runCommand, then use command.writeStdin(data) and command.closeStdin() while it runs, or pass a Readable such as process.stdin to have it piped to the command. (#365)

Patch Changes

  • Update @vercel/oidc to v4. (#375)

3.6.1

Patch Changes

  • Preserve UTF-8 characters split across command and log stream chunks so recovery does not skip new output. (#374)

  • Recover from interrupted command wait and log connections, including streams ending with incomplete JSON records, without rerunning commands or duplicating output. (#374)

3.6.0

Minor Changes

  • Add a new Drive.get method to retrieve an existing drive by name. (#367)

  • Add a new drive.fork({ name }) API that forks and returns a new Drive, inheriting the parent drive's data, max size and region. (#369)

Commits

Updates e2b from 2.53.1 to 2.56.0

Changelog

Sourced from e2b's changelog.

2.56.0

Minor Changes

  • 6a74c39: Require Node.js 22.19.0 or newer and depend on undici@^8 only (undici 7 is dropped).

    • undici 8 respects the server's HTTP/2 SETTINGS_MAX_CONCURRENT_STREAMS and opens more connections when one is saturated.
    • Breaking: the SDK-level in-flight request cap is removed, along with the E2B_API_INFLIGHT_REQUESTS, E2B_ENVD_INFLIGHT_REQUESTS and E2B_ENVD_RPC_INFLIGHT_REQUESTS env vars. Concurrency is governed by undici's connection pools (E2B_API_CONNECTIONS, E2B_ENVD_RPC_CONNECTIONS).

  • 73a784d: Require Node.js 22 or newer (Node.js 20 is no longer supported).

Patch Changes

  • Updated dependencies [73a784d]
    • @​e2b/dockerfile-utils@​0.1.1

2.55.0

Minor Changes

  • b52cd30: Add mode: 'full' | 'filesystem' (exported as the SnapshotMode type) to createSnapshot / create_snapshot. With 'filesystem', only the filesystem is persisted: the snapshot is smaller and faster to take, and sandboxes created from it cold-boot (start fresh from disk) instead of restoring memory. The source sandbox keeps running either way. Omitted, the API default (a full memory snapshot) applies.

    pause() and the lifecycle.onTimeout / lifecycle["on_timeout"] pause object form accept the same mode. Their keepMemory / keep_memory option is deprecated in favor of it (keepMemory: false is mode: 'filesystem') and keeps working; passing both is an InvalidArgumentError / InvalidArgumentException.

Patch Changes

  • 0894595: Remove dead empty-chunk guards from command output handling; envd never sends empty output chunks, so behavior is unchanged.

2.54.0

Minor Changes

  • cc85f69: Replace the third-party Dockerfile parsers (dockerfile-ast, dockerfile-parse) used by Template.fromDockerfile / Template.from_dockerfile with a built-in parser ported from BuildKit. Quoted and escaped values in ENV/ARG/COPY, whitespace inside RUN/CMD arguments, mixed-case AS aliases, comments in line continuations, the # escape= directive, COPY --chmod, heredocs and ENTRYPOINT + CMD combination are now handled consistently in both SDKs. A .dockerignore line consisting of a lone ! is now rejected, as Docker does, instead of being skipped.

Patch Changes

  • Updated dependencies [cc85f69]
    • @​e2b/dockerfile-utils@​0.1.0
Commits
  • 62a17df [skip ci] Release new versions
  • 6a74c39 feat(js-sdk)!: drop undici 7 and the in-flight cap, depend on undici@^8 only ...
  • 73a784d chore(js): require Node.js 22 (#1979)
  • 1c1b5a4 [skip ci] Release new versions
  • 0894595 chore(sdk): remove dead empty-chunk guards from command handles (#1962)
  • b52cd30 feat(sdk): filesystem-only snapshots via mode on createSnapshot (#1925)
  • b47f27c [skip ci] Release new versions
  • cc85f69 feat(template): replace third-party Dockerfile parsers with @​e2b/dockerfile-u...
  • See full diff in compare view

Updates @earendil-works/pi-agent-core from 1.0.4 to 1.2.0

Release notes

Sourced from @​earendil-works/pi-agent-core's releases.

v1.2.0

New Features

  • Per-key OpenRouter model lists: with an OpenRouter key, Pi lists only the models that key may use, with the key's context size, max output, and prices, including regional endpoints set in models.json. See OpenRouter.
  • Published configuration schemas: add $schema to settings.json, models.json, keybindings, and themes for editor validation and completion. See Settings, Models, Keybindings, and Themes.
  • Clipboard copies over remote sessions: PI_CLIPBOARD_OSC52=1 sends copied text to a remote client's clipboard when Pi cannot detect the remote session, such as a multiplexer attached from another machine. See Pi Process Configuration.
  • Codemode improvements: tool declarations show input constraints such as integer, minimum/maximum, and default, and codemode rows show elapsed and total time. See Codemode.
  • before_agent_start for extension-triggered runs: runs started by pi.sendMessage(..., { triggerTurn: true }) go through the same setup as prompts. See Events and concurrency.

Breaking Changes

  • Published generated configuration schemas for models, settings, keybindings, and themes at https://pi.dev/schemas/*.schema.json. The theme schema moved to https://pi.dev/schemas/theme.schema.json; themes loaded during startup now receive the same schema validation as later reloads. Update theme $schema references, define reusable colors under vars, and remove unsupported metadata (#9880, #10751 by @​christianklotz)
  • Changed before_agent_start to also fire for runs started by pi.sendMessage(..., { triggerTurn: true }) while idle. BeforeAgentStartEvent is now a union on messageType: "user" events carry prompt and images, and "custom" events carry the starting message and no prompt. Messages returned by handlers are added to both kinds of run, and pending deliverAs: "nextTurn" messages are delivered with the custom-message run. Handlers that should act only on user prompts must check event.messageType === "user" (#10267, #5581, #10739 by @​davidbrai)
  • Changed the session to count as busy while a run starts, including during before_agent_start handlers: ctx.isIdle() is false, pi.sendMessage() queues into the starting run instead of starting a second run that failed with "Agent is already processing", pi.sendUserMessage() requires deliverAs, and an abort requested meanwhile aborts the run once it starts (#10739 by @​davidbrai)
  • Changed pi mcp list --json to report resources: true for servers that offer resources instead of resources and resourceTemplates counts; Pi no longer lists resources when connecting (#10526)

Added

  • Added reachesTools to tool definitions, so tools that reach other tools (such as codemode and tool_search) declare which tools a call may reach; the MCP extension uses it to wait for the servers a call needs and to decide whether a replacement codemode or tool_search tool can reach MCP tools
  • Added aliases to tool namespaces; codemode's describeNamespace() and the namespace option of searchTools() match them, and MCP namespaces use the server name
  • Added per-key OpenRouter model lists: with an OpenRouter key, Pi lists only the chat models that key may use, with the key's context size, max output, and prices, including guardrails and regional endpoints set as the base URL in models.json. The list is saved and used offline (#10353, #10672 by @​davidbrai)
  • Added PI_CLIPBOARD_OSC52=1 to send copied text to the terminal with OSC 52 after the local clipboard write, so copies reach a remote client's clipboard when Pi cannot detect the remote session, such as multiplexer attaches from another machine or remote IDE daemons (#10826, #10835, #10114)
  • Added elapsed time while a codemode script runs and its total time once finished to the codemode tool row, like bash rows (#10708)

Changed

  • Changed the showHardwareCursor setting to use only the terminal cursor instead of also drawing Pi's reverse-video cursor
  • Changed codemode tool declarations to show input constraints such as integer, minimum/maximum, length, pattern, and default as @ tags on property comments, so scripts see them without the tool repeating them in descriptions (#10707)
  • Changed codemode declarations of MCP tools to spell out the result type (content, structuredContent, isError) instead of referring to CallToolResult<T>, which describeTool(), searchTools(), and ALL_TOOLS showed without defining it; the codemode description no longer includes the shared MCP types
  • Changed serializeConversation() (compaction, branch summaries, bug reports) to omit thinking blocks; replayed thinking is often not in the live context, so including it could make a summarization request larger than the context it summarizes and fail

Fixed

  • Fixed codemode ignoring a // @options: line that is not the first line of the script, which ran the script without the requested timeout_ms; the call now fails with an error before the script runs (#10631)
  • Fixed Mistral streams being aborted mid-generation (e.g. during long thinking) after the request timeout; the timeout now applies only to waiting for response headers (#10609)
  • Fixed a symlinked AGENTS.md in a git worktree nested inside its main repo causing no project context file to load (#10681)
  • Fixed the code mode tool description claiming every failed tool call rejects; a tool that declares an output schema resolves with its value on failure too (e.g. bash with a nonzero exit)
  • Fixed runs started by pi.sendMessage(..., { triggerTurn: true }) removing system prompt sections added in before_agent_start after their first tool call, which changed the prompt mid-run and broke the provider prompt cache twice per run (#10267, #10739 by @​davidbrai)
  • Fixed codemode blocking the process for seconds to minutes after scripts with many text() calls; joining the output items was quadratic (#10678)
  • Fixed print mode (-p) exiting 0 without a warning when the final response was cut off at the model's output token limit; it now prints the partial text, writes a warning to stderr, and exits 1 (#10799)
  • Fixed pi mcp login --help and the CLI docs describing --timeout as only the wait for the browser; it limits the whole sign-in (#10636)
  • Fixed ~ not being expanded in !pattern, +path, and -path entries of the extensions, skills, prompts, and themes settings, so entries like !~/skills/pdf matched nothing (#10765)
  • Fixed MCP servers with resources registering no tools until every resource was listed; Pi no longer lists resources when connecting, so /mcp and pi mcp list show that a server offers resources instead of counting them (#10526)
  • Fixed MCP tool calls failing when the server returns structured content that is not an object (an array, null, or a primitive, as MCP 2026-07-28 allows); codemode declarations of MCP tools without an output schema now type structuredContent as unknown instead of an object (#10416)
  • Fixed reading or writing auth.json on Windows failing with EPERM when the previous lock folder was still being deleted; Pi now retries briefly before reporting the error (#10801)
  • Fixed OpenRouter router models such as openrouter/auto showing a cost of -$1,000,000 per 1M tokens; OpenRouter's negative placeholder prices are now 0 (#10672 by @​davidbrai)
  • Fixed Anthropic requests failing when the provider rejects the strict tool set for grammar size, tool count, or union limits; Pi now retries once with preferred tools non-strict (#10409)
  • Fixed "The upstream provider returned an error" not being retried as a transient provider error (#10842)
  • Fixed focused fullscreen overlays blocking mouse-wheel scrolling of the transcript (#10769)
  • Fixed fragmented terminal color replies leaking hex values into the prompt and opening the external editor (related reports: #10256, #10657)

... (truncated)

Changelog

Sourced from @​earendil-works/pi-agent-core's changelog.

[1.2.0] - 2026-10-12

[1.1.0] - 2026-10-07

Added

  • Added durationMs to tool result messages, AgentToolCallOutcome, and tool_execution_end events: how long execute() took, measured with a monotonic clock and excluding hooks. Calls that did not run have none (#10549)

Changed

  • streamProxy() returns an AssistantMessageEventStream, so proxied responses get durationMs like direct ones
Commits
  • 06a4669 Release v1.2.0
  • 75a9972 Add [Unreleased] section for next cycle
  • abe508e Release v1.1.0
  • f284a24 fix(ai): time responses with private fields; use the real stream in proxy and...
  • 36a686e feat: record response, tool execution, and durable task times
  • 28dcce2 Add [Unreleased] section for next cycle
  • See full diff in compare view

Updates @earendil-works/pi-ai from 1.0.4 to 1.2.0

Release notes

Sourced from @​earendil-works/pi-ai's releases.

v1.2.0

New Features

  • Per-key OpenRouter model lists: with an OpenRouter key, Pi lists only the models that key may use, with the key's context size, max output, and prices, including regional endpoints set in models.json. See OpenRouter.
  • Published configuration schemas: add $schema to settings.json, models.json, keybindings, and themes for editor validation and completion. See Settings, Models, Keybindings, and Themes.
  • Clipboard copies over remote sessions: PI_CLIPBOARD_OSC52=1 sends copied text to a remote client's clipboard when Pi cannot detect the remote session, such as a multiplexer attached from another machine. See Pi Process Configuration.
  • Codemode improvements: tool declarations show input constraints such as integer, minimum/maximum, and default, and codemode rows show elapsed and total time. See Codemode.
  • before_agent_start for extension-triggered runs: runs started by pi.sendMessage(..., { triggerTurn: true }) go through the same setup as prompts. See Events and concurrency.

Breaking Changes

  • Published generated configuration schemas for models, settings, keybindings, and themes at https://pi.dev/schemas/*.schema.json. The theme schema moved to https://pi.dev/schemas/theme.schema.json; themes loaded during startup now receive the same schema validation as later reloads. Update theme $schema references, define reusable colors under vars, and remove unsupported metadata (#9880, #10751 by @​christianklotz)
  • Changed before_agent_start to also fire for runs started by pi.sendMessage(..., { triggerTurn: true }) while idle. BeforeAgentStartEvent is now a union on messageType: "user" events carry prompt and images, and "custom" events carry the starting message and no prompt. Messages returned by handlers are added to both kinds of run, and pending deliverAs: "nextTurn" messages are delivered with the custom-message run. Handlers that should act only on user prompts must check event.messageType === "user" (#10267, #5581, #10739 by @​davidbrai)
  • Changed the session to count as busy while a run starts, including during before_agent_start handlers: ctx.isIdle() is false, pi.sendMessage() queues into the starting run instead of starting a second run that failed with "Agent is already processing", pi.sendUserMessage() requires deliverAs, and an abort requested meanwhile aborts the run once it starts (#10739 by @​davidbrai)
  • Changed pi mcp list --json to report resources: true for servers that offer resources instead of resources and resourceTemplates counts; Pi no longer lists resources when connecting (#10526)

Added

  • Added reachesTools to tool definitions, so tools that reach other tools (such as codemode and tool_search) declare which tools a call may reach; the MCP extension uses it to wait for the servers a call needs and to decide whether a replacement codemode or tool_search tool can reach MCP tools
  • Added aliases to tool namespaces; codemode's describeNamespace() and the namespace option of searchTools() match them, and MCP namespaces use the server name
  • Added per-key OpenRouter model lists: with an OpenRouter key, Pi lists only the chat models that key may use, with the key's context size, max output, and prices, including guardrails and regional endpoints set as the base URL in models.json. The list is saved and used offline (#10353, #10672 by @​davidbrai)
  • Added PI_CLIPBOARD_OSC52=1 to send copied text to the terminal with OSC 52 after the local clipboard write, so copies reach a remote client's clipboard when Pi cannot detect the remote session, such as multiplexer attaches from another machine or remote IDE daemons (#10826, #10835, #10114)
  • Added elapsed time while a codemode script runs and its total time once finished to the codemode tool row, like bash rows (#10708)

Changed

  • Changed the showHardwareCursor setting to use only the terminal cursor instead of also drawing Pi's reverse-video cursor
  • Changed codemode tool declarations to show input constraints such as integer, minimum/maximum, length, pattern, and default as @ tags on property comments, so scripts see them without the tool repeating them in descriptions (#10707)
  • Changed codemode declarations of MCP tools to spell out the result type (content, structuredContent, isError) instead of referring to CallToolResult<T>, which describeTool(), searchTools(), and ALL_TOOLS showed without defining it; the codemode description no longer includes the shared MCP types
  • Changed serializeConversation() (compaction, branch summaries, bug reports) to omit thinking blocks; replayed thinking is often not in the live context, so including it could make a summarization request larger than the context it summarizes and fail

Fixed

  • Fixed codemode ignoring a // @options: line that is not the first line of the script, which ran the script without the requested timeout_ms; the call now fails with an error before the script runs (#10631)
  • Fixed Mistral streams being aborted mid-generation (e.g. during long thinking) after the request timeout; the timeout now applies only to waiting for response headers (#10609)
  • Fixed a symlinked AGENTS.md in a git worktree nested inside its main repo causing no project context file to load (#10681)
  • Fixed the code mode tool description claiming every failed tool call rejects; a tool that declares an output schema resolves with its value on failure too (e.g. bash with a nonzero exit)
  • Fixed runs started by pi.sendMessage(..., { triggerTurn: true }) removing system prompt sections added in before_agent_start after their first tool call, which changed the prompt mid-run and broke the provider prompt cache twice per run (#10267, #10739 by @​davidbrai)
  • Fixed codemode blocking the process for seconds to minutes after scripts with many text() calls; joining the output items was quadratic (#10678)
  • Fixed print mode (-p) exiting 0 without a warning when the final response was cut off at the model's output token limit; it now prints the partial text, writes a warning to stderr, and exits 1 (#10799)
  • Fixed pi mcp login --help and the CLI docs describing --timeout as only the wait for the browser; it limits the whole sign-in (#10636)
  • Fixed ~ not being expanded in !pattern, +path, and -path entries of the extensions, skills, prompts, and themes settings, so entries like !~/skills/pdf matched nothing (#10765)
  • Fixed MCP servers with resources registering no tools until every resource was listed; Pi no longer lists resources when connecting, so /mcp and pi mcp list show that a server offers resources instead of counting them (#10526)
  • Fixed MCP tool calls failing when the server returns structured content that is not an object (an array, null, or a primitive, as MCP 2026-07-28 allows); codemode declarations of MCP tools without an output schema now type structuredContent as unknown instead of an object (#10416)
  • Fixed reading or writing auth.json on Windows failing with EPERM when the previous lock folder was still being deleted; Pi now retries briefly before reporting the error (#10801)
  • Fixed OpenRouter router models such as openrouter/auto showing a cost of -$1,000,000 per 1M tokens; OpenRouter's negative placeholder prices are now 0 (#10672 by @​davidbrai)
  • Fixed Anthropic requests failing when the provider rejects the strict tool set for grammar size, tool count, or union limits; Pi now retries once with preferred tools non-strict (#10409)
  • Fixed "The upstream provider returned an error" not being retried as a transient provider error (#10842)
  • Fixed focused fullscreen overlays blocking mouse-wheel scrolling of the transcript (#10769)
  • Fixed fragmented terminal color replies leaking hex values into the prompt and opening the external editor (related reports: #10256, #10657)

... (truncated)

Changelog

Sourced from @​earendil-works/pi-ai's changelog.

[1.2.0] - 2026-10-12

Added

  • Added personalizeOpenRouterCatalog() (@earendil-works/pi-ai/providers/openrouter), which narrows an OpenRouter catalog to the chat models a key may use, with that key's context size, max output, and prices from GET /models/user (#10353, #10672 by @​davidbrai)
  • Added RefreshModelsContext.baseUrl, the registered provider's base URL including configuration overrides applied by wrappers, so dynamic catalogs can follow a base URL set in models.json (#10353, #10672 by @​davidbrai)

Fixed

  • Fixed Mistral streams being aborted mid-generation (e.g. during long thinking) after the request timeout; the timeout now applies only to waiting for response headers (#10609)
  • Fixed OpenRouter router models such as openrouter/auto showing a cost of -$1,000,000 per 1M tokens; OpenRouter's negative placeholder prices are now 0 (#10672 by @​davidbrai)
  • Fixed Anthropic strict: "prefer" tools failing when the provider rejects the strict tool set for grammar size, tool count, or union limits; requests now retry once with preferred tools non-strict while keeping strict: "require" tools strict (#10409)
  • Fixed "The upstream provider returned an error" not being retried as a transient provider error (#10842)

[1.1.0] - 2026-10-07

Breaking Changes

  • A stream function must return an AssistantMessageEventStream, for example from createAssistantMessageEventStream(); a hand-written EventStream<AssistantMessageEvent, AssistantMessage> subclass no longer type-checks in its place

Added

  • Added durationMs to AssistantMessage: AssistantMessageEventStream measures each response with a monotonic clock from the start of the request to its final message, for every API implementation, including direct calls. Deferred results fetched later stay untimed (#10549)
  • Added an optional durationMs to ToolResultMessage for the execution time of the tool (#10549)
  • Added the openai-decisions classifier API for OpenAI's Decisions API, with gpt-6-luna as a classifier model of the openai provider. It needs an API key, so it is not listed as available while openai uses Sign in with ChatGPT
  • Added Claude Haiku 5.5 (claude-haiku-5-5) to the anthropic provider with its prompt-length pricing tier, adaptive thinking with xhigh/max effort, per-message effort, and mid-conversation system messages and tool changes. Bedrock requests for Haiku 5.5 use adaptive thinking, native xhigh, and prompt caching
  • Added LoginOptions.agentName, which replaces pi's name in the Sign in with ChatGPT agent name hint and the Codex browser login originator (#10433 by @​lucasmeijer)
  • Added optional images to ClassifierContext. Models whose input includes "image" judge them with the state; classify() returns an error result for other models and for APIs that cannot send images

Changed

  • The faux provider's prompt-cache usage estimate compares the previous and current prompt message by message and compares characters only from the first differing message; the usage numbers are unchanged.

Fixed

  • Fixed server_busy and servers are currently busy provider errors ending the turn instead of being retried (#10543)
  • Fixed the error message of a failed lazy API setup, such as a module load or auth failure, using its failure time as timestamp instead of the request start
  • Reduced context-limit request failures by estimating input at 3.5 characters per token instead of 4 when calculating output limits (#10497)
  • Fixed Radius models disabled by an organization owner still being listed: a fetched or cached Radius catalog now replaces the shipped default catalog instead of being merged into it
  • Fixed OpenAI provider type-checking with cached catalogs that contain no classifier models
  • Fixed Anthropic browser login failing with "localhost refused to connect" when port 53692 is reserved or in use, for example by Hyper-V/WSL port exclusions on Windows: login now falls back to a free loopback port (#10571)
  • Fixed built-in model costs missing prompt-length pricing tiers for OpenCode, OpenCode Go, OpenRouter, Vercel AI Gateway, Google, MiniMax, and other models.dev providers, which undercounted the cost of long prompts on models such as Claude Haiku 5.5, Gemini 3.1 Pro, and GPT-5.4. OpenRouter time-of-day pricing is not modeled
  • Fixed Mistral responses that end with finish_reason: "error" not being retried (#10487)
  • Fixed Bedrock Converse not sending the reasoning effort to OpenAI models: gpt-oss gets reasoning_effort clamped to low/medium/high, other GPT models get reasoning.effort with minimal sent as low (#9331, #10142 by @​jsanter27)
  • Fixed model and caller headers not overriding the originator and User-Agent headers of openai-codex-responses requests (#10429 by @​lucasmeijer)
Commits
  • 06a4669 Release v1.2.0
  • 0d79b74 docs: audit changelogs and add new features for next release
  • 7bd01fb fix(ai): retry "The upstream provider returned an error"
  • d4d5361 fix(ai): fall back on Anthropic strict tool limits
  • ee409a8 feat(ai,coding-agent): list only the OpenRouter models a key may use (#10672)
  • 0f4b146 fix(ai): send the codex request body as a Uint8Array<ArrayBuffer> copy
  • 2a33bbe test(ai): e2e repro for radius dropping replayed Claude thinking
  • ce950d7 fix(ai): use models.dev metadata for Claude 5.5 models
  • 6b07b4e fix(ai): apply Mistral request timeout only to response headers
  • 7f9e119 feat(coding-agent): publish configuration schemas (#9880)
  • Additional commits viewable in compare view

Updates @earendil-works/pi-coding-agent from 1.0.4 to 1.2.0

Release notes

Sourced from @​earendil-works/pi-coding-agent's releases.

v1.2.0

New Features

  • Per-key OpenRouter model lists: with an OpenRouter key, Pi lists only the models that key may use, with the key's context size, max output, and prices, including regional endpoints set in models.json. See OpenRouter.
  • Published configuration schemas: add $schema to settings.json, models.json, keybindings, and themes for editor validation and completion. See Settings, Models, Keybindings, and Themes.
  • Clipboard copies over remote sessions: PI_CLIPBOARD_OSC52=1 sends copied text to a remote client's clipboard when Pi cannot detect the remote session, such as a multiplexer attached from another machine. See Pi Process Configuration.
  • Codemode improvements: tool declarations show input constraints such as integer, minimum/maximum, and default, and codemode rows show elapsed and total time. See Codemode.
  • before_agent_start for extension-triggered runs: runs started by pi.sendMessage(..., { triggerTurn: true }) go through the same setup as prompts. See Events and concurrency.

Breaking Changes

  • Published generated configuration schemas for models, settings, keybindings, and themes at https://pi.dev/schemas/*.schema.json. The theme schema moved to https://pi.dev/schemas/theme.schema.json; themes loaded during startup now receive the same schema validation as later reloads. Update theme $schema references, define reusable colors under vars, and remove unsupported metadata (#9880, #10751 by @​christianklotz)
  • Changed before_agent_start to also fire for runs started by pi.sendMessage(..., { triggerTurn: true }) while idle. BeforeAgentStartEvent is now a union on messageType: "user" events carry prompt and images, and "custom" events carry the starting message and no prompt. Messages returned by handlers are added to both kinds of run, and pending deliverAs: "nextTurn" messages are delivered with the custom-message run. Handlers that should act only on user prompts must check event.messageType === "user" (#10267, #5581, #10739 by @​davidbrai)
  • Changed the session to count as busy while a run starts, including during before_agent_start handlers: ctx.isIdle() is false, pi.sendMessage() queues into the starting run instead of starting a second run that failed with "Agent is already processing", pi.sendUserMessage() requires deliverAs, and an abort requested meanwhile aborts the run once it starts (#10739 by @​davidbrai)
  • Changed pi mcp list --json to report resources: true for servers that offer resources instead of resources and resourceTemplates counts; Pi no longer lists resources when connecting (#10526)

Added

  • Added reachesTools to tool definitions, so tools that reach other tools (such as codemode and tool_search) declare which tools a call may reach; the MCP extension uses it to wait for the servers a call needs and to decide whether a replacement codemode or tool_search tool can reach MCP tools
  • Added aliases to tool namespaces; codemode's describeNamespace() and the namespace option of searchTools() match them, and MCP namespaces use the server name
  • Added per-key OpenRouter model lists: with an OpenRouter key, Pi lists only the chat models that key may use, with the key's context size, max output, and prices, including guardrails and regional endpoints set as the base URL in models.json. The list is saved and used offline (#10353, #10672 by @​davidbrai)
  • Added PI_CLIPBOARD_OSC52=1 to send copied text to the terminal with OSC 52 after the local clipboard write, so copies reach a remote client's clipboard when Pi cannot detect the remote session, such as multiplexer attaches from another machine or remote IDE daemons (

@dependabot
Bump the npm group with 8 updates
adec12d 
Bumps the npm group with 8 updates:

| Package | From | To |
| --- | --- | --- |
| [@daytonaio/sdk](https://github.com/daytona/clients) | `0.223.0` | `0.224.0` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.6.4` | `26.6.5` |
| [@vercel/sandbox](https://github.com/vercel/sandbox/tree/HEAD/packages/vercel-sandbox) | `3.5.1` | `3.8.0` |
| [e2b](https://github.com/e2b-dev/e2b/tree/HEAD/packages/js-sdk) | `2.53.1` | `2.56.0` |
| [@earendil-works/pi-agent-core](https://github.com/earendil-works/pi/tree/HEAD/packages/agent) | `1.0.4` | `1.2.0` |
| [@earendil-works/pi-ai](https://github.com/earendil-works/pi/tree/HEAD/packages/ai) | `1.0.4` | `1.2.0` |
| [@earendil-works/pi-coding-agent](https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent) | `1.0.4` | `1.2.0` |
| [@earendil-works/pi-tui](https://github.com/earendil-works/pi/tree/HEAD/packages/tui) | `1.0.4` | `1.2.0` |


Updates `@daytonaio/sdk` from 0.223.0 to 0.224.0
- [Release notes](https://github.com/daytona/clients/releases)
- [Commits](daytona/clients@v0.223.0...v0.224.0)

Updates `@types/node` from 26.6.4 to 26.6.5
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@vercel/sandbox` from 3.5.1 to 3.8.0
- [Release notes](https://github.com/vercel/sandbox/releases)
- [Changelog](https://github.com/vercel/sandbox/blob/main/packages/vercel-sandbox/CHANGELOG.md)
- [Commits](https://github.com/vercel/sandbox/commits/@vercel/sandbox@3.8.0/packages/vercel-sandbox)

Updates `e2b` from 2.53.1 to 2.56.0
- [Release notes](https://github.com/e2b-dev/e2b/releases)
- [Changelog](https://github.com/e2b-dev/E2B/blob/main/packages/js-sdk/CHANGELOG.md)
- [Commits](https://github.com/e2b-dev/e2b/commits/e2b@2.56.0/packages/js-sdk)

Updates `@earendil-works/pi-agent-core` from 1.0.4 to 1.2.0
- [Release notes](https://github.com/earendil-works/pi/releases)
- [Changelog](https://github.com/earendil-works/pi/blob/main/packages/agent/CHANGELOG.md)
- [Commits](https://github.com/earendil-works/pi/commits/v1.2.0/packages/agent)

Updates `@earendil-works/pi-ai` from 1.0.4 to 1.2.0
- [Release notes](https://github.com/earendil-works/pi/releases)
- [Changelog](https://github.com/earendil-works/pi/blob/main/packages/ai/CHANGELOG.md)
- [Commits](https://github.com/earendil-works/pi/commits/v1.2.0/packages/ai)

Updates `@earendil-works/pi-coding-agent` from 1.0.4 to 1.2.0
- [Release notes](https://github.com/earendil-works/pi/releases)
- [Changelog](https://github.com/earendil-works/pi/blob/main/packages/coding-agent/CHANGELOG.md)
- [Commits](https://github.com/earendil-works/pi/commits/v1.2.0/packages/coding-agent)

Updates `@earendil-works/pi-tui` from 1.0.4 to 1.2.0
- [Release notes](https://github.com/earendil-works/pi/releases)
- [Changelog](https://github.com/earendil-works/pi/blob/main/packages/tui/CHANGELOG.md)
- [Commits](https://github.com/earendil-works/pi/commits/v1.2.0/packages/tui)

---
updated-dependencies:
- dependency-name: "@daytonaio/sdk"
  dependency-version: 0.224.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: "@types/node"
  dependency-version: 26.6.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@vercel/sandbox"
  dependency-version: 3.8.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: e2b
  dependency-version: 2.56.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: "@earendil-works/pi-agent-core"
  dependency-version: 1.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: "@earendil-works/pi-ai"
  dependency-version: 1.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: "@earendil-works/pi-coding-agent"
  dependency-version: 1.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: "@earendil-works/pi-tui"
  dependency-version: 1.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 17, 2026
@nathanvvong
nathanvvong merged commit 4545ae7 into main Oct 18, 2026
1 check passed
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/npm-eeeb0aba10 branch October 18, 2026 18:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@nathanvvong nathanvvong nathanvvong approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@nathanvvong