You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Constrained tool sampling — Tools can prefer or require strict JSON Schema sampling or use OpenAI Lark/regex grammars, with model capability metadata preventing unsupported requests. See Constrained Sampling for Tools.
OpenRouter and Kimi Code sign-in — Use /login to authorize OpenRouter or a Kimi Code subscription without manually configuring API keys. See OpenRouter.
Session-aware, streaming bash integrations — Bash tools receive current session/model metadata, while direct RPC bash commands stream correlated output. See Bash Tool Session Environment and RPC bash events.
Added
Exposed PI_SESSION_ID, PI_SESSION_FILE, PI_PROVIDER, PI_MODEL, and PI_REASONING_LEVEL to commands run by built-in and factory-created bash tools.
Exposed the outputPad setting to custom message renderers.
Added inherited Tool.constrainedSampling with strict JSON Schema (prefer/require) and OpenAI Lark/regex grammar variants across OpenAI, Anthropic, Amazon Bedrock, Google Gemini, and Mistral. See Constrained Sampling for Tools.
Added inherited supportsGrammarTools and supportsStrictTools compatibility flags, expanded supportsStrictMode coverage, and generated model capability metadata to gate constrained sampling.
Added inherited Kimi Code subscription OAuth login for the Kimi For Coding provider, including device authorization and automatic token refresh (#6935 by @zaycruz).
Added inherited OpenRouter OAuth PKCE login through /login, minting a user-controlled API key. See OpenRouter (#6927 by @rsaryev).
Exposed PI_SESSION_ID, PI_SESSION_FILE, PI_PROVIDER, PI_MODEL, and PI_REASONING_LEVEL to commands run by built-in and factory-created bash tools. See Bash Tool Session Environment.
Added streaming bash_execution_update events for direct RPC bash commands, correlated with request IDs. See RPC bash events (#6971 by @ananthakumaran).
Changed
Changed inherited generated model catalogs to expose only provider-verified reasoning effort levels from models.dev (#6928 by @davidbrai).
Fixed
Fixed inherited DNS lookup failures such as getaddrinfo, ENOTFOUND, and EAI_AGAIN to trigger automatic assistant retries (#6946 by @christianklotz).
Fixed inherited OpenRouter Anthropic cache breakpoints to advance through tool results and enabled cache control for ~anthropic/*-latest aliases (#6941 by @mteam88).
Fixed inherited OpenAI Codex WebSocket sessions to retry once without a missing previous-response continuation after previous_response_not_found errors (#6955 by @davidbrai).
Fixed TUI debug and crash logs to respect custom agent directories instead of always writing under ~/.pi/agent (#6958 by @davidbrai).
Fixed slow Ctrl+G external-editor startup when the system temporary directory contains many entries (#6903 by @christianklotz).
Fixed startup resource display to preserve relative paths for sibling npm extensions loaded by a package (#6964 by @davidbrai).
Fixed compaction and branch-summary requests to use fresh routing session IDs with prompt caching disabled where supported (#6618 by @tmustier).
Fixed explicit self-updates when PI_SKIP_VERSION_CHECK is set (#6977).
Fixed scoped model IDs containing brackets to resolve as literal exact matches before glob matching (#6210).
Fixed inherited OpenAI and Anthropic provider retry waits to honor abort signals and configured delay limits (#6980 by @petrroll).
Fixed fresh installs from preferring bundled model catalogs over newer remote catalogs because package file mtimes were newer (#7016 by @davidbrai).
Verifiable release source archives — GitHub releases now include deterministic, checksummed source archives with instructions for rebuilding standalone binaries. See Building standalone binaries from release source.
Resilient compaction and branch summaries — Transient provider failures now follow the configured retry policy, with retry lifecycle events available to interactive, JSON, RPC, and SDK consumers. See Compaction & Branch Summarization and RPC retry events.
Added
Added deterministic, checksummed source archives to GitHub releases with documented standalone binary rebuild instructions (#6913 by @christianklotz).
Fixed
Fixed compaction and branch summarization to retry transient provider failures using the configured retry policy, with retry lifecycle events exposed to interactive, JSON, RPC, and SDK consumers (#6901 by @davidbrai).
Fixed interactive startup waiting for background model catalog refresh while computing the footer provider count.
Restored the default stream fallback for extensions using the pre-0.81 agent-core API (#6915).
Fixed inherited Kimi K3 models from Moonshot AI and Moonshot AI China to use the OpenAI thinking format and expose reasoning effort support.
Local llama.cpp model management — Connect to a llama.cpp router, search and download Hugging Face models, and explicitly load or unload models with live progress. See llama.cpp.
Full provider extensions — Extensions can register complete pi-ai providers with authentication, model refresh, filtering, and custom streaming. See Register New Provider.
Qwen Token Plan providers — Use the built-in international and China subscription providers with regional endpoints and API-key authentication. See API Keys.
Expanded usage accounting — Tool, compaction, and branch-summary usage is persisted and included in session totals. See Compaction & Branch Summarization.
Added
Added Qwen Token Plan and Qwen Token Plan China to built-in provider setup, default model resolution, and provider documentation (#6858 by @QuintinShaw).
Added the get_available_thinking_levels RPC command and RpcClient.getAvailableThinkingLevels() method (#6865 by @cristinaponcela).
Exported message and tool execution lifecycle event types from the package root (#6772 by @davidbrai).
Added built-in llama.cpp router support with /login connection setup and /llama Hugging Face model search and downloads, explicit loading, unloading, and live progress. See llama.cpp.
Added extension registration for complete pi-ai providers, including native authentication, model refresh, filtering, and streaming behavior.
Added usage accounting for tools, compaction, and branch summaries in persisted sessions, footer totals, and session statistics (#6671 by @davidbrai).
Fixed
Updated the packaged brace-expansion dependency to 5.0.7 (#6896 by @davidbrai).
Fixed persisted remote model catalogs from overriding newer bundled catalogs after an upgrade.
Fixed inherited stored API-key credentials to apply their provider-scoped env values, including Amazon Bedrock profiles (#6864 by @cristinaponcela).
Fixed inherited OpenAI-compatible cross-provider replay to keep tool call IDs unique when multiple calls share a provider call ID (#6854 by @cristinaponcela).
Fixed inherited Kimi K3 thinking levels to expose low, high, and max, and normalized the k2p7 alias to kimi-for-coding.
Fixed inherited OpenCode Go models routed through the OpenAI Responses API.
Fixed inherited pi-ai package metadata to avoid repeated consumer lockfile changes (#6812 by @jmfederico).
Fixed inherited terminal shutdown to clear the editor's inverted software cursor before restoring the hardware cursor (#6790 by @dam9000).
Fixed inherited ANSI-aware text wrapping to recognize CRLF and CR line endings while preserving styles (#6764 by @xz-dev).
Fixed inherited editor paste registry corruption after deleting and undoing paste markers, preventing literal or mismatched paste markers in submitted prompts (#6844).
Fixed sessionless OpenAI Codex WebSocket requests to use UUIDv7 request IDs (#6834 by @xl0).
Fixed inherited GPT-5.6 Codex models to default to the 272K context window, avoiding automatic long-context pricing (#6853 by @aadishv).
Fixed messages queued during compaction to preserve steering and follow-up delivery behavior (#6730 by @dannote).
Fixed read tool errors being syntax-highlighted as if they were file contents (#6731 by @dannote).
Fixed llama.cpp router download progress updates and removed redundant wording from model action confirmations.
Moved automatic model catalog network refresh out of startup initialization and into the running interactive and RPC modes.
Fixed persisted sessions being read and parsed twice when opened, reducing startup latency for large sessions (#6793).
Fixed prompt-template defaults for all arguments (${@​:-default} and ${ARGUMENTS:-default}) (#6695).
Fixed obsolete custom UI, custom tool, and custom editor examples in the extension documentation (#6735).
Fixed Kimi Coding sessions to show API-equivalent implied costs with the subscription indicator.
Fixed OpenAI Responses early stream endings to trigger automatic retry instead of ending the agent run (#6727).
Kimi Coding thinking compatibility — Kimi Coding models now use adaptive thinking correctly; K3 exposes its supported max level and supports replaying empty-signature thinking blocks. See Kimi For Coding setup and Model Options.
Fixed
Fixed inherited Kimi Coding requests to use Anthropic adaptive thinking effort without token budgets, and enabled empty thinking signatures for K3 and kimi-for-coding.
Fixed inherited Kimi K3 pricing metadata for Moonshot AI and Moonshot AI China.
Fixed inherited Kimi Coding K3 thinking-level metadata to expose only the supported max level (#6737).
Changed xAI login to use a prefilled device-authorization link labeled “Sign in with SuperGrok or X Premium,” and changed the default xAI model to Grok 4.5 (#6734 by @Jaaneek).
Fixed
Fixed inherited Kimi K3 output limits for Vercel AI Gateway and OpenRouter models.
Fixed cloning or forking a session before its first assistant response to explain that the session must be saved first.
Removed
Removed Grok 3, Grok 3 Fast, Grok 4.20 variants, and Grok Code Fast 1 from the built-in xAI model catalog (#6734 by @Jaaneek).
Unified model runtime and provider authentication — ModelRuntime centralizes model configuration, provider-owned /login, and dynamic provider catalogs. See Providers.
Live model catalog refresh — /model refreshes configured providers in the background, and pi update --models forces an immediate refresh. See Install and Manage.
xAI device-code OAuth and Grok 4.5 Responses support — Sign in to xAI with a device code and use Grok 4.5 with low, medium, or high thinking. See xAI.
Breaking Changes
Replaced the SDK's CreateAgentSessionOptions.authStorage and modelRegistry options with the async modelRuntime option. AuthStorage and its storage backends are no longer exported; use ModelRuntime (or a custom pi-ai CredentialStore), or readStoredCredential() for one-off reads of auth.json.
Removed redundant ModelRuntime.getAll(), find(), getSnapshot(), and getAuthOptions() projections. Use the pi-ai Models methods getModels(), getModel(), getProviders(), and checkAuth() directly.
Replaced SDK request-auth assembly through ModelRegistry.getApiKeyAndHeaders() with ModelRuntime.getAuth(). Passing a provider ID returns provider-scoped auth; passing a model also resolves built-in, models.json, and extension model headers.
Changed extension-facing ModelRegistry.refresh() from synchronous void to Promise<void> because models.json loading is asynchronous. Extensions must await it before making synchronous registry reads.
Moved canonical dynamic catalog refresh to async ModelRuntime.refresh()/pi-ai Models.refresh(). Legacy extension OAuth modifyModels remains supported as a synchronous compatibility projection after credential initialization.
Added
Added ModelRuntime as the canonical async SDK and internal model/auth facade while preserving the synchronous extension-facing ModelRegistry API. ModelRuntime.create() accepts any pi-ai CredentialStore through its credentials option.
Added provider-owned /login discovery directly from registered pi-ai providers, including ambient auth status and informational links.
Added file-backed dynamic catalogs in models-store.json, per-provider pi.dev catalog overlays, and Radius gateway support including offline migration from legacy credential-cached catalogs.
Added extension provider refreshModels(context) support for dynamic model discovery with optional provider-controlled persistence.
Added pi update --models to force an immediate model catalog refresh without updating pi or extensions.
Added inherited xAI device-code OAuth login and Grok 4.5 OpenAI Responses support, with low, medium, and high thinking levels (#6651 by @Jaaneek).
Changed
Changed ModelRuntime to compose built-in providers, immutable models.json configuration, and extension overlays through ad-hoc pi-ai provider methods.
Changed ModelRuntime to own final request assembly: getAuth(model) includes configured model headers, stream methods resolve auth once, and before_provider_headers runs as the Models-only header transform before provider dispatch.
Changed /model to render the current model snapshot immediately, refresh configured providers in the background, and update the open selector with partial results or timeout errors.
Fixed
Fixed configured-provider catalog refresh to parse pi.dev's model-ID keyed responses, throttle checks to once per four hours, send the versioned pi user agent, treat unimplemented routes as unavailable overlays, and show concise refresh status in /model.
Fixed adjacent assistant thinking blocks to render as one thinking section.
Fixed inherited OpenAI Codex session IDs longer than 64 characters to meet the API limit (#6630).
Fixed inherited terminal output to normalize tab characters consistently (#6697 by @xz-dev).
Fixed the Windows terminal title after checking npm packages (#6629).
Fixed Bun standalone binaries to bundle OAuth adapters for interactive logins.
Removed the openai-responsescompat.sendSessionIdHeader flag from models.json. Session-affinity behavior is now controlled by compat.sessionAffinityFormat ("openai", "openai-nosession", or "openrouter"). Replace sendSessionIdHeader: false with sessionAffinityFormat: "openai-nosession" (#6496 by @petrroll).
New Features
Cache-friendly dynamic tool loading - Extensions can add tools during execution while supported Anthropic and OpenAI Responses models preserve prompt-cache prefixes. See Dynamic Tool Loading.
Message copy shortcut - Ctrl+X copies the last assistant message in the transcript or the selected message in /tree, making older and branched messages directly copyable. See Display and Message Queue.
Fable 5 xhigh and max thinking - Native xhigh and max thinking levels are available across generated provider catalogs. See Model Options.
Added
Added cache-friendly dynamic tool loading for extension tools activated by tool results. Supported Anthropic and OpenAI Responses models load definitions where they become available, preserving the cached prompt prefix. See Dynamic Tool Loading (#6474).
Added inherited native xhigh and max thinking levels for Claude Fable 5 across all generated provider catalogs (#6490 by @davidbrai).
Added Ctrl+X to copy the last assistant message, or the selected message in /tree.
Added inherited toolChoice support for OpenAI and Codex Responses, including required and named tool selection (#6588 by @xl0).
Fixed
Fixed inherited OpenRouter model context windows to use the top provider's actual context length (#6481 by @davidbrai).
Fixed inherited OpenRouter OpenAI-compatible session IDs to use the x-session-id header instead of OpenAI-specific session-affinity fields (#6496 by @petrroll).
Fixed Ctrl+V to paste clipboard text when the pasteboard does not contain an image.
Fixed /login amazon-bedrock to prompt for and save a Bedrock API key instead of only displaying ambient AWS credential setup instructions.
Fixed inherited Amazon Bedrock ambient AWS credentials to keep using SigV4 authentication, including for custom model IDs (#6532 by @ribelo).
Fixed inherited Cloudflare Workers AI and AI Gateway authentication to use ambient account and gateway IDs when stored credentials contain only an API key (#6292 by @markphelps).
Fixed inherited legacy terminal decoding for Alt+symbol key combinations such as Alt+, and Alt+. (#6523 by @ribelo).
Fixed the GitHub Copilot mai-code-1-flash-picker model to route through the /responses endpoint (#6544 by @petrroll).
Fixed branch summaries to work with providers that use ambient authentication instead of API keys (#6595 by @davidbrai).
Fixed inherited Amazon Bedrock errors to report unhandled provider stop reasons instead of only An unknown error occurred (#6598 by @davidbrai).
Fixed npm package removal when installed packages have conflicting peer dependencies (#6604 by @davidbrai).
Fixed inherited Azure OpenAI Responses reasoning replay when encrypted_content appears only in the terminal response event (#6608 by @davidbrai).
Fixed inherited Anthropic-compatible proxies that omit usage from message_delta events (#6611 by @davidbrai).
Fixed inherited OpenCode OpenAI Responses models to omit the unsupported session-id header while preserving other cache-affinity data (#6645 by @davidbrai).
Fixed system prompt cache invalidation across dates by removing the current date from the default prompt (#6621).
max thinking level - New opt-in thinking level above xhigh, natively supported on GPT-5.6 and adaptive Claude models, available across CLI (--thinking max), SDK, RPC, and model selection. Custom themes can define thinkingMax. See CLI Reference.
Input-based pricing tiers - Request-wide input-token pricing tiers for accurate long-context cost accounting (e.g. GPT-5.4/5.5/5.6 long-context rates), also configurable for custom models in models.json and modelOverrides. See Model Configuration.
Added
Added the opt-in max thinking level across CLI, SDK, RPC, model selection, and themes. Custom themes can define thinkingMax; existing themes fall back to thinkingXhigh.
Added request-wide input-token pricing tiers to custom model costs in models.json, modelOverrides, and extension-registered providers.
Fixed inherited post-compaction output-token budgeting to ignore stale assistant usage from before the compaction boundary (#6464).
Fixed inherited GPT-5.4 and GPT-5.5 long-context cost accounting while retaining the intentional 272K default context limit for models that require an explicit override.
Fixed inherited GPT-5.6 metadata to keep direct OpenAI requests in the 272K short-context tier while exposing the Codex backend's 372K context window with long-context pricing, and removed the nonexistent bare gpt-5.6 alias.
Fixed inherited Anthropic message conversion to preserve thinking blocks with empty thinking text but a valid signature instead of dropping them, avoiding thinking-block errors on newer Claude models (#6457 by @davidbrai).
Notes: No overt covert malware behavior is present in the fragment (no network/exfiltration/persistence/obfuscation). However, the module is inherently high-risk because it directly executes an arbitrary shell command string and can perform powerful filesystem writes/deletes and process termination. Additionally, it inherits the parent environment by default and does not strictly confine absolute filesystem paths to the configured cwd. Security largely depends on whether consuming code treats command/path/env inputs as trusted and enforces allowlists/sandboxing.
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@earendil-works/pi-agent-core@0.82.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Notes: No overt malicious payloads, obfuscation, or exfiltration code is present in this module. The dominant security concern is that it provides an arbitrary bash command execution capability with inherited environment variables, and it streams/returns command output (and truncation metadata including a full-output temp path). If this tool can be reached by untrusted inputs or agents, it represents a high security risk primarily due to command execution and potential sensitive data disclosure.
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@earendil-works/pi-agent-core@0.82.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Warn
System shell access: npm @earendil-works/pi-agent-core in module node:child_process
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@earendil-works/pi-agent-core@0.82.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Notes: This module functions as a privileged IPC/RPC command interpreter over stdin/stdout. While the code is readable and shows no obvious stealth/obfuscation or direct external network exfiltration, it exposes a critical remote command execution sink via a 'bash' RPC handler that forwards untrusted input to session.executeBash, and it also accepts untrusted filesystem paths for export_html. It additionally discloses internal session state and allows extensive session control operations. Security depends heavily on whether the RPC transport is strictly authenticated/controlled; otherwise, the risk is high.
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@earendil-works/pi-coding-agent@0.82.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Notes: No clear signs of intentional malware (no exfiltration, crypto-mining, or OS-level actions observed). However, this module presents a significant client-side security risk: it performs multiple DOM HTML injections and renders untrusted Markdown via marked.parse() directly into the DOM without an explicit sanitization layer, plus it inserts pre-rendered tool HTML fragments (renderedTools[call.id].*Html) verbatim. If any session/tool content can be attacker-influenced, this can enable DOM-based XSS. Recommend enforcing a strict HTML sanitization allowlist on all marked outputs and eliminating or sanitizing pre-rendered HTML fragments before insertion.
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@earendil-works/pi-coding-agent@0.82.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Notes: This module is a high-risk extension/plugin loader: it discovers and imports executable .js/.ts modules from filesystem directories and package.json manifest entries, then immediately executes their exported factory with a privileged API. The API includes direct command execution (api.exec -> execCommand) and runtime messaging/state mutation methods, so any untrusted/tampered extension can escalate to arbitrary host actions. No explicit malware is shown in the fragment itself, but the design materially enables malicious behavior if extension sources are not strictly controlled.
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@earendil-works/pi-coding-agent@0.82.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Notes: No evidence of covert malware (no obfuscation/payload encoding, no network callbacks, no persistence/backdoor indicators) is present in this module. However, the module is an intentionally high-impact local command execution wrapper: it spawns a configurable shell and executes caller-provided command with minimal validation/allowlisting. If an attacker can influence command (or related configuration like commandPrefix/shellPath/spawnHook), this creates a strong risk of arbitrary OS command execution and sensitive data exposure via captured stdout/stderr and optional fullOutputPath disclosure. Overall security depends primarily on strict upstream authorization/sandboxing of tool invocations and environment/command constraints.
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@earendil-works/pi-coding-agent@0.82.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Notes: This code is a runtime downloader/installer for third-party CLI binaries fetched from GitHub “latest” releases. It does not show overt backdoor or data-stealing logic, but it has significant supply-chain and archive-handling risk: downloaded artifacts are not integrity-verified, and extraction is performed via tar/unzip/PowerShell without explicit defenses against malicious archive members. If the remote artifacts are tampered with, the module will likely install and chmod/activate the attacker-controlled binary in the local tools directory.
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@earendil-works/pi-coding-agent@0.82.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Notes: This module provides a built-in, config-driven mechanism to execute operating system shell commands whenever a configuration string starts with '!'. Because command execution input is derived directly from the configuration string and because the command stdout can be returned and potentially propagated into HTTP header values, any scenario where attackers can influence these config strings becomes a high-impact remote command execution risk. No explicit stealth/exfiltration behavior is evident in this snippet, but the capability itself is dangerously powerful; it should only be reachable from strictly trusted configuration sources.
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@earendil-works/pi-coding-agent@0.82.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Notes: This module is primarily a usability feature (searching and truncating results) but it carries a high security risk due to likely command injection: user-controlled parameters (pattern/path/glob) are incorporated into a shell-form execSync command string via args.join(' '). Additionally, when truncation occurs, it persists full search output to a temporary file and exposes the path, increasing the chance of unintended disclosure of sensitive repository contents. No clear malware/backdoor behavior is evident in this snippet.
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@earendil-works/pi-coding-agent@0.82.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Notes: No explicit malicious/backdoor behavior is visible in this module. However, it is a high-impact command-execution primitive: it runs user-controlled shell strings via spawnSync with shell '-c', inherited stdio, and the full parent environment. The “interactive allowlist” is implemented via heuristic string matching and can be expanded/altered at runtime through environment variables, with an additional 'i ' prefix override that weakens the effective control boundary. This should be treated as a significant security risk if upstream authorization/trust assumptions are imperfect.
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@earendil-works/pi-coding-agent@0.82.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Notes: This module is effectively a template-driven arbitrary shell execution feature: any input containing !{...} causes the embedded content to be executed by bash -c with only a timeout, and the resulting stdout/stderr (and previews) are injected back into the transformed text and may be displayed in the UI. Unless the input is strictly trusted and the execution environment is tightly sandboxed, this represents a critical command-injection/RCE-grade supply-chain risk.
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@earendil-works/pi-coding-agent@0.82.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
renovateBot
changed the title
fix(deps): update dependency @earendil-works/pi-coding-agent to v0.80.10
fix(deps): update dependency @earendil-works/pi-coding-agent to v0.82.0
Jul 25, 2026
renovateBot
changed the title
fix(deps): update dependency @earendil-works/pi-coding-agent to v0.82.0
fix(deps): update dependency @earendil-works/pi-coding-agent to v0.82.0 - autoclosed
Jul 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
0.80.3→0.82.0Release Notes
earendil-works/pi (@earendil-works/pi-coding-agent)
v0.82.0Compare Source
New Features
/loginto authorize OpenRouter or a Kimi Code subscription without manually configuring API keys. See OpenRouter.Added
PI_SESSION_ID,PI_SESSION_FILE,PI_PROVIDER,PI_MODEL, andPI_REASONING_LEVELto commands run by built-in and factory-created bash tools.outputPadsetting to custom message renderers.Tool.constrainedSamplingwith strict JSON Schema (prefer/require) and OpenAI Lark/regex grammar variants across OpenAI, Anthropic, Amazon Bedrock, Google Gemini, and Mistral. See Constrained Sampling for Tools.supportsGrammarToolsandsupportsStrictToolscompatibility flags, expandedsupportsStrictModecoverage, and generated model capability metadata to gate constrained sampling./login, minting a user-controlled API key. See OpenRouter (#6927 by @rsaryev).PI_SESSION_ID,PI_SESSION_FILE,PI_PROVIDER,PI_MODEL, andPI_REASONING_LEVELto commands run by built-in and factory-created bash tools. See Bash Tool Session Environment.bash_execution_updateevents for direct RPC bash commands, correlated with request IDs. See RPC bash events (#6971 by @ananthakumaran).Changed
Fixed
getaddrinfo,ENOTFOUND, andEAI_AGAINto trigger automatic assistant retries (#6946 by @christianklotz).~anthropic/*-latestaliases (#6941 by @mteam88).previous_response_not_founderrors (#6955 by @davidbrai).~/.pi/agent(#6958 by @davidbrai).PI_SKIP_VERSION_CHECKis set (#6977).protobufjsdependency to 7.6.5 to address GHSA-j3f2-48v5-ccww (#7005)./copyon Wayland to fall back to X11 or OSC 52 whenwl-copyfails (#7009 by @rkfshakti)./modelto reload updatedmodels.jsonconfiguration when opening the model picker (#6999).v0.81.1Compare Source
New Features
Added
Fixed
v0.81.0Compare Source
New Features
Added
get_available_thinking_levelsRPC command andRpcClient.getAvailableThinkingLevels()method (#6865 by @cristinaponcela)./loginconnection setup and/llamaHugging Face model search and downloads, explicit loading, unloading, and live progress. See llama.cpp.Fixed
brace-expansiondependency to 5.0.7 (#6896 by @davidbrai).envvalues, including Amazon Bedrock profiles (#6864 by @cristinaponcela).k2p7alias tokimi-for-coding.pi-aipackage metadata to avoid repeated consumer lockfile changes (#6812 by @jmfederico).${@​:-default}and${ARGUMENTS:-default}) (#6695).v0.80.10Compare Source
New Features
maxlevel and supports replaying empty-signature thinking blocks. See Kimi For Coding setup and Model Options.Fixed
kimi-for-coding.maxlevel (#6737).v0.80.9Compare Source
New Features
kimi-deferred-tools.tsexample.Added
kimi-deferred-tools.tsexample.Changed
Fixed
Removed
v0.80.8Compare Source
New Features
ModelRuntimecentralizes model configuration, provider-owned/login, and dynamic provider catalogs. See Providers./modelrefreshes configured providers in the background, andpi update --modelsforces an immediate refresh. See Install and Manage.Breaking Changes
CreateAgentSessionOptions.authStorageandmodelRegistryoptions with the asyncmodelRuntimeoption.AuthStorageand its storage backends are no longer exported; useModelRuntime(or a custom pi-aiCredentialStore), orreadStoredCredential()for one-off reads of auth.json.ModelRuntime.getAll(),find(),getSnapshot(), andgetAuthOptions()projections. Use the pi-aiModelsmethodsgetModels(),getModel(),getProviders(), andcheckAuth()directly.ModelRegistry.getApiKeyAndHeaders()withModelRuntime.getAuth(). Passing a provider ID returns provider-scoped auth; passing a model also resolves built-in,models.json, and extension model headers.ModelRegistry.refresh()from synchronousvoidtoPromise<void>becausemodels.jsonloading is asynchronous. Extensions must await it before making synchronous registry reads.ModelRuntime.refresh()/pi-aiModels.refresh(). Legacy extension OAuthmodifyModelsremains supported as a synchronous compatibility projection after credential initialization.Added
ModelRuntimeas the canonical async SDK and internal model/auth facade while preserving the synchronous extension-facingModelRegistryAPI.ModelRuntime.create()accepts any pi-aiCredentialStorethrough itscredentialsoption./logindiscovery directly from registered pi-ai providers, including ambient auth status and informational links.models-store.json, per-provider pi.dev catalog overlays, and Radius gateway support including offline migration from legacy credential-cached catalogs.refreshModels(context)support for dynamic model discovery with optional provider-controlled persistence.pi update --modelsto force an immediate model catalog refresh without updating pi or extensions.Changed
ModelRuntimeto compose built-in providers, immutablemodels.jsonconfiguration, and extension overlays through ad-hoc pi-ai provider methods.ModelRuntimeto own final request assembly:getAuth(model)includes configured model headers, stream methods resolve auth once, andbefore_provider_headersruns as the Models-only header transform before provider dispatch./modelto render the current model snapshot immediately, refresh configured providers in the background, and update the open selector with partial results or timeout errors.Fixed
/model.v0.80.7Compare Source
Breaking Changes
openai-responsescompat.sendSessionIdHeaderflag frommodels.json. Session-affinity behavior is now controlled bycompat.sessionAffinityFormat("openai","openai-nosession", or"openrouter"). ReplacesendSessionIdHeader: falsewithsessionAffinityFormat: "openai-nosession"(#6496 by @petrroll).New Features
Ctrl+Xcopies the last assistant message in the transcript or the selected message in/tree, making older and branched messages directly copyable. See Display and Message Queue.xhighandmaxthinking - Nativexhighandmaxthinking levels are available across generated provider catalogs. See Model Options.Added
xhighandmaxthinking levels for Claude Fable 5 across all generated provider catalogs (#6490 by @davidbrai).Ctrl+Xto copy the last assistant message, or the selected message in/tree.toolChoicesupport for OpenAI and Codex Responses, including required and named tool selection (#6588 by @xl0).Fixed
x-session-idheader instead of OpenAI-specific session-affinity fields (#6496 by @petrroll).Ctrl+Vto paste clipboard text when the pasteboard does not contain an image./login amazon-bedrockto prompt for and save a Bedrock API key instead of only displaying ambient AWS credential setup instructions.Alt+,andAlt+.(#6523 by @ribelo).mai-code-1-flash-pickermodel to route through the/responsesendpoint (#6544 by @petrroll).An unknown error occurred(#6598 by @davidbrai).encrypted_contentappears only in the terminal response event (#6608 by @davidbrai).usagefrommessage_deltaevents (#6611 by @davidbrai).session-idheader while preserving other cache-affinity data (#6645 by @davidbrai).v0.80.6Compare Source
New Features
maxthinking level - New opt-in thinking level abovexhigh, natively supported on GPT-5.6 and adaptive Claude models, available across CLI (--thinking max), SDK, RPC, and model selection. Custom themes can definethinkingMax. See CLI Reference.models.jsonandmodelOverrides. See Model Configuration.Added
maxthinking level across CLI, SDK, RPC, model selection, and themes. Custom themes can definethinkingMax; existing themes fall back tothinkingXhigh.models.json,modelOverrides, and extension-registered providers.~(home directory) expansion for theshellPathsetting (#6470 by @aaronkyriesenbach).Fixed
gpt-5.6alias.v0.80.5Compare Source
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.