chore(deps): update all non-major dependencies

[akua-renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
@earendil-works/pi-ai (source)	peerDependencies	minor	0.81.1 → 0.84.1
@earendil-works/pi-ai (source)	dependencies	minor	0.81.1 → 0.84.1
@earendil-works/pi-ai (source)	devDependencies	minor	0.81.1 → 0.84.1
@earendil-works/pi-coding-agent (source)	peerDependencies	minor	0.81.1 → 0.84.1
@earendil-works/pi-coding-agent (source)	devDependencies	minor	0.81.1 → 0.84.1
@earendil-works/pi-coding-agent (source)	dependencies	minor	0.81.1 → 0.84.1
@effect/opentelemetry (source)	devDependencies	patch	4.0.0-beta.102 → 4.0.0-beta.105
@effect/platform-browser (source)	dependencies	patch	4.0.0-beta.102 → 4.0.0-beta.105
@effect/platform-browser (source)	devDependencies	patch	4.0.0-beta.102 → 4.0.0-beta.105
@effect/platform-bun (source)	dependencies	patch	4.0.0-beta.102 → 4.0.0-beta.105
@effect/platform-bun (source)	devDependencies	patch	4.0.0-beta.102 → 4.0.0-beta.105
@effect/sql-pg (source)	dependencies	patch	4.0.0-beta.102 → 4.0.0-beta.105
@effect/sql-pg (source)	devDependencies	patch	4.0.0-beta.102 → 4.0.0-beta.105
@effect/vitest (source)	devDependencies	patch	4.0.0-beta.102 → 4.0.0-beta.105
@next/bundle-analyzer (source)	devDependencies	minor	16.2.11 → 16.3.0
@next/env (source)	devDependencies	minor	16.2.11 → 16.3.0
@​paper-design/shaders-react	dependencies	patch	^0.0.77 → ^0.0.79
@types/node (source)	devDependencies	minor	26.1.1 → 26.2.0
@types/pg (source)	devDependencies	minor	8.20.0 → 8.21.0
cnfast (source)	dependencies	minor	^0.0.8 → ^0.1.0
docker/login-action	action	minor	v4.4.0 → v4.6.0
effect (source)	peerDependencies	patch	4.0.0-beta.102 → 4.0.0-beta.105
effect (source)	dependencies	patch	4.0.0-beta.102 → 4.0.0-beta.105
effect (source)	devDependencies	patch	4.0.0-beta.102 → 4.0.0-beta.105
fumadocs-core	dependencies	minor	16.13.0 → 16.14.2
fumadocs-mdx	dependencies	patch	15.2.0 → 15.2.2
fumadocs-ui	dependencies	minor	16.13.0 → 16.14.2
gh	tools	minor	2.96.0 → 2.97.0
github:kunchenguid/no-mistakes	tools	minor	1.40.3 → v1.45.4
github:kunchenguid/treehouse	tools	minor	2.0.0 → v2.1.1
github:ogulcancelik/herdr	tools	minor	0.7.3 → v0.8.0
golang (source)	stage	minor	1.25.7-bookworm → 1.26.5-bookworm
jdx/mise-action	action	patch	v4.2.1 → v4.2.4
kubectl	tools	minor	1.35.6 → 1.36.3
next (source)	dependencies	minor	16.2.11 → 16.3.0
node (source)	tools	minor	24.16.0 → v24.19.0
npm:@earendil-works/pi-coding-agent (source)	tools	minor	0.81.1 → 0.84.1
npm:@openai/codex (source)	tools	minor	0.144.5 → 0.147.0
npm:chrome-devtools-axi	tools	patch	0.1.26 → 0.1.29
npm:gh-axi	tools	patch	0.1.27 → 0.1.30
npm:lavish-axi	tools	patch	0.1.42 → 0.1.46
npm:quota-axi	tools	patch	0.1.5 → 0.1.18
oxc-parser (source)	devDependencies	minor	0.128.0 → 0.143.0
posthog-js (source)	dependencies	minor	1.408.2 → 1.414.0
ripgrep	tools	minor	15.1.0 → 15.2.0
sharp (source, changelog)	devDependencies	minor	0.34.5 → 0.35.3
vcluster	tools	minor	0.35.2 → 0.36.1
vite (source)	devDependencies	minor	8.1.5 → 8.2.1
wrangler (source)	devDependencies	minor	4.115.0 → 4.120.0

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Release Notes

earendil-works/pi (@​earendil-works/pi-ai)

v0.84.1

Compare Source

Added

• Added Qwen Token Plan Individual as a built-in provider with its documented subscription model catalog and the shared international QWEN_TOKEN_PLAN_API_KEY (#​7659 by @​arasovic).

v0.84.0

Compare Source

Breaking Changes

• Renamed the exported ModelsStreamTransforms interface to ModelsRequestTransforms because its header transformation now applies to all authenticated provider requests.

• Required dynamic model providers to accept a concrete RefreshModelsContext.signal; Models.refresh() remains unbounded when callers omit its optional signal.

• Required provider login, API-key check/resolution, and OAuth refresh implementations to accept a concrete abort signal; public auth and credential operations remain unbounded when callers omit their optional signal.

• Replaced raw RefreshModelsContext.store access with the read-only context.stored snapshot and generation-checked context.publish() transaction.

  createProvider({ fetchModels }): no catalog-publication migration is required. Before and after, return the fetched list; createProvider() restores stored models and publishes and persists refreshed models itself. signal is now guaranteed to be present.

  // Before
  const beforeProvider = createProvider({
    // ...
    fetchModels: async ({ signal }) => {
      const response = await fetch(catalogUrl, { signal });
      return parseModels(await response.json());
    },
  });
  
  // After: unchanged
  const afterProvider = createProvider({
    // ...
    fetchModels: async ({ signal }) => {
      const response = await fetch(catalogUrl, { signal });
      return parseModels(await response.json());
    },
  });

  Handwritten Provider.refreshModels(): replace direct store access and pre-publication mutation with generation-guarded publications.

  // Before
  refreshModels: async (context) => {
    const stored = await context.store.read();
    if (stored) currentModels = stored.models;
    if (!context.allowNetwork) return;
  
    const refreshed = await fetchModels(context.signal);
    currentModels = refreshed;
    await context.store.write({ models: refreshed, checkedAt: Date.now() });
  },
  
  // After
  refreshModels: async (context) => {
    if (context.stored) {
      const restored = context.stored.models;
      if (!(await context.publish({
        update: () => { currentModels = restored; },
      }))) return;
    }
    if (!context.allowNetwork) return;
  
    const refreshed = await fetchModels(context.signal);
    if (context.signal.aborted) return;
    await context.publish({
      persist: { models: refreshed, checkedAt: Date.now() },
      update: () => { currentModels = refreshed; },
    });
  },

  In publish(), omit persist to leave storage unchanged, pass a ModelsStoreEntry to write it, or pass persist: null to delete it. Omit update for metadata-only persistence; omit persist for an ephemeral in-memory publication.

Added

• Added optional OAuthAuth.isSubscription metadata for distinguishing subscription-backed authentication from generic OAuth sign-in.
• Added explicit TelemetryContext propagation across stream, deferred, and image request options using the vendor-neutral @earendil-works/pi-telemetry contract.
• Added deferred provider request contracts, durable response handles, authenticated fetch/cancel dispatch, and faux-provider support for pending, ready, failed, and cancelled responses (#​7339 by @​davidbrai).
• Added Baseten as a built-in OpenAI-compatible provider with models.dev catalog generation and native chat_template_args reasoning controls.
• Added arbitrary OpenAI-compatible sampling parameters through Model.samplingParams and StreamOptions.samplingParams, including per-request overrides (#​7568 by @​mrexodia).
• Added opt-in vLLM thinking_token_budget support for OpenAI-compatible models, reserving output tokens for the final answer (#​7638 by @​bnsd55).
• Added OpenAICompletionsCompat.supportsFinishReason for providers that omit streamed finish_reason values, inferring normal and tool-use stops when the stream ends.
• Added structured Amazon Bedrock failure diagnostics with HTTP status, modeled error code, and AWS request id when available (#​7286 by @​brianstanley).

Changed

• Added optional cancellation to ModelsStore reads, writes, and deletions; catalog orchestration binds these waits to the provider refresh signal.

Fixed

• Fixed GitHub Copilot Grok 4.5 requests to use the supported Responses API (#​7560).
• Bounded OAuth token refreshes so stalled requests release the credential-store lock (#​7508).
• Fixed tool argument validation to preserve values that already match an anyOf/oneOf union arm before attempting coercion, avoiding nullable unions converting null to another primitive value (#​7328).
• Fixed cancellation of model catalog refreshes so callers stop waiting even when a custom provider ignores its abort signal (#​7027).
• Fixed auth resolution, availability checks, OAuth refreshes, provider login, and in-memory credential queue waits to honor caller cancellation.
• Fixed newer provider refreshes being blocked by or overwritten by an older stalled generation, including persisted catalog publication.
• Updated GPT-5.6 Terra and Luna pricing across OpenAI and passthrough model catalogs.
• Fixed Fireworks Kimi K3 models to use the OpenAI-compatible API with native reasoning-effort levels and deferred tools (#​7199, #​7230 by @​XBeg9).
• Fixed Fireworks GLM 5.2 models sending the unsupported prompt_cache_retention field when long cache retention is enabled, and enabled session affinity for automatic prompt caching (#​7676).
• Updated Groq's Qwen reasoning override for the replacement qwen/qwen3.6-27b model.
• Fixed the OpenCode Go provider display name.
• Fixed provider error normalization treating arrays and class instances as structured response bodies instead of preserving their original errors (#​7205 by @​erikogenvik).
• Fixed Anthropic streams dropping text or thinking included in the initial content-block event (#​7358 by @​davidbrai).
• Fixed Google history conversion dropping signed empty text and thinking blocks required for replay (#​7362 by @​jingtao-wisdomgraph).
• Fixed OpenAI Codex cached WebSocket sessions being shared across different account credentials (#​7364).
• Fixed transient Google Generative AI and Vertex AI provider errors bypassing automatic retries (#​7471 by @​vish-pr).
• Fixed Gemini 3 tool call ids being discarded during history conversion, breaking signed multi-turn replay (#​7494 by @​muyiyr).
• Fixed OpenAI Responses incomplete reasons so only max_output_tokens is treated as a length stop, and exposed bounded recovery detection for responses truncated below their intended output limit (#​7540 by @​davidbrai).
• Restored GitHub Copilot models returned through account-specific policy responses (#​7672 by @​muyiyr).
• Replaced the retired Qwen Token Plan qwen3.8-max-preview model with qwen3.8-max (#​7670 by @​QuintinShaw).

v0.83.0

Compare Source

Breaking Changes

• Upgraded the exported TypeBox dependency to 1.3.7, removing deprecated APIs including Type.Base, Type.Awaited, Type.Promise, Type.AsyncIterator, Type.Iterator, Type.Options, and Value.Mutate, while fixing compiled validation of nullable array tool arguments. Consumers using removed APIs must migrate to supported TypeBox APIs (#​7243 by @​petrroll).

Added

• Added per-request fetch injection for supported text and image provider transports; Google adapters reject non-global implementations rather than silently bypassing them.
• Added Claude Opus 5 support for the GitHub Copilot provider, routing through the Anthropic Messages API with adaptive thinking, 1M context, and the Copilot minimal thinking-level override (#​7158 by @​jay-aye-see-kay).
• Added the "pending" stop reason for partial streaming messages. See Stop Reasons (#​7151 by @​lucasmeijer).
• Added AssistantMessage.rawStopReason and populated it across Google, Anthropic, Amazon Bedrock, Mistral, and OpenAI streams; unmapped terminal reasons now surface as provider errors instead of successful stops (#​7272).
• Added manual redirect URL and authorization-code entry to OpenRouter OAuth login for remote and headless environments (#​7114 by @​rgarcia).
• Added AuthResolutionOverrides.minOAuthValidityMs so callers can require and refresh OAuth credentials with a minimum remaining validity (#​7168).

Changed

• Changed stored OAuth credentials to refresh when less than five minutes of validity remain instead of waiting until expiration (#​7168).

Fixed

• Fixed Qwen Token Plan reasoning models to send their service-specific thinking controls and supported reasoning-effort levels (#​6951, #​6998).
• Fixed Z.AI providers and compatible custom endpoints to send output limits through max_tokens, which those endpoints honor (#​7174 by @​HyeokjaeLee).
• Fixed explicitly configured Amazon Bedrock profiles being overridden by ambient AWS access keys (#​7176 by @​christianbasch).
• Fixed malformed OpenAI-compatible tool-call deltas with both a valid function payload and an empty custom object discarding the function arguments (#​7288 by @​sunnyyoung).

v0.82.1

Compare Source

Added

• Added ModelsStoreEntry.etag so persisted provider catalogs can carry the remote ETag validator for conditional refreshes.
• Added ANTHROPIC_AUTH_TOKEN bearer authentication for Anthropic-compatible gateways (#​5871)
• Added Claude Opus 5 support for Anthropic and Amazon Bedrock with adaptive thinking, inference profiles, prompt caching, and preserved AWS validation messages (#​7081 by @​unexge, #​7083 by @​davidbrai).

Changed

• Changed Radius OAuth device authorization, token exchange, and refresh requests to use the configured gateway directly.
• Changed ModelsError messages to append the underlying cause, so auth failures such as OAuth refresh failed for openai-codex report the provider response instead of a bare wrapper message.

v0.82.0

Compare Source

Breaking Changes

• Replaced getBuiltinModelDataUrl(provider) with getBuiltinModelDataGeneratedAt() so built-in catalog freshness uses its recorded generation time instead of installation-dependent file metadata (#​7016 by @​davidbrai).

Added

• Added Kimi Code subscription OAuth login for the kimi-coding provider, with device authorization, token refresh, and OAuth host overrides (#​6935 by @​zaycruz).
• Added OpenRouter OAuth PKCE login that mints a user-controlled API key for chat and image providers (#​6927 by @​rsaryev).
• Added Tool.constrainedSampling with strict JSON Schema (prefer/require) and OpenAI Lark/regex grammar variants, enforcing provider-side constrained tool sampling across OpenAI, Anthropic, Amazon Bedrock, Google Gemini, and Mistral. See Constrained Sampling for Tools.
• Added supportsGrammarTools and supportsStrictTools compatibility flags, expanded supportsStrictMode to Responses and Bedrock models, and generated model capability metadata to gate constrained sampling.

Changed

• Changed generated model catalogs to expose only provider-verified reasoning effort levels from models.dev (#​6928 by @​davidbrai).

Fixed

• Fixed OpenAI Codex cached WebSocket continuations after grammar tool calls to send only the real tool-result delta.
• Fixed constrained tool sampling across Google, Amazon Bedrock, Mistral, and Azure OpenAI Responses adapters, including model-aware strict-tool capabilities, grammar configuration validation, and malformed grammar-call replay errors.
• Fixed cacheRetention: "none" to disable implicit prompt-cache writes for supported OpenAI models and session-based caching for OpenAI Codex (#​6618 by @​tmustier).
• Fixed DNS lookup failures such as getaddrinfo, ENOTFOUND, and EAI_AGAIN to trigger automatic assistant retries (#​6946 by @​christianklotz).
• Fixed OpenAI Codex WebSocket sessions to retry once without a missing previous-response continuation after previous_response_not_found errors (#​6955 by @​davidbrai).
• Fixed OpenAI and Anthropic provider retry waits to honor abort signals and configured delay limits (#​6980 by @​petrroll).
• Fixed OpenRouter Anthropic cache breakpoints to advance through tool results and enabled cache control for ~anthropic/*-latest aliases (#​6941 by @​mteam88).

earendil-works/pi (@​earendil-works/pi-coding-agent)

v0.84.1

Compare Source

New Features

• Qwen Token Plan Individual — Use the built-in provider for models documented for Individual subscriptions. See API Keys.
• Authentication readiness checks — Use pi auth check to verify provider or model credentials, optionally emitting the resolved credential.
• Improved fullscreen interaction — Select words and paragraphs with multiple clicks and configure half-page transcript scrolling. See TUI Fullscreen Viewport.
• Terminating blocked tool calls — Extension tool_call handlers can stop all-terminating batches without another model call. See Tool Events.

Added

• Added Qwen Token Plan Individual as a built-in provider with its documented subscription model catalog and the shared international QWEN_TOKEN_PLAN_API_KEY. See API Keys (#​7659 by @​arasovic).
• Added pi auth check provider/model auth preflight with optional credential output (#​7152).
• Added terminate support to blocked extension tool_call events so all-terminating batches can skip the automatic follow-up model call. See Tool Events (#​7715 by @​muyiyr).
• Added inherited double-click word and whitespace selection, granularity-aware drag selection, and triple-click paragraph selection in fullscreen mode (#​7725, #​7733 by @​volsa).
• Added inherited unbound half-page transcript scrolling actions for fullscreen mode. See TUI Fullscreen Viewport (#​7735).

Changed

• Softened the bash tool's PI_* environment guideline in an attempt to reduce unnecessary inspection commands (#​7128).
• Reduced worst-case automatic terminal theme detection delay from 200 ms to 100 ms by probing color-scheme and background support concurrently.

Fixed

• Fixed Bun standalone binaries crashing on startup when the cwd contains a bunfig.toml with preload by compiling with --no-compile-autoload-bunfig (#​7685 by @​geril07).
• Fixed extension TUI method wrappers recursing indefinitely when delegating to the original method (#​7731).
• Fixed right-click not pasting clipboard text in fullscreen mode on Windows.
• Fixed inherited Agent.reset() clearing transcript and runtime state during active runs; it now rejects until the agent is idle (#​7717 by @​wesleyzhangwq).
• Fixed inherited LaTeX relation, multiplication, and named-operator spacing, and matrix composition with stacked fractions, operator limits, and adjacent matrices.
• Reduced inherited fullscreen mouse event volume under tmux, Zellij, and GNU Screen by using button-motion tracking instead of all-motion tracking.

v0.84.0

Compare Source

New Features

• Fullscreen TUI mode — Switch between regular and fullscreen modes at runtime, with a sticky editor and footer, independently scrollable transcript, and draggable scrollbars. See UI & Display.
• Mermaid and LaTeX rendering — Render Mermaid diagrams and terminal-friendly Unicode math in interactive transcripts. See Markdown settings and TUI Markdown.
• Per-directory context overrides — Use AGENTS.override.md to replace context files for a specific directory. See Context Files.
• Advanced custom model sampling — Configure arbitrary OpenAI-compatible samplingParams and opt-in vLLM thinking_token_budget values. See Sampling Parameters.
• Baseten provider — Use built-in Baseten authentication and model support. See API Keys.

Breaking Changes

• Renamed the inherited pi-ai ModelsStreamTransforms interface to ModelsRequestTransforms because its header transformation now applies to all authenticated provider requests.

• Changed JSON and RPC message_update events to emit only assistantMessageEvent deltas, removing the cumulative message and assistantMessageEvent.partial fields that caused quadratic output growth. Clients that need partial messages must assemble deltas between message_start and message_end; the latter remains authoritative (#​7290).

• ModelRegistry.getApiKeyAndHeaders() now returns ProviderHeaders with string | null values and preserves null header-deletion markers. Extensions that inspect returned headers must handle null; extensions forwarding them to pi-ai streams should pass them through unchanged. This prevents placeholder OpenAI credentials from being sent through Cloudflare AI Gateway (#​7030).

• Changed ModelRegistry.refresh() to accept ModelsRefreshOptions and return ModelsRefreshResult instead of discarding cancellation and provider errors.

• Changed ModelRuntime.setRuntimeApiKey() to accept auth cancellation options rather than catalog refresh options. Call refresh({ providers: [providerId], signal }) separately when remote freshness is required.

• Required config-form extension OAuth refreshToken(credentials, signal) callbacks to accept and honor a concrete abort signal.

• Replaced dynamic provider refresh context store access with the read-only context.stored snapshot and generation-checked context.publish() transaction.

  Providers built with createProvider({ fetchModels }): no catalog-publication migration is required. Before and after, return the fetched models and register the resulting provider; createProvider() owns restoration, persistence, and in-memory publication.

  // Before
  const beforeProvider = createProvider({
    // ...
    fetchModels: async ({ signal }) => {
      const response = await fetch(catalogUrl, { signal });
      return parseModels(await response.json());
    },
  });
  pi.registerProvider(beforeProvider);
  
  // After: unchanged
  const afterProvider = createProvider({
    // ...
    fetchModels: async ({ signal }) => {
      const response = await fetch(catalogUrl, { signal });
      return parseModels(await response.json());
    },
  });
  pi.registerProvider(afterProvider);

  Handwritten native Provider.refreshModels(): replace direct store access and pre-publication mutation with generation-guarded publications.

  // Before
  refreshModels: async (context) => {
    const stored = await context.store.read();
    if (stored) currentModels = stored.models;
    if (!context.allowNetwork) return;
  
    const refreshed = await fetchModels(context.signal);
    currentModels = refreshed;
    await context.store.write({ models: refreshed, checkedAt: Date.now() });
  },
  
  // After
  refreshModels: async (context) => {
    if (context.stored) {
      const restored = context.stored.models;
      if (!(await context.publish({
        update: () => { currentModels = restored; },
      }))) return;
    }
    if (!context.allowNetwork) return;
  
    const refreshed = await fetchModels(context.signal);
    if (context.signal.aborted) return;
    await context.publish({
      persist: { models: refreshed, checkedAt: Date.now() },
      update: () => { currentModels = refreshed; },
    });
  },

  For the config-form pi.registerProvider(name, { refreshModels }), callbacks that only return models remain unchanged; pi publishes the returned list. If such a callback previously used context.store for custom persistence, read context.stored and call context.publish({ persist: entry }). In publish(), omit persist to leave storage unchanged, pass a ModelsStoreEntry to write it, or pass persist: null to delete it.

• Replaced the inherited pi-agent-core harness session model with the v4 lane-based Session, SessionStorage, and SessionRepo APIs, including durable operation records, global facts, shared sequence numbers, and tree-scoped lane views.

• Promoted the inherited v2 session and AgentHarness API from pi-agent-core's experimental entrypoint to its default export and removed the experimental subpaths.

• Removed the inherited legacy JSONL and in-memory repository APIs. Use pi-agent-core's v4 JsonlSessionRepo or InMemorySessionRepo, both implementing the new SessionRepo contract.

• Added the inherited required pi-agent-core FileSystem.renameFile() operation for atomic JSONL publication; custom harness file-system implementations must provide same-filesystem replacement semantics (#​7707 by @​davidbrai).

• Replaced experimental remote-session list summaries with durable SessionMetadata; RemoteSession.sessions no longer exposes runtime phase, model, thinking, attachment, or lock state, which remains available from acquired SessionSnapshot values (#​7708).

Added

• Added built-in Baseten provider support with BASETEN_API_KEY authentication and zai-org/GLM-5.2 as the default model.
• Added experimental remote-session client APIs: the transport-neutral PiClient, CBOR protocol, Unix-socket transport, and @earendil-works/pi-coding-agent/client RemoteSession controller with transcript reducers. See Pi Client and Remote Protocol (#​7344, #​7348, #​7371, #​7409).
• Added CredentialSynchronizationError for credential changes that commit successfully but fail to synchronize local model state.
• Added chainable pi.registerMarkdownTransformer() hooks for display-only transformation of user and assistant Markdown. See pi.registerMarkdownTransformer() (#​7231 by @​xl0).
• Added an experimental fullscreen TUI mode, selectable through --tui-mode fullscreen or /settings (#​7304).
• Added runtime switching between regular and fullscreen TUI modes through /settings.
• Added a sticky editor, status, widget, and footer dock to fullscreen mode while keeping the transcript independently scrollable.
• Added a draggable transcript scrollbar to fullscreen mode with configurable auto, always, and hidden modes through /settings; always reserves the rightmost column.
• Added page scrolling and marked-message navigation shortcuts to fullscreen mode.
• Added an optional scrollbarThumb theme color for fullscreen scrollbar thumbs, falling back to selectedBg.
• Added configurable themed Unicode rendering for supported Mermaid diagrams in interactive messages, including optional rendering while streaming. See Markdown settings (#​7624 by @​xl0).
• Added opt-in Ctrl+P/Ctrl+N prompt history navigation, with explicit history bindings taking precedence over application shortcuts while the editor is focused.
• Added per-directory AGENTS.override.md context files, which replace AGENTS.md or CLAUDE.md in the same directory while preserving context from other directories. See Context Files (#​7681 by @​Marvae).
• Added AI_AGENT=pi to CLI and RPC child-process environments for generic agent attribution. See Environment Variables (#​7493 by @​renaudhartert-db).
• Added inherited terminal-friendly Unicode rendering for LaTeX expressions in Markdown. See TUI Markdown.
• Added stacked transient notifications in fullscreen mode.
• Added arbitrary OpenAI-compatible model sampling parameters through samplingParams in models.json, model overrides, extension providers, and stream options. See Sampling Parameters (#​7568 by @​mrexodia).
• Added inherited opt-in vLLM thinking_token_budget support for OpenAI-compatible models, reserving output tokens for the final answer (#​7638 by @​bnsd55).
• Added inherited support for OpenAI-compatible streams that omit finish_reason, using compat.supportsFinishReason to infer normal and tool-use stops when the stream ends. See OpenAI Compatibility.
• Added inherited deferred provider request contracts, durable response handles, authenticated fetch/cancel dispatch, and faux-provider support for pending, ready, failed, and cancelled responses (#​7339 by @​davidbrai).
• Added inherited vendor-neutral telemetry contracts plus agent-owned typed AI-request and harness schemas, composed span starters, and callback helpers. See the agent telemetry schema reference.
• Added inherited structured Amazon Bedrock failure diagnostics with HTTP status, modeled error code, and AWS request id when available (#​7286 by @​brianstanley).
• Added inherited AgentOptions.shouldStopAfterTurn for gracefully stopping after a completed turn before queued messages or another model call are processed. See Agent Options (#​7367 by @​acmerfight).
• Added inherited v4 JsonlSessionRepo support for append-only JSONL harness sessions (#​7611 by @​davidbrai).
• Added inherited bounded branch-entry and indexed open-operation recovery queries to the v4 session API (#​7448, #​7646).
• Added the inherited compile-complete AgentHarness v2 scaffold; unfinished operation paths reject with HarnessNotImplemented while durable execution is implemented.

Changed

• Added inherited optional cancellation to pi-ai ModelsStore reads, writes, and deletions; catalog orchestration binds these waits to the provider refresh signal.
• Reduced the inherited default fullscreen mouse wheel step from three lines to one for finer scrolling.

Fixed

• Fixed the footer showing (sub) for generic OAuth/OpenID sign-ins without a known subscription; extension OAuth providers can opt in with isSubscription.
• Fixed inherited OAuth token refreshes so stalled requests release the credential-store lock (#​7508).
• Fixed inherited tool argument validation to preserve values that already match an anyOf/oneOf union arm before coercion, avoiding nullable unions converting null to another primitive value (#​7328).
• Fixed inherited Fireworks GLM 5.2 requests sending the unsupported prompt_cache_retention field when long cache retention is enabled, and enabled session affinity for automatic prompt caching (#​7676).
• Fixed inherited JsonlSessionRepo enforcing session IDs globally across working directories; IDs are now unique within each working directory.
• Fixed inherited JSONL session forks and torn-tail repairs to publish atomically, avoiding partially written or corrupted sessions after interrupted writes (#​7707 by @​davidbrai).
• Fixed path-containing find globs returning no results on Windows (#​6817).
• Fixed messages queued during manual /compact failing instead of being sent after compaction completes.
• Fixed Git Bash, MSYS, Cygwin, and WSL drive paths passed to built-in file tools resolving against the current Windows drive instead of their native drive (#​7064, #​7547).
• Fixed project-level nested provider retry settings replacing unmodified global provider retry settings (#​7572).
• Fixed inherited GitHub Copilot Grok 4.5 requests to use the supported Responses API (#​7560).
• Fixed fullscreen shutdown leaking terminal capability-query replies into the parent shell prompt.
• Fixed bare exact --model IDs shared by multiple providers choosing the first catalog entry instead of the sole authenticated provider or a clear ambiguity error (#​7327).
• Fixed standalone x64 binaries requiring Haswell-era AVX2/BMI2 instructions by compiling release executables against Bun's baseline runtime (#​7390 by @​davidbrai).
• Fixed Ctrl+X copy confirmations in fullscreen mode adding a transcript status line instead of showing the transient Copied! marker.
• Fixed Kitty image previews in fullscreen mode overlapping the sticky editor and footer dock while scrolling.
• Fixed image-heavy fullscreen sessions lagging when layout changes retransmitted visible Kitty image payloads and rendered the transcript twice per frame.
• Fixed spaces in /settings searches toggling the highlighted setting while typing multi-word queries such as TUI mode or Quiet startup.
• Fixed custom editors not inheriting the default editor's autocomplete dropdown item limit (#​7333).
• Fixed malformed resource arrays in package manifests crashing session startup (#​7187).
• Fixed the DOOM overlay example downloading its shareware WAD from a dead URL.
• Fixed setToolsExpanded(false) to be a no-op when tool output is already collapsed, avoiding redundant Tool output: collapsed startup notices from extensions (#​7292).
• Fixed extension-driven model calls in custom compaction, handoff, and Q&A examples to dispatch through the coding-agent model runtime so custom providers and resolved auth options are preserved (#​7325).
• Fixed long-running sessions using stale credentials after another process updates auth.json without serializing concurrent credential reads and delaying startup (#​7319).
• Fixed concurrent models-store.json reads forming a file-lock convoy and delaying startup.
• Updated the packaged brace-expansion dependency to 5.0.8 to address GHSA-mh99-v99m-4gvg (#​7316).
• Fixed forced model availability refreshes remaining blocked behind a stalled earlier refresh (#​7301, #​7421 by @​a-yeyang).
• Fixed /model catalog refresh failures to identify every catalog that failed.
• Fixed provider login remaining stuck after saving credentials when a model catalog refresh stalls by separating local credential consistency from bounded background freshness (#​7027, #​7113, #​7418).
• Fixed /scoped-models waiting for remote catalogs before rendering instead of showing cached models and cancelling refresh on close (#​7153).
• Fixed /model <name> waiting for catalog refresh before checking cached model matches (#​7443).
• Fixed stale availability snapshots and errors publishing after a newer availability pass.
• Fixed stale pi.dev, Radius, llama.cpp, and extension catalog refreshes publishing after a newer provider refresh.
• Fixed cancellation while waiting for file-backed credential or model-catalog locks, preventing cancelled mutations from running or committing later.
• Fixed concurrent in-memory credential mutations losing unrelated provider updates by serializing their read-modify-write sections.
• Updated undici to 8.9.0 and the packaged brace-expansion to 5.0.9 to address GHSA-8xcm-r25x-g524, GHSA-4cwx-7wf7-3272, GHSA-m8rv-5g2x-5cg5, GHSA-jr45-8vmc-qm54, GHSA-v3r7-h72x-cjcm, and GHSA-rgw5-rvv9-x895.
• Fixed GitHub Copilot compaction and branch summaries using the Individual endpoint instead of the credential-resolved Business or Enterprise endpoint (#​6768).
• Fixed extension model calls dropping credential-resolved endpoints when forwarding request authentication, including custom compaction with GitHub Copilot Business and Enterprise accounts (#​7579).
• Fixed fullscreen transcript navigation leaving no editor-accessible Home, End, PageUp, or PageDown variants by adding Ctrl-modified editor bindings (#​7574).
• Fixed extension event-bus listeners surviving session reloads and disposal (#​7656 by @​tudoroancea).
• Fixed /copy failing to read clipboard text on Wayland when no X11 clipboard is available (#​7387).
• Fixed slow connections failing during the initial connection attempt by increasing the connect timeout (#​7435 by @​muyiyr).
• Fixed oversized images returned by extension and built-in tools bypassing automatic image resizing. See Image settings (#​7330 by @​tizmagik).
• Fixed session discovery missing sessions stored through symlinked directories (#​7552 by @​muyiyr).
• Fixed manual compaction racing with threshold auto-compaction (#​7370 by @​davidbrai).
• Fixed responses truncated below their intended output limit ending the run instead of compacting and retrying once (#​7540 by @​davidbrai).
• Fixed Git package updates leaving dependencies missing when git clean cannot remove an ignored dependency directory (#​7570 by @​mrexodia).
• Fixed find results from POSIX and Windows filesystem roots losing the first path segment or gaining duplicate trailing separators (#​7569 by @​petrroll).
• Fixed transient version-check, catalog, managed-tool, and package-management HTTP failures not being retried (#​7632 by @​petrroll).
• Fixed interactive errors ignoring the configured output padding.
• Fixed the inherited OpenCode Go provider display name.
• Fixed inherited provider error normalization treating arrays and class instances as structured response bodies instead of preserving their original errors (#​7205 by @​erikogenvik).
• Fixed inherited Anthropic streams dropping text or thinking included in the initial content-block event (#​7358 by @​davidbrai).
• Fixed inherited Google history conversion dropping signed empty text and thinking blocks required for replay (#​7362 by @​jingtao-wisdomgraph).
• Fixed inherited OpenAI Codex cached WebSocket sessions being shared across different account credentials (#​7364).
• Fixed inherited transient Google Generative AI and Vertex AI provider errors bypassing automatic retries (#​7471 by @​vish-pr).
• Fixed inherited Gemini 3 tool call ids being discarded during history conversion, breaking signed multi-turn replay (#​7494 by @​muyiyr).
• Restored inherited GitHub Copilot models returned through account-specific policy responses (#​7672 by [@​muyiyr](https://redirect

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
❌ Deployment failed View logs	agentos-site	7889aa4	Aug 07 2026, 08:27 PM