[dependabot]

Bumps @earendil-works/pi-ai from 0.75.3 to 0.77.0.

Release notes

Sourced from @​earendil-works/pi-ai's releases.

v0.77.0

New Features

• Claude Opus 4.8 support - Adds Anthropic Claude Opus 4.8 metadata and updates Opus adaptive-thinking coverage.
• Selective tool disablement - --exclude-tools / -xt disables specific built-in, extension, or custom tools while leaving the rest available. See Tool Options.
• Headless Codex subscription login - /login can use device-code auth for ChatGPT Plus/Pro Codex subscriptions. See Subscriptions and OpenAI Codex.
• Streaming-aware extension input - extensions can distinguish idle prompts, mid-stream steers, and queued follow-ups with InputEvent.streamingBehavior. See Input Events.

Added

• Added --exclude-tools / -xt to disable specific built-in, extension, or custom tools while leaving the rest available (#5109).
• Added OpenAI Codex subscription device-code login as a selectable headless alternative while keeping browser login as the default (#4911 by @​vegarsti).
• Added streamingBehavior to extension input events so extensions can distinguish idle prompts from mid-stream steers and queued follow-ups (#5107 by @​DanielThomas).
• Added Claude Opus 4.8 model metadata for Anthropic and updated Opus adaptive-thinking coverage to use it.

Fixed

• Fixed startup timing output so readPipedStdin no longer includes createAgentSessionRuntime work (#4829).
• Fixed OpenRouter DeepSeek V4 xhigh reasoning metadata to preserve OpenRouter's native effort instead of sending DeepSeek's max effort (#4801).
• Fixed custom session directories so current-folder resume/continue lookups stay scoped to the active cwd while all-session listings cover the custom directory.
• Fixed SIGTERM/SIGHUP exits to run extension session_shutdown cleanup and restore the terminal: signal-triggered shutdown now emits session_shutdown before any terminal writes, and SIGHUP no longer hard-exits, so extension resources (e.g. sockets) are released even when the terminal is gone (#5080).
• Fixed keyboard protocol negotiation to ignore mismatched or delayed terminal responses, avoiding false Kitty keyboard protocol detection (#5091 by @​mitsuhiko).
• Fixed Windows startup crashes under MSYS2 ucrt64 Node.js by updating the native clipboard addon to napi-rs 3.x (#5028).
• Fixed API key and header config resolution to treat plain strings as literals, support $ENV_VAR / ${ENV_VAR} interpolation and $! bang escaping, and require explicit env syntax for config files, avoiding Windows case-insensitive env matches corrupting literal keys (#5095).
• Fixed session disposal to abort in-flight agent, compaction, branch summary, retry, and bash work (#5029 by @​TerminallyChilI).
• Fixed pi.getAllTools() to expose each tool's promptGuidelines for extensions that need per-tool guideline attribution (#4879).
• Fixed OpenAI Codex Responses replay after switching from Anthropic extended-thinking sessions by generating unique fallback message item IDs for converted thinking/text blocks (#5148).
• Fixed Anthropic-compatible replay for providers that return empty thinking signatures by adding an opt-in allowEmptySignature compatibility flag (#4464).
• Fixed OpenAI and OpenRouter GPT-5.5 Pro thinking level metadata to expose only supported medium, high, and xhigh efforts.
• Fixed OpenCode Go Kimi K2.6 thinking-off requests to send thinking: "none" (#5078).
• Fixed Xiaomi Token Plan model metadata to omit unsupported mimo-v2-flash variants (#5075).
• Fixed follow-up messages queued by agent_end extension handlers to drain before the agent becomes idle (#5115 by @​DanielThomas).
• Fixed extension input events to report streamingBehavior only for prompts actually queued during streaming (#5107 by @​DanielThomas).
• Fixed system prompt tool-selection guidance to avoid preferring unavailable file exploration tools (#5132).
• Fixed fenced diff code blocks and other highlight.js scopes to keep theme-aware syntax colors after the cli-highlight replacement (#5092).

v0.76.0

New Features

• Explicit session IDs for automation - --session-id <id> lets scripts create or resume an exact project-local session. See Sessions.
• RPC bash output can stay out of model context - RPC clients can pass excludeFromContext to bash for commands whose output should not be sent with the next prompt. See RPC mode.
• More predictable provider retries and timeouts - Codex WebSocket/SSE waits are bounded, and retry.provider.maxRetries controls provider retries instead of hidden SDK defaults. See Retry settings.
• Better terminal editing across environments - Apple Terminal Shift+Enter, Windows/JetBrains capability detection, and Unicode-aware word navigation improve interactive editing. See Terminal setup and Keybindings.

Added

• Added --session-id to let CLI callers use an exact project-local session ID, creating it if missing (#4874).
• Added excludeFromContext flag to the bash RPC command for parity with the internal executeBash API (#5039).

... (truncated)

Changelog

Sourced from @​earendil-works/pi-ai's changelog.

[0.77.0] - 2026-05-28

Added

• Added OpenAI Codex subscription device-code login as a selectable headless alternative while keeping browser login as the default (#4911 by @​vegarsti).
• Added Claude Opus 4.8 model metadata for Anthropic and updated Opus adaptive-thinking coverage to use it.

Fixed

• Fixed OpenRouter DeepSeek V4 xhigh reasoning metadata to preserve OpenRouter's native effort instead of sending DeepSeek's max effort (#4801).
• Fixed OpenAI Codex Responses replay after switching from Anthropic extended-thinking sessions by generating unique fallback message item IDs for converted thinking/text blocks (#5148).
• Fixed Anthropic-compatible replay for providers that return empty thinking signatures by adding an opt-in allowEmptySignature compatibility flag (#4464).
• Fixed OpenAI and OpenRouter GPT-5.5 Pro thinking level metadata to expose only supported medium, high, and xhigh efforts.
• Fixed OpenCode Go Kimi K2.6 thinking-off requests to send thinking: "none" (#5078).
• Fixed Xiaomi Token Plan model metadata to omit unsupported mimo-v2-flash variants (#5075).

[0.76.0] - 2026-05-27

Fixed

• Fixed OpenAI Codex Responses cache-affinity headers to send session-id instead of proxy-incompatible session_id (#4967).
• Fixed openai-codex/gpt-5.3-codex-spark generated metadata to use its 128k context window (#4969).
• Fixed OpenRouter/Poolside context overflow detection for maximum allowed input length errors (#4943).
• Fixed OpenAI Codex Responses WebSocket streams and SSE response-header waits to apply bounded timeouts instead of waiting indefinitely when no events arrive (#4945).
• Fixed provider retry controls so OpenAI Codex Responses honors maxRetries, SDK retries default to 0, and quota/billing 429s are not retried behind Pi's retry handling (#4991 by @​mitsuhiko).

[0.75.5] - 2026-05-23

Breaking Changes

• Changed OAuthLoginCallbacks to require onDeviceCode and onSelect, so OAuth providers can rely on pi supplying device-code and selection UI callbacks (#4788 by @​vegarsti).

Fixed

• Fixed custom Anthropic-compatible model aliases for adaptive-thinking Claude models by adding compat.forceAdaptiveThinking model metadata and moving built-in adaptive-thinking selection out of provider id substring checks (#4797 by @​mbazso).
• Fixed GitHub Copilot OAuth login to rely on the required device-code callback without a runtime callback availability guard (#4788 by @​vegarsti).
• Fixed Amazon Bedrock provider loading under strict package managers by declaring its direct @smithy/node-http-handler dependency (#4842).
• Fixed Amazon Bedrock Claude requests to send the model output token cap by default, matching Anthropic requests and avoiding Bedrock's 4096-token default truncation (#4848).

[0.75.4] - 2026-05-20

Changed

• Changed source syntax to avoid TypeScript constructs that require JavaScript emit, keeping the package compatible with Node.js strip-only TypeScript checks.
• Removed the package-level development watch scripts now that the root TypeScript check validates strip-only-compatible sources.

Added

• Added first-class OAuth device-code callback metadata, shared polling support, and GitHub Copilot OAuth integration.

... (truncated)

Commits

• 8322745 Release v0.77.0
• f29472c Audit unreleased changelog entries
• 0127cae Fix OpenRouter DeepSeek V4 xhigh reasoning
• d1fb34b fix(ai): use valid synthetic Responses message ids closes #5148
• 3f1ce9b fix(ai): avoid duplicate Codex replay message ids closes #5148
• 97ef317 Fix Kimi and Xiaomi model metadata
• bfa3d1f Update Claude Opus and GPT thinking metadata
• 458a7bc Fix Anthropic empty thinking signature replay
• 9d5fb70 feat(ai): add Codex device code login (#4911)
• 39a26c8 Add [Unreleased] section for next cycle
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​earendil-works/pi-ai since your current version.

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​earendil-works/​pi-ai@​0.77.0

View full report

[ualtinok]

Superseded by combined dependency update in 8ba65b3. Thanks, Dependabot.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.