Bump the dependencies group with 3 updates

[dependabot]

Bumps the dependencies group with 3 updates: @earendil-works/pi-ai, @earendil-works/pi-coding-agent and @types/node.

Updates @earendil-works/pi-ai from 1.0.3 to 1.1.0

Release notes

Sourced from @​earendil-works/pi-ai's releases.

v1.1.0

New Features

• Program status reporting: terminals and agent dashboards that support OSC 7501 see whether Pi is working, blocked on a dialog or login, done, or failed. See Program status.
• Claude Haiku 5.5: anthropic/claude-haiku-5-5, with adaptive thinking up to xhigh/max effort.
• Adjust default tools with +name/-name: --tools entries like pi -t +codemode,-write change the default selection instead of replacing it. See Tools.
• GPT-6 Luna and image classification: OpenAI's GPT-6 Luna is available as a classifier model through the Decisions API, and codemode's models.classify() accepts images for classifiers that support them. See Use classifier models.
• Native llama.cpp decision models: Julia-1, Laya, Kev, lev, and OpenJev served by llama.cpp 0.6.0 or later run natively as classifiers through /v1/systemone. See Classification.

Added

• Added +name and -name entries to --tools, which change the default tool selection instead of replacing it, for example pi -t +codemode
• Added durationMs to the tool render context and to tool_execution_end extension events: the recorded execution time of a final tool result (#10549)
• Added outputPad to the tool render context (#10557 by @​rwachtler)
• Added OpenAI's GPT-6 Luna as a classifier model through the Decisions API, available with OPENAI_API_KEY (see Use classifier models)
• Added images to codemode's models.classify() context, so classifiers that accept images, such as GPT-6 Luna, can judge them
• Added program status reporting with OSC 7501: terminals and agent dashboards that support it see whether Pi is working, blocked on a dialog or login, done, or failed. PI_PROGRAM_STATUS=1|0 overrides detection (see Terminal setup) (#10607)
• Added aborted to agent_settled session, extension, and JSON events, so integrations can tell a cancelled run from a finished one (#10607)
• Added Claude Haiku 5.5 (anthropic/claude-haiku-5-5), with adaptive thinking up to xhigh/max effort and prompt caching on Bedrock
• Added native llama.cpp decision models: Julia-1, Laya, Kev, lev, and OpenJev served by llama.cpp 0.6.0 or later are listed only as classifiers through /v1/systemone instead of as chat models (see Classification) (#10382)

Changed

• Changed outputPad to also apply to ! command output, tool output, and summary blocks (#9946, #10557 by @​rwachtler)
• Changed pi mcp login --timeout to limit the whole sign-in, including requests to the authorization server, instead of only the wait for the browser (#10565)

Fixed

• Fixed bash and PowerShell results losing Took after reloading a session, and the live Took including wall-clock steps; both now show the recorded execution time (#10549)
• Fixed managed installs keeping every old release; pi update now keeps only the new release and the one it updated from (#10392, #10511 by @​davidbrai)
• Fixed standalone binaries loading .env, .env.local, and .env.development from the launch directory into Pi's environment (#10473)
• Fixed !! command headers losing their dim color once output arrives (#10557 by @​rwachtler)
• Fixed the codemode description not marking searchTools(), describeTool(), and describeNamespace() as async, which led models to serialize the unawaited promise as {} (#10555)
• Fixed codemode output items running together, so models could not tell where one text() or console.log() output ended and the next began. With several text items, each now starts with a ==> text N/M <== line, and console calls follow the other output in one <console_output> block with one line per call
• Fixed /mcp waiting for all servers to connect before opening; the manager now updates live and remains usable while enabling, reconnecting, or disabling servers (#10562)
• Fixed images being dropped as "could not be resized" when running under node --watch on Node 24.19+ and 26.x, where Node posts its own messages on the image resize worker channel (#10527)
• Fixed clipboard paste doing nothing in Termux, and failed copies there omitting the Termux:API install hint (#10391)
• Fixed ! and RPC bash output keeping fragments of color codes, such as a stray m, when a code was split across output chunks (#10504)
• Fixed MCP OAuth sign-ins that could not be cancelled while waiting on the authorization server and kept running after the session ended. The sign-in screen now cancels with Esc at every step, session shutdown aborts a running sign-in, and each request to the authorization server times out after 15 seconds (#10565)
• Fixed shutdown waiting up to 15 seconds to refresh an MCP OAuth token that was about to expire, only to close the server's session (#10565)
• Fixed the fullscreen text selection surviving session switches and other transcript rebuilds, which highlighted unrelated text in the new transcript (#9311, #10567 by @​christianklotz)
• Fixed OpenAI models on Bedrock ignoring the thinking level and always running at Bedrock's default reasoning effort (#9331, #10142 by @​jsanter27)
• Fixed model headers in models.json not overriding the originator and User-Agent headers of Codex requests (#10429 by @​lucasmeijer)
• Fixed server_busy and servers are currently busy provider errors ending the turn instead of being retried (#10543)
• Fixed Mistral responses that end with finish_reason: "error" not being retried (#10487)
• Reduced context-limit request failures by estimating input at 3.5 characters per token instead of 4 when calculating output limits (#10497)
• Fixed Radius models disabled by an organization owner still being listed
• Fixed Anthropic browser login failing with "localhost refused to connect" when port 53692 is reserved or in use, for example by Hyper-V/WSL port exclusions on Windows: login now falls back to a free loopback port (#10571)
• Fixed session costs undercounting long prompts on models with prompt-length pricing tiers, such as Claude Haiku 5.5, Gemini 3.1 Pro, and GPT-5.4, through OpenCode, OpenCode Go, OpenRouter, Vercel AI Gateway, Google, MiniMax, and other providers
• Fixed Markdown links not being clickable in Herdr (#10573)

... (truncated)

Changelog

Sourced from @​earendil-works/pi-ai's changelog.

[1.1.0] - 2026-10-07

Breaking Changes

• A stream function must return an AssistantMessageEventStream, for example from createAssistantMessageEventStream(); a hand-written EventStream<AssistantMessageEvent, AssistantMessage> subclass no longer type-checks in its place

Added

• Added durationMs to AssistantMessage: AssistantMessageEventStream measures each response with a monotonic clock from the start of the request to its final message, for every API implementation, including direct calls. Deferred results fetched later stay untimed (#10549)
• Added an optional durationMs to ToolResultMessage for the execution time of the tool (#10549)
• Added the openai-decisions classifier API for OpenAI's Decisions API, with gpt-6-luna as a classifier model of the openai provider. It needs an API key, so it is not listed as available while openai uses Sign in with ChatGPT
• Added Claude Haiku 5.5 (claude-haiku-5-5) to the anthropic provider with its prompt-length pricing tier, adaptive thinking with xhigh/max effort, per-message effort, and mid-conversation system messages and tool changes. Bedrock requests for Haiku 5.5 use adaptive thinking, native xhigh, and prompt caching
• Added LoginOptions.agentName, which replaces pi's name in the Sign in with ChatGPT agent name hint and the Codex browser login originator (#10433 by @​lucasmeijer)
• Added optional images to ClassifierContext. Models whose input includes "image" judge them with the state; classify() returns an error result for other models and for APIs that cannot send images

Changed

• The faux provider's prompt-cache usage estimate compares the previous and current prompt message by message and compares characters only from the first differing message; the usage numbers are unchanged.

Fixed

• Fixed server_busy and servers are currently busy provider errors ending the turn instead of being retried (#10543)
• Fixed the error message of a failed lazy API setup, such as a module load or auth failure, using its failure time as timestamp instead of the request start
• Reduced context-limit request failures by estimating input at 3.5 characters per token instead of 4 when calculating output limits (#10497)
• Fixed Radius models disabled by an organization owner still being listed: a fetched or cached Radius catalog now replaces the shipped default catalog instead of being merged into it
• Fixed OpenAI provider type-checking with cached catalogs that contain no classifier models
• Fixed Anthropic browser login failing with "localhost refused to connect" when port 53692 is reserved or in use, for example by Hyper-V/WSL port exclusions on Windows: login now falls back to a free loopback port (#10571)
• Fixed built-in model costs missing prompt-length pricing tiers for OpenCode, OpenCode Go, OpenRouter, Vercel AI Gateway, Google, MiniMax, and other models.dev providers, which undercounted the cost of long prompts on models such as Claude Haiku 5.5, Gemini 3.1 Pro, and GPT-5.4. OpenRouter time-of-day pricing is not modeled
• Fixed Mistral responses that end with finish_reason: "error" not being retried (#10487)
• Fixed Bedrock Converse not sending the reasoning effort to OpenAI models: gpt-oss gets reasoning_effort clamped to low/medium/high, other GPT models get reasoning.effort with minimal sent as low (#9331, #10142 by @​jsanter27)
• Fixed model and caller headers not overriding the originator and User-Agent headers of openai-codex-responses requests (#10429 by @​lucasmeijer)

[1.0.4] - 2026-10-05

Fixed

• Fixed Bedrock requests that fail with The pending stream has been canceled after a stalled HTTP/2 connection not being retried automatically (#10379)

Commits

• abe508e Release v1.1.0
• a2eef9e fix(ai): pin Kimi K3 Moonshot pricing and expect Haiku 5.5 adaptive thinking
• dce4ae6 docs: audit changelogs for v1.1.0
• 943a10e fix(ai): keep prompt-length pricing tiers from all model catalogs
• f76c1db feat(ai): add Claude Haiku 5.5
• 7fb59f9 fix(ai): retry Mistral finish_reason error
• 8d8ae2f fix(ai): fall back to a free port for Anthropic OAuth callback
• 6b58544 fix(ai): type empty OpenAI classifier catalogs
• ce8972a feat(ai,coding-agent): add OpenAI Decisions classifier and classifier images
• fe11328 fix(ai): compare faux prompt-cache usage per message
• Additional commits viewable in compare view

Updates @earendil-works/pi-coding-agent from 1.0.3 to 1.1.0

Release notes

Sourced from @​earendil-works/pi-coding-agent's releases.

v1.1.0

New Features

• Program status reporting: terminals and agent dashboards that support OSC 7501 see whether Pi is working, blocked on a dialog or login, done, or failed. See Program status.
• Claude Haiku 5.5: anthropic/claude-haiku-5-5, with adaptive thinking up to xhigh/max effort.
• Adjust default tools with +name/-name: --tools entries like pi -t +codemode,-write change the default selection instead of replacing it. See Tools.
• GPT-6 Luna and image classification: OpenAI's GPT-6 Luna is available as a classifier model through the Decisions API, and codemode's models.classify() accepts images for classifiers that support them. See Use classifier models.
• Native llama.cpp decision models: Julia-1, Laya, Kev, lev, and OpenJev served by llama.cpp 0.6.0 or later run natively as classifiers through /v1/systemone. See Classification.

Added

• Added +name and -name entries to --tools, which change the default tool selection instead of replacing it, for example pi -t +codemode
• Added durationMs to the tool render context and to tool_execution_end extension events: the recorded execution time of a final tool result (#10549)
• Added outputPad to the tool render context (#10557 by @​rwachtler)
• Added OpenAI's GPT-6 Luna as a classifier model through the Decisions API, available with OPENAI_API_KEY (see Use classifier models)
• Added images to codemode's models.classify() context, so classifiers that accept images, such as GPT-6 Luna, can judge them
• Added program status reporting with OSC 7501: terminals and agent dashboards that support it see whether Pi is working, blocked on a dialog or login, done, or failed. PI_PROGRAM_STATUS=1|0 overrides detection (see Terminal setup) (#10607)
• Added aborted to agent_settled session, extension, and JSON events, so integrations can tell a cancelled run from a finished one (#10607)
• Added Claude Haiku 5.5 (anthropic/claude-haiku-5-5), with adaptive thinking up to xhigh/max effort and prompt caching on Bedrock
• Added native llama.cpp decision models: Julia-1, Laya, Kev, lev, and OpenJev served by llama.cpp 0.6.0 or later are listed only as classifiers through /v1/systemone instead of as chat models (see Classification) (#10382)

Changed

• Changed outputPad to also apply to ! command output, tool output, and summary blocks (#9946, #10557 by @​rwachtler)
• Changed pi mcp login --timeout to limit the whole sign-in, including requests to the authorization server, instead of only the wait for the browser (#10565)

Fixed

• Fixed bash and PowerShell results losing Took after reloading a session, and the live Took including wall-clock steps; both now show the recorded execution time (#10549)
• Fixed managed installs keeping every old release; pi update now keeps only the new release and the one it updated from (#10392, #10511 by @​davidbrai)
• Fixed standalone binaries loading .env, .env.local, and .env.development from the launch directory into Pi's environment (#10473)
• Fixed !! command headers losing their dim color once output arrives (#10557 by @​rwachtler)
• Fixed the codemode description not marking searchTools(), describeTool(), and describeNamespace() as async, which led models to serialize the unawaited promise as {} (#10555)
• Fixed codemode output items running together, so models could not tell where one text() or console.log() output ended and the next began. With several text items, each now starts with a ==> text N/M <== line, and console calls follow the other output in one <console_output> block with one line per call
• Fixed /mcp waiting for all servers to connect before opening; the manager now updates live and remains usable while enabling, reconnecting, or disabling servers (#10562)
• Fixed images being dropped as "could not be resized" when running under node --watch on Node 24.19+ and 26.x, where Node posts its own messages on the image resize worker channel (#10527)
• Fixed clipboard paste doing nothing in Termux, and failed copies there omitting the Termux:API install hint (#10391)
• Fixed ! and RPC bash output keeping fragments of color codes, such as a stray m, when a code was split across output chunks (#10504)
• Fixed MCP OAuth sign-ins that could not be cancelled while waiting on the authorization server and kept running after the session ended. The sign-in screen now cancels with Esc at every step, session shutdown aborts a running sign-in, and each request to the authorization server times out after 15 seconds (#10565)
• Fixed shutdown waiting up to 15 seconds to refresh an MCP OAuth token that was about to expire, only to close the server's session (#10565)
• Fixed the fullscreen text selection surviving session switches and other transcript rebuilds, which highlighted unrelated text in the new transcript (#9311, #10567 by @​christianklotz)
• Fixed OpenAI models on Bedrock ignoring the thinking level and always running at Bedrock's default reasoning effort (#9331, #10142 by @​jsanter27)
• Fixed model headers in models.json not overriding the originator and User-Agent headers of Codex requests (#10429 by @​lucasmeijer)
• Fixed server_busy and servers are currently busy provider errors ending the turn instead of being retried (#10543)
• Fixed Mistral responses that end with finish_reason: "error" not being retried (#10487)
• Reduced context-limit request failures by estimating input at 3.5 characters per token instead of 4 when calculating output limits (#10497)
• Fixed Radius models disabled by an organization owner still being listed
• Fixed Anthropic browser login failing with "localhost refused to connect" when port 53692 is reserved or in use, for example by Hyper-V/WSL port exclusions on Windows: login now falls back to a free loopback port (#10571)
• Fixed session costs undercounting long prompts on models with prompt-length pricing tiers, such as Claude Haiku 5.5, Gemini 3.1 Pro, and GPT-5.4, through OpenCode, OpenCode Go, OpenRouter, Vercel AI Gateway, Google, MiniMax, and other providers
• Fixed Markdown links not being clickable in Herdr (#10573)

... (truncated)

Changelog

Sourced from @​earendil-works/pi-coding-agent's changelog.

[1.1.0] - 2026-10-07

New Features

• Program status reporting: terminals and agent dashboards that support OSC 7501 see whether Pi is working, blocked on a dialog or login, done, or failed. See Program status.
• Claude Haiku 5.5: anthropic/claude-haiku-5-5, with adaptive thinking up to xhigh/max effort.
• Adjust default tools with +name/-name: --tools entries like pi -t +codemode,-write change the default selection instead of replacing it. See Tools.
• GPT-6 Luna and image classification: OpenAI's GPT-6 Luna is available as a classifier model through the Decisions API, and codemode's models.classify() accepts images for classifiers that support them. See Use classifier models.
• Native llama.cpp decision models: Julia-1, Laya, Kev, lev, and OpenJev served by llama.cpp 0.6.0 or later run natively as classifiers through /v1/systemone. See Classification.

Added

• Added +name and -name entries to --tools, which change the default tool selection instead of replacing it, for example pi -t +codemode
• Added durationMs to the tool render context and to tool_execution_end extension events: the recorded execution time of a final tool result (#10549)
• Added outputPad to the tool render context (#10557 by @​rwachtler)
• Added OpenAI's GPT-6 Luna as a classifier model through the Decisions API, available with OPENAI_API_KEY (see Use classifier models)
• Added images to codemode's models.classify() context, so classifiers that accept images, such as GPT-6 Luna, can judge them
• Added program status reporting with OSC 7501: terminals and agent dashboards that support it see whether Pi is working, blocked on a dialog or login, done, or failed. PI_PROGRAM_STATUS=1|0 overrides detection (see Terminal setup) (#10607)
• Added aborted to agent_settled session, extension, and JSON events, so integrations can tell a cancelled run from a finished one (#10607)
• Added Claude Haiku 5.5 (anthropic/claude-haiku-5-5), with adaptive thinking up to xhigh/max effort and prompt caching on Bedrock
• Added native llama.cpp decision models: Julia-1, Laya, Kev, lev, and OpenJev served by llama.cpp 0.6.0 or later are listed only as classifiers through /v1/systemone instead of as chat models (see Classification) (#10382)

Changed

• Changed outputPad to also apply to ! command output, tool output, and summary blocks (#9946, #10557 by @​rwachtler)
• Changed pi mcp login --timeout to limit the whole sign-in, including requests to the authorization server, instead of only the wait for the browser (#10565)

Fixed

• Fixed bash and PowerShell results losing Took after reloading a session, and the live Took including wall-clock steps; both now show the recorded execution time (#10549)
• Fixed managed installs keeping every old release; pi update now keeps only the new release and the one it updated from (#10392, #10511 by @​davidbrai)
• Fixed standalone binaries loading .env, .env.local, and .env.development from the launch directory into Pi's environment (#10473)
• Fixed !! command headers losing their dim color once output arrives (#10557 by @​rwachtler)
• Fixed the codemode description not marking searchTools(), describeTool(), and describeNamespace() as async, which led models to serialize the unawaited promise as {} (#10555)
• Fixed codemode output items running together, so models could not tell where one text() or console.log() output ended and the next began. With several text items, each now starts with a ==> text N/M <== line, and console calls follow the other output in one <console_output> block with one line per call
• Fixed /mcp waiting for all servers to connect before opening; the manager now updates live and remains usable while enabling, reconnecting, or disabling servers (#10562)
• Fixed images being dropped as "could not be resized" when running under node --watch on Node 24.19+ and 26.x, where Node posts its own messages on the image resize worker channel (#10527)
• Fixed clipboard paste doing nothing in Termux, and failed copies there omitting the Termux:API install hint (#10391)
• Fixed ! and RPC bash output keeping fragments of color codes, such as a stray m, when a code was split across output chunks (#10504)
• Fixed MCP OAuth sign-ins that could not be cancelled while waiting on the authorization server and kept running after the session ended. The sign-in screen now cancels with Esc at every step, session shutdown aborts a running sign-in, and each request to the authorization server times out after 15 seconds (#10565)
• Fixed shutdown waiting up to 15 seconds to refresh an MCP OAuth token that was about to expire, only to close the server's session (#10565)
• Fixed the fullscreen text selection surviving session switches and other transcript rebuilds, which highlighted unrelated text in the new transcript (#9311, #10567 by @​christianklotz)
• Fixed OpenAI models on Bedrock ignoring the thinking level and always running at Bedrock's default reasoning effort (#9331, #10142 by @​jsanter27)
• Fixed model headers in models.json not overriding the originator and User-Agent headers of Codex requests (#10429 by @​lucasmeijer)
• Fixed server_busy and servers are currently busy provider errors ending the turn instead of being retried (#10543)
• Fixed Mistral responses that end with finish_reason: "error" not being retried (#10487)
• Reduced context-limit request failures by estimating input at 3.5 characters per token instead of 4 when calculating output limits (#10497)
• Fixed Radius models disabled by an organization owner still being listed
• Fixed Anthropic browser login failing with "localhost refused to connect" when port 53692 is reserved or in use, for example by Hyper-V/WSL port exclusions on Windows: login now falls back to a free loopback port (#10571)
• Fixed session costs undercounting long prompts on models with prompt-length pricing tiers, such as Claude Haiku 5.5, Gemini 3.1 Pro, and GPT-5.4, through OpenCode, OpenCode Go, OpenRouter, Vercel AI Gateway, Google, MiniMax, and other providers

... (truncated)

Commits

• abe508e Release v1.1.0
• e916310 test(coding-agent): wait for streaming and watcher events instead of fixed sl...
• 70759f4 fix: address actionable npm audit findings
• dce4ae6 docs: audit changelogs for v1.1.0
• 503c605 feat(tui,coding-agent): report program status via OSC 7501
• f10993b fix(coding-agent): cancel MCP OAuth sign-ins and stop refreshing on close
• 27c7b6f fix(coding-agent): strip ANSI sequences split across user bash output chunks
• 592fb57 fix(coding-agent): read Termux clipboard on Android platform
• adae824 docs(coding-agent): document azure provider id, Foundry models, and deploymen...
• b30a6dd fix(coding-agent): ignore Node's own worker messages in image resize
• Additional commits viewable in compare view

Updates @types/node from 26.6.4 to 26.6.5

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions