Resolves GHSA-8xcm-r25x-g524, GHSA-4cwx-7wf7-3272, GHSA-m8rv-5g2x-5cg5,
GHSA-jr45-8vmc-qm54, GHSA-v3r7-h72x-cjcm, and GHSA-rgw5-rvv9-x895.
undici 8.10.0 is blocked by the npm min-release-age gate; 8.9.0 is the
first fixed 8.x release. Reviewed undici 8.6.0-8.9.0 release notes
against http-dispatcher usage; no breaking changes. Adds an AGENTS.md
rule requiring changelog review for future undici updates.
Bump TypeBox to 1.3.7 so compiled validators guard array-specific keywords when null is accepted, and cover tool-argument validation with a regression test.
Breaking for extensions: TypeBox 1.3 removes deprecated APIs including Type.Base, Type.Awaited, Type.Promise, Type.AsyncIterator, Type.Iterator, Type.Options, and Value.Mutate. Extensions using these through Pi's bundled TypeBox aliases must migrate to supported TypeBox APIs.
Fixes#7003
The harness declared peer deps on the pre-rename @mariozechner/pi-ai and
@mariozechner/pi-agent-core names, so npm auto-installed our own code from the
registry under an alias. sync-versions bumped those aliases in lockstep, which
made every release fail because the new version is not published yet.
Build the eval harness on createHarness from vitest-evals core instead. The
pi-specific code was already ours; the harness only contributed agent-lifecycle
plumbing and unused tool replay.
This PR:
- Adds retainedTail to compaction entries in the new agent harness so we don't have to walk up the tree for the 2000 tokens before compaction,
- Changes getPathToRoot to getPathToRootOrCompaction to only load until last compaction, as unnecessary to access all nodes where it is called,
- Adds a SQLite storage backend, in a separate packages/session-backend-sqlite, with a migration system and schemas as per on-site discussions: sessions to match session header messages (except for metadata, which I couldn't understand what it's used for or where it gets written, so I omitted it), session_entries for shared entry types as columns plus payload as a json for what remains, session_sequences to represent the append-only, serialized nature of the jsonl files, branch_entries to attribute nodes to branches (relationship one-to-many), and session_materialized with the session info (see /session in TUI) to act as a "cache" or quick-access for costs, message count, token info, labels, session name, and model-thinking-level config (e.g. for fast resume).
- This is compatible with the new agent harness Session abstraction.
