ci(deps): bump undici and @earendil-works/pi-coding-agent in /pi/pi-extensions/ainsel-runner

[dependabot]

Bumps undici and @earendil-works/pi-coding-agent. These dependencies needed to be updated together.
Updates undici from 8.3.0 to 8.9.0

Release notes

Sourced from undici's releases.

v8.9.0

⚠️ Security fixes

High severity

• GHSA-4cwx-7wf7-3272: malformed qualified private Cache-Control directives could cause cross-user information disclosure in shared caches or a parse-time crash. The cache parser now treats empty qualified directives conservatively and safely handles mixed qualified and unqualified directives. Fixed by 4fe5bc5f with regression coverage in 9f09b49a.

Medium severity

• GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 7d3cf924.
• GHSA-jr45-8vmc-qm54: optional whitespace around = in qualified no-cache and private directives could bypass shared-cache restrictions and disclose authenticated data across users. Cache-Control parsing now normalizes these forms and applies conservative cache decisions. Fixed by c601fff1.
• GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by e11a68ed, with corrected fixtures in 2b3f7493.
• GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by 10d93fc3.

Additional hardening

Undici now validates non-string header values after coercion, including array elements, preventing crafted toString() or Symbol.toPrimitive implementations from introducing CRLF sequences. This defense-in-depth change was made in 354a151f.

What's Changed

• fix(decompress): preserve response trailers by @​Ram-blip in nodejs/undici#5572
• build(deps-dev): bump ws from 8.21.0 to 8.21.1 by @​dependabot[bot] in nodejs/undici#5576
• fix: validate coerced header values for CRLF by @​mcollina in nodejs/undici#5579
• fix: handle frozen globalThis in setGlobalDispatcher by @​mhayk in nodejs/undici#5574
• Ignore auto-generated .npmrc on Windows by @​tsctx in nodejs/undici#5583

New Contributors

• @​mhayk made their first contribution in nodejs/undici#5574

Full Changelog: nodejs/undici@v8.8.0...v8.9.0

v8.8.0

What's Changed

• fetch: use ReadableStreamTee for cloning streams by @​KhafraDev in nodejs/undici#5517
• fix(benchmarks): adjust got after v15 upgrade by @​slagiewka in nodejs/undici#5526
• feat(mock): support asynchronous reply options callbacks by @​Develop-KIM in nodejs/undici#5534
• docs: clarify proxy threat model by @​mcollina in nodejs/undici#5530
• docs: clarify MockAgent pool usage by @​vibhor-aggr in nodejs/undici#5542
• docs: clarify parser timeout precision by @​vibhor-aggr in nodejs/undici#5543
• fix: handle flat alternating header arrays in cache normalizeHeaders by @​mcollina in nodejs/undici#5536
• chore(benchmarks): require(esm) on ESM-only packages by @​slagiewka in nodejs/undici#5527
• fix: run idle socket validation off setImmediate instead of setTimeout by @​carlotestor in nodejs/undici#5499
• docs: add custom interceptor example by @​vibhor-aggr in nodejs/undici#5548
• fix(h1): ignore type of service errors by @​mcollina in nodejs/undici#5547
• fix(fetch): convert null init in Response.json by @​Ram-blip in nodejs/undici#5540
• fix(redirect): remove body headers after POST-to-GET by @​Ram-blip in nodejs/undici#5551
• build(deps-dev): bump fast-check from 4.8.0 to 4.9.0 by @​dependabot[bot] in nodejs/undici#5556
• fix(h2): allow stream-bodied requests to multiplex on a busy session by @​GiHoon1123 in nodejs/undici#5538
• fix(h2): destroy aborted stream synchronously instead of via setImmediate by @​staylor in nodejs/undici#5559
• fix(decompress): skip HEAD responses by @​Ram-blip in nodejs/undici#5564
• ci: build undici with node.js v26 by @​shivarm in nodejs/undici#5237

... (truncated)

Commits

• 21a8e1e Bumped v8.9.0 (#5589)
• 7d3cf92 fix: validate blob body content type
• c601fff fix(cache): harden cache directive parsing
• 2b3f749 test(retry): correct broken content-range fixtures in retry-handler.js
• e11a68e fix(retry): reject partial content length mismatch
• 9f09b49 test: cover crash on mixed unqualified and qualified private cache directives
• 4fe5bc5 fix: handle empty qualified private cache directive
• 10d93fc fix: harden cookie domain, path, and unparsed attribute validation
• a17e301 Ignore auto-generated .npmrc on Windows (#5583)
• a0922b0 fix: handle frozen globalThis in setGlobalDispatcher (#5574)
• Additional commits viewable in compare view

Updates @earendil-works/pi-coding-agent from 0.77.0 to 0.84.1

Release notes

Sourced from @​earendil-works/pi-coding-agent's releases.

v0.84.1

New Features

• Qwen Token Plan Individual — Use the built-in provider for models documented for Individual subscriptions. See API Keys.
• Authentication readiness checks — Use pi auth check to verify provider or model credentials, optionally emitting the resolved credential.
• Improved fullscreen interaction — Select words and paragraphs with multiple clicks and configure half-page transcript scrolling. See TUI Fullscreen Viewport.
• Terminating blocked tool calls — Extension tool_call handlers can stop all-terminating batches without another model call. See Tool Events.

Added

• Added Qwen Token Plan Individual as a built-in provider with its documented subscription model catalog and the shared international QWEN_TOKEN_PLAN_API_KEY. See API Keys (#7659 by @​arasovic).
• Added pi auth check provider/model auth preflight with optional credential output (#7152).
• Added terminate support to blocked extension tool_call events so all-terminating batches can skip the automatic follow-up model call. See Tool Events (#7715 by @​muyiyr).
• Added inherited double-click word and whitespace selection, granularity-aware drag selection, and triple-click paragraph selection in fullscreen mode (#7725, #7733 by @​volsa).
• Added inherited unbound half-page transcript scrolling actions for fullscreen mode. See TUI Fullscreen Viewport (#7735).

Changed

• Softened the bash tool's PI_* environment guideline in an attempt to reduce unnecessary inspection commands (#7128).
• Reduced worst-case automatic terminal theme detection delay from 200 ms to 100 ms by probing color-scheme and background support concurrently.

Fixed

• Fixed Bun standalone binaries crashing on startup when the cwd contains a bunfig.toml with preload by compiling with --no-compile-autoload-bunfig (#7685 by @​geril07).
• Fixed extension TUI method wrappers recursing indefinitely when delegating to the original method (#7731).
• Fixed right-click not pasting clipboard text in fullscreen mode on Windows.
• Fixed inherited Agent.reset() clearing transcript and runtime state during active runs; it now rejects until the agent is idle (#7717 by @​wesleyzhangwq).
• Fixed inherited LaTeX relation, multiplication, and named-operator spacing, and matrix composition with stacked fractions, operator limits, and adjacent matrices.
• Reduced inherited fullscreen mouse event volume under tmux, Zellij, and GNU Screen by using button-motion tracking instead of all-motion tracking.

v0.84.0

New Features

• Fullscreen TUI mode — Switch between regular and fullscreen modes at runtime, with a sticky editor and footer, independently scrollable transcript, and draggable scrollbars. See UI & Display.
• Mermaid and LaTeX rendering — Render Mermaid diagrams and terminal-friendly Unicode math in interactive transcripts. See Markdown settings and TUI Markdown.
• Per-directory context overrides — Use AGENTS.override.md to replace context files for a specific directory. See Context Files.
• Advanced custom model sampling — Configure arbitrary OpenAI-compatible samplingParams and opt-in vLLM thinking_token_budget values. See Sampling Parameters.
• Baseten provider — Use built-in Baseten authentication and model support. See API Keys.

Breaking Changes

• Renamed the inherited pi-ai ModelsStreamTransforms interface to ModelsRequestTransforms because its header transformation now applies to all authenticated provider requests.

• Changed JSON and RPC message_update events to emit only assistantMessageEvent deltas, removing the cumulative message and assistantMessageEvent.partial fields that caused quadratic output growth. Clients that need partial messages must assemble deltas between message_start and message_end; the latter remains authoritative (#7290).

• ModelRegistry.getApiKeyAndHeaders() now returns ProviderHeaders with string | null values and preserves null header-deletion markers. Extensions that inspect returned headers must handle null; extensions forwarding them to pi-ai streams should pass them through unchanged. This prevents placeholder OpenAI credentials from being sent through Cloudflare AI Gateway (#7030).

• Changed ModelRegistry.refresh() to accept ModelsRefreshOptions and return ModelsRefreshResult instead of discarding cancellation and provider errors.

• Changed ModelRuntime.setRuntimeApiKey() to accept auth cancellation options rather than catalog refresh options. Call refresh({ providers: [providerId], signal }) separately when remote freshness is required.

• Required config-form extension OAuth refreshToken(credentials, signal) callbacks to accept and honor a concrete abort signal.

• Replaced dynamic provider refresh context store access with the read-only context.stored snapshot and generation-checked context.publish() transaction.

  Providers built with createProvider({ fetchModels }): no catalog-publication migration is required. Before and after, return the fetched models and register the resulting provider; createProvider() owns restoration, persistence, and in-memory publication.

... (truncated)

Changelog

Sourced from @​earendil-works/pi-coding-agent's changelog.

[0.84.1] - 2026-08-07

New Features

• Qwen Token Plan Individual — Use the built-in provider for models documented for Individual subscriptions. See API Keys.
• Authentication readiness checks — Use pi auth check to verify provider or model credentials, optionally emitting the resolved credential.
• Improved fullscreen interaction — Select words and paragraphs with multiple clicks and configure half-page transcript scrolling. See TUI Fullscreen Viewport.
• Terminating blocked tool calls — Extension tool_call handlers can stop all-terminating batches without another model call. See Tool Events.

Added

• Added Qwen Token Plan Individual as a built-in provider with its documented subscription model catalog and the shared international QWEN_TOKEN_PLAN_API_KEY. See API Keys (#7659 by @​arasovic).
• Added pi auth check provider/model auth preflight with optional credential output (#7152).
• Added terminate support to blocked extension tool_call events so all-terminating batches can skip the automatic follow-up model call. See Tool Events (#7715 by @​muyiyr).
• Added inherited double-click word and whitespace selection, granularity-aware drag selection, and triple-click paragraph selection in fullscreen mode (#7725, #7733 by @​volsa).
• Added inherited unbound half-page transcript scrolling actions for fullscreen mode. See TUI Fullscreen Viewport (#7735).

Changed

• Softened the bash tool's PI_* environment guideline in an attempt to reduce unnecessary inspection commands (#7128).
• Reduced worst-case automatic terminal theme detection delay from 200 ms to 100 ms by probing color-scheme and background support concurrently.

Fixed

• Fixed Bun standalone binaries crashing on startup when the cwd contains a bunfig.toml with preload by compiling with --no-compile-autoload-bunfig (#7685 by @​geril07).
• Fixed extension TUI method wrappers recursing indefinitely when delegating to the original method (#7731).
• Fixed right-click not pasting clipboard text in fullscreen mode on Windows.
• Fixed inherited Agent.reset() clearing transcript and runtime state during active runs; it now rejects until the agent is idle (#7717 by @​wesleyzhangwq).
• Fixed inherited LaTeX relation, multiplication, and named-operator spacing, and matrix composition with stacked fractions, operator limits, and adjacent matrices.
• Reduced inherited fullscreen mouse event volume under tmux, Zellij, and GNU Screen by using button-motion tracking instead of all-motion tracking.

[0.84.0] - 2026-08-06

New Features

• Fullscreen TUI mode — Switch between regular and fullscreen modes at runtime, with a sticky editor and footer, independently scrollable transcript, and draggable scrollbars. See UI & Display.
• Mermaid and LaTeX rendering — Render Mermaid diagrams and terminal-friendly Unicode math in interactive transcripts. See Markdown settings and TUI Markdown.
• Per-directory context overrides — Use AGENTS.override.md to replace context files for a specific directory. See Context Files.
• Advanced custom model sampling — Configure arbitrary OpenAI-compatible samplingParams and opt-in vLLM thinking_token_budget values. See Sampling Parameters.
• Baseten provider — Use built-in Baseten authentication and model support. See API Keys.

Breaking Changes

• Renamed the inherited pi-ai ModelsStreamTransforms interface to ModelsRequestTransforms because its header transformation now applies to all authenticated provider requests.
• Changed JSON and RPC message_update events to emit only assistantMessageEvent deltas, removing the cumulative message and assistantMessageEvent.partial fields that caused quadratic output growth. Clients that need partial messages must assemble deltas between message_start and message_end; the latter remains authoritative (#7290).
• ModelRegistry.getApiKeyAndHeaders() now returns ProviderHeaders with string | null values and preserves null header-deletion markers. Extensions that inspect returned headers must handle null; extensions forwarding them to pi-ai streams should pass them through unchanged. This prevents placeholder OpenAI credentials from being sent through Cloudflare AI Gateway (#7030).
• Changed ModelRegistry.refresh() to accept ModelsRefreshOptions and return ModelsRefreshResult instead of discarding cancellation and provider errors.
• Changed ModelRuntime.setRuntimeApiKey() to accept auth cancellation options rather than catalog refresh options. Call refresh({ providers: [providerId], signal }) separately when remote freshness is required.
• Required config-form extension OAuth refreshToken(credentials, signal) callbacks to accept and honor a concrete abort signal.
• Replaced dynamic provider refresh context store access with the read-only context.stored snapshot and generation-checked context.publish() transaction.

... (truncated)

Commits

• 53fa77c Release v0.84.1
• 6ba4d23 docs: audit changelogs since v0.84.0
• 666d897 fix(coding-agent): preserve TUI wrapper routing (closes #7731)
• 7cb2a51 fix(coding-agent): reduce automatic theme detection delay
• 4688e4f docs(coding-agent): reconcile keybinding behavior (#7729)
• 4e64de6 fix(coding-agent): soften PI environment guideline
• c96bfac fix(coding-agent): support Windows fullscreen right-click paste
• a3e93ec feat(tui): add half-page transcript scrolling
• 6fb2d76 feat(coding-agent): add configurable Harness factory (#7686)
• a261366 feat(coding-agent): add auth preflight
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.