build(deps-dev): bump @earendil-works/pi-ai from 0.84.1 to 0.84.2

[dependabot]

Bumps @earendil-works/pi-ai from 0.84.1 to 0.84.2.

Release notes

Sourced from @​earendil-works/pi-ai's releases.

v0.84.2

New Features

• Fullscreen transcript search — Search and navigate matches in fullscreen mode. See TUI Fullscreen Viewport.
• Configurable default tools — Choose startup built-in tools globally or per project. See Tools.
• Configurable fullscreen exit output — Print the transcript or only a resume hint on exit. See Interactive Mode.

Added

• Added fullscreen transcript search with Ctrl+Shift+F, incremental match highlighting, configurable search match theme colors, and next/previous navigation with Enter/Ctrl+G and Shift+Enter/Ctrl+Shift+G.
• Added experimental strict JSON-schema constrained sampling for the default read, bash, edit, and write tools under PI_EXPERIMENTAL=1.
• Added a fullscreen exit output setting to choose between printing the final transcript and only a session resume hint.
• Added the defaultTools setting for configuring the initial built-in tool selection globally or per project.
• Added --use-theme <name[/name]> to choose an initial per-run interactive theme without changing saved settings (#7722 by @​rwachtler).
• Added expandPromptTemplates to extension pi.sendUserMessage() options for explicitly dispatching commands and expanding skills and prompt templates. See pi.sendUserMessage() (#7857 by @​mrexodia).
• Added inherited createGatewayBindingFetch() for routing Cloudflare AI Gateway requests through a Workers AI binding without an API token (#7901 by @​Maximo-Guk).
• Added inherited AssistantMessage.endTurn to preserve OpenAI Codex's terminal end_turn signal for diagnostics (#7766).
• Added inherited unbound single-line transcript scrolling actions for fullscreen mode. See TUI Fullscreen Viewport (#7903 by @​midastruth).

Changed

• Changed inherited Kimi Coding requests to use pi's runtime User-Agent header.
• Replaced the inherited Mistral SDK transport with a native Chat Completions HTTP stream, eliminating its generated client and schema runtime overhead.
• Documented the generic AI_AGENT=pi process marker and how it differs from PI_CODING_AGENT=true (#7747).
• Changed inherited OpenAI Responses deferred tool loading to prefer message-anchored additional_tools where supported while retaining tool-search and top-level fallbacks (#7709).
• Reduced inherited fullscreen rendering allocation churn by painting full-width layout rows directly instead of recompositing them on every frame.

Fixed

• Fixed managed-tool downloads delaying TUI startup and hiding diagnostics in fullscreen mode by mounting the TUI first and showing download progress and warnings inside it.
• Fixed opening a model selector immediately after startup cancelling and restarting the in-progress model catalog refresh.
• Fixed inherited GitHub Copilot login triggering API rate limits while enabling model policies by limiting concurrent policy updates (#6187).
• Fixed fullscreen transcript search snapping back to the current match during manual scrolling and fragmented mouse input leaking into the search query.
• Fixed inherited required LaTeX arguments starting on a new line being parsed as empty (#7760).
• Updated the transitive nanoid development dependency to address a denial-of-service vulnerability.
• Fixed fallback rendering for extension tool results to collapse long output and honor tool expansion (#7979).
• Fixed JSON and RPC message_update events dropping cumulative usage during streaming. See JSON Event Mode and RPC message_update (#7982 by @​christianklotz).
• Fixed pi.sendMessage(..., { triggerTurn: false }) steering an active run instead of only recording the custom message (#8022 by @​cristinaponcela).
• Fixed the defaultTools setting dropping extension and SDK custom tools when selecting built-in defaults.
• Fixed the subagent example rejecting YAML array syntax for the tools frontmatter field (#7598 by @​alexsavio).
• Fixed the subagent example dropping parent session model, thinking, and tool configuration (#7897 by @​virtuald).
• Fixed custom system prompts concatenating the current working directory with later appended prompt content (#7887 by @​distributedlock).
• Fixed inherited OpenAI Responses function and custom tool calls losing namespaces during streaming, proxying, and replay (#7709).
• Fixed inherited upstream request buffer failures not triggering automatic assistant retries.
• Fixed inherited built-in and custom DeepSeek API models sending output limits through an unsupported field.
• Fixed inherited Amazon Bedrock replay rejecting tool arguments that contain empty object keys while preserving all valid nested values (#7882 by @​muyiyr).
• Fixed inherited DeepSeek compatibility detection for base URLs whose hostname contains uppercase letters (#7933 by @​yearth).
• Fixed inherited Google Generative AI and Vertex AI responses with tool calls incorrectly treating output-limit or provider-error stops as normal tool use (#8059).
• Fixed inherited fullscreen mouse drag selection and OSC 8 link activation in terminals that report generic SGR mouse release button codes (#7963).
• Fixed inherited focused fullscreen overlays not receiving mouse wheel or viewport scroll keys such as PageUp and PageDown (#7894).

... (truncated)

Changelog

Sourced from @​earendil-works/pi-ai's changelog.

[0.84.2] - 2026-08-14

Added

• Added createGatewayBindingFetch() for routing Cloudflare AI Gateway requests through a Workers AI binding without an API token (#7901 by @​Maximo-Guk).
• Added AssistantMessage.endTurn to preserve OpenAI Codex's terminal end_turn signal for diagnostics (#7766).

Changed

• Changed Kimi Coding requests to use pi's runtime User-Agent header.
• Automatically converted supported strict tool schemas to provider-compatible closed objects with required nullable optional fields while preserving original tool definitions, and treated null values for optional non-nullable tool arguments as omitted.
• Changed OpenAI Responses deferred tool loading to prefer message-anchored additional_tools where supported while retaining tool-search and top-level fallbacks (#7709).
• Replaced the Mistral SDK transport with a native Chat Completions HTTP stream, eliminating its generated client and schema runtime overhead.

Fixed

• Fixed GitHub Copilot login triggering API rate limits while enabling model policies by limiting concurrent policy updates (#6187).
• Fixed upstream request buffer limit failures to trigger automatic assistant retries.
• Fixed OpenAI Responses function and custom tool calls to preserve namespaces during streaming, proxying, and replay (#7709).
• Fixed built-in and custom DeepSeek API models to send output limits through the supported max_tokens field.
• Fixed Google Generative AI and Vertex AI responses with tool calls incorrectly treating output-limit or provider-error stops as normal tool use (#8059).
• Fixed Amazon Bedrock replay rejecting tool arguments that contain empty object keys while preserving all valid nested values (#7882 by @​muyiyr).
• Fixed DeepSeek compatibility detection for base URLs whose hostname contains uppercase letters (#7933 by @​yearth).

Commits

• 914cf14 Release v0.84.2
• d10c974 docs: audit changelogs since v0.84.1
• 5093641 fix(ai): preserve Google length stops with tool calls
• 9d2ec7f fix(ai): use pi user agent for Kimi Coding requests
• b3edf01 fix(ai): bound Copilot policy update concurrency
• 7915cda feat(ai): add strict tool schema conversion
• 2f8b4b4 fix(ai): expose low reasoning effort for native DeepSeek V4 Flash (#7807)
• 2300290 feat(ai): AI Gateway transport over the Cloudflare AI binding (#7901)
• b647d18 fix(ai): detect DeepSeek base URLs case-insensitively (#7933)
• 75c7fd6 fix(ai): declare Cloudflare Responses strict tools (#7934)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Bumps @earendil-works/pi-ai from 0.84.1 to 0.84.2 to pick up bug fixes and tooling improvements for local development and CI; no runtime code paths are affected.

• Only package.json and bun.lock changed. Transitive updates include openai 6.40.0 and @earendil-works/pi-telemetry 0.84.2.
• @earendil-works/pi-coding-agent stays at 0.84.1, so the lock contains both pi-ai 0.84.2 (root) and 0.84.1 (nested). The root pi-ai CLI resolves to 0.84.2.
• No migration required. If you use the pi-ai CLI locally, do a quick smoke test to confirm scripts still run.

^{Written for commit 0affc4a. Summary will update on new commits.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​earendil-works/​pi-ai@​0.84.2

View full report