chore(deps): bump the production group across 1 directory with 14 updates

[dependabot]

Bumps the production group with 14 updates in the / directory:

Package	From	To
@cantoo/pdf-lib	2.7.1	2.7.4
@composio/core	0.10.0	0.14.0
@earendil-works/pi-agent-core	0.79.9	0.80.10
@earendil-works/pi-ai	0.79.9	0.80.10
@earendil-works/pi-coding-agent	0.79.9	0.80.10
@earendil-works/pi-tui	0.79.9	0.80.10
convex	1.41.0	1.42.3
discord.js	14.26.4	14.27.0
grammy	1.44.0	1.45.1
linkedom	0.18.12	0.18.13
playwright-core	1.60.0	1.61.1
tar	7.5.16	7.5.20
ws	8.21.0	8.21.1
@anthropic-ai/claude-code	2.1.201	2.1.215

Updates @cantoo/pdf-lib from 2.7.1 to 2.7.4

Commits

• ee8ee2d Release 2.7.4
• 4485440 Improve types for compatibility with recent node versions
• 9f1e65e Fix document corruption after incremental update
• 0f9cabf Release 2.7.3
• 46613dd Per PDF spec 7.3.4.3, white-space inside hex strings must be ignored
• 9011011 Release 2.7.2
• ed79a1b Improve documentation for empty password
• b8e1d48 Fix data loss on reload when source PDF uses object streams
• See full diff in compare view

Updates @composio/core from 0.10.0 to 0.14.0

Release notes

Sourced from @​composio/core's releases.

@​composio/core@​0.14.0

Minor Changes

• fc17c37: Export the sensitive-file-upload denylist guard from the package root so downstream packages share one implementation: assertSafeFileUploadPath, isBlockedSensitiveFileUploadPath, and BUILTIN_FILE_UPLOAD_PATH_DENY_SEGMENTS. The guard now routes its filesystem access through the internal #platform abstraction (adding a realpathSync platform method), so it is edge/workerd-safe and the module carries no static node:* imports. Behavior on Node/Bun is unchanged.

• 20a4711: triggers.create now resolves the connection from user_id on the backend instead of client-side.

  • The SDK no longer makes an extra connectedAccounts.list() call. When connectedAccountId is omitted, the backend resolves the first active connection for the user and the trigger's toolkit (ordered by most recently created), matching tool execution.
  • Behavior change: create no longer throws ComposioConnectedAccountNotFoundError for a missing or invalid connection. That case now surfaces as the backend error from the upsert call. ComposioTriggerTypeNotFoundError (invalid slug) and ValidationError (including empty userId) are still thrown client-side.
  • Requires a backend that resolves the trigger connection from user_id on upsert (ComposioHQ/platform#10932). Self-hosted deployments must be on a version that includes it.

Patch Changes

• 7125576: Normalize duplicate JSON Schema required entries before provider tool schemas are emitted.

• 58bc93b: Refresh dependency ranges and lockfiles across the workspace.

• 4c3a321: Disable client retries on tools.execute and tools.proxyExecute. These are non-idempotent writes, so a silent retry after a read timeout could duplicate the side effect (e.g. send the same email more than once). Both now route through a sibling client built with maxRetries: 0; reads keep the default retry behaviour.

• b07fcad: Add an eve provider: EveProvider makes session.tools() return eve-native defineTools, defineComposioTools is the replay-safe step.started resolver, and (ctx, next) hooks can rewrite, deny, or transform Tool Router meta-tool calls.

  Preserve successful local-tool results when the remote half of a mixed COMPOSIO_MULTI_EXECUTE_TOOL batch fails at the transport layer, so callers can see which side effects already completed before retrying.

• fa933a6: Fix the homepage links in these packages' package.json. They pointed at github.com/ComposioHQ/composio/tree/main/..., but the default branch is next and no main branch exists, so every link 404'd on npm and in editor tooltips. They now point at tree/next/....

• 2ef40ce: Treat local file paths that begin with http as paths instead of URLs, ensuring that upload allowlist and sensitive-file denylist checks still run.

• e78ed31: Execute every parallel tool call in OpenAIProvider.handleToolCalls. It previously only ran the first tool call in each assistant message, so parallel tool calls (on by default) dropped the rest and left their tool_call_ids unanswered, failing the next request.

  The calls are run sequentially, in the order the model returned them — here "parallel" means the model issued several calls in one turn, not that they execute concurrently — so each tool_call_id is answered exactly once and the tool messages come back in a deterministic order.

  Only the first choice is handled. Tool results are fed back into a single assistant turn, so with n > 1 iterating over every choice would run each tool call once per choice and orphan the tool_call_ids from the alternative completions.

• a0f37a7: Close two secret/SSRF exposure surfaces in the TypeScript SDK:

  • SSRF guard on URL file inputs. composio.files.upload(url) and automatic file upload during tool execution previously did a raw fetch() on user-supplied URLs with no guard. They now resolve the host and refuse private, loopback, link-local (incl. the 169.254.169.254 cloud-metadata endpoint), CGNAT, and reserved addresses, reject non-http(s) schemes, and follow redirects manually so each hop is re-validated (blocking a public URL that redirects into internal space). Blocked requests throw ComposioBlockedInternalUrlError. Node-only; behaviour for public URLs is unchanged.
  • Telemetry redaction. Error telemetry previously shipped error.message / error.stack verbatim. They are now passed through a redactor that strips URL query strings, Authorization bearer/basic credentials, and secret-like key=value pairs (API keys, tokens, client secrets, passwords) before transport.

• 820abb9: Resolve toolkit version pins case-insensitively. Version maps are keyed by normalized (lowercase) slugs, but getToolkitVersion previously looked them up with the raw slug, so a pin configured under a different casing (e.g. { GitHub: '20250101_00' } or COMPOSIO_TOOLKIT_VERSION_GITHUB) could silently fall back to 'latest'. Normalization is now centralized in a single normalizeToolkitSlug helper used symmetrically on both the write (map-building) and read (lookup) paths, so the two sides can no longer drift. This mirrors the equivalent fix in the Python SDK.

• Updated dependencies [58bc93b]

• Updated dependencies [fa933a6]

  • @​composio/json-schema-to-zod@​0.2.1

@​composio/core@​0.13.1

Patch Changes

• 605a726: Add Tool Router session deletion APIs.

@​composio/core@​0.13.0

Minor Changes

• d17a268: Add the first-class composio.sessions.create() API while keeping composio.create() as an alias, expose the experimental shared-connection ACL patch helper as connectedAccounts.updateAcl() while keeping experimental.updateAcl() as an alias, and include SDK docs/source in the published package.

  MCP is now opt-in. Sessions return native tools by default; the hosted MCP endpoint is only surfaced on the type when you create the session with { mcp: true }. The default create() / use() now return SessionWithoutMcp (the runtime object is unchanged — session.mcp still exists at runtime — but it is no longer in the type).

  Migration: read session.mcp only after creating with { mcp: true }.

... (truncated)

Changelog

Sourced from @​composio/core's changelog.

0.14.0

Minor Changes

• fc17c37: Export the sensitive-file-upload denylist guard from the package root so downstream packages share one implementation: assertSafeFileUploadPath, isBlockedSensitiveFileUploadPath, and BUILTIN_FILE_UPLOAD_PATH_DENY_SEGMENTS. The guard now routes its filesystem access through the internal #platform abstraction (adding a realpathSync platform method), so it is edge/workerd-safe and the module carries no static node:* imports. Behavior on Node/Bun is unchanged.

• 20a4711: triggers.create now resolves the connection from user_id on the backend instead of client-side.

  • The SDK no longer makes an extra connectedAccounts.list() call. When connectedAccountId is omitted, the backend resolves the first active connection for the user and the trigger's toolkit (ordered by most recently created), matching tool execution.
  • Behavior change: create no longer throws ComposioConnectedAccountNotFoundError for a missing or invalid connection. That case now surfaces as the backend error from the upsert call. ComposioTriggerTypeNotFoundError (invalid slug) and ValidationError (including empty userId) are still thrown client-side.
  • Requires a backend that resolves the trigger connection from user_id on upsert (ComposioHQ/platform#10932). Self-hosted deployments must be on a version that includes it.

Patch Changes

• 7125576: Normalize duplicate JSON Schema required entries before provider tool schemas are emitted.

• 58bc93b: Refresh dependency ranges and lockfiles across the workspace.

• 4c3a321: Disable client retries on tools.execute and tools.proxyExecute. These are non-idempotent writes, so a silent retry after a read timeout could duplicate the side effect (e.g. send the same email more than once). Both now route through a sibling client built with maxRetries: 0; reads keep the default retry behaviour.

• b07fcad: Add an eve provider: EveProvider makes session.tools() return eve-native defineTools, defineComposioTools is the replay-safe step.started resolver, and (ctx, next) hooks can rewrite, deny, or transform Tool Router meta-tool calls.

  Preserve successful local-tool results when the remote half of a mixed COMPOSIO_MULTI_EXECUTE_TOOL batch fails at the transport layer, so callers can see which side effects already completed before retrying.

• fa933a6: Fix the homepage links in these packages' package.json. They pointed at github.com/ComposioHQ/composio/tree/main/..., but the default branch is next and no main branch exists, so every link 404'd on npm and in editor tooltips. They now point at tree/next/....

• 2ef40ce: Treat local file paths that begin with http as paths instead of URLs, ensuring that upload allowlist and sensitive-file denylist checks still run.

• e78ed31: Execute every parallel tool call in OpenAIProvider.handleToolCalls. It previously only ran the first tool call in each assistant message, so parallel tool calls (on by default) dropped the rest and left their tool_call_ids unanswered, failing the next request.

  The calls are run sequentially, in the order the model returned them — here "parallel" means the model issued several calls in one turn, not that they execute concurrently — so each tool_call_id is answered exactly once and the tool messages come back in a deterministic order.

  Only the first choice is handled. Tool results are fed back into a single assistant turn, so with n > 1 iterating over every choice would run each tool call once per choice and orphan the tool_call_ids from the alternative completions.

• a0f37a7: Close two secret/SSRF exposure surfaces in the TypeScript SDK:

  • SSRF guard on URL file inputs. composio.files.upload(url) and automatic file upload during tool execution previously did a raw fetch() on user-supplied URLs with no guard. They now resolve the host and refuse private, loopback, link-local (incl. the 169.254.169.254 cloud-metadata endpoint), CGNAT, and reserved addresses, reject non-http(s) schemes, and follow redirects manually so each hop is re-validated (blocking a public URL that redirects into internal space). Blocked requests throw ComposioBlockedInternalUrlError. Node-only; behaviour for public URLs is unchanged.
  • Telemetry redaction. Error telemetry previously shipped error.message / error.stack verbatim. They are now passed through a redactor that strips URL query strings, Authorization bearer/basic credentials, and secret-like key=value pairs (API keys, tokens, client secrets, passwords) before transport.

• 820abb9: Resolve toolkit version pins case-insensitively. Version maps are keyed by normalized (lowercase) slugs, but getToolkitVersion previously looked them up with the raw slug, so a pin configured under a different casing (e.g. { GitHub: '20250101_00' } or COMPOSIO_TOOLKIT_VERSION_GITHUB) could silently fall back to 'latest'. Normalization is now centralized in a single normalizeToolkitSlug helper used symmetrically on both the write (map-building) and read (lookup) paths, so the two sides can no longer drift. This mirrors the equivalent fix in the Python SDK.

• Updated dependencies [58bc93b]

• Updated dependencies [fa933a6]

  • @​composio/json-schema-to-zod@​0.2.1

0.13.1

Patch Changes

• 605a726: Add Tool Router session deletion APIs.

0.13.0

Minor Changes

• d17a268: Add the first-class composio.sessions.create() API while keeping composio.create() as an alias, expose the experimental shared-connection ACL patch helper as connectedAccounts.updateAcl() while keeping experimental.updateAcl() as an alias, and include SDK docs/source in the published package.

... (truncated)

Commits

• 26f3c62 Release: update version (#3717)
• fbcf081 revert(core): defer v1 session alias removal (#3826)
• fa933a6 fix(ts): point published package homepage links at the next branch (#3821)
• 7125576 fix(schema): normalize duplicate required entries (#3812)
• 09aab1d chore(deps-dev): bump the npm-development group across 1 directory with 3 upd...
• 0de5263 feat(core)!: remove bare session aliases; freeze MCP SPI (#3780)
• a0f37a7 fix(core): SSRF guard on URL file inputs + telemetry secret redaction (#3779)
• a13c883 docs: package-manager picker for install commands (#3802)
• caef908 docs: refresh README(s) (#3801)
• b07fcad feat(experimental): add Eve provider and iMessage example (#3800)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​composio/core since your current version.

Updates @earendil-works/pi-agent-core from 0.79.9 to 0.80.10

Release notes

Sourced from @​earendil-works/pi-agent-core's releases.

v0.80.10

New Features

• Kimi Coding thinking compatibility — Kimi Coding models now use adaptive thinking correctly; K3 exposes its supported max level and supports replaying empty-signature thinking blocks. See Kimi For Coding setup and Model Options.

Fixed

• Fixed inherited Kimi Coding requests to use Anthropic adaptive thinking effort without token budgets, and enabled empty thinking signatures for K3 and kimi-for-coding.
• Fixed inherited Kimi K3 pricing metadata for Moonshot AI and Moonshot AI China.
• Fixed inherited Kimi Coding K3 thinking-level metadata to expose only the supported max level (#6737).
• Fixed inherited catalog generation restoring xAI models removed in 0.80.9 (#6736).

v0.80.9

New Features

• Kimi K3 and deferred tool loading — Use Kimi K3 across built-in providers, including progressive extension tool activation through Kimi’s native protocol. See Dynamic Tool Loading, OpenAI Compatibility, and the kimi-deferred-tools.ts example.

Added

• Added inherited Kimi K3 support for Kimi Coding, Moonshot AI, Moonshot AI China, OpenRouter, and Vercel AI Gateway.
• Added Kimi deferred tool loading for extension-driven tool activation. See Dynamic Tool Loading, OpenAI Compatibility, and the kimi-deferred-tools.ts example.

Changed

• Changed xAI login to use a prefilled device-authorization link labeled “Sign in with SuperGrok or X Premium,” and changed the default xAI model to Grok 4.5 (#6734 by @​Jaaneek).

Fixed

• Fixed inherited Kimi K3 output limits for Vercel AI Gateway and OpenRouter models.
• Fixed cloning or forking a session before its first assistant response to explain that the session must be saved first.

Removed

• Removed Grok 3, Grok 3 Fast, Grok 4.20 variants, and Grok Code Fast 1 from the built-in xAI model catalog (#6734 by @​Jaaneek).

v0.80.8

New Features

• Unified model runtime and provider authentication — ModelRuntime centralizes model configuration, provider-owned /login, and dynamic provider catalogs. See Providers.
• Live model catalog refresh — /model refreshes configured providers in the background, and pi update --models forces an immediate refresh. See Install and Manage.
• xAI device-code OAuth and Grok 4.5 Responses support — Sign in to xAI with a device code and use Grok 4.5 with low, medium, or high thinking. See xAI.

Breaking Changes

• Replaced the SDK's CreateAgentSessionOptions.authStorage and modelRegistry options with the async modelRuntime option. AuthStorage and its storage backends are no longer exported; use ModelRuntime (or a custom pi-ai CredentialStore), or readStoredCredential() for one-off reads of auth.json.
• Removed redundant ModelRuntime.getAll(), find(), getSnapshot(), and getAuthOptions() projections. Use the pi-ai Models methods getModels(), getModel(), getProviders(), and checkAuth() directly.
• Replaced SDK request-auth assembly through ModelRegistry.getApiKeyAndHeaders() with ModelRuntime.getAuth(). Passing a provider ID returns provider-scoped auth; passing a model also resolves built-in, models.json, and extension model headers.
• Changed extension-facing ModelRegistry.refresh() from synchronous void to Promise<void> because models.json loading is asynchronous. Extensions must await it before making synchronous registry reads.
• Moved canonical dynamic catalog refresh to async ModelRuntime.refresh()/pi-ai Models.refresh(). Legacy extension OAuth modifyModels remains supported as a synchronous compatibility projection after credential initialization.

... (truncated)

Changelog

Sourced from @​earendil-works/pi-agent-core's changelog.

[0.80.10] - 2026-07-16

[0.80.9] - 2026-07-16

[0.80.8] - 2026-07-16

[0.80.7] - 2026-07-14

Added

• Added AgentToolResult.addedToolNames propagation to ToolResultMessage so tools introduced by a result can be loaded from that transcript point onward (#6474).

[0.80.6] - 2026-07-09

Added

• Added the max model thinking level after xhigh.

[0.80.5] - 2026-07-09

[0.80.4] - 2026-07-09

Added

• Added configurable harness session context entry transforms and custom-entry message projectors.
• Added custom metadata support in JSONL session headers (#6417 by @​ArcadiaLin).
• Exported InMemorySessionStorage and JsonlSessionStorage (#6435).

Fixed

• Fixed harness split-turn compaction to serialize summary requests so single-concurrency providers are not asked to run overlapping generations (#5536).
• Fixed harness tool calls from length-truncated assistant messages to fail instead of waiting for missing tool results (#6285).
• Fixed harness session ingestion to normalize null message content before context projection, avoiding crashes on lax imported transcripts (#6343).
• Fixed non-positive or oversized harness shell execution timeouts to fail with a clear validation error instead of being clamped to an immediate timeout (#6181).
• Fixed harness session storage short entry ids to use the random tail of the generated uuidv7 instead of the timestamp prefix, which was nearly constant between calls (#6242).

[0.80.3] - 2026-06-30

Added

• Added prepareNextTurnWithContext for Agent users that need the next-turn loop context.

Fixed

• Fixed Agent.prepareNextTurn to keep receiving the run abort signal instead of the next-turn context.

[0.80.2] - 2026-06-23

Changed

... (truncated)

Commits

• 8dc7883 Release v0.80.10
• f7e0603 Add [Unreleased] section for next cycle
• 2d16f92 Release v0.80.9
• e022eec Add [Unreleased] section for next cycle
• fae7176 Release v0.80.8
• 5e336cf Merge origin/main into model runtime changes
• cd7cad4 feat(coding-agent): merge origin/main into model runtime facade
• 9d09075 Add [Unreleased] section for next cycle
• 818d674 Release v0.80.7
• 9993c96 feat(coding-agent): replace model registry with model runtime
• Additional commits viewable in compare view

Updates @earendil-works/pi-ai from 0.79.9 to 0.80.10

Release notes

Sourced from @​earendil-works/pi-ai's releases.

v0.80.10

New Features

• Kimi Coding thinking compatibility — Kimi Coding models now use adaptive thinking correctly; K3 exposes its supported max level and supports replaying empty-signature thinking blocks. See Kimi For Coding setup and Model Options.

Fixed

• Fixed inherited Kimi Coding requests to use Anthropic adaptive thinking effort without token budgets, and enabled empty thinking signatures for K3 and kimi-for-coding.
• Fixed inherited Kimi K3 pricing metadata for Moonshot AI and Moonshot AI China.
• Fixed inherited Kimi Coding K3 thinking-level metadata to expose only the supported max level (#6737).
• Fixed inherited catalog generation restoring xAI models removed in 0.80.9 (#6736).

v0.80.9

New Features

• Kimi K3 and deferred tool loading — Use Kimi K3 across built-in providers, including progressive extension tool activation through Kimi’s native protocol. See Dynamic Tool Loading, OpenAI Compatibility, and the kimi-deferred-tools.ts example.

Added

• Added inherited Kimi K3 support for Kimi Coding, Moonshot AI, Moonshot AI China, OpenRouter, and Vercel AI Gateway.
• Added Kimi deferred tool loading for extension-driven tool activation. See Dynamic Tool Loading, OpenAI Compatibility, and the kimi-deferred-tools.ts example.

Changed

• Changed xAI login to use a prefilled device-authorization link labeled “Sign in with SuperGrok or X Premium,” and changed the default xAI model to Grok 4.5 (#6734 by @​Jaaneek).

Fixed

• Fixed inherited Kimi K3 output limits for Vercel AI Gateway and OpenRouter models.
• Fixed cloning or forking a session before its first assistant response to explain that the session must be saved first.

Removed

• Removed Grok 3, Grok 3 Fast, Grok 4.20 variants, and Grok Code Fast 1 from the built-in xAI model catalog (#6734 by @​Jaaneek).

v0.80.8

New Features

• Unified model runtime and provider authentication — ModelRuntime centralizes model configuration, provider-owned /login, and dynamic provider catalogs. See Providers.
• Live model catalog refresh — /model refreshes configured providers in the background, and pi update --models forces an immediate refresh. See Install and Manage.
• xAI device-code OAuth and Grok 4.5 Responses support — Sign in to xAI with a device code and use Grok 4.5 with low, medium, or high thinking. See xAI.

Breaking Changes

• Replaced the SDK's CreateAgentSessionOptions.authStorage and modelRegistry options with the async modelRuntime option. AuthStorage and its storage backends are no longer exported; use ModelRuntime (or a custom pi-ai CredentialStore), or readStoredCredential() for one-off reads of auth.json.
• Removed redundant ModelRuntime.getAll(), find(), getSnapshot(), and getAuthOptions() projections. Use the pi-ai Models methods getModels(), getModel(), getProviders(), and checkAuth() directly.
• Replaced SDK request-auth assembly through ModelRegistry.getApiKeyAndHeaders() with ModelRuntime.getAuth(). Passing a provider ID returns provider-scoped auth; passing a model also resolves built-in, models.json, and extension model headers.
• Changed extension-facing ModelRegistry.refresh() from synchronous void to Promise<void> because models.json loading is asynchronous. Extensions must await it before making synchronous registry reads.
• Moved canonical dynamic catalog refresh to async ModelRuntime.refresh()/pi-ai Models.refresh(). Legacy extension OAuth modifyModels remains supported as a synchronous compatibility projection after credential initialization.

... (truncated)

Changelog

Sourced from @​earendil-works/pi-ai's changelog.

[0.80.10] - 2026-07-16

Fixed

• Fixed Kimi Coding requests to use Anthropic adaptive thinking effort without token budgets, and enabled empty thinking signatures for K3 and kimi-for-coding.
• Fixed Kimi K3 pricing metadata for Moonshot AI and Moonshot AI China.
• Fixed Kimi Coding K3 thinking-level metadata to expose only the supported max level (#6737).
• Fixed catalog generation restoring xAI models removed in 0.80.9 (#6736).

[0.80.9] - 2026-07-16

Added

• Added Kimi K3 support for Kimi Coding, Moonshot AI, Moonshot AI China, OpenRouter, and Vercel AI Gateway.
• Added Kimi deferred tool loading to OpenAI-compatible Chat Completions through compat.deferredToolsMode.

Changed

• Changed xAI device OAuth to open a prefilled authorization link and added provider-specific OAuth login labels (#6734 by @​Jaaneek).

Fixed

• Fixed Kimi K3 output limits for Vercel AI Gateway and OpenRouter models.

Removed

• Removed Grok 3, Grok 3 Fast, Grok 4.20 variants, and Grok Code Fast 1 from the built-in xAI model catalog (#6734 by @​Jaaneek).

[0.80.8] - 2026-07-16

Breaking Changes

• Changed runtime authentication to provider-scoped Models.checkAuth(), getAuth(), login(), and logout() APIs. checkAuth() now returns AuthCheck | undefined, and API-key auth resolvers no longer receive a model.
• Removed the legacy built-in OAuth provider objects, global OAuth registry APIs, and public low-level built-in login/refresh functions. Use canonical Provider.auth.oauth methods instead; the oauth subpath now retains only extension compatibility types.
• Renamed the canonical login interaction interface from AuthLoginCallbacks to AuthInteraction; it exposes the provider-neutral prompt()/notify() protocol used by API-key and OAuth flows.
• Changed the Models request contract: getAuth(model) now includes model headers, while getAuth(providerId) remains provider-scoped, and Models stream options may include transformHeaders. Custom Models implementations must execute the transform after merging auth/model and explicit headers, then remove it before provider dispatch.
• Changed dynamic model refresh to Models.refresh(options), which refreshes every configured dynamic provider and returns per-provider errors/cancellation state. Provider.refreshModels(context) now receives the effective credential, scoped model storage, network policy, and abort signal.

Added

• Added provider-owned authentication and availability resolution to Models, including stored OAuth refresh and interactive login support through CredentialStore.
• Added async non-secret credential enumeration through CredentialStore.list() and credential-aware Provider.filterModels() availability policy.
• Added neutral auth-flow information/link events and provider-owned Amazon Bedrock and Google Vertex AI credential selection flows.
• Added ModelsStore with an in-memory default for restoring and persisting dynamic provider catalogs.
• Added the dynamic Radius pi-messages gateway provider with OAuth and credential-specific catalog refresh.
• Added Models.refresh({ force: true }) to let providers bypass freshness checks for explicit refreshes.
• Added xAI device-code OAuth login and routed Grok 4.5 through OpenAI Responses, with low, medium, and high thinking support (#6651 by @​Jaaneek).

Changed

... (truncated)

Commits

• 8dc7883 Release v0.80.10
• b8575f6 fix(ai): use adaptive thinking for Kimi Coding
• aba3245 fix(ai): correct Kimi K3 Moonshot pricing
• c1b7856 fix(ai): prevent removed xAI models regenerating, closes #6736
• 78ff249 fix(ai): expose max thinking for Kimi Coding K3
• f7e0603 Add [Unreleased] section for next cycle
• 2d16f92 Release v0.80.9
• aa508b7 docs: audit unreleased changelogs
• a01baaa feat(xai): prefilled OAuth device link, SuperGrok login label, trimmed model ...
• c2c32fe fix(ai): correct Kimi K3 gateway output limits
• Additional commits viewable in compare view

Updates @earendil-works/pi-coding-agent from 0.79.9 to 0.80.10

Release notes

Sourced from @​earendil-works/pi-coding-agent's releases.

v0.80.10

New Features

• Kimi Coding thinking compatibility — Kimi Coding models now use adaptive thinking correctly; K3 exposes its supported max level and supports replaying empty-signature thinking blocks. See Kimi For Coding setup and Model Options.

Fixed

• Fixed inherited Kimi Coding requests to use Anthropic adaptive thinking effort without token budgets, and enabled empty thinking signatures for K3 and kimi-for-coding.
• Fixed inherited Kimi K3 pricing metadata for Moonshot AI and Moonshot AI China.
• Fixed inherited Kimi Coding K3 thinking-level metadata to expose only the supported max level (#6737).
• Fixed inherited catalog generation restoring xAI models removed in 0.80.9 (#6736).

v0.80.9

New Features

• Kimi K3 and deferred tool loading — Use Kimi K3 across built-in providers, including progressive extension tool activation through Kimi’s native protocol. See Dynamic Tool Loading, OpenAI Compatibility, and the kimi-deferred-tools.ts example.

Added

• Added inherited Kimi K3 support for Kimi Coding, Moonshot AI, Moonshot AI China, OpenRouter, and Vercel AI Gateway.
• Added Kimi deferred tool loading for extension-driven tool activation. See Dynamic Tool Loading, OpenAI Compatibility, and the kimi-deferred-tools.ts example.

Changed

• Changed xAI login to use a prefilled device-authorization link labeled “Sign in with SuperGrok or X Premium,” and changed the default xAI model to Grok 4.5 (#6734 by @​Jaaneek).

Fixed

• Fixed inherited Kimi K3 output limits for Vercel AI Gateway and OpenRouter models.
• Fixed cloning or forking a session before its first assistant response to explain that the session must be saved first.

Removed

• Removed Grok 3, Grok 3 Fast, Grok 4.20 variants, and Grok Code Fast 1 from the built-in xAI model catalog (#6734 by @​Jaaneek).

v0.80.8

New Features

• Unified model runtime and provider authentication — ModelRuntime centralizes model configuration, provider-owned /login, and dynamic provider catalogs. See Providers.
• Live model catalog refresh — /model refreshes configured providers in the background, and pi update --models forces an immediate refresh. See Install and Manage.
• xAI device-code OAuth and Grok 4.5 Responses support — Sign in to xAI with a device code and use Grok 4.5 with low, medium, or high thinking. See xAI.

Breaking Changes

• Replaced the SDK's CreateAgentSessionOptions.authStorage and modelRegistry options with the async modelRuntime option. AuthStorage and its storage backends are no longer exported; use ModelRuntime (or a custom pi-ai CredentialStore), or readStoredCredential() for one-off reads of auth.json.
• Removed redundant ModelRuntime.getAll(), find(), getSnapshot(), and getAuthOptions() projections. Use the pi-ai Models methods getModels(), getModel(), getProviders(), and checkAuth() directly.
• Replaced SDK request-auth assembly through ModelRegistry.getApiKeyAndHeaders() with ModelRuntime.getAuth(). Passing a provider ID returns provider-scoped auth; passing a model also resolves built-in, models.json, and extension model headers.
• Changed extension-facing ModelRegistry.refresh() from synchronous void to Promise<void> because models.json loading is asynchronous. Extensions must await it before making synchronous registry reads.
• Moved canonical dynamic catalog refresh to async ModelRuntime.refresh()/pi-ai Models.refresh(). Legacy extension OAuth modifyModels remains supported as a synchronous compatibility projection after credential initialization.

... (truncated)

Changelog

Sourced from @​earendil-works/pi-coding-agent's changelog.

[0.80.10] - 2026-07-16

New Features

• Kimi Coding thinking compatibility — Kimi Coding models now use adaptive thinking correctly; K3 exposes its supported max level and supports replaying empty-signature thinking blocks. See Kimi For Coding setup and Model Options.

Fixed

• Fixed inherited Kimi Coding requests to use Anthropic adaptive thinking effort without token budgets, and enabled empty thinking signatures for K3 and kimi-for-coding.
• Fixed inherited Kimi K3 pricing metadata for Moonshot AI and Moonshot AI China.
• Fixed inherited Kimi Coding K3 thinking-level metadata to expose only the supported max level (#6737).
• Fixed inherited catalog generation restoring xAI models removed in 0.80.9 (#6736).

[0.80.9] - 2026-07-16

New Features

• Kimi K3 and deferred tool loading — Use Kimi K3 across built-in providers, including progressive extension tool activation through Kimi’s native protocol. See Dynamic Tool Loading, OpenAI Compatibility, and the kimi-deferred-tools.ts example.

Added

• Added inherited Kimi K3 support for Kimi Coding, Moonshot AI, Moonshot AI China, OpenRouter, and Vercel AI Gateway.
• Added Kimi deferred tool loading for extension-driven tool activation. See Dynamic Tool Loading, OpenAI Compatibility, and the kimi-deferred-tools.ts example.

Changed

• Changed xAI login to use a prefilled device-authorization link labeled “Sign in with SuperGrok or X Premium,” and changed the default xAI model to Grok 4.5 (#6734 by @​Jaaneek).

Fixed

• Fixed inherited Kimi K3 output limits for Vercel AI Gateway and OpenRouter models.
• Fixed cloning or forking a session before its first assistant response to explain that the session must be saved first.

Removed

• Removed Grok 3, Grok 3 Fast, Grok 4.20 variants, and Grok Code Fast 1 from the built-in xAI model catalog (#6734 by @​Jaaneek).

[0.80.8] - 2026-07-16

New Features

• Unified model runtime and provider authentication — ModelRuntime centralizes model configuration, provider-owned /login, and dynamic provider catalogs. See Providers.
• Live model catalog refresh — /model refreshes configured providers in the background, and pi update --models forces an immediate refresh. See Install and Manage.
• xAI device-code OAuth and Grok 4.5 Responses support — Sign in to xAI with a device code and use Grok 4.5 with low, medium, or high thinking. See xAI.

Breaking Changes

• Replaced the SDK's CreateAgentSessionOptions.authStorage and modelRegistry options with the async modelRuntime option. AuthStorage and its storage backends are no longer exported; use ModelRuntime (or a custom pi-ai CredentialStore), or readStoredCredential() for one-off reads of auth.json.
• Removed redundant ModelRuntime.getAll(), find(), getSnapshot(), and getAuthOptions() projections. Use the pi-ai Models methods getModels(), getModel(), getProviders(), and checkAuth() directly.
• Replaced SDK request-auth assembly through ModelRegistry.getApiKeyAndHeaders() with ModelRuntime.getAuth(). Passing a provider ID returns provider-scoped auth; passing a model also resolves built-in, models.json, and extension model headers.

... (truncated)

Commits

• 8dc7883 Release v0.80.10
• c29eda6 docs(coding-agent): audit unreleased changelog
• aba3245 fix(ai): correct Kimi K3 Moonshot pricing
• c1b7856 fix(ai): prevent removed xAI models regenerating, closes #6736
• f7e0603 Add [Unreleased] section for next cycle
• 2d16f92 Release v0.80.9
• aa508b7 docs: audit unreleased changelogs
• b97ed20 fix(coding-agent): explain clone failure for unsaved sessions
• a01baaa feat(xai): prefilled OAuth device link, SuperGrok login label, trimmed model ...
• 3524cd4 Merge remote-tracking branch 'origin/main' into add-kimi-deferred-tools
• Additional commits viewable in compare view

Updates @earendil-works/pi-tui from 0.79.9 to 0.80.10

Release notes

Sourced from @​earendil-works/pi-tui's releases.

v0.80.10

New Features

• Kimi Coding thinking compatibility — Kimi Coding models now use adaptive thinking correctly; K3 exposes its supported max level and supports replaying empty-signature thinking blocks. See Kimi For Coding setup and Model Options.

Fixed

• Fixed inherited Kimi Coding requests to use Anthropic adaptive thinking effort without token budgets, and enabled empty thinking signatures for K3 and kimi-for-coding.
• Fixed inherited Kimi K3 pricing metadata for Moonshot AI and Moonshot AI China.
• Fixed inherited Kimi Coding K3 thinking-level metadata to expose only the supported max level (#6737).
• Fixed inherited catalog generation restoring xAI models removed in 0.80.9 (#6736).

v0.80.9

New Features

• Kimi K3 and deferred tool loading — Use Kimi K3 across built-in providers, including progressive extension tool activation through Kimi’s native protocol. See Dynamic Tool Loading, OpenAI Compatibility, and the kimi-deferred-tools.ts example.

Added

• Added inherited Kimi K3 support for Kimi Coding, Moonshot AI, Moonshot AI China, OpenRouter, and Vercel AI Gateway.
• Added Kimi deferred tool loading for extension-driven tool activation. See Dynamic Tool Loading, OpenAI Compatibility, and the kimi-deferred-tools.ts example.

Changed

• Changed xAI login to use a prefilled device-authorization link labeled “Sign in with SuperGrok or X Premium,” and changed the default xAI model to Grok 4.5 (#6734 by @​Jaaneek).

Fixed

• Fixed inherited Kimi K3 output limits for Vercel AI Gateway and OpenRouter models.
• Fixed cloning or forking a session before its first assistant response to explain that the session must be saved first.

Removed

• Removed Grok 3, Grok 3 Fast, Grok 4.20 variants, and Grok Code Fast 1 from the built-in xAI model catalog (#6734 by @​Jaaneek).

v0.80.8

New Features

• Unified model runtime and provider authentication — ModelRuntime centralizes model configuration, provider-owned /login, and dynamic provider catalogs. See Providers.
• Live model catalog refresh — /model refreshes configured providers in the background, and pi update --models forces an immediate refresh. See Install and Manage.
• xAI device-code OAuth and Grok 4.5 Responses support — Sign in to xAI with a device code and use Grok 4.5 with low, medium, or high thinking. See xAI.

Breaking Changes

• Replaced the SDK's CreateAgentSessionOptions.authStorage and modelRegistry options with the async modelRuntime option. AuthStorage and its storage backends are no longer exported; use ModelRuntime (or a custom pi-ai CredentialStore), or readStoredCredential() for one-off reads of auth.json.
Description has been truncated

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.