chore(deps): update dependency @earendil-works/pi-coding-agent to v0.85.1

[renovate-fullsend]

This PR contains the following updates:

Package	Change	Age	Confidence
@earendil-works/pi-coding-agent (source)	0.85.0 → 0.85.1

---

Release Notes

earendil-works/pi (@​earendil-works/pi-coding-agent)

v0.85.1

Compare Source

New Features

• GPT-6 Astra — Available through OpenAI API keys and OpenAI Codex subscriptions. See API Keys and OpenAI Codex.

Added

• Added GPT-6 Astra for OpenAI API keys and OpenAI Codex subscriptions.
• Added five-times-faster mouse wheel scrolling while holding Alt in fullscreen mode (#​9166 by @​xl0).

Fixed

• Fixed configurable save keybindings in the model and thinking selectors (#​9149 by @​rwachtler).
• Fixed SDK import failures caused by unintentionally publishing internal experimental code and dependencies in 0.85.0. The experimental client and experimental/plugin subpaths and server/client commands are now source-only through pi-test.sh; the supported local SDK and stdio RPC API are unchanged (#​9132).
• Fixed mouse hover changing selection and recentering autocomplete and settings lists, causing clicks to target a different item.
• Fixed long prompt-cache requests for GPT-5.6+ Responses models to use prompt_cache_options.ttl: "30m" instead of prompt_cache_retention: "24h".

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:21 PM UTC · Completed 3:35 PM UTC

Commit: d28c9a4 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.47

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[fullsend-ai-review]

Risk Assessment: moderate (2/5)

Details

Bot-authored 2-line single-file dependency bump in a protected path with historically high churn (36 commits/30d) and multi-author contention (7 distinct authors/90d); Tier 1 signals are unchanged from prior assessment and the weighted composite (0.62x1.25 + 0.38x3.0 = 1.9) rounds to 2, preserving the prior moderate score.

Previous run

Risk Assessment: moderate (2/5)

Details

Bot-authored 2-line single-file dependency bump in a protected but historically high-churn, multi-author path; Tier 1 signals are unchanged from prior assessment and composite weighted score rounds to 2, preserving the prior score of moderate.

Previous run (2)

Risk Assessment: moderate (2/5)

Details

Bot-authored single-file 2-line dependency bump in a protected but historically high-churn, multi-author path; signals are unchanged from prior assessment, prior score of 2 preserved.

Previous run (3)

Risk Assessment: moderate (2/5)

Details

Bot-authored single-file 2-line dependency bump in a protected but historically high-churn, multi-author path; the tiny change footprint and bot authorship keep the composite risk moderate despite the files active churn and fix-commit history — signals unchanged from prior assessment, prior score of 2 preserved.

Previous run (4)

Risk Assessment: moderate (2/5)

Details

Bot-authored single-file 2-line dependency bump in a protected but historically high-churn path; tiny change footprint, zero regression and revert history, and bot authorship keep the composite risk moderate despite the file's active history — signals unchanged from prior assessment, prior score of 2 preserved.

Previous run (5)

Risk Assessment: moderate (2/5)

Details

A bot-authored single-file 2-line dependency bump in a protected but historically high-churn path; tiny change footprint and bot authorship keep composite risk moderate despite the file's active history.

[fullsend-ai-review]

Review

Findings

High

• [protected-path] images/sandbox/Containerfile — This PR modifies images/sandbox/Containerfile, which is under the protected path prefix images/. The PR has no linked issue providing authorization for modifying governance or infrastructure files. Human approval is required for all protected-path changes.

Medium

• [verification gap] images/sandbox/Containerfile:101 — The comment block at lines 98–100 explicitly states "the pi stream parser fixtures must be re-verified when this pin moves." The pin has moved from 0.85.0 to 0.85.1 but no verification scripts were run and no fixture files or verification markers were updated. Stale verification markers referencing the prior pin "0.85.0" remain in at least 8 locations across the codebase: internal/runtime/pi_progress.go:260 ("re-checked at the pinned 0.85.0"), internal/runtime/pi_run.go:597 ("re-checked on 0.85.0"), internal/runtime/pi_bootstrap.go:587 ("@earendil-works/pi-ai 0.85.0, dist/providers/data/google-vertex.json"), internal/runtime/pi.go:111 ("jiti is still 2.7.0 at the pinned 0.85.0"), internal/runtime/stray_processes.go:28 ("killProcessTree call sites unchanged at 0.85.0"), internal/pluginformat/pi.go:119 ("module is byte-identical at 0.85.0"), and docs/contributing/runtime-implementation.md:669 ("At the pinned 0.85.0 the loader modules cited below"). Additionally, the Containerfile comment at line 84 ("0.85.0 adds @earendil-works/chord → esbuild") justifies --ignore-scripts based on the 0.85.0 dependency tree; if 0.85.1 changed the experimental dependency structure, --ignore-scripts could silently break the install.
  Remediation: Run internal/runtime/testdata/pi/check-vertex-catalog.sh, internal/runtime/testdata/pi/regen.sh, and internal/runtime/testdata/pi/jiti-cache-check.sh against 0.85.1. If fixtures and catalogs are unchanged, update all "0.85.0" verification comments to "0.85.1". Check whether the --ignore-scripts justification at Containerfile line 84 is still accurate for the 0.85.1 dependency tree.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run

Review

Findings

High

• [protected-path] images/sandbox/Containerfile — This PR modifies images/sandbox/Containerfile, which is under the protected path prefix images/. The PR has no linked issue providing authorization for modifying governance or infrastructure files. Human approval is required for all protected-path changes.

Medium

• [verification gap] images/sandbox/Containerfile:101 — The comment block at lines 98–100 explicitly states "the pi stream parser fixtures must be re-verified when this pin moves." The pin has moved from 0.85.0 to 0.85.1 but no verification markers or fixture files were updated. Stale verification markers that still reference 0.85.0 exist in: pi_progress.go:260 ("re-checked at the pinned 0.85.0"), pi_run.go:597 ("re-checked on 0.85.0"), pi_bootstrap.go:587 ("@earendil-works/pi-ai 0.85.0, dist/providers/data/google-vertex.json"), pi.go:111 ("jiti is still 2.7.0 at the pinned 0.85.0"), stray_processes.go:28 ("killProcessTree call sites unchanged at 0.85.0"), pluginformat/pi.go:119 ("module is byte-identical at 0.85.0"), and docs/contributing/runtime-implementation.md:669 ("At the pinned 0.85.0 the loader modules cited below"). The Containerfile comment at line 84 ("0.85.0 adds @earendil-works/chord → esbuild") may also be factually stale if 0.85.1 changed the experimental dependency tree.
  Remediation: Run internal/runtime/testdata/pi/check-vertex-catalog.sh, internal/runtime/testdata/pi/regen.sh, and internal/runtime/testdata/pi/jiti-cache-check.sh against 0.85.1. If fixtures and catalogs are unchanged, update all "0.85.0" verification comments to "0.85.1". Check whether the --ignore-scripts justification at Containerfile line 84 is still accurate for the 0.85.1 dependency tree.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run (2)

Review

Findings

High

• [protected-path] images/sandbox/Containerfile — This PR modifies images/sandbox/Containerfile, which is under the protected path prefix images/. The PR has no linked issue providing authorization for modifying governance or infrastructure files. Human approval is required for all protected-path changes.

Medium

• [verification gap] images/sandbox/Containerfile:101 — The comment block at lines 98–100 explicitly states "the pi stream parser fixtures must be re-verified when this pin moves." Multiple Go source files contain version-specific verification markers that still reference 0.85.0: pi_progress.go:260 ("re-checked at the pinned 0.85.0"), pi_run.go:597 ("re-checked on 0.85.0"), pi_bootstrap.go:587 ("pi-ai 0.85.0, dist/providers/data/google-vertex.json"), pi.go:111 ("jiti is still 2.7.0 at the pinned 0.85.0"), and stray_processes.go:28 ("killProcessTree call sites unchanged at 0.85.0"). The Containerfile comment at line 84 ("0.85.0 adds @earendil-works/chord → esbuild") and docs/contributing/runtime-implementation.md:669 ("At the pinned 0.85.0 the loader modules cited below") are also stale. The PR bumps PI_VERSION from 0.85.0 to 0.85.1 without updating any verification markers or fixture files.
  Remediation: Run internal/runtime/testdata/pi/check-vertex-catalog.sh, internal/runtime/testdata/pi/regen.sh, and internal/runtime/testdata/pi/jiti-cache-check.sh against the new 0.85.1 pin. If fixtures and catalogs are unchanged, update all "0.85.0" verification comments (including line 84 of the Containerfile and line 669 of docs/contributing/runtime-implementation.md) to "0.85.1".

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run (3)

Review

Findings

High

• [protected-path] images/sandbox/Containerfile — This PR modifies images/sandbox/Containerfile, which is under the protected path prefix images/. The PR has no linked issue providing authorization for modifying governance or infrastructure files. Human approval is required for all protected-path changes.

Medium

• [verification gap] images/sandbox/Containerfile:101 — The comment block at lines 98–100 explicitly states "the pi stream parser fixtures must be re-verified when this pin moves." Multiple Go source files echo this requirement: pi_progress.go:260 ("re-checked at the pinned 0.85.0"), pi_run.go:30–31 ("re-check it against the pinned pi's anthropic.json on a bump"), and pi_run.go:602 ("Re-verify it on a PI_VERSION bump"). The PR bumps PI_VERSION from 0.85.0 to 0.85.1 but does not update any verification markers or fixture files.
  Remediation: Run internal/runtime/testdata/pi/regen.sh, internal/runtime/testdata/pi/check-vertex-catalog.sh, and internal/runtime/testdata/pi/jiti-cache-check.sh against the new pin. If fixtures are unchanged, update the "re-checked at" comments from "0.85.0" to "0.85.1".

Low

• [stale comment] images/sandbox/Containerfile:84 — Lines 84–86 describe the 0.85.0 dependency tree structure (@earendil-works/chord → esbuild reachable from dist/experimental/). With the pin now at 0.85.1, this comment describes the previous version's dependency tree, not the current one. The --ignore-scripts flag remains correct regardless.

• [stale-version-reference] docs/contributing/runtime-implementation.md:669 — Contains the literal version string "0.85.0" in prose ("At the pinned 0.85.0 the loader modules cited below..."). The Containerfile now pins PI_VERSION=0.85.1, making this reference stale.
  Remediation: Update the version string from 0.85.0 to 0.85.1 in that sentence.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run (4)

Review

Findings

High

• [protected-path] images/sandbox/Containerfile — This PR modifies images/sandbox/Containerfile, which is under the protected path prefixes images/ and Containerfile. The PR has no linked issue providing authorization for modifying governance or infrastructure files. Human approval is required for all protected-path changes.

Medium

• [verification gap] images/sandbox/Containerfile:101 — The comment block at lines 98–100 explicitly states "the pi stream parser fixtures must be re-verified when this pin moves." Multiple Go source files echo this requirement: pi_progress.go:260 ("re-checked at the pinned 0.85.0"), pi_run.go:30–31 ("re-check it against the pinned pi's anthropic.json on a bump"), and pi_run.go:602 ("Re-verify it on a PI_VERSION bump"). The PR bumps PI_VERSION from 0.85.0 to 0.85.1 but does not update any verification markers or fixture files. While 0.85.1 is a patch release whose release notes do not mention wire format changes, the project's own policy requires this check on every pin move.
  Remediation: Run internal/runtime/testdata/pi/regen.sh, internal/runtime/testdata/pi/check-vertex-catalog.sh, and internal/runtime/testdata/pi/jiti-cache-check.sh against the new pin. If fixtures are unchanged, update the "re-checked at" comments from "0.85.0" to "0.85.1".

Low

• [stale comment] images/sandbox/Containerfile:84 — Lines 84–86 describe the 0.85.0 dependency tree structure (@earendil-works/chord → esbuild reachable from dist/experimental/). The 0.85.1 release notes state "Fixed SDK import failures caused by unintentionally publishing internal experimental code and dependencies in 0.85.0," suggesting this dependency tree may have changed. The --ignore-scripts flag remains correct regardless.

• [stale-version-reference] docs/contributing/runtime-implementation.md:669 — Contains the literal version string "0.85.0" in prose ("At the pinned 0.85.0 the loader modules cited below..."). The Containerfile now pins PI_VERSION=0.85.1, making this reference stale.
  Remediation: Update the version string from 0.85.0 to 0.85.1 in that sentence.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run (5)

Review

Findings

High

• [protected-path] images/sandbox/Containerfile — This PR modifies a file under the protected path prefix images/. The PR has no linked issue providing authorization for modifying governance or infrastructure files. Human approval is required for all protected-path changes. The Containerfile comment notes that Renovate is configured to track this ARG via a customManagers entry in renovate.json, but infrastructure image changes require explicit human sign-off regardless of automation source.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:28 AM UTC · Completed 3:47 AM UTC

Commit: 6b0aa8a · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $4.47

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:22 PM UTC · Completed 3:37 PM UTC

Commit: 2817836 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $3.03

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:31 AM UTC · Completed 3:47 AM UTC

Commit: 5265557 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $3.17

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:25 PM UTC · Completed 3:39 PM UTC

Commit: e1fd090 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.94

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:29 AM UTC · Completed 3:41 AM UTC

Commit: 7a65080 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.37

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-review]

[medium] verification gap

The comment block at lines 98-100 explicitly states 'the pi stream parser fixtures must be re-verified when this pin moves.' The pin has moved from 0.85.0 to 0.85.1 but no verification scripts were run and no fixture files or verification markers were updated. Stale verification markers referencing the prior pin '0.85.0' remain in at least 8 locations across the codebase: internal/runtime/pi_progress.go:260, internal/runtime/pi_run.go:597, internal/runtime/pi_bootstrap.go:587, internal/runtime/pi.go:111, internal/runtime/stray_processes.go:28, internal/pluginformat/pi.go:119, and docs/contributing/runtime-implementation.md:669. Additionally, the Containerfile comment at line 84 justifies --ignore-scripts based on the 0.85.0 dependency tree; if 0.85.1 changed the experimental dependency structure, --ignore-scripts could silently break the install.

Suggested fix: Run internal/runtime/testdata/pi/check-vertex-catalog.sh, internal/runtime/testdata/pi/regen.sh, and internal/runtime/testdata/pi/jiti-cache-check.sh against 0.85.1. If fixtures and catalogs are unchanged, update all '0.85.0' verification comments to '0.85.1'. Check whether the --ignore-scripts justification at Containerfile line 84 is still accurate for the 0.85.1 dependency tree.