npm / @earendil-works/pi-ai
@earendil-works/pi-ai
What changed in @earendil-works/pi-ai 0.78 to 1, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-28.
13 breaking4 security18 new APIs and options7 behavior and defaults25 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli init@earendil-works/pi-ai 163 changes
Breaking changes 13
Replaces TranscriptTools.anchorsAdditions with a count of leading system messages folded into requestTools.
Exports formatUserAgent() for formatting the User-Agent.
The utility getPiUserAgent() is removed; use formatUserAgent().
Removed from the openai-codex provider listing because the Codex backend rejects it for ChatGPT accounts.
Removed from the openai-codex provider listing because the Codex backend rejects it for ChatGPT accounts.
Now takes a TranscriptToolSupport value of "none", "additions", or "changes" instead of a boolean.
Replaces the provider request option telemetryContext with telemetry?: TelemetrySpan, without a compatibility alias; pass a parent span rather than an adapter.
The default User-Agent changes to include the version and runtime, with a different format.
Malformed final JSON tool-call arguments now carry argumentsError and fail validation with the raw arguments text, so the model sees what it sent.
Removed this API, which was only used by the removed experimental agent harness.
Removed this API, which was only used by the removed experimental agent harness.
Overrides of the kimi-coding base URL must now include /v1.
Removed this API, which was only used by the removed experimental agent harness.
New APIs and options 18
Adds the AI_TELEMETRY_SCHEMA export for opt-in request and poll tracing.
Adds the @cf/cloudflare/clef-omni and typesafe/jev-1.14.0 classifier models.
Exports getIdentityHeaders().
Exports getOpenCodeSessionHeaders().
Adds an identity request option and createModels({ identity }) default to choose the User-Agent and provider attribution headers.
Exports mergeClientIdentity().
Adds MiniMax-M3.1-Flash to minimax and minimax-cn, with thinking levels low through max sent as output_config.effort; thinking cannot be turned off.
Exports PI_AI_VERSION.
Exports PI_ATTRIBUTION.
Adds opt-in poll tracing around Models requests with content-free attributes and metrics.
Adds opt-in request tracing around Models requests with content-free attributes and metrics.
Adds classifier model compatibility configuration, including imageInput and sendImageOptInHeader; models without it detect the form from provider, baseUrl, and model ID.
Opts in to experimental Jev image input on typesafe.
Applies an identity to a Models or MutableModels instance received from a host.
Grok 4.3 and Grok 4.5 on xai now offer the xhigh thinking level, matching xAI's supported reasoning efforts.
Controls cache-preserving thinking level changes for GPT-6 models on the openai provider; with an API key, the level is sent as configuration_update input items instead of changing reasoning.effort.
Adds a function that narrows an OpenRouter catalog to chat models a key may use, using that key's context size, max output, and prices.
Adds the registered provider's base URL, including configuration overrides applied by wrappers, so dynamic catalogs can follow a base URL set in models.json.
Behavior and default changes 7
These errors are not retried and tell the user to ask their workspace admin to increase the limit.
Adds image input for System One classifiers on Jev, Clef, cloudflare-workers-ai, and eligible OpenRouter decision models, using service-specific wire forms.
New MiniMax models from models.dev now appear without a manual allowlist entry; only older listed models stay hidden.
Failed model request spans report provider_error status with up to 500 error-message characters.
Bedrock, OpenRouter image generation, pi-messages, and classifier requests now send pi's User-Agent.
Uses OpenAI Chat Completions at https://api.kimi.com/coding/v1; K3, K3-256K, and Kimi For Coding accept tools added mid-conversation without invalidating the prompt cache.
Drops thinking blocks from earlier assistant messages produced by a different model instead of sending them as plain text.
Fixes and other changes 25
Retries now trigger for gateway upstream failures such as upstream_error, upstream_stream_read_error, and Upstream HTTP/2 stream failed.
Retries now trigger when Google Vertex OAuth token refresh fails with a transient network error.
Retries now trigger for stream disconnected before completion errors relayed by proxies wrapping the Codex CLI.
Digits in request IDs and other numbers are no longer incorrectly treated as retryable HTTP status codes.
Corrects Clef Flash pricing and context window, and Jev input-token pricing.
Any HTTP 413 now counts as context overflow, allowing callers to compact and retry instead of failing on oversized Copilot requests.
Tool loads no longer rewrite the top-level tool list and lose the prompt cache after a removal; tool declarations and anchoring behavior are corrected.
OpenAI Completions, OpenAI Responses, and Google providers now use the empty-output placeholder instead of sending whitespace-only tool content.
Models requests with a sessionId to custom providers pointing at opencode.ai now send the x-opencode-session header.
Avoids 400 errors when an error tool result contains images by sending the images after the tool results of the turn.
Retries when gateway errors say Unable to forward upstream stream.
Retries when errors say The service is temporarily unavailable; this also prevents compaction from failing on the first attempt.
For Claude Haiku 5.5 and Claude Opus 5, off sends thinking: {type: "disabled"} without effort settings.
Uses the 500K context window Codex now provides instead of a 272K context window.
Avoids showing thinking after the answer when a proxy sends reasoning and content in the same stream chunk.
Gemini models use the opencode.ai/inference endpoint, and the provider now supports Google Generative AI.
Uses the Anthropic Messages API to avoid the “Model does not support this protocol” failure.
Moved to the opencode.ai/inference endpoint.
Gemini 4 and later models send thinkingLevel, fixing Vertex requests and ensuring the thinking level is not ignored on the Gemini API.
No longer drops fields when a string contains an invalid \u escape such as \usepackage.
Sends only the documented thinking on/off toggle and exposes only the off and high levels, fixing 400 errors at minimal.
Streams are no longer aborted mid-generation after the request timeout; the timeout now applies only while waiting for response headers.
OpenRouter's negative placeholder prices are now treated as 0, preventing router models such as openrouter/auto from showing a cost of -$1,000,000 per 1M tokens.
When Anthropic rejects a strict tool set for grammar size, tool count, or union limits, requests retry once with preferred tools non-strict while keeping required tools strict.
“The upstream provider returned an error” is now retried as a transient provider error.
@earendil-works/pi-ai 0.791 changes
Security 1
Pi Agent: Pi loads project-local extensions without approval
@earendil-works/pi-ai 0.783 changes
Security 3
Pi Agent: Potential XSS in HTML session exports via Markdown URL sanitization bypass
Pi Agent: Predictable temporary extension install paths allow local privilege escalation on shared Linux hosts
Pi Agent: Race condition in Pi auth.json writes could expose stored credentials