chore(deps): bump the production-dependencies group across 1 directory with 7 updates

[dependabot]

Bumps the production-dependencies group with 7 updates in the / directory:

Package	From	To
@earendil-works/pi-coding-agent	1.1.0	1.2.0
@radix-ui/react-context-menu	2.3.7	2.4.1
@radix-ui/react-dialog	1.1.23	1.3.1
ignore	7.0.9	7.0.12
monaco-editor	0.56.0	0.57.0
react	19.3.0	19.3.1
react-dom	19.3.0	19.3.1

Updates @earendil-works/pi-coding-agent from 1.1.0 to 1.2.0

Release notes

Sourced from @​earendil-works/pi-coding-agent's releases.

v1.2.0

New Features

• Per-key OpenRouter model lists: with an OpenRouter key, Pi lists only the models that key may use, with the key's context size, max output, and prices, including regional endpoints set in models.json. See OpenRouter.
• Published configuration schemas: add $schema to settings.json, models.json, keybindings, and themes for editor validation and completion. See Settings, Models, Keybindings, and Themes.
• Clipboard copies over remote sessions: PI_CLIPBOARD_OSC52=1 sends copied text to a remote client's clipboard when Pi cannot detect the remote session, such as a multiplexer attached from another machine. See Pi Process Configuration.
• Codemode improvements: tool declarations show input constraints such as integer, minimum/maximum, and default, and codemode rows show elapsed and total time. See Codemode.
• before_agent_start for extension-triggered runs: runs started by pi.sendMessage(..., { triggerTurn: true }) go through the same setup as prompts. See Events and concurrency.

Breaking Changes

• Published generated configuration schemas for models, settings, keybindings, and themes at https://pi.dev/schemas/*.schema.json. The theme schema moved to https://pi.dev/schemas/theme.schema.json; themes loaded during startup now receive the same schema validation as later reloads. Update theme $schema references, define reusable colors under vars, and remove unsupported metadata (#9880, #10751 by @​christianklotz)
• Changed before_agent_start to also fire for runs started by pi.sendMessage(..., { triggerTurn: true }) while idle. BeforeAgentStartEvent is now a union on messageType: "user" events carry prompt and images, and "custom" events carry the starting message and no prompt. Messages returned by handlers are added to both kinds of run, and pending deliverAs: "nextTurn" messages are delivered with the custom-message run. Handlers that should act only on user prompts must check event.messageType === "user" (#10267, #5581, #10739 by @​davidbrai)
• Changed the session to count as busy while a run starts, including during before_agent_start handlers: ctx.isIdle() is false, pi.sendMessage() queues into the starting run instead of starting a second run that failed with "Agent is already processing", pi.sendUserMessage() requires deliverAs, and an abort requested meanwhile aborts the run once it starts (#10739 by @​davidbrai)
• Changed pi mcp list --json to report resources: true for servers that offer resources instead of resources and resourceTemplates counts; Pi no longer lists resources when connecting (#10526)

Added

• Added reachesTools to tool definitions, so tools that reach other tools (such as codemode and tool_search) declare which tools a call may reach; the MCP extension uses it to wait for the servers a call needs and to decide whether a replacement codemode or tool_search tool can reach MCP tools
• Added aliases to tool namespaces; codemode's describeNamespace() and the namespace option of searchTools() match them, and MCP namespaces use the server name
• Added per-key OpenRouter model lists: with an OpenRouter key, Pi lists only the chat models that key may use, with the key's context size, max output, and prices, including guardrails and regional endpoints set as the base URL in models.json. The list is saved and used offline (#10353, #10672 by @​davidbrai)
• Added PI_CLIPBOARD_OSC52=1 to send copied text to the terminal with OSC 52 after the local clipboard write, so copies reach a remote client's clipboard when Pi cannot detect the remote session, such as multiplexer attaches from another machine or remote IDE daemons (#10826, #10835, #10114)
• Added elapsed time while a codemode script runs and its total time once finished to the codemode tool row, like bash rows (#10708)

Changed

• Changed the showHardwareCursor setting to use only the terminal cursor instead of also drawing Pi's reverse-video cursor
• Changed codemode tool declarations to show input constraints such as integer, minimum/maximum, length, pattern, and default as @ tags on property comments, so scripts see them without the tool repeating them in descriptions (#10707)
• Changed codemode declarations of MCP tools to spell out the result type (content, structuredContent, isError) instead of referring to CallToolResult<T>, which describeTool(), searchTools(), and ALL_TOOLS showed without defining it; the codemode description no longer includes the shared MCP types
• Changed serializeConversation() (compaction, branch summaries, bug reports) to omit thinking blocks; replayed thinking is often not in the live context, so including it could make a summarization request larger than the context it summarizes and fail

Fixed

• Fixed codemode ignoring a // @options: line that is not the first line of the script, which ran the script without the requested timeout_ms; the call now fails with an error before the script runs (#10631)
• Fixed Mistral streams being aborted mid-generation (e.g. during long thinking) after the request timeout; the timeout now applies only to waiting for response headers (#10609)
• Fixed a symlinked AGENTS.md in a git worktree nested inside its main repo causing no project context file to load (#10681)
• Fixed the code mode tool description claiming every failed tool call rejects; a tool that declares an output schema resolves with its value on failure too (e.g. bash with a nonzero exit)
• Fixed runs started by pi.sendMessage(..., { triggerTurn: true }) removing system prompt sections added in before_agent_start after their first tool call, which changed the prompt mid-run and broke the provider prompt cache twice per run (#10267, #10739 by @​davidbrai)
• Fixed codemode blocking the process for seconds to minutes after scripts with many text() calls; joining the output items was quadratic (#10678)
• Fixed print mode (-p) exiting 0 without a warning when the final response was cut off at the model's output token limit; it now prints the partial text, writes a warning to stderr, and exits 1 (#10799)
• Fixed pi mcp login --help and the CLI docs describing --timeout as only the wait for the browser; it limits the whole sign-in (#10636)
• Fixed ~ not being expanded in !pattern, +path, and -path entries of the extensions, skills, prompts, and themes settings, so entries like !~/skills/pdf matched nothing (#10765)
• Fixed MCP servers with resources registering no tools until every resource was listed; Pi no longer lists resources when connecting, so /mcp and pi mcp list show that a server offers resources instead of counting them (#10526)
• Fixed MCP tool calls failing when the server returns structured content that is not an object (an array, null, or a primitive, as MCP 2026-07-28 allows); codemode declarations of MCP tools without an output schema now type structuredContent as unknown instead of an object (#10416)
• Fixed reading or writing auth.json on Windows failing with EPERM when the previous lock folder was still being deleted; Pi now retries briefly before reporting the error (#10801)
• Fixed OpenRouter router models such as openrouter/auto showing a cost of -$1,000,000 per 1M tokens; OpenRouter's negative placeholder prices are now 0 (#10672 by @​davidbrai)
• Fixed Anthropic requests failing when the provider rejects the strict tool set for grammar size, tool count, or union limits; Pi now retries once with preferred tools non-strict (#10409)
• Fixed "The upstream provider returned an error" not being retried as a transient provider error (#10842)
• Fixed focused fullscreen overlays blocking mouse-wheel scrolling of the transcript (#10769)
• Fixed fragmented terminal color replies leaking hex values into the prompt and opening the external editor (related reports: #10256, #10657)

... (truncated)

Changelog

Sourced from @​earendil-works/pi-coding-agent's changelog.

[1.2.0] - 2026-10-12

New Features

• Per-key OpenRouter model lists: with an OpenRouter key, Pi lists only the models that key may use, with the key's context size, max output, and prices, including regional endpoints set in models.json. See OpenRouter.
• Published configuration schemas: add $schema to settings.json, models.json, keybindings, and themes for editor validation and completion. See Settings, Models, Keybindings, and Themes.
• Clipboard copies over remote sessions: PI_CLIPBOARD_OSC52=1 sends copied text to a remote client's clipboard when Pi cannot detect the remote session, such as a multiplexer attached from another machine. See Pi Process Configuration.
• Codemode improvements: tool declarations show input constraints such as integer, minimum/maximum, and default, and codemode rows show elapsed and total time. See Codemode.
• before_agent_start for extension-triggered runs: runs started by pi.sendMessage(..., { triggerTurn: true }) go through the same setup as prompts. See Events and concurrency.

Breaking Changes

• Published generated configuration schemas for models, settings, keybindings, and themes at https://pi.dev/schemas/*.schema.json. The theme schema moved to https://pi.dev/schemas/theme.schema.json; themes loaded during startup now receive the same schema validation as later reloads. Update theme $schema references, define reusable colors under vars, and remove unsupported metadata (#9880, #10751 by @​christianklotz)
• Changed before_agent_start to also fire for runs started by pi.sendMessage(..., { triggerTurn: true }) while idle. BeforeAgentStartEvent is now a union on messageType: "user" events carry prompt and images, and "custom" events carry the starting message and no prompt. Messages returned by handlers are added to both kinds of run, and pending deliverAs: "nextTurn" messages are delivered with the custom-message run. Handlers that should act only on user prompts must check event.messageType === "user" (#10267, #5581, #10739 by @​davidbrai)
• Changed the session to count as busy while a run starts, including during before_agent_start handlers: ctx.isIdle() is false, pi.sendMessage() queues into the starting run instead of starting a second run that failed with "Agent is already processing", pi.sendUserMessage() requires deliverAs, and an abort requested meanwhile aborts the run once it starts (#10739 by @​davidbrai)
• Changed pi mcp list --json to report resources: true for servers that offer resources instead of resources and resourceTemplates counts; Pi no longer lists resources when connecting (#10526)

Added

• Added reachesTools to tool definitions, so tools that reach other tools (such as codemode and tool_search) declare which tools a call may reach; the MCP extension uses it to wait for the servers a call needs and to decide whether a replacement codemode or tool_search tool can reach MCP tools
• Added aliases to tool namespaces; codemode's describeNamespace() and the namespace option of searchTools() match them, and MCP namespaces use the server name
• Added per-key OpenRouter model lists: with an OpenRouter key, Pi lists only the chat models that key may use, with the key's context size, max output, and prices, including guardrails and regional endpoints set as the base URL in models.json. The list is saved and used offline (#10353, #10672 by @​davidbrai)
• Added PI_CLIPBOARD_OSC52=1 to send copied text to the terminal with OSC 52 after the local clipboard write, so copies reach a remote client's clipboard when Pi cannot detect the remote session, such as multiplexer attaches from another machine or remote IDE daemons (#10826, #10835, #10114)
• Added elapsed time while a codemode script runs and its total time once finished to the codemode tool row, like bash rows (#10708)

Changed

• Changed the showHardwareCursor setting to use only the terminal cursor instead of also drawing Pi's reverse-video cursor
• Changed codemode tool declarations to show input constraints such as integer, minimum/maximum, length, pattern, and default as @ tags on property comments, so scripts see them without the tool repeating them in descriptions (#10707)
• Changed codemode declarations of MCP tools to spell out the result type (content, structuredContent, isError) instead of referring to CallToolResult<T>, which describeTool(), searchTools(), and ALL_TOOLS showed without defining it; the codemode description no longer includes the shared MCP types
• Changed serializeConversation() (compaction, branch summaries, bug reports) to omit thinking blocks; replayed thinking is often not in the live context, so including it could make a summarization request larger than the context it summarizes and fail

Fixed

• Fixed codemode ignoring a // @options: line that is not the first line of the script, which ran the script without the requested timeout_ms; the call now fails with an error before the script runs (#10631)
• Fixed Mistral streams being aborted mid-generation (e.g. during long thinking) after the request timeout; the timeout now applies only to waiting for response headers (#10609)
• Fixed a symlinked AGENTS.md in a git worktree nested inside its main repo causing no project context file to load (#10681)
• Fixed the code mode tool description claiming every failed tool call rejects; a tool that declares an output schema resolves with its value on failure too (e.g. bash with a nonzero exit)
• Fixed runs started by pi.sendMessage(..., { triggerTurn: true }) removing system prompt sections added in before_agent_start after their first tool call, which changed the prompt mid-run and broke the provider prompt cache twice per run (#10267, #10739 by @​davidbrai)
• Fixed codemode blocking the process for seconds to minutes after scripts with many text() calls; joining the output items was quadratic (#10678)
• Fixed print mode (-p) exiting 0 without a warning when the final response was cut off at the model's output token limit; it now prints the partial text, writes a warning to stderr, and exits 1 (#10799)
• Fixed pi mcp login --help and the CLI docs describing --timeout as only the wait for the browser; it limits the whole sign-in (#10636)
• Fixed ~ not being expanded in !pattern, +path, and -path entries of the extensions, skills, prompts, and themes settings, so entries like !~/skills/pdf matched nothing (#10765)
• Fixed MCP servers with resources registering no tools until every resource was listed; Pi no longer lists resources when connecting, so /mcp and pi mcp list show that a server offers resources instead of counting them (#10526)
• Fixed MCP tool calls failing when the server returns structured content that is not an object (an array, null, or a primitive, as MCP 2026-07-28 allows); codemode declarations of MCP tools without an output schema now type structuredContent as unknown instead of an object (#10416)
• Fixed reading or writing auth.json on Windows failing with EPERM when the previous lock folder was still being deleted; Pi now retries briefly before reporting the error (#10801)
• Fixed OpenRouter router models such as openrouter/auto showing a cost of -$1,000,000 per 1M tokens; OpenRouter's negative placeholder prices are now 0 (#10672 by @​davidbrai)
• Fixed Anthropic requests failing when the provider rejects the strict tool set for grammar size, tool count, or union limits; Pi now retries once with preferred tools non-strict (#10409)
• Fixed "The upstream provider returned an error" not being retried as a transient provider error (#10842)
• Fixed focused fullscreen overlays blocking mouse-wheel scrolling of the transcript (#10769)

... (truncated)

Commits

• 06a4669 Release v1.2.0
• 0d79b74 docs: audit changelogs and add new features for next release
• 3e477ea feat(coding-agent): add PI_CLIPBOARD_OSC52 to force OSC 52 copies
• b6d505c fix(codemode): reject // @​options: lines that are not the first line
• e6fb258 fix(coding-agent): retry transient Windows EPERM when acquiring auth lock
• 441f576 fix(coding-agent): warn and exit non-zero in print mode on truncated response
• 014873d feat(coding-agent): show elapsed and total time on codemode rows
• 67996ab fix(mcp,coding-agent): accept any JSON value as tool structuredContent
• f4cca2d fix(coding-agent): stop listing MCP resources when connecting
• 6a51a39 fix(coding-agent): expand ~ in resource setting patterns
• Additional commits viewable in compare view

Updates @radix-ui/react-context-menu from 2.3.7 to 2.4.1

Changelog

Sourced from @​radix-ui/react-context-menu's changelog.

2.4.1

• Fixed a type regression where callback props that were previously declared as methods rejected handlers whose parameter is narrower than the prop's.
• Updated dependencies: @radix-ui/react-menu@2.2.1

2.4.0

• Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.
• Allowed side, sideOffset, and align props to be overridden on ContextMenu.Content.
• Updated dependencies: @radix-ui/primitive@1.2.0, @radix-ui/react-context@1.3.0, @radix-ui/react-menu@2.2.0, @radix-ui/react-primitive@2.2.0, @radix-ui/react-use-controllable-state@1.3.0

2.3.8

• Updated dependencies: @radix-ui/react-menu@2.1.25, @radix-ui/react-primitive@2.1.11

Commits

• See full diff in compare view

Updates @radix-ui/react-dialog from 1.1.23 to 1.3.1

Changelog

Sourced from @​radix-ui/react-dialog's changelog.

1.3.1

• Fixed a type regression where callback props that were previously declared as methods rejected handlers whose parameter is narrower than the prop's.
• Updated dependencies: @radix-ui/react-dismissable-layer@1.2.1, @radix-ui/react-focus-scope@1.3.1

1.3.0

• Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.
• Updated dependencies: @radix-ui/primitive@1.2.0, @radix-ui/react-context@1.3.0, @radix-ui/react-dismissable-layer@1.2.0, @radix-ui/react-focus-guards@1.2.0, @radix-ui/react-focus-scope@1.3.0, @radix-ui/react-portal@1.2.0, @radix-ui/react-primitive@2.2.0, @radix-ui/react-slot@1.5.0, @radix-ui/react-use-controllable-state@1.3.0

1.2.0

• Added support for multiple aria-describedby attributes.
• Fixed nested, portalled layers being unusable inside a modal layer. A non-modal popover rendered inside a modal Dialog previously broke some user interactions because the modal layer's trapped FocusScope reclaimed focus, and its RemoveScroll only allowed scrolling within the modal content.
• Updated dependencies: @radix-ui/react-focus-scope@1.2.0, @radix-ui/react-slot@1.4.0, @radix-ui/react-dismissable-layer@1.1.20, @radix-ui/react-primitive@2.1.11, @radix-ui/react-presence@1.1.11, @radix-ui/react-portal@1.1.18

Commits

• See full diff in compare view

Updates ignore from 7.0.9 to 7.0.12

Commits

• 75533ef bump version 7.0.12, #170, #171
• 07467f6 fix: drop a pattern that normalizes to nothing
• 6d307b0 perf: trim a pattern's end in linear time
• 27a3589 perf: unescape spaces in linear time
• 1d9da18 ci: post the benchmark result on the pull request
• f144513 ci: benchmark merges to master, and against the last release
• aad3ed4 bench: cover checkIgnore('dir/') and hostile patterns
• f7cedfe Merge pull request #171 from youdie006/lone-bang-is-blank
• f4e3df1 perf: trim a pattern only when it ends in a space or newline
• 3b6048c Merge pull request #170 from hao0x1/codex/fix-directory-pattern-trailing-spaces
• Additional commits viewable in compare view

Updates monaco-editor from 0.56.0 to 0.57.0

Release notes

Sourced from monaco-editor's releases.

v0.57.0

Changes:

• #5487: Prepare Monaco Editor 0.57.0 release
• #5415: Bump uuid and webpack-dev-server in /website
• #5476: Bump baseline-browser-mapping from 2.9.19 to 2.11.21 in /website
• #5474: Bump svgo from 2.8.3 to 2.8.4 in /samples/browser-esm-parcel
• #5479: Bump actions/deploy-pages from 5.0.0 to 5.0.1 in the github-actions group
• #5468: Bump browserslist from 4.28.1 to 4.28.8 in /website
• #5475: Bump js-yaml from 4.3.1 to 4.3.2
• #5470: Bump fast-uri from 3.1.2 to 3.1.7 in /webpack-plugin
• #5469: Bump nanoid from 3.3.11 to 3.3.18 in /webpack-plugin
• #5467: Bump fast-uri from 3.1.5 to 3.1.7 in /samples/browser-esm-webpack-typescript-react

• #5466: Bump fast-uri from 3.1.2 to 3.1.7 in /samples
• #5465: Bump fast-uri from 3.1.4 to 3.1.7 in /website
• #5463: Bump postcss-selector-parser from 7.1.0 to 7.1.5 in /website
• #5416: Bump @​babel/core from 7.17.8 to 7.29.7 in /samples/browser-esm-vite-react
• #5438: Bump electron from 39.8.5 to 39.8.10 in /samples
• #5460: Bump the github-actions group with 7 updates
• #5456: Pin GitHub Actions to full-length commit SHAs
• #5450: Bump postcss from 8.5.12 to 8.5.26
• #5449: Bump js-yaml from 4.2.0 to 4.3.1
• #5439: Bump postcss from 8.5.13 to 8.5.26 in /samples
• #5441: Bump postcss from 8.5.15 to 8.5.26 in /samples/browser-esm-vite-react
• #5432: Bump undici from 7.28.0 to 7.29.0
• #5440: Bump brace-expansion in /website
• #5436: Bump fast-uri from 3.1.4 to 3.1.5 in /samples/browser-esm-webpack-typescript-react
• #5437: Bump fast-uri from 3.1.2 to 3.1.5
• #5413: Bump svgo from 2.8.2 to 2.8.3 in /samples/browser-esm-parcel
• #5419: Bump launch-editor from 2.12.0 to 2.14.1 in /website
• #5414: Bump fast-uri from 3.1.2 to 3.1.4 in /samples/browser-esm-webpack-typescript-react
• #5417: Bump minimatch from 3.1.2 to 3.1.5 in /webpack-plugin
• #5420: Bump ws from 8.18.0 to 8.21.1 in /samples
• #5418: Bump http-proxy-middleware from 2.0.9 to 2.0.10 in /samples
• #5412: Bump fast-uri from 3.1.2 to 3.1.4 in /website
• #5411: Bump shell-quote from 1.8.4 to 1.10.0 in /website
• #5409: Bump webpack-dev-server from 5.2.5 to 5.2.6 in /samples
• #5410: Bump postcss from 8.5.14 to 8.5.23 in /website
• #5407: Bump immutable from 5.1.5 to 5.1.9 in /website
• #5401: Bump brace-expansion from 1.1.11 to 1.1.16 in /samples

This list of changes was auto generated.

v0.57.0-rc.2

... (truncated)

Changelog

Sourced from monaco-editor's changelog.

[0.57.0]

New Features and APIs

• Adds editor.wordWrapIndicator to display an indicator at the wrapping column of soft-wrapped lines.
• Adds editor.fullwidthCharacterWidth, with font and twoCells modes for rendering full-width characters.
• Adds languages.score to score a language selector against a URI and language.
• Exports the editor.DiffEditorViewMode type.
• Adds isForAnotherDocument to the inline completion languages.LifetimeSummary type.

Updates

• Updates the editor core to VS Code commit 6a598d4a13031703d483d103c1d934a36ad27971, validated in 0.57.0-rc.2.
• Updates bundled DOMPurify from 3.4.8 to 3.4.15.

Commits

• d618242 Merge pull request #5487 from microsoft/hediet/b/release-0.57.0
• ef061ff Prepare Monaco Editor 0.57.0 release
• 8e9b0f7 Keep editor release version stable across task retries
• 3f31304 Prepare VS Code native headers before installing dependencies
• ebd1312 Use authenticated Foundry Local installer for core builds
• 176408b Align release build Node version with VS Code 1.139
• 97d81ca Bump uuid and webpack-dev-server in /website (#5415)
• f7c7f4c Bump baseline-browser-mapping from 2.9.19 to 2.11.21 in /website (#5476)
• 36f4fe6 Bump svgo from 2.8.3 to 2.8.4 in /samples/browser-esm-parcel (#5474)
• f24cd7f Bump actions/deploy-pages in the github-actions group (#5479)
• Additional commits viewable in compare view

Updates react from 19.3.0 to 19.3.1

Release notes

Sourced from react's releases.

19.3.1 (October 14th, 2026)

React Server Components

• Improve transport protocol (#37845 by @​unstubbable and @​eps1lon)

Commits

• 61aa00d [19.3.x][Flight] Improve transport protocol (#37845)
• See full diff in compare view

Updates react-dom from 19.3.0 to 19.3.1

Release notes

Sourced from react-dom's releases.

19.3.1 (October 14th, 2026)

React Server Components

• Improve transport protocol (#37845 by @​unstubbable and @​eps1lon)

Commits

• 61aa00d [19.3.x][Flight] Improve transport protocol (#37845)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions