agent/pi - pi - Penguin

github-actions[bot] · 2026-04-22 08:57:51 +00:00

a64dc76508

fix(coding-agent): sanitize markdown links in exported session HTML (#3532 )

marked v15 does not filter dangerous URL protocols. The default link
renderer passes href values through verbatim, so markdown like
`[click](javascript:alert(1))` renders as a clickable XSS link in
shared/exported session HTML.

Add custom link and image renderers that:
- Block javascript:, vbscript:, and data: protocol URLs
- Escape href/title/alt attributes via escapeHtml()

Also escape img.mimeType in session image rendering to prevent
attribute breakout from crafted session JSONL.

Fixes #3531

Samuel Painter · 2026-04-22 10:53:03 +02:00

ee462dd70d

Add [Unreleased] section for next cycle

Mario Zechner · 2026-04-22 02:15:04 +02:00

9f91276a42

Release v0.68.1

Mario Zechner · 2026-04-22 02:14:13 +02:00

v0.68.1 a2c183db0f

docs(coding-agent): audit unreleased changelog entries

Mario Zechner · 2026-04-22 02:13:10 +02:00

6cc4ad26e3

feat(ai): add Fireworks provider support closes #3519

Mario Zechner · 2026-04-22 01:09:11 +02:00

0bb0a58466

chore: approve contributor tantara

github-actions[bot] · 2026-04-21 23:08:53 +00:00

92b08abd3b

fix(coding-agent): configure inline tool image width

closes #3508

Mario Zechner · 2026-04-22 00:56:01 +02:00

97a38bf652

fix(tui): follow symlinks in fuzzy autocomplete closes #3507

Mario Zechner · 2026-04-22 00:35:19 +02:00

780d536727

fix(agent): preserve proxy stream options closes #3512

Mario Zechner · 2026-04-22 00:34:20 +02:00

32859bdf9a

fix(coding-agent): expand ~ in sessionDir

closes #3514

Mario Zechner · 2026-04-22 00:21:57 +02:00

60290b0d75

fix(agent): emit parallel tool completion eagerly\n\ncloses #3503

Mario Zechner · 2026-04-22 00:15:56 +02:00

759d551527

docs(ai): add changelog entry for Anthropic SSE parsing fix (#3175 )

Mario Zechner · 2026-04-22 00:00:26 +02:00

6480b734c1

fix(ai): drop deprecated fine-grained-tool-streaming beta header, use eager_input_streaming per-tool

Replace the deprecated global anthropic-beta header with per-tool
eager_input_streaming: true. Fix empty anthropic-beta header causing
400 errors on models with no beta features.

fixes #3175

Mario Zechner · 2026-04-21 23:53:23 +02:00

b0217ca6f8

Reapply "fix(ai): own Anthropic SSE parsing to avoid SDK JSON.parse hard-failures"

This reverts commit fc9220d2de.

Mario Zechner · 2026-04-21 23:42:19 +02:00

e58d631c89

Revert "fix(ai): own Anthropic SSE parsing to avoid SDK JSON.parse hard-failures"

This reverts commit 4b926a30a2.

Mario Zechner · 2026-04-21 23:19:52 +02:00

fc9220d2de

test(coding-agent): fix showLoadedResources mocks (#3518 )

Add getCommandDiagnostics and getShortcutDiagnostics mocks to fix
'Cannot read properties of undefined' errors in InteractiveMode tests.

regression from 32a305cb

Aliou Diallo · 2026-04-21 23:05:38 +02:00

81de426f96

fix(ai): own Anthropic SSE parsing to avoid SDK JSON.parse hard-failures

Bypass the Anthropic SDK streaming parser entirely. Use
client.messages.create().asResponse() and decode the SSE stream
ourselves with defensive JSON parsing that repairs invalid escape
sequences and control characters inside string literals.

- Switch from SDK .stream() to .asResponse() + pi-owned SSE decoder
- Add repairJson() / parseJsonWithRepair() to json-parse.ts
- Add anthropic-sse-parsing.test.ts regression for malformed tool deltas
- Update github-copilot-anthropic.test.ts mock to match new call path
- Update deprecated claude-3-5-haiku-20241022 refs to claude-haiku-4-5
- Remove stale non-reasoning model test

fixes #3175

Mario Zechner · 2026-04-21 23:00:56 +02:00

4b926a30a2

fix(amazon-bedrock): restore regional endpoint resolution

closes #3481
closes #3485
closes #3486
closes #3487
closes #3488

Mario Zechner · 2026-04-21 13:20:10 +02:00

a0a16c7762

docs(coding-agent): fix promptGuidelines examples to name tools explicitly (#3489 )

promptGuidelines bullets are appended flat to the Guidelines section
with no tool name prefix. Using 'Use this tool when...' is ambiguous
because the LLM cannot tell which tool 'this' refers to. Updated docs
and examples to use explicit tool names instead.

Aliou Diallo · 2026-04-21 13:07:42 +02:00

01ec6e2e7f

fix(coding-agent): fix grep/find/ls HTML export rendering (#3491 )

Rename BUILTIN_TOOLS to TEMPLATE_RENDERED_TOOLS to match what the set
actually represents: tools rendered directly by the HTML template instead of
pre-rendered through the TUI→ANSI→HTML pipeline.

Move grep and find off the template-rendered exclusion path so they use their
existing TUI renderCall/renderResult output in HTML export.

Add a dedicated HTML renderer for ls and keep it in the template-rendered set.
Unlike grep and find, rendering ls through the terminal-oriented Text component
introduced spacing artifacts in exported HTML due to full-width line padding,
so ls is rendered natively in the export template instead.

Aliou Diallo · 2026-04-21 13:06:49 +02:00

b2a1997ea0

fix(coding-agent): render HTML-like message content verbatim in exports

closes #3484

Mario Zechner · 2026-04-21 09:24:44 +02:00

c6cef7c806

chore: approve contributor jlaneve

github-actions[bot] · 2026-04-21 07:12:23 +00:00

ac99bdba00

chore: approve contributor drio

github-actions[bot] · 2026-04-21 07:04:32 +00:00

6baadb831d

Add [Unreleased] section for next cycle

Mario Zechner · 2026-04-20 23:55:47 +02:00

19013265a8

Release v0.68.0

Mario Zechner · 2026-04-20 23:54:54 +02:00

v0.68.0 6f345b78d5

docs(changelog): audit unreleased entries

Mario Zechner · 2026-04-20 23:53:53 +02:00

639da8a602

fix(coding-agent): initialize system prompt options lazily

Mario Zechner · 2026-04-20 23:22:21 +02:00

14ad636fb5

fix(coding-agent): add session_shutdown reasons closes #2863

Mario Zechner · 2026-04-20 23:11:08 +02:00

12d7161884

feat: Expose BuildSystemPromptOptions on before-agent-start event. (#3473 )

Resolves: #3463

Douglas Stephen · 2026-04-20 23:06:47 +02:00

1891b9ac01

chore: remove bjesuiter from approved contributors

Mario Zechner · 2026-04-20 23:04:52 +02:00

7c69aadcaf

feat(coding-agent): batch package updates

closes #2980

Mario Zechner · 2026-04-20 22:56:26 +02:00

e4f7fe7bb7

fix(tui): avoid cwd-path matches in @ autocomplete

Only use fd --full-path for path queries so plain fuzzy @ autocomplete results no longer depend on whether the cwd path contains the query text.

closes #2778

Mario Zechner · 2026-04-20 22:44:34 +02:00

968430f63e

docs(agent): clarify parallel tool ordering closes #3468

Mario Zechner · 2026-04-20 22:35:43 +02:00

7b1599058b

fix(coding-agent): resolve shell config from session settings

Stop shell resolution from consulting ambient process.cwd() during bash execution and use the active session's shellPath setting instead.

closes #3452

Mario Zechner · 2026-04-20 22:32:11 +02:00

c40efa9bab

fix(coding-agent): remove process-cwd tool singletons and use tool-name allowlists

- switch SDK/CLI tool selection to name-based allowlists
- apply allowlists across built-in, extension, and SDK tools
- remove ambient process.cwd defaults from core tooling and resource helpers
- update tests, examples, and TUI callers for explicit cwd plumbing
- add regression coverage for extension tool filtering

closes #3452
closes #2835

Mario Zechner · 2026-04-20 22:05:28 +02:00

5a4e22ea44

fix(coding-agent): use tool-name allowlists and remove cwd-bound singletons

- treat tools as a global allowlist across built-in, extension, and SDK tools
- remove process-cwd singleton tool usage from SDK and CLI paths
- add regression coverage for extension tool filtering

closes #3452
closes #2835

Mario Zechner · 2026-04-20 22:05:28 +02:00

27c1544839

docs(coding-agent): document async extension factories closes #3469

Mario Zechner · 2026-04-20 22:02:03 +02:00

ed89480f20

chore: approve contributor dljsjr

github-actions[bot] · 2026-04-20 19:23:24 +00:00

029a6e54be

fix(ai): preserve requiresThinkingAsText replay semantics closes #3387

Mario Zechner · 2026-04-20 19:44:38 +02:00

1d488626d9

fix(coding-agent): skip redundant npm package updates