Addresses GHSA-82fw-gwwq-j7x9 (vitest mocker path traversal) and
GHSA-3wwx-pv8p-q78v (undici 6.x permessage-deflate DoS). Both are
dev/example-only; the shipped coding-agent shrinkwrap is unchanged.
Replace the tsgo native preview with typescript@7.0.2 and port the check scripts to the TS 7 API. Target ES2024, drop useDefineForClassFields: false and unused decorator options, and enable verbatimModuleSyntax. Replace tsx with node plus the source resolver hook, passed to --import as a file URL.
closes#9965
The harness declared peer deps on the pre-rename @mariozechner/pi-ai and
@mariozechner/pi-agent-core names, so npm auto-installed our own code from the
registry under an alias. sync-versions bumped those aliases in lockstep, which
made every release fail because the new version is not published yet.
Build the eval harness on createHarness from vitest-evals core instead. The
pi-specific code was already ours; the harness only contributed agent-lifecycle
plumbing and unused tool replay.
