Replace build-time shell utilities with Node filesystem operations and retire the native sandbox example in favor of existing isolation options. Upgrade glob matching and worker-test dependencies and refresh the lockfiles.
pi-agent-core now contains only Agent, the agent loop, the proxy stream, and
their types. Removed the harness, sessions and session storage, pico3, harness
tools, compaction, skills, prompt templates, telemetry schemas, search types,
and the uuidv7 and pi-telemetry re-exports, plus the ./node, ./harness/* and
./experimental/pico3 subpath exports. Durable sessions live in
@earendil-works/pi-durable.
Also removed packages/session-backends and the experimental mini and micro
coding-agent frontends, with their scripts and build configuration.
Addresses GHSA-82fw-gwwq-j7x9 (vitest mocker path traversal) and
GHSA-3wwx-pv8p-q78v (undici 6.x permessage-deflate DoS). Both are
dev/example-only; the shipped coding-agent shrinkwrap is unchanged.
Replace the tsgo native preview with typescript@7.0.2 and port the check scripts to the TS 7 API. Target ES2024, drop useDefineForClassFields: false and unused decorator options, and enable verbatimModuleSyntax. Replace tsx with node plus the source resolver hook, passed to --import as a file URL.
closes#9965
A barrel forces Node to evaluate its whole graph: importing reduceLaneSnapshot
(1 file, 6 KB) through pi-agent-core's index evaluated 106 files, and mini's
server loaded 112 files to enumerate JSONL headers. Types are free, so this only
ever affected value imports.
pi-ai gains ./utils/* alongside the existing ./providers/* and ./api/*
wildcards. pi-agent-core gains ./harness/context, ./harness/env/nodejs,
./harness/runtime/reducer and ./harness/session, and ./session/testing becomes
./harness/session/testing so every export mirrors its source path. The barrel
and ./node keep their batteries-included semantics.
The session layer takes uuidv7 from @earendil-works/pi-ai/utils/uuid rather than
the pi-ai barrel, which is what let ./harness/session drop from 42 files to 19.
Two imports there were written `import { type Usage } from` - not a type-only
statement, so it emitted a runtime import of the barrel.
scripts/check-entry-graphs.mjs walks each declared entry's value-import graph and
enforces per-entry budgets and forbidden paths, so a stray `export *` cannot
silently undo this. It caught the two `import { type ... }` regressions above.
Measured with mini: server 112 files and 98 MB to 28 files and 69 MB, presentation
204 files and 125 MB to 99 files and 110 MB. The worker still loads the provider
graph, correctly.
Bump TypeBox to 1.3.7 so compiled validators guard array-specific keywords when null is accepted, and cover tool-argument validation with a regression test.
Breaking for extensions: TypeBox 1.3 removes deprecated APIs including Type.Base, Type.Awaited, Type.Promise, Type.AsyncIterator, Type.Iterator, Type.Options, and Value.Mutate. Extensions using these through Pi's bundled TypeBox aliases must migrate to supported TypeBox APIs.
Fixes#7003
