FE-1345: Bump @earendil-works/pi-coding-agent to 0.84.1 to clear its bundled shrinkwrap advisories

[claude]

Requested by Tim Diekmann · Slack thread

Nine of brunch's thirty findings in the 2026-08-10 scan live in one place. This clears all nine — but it is not a version-only bump, and the part worth reviewing is the code change, not the lockfile.

Before

@earendil-works/pi-coding-agent ships an npm-shrinkwrap, so its dependencies resolve into node_modules/@earendil-works/pi-coding-agent/node_modules/ and are pinned by that file. Root overrides cannot reach inside a dependency's own shrinkwrap. At 0.79.8 that subtree held:

Nested package	Version	Advisories
brace-expansion	5.0.6	GHSA-3jxr-9vmj-r5cp (HIGH), GHSA-mh99-v99m-4gvg (HIGH), GHSA-rgw5-rvv9-x895 (HIGH)
undici	8.5.0	GHSA-4cwx-7wf7-3272 (HIGH), GHSA-8xcm-r25x-g524, GHSA-jr45-8vmc-qm54, GHSA-m8rv-5g2x-5cg5, GHSA-v3r7-h72x-cjcm (MODERATE)
protobufjs	7.6.4	GHSA-j3f2-48v5-ccww (MODERATE)

The 2026-08-03 run recorded the brace-expansion copy as "unfixable locally". It is fixable — just not by an override. The parent version is the only lever.

After

0.84.1, whose shrinkwrap carries brace-expansion 5.0.9, protobufjs 7.6.5 and undici 8.9.0. All nine advisories close.

0.82.1, which the Renovate dashboard (#407) offers, is not enough: it still ships brace-expansion 5.0.7 (open for GHSA-mh99 and GHSA-rgw5) and undici 8.5.0 (open for all five). Shrinkwraps read out of the published tarballs:

Nested package	0.79.8	0.82.1	0.83.0	0.84.1
brace-expansion	5.0.6	5.0.7	5.0.7	5.0.9
protobufjs	7.6.4	7.6.5	7.6.5	7.6.5
undici	8.5.0	8.5.0	8.5.0	8.9.0

0.84.0 is the first release that clears all three; 0.84.1 is latest.

The code change — please read this bit

pi 0.80.8 removed the AuthStorage export and replaced the authStorage + modelRegistry session options with a single async modelRuntime. Five minors of the agent SDK cannot be crossed without migrating the cook agent's auth wiring, so src/orchestrator/src/pi-actions.ts moves from:

AuthStorage.create(path) → setRuntimeApiKey → ModelRegistry.inMemory(authStorage) → find(...)

to:

ModelRuntime.create({ authPath, modelsPath: null, refreshOnCreate: false }) → await setRuntimeApiKey → getModel(...)

modelsPath: null, allowModelNetwork: false and refreshOnCreate: false are what reproduce the old ModelRegistry.inMemory behaviour: built-in models only, no models.json, no I/O at construction time. allowModelNetwork: false is already the default — it is stated explicitly so an upstream default flip cannot quietly put a network call on this path — while refreshOnCreate: false is load-bearing, since create() runs an initial catalog/availability refresh unless it is passed exactly false. Behaviour is otherwise meant to be identical — same isolated auth.json path, same ANTHROPIC_API_KEY source, same "model not found" error branch.

This path has no unit-test coverage (it needs a real API key), so I exercised it directly instead: ModelRuntime.create with those options resolves anthropic/claude-opus-4-8 from built-ins offline, setRuntimeApiKey stores the key and getAuth('anthropic') returns it, and an unknown model id still comes back undefined so the existing throw still fires. That is a mechanical check, not a real agent run — a live cook run before merge is the thing I'd most want a second pair of eyes on.

Also in the 0.80.x–0.84.x range but not obviously reaching brunch: the harness session model was replaced with pi-agent-core's v4 lane-based API, and message_update now emits only assistantMessageEvent deltas (the cumulative message field is gone). brunch already consumes the delta form, and the suite passes.

Also: the stale protobufjs override

package.json pinned overrides.protobufjs to 7.6.4 — the vulnerable version. Nothing in the tree resolves through it today, so the lockfile is unchanged by this edit, but leaving an exact pin on a vulnerable version is a trap for the next resolve that does hit it. Bumped to 7.6.5.

This is what #409 was trying to do. That PR is ineffective and I'd suggest closing it: it bumps the same root override, but its package-lock.json diff only adds two "dev": true markers and does not move protobufjs at all — the nested 7.6.4 survives, because a root override cannot reach into the shrinkwrap. Its gone-check fails. This PR is the fix.

Gone-check

Confirmed absent from package-lock.json after the change — 0 occurrences each of brace-expansion-5.0.6, protobufjs-7.6.4, undici-8.5.0. Each entry is replaced in place, not added alongside a survivor.

Re-running the full lockfile through npm's bulk advisory endpoint before and after: 11 advisory rows removed, 0 added. The pi bump brings in four new nested packages (grok-mermaid, pi-client, pi-protocol, pi-telemetry) and none of them carries an advisory.

Still open afterwards and covered elsewhere: dompurify (#418), hono (#408), mermaid (#417), nanoid (#419/#420), and undici 7.28.0 via release-it (separate PR).

Verification

• npm run verify — check clean (0 errors, 11 pre-existing warnings, same as main), build passes.
• test: the 3 known failures (sandbox-guard.test.ts ×2, petrinaut-events.test.ts ×1) which reproduce on unmodified main in this container — bwrap-sensitive, unrelated. A handful of other files timed out at 5s under load during the full run and all pass when re-run on their own; pi-actions.test.ts itself passes.

brunch has no lint/test/build workflow in CI, so the green checks on this PR say nothing about tests — the runs above are the real gate.

Linear: FE-1345

[cursor]

PR Summary

Medium Risk
Touches the in-process cook agent’s Anthropic API key and model resolution path with no unit-test coverage for a live session; dependency jump spans several pi minors.

Overview
Bumps @earendil-works/pi-coding-agent from 0.79.8 to 0.84.1 so the package’s bundled shrinkwrap picks up patched nested deps (brace-expansion, undici, protobufjs) and clears related security advisories. The root protobufjs override moves from 7.6.4 to 7.6.5 so a future resolve doesn’t pin a vulnerable version.

buildSessionOptions in pi-actions.ts is updated for pi ≥0.80.8: AuthStorage / ModelRegistry are replaced with async ModelRuntime.create (authPath, modelsPath: null, allowModelNetwork: false, refreshOnCreate: false), setRuntimeApiKey, and getModel, with modelRuntime passed into session options instead of the old auth/registry pair—intended to match prior in-memory, built-in-models-only, no-network-at-setup behavior.

^{Reviewed by Cursor Bugbot for commit 18d6a3e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 6feeab0. Configure here.}

[TimDiekmann]

@hashintel/frontend to look at this before merging please.