v1.28.3

PI WEBUI v1.28.3

Fixes

Session list no longer jumps back to the selected session on a background refresh (5dacec9, closes #20)

SessionList previously re-ran scrollIntoView() on the selected row on every sessions replacement, so a poll that left the selection unchanged yanked a list the user had scrolled elsewhere. The reveal is now keyed on the selected row's identity — session id plus the section it renders in — so a refresh that leaves it unchanged does nothing, while a genuinely new or newly visible selection is still revealed. A reveal attempted while an enclosing panel is display: none is deferred and delivered once the panel has layout.

Verified in real Chromium against the pre-fix tree using issue #20's own reproduction (60 sessions, selection near the end, list scrolled to the top, sessions replaced with a copied array):

step	v1.28.2	v1.28.3
background refresh keeps scroll	scrollTop 2854 (snaps)	scrollTop 0
same-id selection replacement	2854	0
panel hidden then shown, no new debt	2854	0
selection changed while panel hidden, then shown	never lands	1873, once
total scrollIntoView calls	8	3

13 new cases in SessionList.scroll.test.ts; 7 of them fail against the previous implementation.

Production dependency advisories cleared (039b23f)

fastify 5.12.5 → 5.12.7, fast-uri 3.1.8/4.2.1 → 3.1.9/4.2.3, zod 4.4.3 → 4.6.7. All in-range; no declared range changed. npm audit --omit=dev now exits 0 with zero production vulnerabilities.

Security disclosure — known advisory in the resolved runtime graph

This release ships with an accepted, disclosed dependency advisory that PI WEBUI cannot remediate. No audit exception is claimed: the register in IGNORED.md does not cover this finding and has not been amended to.

Path: @earendil-works/pi-coding-agent@1.4.0 declares "undici": "8.10.2" — an exact pin, not a range. That package is a peerDependency (>=1.4.0 <2) and is statically imported by the published dist/server/piPackageService.js, so a deployed install resolves the pinned undici at runtime. npm audit --omit=dev reports zero only because npm excludes the peer subtree from the local production tree; it does not mean a deployed install avoids it.

Advisories present in undici@8.10.2:

Advisory	CVSS	Impact
GHSA-xjj6-f33q-929c	7.5	Denial of Service — excessive content-encodings
GHSA-qrxm-fqhp-jwvm	7.5	Denial of Service — TLS 1.2 certificate-changing renegotiation
GHSA-4w7w-5xrc-9h26	7.4	cache poisoning and cross-user disclosure via cross-origin redirects
GHSA-2m5v-pch6-74hx	7.4	TLS certificate validation bypass — dropped TLS options in Agent
GHSA-9fm3-97px-rjf6	5.9	Denial of Service — WebSocket PONG buffering
GHSA-55wc-3pg8-jfw6	5.9	Denial of Service — decompress interceptor
GHSA-f72v-6w45-q472	5.9	Subresource Integrity bypass
GHSA-4qv8-2p9j-2685	5.9	Denial of Service — EventSource parser memory

Four are Denial of Service. The remaining four are not: one TLS certificate-validation bypass, one cache-poisoning/cross-user disclosure issue, and a Subresource Integrity bypass.

Why it is not fixed here: the vulnerable resolution is an exact pin inside a third-party published package. There is no range to move within, npm audit fix --force proposes downgrading @earendil-works/pi-coding-agent to 0.75.3, and forcing an overrides entry would substitute a version upstream never tested against an explicit pin — which IGNORED.md prohibits. @earendil-works/pi-coding-agent 1.4.0 is the latest published release. The fix belongs upstream: repin undici to >=8.12.2 and publish. Patched undici 8.12.3 is already published.

Decision: published on 2026-10-27 with this disclosure, on the recorded basis that the vulnerability is upstream's to fix, that it is disclosed rather than hidden, and that main alone does not deliver it to npm consumers. Consumers who can wait should pin to a later release once upstream repins undici.

Verification

• npm run verify (serial): 521 files, 6488 tests passed, 2 skipped — twice.
• npm audit --omit=dev: exit 0, 0 vulnerabilities.
• npm audit --include=dev: exit 1, the two findings documented above (undici and its parent).
• Full suite flake note: src/server/app.speechInput.test.ts occasionally exceeds its 5000 ms timeout in a loaded serial run; it passes in isolation and has no timers. Pre-existing, unrelated to these changes.

v1.28.2

What's Changed

Patch Changes

• 12305b8: Repair missing execute permission on node-pty's macOS spawn helper before starting or continuing terminals, preventing terminal startup failures after installation. Report an actionable error when installation permissions prevent repair.
• 36872f8: Preserve the workspace list scroll position during background refreshes while still revealing newly selected workspaces, selections that become visible after loading or expanding the list, and selections revealed once a collapsed or compact navigation panel becomes visible again.

Full Changelog: v1.28.1...v1.28.2

v1.28.1

Patch Changes

• e3be3c3: Fix archived sessions sometimes reappearing as unreadable one-line session files when automatic title generation finished after archiving, which could leave permanent session-search errors.

v1.28.0

Minor Changes

• 0463136: Upgrade the supported Pi core and coding agent dependencies to the 1.4.0 series (^1.4.0 and >=1.4.0 <2).

v1.27.3

Patch Changes

• Fix remote session pinning and unpinning, Force Cleanup, and project usage statistics failing with "API route not found".

v1.27.2

1.27.2

Patch Changes

• 41d4ab7: Restore available image attachments when editing a message from the chat history, with notices for images that could not be restored or were omitted at the attachment limit.

v1.27.1

Patch Changes

• 50b6f19: Keep session and subsession lists synchronized across browser clients after creation, archiving, restoration, deletion, and reconnects without a manual refresh. Reconnect live updates when another client restores the selected archived session, and retain memory-only session recovery until persistence is confirmed, including after shell commands.

v1.26.2

1.26.2

Patch Changes

• Show known HTTP status codes on failed model responses and preserve them in saved session history.

v1.26.1

Changes

• Keep the navigation header readable by raising its minimum column width to 324px while retaining the 340px default. Hide the visual version label in narrow headers and replace cramped machine health words with status dots while keeping machine names and health text accessible. Move installed-app reload controls from the navigation header to the Activity Rail, with context-bar access in smaller layouts.

v1.26.0

Minor Changes

• 1cab873: Remember the last opened Files preview and its top visible text line separately for each machine, project, and workspace within a browser tab. Restore the file and expand its parent folders when returning or reloading, with explicit file links taking priority. Add Collapse all to fold the file tree without closing or moving the current preview.

Patch Changes

• c02f385: Keep pending folder expansions working when another folder is collapsed in the Files panel.