v1.1.9

Pi Reaches Claude Code Parity, Antigravity Agent, SilverBullet Persistent Indexing, Proactive Memory, Security Hardening, Spec & Doc Sweep

Agent coverage. The discipline layer (model tiers, hooks, skills, rules, MCP plumbing, graphify integration) is most mature on the Claude Code session shape, but this release closes most of that gap for Pi: a Pi-backed container now captures memory, indexes the vault, runs PR-boundary reviews, and navigates the graph with the same capabilities as a Claude-backed one. Antigravity (agy) replaces the Gemini CLI agent. Codex, Copilot, and OpenCode continue to receive the transformed seed; their session-shape-appropriate parity follows as their extension surfaces stabilize.

Multi-agent runtime

Pi coding agent reaches Claude Code parity (#426, #427, #441, #442, #443, #449, #450; REQ-AGENT-001/050/051/052, REQ-MEM-014, AD60-AD63)

Pi (by earendil-works) is now a first-class Codeflare agent rather than a degraded harness. The high-value workflows behave the same as on the Claude runtime.

• Pi-native runtime assets (preseed/agents/pi/). Eight TypeScript extensions (codeflare-pi adapter, context-mode enforcement, graphify helpers, memory/vault helpers, review command + enforcement) with their own manifest, MCP config (context-mode + graphify servers), and pinned deps. A native graphify skill override at ~/.pi/agent/skills/ wins over the transformed Claude version.
• Three-stream seed generator. generate-agent-seed.mjs now emits Claude as-is, Pi-native (extensions / MCP / npm), and transformed (Codex / Antigravity / Copilot / OpenCode) documents, with Pi tool-remapping through a 13-tool allowlist, MCP-tool stripping for the non-MCP agents, and a validateDocuments() guard against duplicate (key, mode) pairs.
• /review parity (REQ-AGENT-050, AD61). Pi /review injects a native skill mirroring the Claude multi-phase workflow: scope flags, --deep behavioral REQ verification via parallel subagents, and --verify-high external second-opinion that degrades gracefully when unavailable. Review lanes additively load graphify (always) and context-mode (after /ctx on) plus the codeflare-pi guards, so reviewers under Pi have the same graphify_* / ctx_* toolset as under Claude.
• PR-boundary review enforcement (REQ-AGENT-036, REQ-AGENT-040). Reviewers spawn directly through the pi-subagents service with run_in_background: true; a per-lane in-flight guard produces exactly one review window per push without masking other lanes; head-currency is tri-state (current / stale / unknown) so a transient gh failure never drops the merge gate or leaves a reviewed head un-acked.
• Developer commands (REQ-AGENT-051). /debug, /deploy, /brainstorm reimplemented as native pi.registerCommand handlers.
• Memory + vault capture parity (REQ-MEM-001/002/010/014, REQ-VAULT-003/004, AD58 parity). Full capture-contract and vault-extract prompts ship to ~/.pi/agent/prompts/, with the transcript prefiltered to user/assistant text (last 200 turns, 8000 chars/turn) instead of a raw 40-message JSON slice. Capture counts only real user prompts and triggers on delta >= 15, advancing the counter before the trigger (dedup contract); vault indexing shares Claude's vault-extract.last mtime marker and exclusion set (Raw/Sessions/, graphify-out/, .silverbullet/, the four preseed pages) exactly, with a 5-minute in-flight TTL handed to the extract agent. Resumed-session detection keys on the missing /tmp counter with a stable uuidv7 id read back from the session header, so the resume force-fire runs once per container recycle. An optional CODEFLARE_MEMORY_MODEL lever pins fidelity with no hardcoded model name.
• Toolset-agnostic CI monitoring (REQ-AGENT-021). Post-push CI monitoring runs as one continuous background task; the same shell body runs under the native Bash tool or ctx_execute + setsid when Bash is routing-gated, propagated to all five seeded agents.
• Container integration. Pi npm deps preinstalled at /opt/codeflare/pi-agent/npm/ and symlinked into place at boot (zero-copy); Fast Start via PI_OFFLINE + PI_SKIP_VERSION_CHECK; idempotent settings.json merge; transcript cleanup keeps the 5 newest sessions.

Antigravity (agy) replaces the Gemini CLI agent (#443, #457; REQ-AGENT-001/002, REQ-TERM-005, AD67)

The launchable Gemini CLI agent is swapped for Antigravity (agy); Copilot and Pi leave beta. Net agent count stays seven (claude-code, codex, copilot, antigravity, opencode, pi, bash); the New Session dialog now sorts agents alphabetically with Bash last. The agy lane seeds ~/.gemini/{GEMINI.md, skills/, agents/} with a Claude->Gemini tool remap (58 seed documents); bisync excludes the 33MB ~/.gemini/antigravity-cli/ runtime churn while keeping seeded config + auth so agy sign-in persists across sessions. consult-llm's Gemini API (GEMINI_API_KEY) is unchanged - only the CLI agent was replaced.

Mobile auth-URL login fix (#443, REQ-AGENT-013 AC4)

Long browser sign-in URLs (OAuth / device-login) that wrap across several terminal rows are now reassembled in full before being offered as a clickable link. Previously, on mobile the on-screen keyboard shrank the terminal, the URL wrapped past the visible area, and the truncated link was rejected by Google with invalid_scope - with no way to select-and-copy on mobile, sign-in was impossible. The row-joining scan is bounded by a fixed cap (MAX_URL_CONTINUATION_ROWS) so it never walks unbounded scrollback.

Auto-upgrade preseed on release (#426, REQ-AGENT-049)

When a release ships updated agent skills, rules, or plugins, users no longer click "Recreate Agent Skills & Rules" by hand. generate-agent-seed.mjs computes a build-time PRESEED_CONTENT_HASH; on first dashboard load the existing batch-status call compares it against the user's lastPreseedHash in KV, and a stale hash fires recreateAgentConfigs() in the background (UI shows "Upgrading...", dims stopped sessions) before recording the new hash. The check piggybacks on the initial load only - zero extra KV reads during the 5s poll.

Cloudflare API token scope tiers (#426, REQ-AGENT-028 AC2)

Restores prefilled Cloudflare token-creation URLs with three tiers matching the existing GitHub pattern, rebuilt on Cloudflare's new permissionGroupKeys format (22 keys verified): Minimal (7 scopes: Workers Scripts, KV, R2, D1, Routes, Account/Zone read), Recommended (+DNS, Access zone/account), Advanced (+Pages, Containers, API Tokens, Queues, Workers AI, Vectorize, Turnstile, Workers Builds/Observability, R2 Data Catalog, Agents Config).

consult-llm v2.1.0: provider dialog + live flagship model (#443, REQ-AGENT-031 AC4/AC5)

When the user does not name a provider, consult-llm shows an AskUserQuestion dialog (OpenAI / Gemini) and always resolves the latest flagship model live (/v1/models, /v1beta/models) rather than the MCP server default.

Vault & SilverBullet

SilverBullet native service worker: persistent encrypted client indexing (#459, closes #445; REQ-VAULT-008/013, AD69)

The vault proxy now serves SilverBullet's native service worker (vendored verbatim, SHA-256 drift-guarded) with a deterministic codeflare key-recovery graft, replacing the key-bridge-only shim that had no sync engine and never created the persistent sb_files_* store - which had forced a full re-crawl and re-index of the vault over HTTP on every cold load.

• The graft injects __cfRecover() at the worker's two key-empty checkpoints (the config auth-gate and get-encryption-key), re-fetching the per-session key from the auth-gated /.vault-key, so zero-UI encryption survives the worker's idle key-flush.
• vault.ts suppresses the shell bootstrap-hop 302 for service-worker-context fetches (Sec-Fetch-Mode present and != navigate) so the cache.addAll precache resolves instead of hanging the install.
• Verified end-to-end on integration (mobile): sb_files_* created, key recovered, no .auth bounce, indexing now incremental. REQ-VAULT-008 + REQ-VAULT-013 -> Implemented; the legacy key-shim is retired.

Vault bootstrap-hop hardening (#420, REQ-VAULT-013 AC1-AC4)

The bootstrap-hop redirect is now GET-only with an explicit SW-activation timeout constant and per-step diagnostic reporting; rewriteVaultBaseHref / rewriteVaultHtmlResponse were extracted for testability with six behavioral tests.

Memory & knowledge graph

Proactive memory context injection (#421, REQ-MEM-013, REQ-AGENT-024 AC1)

Two new hooks surface prior knowledge without being asked. The SessionStart hook queries the graph for god-nodes and injects a structural summary (three-tier fallback); a first-prompt hook extracts keywords from the user's message and injects matching vault notes, code concepts, and prior decisions as additionalContext, bounded by a budget cap. All ACs tested.

Graphify: language-agnostic import resolution, native Pi build-mode, skill refactor (#420, #441, #450, #459; REQ-AGENT-023, AD63)

• Language-agnostic import resolution. The Pi first-build graph pass resolves internal imports for any language - Dart package:, Java/Kotlin/C# dotted namespaces, C/C++ includes, JS/TS module paths - via a generic longest-unique-suffix matcher, while stdlib and third-party imports stay external; a 2-segment-tail floor prevents a bare basename from mis-merging. Verified against a live Flutter repo: every internal import resolved to a local file node, all dart:* and third-party package:* left external.
• Interactive Pi build-mode split. First builds use a full AST extract + build through the bounded safe-update wrapper (which fails closed on a missing target, an inapplicable RLIMIT_AS cap, or an absent CLI, and always re-exports GRAPHIFY_VIZ_NODE_LIMIT); Full mode dispatches Pi Agent subagents. Post-clone graph triage added; the count-based graphify hard-block retired in favour of advisory graph-first discipline.
• Skill refactor. The graphify skill shrank from 56k to 39k chars (recipes-first Quick Reference) with six correctness fixes (cache API, category keys, hyperedge pipeline, import cleanup). The vault .graphifyignore now excludes minified SilverBullet plug bundles that had polluted the global graph as god-nodes.

Security & reliability hardening

Security review remediation (#450)

A full --all --deep --verify-high review pass produced legitimate hardening across the auth and billing surfaces: session-JWT aud binding, LLM-key header-injection validation, deploy-key account-ID re-validation, Stripe webhook hardening (30/min + fail-closed), and billing-aware advanced-mode gating, each landed with new behavioral tests (real-HMAC webhook verifier, deploy-key encryption round-trip).

Technical-debt sweep + session-status reconciliation (#459; #149, #150, #151, #153, #452)

• Bounded state. Auth-config cache uses a 30s TTL for the pre-setup/null (spoofable-email) state vs 5min populated; the rate-limit fallback Map and per-container circuit-breaker maps gain LRU size caps; breakers reset on setup/config change.
• CSRF. Independent double-submit token on state-changing vault routes, with Origin + X-Requested-With kept as defense-in-depth and a no-break fallback; getBaseUrl validates the KV custom domain before use.
• Session reconciliation. A pure reconcileStaleStatus downgrades a running session to stopped on the read path when its metrics heartbeat is >180s stale (with startup grace), applied on the dashboard read paths and the session-limit count, so a session whose container died self-heals instead of sticking on a yellow "running" dot; the unbounded GET /api/sessions fan-out is bounded to batches of 20.
• Boundary validation. setSessionId payload validated at the Durable Object boundary with Zod; ScrambleText consolidated onto the use-scramble-text hook with reduced-motion handling.

CI / deploy / supply chain

Shadow-pin automation for Dockerfile binaries (#421, REQ-OPS-020)

bump-shadow-pins.yml gains four jobs watching the Dockerfile binaries (zoxide, yazi, lazygit, silverbullet); the SHA256 is invalidated on bump so an upgrade forces manual verification. The graphifyy PyPI pin joined the same weekly sweep (#443).

Host hook tests in CI + wrangler types migration (#421)

42 self-contained host hook tests (707 subtests) now run via node --test in CI. @cloudflare/workers-types was replaced with the wrangler-generated worker-configuration.d.ts, unblocking the wrangler + vitest-pool-workers bumps. The dead 192-line r2-nuke workflow was removed.

Review-enforcement env-prefix detection (#457)

The review Stop hook and PostToolUse reminder now consume an optional leading env-var assignment, so an env-prefixed git push (e.g. BROWSER="" git push) can no longer slip past review enforcement; bare commands still match and commit-message false positives stay rejected.

Image size optimization (~600MB) (#427)

Stripped Bun non-linux node_modules (258MB), Copilot non-linux prebuilds + duplicate ripgrep + unused native modules (200MB), unused yarn (5MB), and the ~/.npm cache on boot (200MB runtime).

Specification & documentation sweep

A deliberate, repo-wide specification and documentation pass landed alongside the feature work, restoring single-source-of-truth discipline across every domain.

• Verification coverage across all 12 spec domains. Every REQ's Verification field was linked to a real test file: 33 fields in #426 and a further 180 in #420, replacing leftover "Manual check" placeholders with [Automated test](...) links. Multiple REQs were promoted Partial -> Implemented as their ACs gained automated coverage, and every new requirement below shipped with behavioral tests rather than prose.
• Status, anchor, and AC reconciliation. REQ statuses were corrected to match the shipped code (REQ-VAULT-008/011), @impl / @test anchors realigned to renamed symbols, and AC citations corrected during the cycle-1 /review pass (#450); sdd/spec/changes.md carries the changelog across every increment.
• Documentation lanes consolidated 22 -> 18 files with broken cross-references repaired (#420). Drift-prone file-count numbers were removed from preseed.md so it stops going stale on every preseed change (#443); Pi runtime env vars, critical paths, and troubleshooting entries were added (#427); and security.md gained the AD68 service-token cross-ref with corrected REQ-AUTH backlinks (#459).
• New requirements: REQ-AGENT-049 (auto-upgrade preseed), REQ-AGENT-050 (Pi /review parity), REQ-AGENT-051 (Pi developer commands), REQ-AGENT-052 (generic attribution guard), REQ-MEM-013 (proactive memory hooks), REQ-MEM-014 (Pi capture fidelity).
• New ADRs: AD60-AD63 (Pi capture / review / model-genericization / graphify hardening), AD67 (Antigravity lane), AD68 (service-token bypass gating), AD69 (SilverBullet native service worker).

Dependencies (cumulative since v1.1.8)

• @cloudflare/containers 0.3.4 -> 0.3.5; wrangler 4.94.0 -> 4.95.0; @cloudflare/vitest-pool-workers 0.16.9 -> 0.16.10; @vitest/coverage-v8 -> 4.1.7; puppeteer -> 25.1.0
• vite 8.0.12 -> 8.0.14 (web-ui); knip 6.12.2 -> 6.14.2; oxlint 1.64.0 -> 1.67.0; ws 8.20.1 -> 8.21.0 (host)
• graphifyy 0.8.18 -> 0.8.27; lazygit 0.61.1 -> 0.62.1; github/codeql-action 4.35.4 -> 4.36.0; docker/setup-buildx-action v3.12.0 -> v4.1.0
• Dockerfile binaries: silverbullet 2.8.0 -> 2.8.1, yazi 26.5.6 (gnu -> musl), bun 1.3.14; context-mode 1.0.151
• Lockfiles regenerated to match.

CVE remediation

Suppressed in .trivyignore with explicit exposure-profile justification matching the established convention.

• CVE-2026-48962 (perl IO::Compress) - no fix in Debian bookworm; the container runs no untrusted compressed-stream parsing path.
• CVE-2026-42497 (perl Archive::Tar hardlink traversal) - no fix in bookworm; no untrusted tar extraction at runtime.
• Go-stdlib CVEs in rclone / lazygit pinned for bisync stability and picked up via the lazygit 0.62.x bump where a patched build exists.

Full Changelog: v1.1.8...v1.1.9