Pi-Bolt 0.8.0

Pi-Bolt 0.8.0 runs on Windows. It adds Windows x64 (Windows 10 and 11) to Linux x86-64 and macOS on Apple silicon,
with Pi 1.1.0 on all three, and the installers offer OpenSec's extensions again.

Windows x64

powershell -c "irm https://pi-bolt.opensec.in/install.ps1 | iex"

or npm install -g pi-bolt. The installer puts pi-bolt.exe in %USERPROFILE%\.pi-bolt and on your PATH, so pi-bolt
works in cmd, PowerShell and any terminal. pi-bolt update updates it in place.

On a Windows 11 laptop (Intel Core i5-1335U), against Pi 1.1.0 as released (medians;
docs/BENCHMARKS.md):

	Pi-Bolt 0.8.0	Pi on Bun 1.4.2	Pi on Node 24
Launch to interactive	92 ms	177 ms	311 ms
pi-bolt --version	35 ms	98 ms	219 ms
pi-bolt -p: one prompt, 4 tool calls	113 ms	203 ms	383 ms
CPU, interactive session of 5 prompts	291 ms	805 ms	1,125 ms
CPU per prompt, 4.2M-token session	166 ms	298 ms	634 ms
Peak private bytes, interactive session	113 MB	345 MB	197 MB
Longest stall writing a 200 KB file	63 ms	43.9 s	46.6 s

• Signed. install.ps1 and the npm package check the release's Ed25519 signature themselves (Windows has no tool for it)
  and refuse checksums of another version. A mirror is accepted only if it is signed too.
• Hardened. DEP and Control Flow Guard; the prebuilt heap is read-only, so a write to it stops the
  program instead of changing it; the DLLs Pi-Bolt loads late come from System32 only, never from the folder it is in; the
  debugging options that reach memory or load code are off.
• Works as Pi does on Windows: PowerShell, cmd and Git Bash for the bash tool, images (resized in a worker), extensions
  and their programs, MCP servers. A program is never looked up in the current folder.
• Older CPUs: CPUs without AVX2 (before Intel Haswell, 2013) run the same build on its bytecode.
• JIT build: pi-bolt-win32-x64-jit ($env:PIBOLT_VARIANT = "x64-jit" before installing) is for extensions that do heavy
  JavaScript work themselves, such as pi-lens. With the default build their work runs on the interpreter.
• The executable has no Authenticode signature yet. SmartScreen may warn about one downloaded with a browser; the installers do
  not mark what they download, so installs through them are not affected.

From 0.7.4

• Pi-Bolt does not load code from the directory it is started in, on Windows too: code built into the executable resolves no
  module or package from the working directory (0.7.4).
• Extensions resolve their own packages as on Node, through their package.json (packages such as sharp load).

Extensions

• The installers offer OpenSec's two extensions again (opensec-pi-subagents, opensec-pi-todo). 0.7.1 to 0.7.3 were
  published without extensions.txt, the signed list of their versions, so no installer offered them; it is back, and
  publishing now checks it is there.
• pi-bolt update installs into the installation that is running. PIBOLT_INSTALL decides only for an executable that is not
  in an installation (a build of your own). Before, a PIBOLT_INSTALL left in the environment could put the update elsewhere and
  leave the running copy as it was.

Installer

• install.sh refuses checksums that say they are another release's, as install.ps1 does: an older release, signed all the
  same, served as a newer one, is no longer installed as the newer.

Engine

• On Windows: an idle keep-alive connection is aged on a clock nobody sets (GetTickCount64), as on Linux and macOS since 0.7.3.
• The writer of the prebuilt heap no longer stops at a pair of numbers that reads like an address of the builder's own memory;
  a word that could be a pointer there still stops it.

Corrections to earlier notes

• 0.7.1 to 0.7.3 said the installer detects Linux or macOS: it is install.sh for those, and install.ps1 for Windows.
• 0.7.1 said git sources are passed with --end-of-options. They are refused when the repository or ref starts with -, which
  works with every git version.

Install

curl -fsSL https://pi-bolt.opensec.in/install.sh | sh

powershell -c "irm https://pi-bolt.opensec.in/install.ps1 | iex"

or pi-bolt update, or npm install -g pi-bolt.

Asset	For
pi-bolt-linux-x64.tar.xz / .tar.gz	Recommended on Linux. CPUs with AVX2 (Intel Haswell 2013+, AMD Zen+).
pi-bolt-linux-x64-baseline.tar.xz / .tar.gz	Any x86-64 CPU with SSE4.2.
pi-bolt-linux-x64-jit.tar.xz / .tar.gz	JIT also on, for plugins loaded at run time.
pi-bolt-darwin-arm64.tar.xz / .tar.gz	macOS. Macs with Apple silicon, macOS 13 or later.
pi-bolt-darwin-arm64-jit.tar.xz / .tar.gz	macOS, JIT also on.
pi-bolt-win32-x64.zip	Windows. Windows 10 (1809) or 11 on x64; compiled code on AVX2 CPUs, bytecode on others.
pi-bolt-win32-x64-jit.zip	Windows, JIT also on.
pi-bolt-runtime-linux-x64.tar.gz, pi-bolt-runtime-darwin-arm64.tar.gz, pi-bolt-runtime-win32-x64.zip	The Pi-Bolt Bun runtime, for compiling plugins in.

Linux x86-64 with glibc 2.17 or later; macOS 13 or later on Apple silicon; Windows 10 1809 or later, or Windows 11, on x64.

The runtimes

The engine changed (Windows, and 0.7.3's and 0.7.4's changes merged with it), so the runtimes of this release were built by
hand (RELEASING.md). From the engine trees that patches/webkit.patch and
patches/bun.patch make on the pinned sources (git rev-parse HEAD^{tree}): WebKit f527504e0d1d9f14c73b7aab4682fe44972507fa,
Bun 2c4f4980f78e0986a324aa46f648ce05542d9369.

Runtime	Built on	bun.exe / bun SHA-256
Windows x64	the maintainer's Windows 11 machine, Visual Studio 2022, LLVM 23.1, ThinLTO, Control Flow Guard	3770b10e74eb4036d5df080173ed54ae956de6891a1babfeab1b65953f4bb059
Linux x86-64	a Linux x86-64 VM (AMD EPYC 7B13), LLVM 23.1, ThinLTO, glibc 2.17 sysroot	fb9ee22ef65619272e3e8d5cfb80020b24590aac82d8bcbf705a301edfe8acc8
macOS arm64	the maintainer's MacBook Air (M5), LLVM 23.1, ThinLTO	24b6d7ffb4076db2fe4cfe67f65fda18f5c4aeb4e32f98c37b0ada5da0aeb785

A runtime is not yet built bit for bit the same twice, so these are what was built, not what anyone would get.