Pi-Bolt 1.0.9

Pi-Bolt 1.0.9 is a fix release: after /new, the screens of the old session no longer stay in memory, and the engine takes
the root certificates and blocked keys of Bun 1.4.4. Everything else is 1.0.8.

Fixed

• Memory after /new (#220 by
  @Shrub24): a component drawn inside several parents kept every parent it was ever drawn in,
  with their children and rendered lines, for as long as it lived. Across several /new in a long session that held old
  message trees (800 MB in one session). Parents are now held weakly and freed once Pi drops them; live parents still
  redraw when the component changes.

Changed

• TLS (#222): the bundled root certificates are those of NSS 3.131.1
  (118, against 121), and a certificate chain that holds a public key on Node's blocked list fails with CERT_REVOKED, as
  in Bun 1.4.4 and Node 22.23.4, 24.22.1 and 26.12.1. This applies to fetch (HTTP/3 included), node:tls, node:https
  and WebSocket.
• minimatch 11.0.1 (#221): package resource filters and model
  patterns match as before (5,724 patterns and paths compared with 10.2.6).

With the default settings Pi draws the same screens and sends the same requests as 1.0.8. The release archives on the
Apple M5, 1.0.8 / 1.0.9 (medians of 25 runs, 15 for the -jit build; a second copy of 1.0.8 varied as much):

	Instructions	CPU	Peak memory
pi --version	54 / 54 M	4.5 / 4.5 ms	19 / 19 MB
pi -p (5 model turns)	203 / 203 M	18.8 / 18.8 ms	53 / 53 MB
Interactive, 5 prompts	607 / 609 M	91 / 91 ms	64 / 64 MB
-jit build, pi -p	209 / 209 M	19.3 / 19.3 ms	53 / 53 MB

Ready to type: 30 / 29 ms.

Pi is 1.4.0. The runtimes are new: Bun's patch adds #222.

Install

curl -fsSL https://pi-bolt.opensec.in/install.sh | sh

irm https://pi-bolt.opensec.in/install.ps1 | iex

powershell -c "irm https://pi-bolt.opensec.in/install.ps1 | iex"

or pi-bolt update, or npm install -g --allow-scripts=pi-bolt pi-bolt, or bun add -g --trust pi-bolt, or:

• Homebrew (macOS on Apple silicon, Linux): brew install opensec-git/tap/pi-bolt
• Scoop (Windows): scoop bucket add opensec-git https://github.com/opensec-git/scoop-bucket, then scoop install opensec-git/pi-bolt
• mise: github:opensec-git/Pi-Bolt with the options in the installation guide

The installer checks the release signature with OpenSSL 3, ssh-keygen (OpenSSH 8.1 or later), or an installed Pi-Bolt.
Every archive also has a GitHub build attestation: gh attestation verify <file> -R opensec-git/Pi-Bolt.

Asset	For
pi-bolt-linux-x64.tar.xz / .tar.gz	Recommended on Linux x86-64. CPUs with AVX2 (Intel Haswell 2013+, AMD Zen+).
pi-bolt-linux-x64-baseline.tar.xz / .tar.gz	Any x86-64 CPU with SSE4.2.
pi-bolt-linux-x64-jit.tar.xz / .tar.gz	JIT also on, for plugins loaded at run time.
pi-bolt-linux-arm64.tar.xz / .tar.gz	Linux on ARM64, any 64-bit ARM CPU; Android in Termux, with the installer.
pi-bolt-linux-arm64-jit.tar.xz / .tar.gz	Linux on ARM64, JIT also on.
pi-bolt-darwin-arm64.tar.xz / .tar.gz	macOS. Macs with Apple silicon, macOS 13 or later.
pi-bolt-darwin-arm64-jit.tar.xz / .tar.gz	macOS, JIT also on.
pi-bolt-win32-x64.zip	Windows. Windows 10 (1809) or 11 on x64; compiled code on AVX2 CPUs, bytecode on others.
pi-bolt-win32-x64-jit.zip	Windows, JIT also on.
pi-bolt-runtime-linux-x64.tar.gz, pi-bolt-runtime-linux-arm64.tar.gz, pi-bolt-runtime-darwin-arm64.tar.gz, pi-bolt-runtime-win32-x64.zip	The Pi-Bolt Bun runtime, for compiling plugins in.
pi-bolt-kit-linux-x64.tar.gz, pi-bolt-kit-linux-arm64.tar.gz, pi-bolt-kit-darwin-arm64.tar.gz	What pi-bolt compile builds with, besides the runtime.
install.sh, install.ps1	The installers, listed in the signed SHA256SUMS: pi-bolt update runs them only after checking them.

Linux x86-64 or ARM64 with glibc 2.17 or later; Android 7 or later on 64-bit ARM, in Termux; macOS 13 or later on Apple silicon;
Windows 10 1809 or later, or Windows 11, on x64.