Pi 1.0 đã thay đổi những gì

/** * How the model reaches a tool. "Callable" means callable from other tools through * `ctx.executeTool()`, as the `codemode` tool does. * * - `direct`: declared to the model while active, and callable while active. * - `model-only`: declared to the model while active, never callable. Use it for orchestrating or *   interactive tools. * - `codemode`: callable whenever registered. Not declared to the model unless explicitly *   activated. Codemode tools list it in their description. * - `deferred`: like `codemode`, but codemode tools do not list it; tool search can find it. * - `hidden`: registered but unreachable. Activating it has no effect. * * `direct` and `model-only` tools are activated when they are registered; the others are not. * The active tool set (`getActiveTools`/`setActiveTools`) is the set declared to the model. */export type ToolExposure = "direct" | "model-only" | "codemode" | "deferred" | "hidden";

/** The tools of a session as {@link ToolDefinition.prepareLoadout} sees them. */export interface ToolLoadout {	/** Tools declared to the model (the active tools), in order, with their original descriptions. */	readonly declared: readonly AgentTool[];	/** Tools callable through `ctx.executeTool()`. */	readonly callable: readonly AgentTool[];	/** Every registered tool. */	readonly registered: readonly AgentTool[];	getExposure(name: string): ToolExposure;	getNamespace(name: string): ToolNamespace | undefined;	/** A tool's `promptGuidelines`. Hidden declarations leave them out of the system prompt. */	getPromptGuidelines(name: string): readonly string[];}/** Changes {@link ToolDefinition.prepareLoadout} makes to what the model sees. */export interface ToolLoadoutChanges {	/** Model-facing descriptions of declared tools, by tool name. */	descriptions?: Readonly<Record<string, string>>;	/**	 * Declared tools whose declarations requests leave out. They stay active and callable, and the	 * transcript still declares them, so the active set survives `/tree` and resume.	 */	hiddenDeclarations?: readonly string[];}

/** * JSON Schema of `structuredContent` in successful results. Tools that declare it should always * set `structuredContent`; codemode scripts then receive it instead of the text content. */outputSchema?: TSchema;/** * How the model reaches the tool. Default: `"direct"`. See {@link ToolExposure}. */exposure?: ToolExposure;/** Group the tool belongs to, for example its MCP server. */namespace?: ToolNamespace;/** * For tools that reach other tools (such as `codemode`, which calls them, and `tool_search`, which * loads them): which tools a call with `input` may reach. `"all"`, or the words of the input that * may name them, where a word refers to a tool or namespace whose name it contains, so words may * over-match. Extensions that register tools late, such as MCP servers that are still connecting, * use it from their `tool_call` handler to finish registering those tools before the call runs. */reachesTools?: (input: Record<string, unknown>) => "all" | readonly string[];/** Hints about what the tool does, for example from an MCP server. */annotations?: ToolAnnotations;/** * Whether registering the tool activates it. Default: `true` for `direct` and `model-only` tools; * other exposures are never activated on registration. A tool with `defaultActive: false` is * activated by naming it in `--tools` or the `defaultTools` setting, or with `setActiveTools()`. */defaultActive?: boolean;/** * Adjust how the loadout is presented to the model while this tool is active. Called whenever * the active tools change. Tools that orchestrate other tools use it, for example to list the * callable tools in their own description. */prepareLoadout?: (loadout: ToolLoadout) => ToolLoadoutChanges | undefined;

/** * Remove the declarations that `prepareLoadout` hooks hide from every request. The whole * transcript is filtered with the current set, so the projected declarations stay consistent * across requests and only change when the loadout does. */private _installHiddenDeclarationsProjection(): void {	const previousTransformContext = this.agent.transformContext;	this.agent.transformContext = async (messages, signal) => {		const transformed = previousTransformContext ? await previousTransformContext(messages, signal) : messages;		const hidden = this._hiddenDeclarations;		if (hidden.size === 0) return transformed;		return transformed.map((message) => {			if (message.role !== "system" || (!message.toolsAdded && !message.toolsRemoved)) return message;			const { toolsAdded, toolsRemoved, ...rest } = message;			const added = toolsAdded?.filter((tool) => !hidden.has(tool.name)) ?? [];			const removed = toolsRemoved?.filter((tool) => !hidden.has(tool.name)) ?? [];			return {				...rest,				...(added.length > 0 ? { toolsAdded: added } : {}),				...(removed.length > 0 ? { toolsRemoved: removed } : {}),			};		});	};}

private _restoreToolsFromTranscript(modifiers: readonly string[] = []): void {	this._pendingToolNames.clear();	// All system messages on the branch, including those before a compaction. Compaction snapshots	// are derived from these, so replaying them gives the current loadout.	const systemMessages = this.sessionManager		.getBranch()		.flatMap((entry) => (entry.type === "message" && entry.message.role === "system" ? [entry.message] : []));	// No recorded loadout: keep the current tools.	if (systemMessages.length === 0) return;	// Tools the branch ever added or removed. Removed tools stay inactive.	const mentioned = new Set(		systemMessages			.flatMap((message) => [...(message.toolsAdded ?? []), ...(message.toolsRemoved ?? [])])			.map((tool) => tool.name),	);	// Extension tools the branch never mentioned were registered after it recorded its loadout, so	// they are activated like newly registered tools. Built-in tools follow `defaultTools` instead.	const newTools = [...this._toolRegistry.keys()].filter(		(name) =>			!mentioned.has(name) && !this._baseToolDefinitions.has(name) && this._isActivatedOnRegistration(name),	);	// The recorded loadout plus the new tools, with `--tools +name`/`-name` applied.	const names = applyToolModifiers(		[...getCurrentTools(systemMessages).map((tool) => tool.name), ...newTools],		modifiers,	);	// Recorded tools that are not registered yet, such as MCP tools of servers still connecting, are	// activated when they register. Excluded tools never register, so they are not kept pending.	this._pendingToolNames = new Set(names.filter((name) => this._isAllowedTool(name)));	// Ignores names that are not registered.	this._setActiveTools(names);}

/** * Apply a prompt and tool loadout for the next request. Sets the executable tools and * returns a system message patching the prompt sections the model currently has (replayed * from `messages`), or undefined when the prompt is unchanged. Tool changes are declared by * the agent loop before the request. * * A forced prompt does not affect the transcript: the structured sections are still diffed * and persisted, and the forced text is projected onto the request by * {@link _installAgentForcedPromptProjection}. */private _preparePromptAndToolLoadout(	options: NormalizedBuildSystemPromptOptions,	messages: AgentMessage[] = this.agent.state.messages,): SystemMessage | undefined {	options.selectedTools = this._applyToolLoadout(options.selectedTools).map((tool) => tool.name);	// The tool list and rules must match the declarations the request carries.	options.hiddenTools = [...this._hiddenDeclarations];	const sections = diffSystemPromptSections(		getCurrentSystemMessage(messages)?.sections ?? {},		buildSystemPromptSections(options),	);	return sections ? { role: "system", content: "", sections, timestamp: Date.now() } : undefined;}

/** * Diff the sections the model currently has (replayed from the transcript, so never null) * against the desired ones. Returns a `SystemMessage.sections` patch, or undefined when * nothing changed. */export function diffSystemPromptSections(	previous: Record<string, string | null>,	current: SystemPromptSections,): Record<string, string | null> | undefined {	const patch: Record<string, string | null> = {};	for (const [name, text] of Object.entries(current)) {		if (previous[name] !== text) patch[name] = text;	}	for (const name of Object.keys(previous)) {		if (current[name] === undefined) patch[name] = null;	}	return Object.keys(patch).length > 0 ? patch : undefined;}

const NO_CHANGES: ToolStateChanges = { toolsAdded: [], toolsRemoved: [] };/** Copy a system message with its tool fields replaced by `changes`; empty lists omit the field. */function withToolChanges(message: SystemMessage, { toolsAdded, toolsRemoved }: ToolStateChanges): SystemMessage {	const { toolsAdded: _added, toolsRemoved: _removed, ...rest } = message;	return {		...rest,		...(toolsAdded.length > 0 ? { toolsAdded } : {}),		...(toolsRemoved.length > 0 ? { toolsRemoved } : {}),	};}

/** * Render a later system message for APIs that accept system messages mid-conversation. * Section changes are framed by name so the model can relate them to the leading prompt. * This framing is request-time only and may change between versions. */export function renderSystemMessageUpdate(message: SystemMessage): string {	const parts: string[] = [];	const text = contentText(message.content);	if (text.length > 0) parts.push(text);	for (const [name, value] of Object.entries(message.sections ?? {})) {		parts.push(			value === null				? `Removed system prompt section "${name}".`				: `Updated system prompt section "${name}":\n\n${value}`,		);	}	return parts.join("\n\n");}

/** * Rebuild the transcript for APIs without mid-conversation system messages: the replayed * system message leads, and every later system message is dropped. */export function collapseSystemMessages(context: TranscriptContext): TranscriptContext {	const head = getCurrentSystemMessage(context.messages);	const messages = context.messages.filter((message) => message.role !== "system");	return { messages: head ? [head, ...messages] : messages } as TranscriptContext;}/** Keep later system messages in place when the model accepts them; otherwise collapse them. */export function resolveTranscript(	context: TranscriptContext,	supportsMidConvoSystemMessages: boolean | undefined,): TranscriptContext {	return supportsMidConvoSystemMessages ? context : collapseSystemMessages(context);}

/** * How a transport can express tool changes after the first request. * * - `"none"`: only the top-level tool list exists; it always holds the current tools. * - `"additions"`: tools can be added at a later message, but not removed or redefined. * - `"changes"`: every tool, including the initial ones, is declared in place, and a later *   declaration under the same name replaces the earlier one. Removals are not expressible on *   the wire, so the transport announces them as text and the removed tools stay declared. */export type TranscriptToolSupport = "none" | "additions" | "changes";⋯ lược bớt dòng 231–241/** * Split tool declarations between the top-level request field and in-place changes. * * With `"changes"`, the top-level list stays empty and every system message, including the * leading one, declares its tools in place: an in-place declaration can replace an earlier * in-place one, but not a top-level one. With `"additions"`, a removal or redefinition cannot be * expressed in place, so the top-level list becomes the tool state after the last such change; * later additions stay anchored, and the cached prefix is invalidated once per removal instead * of on every later addition. With `"none"`, the top-level list is the current tool set. */export function resolveTranscriptTools(messages: TranscriptMessages, support: TranscriptToolSupport): TranscriptTools {	const systemMessages = messages.filter(isSystemMessage);	if (support === "none") {		return { requestTools: getCurrentTools(systemMessages), foldedSystemMessages: systemMessages.length };	}	if (support === "changes") return { requestTools: [], foldedSystemMessages: 0 };	const folded = Math.max(		getInitialSystemMessage(messages) ? 1 : 0,		findLastNonAdditiveToolChange(systemMessages) + 1,	);	return { requestTools: getCurrentTools(systemMessages.slice(0, folded)), foldedSystemMessages: folded };}

/** * Stable deferred tool declared whenever native tool changes are in use. Anthropic adds * hidden prompt scaffolding for mid-conversation tool changes; declaring this placeholder * from the first request keeps that scaffolding in the cached prefix, so the first tool * change does not invalidate the cache (measured: full miss without it). It is never * activated and the model cannot see it. */const DEFERRED_TOOL_PLACEHOLDER: BetaTool = {	name: "__pi_deferred_placeholder__",	description: "Reserved placeholder. Never available. Never call this.",	input_schema: { type: "object", properties: {}, required: [] },	defer_loading: true,};⋯ lược bớt dòng 214–1201	const initialTools = initialSystemMessage?.toolsAdded ?? [];	const nativeToolChanges =		compat.supportsMidConvoSystemMessages && compat.supportsMidConvoToolChanges && initialTools.length > 0;⋯ lược bớt dòng 1205–1263	const toolCacheControl = compat.supportsCacheControlOnTools ? cacheControl : undefined;	if (nativeToolChanges) {		// Initial tools stay active with the cache breakpoint on the last one, followed by the		// placeholder. The list never changes afterwards: later tools are defined by value in		// `tool_addition` blocks and withdrawn by `tool_removal`, so the cached prefix survives		// every tool change.		params.tools = [...convertToolDefinitions(initialTools, toolCacheControl), DEFERRED_TOOL_PLACEHOLDER];	} else {		const tools = getCurrentTools(context.messages);		if (tools.length > 0) {			params.tools = convertToolDefinitions(tools, toolCacheControl);		}	}

if (msg.role === "system") {	// Later system messages only reach this point when the model accepts them natively;	// otherwise the transcript was collapsed into the leading message before conversion.	const text = renderSystemMessageUpdate(msg);	const blocks: ContentBlockParam[] = [];	if (text.length > 0) blocks.push({ type: "text", text: sanitizeSurrogates(text) });	if (convertToolDefinitions) {		const added = msg.toolsAdded ?? [];		const redefined = new Set(added.map((tool) => tool.name));		for (const tool of msg.toolsRemoved ?? []) {			// A new definition under the same name replaces the old one, so no removal is needed.			if (redefined.has(tool.name)) continue;			blocks.push({				type: "tool_removal",				tool: { type: "tool_reference", name: isOAuthToken ? toClaudeCodeName(tool.name) : tool.name },			});		}		for (const definition of convertToolDefinitions(added)) {			blocks.push({ type: "tool_addition", tool: { type: "tool_definition", definition } });		}	}	if (blocks.length > 0) pendingSystemMessages.push({ role: "system", content: blocks });

/** * How a Responses transport expresses tool changes. * * `additional_tools` items accumulate: a later item adds tools and replaces same-name * definitions from earlier items, but it cannot replace a top-level tool and cannot remove any * tool (verified with strict schemas on the OpenAI, Codex, and Copilot backends, October 2026). * Like Codex, every tool is therefore declared in `additional_tools` items, starting with one * at the head of the input, and removals are announced as text. Synthetic tool search can * only add tools. Without mid-conversation system messages there is nothing to anchor. */export function getResponsesToolSupport(options: {	supportsMidConvoSystemMessages?: boolean;	supportsAdditionalTools?: boolean;	supportsToolSearch?: boolean;}): TranscriptToolSupport {	if (options.supportsMidConvoSystemMessages && options.supportsAdditionalTools) return "changes";	return options.supportsToolSearch ? "additions" : "none";}

const appendSystemToolAdditions = (message: SystemMessage, seed: string): void => {	const tools = message.toolsAdded ?? [];	for (const tool of tools) unavailableTools.delete(tool.name);	if (tools.length === 0) return;	if (toolSupport === "changes") {		if (declaredAdditionalTools) {			messages.push({ role: instructionRole, content: renderIncrementalToolsNotice(unavailableTools) });		}		declaredAdditionalTools = true;		messages.push({			type: "additional_tools",			role: "developer",			tools: convertResponsesTools(tools, options?.toolOptions),		} satisfies ResponseInputItem);		return;	}	if (toolSupport !== "additions") return;	const names = tools.map((tool) => tool.name);	const callId = `pi_tool_load_${shortHash(`${seed}:${names.join(",")}`)}`;	messages.push({		type: "tool_search_call",		call_id: callId,		execution: "client",		status: "completed",		arguments: { query: names.join(" "), limit: names.length },	} satisfies ResponseInputItem);	messages.push({		type: "tool_search_output",		call_id: callId,		execution: "client",		status: "completed",		tools: convertResponsesTools(tools, { ...options?.toolOptions, toolSearchResult: true }),	} satisfies ResponseToolSearchOutputItemParam);};

/** Streaming warming never continues past this long after the real request that started it. */const MAX_WARMING_AGE_MS = 60 * 60_000;/** Idle warming uses a shorter horizon because continuation estimates become less reliable with age. */const MAX_IDLE_WARMING_AGE_MS = 30 * 60_000;/** A refresh is sent only when it is expected to save at least this many dollars. */const CACHE_WARMING_MINIMUM_EXPECTED_SAVINGS = 0.05;/** * Chance that a real request arrives before the cache entry expires while the * agent sits idle. Measured from our own usage; per-session estimates were not * better than this constant. */const IDLE_CONTINUATION_PROBABILITY = 0.15;/** Refresh at 90% of the TTL while preserving at least ten seconds of margin. */export function getCacheWarmingDelayMs(ttlMs: number): number | undefined {	if (ttlMs <= 10_000) return undefined;	return Math.max(1, Math.floor(Math.min(ttlMs * 0.9, ttlMs - 10_000)));}/** * Lifetime of the prompt cache entry a request writes, from the model's * `promptCache` tier for the retention the request used. Undefined when the * model has no lifetime for that tier or caching is off. */export function getPromptCacheTtlMs(model: Model<Api>, options: SimpleStreamOptions | undefined): number | undefined {	const retention =		options?.cacheRetention ??		(getProviderEnvValue("PI_CACHE_RETENTION", options?.env) === "long" ? "long" : "short");	if (retention === "none") return undefined;	const seconds = model.promptCache?.[retention];	return seconds === undefined ? undefined : seconds * 1000;}

// Anthropic ephemeral entries have a hard five-minute lifetime; `ttl: "1h"`// extends it to one hour. Only direct Anthropic is annotated so cache warming// does not assume equivalent behavior through proxies.// https://docs.anthropic.com/en/docs/build-with-claude/prompt-cachingconst ANTHROPIC_PROMPT_CACHE: ModelPromptCache = { short: 300, long: 3600 };function applyPromptCacheMetadata(model: Model<Api>): void {	if (model.provider === "anthropic" && model.api === "anthropic-messages") {		model.promptCache = ANTHROPIC_PROMPT_CACHE;	}	// Do not add OpenAI lifetimes yet. Before enabling warming for explicit	// OpenAI caches, re-evaluate it using observed expiry, replay, and billing	// behavior; a documented TTL alone does not establish full cache loss.}

streamFn: async (model, context, options) => {	const requestOptions = buildRequestOptions(options);	// Compaction and summaries use their own routing ids; only session requests	// replace the cache entry, so warming restarts from them. Keep warming while	// the current transcript still extends the request's prefix. Agent state may	// shallow-copy the messages array or refresh the model object without changing	// the provider request, so top-level object identity is not a valid cache key.	if (options?.sessionId === sessionManager.getSessionId()) {		cacheWarmer.start({ model, context, options: requestOptions }, cacheContextIsCurrent(model));	}	return modelRuntime.streamSimple(model, context, requestOptions);},

private evaluate(run: ActiveRun): CacheWarmingDecision {	const model = run.model;	const promptTokens = lastPromptTokens(this.sessionManager.getBranch());	const cacheHitCost = price(model, { cacheRead: promptTokens });	const cacheMissCost = price(		model,		model.cost.cacheWrite > 0 ? { cacheWrite: promptTokens } : { input: promptTokens },	);	const warmCost = price(model, { cacheRead: promptTokens, output: 1 });	const missCost = Math.max(0, cacheMissCost - cacheHitCost);	const continuationProbability = run.phase === "idle" ? IDLE_CONTINUATION_PROBABILITY : 1;	const economicsAvailable = promptTokens > 0 && (cacheHitCost > 0 || cacheMissCost > 0);	const expectedSavings = continuationProbability * missCost - warmCost;	return {		phase: run.phase,		warmCost,		missCost,		continuationProbability,		expectedSavings,		economicsAvailable,		action: expectedSavings >= CACHE_WARMING_MINIMUM_EXPECTED_SAVINGS ? "warm" : "stop",	};}

export interface UsageEntry extends SessionEntryBase {	type: "usage";	/** Arbitrary usage category, such as "cache_warm". */	kind: string;	provider: string;	model: string;	usage: Usage;	/** Optional human-readable qualifier for usage notices. */	note?: string;}

const model = previous?.model ?? this.agent.state.model;const thinkingLevel = previous?.thinkingLevel ?? this.agent.state.thinkingLevel;if (!isVirtualModel(model)) return { ...previous, context, model, thinkingLevel };// The selection stays in agent state; only this request uses the routed model. A routing// failure rejects, which ends the run with an error response. Only messages the user wrote// start a turn; extension messages can follow them, e.g. from before_agent_start.const lastResponse = context.messages.findLastIndex((message) => message.role === "assistant");const userTurn = context.messages.slice(lastResponse + 1).some((message) => message.role === "user");const state = getVirtualModelState(this.sessionManager.getBranch(), model.provider, model.id);const route = await this._modelRuntime.resolveModel(model, convertToLlm(context.messages), {	reason: failed ? "retry" : userTurn ? "user" : "continuation",	thinkingLevel,	signal,	failed,	state,});if (route.state !== undefined && route.state !== state) {	const data: VirtualModelStateData = { provider: model.provider, modelId: model.id, state: route.state };	const entry = this.sessionManager.getEntry(		this.sessionManager.appendCustomEntry(VIRTUAL_MODEL_STATE_ENTRY, data),	);	if (entry) this._emit({ type: "entry_appended", entry });}// The route stands: the router already decided this request. The state entry does not change// the projection.if (this._exceedsCompactionThreshold(route.model, projection)) {	await this._runAutoCompaction("threshold", false);	({ previous, context } = await prepare());}return { ...previous, context, model: route.model, thinkingLevel: route.thinkingLevel };

export default function (pi: ExtensionAPI) {	pi.registerVirtualModel<JevState>({		provider: "jev",		id: "auto",		name: "Auto (Jev)",		thinkingLevels: ["low", "medium", "high", "xhigh"],		// Shared by all three models; shown before the first response.		contextWindow: 272_000,		maxTokens: 128_000,		async route(request, ctx) {			if (request.reason === "direct") return routeTo(request, ctx, LUNA);			const state = request.state;			if (!state) {				const model = await choosePlanningModel(request, ctx);				return routeTo(request, ctx, model, { phase: "planning", model });			}			// The planning model made the first edit: hand the rest of the work to Luna.			if (state.phase === "planning" && editedThisTurn(request.messages)) {				return routeTo(request, ctx, LUNA, { phase: "implementation", model: LUNA });			}			return routeTo(request, ctx, state.model);		},	});}

/** Image-generation model: usable with `generateImages()` only. */export interface ImageModel<TApi extends ImageApi> extends BaseModel<TApi> {	type: "image";	/** Output modalities. Always includes `"image"`; `"text"` means the model can also return text blocks. */	output: ("text" | "image")[];}/** Structured classifier model: usable with `classify()` only. */export interface ClassifierModel<TApi extends ClassifierApi> extends BaseModel<TApi> {	type: "classifier";	contextWindow: number;	/** Compatibility overrides for System One APIs. If not set, auto-detected from provider, baseUrl, and id. */	compat?: TApi extends "typesafe-system-one" | "cloudflare-workers-ai-system-one" ? SystemOneCompat : never;}/** Model shape for each model type. */export interface ModelTypeMap {	chat: Model<Api>;	image: ImageModel<ImageApi>;	classifier: ClassifierModel<ClassifierApi>;}/** What a catalog entry is for. Decides which `Models` operation accepts it. */export type ModelType = keyof ModelTypeMap;/** Anything a provider can list. Narrow with `isModelType()`. */export type AnyModel = ModelTypeMap[ModelType];

/** Present when the provider supports dedicated image models. Never rejects. */generateImages?(	model: ImageModel<ImageApi>,	context: ImagesContext,	options?: ImagesOptions,): Promise<AssistantImages>;/** Present when the provider supports structured classifier models. Never rejects. */classify?(	model: ClassifierModel<ClassifierApi>,	context: ClassifierContext,	options?: ClassifierOptions,): Promise<ClassifierResult>;

async generateImages(	model: ImageModel<ImageApi>,	context: ImagesContext,	options?: ModelsImagesOptions,): Promise<AssistantImages> {	try {		assertImageModel(model);		const prepared = await this.prepareRequest(model, options);		if (!prepared.provider.generateImages) {			throw new ModelsError("provider", `Provider ${model.provider} does not support image generation`);		}		return await prepared.provider.generateImages(prepared.model, context, prepared.options as ImagesOptions);	} catch (error) {		return imageErrorResult(model, error, options?.signal?.aborted);	}}async classify(	model: ClassifierModel<ClassifierApi>,	context: ClassifierContext,	options?: ModelsClassifierOptions,): Promise<ClassifierResult> {	try {		assertClassifierModel(model);		assertClassifierInputSupported(model, context);		const prepared = await this.prepareRequest(model, options);		if (!prepared.provider.classify) {			throw new ModelsError("provider", `Provider ${model.provider} does not support classification`);		}		return await prepared.provider.classify(prepared.model, context, prepared.options as ClassifierOptions);	} catch (error) {		return classifierErrorResult(model, error, options?.signal?.aborted);	}}

## Supply-chain hardeningWe treat npm dependency changes as reviewed code changes.- Direct external dependencies are pinned to exact versions. Internal workspace packages remain version-ranged.- `.npmrc` sets `save-exact=true` and `min-release-age=2` to avoid same-day dependency releases during npm resolution.- `package-lock.json` is the dependency ground truth. Pre-commit blocks accidental lockfile commits unless `PI_ALLOW_LOCKFILE_CHANGE=1` is set.- `npm run check` verifies pinned direct deps, native TypeScript import compatibility, and the generated coding-agent install lock.- The pi.dev installer installs from `packages/coding-agent/install-lock/`, generated from the root lockfile, to pin transitive deps. The npm package does not pin transitive deps.- Local release smoke tests and npm publication use the same tarball packer; npm publishes the validated tarballs rather than repacking workspace directories.- Local release installs, documented npm installs, and `pi update --self` use `--ignore-scripts` where supported.- CI installs with `npm ci --ignore-scripts`, and a scheduled GitHub workflow runs `npm audit --omit=dev` plus `npm audit signatures --omit=dev`.- Install lock generation has an explicit allowlist for dependency lifecycle scripts; new lifecycle-script deps fail checks until reviewed.

{	"name": "@earendil-works/pi-coding-agent-install",	"version": "1.4.0",	"private": true,	"description": "Lockfile root used by the Pi installer and updater.",	"dependencies": {		"@earendil-works/pi-coding-agent": "1.4.0"	},	"overrides": {		"protobufjs": "7.6.6"	},	"engines": {		"node": ">=22.19.0"	}}

const allowedInstallScriptPackages = new Map([	["@google/genai@2.21.0", "preinstall is a no-op in the published package"],	["protobufjs@7.6.6", "postinstall only warns about protobufjs version scheme mismatches"],]);⋯ lược bớt dòng 21–318		if (entry.hasInstallScript) {			if (!packageName || !entry.version) {				errors.push(`${lockPath || "root"} has install scripts but no package name/version`);			} else {				const packageId = `${packageName}@${entry.version}`;				if (allowedInstallScriptPackages.has(packageId)) {					seenAllowedInstallScriptPackages.add(packageId);				} else {					errors.push(						`${lockPath} has install scripts (${packageId}). Review it and add it to allowedInstallScriptPackages if intentional.`,					);				}			}		}	}	for (const packageId of allowedInstallScriptPackages.keys()) {		if (!seenAllowedInstallScriptPackages.has(packageId)) {			errors.push(`allowed install-script package ${packageId} is no longer present; remove it from the allowlist`);		}	}

const releaseUrl = `${installerApiBase}/${encodeURIComponent(version)}`;const stagingRoot = join(managedRoot, "staging");const releasesRoot = join(managedRoot, "releases");mkdirSync(releasesRoot, { recursive: true });const releaseDir = join(releasesRoot, version);if (existsSync(releaseDir)) {	verifyManagedRelease(releaseDir, version);	activateManagedRelease(managedRoot, version);	pruneManagedReleases(managedRoot, version);	return;}mkdirSync(stagingRoot, { recursive: true });stageDir = mkdtempSync(join(stagingRoot, "update-"));const [packageJsonContent, packageLockContent] = await Promise.all([	fetchInstallerArtifact(`${releaseUrl}/package.json`, "package.json"),	fetchInstallerArtifact(`${releaseUrl}/package-lock.json`, "package-lock.json"),]);writeFileSync(join(stageDir, "package.json"), packageJsonContent);writeFileSync(join(stageDir, "package-lock.json"), packageLockContent);await runManagedNpmCi(stageDir);verifyManagedRelease(stageDir, version);renameSync(stageDir, releaseDir);activateManagedRelease(managedRoot, version);pruneManagedReleases(managedRoot, version);

let  nodejs = nodejs_22;  packageJson = lib.importJSON (source + "/packages/coding-agent/package.json");  # Lockfile root used by the pi.dev installer. It pins the coding agent's  # runtime dependency tree and is kept in sync with package-lock.json by  # `npm run check`.  installLock = source + "/packages/coding-agent/install-lock";  modelCatalogPin = lib.importJSON ./model-catalog.json;  modelCatalog = fetchurl {    name = "pi-model-catalog.json";    # The typed catalog is the representation whose bytes the revision hashes.    url = "https://pi.dev/api/models/revisions/${modelCatalogPin.revision}?types=chat,image,classifier";    sha256 = lib.removePrefix "sha256-" modelCatalogPin.revision;  };

/** * Effort for the reply being generated. When set, the thinking level is sent as * configuration_update items instead of a changing reasoning.effort, which would invalidate the * prompt cache. Each item sets the effort from that point on: one goes before every earlier * reply with the level recorded on it (`providerThinkingLevel`), and one with this effort goes * at the end. Earlier input therefore never changes. OpenAI documents the item before user * messages only. After tool results it was verified on gpt-6-luna (October 2026) to be accepted * and to apply to the next reply. */configurationUpdateEffort?: string;