#273 build(deps-dev): bump @earendil-works/pi-tui from 1.4.0 to 1.5.0

Sourced from @​earendil-works/pi-tui's releases.

v1.5.0

New Features

• Extension update changelogs: see what changed in installed extension packages on the next fresh launch after an update. Package authors can choose the changelog path, and collapseChangelog condenses the notices. See Show a changelog.
• Faster streaming: large tool calls are parsed incrementally, and code-heavy answers and tool rows reuse highlighting and rendered Markdown instead of repeating the work on every update. See Keep rendering responsive.
• Custom self-update commands: use PI_SELF_UPDATE_COMMAND or selfUpdateCommand to update pi through a wrapper or another package manager. See Custom update command.
• GPT-6.1 Terra: available through OpenAI, Azure OpenAI Responses, and OpenAI Codex, with tool search, mid-conversation thinking-level changes, and thinking off. Codex offers a 500K context window. See Models.

Breaking Changes

• Tool argument validation runs on @earendil-works/pi-schema. TypeBox features outside JSON Schema (Type.Refine(), Type.BigInt(), Type.Undefined(), codecs, Format.Set() formats) no longer apply to tool arguments; see Tool parameter schemas and TypeBox. Plain JSON Schema tools, including MCP tools, now get the same coercion as TypeBox tools, such as converting numeric strings and wrapping a single value into an array. Validation failures the model sees list pi-schema's messages (- path: missing, - limit: expected number, got string) instead of TypeBox's (must have required properties path, must be number).

Added

• Extension packages can now show their changelog after an update. Pi reads pi.changelogPath from the package's package.json, or CHANGELOG.md in the package root, and on the next fresh launch shows entries newer than the last seen version under "Extension Updates". The collapseChangelog setting condenses this to one line per package (#5958, #8790)
• pi.exec() accepts a maxBuffer option that limits stdout and stderr combined, and its result has a truncated field that is true when output exceeded the limit (#11360)
• Device-code login (for example GitHub Copilot) now opens the verification page and copies the code when you press Enter. Providers can turn either action off with openBrowserOnConfirm: false or copyCodeOnConfirm: false (#9282, #9301)
• pi update can update Pi through a wrapper or another package manager. Set PI_SELF_UPDATE_COMMAND (for example mise use -g npm:{packageName}@{version}) or the global selfUpdateCommand setting; pi update runs it when pi.dev reports a newer release and fills {packageName}, {version}, and {installSpec} from that release. See Custom update command (#7756, #5607)
• Extensions can format the user's configured keybindings with keyText() and keyHint() from the tool render context and the message and entry renderer options. Importing these functions from @earendil-works/pi-coding-agent can resolve the extension's own copy of the package, which does not see pi's keybindings, so hints such as keyHint("app.tools.expand", "to expand") rendered without the key. The docs now recommend the injected functions (#4748)
• Added persisted session-entry messageId and ISO timestamp to MarkdownTransformContext. They are available when rendering saved entries and undefined for live rendering (#7952 by @​vipentti)
• Added a blocked option to inline ctx.ui.custom() components so approval prompts and other custom dialogs can report that pi is waiting for user input. Overlays ignore the option. See Custom screens and overlays (#11428)
• Added Usage.cost.totalFromProvider to distinguish billed totals from catalog estimates in SDK and extension usage data; combined usage is marked provider-reported only when every part is (#11178)
• Added concrete responseModel metadata to messages from pi-messages providers such as Radius, including when a virtual model is requested. See AssistantMessage (#11265)
• Added GPT-6.1 Terra for OpenAI, Azure OpenAI Responses, and OpenAI Codex, with tool search and mid-conversation thinking-level changes. It supports thinking off; Codex offers a 500K context window

Changed

• Extensions keep importing Type, Static and TSchema from @earendil-works/pi-ai: Pi maps that import to pi-ai's compat entry plus the TypeBox it bundles, now that pi-ai itself no longer re-exports TypeBox, and its StringEnum there stays a TypeBox TUnsafe<T>. The built-in tool factories (createReadTool() and the others) return TypeBoxAgentTool<typeof schema>, which keeps params typed for TypeBox.
• Tightened system prompt
• pi update for installs from the pi.dev installer no longer passes --min-release-age=0 to npm ci. The release lockfile pins every package, so the flag had no effect, and security scanners that block it stopped the update (#11262)
• /model and /scoped-models now show a model's name next to its ID when the name adds words the ID lacks, such as a renamed models.json override (#5916, #11347)
• MCP OAuth sign-in now uses pi's Client ID Metadata Document by default when the authorization server supports it for public clients, and registers a client dynamically otherwise, like Codex, Claude Code, and opencode. Clients registered before stay in use while their redirect URI matches. The new default oauth.clientRegistration: "auto" registers when clientName or a non-default callbackUrl is set; "dcr" always registers. pi mcp add --oauth-client-registration sets the mode (#11426)
• Changed the default OpenAI model from gpt-5.5 to gpt-6.1-sol, including after ChatGPT sign-in when no model is selected (#11442)
• Updated the built-in model catalog to models.dev v2. Realtime and image-only models are no longer offered as chat models; newer OpenAI and Google chat models are included

Fixed

• Updated glob matching to prevent denial of service from amplified glob patterns.
• Fixed a saved "Do not trust" decision being ignored for projects without trust-requiring resources, for example a folder with only AGENTS.md. pi auto-trusted such projects, so ctx.isProjectTrusted() returned true and package commands treated them as trusted. A saved decision in trust.json now takes precedence; auto-trust applies only when no decision is saved (#10947)
• Fixed Shift+Enter queueing a follow-up instead of inserting a newline in Apple Terminal setups that send ESC + Return. pi now checks the local Shift key state for that sequence, as it already did for plain Return; Alt+Enter without Shift still queues a follow-up (#11559)
• Fixed the working status (OSC 7501) disappearing in Rex and iTerm2 during runs in regular TUI mode. Rendered messages wrote OSC 133 prompt markers to the terminal, which the terminal treats as a new shell prompt; regular mode no longer writes them (#11519)
• Fixed compaction, branch summaries, and bug-report summaries in SDK sessions passing the stored OAuth token back to the model runtime as an explicit API key. Provider auth that treats explicit keys differently from stored OAuth now sees the OAuth login, as normal prompts do (#11520)
• Fixed a redundant system prompt update (tools, rules) when an extension set the same active tools in a different order, for example a reversed pi.setActiveTools() list. Tools that stay active now keep their order and newly activated tools are appended (#11495)
• Fixed pi.exec() crashing pi with RangeError: Invalid string length when a command printed more output than fits in a string. The default output cap is the smaller of 256 MiB and the runtime string limit; past the cap, the command is terminated and the result has truncated: true and a nonzero exit code (#11360)
• Fixed pi.exec() never returning when a command ignored SIGTERM after a timeout or abort. pi now sends SIGKILL 5 seconds later, as intended
• Fixed pi install and pi remove adding ever deeper nested entries to the npm package-lock.json when the agent directory is reached through a symlink, such as ~/.pi linked into a dotfiles repo. pi now passes the resolved real path to npm (#11358)
• MCP sign-in now rejects authorization endpoints and other OAuth metadata URLs that are not http: or https:. Before, a malicious MCP server could supply a file: or custom protocol URL, which pi passed to the platform URL handler.
• Automatic fd and rg downloads no longer fetch x86-64 binaries on ARM32 and other architectures without a prebuilt release. pi now warns and recommends installing the tool with the system package manager (#11209)
• Fixed /model search ranking letters scattered over an earlier part of an entry above a real match, for example opus listing gpt-oss-120b and claude-sonnet-4.5 before claude-opus-4.1 (#11220, #11296)
• Fixed /resume search matching scattered letters anywhere in session messages and IDs, for example 1024 matching inside a session UUID. Session names and working directories still match fuzzily; IDs and message text now match only as exact substrings (#11220, #11024, #11296)

... (truncated)

Sourced from @​earendil-works/pi-tui's changelog.

[1.5.0] - 2026-11-02

Added

• Added replaceControlCharacters() to replace runs of C0 and C1 control characters with a space
• Added Component.capturesViewportInput. While a component that sets it has focus, TuiAltScreen sends viewport keys such as PageUp/PageDown to it instead of scrolling the transcript, as it already does for focused overlays. SelectList, SettingsList, and Editor with open autocomplete set it (#7629, based on #7680 by @​muyiyr)
• Added getSelectPageIndex() to compute the selection after a tui.select.pageUp or tui.select.pageDown key (#7629, based on #7680 by @​muyiyr)

Fixed

• Fixed Shift+Enter queueing a follow-up in Apple Terminal setups that send ESC + Return. When local native Shift detection is available (Apple Terminal, native Windows), ProcessTerminal now treats ESC + Return with Shift held as Shift+Enter; without Shift it remains Alt+Enter (#11559)
• Fixed regular-mode TUI writing OSC 133 prompt markers from rendered lines to the terminal. Terminals treat 133;A as a new shell prompt and drop the OSC 7501 program status, so the working indicator disappeared during runs. Fullscreen still uses the markers for prompt navigation and already stripped them (#11519)
• Fixed fullscreen double-click selection splitting paths and tokens at ~, ., \, and +. Word characters now match iTerm2's defaults (#10980)
• Fixed fuzzyMatch() ranking a query scattered over an earlier part of the text above a contiguous match later in it. It now also scores each contiguous occurrence of the query and keeps the best alignment (#11220, #11296)
• Fixed ProcessTerminal.setTitle() writing control characters from the title, which could end the title sequence and send the rest to the terminal as escape sequences
• Fixed display math wider than the content width being wrapped row by row, which split fractions and sums apart. It now falls back to the raw LaTeX source (#11483)
• Fixed tui.select.pageUp and tui.select.pageDown being ignored by SelectList, SettingsList, and editor autocomplete (#7629, based on #7680 by @​muyiyr)
• Fixed wrapTextWithAnsi() starting the next line with a space when a styled word ended exactly at the wrap width, and strikethrough continuing into the right padding of wrapped lines (#10925)
• Fixed Markdown styling, highlighting, and wrapping every block on each render. It now reuses the top-level blocks of its last render, so a streaming message renders only its changed last block, and a resize reuses highlighted code. Reused blocks are held weakly and dropped by invalidate(), which a theme change must call because MarkdownTheme.highlightCode results are reused until then (#10971)
• Fixed Text.setText() with unchanged text dropping the wrapped lines, so renderers that set the same text on every update wrapped it again (#10971)
• Fixed Orca terminals falling back to text for inline images. Orca is now recognized as supporting true color and hyperlinks, and Kitty images when it advertises ORCA_IMAGE_PROTOCOL=kitty (#9329 by @​XRX193)
• Fixed bare Markdown URLs swallowing following CJK punctuation and text; explicit Markdown links and angle autolinks are unchanged (#10934 by @​haoqixu)
• Fixed Kitty-protocol F1–F12 shortcuts, including modified function keys, not being recognized, and F13+ and other functional keys inserting invisible private-use characters into the editor (#11419, #11345)
• Fixed Kitty images inside padded or colored boxes disappearing when their first row scrolled above the fullscreen viewport. Partially visible images are now cropped correctly, including beside other text
• Fixed deeply nested Markdown blockquotes producing exponentially many lines, hanging or crashing rendering once their borders exhausted the available width (#11272)

• f9a2636 Release v1.5.0
• ddbe02c docs: audit changelogs and add release highlights
• 0f21a33 fix(coding-agent,tui): reuse syntax highlighting and rendered Markdown blocks
• b4c2e92 fix: remove vulnerable dependency chains
• f09d01b fix(tui): detect Orca terminals as Kitty-image capable (#9329)
• 2ce9d52 fix(tui): drop space after styled word at wrap boundary, reset strikethrough ...
• 86dc686 fix(tui): treat ESC+Return with native Shift held as Shift+Enter
• 19ce805 fix(tui): stop writing OSC 133 prompt markers in regular mode (#11565)
• 3bae852 fix(tui,coding-agent): handle selection page keys in all scrolling lists
• fa16851 fix(tui): stop bare URLs at CJK punctuation (#10934)
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)