build(deps-dev): bump the npm-dependencies group across 1 directory with 2 updates

[dependabot]

Bumps the npm-dependencies group with 2 updates in the / directory: @earendil-works/pi-coding-agent and @types/node.

Updates @earendil-works/pi-coding-agent from 0.82.1 to 0.83.0

Release notes

Sourced from @​earendil-works/pi-coding-agent's releases.

v0.83.0

New Features

• Credential export for external clients — pi auth print-api-key and pi auth print-bearer-token export configured credentials with automatic OAuth refresh and minimum-validity enforcement.
• Headless OpenRouter sign-in — Complete /login over SSH by pasting the redirect URL or authorization code when the loopback callback is unavailable. See OpenRouter.
• Claude Opus 5 on GitHub Copilot — Use Claude Opus 5 through GitHub Copilot with adaptive thinking and a 1M context window. See GitHub Copilot.

Breaking Changes

• Upgraded bundled TypeBox aliases to 1.3.7, removing deprecated APIs including Type.Base, Type.Awaited, Type.Promise, Type.AsyncIterator, Type.Iterator, Type.Options, and Value.Mutate, while fixing compiled validation of nullable array tool arguments. Extensions using removed APIs must migrate to supported TypeBox APIs. See Package Dependencies (#7243 by @​petrroll).

Added

• Added pi auth print-api-key and pi auth print-bearer-token commands for exporting configured credentials to external clients, including automatic OAuth refresh and configurable minimum token validity (#7168).
• Exposed the session's resolved model scope as ctx.scopedModels to extensions. See Extension Context (#7191 by @​pungggi, #7215).
• Added inherited per-request fetch injection for supported text and image provider transports.
• Added the inherited "pending" stop reason for partial streaming messages. See Custom Provider Stream Pattern (#7151 by @​lucasmeijer).
• Added inherited raw provider stop reasons across Google, Anthropic, Amazon Bedrock, Mistral, and OpenAI streams; unmapped terminal reasons now surface as provider errors instead of successful stops (#7272).
• Added manual redirect URL and authorization-code entry to OpenRouter login for remote and headless environments. See OpenRouter (#7114 by @​rgarcia).
• Added inherited Claude Opus 5 support for GitHub Copilot with adaptive thinking and a 1M context window. See GitHub Copilot (#7158 by @​jay-aye-see-kay).

Changed

• Changed inherited OAuth credential resolution to refresh tokens with less than five minutes of validity remaining instead of waiting until expiration (#7168).

Fixed

• Added a status line when the tool output expansion is toggled (#7180).
• Fixed file-backed SYSTEM.md and APPEND_SYSTEM.md prompts being omitted from the interactive startup context listing. See System Prompt Files (#7096).
• Fixed context files loading twice when a linked Git worktree is nested under its main repository. See Context Files (#7221 by @​arajkumar).
• Fixed llama.cpp streamed responses reporting zero token usage and leaving session context accounting empty. See llama.cpp (#7258 by @​SteveImmanuel).
• Fixed session replacement and committed tree navigation during an active response to abort and persist the outgoing turn instead of leaving dangling tool calls. See Sessions (#7022 by @​tmustier).
• Fixed failed Git package installs leaving partial directories that blocked clean retries. See Install and Manage (#7210 by @​haoqixu).
• Fixed the /model selector retaining a stale selection while filtering instead of highlighting the top match (#7211 by @​christianbasch).
• Fixed direct RPC bash commands bypassing extension user_bash handlers. See User Bash Events (#7214).
• Fixed skills, prompts, and themes losing package source metadata after extensions reload resources. See Resource Events (#6968).
• Fixed cancellation of concurrently running user bash commands so every active command is aborted (#7103 by @​yzhg1983).
• Fixed duplicate messages appearing when extensions switch sessions during interactive startup (#7110 by @​yzhg1983).
• Fixed inherited Qwen Token Plan reasoning models to send their service-specific thinking controls and supported reasoning-effort levels (#6951, #6998).
• Fixed inherited Z.AI output limits being sent through an unsupported parameter. See Providers (#7174 by @​HyeokjaeLee).
• Fixed explicitly configured Amazon Bedrock profiles being overridden by ambient AWS access keys. See Amazon Bedrock (#7176 by @​christianbasch).
• Fixed inherited image fallback paths overflowing narrow terminals, shortened home-directory paths, and made absolute paths clickable when terminal hyperlinks are available (#7262).
• Fixed inherited OpenAI-compatible tool calls losing their function arguments when malformed deltas also contain an empty custom object (#7288 by @​sunnyyoung).

Changelog

Sourced from @​earendil-works/pi-coding-agent's changelog.

[0.83.0] - 2026-07-29

New Features

• Credential export for external clients — pi auth print-api-key and pi auth print-bearer-token export configured credentials with automatic OAuth refresh and minimum-validity enforcement.
• Headless OpenRouter sign-in — Complete /login over SSH by pasting the redirect URL or authorization code when the loopback callback is unavailable. See OpenRouter.
• Claude Opus 5 on GitHub Copilot — Use Claude Opus 5 through GitHub Copilot with adaptive thinking and a 1M context window. See GitHub Copilot.

Breaking Changes

• Upgraded bundled TypeBox aliases to 1.3.7, removing deprecated APIs including Type.Base, Type.Awaited, Type.Promise, Type.AsyncIterator, Type.Iterator, Type.Options, and Value.Mutate, while fixing compiled validation of nullable array tool arguments. Extensions using removed APIs must migrate to supported TypeBox APIs. See Package Dependencies (#7243 by @​petrroll).

Added

• Added pi auth print-api-key and pi auth print-bearer-token commands for exporting configured credentials to external clients, including automatic OAuth refresh and configurable minimum token validity (#7168).
• Exposed the session's resolved model scope as ctx.scopedModels to extensions. See Extension Context (#7191 by @​pungggi, #7215).
• Added inherited per-request fetch injection for supported text and image provider transports.
• Added the inherited "pending" stop reason for partial streaming messages. See Custom Provider Stream Pattern (#7151 by @​lucasmeijer).
• Added inherited raw provider stop reasons across Google, Anthropic, Amazon Bedrock, Mistral, and OpenAI streams; unmapped terminal reasons now surface as provider errors instead of successful stops (#7272).
• Added manual redirect URL and authorization-code entry to OpenRouter login for remote and headless environments. See OpenRouter (#7114 by @​rgarcia).
• Added inherited Claude Opus 5 support for GitHub Copilot with adaptive thinking and a 1M context window. See GitHub Copilot (#7158 by @​jay-aye-see-kay).

Changed

• Changed inherited OAuth credential resolution to refresh tokens with less than five minutes of validity remaining instead of waiting until expiration (#7168).

Fixed

• Added a status line when the tool output expansion is toggled (#7180).
• Fixed file-backed SYSTEM.md and APPEND_SYSTEM.md prompts being omitted from the interactive startup context listing. See System Prompt Files (#7096).
• Fixed context files loading twice when a linked Git worktree is nested under its main repository. See Context Files (#7221 by @​arajkumar).
• Fixed llama.cpp streamed responses reporting zero token usage and leaving session context accounting empty. See llama.cpp (#7258 by @​SteveImmanuel).
• Fixed session replacement and committed tree navigation during an active response to abort and persist the outgoing turn instead of leaving dangling tool calls. See Sessions (#7022 by @​tmustier).
• Fixed failed Git package installs leaving partial directories that blocked clean retries. See Install and Manage (#7210 by @​haoqixu).
• Fixed the /model selector retaining a stale selection while filtering instead of highlighting the top match (#7211 by @​christianbasch).
• Fixed direct RPC bash commands bypassing extension user_bash handlers. See User Bash Events (#7214).
• Fixed skills, prompts, and themes losing package source metadata after extensions reload resources. See Resource Events (#6968).
• Fixed cancellation of concurrently running user bash commands so every active command is aborted (#7103 by @​yzhg1983).
• Fixed duplicate messages appearing when extensions switch sessions during interactive startup (#7110 by @​yzhg1983).
• Fixed inherited Qwen Token Plan reasoning models to send their service-specific thinking controls and supported reasoning-effort levels (#6951, #6998).
• Fixed inherited Z.AI output limits being sent through an unsupported parameter. See Providers (#7174 by @​HyeokjaeLee).
• Fixed explicitly configured Amazon Bedrock profiles being overridden by ambient AWS access keys. See Amazon Bedrock (#7176 by @​christianbasch).
• Fixed inherited image fallback paths overflowing narrow terminals, shortened home-directory paths, and made absolute paths clickable when terminal hyperlinks are available (#7262).
• Fixed inherited OpenAI-compatible tool calls losing their function arguments when malformed deltas also contain an empty custom object (#7288 by @​sunnyyoung).

Commits

• 845d6ff Release v0.83.0
• f0499a6 docs: audit changelogs since v0.82.1
• bff5ab7 fix(coding-agent): show system prompt files in startup context (#7266)
• cced6a2 fix(coding-agent): stop loading AGENTS.md twice in nested git worktrees (#7221)
• f9476a6 fix(ai): update TypeBox nullable array validation (#7243)
• 0c32e83 fix(coding-agent): enable streaming usage for llama.cpp provider (#7258)
• 47ca25f Revert "fix(coding-agent): build-check-test (#7206)"
• 0d008b7 fix(coding-agent): show tool expansion status
• f145195 fix(coding-agent): build-check-test (#7206)
• cefa40e ***WIP it's a PoC *** fix(coding-agent): guard tree navigation during respons...
• Additional commits viewable in compare view

Updates @types/node from 26.1.1 to 26.1.2

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions