diff --git a/CHANGELOG.md b/CHANGELOG.md index 494109a..b218f0b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,15 +11,27 @@ Pre-v1.0.0 tags followed the pi npm version (`v{pi_version}[letter]`). --- -## Unreleased +## v1.11.0 — 2026-10-12 -### Components that move with the next build +Minor release. Headlines: **pi 1.1.0**, **secret env values are kept out of +model context by default** (pi-extensions `secret-guard`), an opt-in **AWS SSO +keeper** for long Bedrock runs, and **`~/.pi/agent/models.json` linked to a +mounted shared file** at every start. Everything else moves to its newest +upstream: pi-observational-memory `022da5e`, pi-atelier `v0.15.0`, pi-studio +`v0.9.63`. The base image is rebuilt (rootfs and `entrypoint-user.sh` changed), +so the base tools pinned to `latest` re-resolve too. -| Component | Baked in v1.10.2 | Next build | Why | +### Components that move with this release + +| Component | Baked in v1.10.2 | v1.11.0 | Why | |---|---|---|---| +| **pi** | `1.0.0` | **`1.1.0`** | audited, see *Changed* below | +| pi-obsmem | `731c3d4` | **`022da5e`** (pinned SHA, = `master`) | #81: compaction never drops unobserved context; #93: pi loads a prebuilt `dist/index.ts` (see *Changed*) | +| pi-atelier | `v0.13.0` (`34d26f1`) | **`v0.15.0`** (`3befe02`) | v0.14.0 Auto/Manual sidebar modes with auto-collapse; v0.15.0 starts in Manual, recolours panels, simpler Activity rows | +| skillset snapshot | `e9e45f7` | **`96b840e`** | provenance only: the vendored `SKILL.md` is byte-identical (sha256 `a1db86da…` at both refs) | | pi-extensions | `143a214` | **`a88fa99`** (or later: CI resolves `main` at build time) | new `aws-sso.ts` (keeps the Bedrock SSO session alive) and `secret-guard.ts` (keeps secret env values out of model context); both below | | pi-toolkit | `9c87ee8` | **`3760d90`** (or later: CI resolves `main` at build time) | `pi-task`: optional model fallback when the primary model fails auth before acting (below) | -| pi-studio | `v0.9.61` (`641aa32`) | **`v0.9.63`** (`fae3ad3`) | upstream releases (v0.9.62, v0.9.63), picked up by CI's newest-tag resolution; `-studio` variant only; **not reviewed yet**: [compare](https://github.com/omaclaren/pi-studio/compare/641aa3288a6bfd4a7eb37a3a4847836de85e0593...fae3ad38d23c9666981bfc29f9a4e06d56f8de84) | +| pi-studio | `v0.9.61` (`641aa32`) | **`v0.9.63`** (`fae3ad3`) | upstream releases (v0.9.62, v0.9.63), picked up by CI's newest-tag resolution; `-studio` variant only. Reviewed: browser-editor fixes only (WebKit cursor drift after re-wrap, re-layout after macOS autocorrect) plus `Ctrl+Shift+H` to toggle highlighting; peerDependencies unchanged: [compare](https://github.com/omaclaren/pi-studio/compare/641aa3288a6bfd4a7eb37a3a4847836de85e0593...fae3ad38d23c9666981bfc29f9a4e06d56f8de84) | ### Added @@ -135,6 +147,51 @@ Pre-v1.0.0 tags followed the pi npm version (`v{pi_version}[letter]`). providers"). Use `docker exec -it -u developer -e PI_AWS_SSO_NTFY=… pi-devbox bash -lc pi`. +### Changed + +- **pi `1.0.0` → `1.1.0`.** Audited 2026-10-12 against the published npm + tarballs, by the same method as the v1.10.2 audit (the full note is above + `ARG PI_VERSION` in `Dockerfile.variant`): + - The only `### Breaking Changes` section in 1.0.1..1.1.0 is 1.0.3's rename + of the `azure-openai-responses` provider to `azure`. Nothing here uses it. + - `finishTurn` handling in pi-agent-core is byte-identical between 1.0.0 and + 1.1.0. The six named `pi.*` APIs our extensions call (`registerTool`, + `registerCommand`, `registerFlag`, `getFlag`, `sendMessage`, + `sendUserMessage`) appear in the same dist files in both versions, and so do + the TUI internals atelier hooks. `engines.node` is unchanged. + - User-visible: `Home`/`End` now always move the editor cursor (fullscreen + transcript top/bottom moved to `Ctrl+Home`/`Ctrl+End`). Terminals that + support OSC 7501 now see pi's working/blocked/done status; set + `PI_PROGRAM_STATUS=0` to turn that off. + - Exercised before tagging with pi 1.1.0 from a temp prefix, in a real pty, + with `--no-extensions` controls: + - The obsmem turn cap held on the real 1.1.0 agent loop: uncapped ran 11 + turns, capped stopped at exactly 3. + - atelier v0.15.0 painted in both renderers (controls 0/3, every arm + render-proofed). + - obsmem `022da5e` registered `/om:status` and `/om:view`. + - All 11 pi-extensions `a88fa99` extensions loaded without error. +- **pi-observational-memory `731c3d4` → `022da5e`**, still a full-SHA pin; no + tag newer than 3.1.4 exists. + - #81 changes compaction. Entries the observer has not reached yet are no + longer cut out of context, and memory workers yield to the session. New + settings (`compactionMaxRetainedTokens`, `consolidateWhenIdle`, + `piAutoCompactionEnabled`) all have defaults, so nothing needs setting. + - #93 makes pi load a committed `dist/index.ts` bundle instead of 32 TS + sources, which is faster to start. + - `src/agents/` is unchanged between the two SHAs, so the workers' + `finishTurn` migration is intact. +- **pi-atelier `v0.13.0` → `v0.15.0`.** The sidebar now starts in **Manual** + mode. `/atelier sidebar auto` collapses it when the terminal is narrow and + reopens it when there is room. `showSidebarOnStartup` keeps its key and its + default. README's sidebar section describes both modes. +- **Base rebuilt** (`base-` changes because `rootfs/` and + `entrypoint-user.sh` changed). The base tools pinned to `latest` re-resolve. + Upstream on 2026-10-12: uv 0.13.0 (its breaking change makes Python 3.15 the + default *download*; mempalace still installs with `uv tool install` on + Debian's python3.13, which uv prefers because it is already installed), nvim + 0.12.6, fzf 0.74.5. `# BASE_REBUILD_DATE:` is updated while it is free. + ### Still open - `remote` mode end to end (code → push → approve on the phone) is unit-tested and @@ -148,6 +205,15 @@ Pre-v1.0.0 tags followed the pi npm version (`v{pi_version}[letter]`). a login then worked at once. - The real fix is administrative: the IdC admin can raise the session length (up to 90 days), after which the keeper has almost nothing to do. +- **The pi-obsmem pin does not bind CI builds.** `resolve-versions` in + `docker-publish.yml` still resolves `pi-observational-memory` from `master` + and passes it as `--build-arg PI_OBSMEM_REF`, which overrides the Dockerfile + default. This was verified on both sides with buildx: without the build-arg + the pin is baked, with it `master` is. The pin reached v1.9.5, v1.10.2 and + this release only because `master` equalled the pin at build time. + `check-doc-drift.sh` reads the ARG, so it would not notice a divergence. Fix + it by reading the pin from `Dockerfile.variant` in `resolve-versions`, the way + pi-atelier's tag already is. --- diff --git a/Dockerfile.base b/Dockerfile.base index 215503d..2faeb26 100644 --- a/Dockerfile.base +++ b/Dockerfile.base @@ -14,7 +14,7 @@ # content-addressed over this file, so any byte change invalidates the # cache. Recommended cadence: once per release for security updates. # -# BASE_REBUILD_DATE: 2026-09-22 (v1.9.4 — mempalace 3.9.0 -> 3.10.0 with ENV MEMPALACE_CONFIG_DIR pinning the layout, mempalace-toolkit 2167a1b explicit event_list order; previous marker 2026-09-19 / v1.9.3) +# BASE_REBUILD_DATE: 2026-10-12 (v1.11.0 — rootfs gains link-pi-models.sh, entrypoint-user.sh links models.json; base tools re-resolve `latest` (upstream on 2026-10-12: uv 0.13.0, nvim 0.12.6, fzf 0.74.5); previous marker 2026-09-22 / v1.9.4) # # ── Lineage note ───────────────────────────────────────────────────── # Adapted from opencode-devbox/Dockerfile.base (commit before v1.16.2). diff --git a/Dockerfile.variant b/Dockerfile.variant index 5305fd5..b3a24e7 100644 --- a/Dockerfile.variant +++ b/Dockerfile.variant @@ -231,7 +231,34 @@ ARG USER_NAME=developer # is documented (README -> "Terminal UI mode"): `"tuiMode": "regular"` in # ~/.pi/agent/settings.json, `pi --tui-mode regular` for one session, or the # same key in a project's .pi/settings.json. -ARG PI_VERSION=1.0.0 +# +# v1.11.0: 1.0.0 -> 1.1.0. MEASURED 2026-10-12 against the published npm +# tarballs for 1.0.0 and 1.1.0, unpacked side by side, by the same method as +# the v1.10.2 audit above: +# 1. ONE `### Breaking Changes` section in 1.0.1..1.1.0: 1.0.3 renamed the +# provider `azure-openai-responses` -> `azure`. 0 uses here: grepped +# rootfs/, ~/.pi/agent/settings.json, pi-toolkit's settings.example.json +# and the fleet's shared models.json. Everything else is additive or a fix +# (OSC 7501 program status, `+name`/`-name` in --tools, `durationMs` and +# `outputPad` in the tool render context, `aborted` on agent_settled). +# Two user-visible changes: Home/End always move the editor cursor +# (fullscreen transcript top/bottom moved to Ctrl+Home/Ctrl+End, 1.0.3), +# and OSC 7501 status reporting (PI_PROGRAM_STATUS=0 turns it off, 1.1.0). +# 2. pi-agent-core 1.0.0 -> 1.1.0: the finishTurn context in dist is +# BYTE-IDENTICAL; the only agent-loop diff adds `durationMs`. The obsmem +# turn-cap probe drove the real 1.1.0 agentLoop: uncapped ran its chosen +# 11 turns, maxTurns=3 stopped at exactly 3 + agent_end. +# 3. The 6 named pi.* APIs (registerTool, registerCommand, registerFlag, +# getFlag, sendMessage, sendUserMessage) appear in the same number of dist +# files in 1.0.0 and 1.1.0. atelier's internals TuiMainScreen and +# renderLayoutFrame are both still in 1.1.0's dist. +# 4. engines.node is still `>=22.19.0`; the image ships 24.x. +# Exercised before tagging, from a temp prefix with pi 1.1.0 and a throwaway +# PI_CODING_AGENT_DIR, in a real pty, with -ne controls: atelier v0.15.0 paints +# ACTIVITY/READY/TOOLS in BOTH renderers (controls 0/3, every arm render-proofed); +# obsmem 022da5e registers /om:status and /om:view (control: none); and all 11 +# pi-extensions a88fa99 extensions load with no error (control: no /aws-sso). +ARG PI_VERSION=1.1.0 ARG PI_TOOLKIT_REF=main ARG PI_EXTENSIONS_REF=main # Repo URLs default to the canonical gitea origin but are overridable so a @@ -253,7 +280,18 @@ ARG PI_OBSMEM_REPO=https://github.com/elpapi42/pi-observational-memory.git # 40-char match (SHA40), so a short pin would fall through to its # branch-or-tag lookup, fail, and downgrade that component's drift check to a # silent SKIP — a pin that reads fine and is no longer verified. -ARG PI_OBSMEM_REF=731c3d49288580f4d79cabdbfbc0d16b34db0f41 +# v1.11.0: 731c3d4 -> 022da5e (master, 2026-10-05; still no newer tag than +# 3.1.4). Two commits: #81 never drops unobserved context at compaction +# (new settings compactionMaxRetainedTokens, consolidateWhenIdle, +# piAutoCompactionEnabled, all defaulted), and #93 makes pi load a prebuilt +# dist/index.ts instead of 32 TS sources. The bundle is committed, so +# `npm install --omit=dev` below needs no build step. src/agents/ is +# UNCHANGED between the two SHAs, so the finishTurn migration is intact. +# KNOWN GAP, not fixed here: docker-publish.yml's resolve-versions still +# resolves obsmem from `master` and passes it as --build-arg, which overrides +# this default (verified two-sided on buildx 2026-10-12). CI builds therefore +# get the pin only while master == pin, as it is at this release. +ARG PI_OBSMEM_REF=022da5e5554d04dfdc876ed7dac4a42c6b83dfd4 # pi-atelier (TUI sidebar: ordered panels, split-pane, themes) is PINNED TO A # TAG, which CI resolves to that tag's commit SHA — same treatment as # pi-studio, for reproducibility plus cache-busting. @@ -332,9 +370,18 @@ ARG PI_ATELIER_REPO=https://github.com/michaelmjhhhh/pi-atelier.git # - Residual: v0.13.0 is SAME-DAY upstream (2026-10-02). Acceptance proves # the sidebar PAINTS with the two-sided check from 0.84.4/0.85.1 that can # tell "loaded" from "silently absent" — "no crash" is not the test. -ARG PI_ATELIER_REF=v0.13.0 +# +# v1.11.0: v0.13.0 -> v0.15.0 (v0.14.0 and v0.15.0 both 2026-10-03). The +# peerDependencies floor is unchanged (pi >=0.84.0), atelier still has zero +# runtime dependencies, and it still imports only the public package exports. +# Behaviour changes: v0.14.0 auto-collapses the Sidebar when the terminal is +# narrow (Auto/Manual modes). v0.15.0 starts in Manual mode, recolours the +# panels and simplifies the Activity rows. The startup preference is still +# `showSidebarOnStartup` (default true, src/config.ts:38). Painted in both +# renderers on pi 1.1.0 before tagging (see the PI_VERSION note). +ARG PI_ATELIER_REF=v0.15.0 # Human-readable tag PI_ATELIER_REF was resolved from; recorded as a label. -ARG PI_ATELIER_VERSION=v0.13.0 +ARG PI_ATELIER_VERSION=v0.15.0 RUN set -e && \ # git_fetch_ref: clone-equivalent helper that accepts EITHER a branch name @@ -659,7 +706,7 @@ ARG MEMPALACE_TOOLKIT_REF=main # no ~67-minute base rebuild. (scripts/check-base-hash.sh scans only # Dockerfile.base, so no folding into the base hash is required — nor would # it be correct, since this ARG changes nothing about the base's contents.) -ARG SKILLSET_SNAPSHOT_REF=e9e45f7acdde490c3b5d24ce5f508bff8785c2c7 +ARG SKILLSET_SNAPSHOT_REF=96b840ee43beca65a190772021a8ef370145cde1 # Dockerfile.base sets description="pi-devbox — base image (variant-independent)" # and every variant INHERITS it, so both published images used to advertise diff --git a/README.md b/README.md index 584a1c3..071d37b 100644 --- a/README.md +++ b/README.md @@ -464,7 +464,10 @@ pin the order yourself. The sidebar auto-hides below 92 terminal columns and keeps the main pane at least 64 columns wide, so a narrow terminal degrades to the plain TUI rather -than a squeezed one. +than a squeezed one. That is **Manual** mode, the default since atelier v0.15.0. +`/atelier sidebar auto` switches to **Auto** mode, which collapses the sidebar +when space is tight (below 124 columns at the default width) and reopens it at +132. Manual width adjustment is disabled in Auto mode. ## docker-compose.yml — basic shape @@ -1195,7 +1198,7 @@ persisted volumes survived, and pi runtime wiring is intact: ```bash ./scripts/recreate-sanity-check.sh # auto-detects variant ./scripts/recreate-sanity-check.sh --expected-image-version 1.8.9 # assert the pi-devbox release tag -./scripts/recreate-sanity-check.sh --expected-version 1.0.0 # assert the pi coding agent version +./scripts/recreate-sanity-check.sh --expected-version 1.1.0 # assert the pi coding agent version ``` Those are **two different versions**, and the flags are not interchangeable: @@ -1234,9 +1237,9 @@ resolved to `latest` at build time: | Component | Pin | Where | |---|---|---| -| pi | `1.0.0` | `ARG PI_VERSION` — `Dockerfile.variant` | -| pi-obsmem | `731c3d49288580f4d79cabdbfbc0d16b34db0f41` | `ARG PI_OBSMEM_REF` — `Dockerfile.variant` | -| pi-atelier | `v0.13.0` | `ARG PI_ATELIER_REF` — `Dockerfile.variant` | +| pi | `1.1.0` | `ARG PI_VERSION` — `Dockerfile.variant` | +| pi-obsmem | `022da5e5554d04dfdc876ed7dac4a42c6b83dfd4` | `ARG PI_OBSMEM_REF` — `Dockerfile.variant` | +| pi-atelier | `v0.15.0` | `ARG PI_ATELIER_REF` — `Dockerfile.variant` | | mempalace | `3.10.0` | `ARG MEMPALACE_VERSION` — `Dockerfile.base` | The objective is **not** to freeze versions. Bumping is routine — usually one