release(v1.12.2): pi 1.4.0, pi-studio v0.11.1, Node 24.22.1 + git-lfs 3.8.1 security

Patch release. pi 1.3.0 -> 1.4.0 (audited, notes next to ARG PI_VERSION in
Dockerfile.variant). pi-studio v0.10.2 -> v0.11.1 (-studio tags; pane echo
now defaults to Summary, see Upgrade notes). The base rebuilds because
rootfs/ changed (8ae1659), so Node v24.22.1 (8 CVEs), git-lfs v3.8.1
(4 CVEs), uv 0.13.5 and agent-browser 0.39.2 come in from latest.
BASE_REBUILD_DATE marker refreshed while the base rebuilds anyway.
check-doc-drift.sh: OK (pi-version and pi-studio named above v1.12.1).

CHANGELOG.md

@@ -11,6 +11,136 @@ Pre-v1.0.0 tags followed the pi npm version (`v{pi_version}[letter]`).
 
 ---
 
+## v1.12.2 — 2026-10-22
+
+Patch release. Headline: **pi `1.4.0`** (audited, see *Changed* below), plus
+two upstream **security releases** baked into the base image: **Node
+`v24.22.1`** (8 CVEs) and **git-lfs `v3.8.1`** (4 CVEs). Also **pi-studio
+`v0.11.1`** (`-studio` tags only), uv `0.13.5`, agent-browser `0.39.2`, and
+`~/.ssh/config` is Included even if it appears after start (*Fixed*, below).
+Surveyed 2026-10-22. Unchanged since v1.12.1: mempalace `3.11.0` (PyPI
+`latest`), pi-atelier `v0.16.0` (`3b42825`, newest tag),
+pi-observational-memory `022da5e` (= `master`), pi-toolkit `7c05901`,
+pi-extensions `4c1d28d`, pi-fork `e69725c`, mempalace-toolkit `d5a03f4`. The
+skillset snapshot needs no refresh (`vendor-mempalace-skill.sh --check`: OK,
+still `96b840e`). The base image is rebuilt because `rootfs/` changed, so apt
+and the base tools pinned to `latest` re-resolve. Of those, Node, git-lfs, uv
+and agent-browser moved upstream (*Changed*, below). gitea-mcp `v1.10.0`, nvim
+`0.12.6`, fzf `0.74.5`, gitleaks `8.30.1`, bat `0.26.1`, eza `0.23.5`, zoxide
+`0.10.0`, gosu `1.19`, micro `2.0.15`, tealdeer `1.9.0`, typst `0.15.1`, yq
+`4.54.1` and playwright `1.64.1` match their newest releases. Each was compared
+against the v1.12.1 image on tor-ms22.
+
+### Components that move with this release
+
+| Component | Baked in v1.12.1 | v1.12.2 | Why |
+|---|---|---|---|
+| **pi** | `1.3.0` | **`1.4.0`** | audited, see *Changed* below |
+| **pi-studio** (`-studio` tags) | `v0.10.2` (`4b4abd1`) | **`v0.11.1`** (`8a410b4`) | newest tag, see *Changed* below |
+| **Node** (base) | `v24.22.0` | **`v24.22.1`** (or later: NodeSource `node_24.x` at build time) | security release, see *Changed* below |
+| **git-lfs** (base) | `v3.8.0` | **`v3.8.1`** (or later: `latest` at build time) | security release, see *Changed* below |
+| uv (base) | `0.13.1` | **`0.13.5`** (or later: `latest` at build time) | see *Changed* below |
+| agent-browser (base) | `0.39.1` | **`0.39.2`** (or later: `latest` at build time) | see *Changed* below |
+
+### Upgrade notes
+
+- **pi-studio's REPL pane now echoes each send by default** (`-studio` tags
+  only). From 0.11.0, *Pane echo* defaults to **Summary**, as in pi-repl: the
+  tmux pane shows each submitted block (up to 20 lines or 2,000 characters)
+  above its output. Before, the default was **Off**. The same default applies
+  to the agent's `studio_repl_send` tool when it passes no `echoMode`. A choice
+  of **Full** made in Studio is kept. To get the old quiet pane back, choose
+  **Off** under the REPL pane's **More**, or set
+  `PI_STUDIO_REPL_ECHO_MODE=off` for the agent tool. What Studio *records* is
+  unchanged: only the code and its output.
+
+### Changed
+
+- **pi `1.3.0` → `1.4.0`** (npm `latest`, published 2026-10-21). No breaking
+  changes listed. Fixes that land on how this fleet uses pi: compaction and
+  branch summaries no longer fail with "generation hit the token cap" when
+  reasoning uses most of the old fixed summary limit (#9512, #9075); resumed
+  sessions and `/tree` no longer leave extension tools inactive (#11062); a
+  session no longer breaks after recovering from a reply cut off at the output
+  limit (#11227); codemode scripts wait up to 60 s for a free worker instead
+  of failing (#11184); the terminal is restored when pi exits without its
+  normal teardown (#11170); concurrent extension dialogs no longer lose a
+  promise (#11166); the `grep` tool runs `rg --no-config` (#11203); and
+  extensions can import `@earendil-works/pi-ai/models` (#11156). Audited
+  2026-10-22 on tor-ms22. The only API changes that could reach us are the
+  attribution headers that `before_provider_headers` handlers no longer see,
+  `generateSummary()` ignoring `reserveTokens`, and two removed exports
+  (`mergeProviderAttributionHeaders`, `getPiUserAgent`). None is used by any
+  companion, fleet extension or mempalace-toolkit. pi-agent-core changes only
+  by the new optional `identity` field, so obsmem's `finishTurn` turn cap is
+  untouched. All 58 names our extensions import from pi resolve in 1.4.0.
+  With a copy of tor-ms22's real `~/.pi/agent`, `pi -p` exits 0 with nothing
+  on stderr. The TUI loads the same extensions as on 1.3.0, with no
+  extension issues. Atelier paints in both renderers, and the bridge registers
+  its 45 tools. Full audit next to `ARG PI_VERSION` in `Dockerfile.variant`.
+- **pi-studio `v0.10.2` → `v0.11.1`** (`8a410b4`, `-studio` tags only). Five
+  upstream releases, 2026-10-19 to 2026-10-22. 0.10.3: IPython prints a value
+  once (`Out[5]: …`), not twice, and after a Quick send the cursor returns to
+  the input box. 0.10.4: Stop works again on a Mac that has a process running
+  as `nobody`. That was a 0.10.2 regression: macOS lists that uid as `-2`, and
+  the 0.10.2 parser refused to stop anything. **It does not affect the
+  image**: inside the container, `ps` shows only the container's own
+  processes, and none has a negative uid. Measured 2026-10-19 on tor-ms22.
+  0.10.2's own `readStopProcessTable` parsed the live process table (9 rows,
+  min uid 1000). Control: a macOS-style `-2` row made it throw "Could not parse
+  process ownership data". 0.10.5: the Quick-send result shows while the
+  cursor stays in the box, and the Prompt toolbar fits on one row on a
+  13-inch screen. 0.11.0: the REPL pane runs Ruby (irb), Java (JShell), Octave,
+  MATLAB, gnuplot and C++ (Cling) when they are on `PATH` (none is baked into
+  this image), a send ends within seconds when its runtime crashes instead of
+  waiting out the 20 s timeout, and the pane-echo default changes (see
+  *Upgrade notes*). 0.11.1: a shorter run status beside **Stop**, and the line
+  above a response shows which one you are on ("9/9"). Dependencies are
+  unchanged: `package-lock.json` differs from 0.10.2's only in the package's
+  own version, and `ws` is still the only runtime dependency. Loaded into pi
+  `1.4.0` with `pi --no-extensions -e <clone>/index.ts -p`, it registers the
+  same four tools (`studio_repl_status`, `studio_repl_send`,
+  `studio_export_pdf`, `studio_export_html`), rc 0, nothing on stderr.
+  Control: without `-e`, none.
+- **Node `v24.22.0` → `v24.22.1`** (base, NodeSource `node_24.x`). An LTS
+  security release with 8 CVEs in http, dns, tls, permission, crypto and
+  brotli. On 2026-10-21 NodeSource still served only `24.22.0`, so a rebuild
+  then would not have picked it up. On 2026-10-22 it serves
+  `24.22.1-1nodesource1` for both arm64 and amd64.
+- **git-lfs `v3.8.0` → `v3.8.1`** (base). A security release (2026-10-22)
+  with 4 CVEs. Among them: remote commands sent over SSH are now fully quoted
+  (CVE-2026-69260), and Cookie headers are no longer forwarded to another host
+  after a redirect (CVE-2026-69261).
+- **uv `0.13.1` → `0.13.5`** (base). Bundled root certificates updated,
+  dropped GET and HEAD requests retried, `uv export` faster with extras, lower
+  peak memory when resolving, and new CPython builds (3.15.1, 3.14.9, 3.13.17).
+  No breaking changes.
+- **agent-browser `0.39.1` → `0.39.2`** (base). Bug fixes only. The ones an
+  agent notices: a click or double-click on a hidden, disabled or off-viewport
+  element now returns an error instead of reporting success, an ambiguous
+  stale element reference fails instead of picking another element, and an
+  unreadable or invalid policy file denies actions instead of being ignored.
+
+### Fixed
+
+- **`~/.ssh/config` is Included even if it appears after the container
+  started.** Same rule as the `ssh-lan.conf` fix in v1.12.1. `setup-lan-access.sh`
+  wrote `Include ~/.ssh/config` into `~/.ssh-local/config` only if
+  `~/.ssh/config` was readable at container start, so a file that appeared
+  later (a host provisioned after its first `docker compose up`) was ignored
+  until a restart. Entries *added* to a file that already existed were never
+  affected: ssh reads Included files on every connection, and the bind mount is
+  live. Measured 2026-10-19 on tor-ms22: on the Mac, a newly created file, an
+  atomic replace (write + `mv`, as editors do) and an append each showed up in
+  the container within a second. The line is now written whether or not the
+  file exists. A file that exists but is unreadable is still left out, with a
+  warning on stderr, because ssh would abort every connection. When the file
+  exists at start the generated config is byte-identical to v1.12.1's (checked
+  with and without `ssh-lan.conf`). When it is absent, the only difference is
+  the added Include block. `scripts/smoke-test.sh` gains two checks, Included
+  when created after start and left out when unreadable. Against the v1.12.1
+  script the first fails and the second passes; against this one both pass.
+
 ## v1.12.1 — 2026-10-19
 
 Patch release. Headline: **`ssh-lan.conf` is Included even if it is created

Dockerfile.base

@@ -14,7 +14,7 @@
 # content-addressed over this file, so any byte change invalidates the
 # cache. Recommended cadence: once per release for security updates.
 #
-# BASE_REBUILD_DATE: 2026-10-19 (v1.12.1 — setup-lan-access.sh always Includes ssh-lan.conf; apt and base tools re-resolve (upstream on 2026-10-19: gitea-mcp 1.10.0; uv 0.13.1, Node v24.22.0, nvim 0.12.6, fzf 0.74.5 unchanged); previous marker 2026-10-18 / v1.12.0)
+# BASE_REBUILD_DATE: 2026-10-22 (v1.12.2 — setup-lan-access.sh always Includes ~/.ssh/config; apt and base tools re-resolve (upstream on 2026-10-22: Node v24.22.1 and git-lfs 3.8.1 security releases, uv 0.13.5, agent-browser 0.39.2; gitea-mcp 1.10.0, nvim 0.12.6, fzf 0.74.5 unchanged); previous marker 2026-10-19 / v1.12.1)
 #
 # ── Lineage note ─────────────────────────────────────────────────────
 # Adapted from opencode-devbox/Dockerfile.base (commit before v1.16.2).

Dockerfile.variant

@@ -317,7 +317,42 @@ ARG USER_NAME=developer
 # extension with no [Extension issues], the bridge registers its 45 tools,
 # /om:status, /om:view and the /studio commands are offered, and atelier
 # paints ACTIVITY/READY/TOOLS in both renderers (controls with -ne: none).
-ARG PI_VERSION=1.3.0
+#
+# v1.12.2: 1.3.0 -> 1.4.0 (npm latest, published 2026-10-21T22:48Z). MEASURED
+# 2026-10-22 on tor-ms22 from isolated npm prefixes for 1.3.0 and 1.4.0, with
+# the published tarballs unpacked side by side:
+#   1. NO `### Breaking Changes` section in 1.4.0. Behaviour changes, none of
+#      which reaches us: attribution headers come from pi-ai's client identity,
+#      so `before_provider_headers` handlers no longer see them, and
+#      `generateSummary()` ignores `reserveTokens`. 0 uses of either
+#      (`before_provider_headers`, `generateSummary`, `reserveTokens`) in
+#      pi-extensions, pi-fork, obsmem, pi-atelier and pi-studio. Control: the
+#      same grep finds `registerTool` in 18 files.
+#   2. pi-agent-core 1.3.0 -> 1.4.0 is NOT byte-identical this time, but every
+#      changed line in dist (4 files) is the new optional `identity` field and
+#      `DEFAULT_AGENT_IDENTITY`; 0 changed lines mention finishTurn, so obsmem's
+#      turn cap is untouched. pi-tui adds only exit-restore methods
+#      (`restoreOnExit`, `getExitRestorePrefix/Suffix`, #11170); atelier's
+#      internals TuiMainScreen / renderLayoutFrame are in the same 10 dist
+#      files. The extension loader only gains the `@earendil-works/pi-ai/models`
+#      alias (#11156). pi-mcp and pi-codemode dist are byte-identical.
+#   3. Public API: the only removed .d.ts exports are
+#      `mergeProviderAttributionHeaders` (pi-coding-agent) and `getPiUserAgent`
+#      (pi-ai). 0 consumers. All 58 runtime-imported names across pi-toolkit,
+#      pi-extensions, pi-fork, obsmem, pi-studio (0.10.2 and 0.11.1),
+#      pi-atelier, mempalace-toolkit, ~/.pi/agent/extensions and /opt/fleet-pi
+#      resolve in 1.4.0, and in 1.3.0 (control: an injected fake name is
+#      reported missing).
+#   4. engines.node is still `>=22.19.0`. Peer ranges: atelier >=0.84.0, fork
+#      >=0.75.0, obsmem and studio `*`.
+# Exercised before tagging, with a copy of tor-ms22's real ~/.pi/agent
+# (pi-studio swapped for v0.11.1): `pi -p` answers PONG, rc 0 in 10 s (1.3.0:
+# 9 s), nothing on stderr. In the TUI the [Extensions] list is the same as on
+# 1.3.0, with no [Extension issues]. The bridge registers its 45 tools, and
+# TOOLS shows 58 / 64 on both. /om:status, /om:view and the /studio commands
+# are offered, and atelier paints ACTIVITY/READY/TOOLS in both renderers
+# (control with -ne: none).
+ARG PI_VERSION=1.4.0
 ARG PI_TOOLKIT_REF=main
 ARG PI_EXTENSIONS_REF=main
 # Repo URLs default to the canonical gitea origin but are overridable so a

README.md

@@ -1297,7 +1297,7 @@ persisted volumes survived, and pi runtime wiring is intact:
 ```bash
 ./scripts/recreate-sanity-check.sh                              # auto-detects variant
 ./scripts/recreate-sanity-check.sh --expected-image-version 1.8.9  # assert the pi-devbox release tag
-./scripts/recreate-sanity-check.sh --expected-version 1.3.0          # assert the pi coding agent version
+./scripts/recreate-sanity-check.sh --expected-version 1.4.0          # assert the pi coding agent version
 ```
 
 Those are **two different versions**, and the flags are not interchangeable:
@@ -1336,7 +1336,7 @@ resolved to `latest` at build time:
 
 | Component | Pin | Where |
 |---|---|---|
-| pi | `1.3.0` | `ARG PI_VERSION` — `Dockerfile.variant` |
+| pi | `1.4.0` | `ARG PI_VERSION` — `Dockerfile.variant` |
 | pi-obsmem | `022da5e5554d04dfdc876ed7dac4a42c6b83dfd4` | `ARG PI_OBSMEM_REF` — `Dockerfile.variant` |
 | pi-atelier | `v0.16.0` | `ARG PI_ATELIER_REF` — `Dockerfile.variant` |
 | mempalace | `3.11.0` | `ARG MEMPALACE_VERSION` — `Dockerfile.base` |

rootfs/usr/local/lib/pi-devbox/setup-lan-access.sh

@@ -196,8 +196,17 @@ EOF
   fi
 fi
 
+# Same rule as ssh-lan.conf above: Included even when ~/.ssh/config does not
+# exist yet, so a file that appears after container start (a host provisioned
+# after its first `docker compose up`) is read on the next ssh. Entries added to
+# a file that already existed were always picked up: ssh reads Includes on every
+# connection and the mount is live. Through v1.12.1 the line was written only if
+# the file was readable at start. Only a file that EXISTS but cannot be read is
+# left out, because ssh would then abort every connection, git included.
 INCLUDE_BLOCK=""
-if [ -r "${HOME}/.ssh/config" ]; then
+if [ -e "${HOME}/.ssh/config" ] && [ ! -r "${HOME}/.ssh/config" ]; then
+  echo "setup-lan-access: ${HOME}/.ssh/config exists but is not readable, so it is not Included (ssh would refuse every connection). Fix its permissions, then rerun this script or restart the container." >&2
+else
   INCLUDE_BLOCK=$(cat <<'EOF'
 
 # Your own target hosts. Scope reset to match-all so this Include applies to

scripts/smoke-test.sh

@@ -719,6 +719,28 @@ exec_test "unreadable ssh-lan.conf left out (ssh would abort)" '
   ! grep -q "ssh-lan.conf$" $T/.ssh-local/config &&
   HOME=$T ssh -F $T/.ssh-local/config -G lanpeer >/dev/null 2>&1
   r=$?; rm -rf $T; exit $r'
+# ~/.ssh/config gets the same rule as ssh-lan.conf above: Included whether or
+# not it exists at container start, except when it exists but cannot be read.
+# Entries added to a file that already existed at start were always picked up
+# (ssh reads Includes on every connection, and the mount is live). This covers
+# only a file that appears after start, e.g. a host provisioned after its first
+# `docker compose up`. Through v1.12.1 that file was ignored until a restart.
+exec_test "~/.ssh/config Included even if created after start" '
+  T=$(mktemp -d) &&
+  HOME=$T DEVBOX_LAN_ACCESS=jump bash /usr/local/lib/pi-devbox/setup-lan-access.sh >/dev/null 2>&1 &&
+  grep -qx "Include ~/.ssh/config" $T/.ssh-local/config &&
+  HOME=$T ssh -F $T/.ssh-local/config -G ownpeer 2>/dev/null | grep -qx "hostname ownpeer" &&
+  mkdir -p $T/.ssh && printf "Host ownpeer\n    HostName 10.8.8.8\n" > $T/.ssh/config &&
+  chmod 600 $T/.ssh/config &&
+  HOME=$T ssh -F $T/.ssh-local/config -G ownpeer 2>/dev/null | grep -qx "hostname 10.8.8.8"
+  r=$?; rm -rf $T; exit $r'
+exec_test "unreadable ~/.ssh/config left out (ssh would abort)" '
+  T=$(mktemp -d) && mkdir -p $T/.ssh && printf "Host x\n" > $T/.ssh/config &&
+  chmod 000 $T/.ssh/config &&
+  HOME=$T DEVBOX_LAN_ACCESS=jump bash /usr/local/lib/pi-devbox/setup-lan-access.sh >/dev/null 2>&1 &&
+  ! grep -qx "Include ~/.ssh/config" $T/.ssh-local/config &&
+  HOME=$T ssh -F $T/.ssh-local/config -G ownpeer >/dev/null 2>&1
+  r=$?; chmod 600 $T/.ssh/config; rm -rf $T; exit $r'
 # The vendored mempalace snapshot is refreshed MANUALLY per release (see
 # rootfs/usr/local/share/pi-devbox/skills/VENDORED.md). Through v1.8.4 it also
 # silently SHADOWED the live skillset copy, so staleness was invisible — and the