chore(deps): consolidate Dependabot updates and sync pi runtime to 0.80.5

[flora131]

Summary

Consolidates five open Dependabot dependency-update PRs into one branch and refreshes the upstream Pi runtime dependency line (pi-agent-core, pi-ai, pi-tui) from 0.80.3 to 0.80.5.

Dependabot PR inventory

Superseded PR	Dependency	Ecosystem	Proposed	Applied
#1653	napi-derive	Cargo	3.5.9	3.5.9
#1652	napi	Cargo	3.10.3	3.10.3
#1651	tree-sitter	Cargo	0.26.10	0.26.10
#1650	@dbos-inc/dbos-sdk	Bun	4.23.6	4.23.6
#1649	lru-cache	Bun	11.5.1	11.5.2 (latest stable)

Pi runtime sync

• @earendil-works/pi-agent-core: ^0.80.3 -> ^0.80.5
• @earendil-works/pi-ai: ^0.80.3 -> ^0.80.5
• @earendil-works/pi-tui: ^0.80.3 -> ^0.80.5

Applied across @bastani/atomic and bundled first-party extension peer/dependency manifests (cursor, intercom, mcp, subagents, web-access, workflows), with bun.lock, package-lock.json, packages/coding-agent/npm-shrinkwrap.json, and Cargo.lock/Cargo.toml refreshed to match. Each affected package's CHANGELOG.md Unreleased section was updated accordingly, and packages/coding-agent/docs/changelog.mdx was refreshed for the user-facing docs.

Compatibility notes

• tree-sitter updated from 0.25 to 0.26 (transitively bumping windows-sys to 0.61.2); existing native tests pass without source compatibility changes.
• Added a hermetic durable backend setup (InMemoryDurableBackend) to the /workflow attach overlay integration test suite, which otherwise fell back to scanning the real ~/.atomic/workflow-durable directory and could time out on a cold FS cache on dev machines.
• Minor adjustment to packages/coding-agent/test/http-dispatcher.test.ts to track the dependency bump (comment reworded from the pinned v0.80.3 reference to a version-agnostic "Pi sync" note).
• Renamed the model-registry-context-window and agent-session-copilot-catalog-refresh test fixtures (claude-sonnet-5 -> claude-sonnet-5-test, mai-code-1-flash-picker -> mai-code-2-flash-picker) so the copilot catalog test fixtures no longer alias real model IDs shipped by the runtime bump.
• Removed a transient dependency-inventory artifact that had been committed in error.
• Package versions remain versionless 0.0.0 (no manifest version bumps) — this repo cuts releases off-main via scripts/cut-release.ts, never on main directly.

Validation

• bun install --minimum-release-age=0
• cargo update -p napi -p napi-derive -p tree-sitter
• bun run shrinkwrap:coding-agent
• bun run check:shrinkwrap
• bun run typecheck
• bun run lint
• bun run check:file-length
• AGENT=1 bun run test:unit — 2979 pass
• AGENT=1 bun run test:integration — 248 pass, 1 skip (installed-package-node-extensions: requires built dist and real non-bun-shim node)
• AGENT=1 bun run test:all — unit + integration pass
• cargo test --workspace — 32 native tests pass, 1 doctest ignored
• Push hooks also ran: cargo fmt/checks, cargo clippy, lint, file-length, unit tests

No merge, publish, or release performed.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
bastani	🟢 Ready	View Preview	Jul 9, 2026, 9:50 PM

💡 Tip: Enable Workflows to automatically generate PRs for you.

[claude]

Review: chore(deps): consolidate Dependabot updates (#1701)

Thanks for the well-documented, thoroughly-validated dependency roll-up — the validation matrix and per-package changelog entries make this easy to reason about. Overall it looks safe to merge, with a couple of small cleanups worth doing first.

🐛 Bugs / must-fix

1. Duplicate ### Changed heading in packages/workflows/CHANGELOG.md. The new entry was inserted as a second ### Changed block directly above the existing one under Unreleased: the new "Aligned the workflows extension peer dependency..." bullet gets its own ### Changed, then the pre-existing ralph bullet sits under a second ### Changed. This violates the CLAUDE.md rule: "Append to existing subsections, do not create duplicates." Please fold the new bullet into the existing section and drop the duplicate heading.

🧹 Nits / suggestions

2. Stray double blank line in packages/coding-agent/CHANGELOG.md — two blank lines separate the new dependency bullet from the ralph bullet under ### Changed. Collapse to one for consistency.

3. dependency-pr-inventory.md committed at repo root — this reads like a working/discovery artifact rather than a durable doc. It embeds machine-local detail: a developers absolute worktree path (/Users/tonystark/Documents/projects/...), the active gh account, and token scopes — noise/leakage that does not belong in the tracked tree, and it sits at the repo root rather than a docs directory. Consider dropping it (like the transient issues.md convention CLAUDE.md describes), or if worth keeping, move it under a docs path and strip the local-environment specifics.

✅ Things that look good

• tree-sitter 0.25 → 0.26 (Cargo.toml + lock): a breaking 0.x minor bump and the highest-risk change here. The grammar crates (tree-sitter-typescript 0.23, -javascript 0.25, etc.) were intentionally left in place; thats fine because tree-sitters runtime is backward-compatible with older grammar language-ABI versions, and cargo test --workspace passing confirms the build/link is coherent. Good call validating native tests explicitly.
• Pi runtime ^0.80.3 → ^0.80.5: patch-level, applied consistently across the coding-agent manifest and every bundled extensions peer/dep ranges, with bun.lock, package-lock.json, and npm-shrinkwrap.json all regenerated to match. Versionless 0.0.0 placeholders correctly preserved.
• Lockfile hygiene: the nested hosted-git-info/lru-cache / path-scurry/lru-cache @ 11.3.6 pins in bun.lock are the expected result of bumping top-level lru-cache to 11.5.2 while transitive consumers keep the older range — not a mistake.
• Incidental lock drift corrected: regenerating package-lock.json also pulled @bufbuild/protobuf, @modelcontextprotocol/ext-apps, semver, and @dbos-inc/dbos-sdk into line with manifest values that had drifted (e.g. dbos-sdk 4.20.11 → 4.23.6). Slightly outside the stated scope but strictly corrective.
• Integration test fix (overlay-entrypoints-commands.test.ts): scoping an InMemoryDurableBackend via beforeEach/afterEach for the /workflow attach block is the right way to keep the test hermetic and off the real ~/.atomic/workflow-durable dir. Imports already exist and the pattern matches the sibling describe blocks; the afterEach reset is harmlessly redundant with the in-test finally blocks.

Minor

• In http-dispatcher.test.ts the comment changed from v0.80.3: to Pi sync: — a concrete version anchor is marginally more useful for traceability. Not important.

Nothing here is blocking beyond the duplicate changelog heading (#1). Nice, careful work overall.

[claude]

Review — PR #1701 (dependency consolidation + Pi 0.80.5 sync)

Thanks for the thorough writeup and validation log. This is a clean, well-scoped dependency refresh: manifests, lockfiles (bun.lock, package-lock.json, npm-shrinkwrap.json), Cargo metadata, per-package changelogs, and user-facing docs/changelog.mdx all move together, and the versionless 0.0.0 placeholder is correctly preserved per the release flow in CLAUDE.md. The comment retagging in http-dispatcher.test.ts (v0.80.3 → Pi sync) is a nice touch to avoid stale version references.

🔴 Should fix — dependency-pr-inventory.md shouldn't be committed to the repo root

This file is a process/scratch artifact rather than durable project content, and committing it to the repo root has a few downsides:

• Leaks local environment detail — hardcoded developer path (/Users/tonystark/Documents/projects/atomic-deps-latest-pi-0.80.5) and gh auth status output (active account flora131, token scopes repo/workflow). None of this is a secret, but it's not something the repo should carry.
• Duplicates the PR description — the inventory table + applied-version notes already live in the PR body, which is the right home for discovery notes.
• Repo-cleanliness convention — CLAUDE.md explicitly treats this kind of working file (e.g. issues.md) as transient and asks that it be deleted "to keep the repository clean." A root-level dependency-pr-inventory.md runs against that.

Recommend dropping it from the diff (keep the content in the PR description, where it already mostly is).

🟡 Notes / nits

• lru-cache → 11.5.2 vs Dependabot's proposed 11.5.1. This is a deliberate "latest stable" bump beyond the superseded PR; it's clearly documented, so just flagging that chore(deps): consolidate Dependabot updates and sync pi runtime to 0.80.5 #1701 is slightly more than a pure consolidation of the open Dependabot PRs. Fine as-is.
• tree-sitter 0.25 → 0.26 (minor). The grammar crates (tree-sitter-typescript 0.23, tree-sitter-javascript/python 0.25) stay put, so there's a theoretical grammar/runtime ABI-compat surface here. The 32 native cargo test --workspace passes are reassuring, but worth keeping an eye on parser behavior post-merge.

🟢 Test change looks correct

The new hermetic beforeEach/afterEach in the /workflow attach block of overlay-entrypoints-commands.test.ts mirrors the existing pattern in the sibling /workflow resume describe (imports already present, afterEach resets to undefined). Per-test blocks that install their own InMemoryDurableBackend still override cleanly, and the describe-level afterEach tears down consistently. Good, minimal fix for the real-FS-scan timeout.

Overall: 👍 once the inventory artifact is removed. Everything else is mechanical and well-validated.

[claude]

Review — PR #1701 (dependency consolidation + Pi 0.80.5 sync)

Overall this is a clean, well-scoped dependency refresh. Manifests are updated consistently across @bastani/atomic and every bundled extension (cursor, intercom, mcp, subagents, web-access, workflows), each package's CHANGELOG.md Unreleased section is touched, and the user-facing docs/changelog.mdx is refreshed — matching the CLAUDE.md conventions. There are no product-source changes, so runtime risk is low, and the validation matrix in the description is thorough.

A few things worth addressing:

Should fix

1. dependency-pr-inventory.md should not be committed to the repo root.
This is a discovery/scratch artifact and it leaks developer-machine specifics into the tracked tree:

• Absolute local paths: /Users/tonystark/Documents/projects/atomic-deps-latest-pi-0.80.5
• gh auth status output (active account, token scopes)
• Raw command logs

CLAUDE.md's philosophy is explicit about keeping the repo clean (e.g. "Delete the file when all issues are resolved" for issues.md). This inventory is exactly that kind of transient working note — and its content already lives in the PR description. Recommend removing it from the PR (or, if you want it retained, move it under a scratch/ignored path rather than the repo root).

Nits

2. Inconsistent fixture-isolation naming in model-registry-context-window.suite.ts.
The two collision-avoidance renames use different strategies:

• claude-sonnet-5 -> claude-sonnet-5-test (clearly-synthetic suffix)
• mai-code-1-flash-picker -> mai-code-2-flash-picker (version bump)

The -2- variant is fragile: if upstream Pi later ships a real mai-code-2-flash-picker, the fixture will re-collide and the test breaks the same way it does today. A consistent synthetic suffix (mai-code-1-flash-picker-test) would be more robust. Minor related cosmetic: the retained expect(maiCodeFlash.name).toBe("MAI-Code-1-Flash") assertion now reads oddly next to a -2- id.

3. Double blank line in packages/coding-agent/CHANGELOG.md between the new sync entry and the existing ralph entry — trim to a single blank line for consistency with the rest of the file.

Confirmed good

• Test hermeticity improvements are the right call: the InMemoryDurableBackend beforeEach/afterEach in overlay-entrypoints-commands.test.ts (imports verified) and the { ...getModel(...), contextWindow: 200_000 } pins in the auto-compaction suites both decouple tests from environment/registry drift introduced by the bump.
• lru-cache landing on 11.5.2 (ahead of Dependabot's proposed 11.5.1) is documented and reasonable.
• tree-sitter 0.25 -> 0.26 with native tests passing and no source changes is called out clearly.

Nothing blocking beyond removing the scratch inventory file.

[claude]

Review: chore(deps) — consolidate Dependabot + sync Pi to 0.80.5

Thanks for the exceptionally well-documented PR — the superseded-PR inventory, validation matrix, and compatibility notes make this easy to reason about. Overall this is a clean, low-risk dependency bump and I'd be comfortable merging after a couple of small confirmations.

✅ What looks good

• Versionless main respected. All packages/*/package.json stay at 0.0.0; only lockfile/dependency version lines change. 👍
• Selective fixture rename is correct. Renaming claude-sonnet-5→claude-sonnet-5-test and mai-code-1-flash-picker→mai-code-2-flash-picker only in model-registry-context-window.suite.ts and agent-session-copilot-catalog-refresh.test.ts is right: those tests go through ModelRegistry.create, which merges the injected catalog with the runtime's real model list, so aliasing a now-real runtime ID would collide. copilot-model-catalog.test.ts builds its map directly from parseCopilotModelCatalog(capiBody()) and never merges with the runtime registry, so leaving its old fixtures untouched is harmless. Good scoping.
• Hermetic durable backend fix in overlay-entrypoints-commands.test.ts is a genuine robustness win — the beforeEach/afterEach setDurableBackend pair prevents the fallback path from scanning the real ~/.atomic/workflow-durable dir. Imports for both symbols are already present, and the per-test backend/reset blocks nested inside compose cleanly with the new describe-level hooks (idempotent resets to undefined).
• Auto-compaction context-window pin ({ ...getModel(...)!, contextWindow: 200_000 }) is a sensible way to decouple the compaction-threshold math from whatever default window the runtime bump ships, keeping the test deterministic.

🔎 Worth confirming

1. tree-sitter bumped to 0.26 while grammar crates stay at 0.23/0.25 (Cargo.toml): tree-sitter-typescript = "0.23", tree-sitter-javascript = "0.25", tree-sitter-python = "0.25" were not moved in lockstep. Grammar crates compile against a specific tree-sitter language ABI, so a core bump can diverge from grammars at runtime even when it links. You note cargo test --workspace passes (32 tests), which is the right guard — just calling it out so a reviewer confirms the native parsing tests actually exercise each grammar (TS/JS/Python) against the 0.26 core, not merely compile it.

💅 Minor nits (non-blocking)

• Double blank line introduced in packages/coding-agent/CHANGELOG.md between the new entry and the existing reviewer-c bullet — collapse to one.
• MDX spacing: in docs/changelog.mdx the new </Update> is immediately followed by the next <Update ...> with no blank line between blocks; add one for consistency.
• Style consistency in the overlay test: beforeEach(() => { ... }) uses a block while afterEach(() => setDurableBackend(undefined)) uses an expression arrow — trivial, but matching them reads cleaner.
• The renamed fixture keeps display name "MAI-Code-1-Flash" under id mai-code-2-flash-picker (and "Claude Sonnet 5" under -test); intentional and fine for a fixture, but a one-line comment noting the id was renamed to avoid aliasing the real runtime model would age well.

Test coverage

No new product code paths, so no new tests are warranted; the changes are fixture/hermeticity adjustments driven by the runtime bump, and the validation matrix (2979 unit + 248 integration + 32 native) covers them.

Nice work — LGTM pending the tree-sitter confirmation. 🚀