[dependabot]

Bumps the sandbox-harnesses group with 5 updates in the /deploy/sandbox directory:

Package	From	To
@anthropic-ai/claude-code	2.1.304	2.1.310
@earendil-works/pi-coding-agent	1.3.0	1.4.0
@openai/codex	0.163.0	0.164.0
opencode-ai	1.19.3	1.19.4
pi-mcp-adapter	5.4.0	6.0.0

Updates @anthropic-ai/claude-code from 2.1.304 to 2.1.310

Release notes

Sourced from @​anthropic-ai/claude-code's releases.

v2.1.310

What's changed

• Added the Monitor tool and plugin monitors on Bedrock, Vertex, and Foundry, and when telemetry or nonessential traffic is disabled; long foreground sleeps are now blocked there too
• Fixed requests failing behind some gateways and compatible servers that reject the effort-2025-11-24 beta value or mid-conversation system messages; Claude Code now retries without them
• Fixed background cleanup deleting some recent files, such as pasted images, when cleanupPeriodDays is set to a very large value
• Fixed compaction after a "Prompt is too long" error keeping too much of a conversation with dense text, such as base64 or SVG, so the next request could fail again
• Fixed file read permission prompts not showing where a symbolic link leads
• Fixed a question's auto-continue timeout firing the moment the external editor closed after a long edit
• Windows: Fixed PreToolUse and PermissionRequest hooks letting a tool call through when Git Bash is missing and the hook's command is only quoted strings, such as a quoted path
• Improved auto mode's prompt before the first read outside the working directories: it now says when blocking those reads makes shell commands ask for permission
• Improved memory use of non-interactive sessions (-p, Agent SDK) during compaction when the transcript file is very large
• Improved a mod's Image to draw inside tmux with allow-passthrough and focus-events on, in kitty, Ghostty, and iTerm2 3.5+ with fullscreen rendering, where it showed only its alt text
• Linux: Improved /sandbox and the sandbox startup warning to name Ubuntu's AppArmor restriction on user namespaces, and how to lift it, when it keeps bubblewrap from starting the sandbox
• Changed the error for an MCP tool call that times out in a non-interactive session while the server's elicitation is unanswered: it now tells Claude that no answer came and not to repeat the call
• [VSCode] Fixed pressing Enter on the plan review card's "Send feedback and keep planning" button approving the plan instead of sending your comments back
• [VSCode] Fixed the panel showing "Something went wrong" after "Switch branch & continue" on a cloud session opened from Session history's Web tab
• [Cloud sessions] Added Claude Code cloud sessions and Remote Control permissions to Enterprise custom roles, so Owners can control access to each by role
• [Cloud sessions] Added a Choose file button to load a cloud environment's setup script from a file
• [Cloud sessions] Fixed failed saves and archives in the cloud environment edit dialog showing no error inside the dialog
• [Cloud sessions] Fixed failed routine API token actions showing only a toast; the error now appears in the routine edit dialog
• [Cloud sessions] Improved the session start checklist to show a cloud environment's setup script output in a scrolling box
• [Cloud sessions] Changed turning on Cloud sessions or Remote Control in admin settings to ask for confirmation and list the custom roles that have that permission
• [Cloud sessions] Changed the cloud environment dialog to open network access, setup script and environment variables from rows instead of listing every editor at once
• [Claude Tag] Fixed Claude Tag treating ! commands such as !restart and !help as ordinary messages when sent in bold, italic or strikethrough
• [Claude Tag] Fixed Claude Tag admin channel and workspace pages being replaced by a load error when a background refresh of the bundle list fails
• [Claude Tag] Fixed Claude Tag's spend limits page in admin settings reporting that no channels match a filter while channel names are still loading
• [Code Review] Fixed the Code Review admin section hiding its repositories and switches after a failed refresh of the repository list
• [Code Review] Improved the Code Review admin section to retry the first load and show one Try again banner when it still fails

v2.1.309

What's changed

• Fixed sandboxed Bash commands on macOS and Linux running the shell's startup files outside the sandbox before each command
• Fixed macOS sandbox denyWrite glob patterns not applying at a path's real location when the pattern's folder is reached through a symlink
• Fixed sandboxed commands and auto-accepted edits being able to modify the MCP config file passed with --mcp-config
• Fixed a disabled MCP server being reconnected by a later permission prompt in print and SDK sessions
• Fixed the Bash permission check trusting a variable set by a command whose redirect can fail to open
• Fixed Bash permission checks not prompting for some compound commands that change directory before running git when the cd is wrapped or prefixed, as they do for a plain cd
• Fixed an Edit(path) deny rule not blocking a Bash redirect to that path in some commands that also held a subshell
• Fixed worktree-isolated sessions accepting some locale-prefixed commands the isolation guard should refuse
• Fixed worktree-isolated sessions on zsh accepting some arithmetic commands that the isolation guard should refuse
• Fixed worktrees and branch checkouts that Claude Code creates so they ignore git replace refs, as its other git operations already do
• Fixed profile store write protection not applying when the config directory is reached through a symlink
• Fixed sessions compacting repeatedly after reading files under a very large nested CLAUDE.md; a nested CLAUDE.md over the size limit now loads only its start
• Fixed ctrl+enter (send now) only queuing a message when pressed before the response had started, and restarting a prompt's hooks while leaving the message queued when pressed while those hooks were running
• Fixed key-bound slash commands running in the shell from ! mode
• Fixed ctrl+o not showing messages from other agents and sessions that are still waiting to be delivered; they now appear in full under the transcript, marked as waiting
• Fixed long tool output previews being cut through an emoji, leaving session transcripts that jq could not parse
• Fixed Read reporting "File does not exist" for PDF page ranges in Linux sandboxes that share the parent's /proc

... (truncated)

Commits

• b70dc41 chore: Update CHANGELOG.md and feed.xml
• 30fa83c chore: Update mods/
• 65823ec chore: Update CHANGELOG.md and feed.xml
• 5ed799e chore: Update CHANGELOG.md and feed.xml
• 1132b8a chore: Update CHANGELOG.md and feed.xml
• d014fc0 chore: Update CHANGELOG.md and feed.xml
• 49b8c35 chore: Update CHANGELOG.md and feed.xml
• 5a2676e chore: Update mods/
• a6e289a chore: Update mods/
• See full diff in compare view

Updates @earendil-works/pi-coding-agent from 1.3.0 to 1.4.0

Release notes

Sourced from @​earendil-works/pi-coding-agent's releases.

v1.4.0

New Features

• Image input for classifiers: codemode models.classify() accepts images for TypeSafe's Jev and Cloudflare's Clef models on typesafe, cloudflare-workers-ai, and OpenRouter. See Use classifier models and Codemode.
• Models Configuration reference: every provider, model, model override, and compatibility field of models.json, generated from its schema. See Models Configuration.
• Summaries without a fixed output cap: compaction and branch summaries use the model's output limit, so long reasoning no longer makes them fail. See Compaction.
• Codemode waits for a free worker: parallel scripts and in-process subagents queue instead of failing, and PI_CODEMODE_MAX_WORKERS raises the limit. See Codemode limits.
• Rex terminal support: OSC 8 hyperlinks, truecolor, and inline images.

Added

• Added a Models Configuration reference generated from the models.json schema, listing all provider, model, model override, and compatibility fields (#10790)
• Codemode models.classify() now accepts images for TypeSafe's Jev and Cloudflare's Clef models on typesafe, cloudflare-workers-ai, and OpenRouter, and lists Clef Omni and Jev 1.14 on Workers AI.
• Provider-level compat in models.json now also applies to classifier models, with the System One fields imageInput and sendImageOptInHeader for proxies that serve another service's classifiers. Extension classifier models accept compat too.
• Added MiniMax-M3.1-Flash to the minimax and minimax-cn providers, with thinking levels low through max (#11121)
• Added support for the Rex terminal: OSC 8 hyperlinks, truecolor, and inline images (#11131, #11150 by @​petrroll, #11183 by @​nihaals)

Changed

• Provider attribution headers now come from pi-ai's client identity. Extensions' before_provider_headers handlers no longer see the OpenRouter, NVIDIA NIM, and OpenCode attribution headers; returning null for one still removes it. Cloudflare requests send pi's detailed User-Agent instead of pi-coding-agent, as do GitHub release checks for tool downloads, and OpenCode requests send x-opencode-client whenever attribution is enabled, not only with a session.
• generateSummary() and generateSummaryWithUsage() now ignore their reserveTokens parameter. Summary requests use the model's output limit instead.
• Changed the default GitHub Copilot model from gpt-5.4, which Copilot retired, to gpt-6.1-sol.
• Changed the default NVIDIA model to nvidia/nemotron-3.5-super-vl-120b-a12b (#10910 by @​cv)
• Changed the default Xiaomi model to mimo-v2.6-pro for the xiaomi and Xiaomi Token Plan providers, since mimo-v2.5-pro left the catalog.
• Grok 4.3 and Grok 4.5 on the xai provider now offer the xhigh thinking level.
• Sign in with ChatGPT: ChatGPT Business workspace usage-limit errors are not retried and tell the user to ask their workspace admin to increase the limit.

Fixed

• Fixed compaction and branch summaries failing with "generation hit the token cap" when reasoning used most of the fixed summary output limit. Summaries now use the model's output limit, and compaction.reserveTokens only controls when compaction starts (#9512, #9075).
• Fixed models.schema.json missing descriptions for provider and model fields, so editors showed no hints for them (#10790)
• Fixed pi update failing with "Managed install marker is missing or invalid" when managed-install.json starts with a UTF-8 BOM, which Windows PowerShell 5.1 adds when it rewrites the file.
• Fixed HTML export showing literal asterisks for Markdown bold and italic next to CJK punctuation (#3353, #10154)
• Fixed the terminal staying in mouse-tracking, focus-reporting, Kitty keyboard, and alternate-screen modes when pi exits without its normal terminal teardown, which flooded the shell prompt with escape sequences (#11170)
• Fixed concurrent extension select/confirm/input/editor dialogs and inline custom() components in interactive mode: a second dialog replaced the first and the first promise never settled; closing the visible dialog now shows the previous one again (#11166, #9909)
• Fixed pasting in the shell hanging after copying text in pi and suspending it with Ctrl+Z on Linux: the background wl-copy/xclip/xsel process that keeps serving the clipboard was suspended along with pi (#11179)
• Fixed codemode scripts failing immediately when both codemode workers are busy, for example with parallel codemode calls or in-process subagents. Scripts now wait up to 60 seconds for a free worker, and PI_CODEMODE_MAX_WORKERS raises the limit of two workers (#11184)
• Fixed extensions failing to load when importing @earendil-works/pi-ai/models (e.g. for clampThinkingLevel) by exposing the subpath through the extension loader aliases and virtual modules (#11156)
• Fixed mcp.json files that start with a UTF-8 BOM failing to parse, which skipped all their MCP servers and made pi mcp add/pi mcp remove fail (#11191)
• Fixed /compact <instructions> ignoring the instructions when summarizing the start of a turn that compaction splits. When the split turn was the only new content since the last compaction, the instructions were ignored entirely (#11058)
• Fixed resumed sessions and /tree navigation leaving extension tools inactive when the branch recorded its tools before they were registered, such as tools from extensions installed after the session started. Extension tools the branch never added or removed are now active unless they are registered with defaultActive: false (#11062, #11075)
• Fixed sessions breaking after recovery from a response cut off at the output limit: the truncated tool call was omitted but its tool results were kept, so providers rejected every later request (#11227, #11233 by @​petrroll)
• Fixed the grep tool following RIPGREP_CONFIG_PATH, where options such as --fixed-strings silently changed regex searches into literal ones. The tool now runs rg --no-config (#11203, #11230 by @​petrroll)
• Fixed Windows shell detection rejecting runnable Microsoft Store shell aliases (#9504 by @​petrroll)
• Fixed Windows shell detection missing PowerShell outside PATH and the legacy WSL bash.exe launcher when Windows is not installed in C:\Windows. pi now checks %ProgramFiles%\PowerShell\7, %SystemRoot%\System32\WindowsPowerShell\v1.0, and %SystemRoot% (#9501 by @​petrroll)
• Fixed GitHub Copilot sessions with large request bodies, such as many images, failing with HTTP 413 failed to parse request instead of compacting and retrying (#11016 by @​petrroll)
• Fixed the openai-codex provider offering gpt-5.5 and gpt-5.3-codex-spark, which always fail for ChatGPT accounts (#11173 by @​lucasmeijer)
• Fixed whitespace-only tool output (for example a bare \r\n from bash) making OpenAI Completions, OpenAI Responses, and Google requests fail with a 400 (#8720)
• Fixed automatic retry not triggering for more gateway upstream failures, stream disconnected before completion errors relayed by Codex CLI proxies, and transient Google Vertex OAuth token refresh failures, and retrying errors because of digits inside request ids or byte counts (#10920, #11057, #10996)
• Fixed OpenAI Responses models losing the prompt cache on every deferred tool load after a tool was removed (#10940)

... (truncated)

Changelog

Sourced from @​earendil-works/pi-coding-agent's changelog.

[1.4.0] - 2026-10-21

New Features

• Image input for classifiers: codemode models.classify() accepts images for TypeSafe's Jev and Cloudflare's Clef models on typesafe, cloudflare-workers-ai, and OpenRouter. See Use classifier models and Codemode.
• Models Configuration reference: every provider, model, model override, and compatibility field of models.json, generated from its schema. See Models Configuration.
• Summaries without a fixed output cap: compaction and branch summaries use the model's output limit, so long reasoning no longer makes them fail. See Compaction.
• Codemode waits for a free worker: parallel scripts and in-process subagents queue instead of failing, and PI_CODEMODE_MAX_WORKERS raises the limit. See Codemode limits.
• Rex terminal support: OSC 8 hyperlinks, truecolor, and inline images.

Added

• Added a Models Configuration reference generated from the models.json schema, listing all provider, model, model override, and compatibility fields (#10790)
• Codemode models.classify() now accepts images for TypeSafe's Jev and Cloudflare's Clef models on typesafe, cloudflare-workers-ai, and OpenRouter, and lists Clef Omni and Jev 1.14 on Workers AI.
• Provider-level compat in models.json now also applies to classifier models, with the System One fields imageInput and sendImageOptInHeader for proxies that serve another service's classifiers. Extension classifier models accept compat too.
• Added MiniMax-M3.1-Flash to the minimax and minimax-cn providers, with thinking levels low through max (#11121)
• Added support for the Rex terminal: OSC 8 hyperlinks, truecolor, and inline images (#11131, #11150 by @​petrroll, #11183 by @​nihaals)

Changed

• Provider attribution headers now come from pi-ai's client identity. Extensions' before_provider_headers handlers no longer see the OpenRouter, NVIDIA NIM, and OpenCode attribution headers; returning null for one still removes it. Cloudflare requests send pi's detailed User-Agent instead of pi-coding-agent, as do GitHub release checks for tool downloads, and OpenCode requests send x-opencode-client whenever attribution is enabled, not only with a session.
• generateSummary() and generateSummaryWithUsage() now ignore their reserveTokens parameter. Summary requests use the model's output limit instead.
• Changed the default GitHub Copilot model from gpt-5.4, which Copilot retired, to gpt-6.1-sol.
• Changed the default NVIDIA model to nvidia/nemotron-3.5-super-vl-120b-a12b (#10910 by @​cv)
• Changed the default Xiaomi model to mimo-v2.6-pro for the xiaomi and Xiaomi Token Plan providers, since mimo-v2.5-pro left the catalog.
• Grok 4.3 and Grok 4.5 on the xai provider now offer the xhigh thinking level.
• Sign in with ChatGPT: ChatGPT Business workspace usage-limit errors are not retried and tell the user to ask their workspace admin to increase the limit.

Fixed

• Fixed compaction and branch summaries failing with "generation hit the token cap" when reasoning used most of the fixed summary output limit. Summaries now use the model's output limit, and compaction.reserveTokens only controls when compaction starts (#9512, #9075).
• Fixed models.schema.json missing descriptions for provider and model fields, so editors showed no hints for them (#10790)
• Fixed pi update failing with "Managed install marker is missing or invalid" when managed-install.json starts with a UTF-8 BOM, which Windows PowerShell 5.1 adds when it rewrites the file.
• Fixed HTML export showing literal asterisks for Markdown bold and italic next to CJK punctuation (#3353, #10154)
• Fixed the terminal staying in mouse-tracking, focus-reporting, Kitty keyboard, and alternate-screen modes when pi exits without its normal terminal teardown, which flooded the shell prompt with escape sequences (#11170)
• Fixed concurrent extension select/confirm/input/editor dialogs and inline custom() components in interactive mode: a second dialog replaced the first and the first promise never settled; closing the visible dialog now shows the previous one again (#11166, #9909)
• Fixed pasting in the shell hanging after copying text in pi and suspending it with Ctrl+Z on Linux: the background wl-copy/xclip/xsel process that keeps serving the clipboard was suspended along with pi (#11179)
• Fixed codemode scripts failing immediately when both codemode workers are busy, for example with parallel codemode calls or in-process subagents. Scripts now wait up to 60 seconds for a free worker, and PI_CODEMODE_MAX_WORKERS raises the limit of two workers (#11184)
• Fixed extensions failing to load when importing @earendil-works/pi-ai/models (e.g. for clampThinkingLevel) by exposing the subpath through the extension loader aliases and virtual modules (#11156)
• Fixed mcp.json files that start with a UTF-8 BOM failing to parse, which skipped all their MCP servers and made pi mcp add/pi mcp remove fail (#11191)
• Fixed /compact <instructions> ignoring the instructions when summarizing the start of a turn that compaction splits. When the split turn was the only new content since the last compaction, the instructions were ignored entirely (#11058)
• Fixed resumed sessions and /tree navigation leaving extension tools inactive when the branch recorded its tools before they were registered, such as tools from extensions installed after the session started. Extension tools the branch never added or removed are now active unless they are registered with defaultActive: false (#11062, #11075)
• Fixed sessions breaking after recovery from a response cut off at the output limit: the truncated tool call was omitted but its tool results were kept, so providers rejected every later request (#11227, #11233 by @​petrroll)
• Fixed the grep tool following RIPGREP_CONFIG_PATH, where options such as --fixed-strings silently changed regex searches into literal ones. The tool now runs rg --no-config (#11203, #11230 by @​petrroll)
• Fixed Windows shell detection rejecting runnable Microsoft Store shell aliases (#9504 by @​petrroll)
• Fixed Windows shell detection missing PowerShell outside PATH and the legacy WSL bash.exe launcher when Windows is not installed in C:\Windows. pi now checks %ProgramFiles%\PowerShell\7, %SystemRoot%\System32\WindowsPowerShell\v1.0, and %SystemRoot% (#9501 by @​petrroll)
• Fixed GitHub Copilot sessions with large request bodies, such as many images, failing with HTTP 413 failed to parse request instead of compacting and retrying (#11016 by @​petrroll)
• Fixed the openai-codex provider offering gpt-5.5 and gpt-5.3-codex-spark, which always fail for ChatGPT accounts (#11173 by @​lucasmeijer)
• Fixed whitespace-only tool output (for example a bare \r\n from bash) making OpenAI Completions, OpenAI Responses, and Google requests fail with a 400 (#8720)
• Fixed automatic retry not triggering for more gateway upstream failures, stream disconnected before completion errors relayed by Codex CLI proxies, and transient Google Vertex OAuth token refresh failures, and retrying errors because of digits inside request ids or byte counts (#10920, #11057, #10996)

... (truncated)

Commits

• 4a08025 Release v1.4.0
• f76b248 docs(ai,tui,coding-agent): audit changelogs since v1.3.0
• 7f225f2 feat(ai,coding-agent): image input for System One classifiers
• 0272608 fix(coding-agent): recovery omits tool results with the truncated tool call
• 8c4e873 fix(coding-agent): grep tool ignores ripgrep config via --no-config
• bd3c9b8 fix(coding-agent): activate extension tools registered after the branch recor...
• 04a93ba fix(ai,agent,coding-agent,durable): client identity follow-ups
• adc5fa9 feat(ai,agent,coding-agent): move client identity and provider attribution in...
• adfc144 fix(coding-agent): apply /compact instructions to split-turn prefix summary
• e5fe977 fix(ai,coding-agent): drop models retired upstream
• Additional commits viewable in compare view

Updates @openai/codex from 0.163.0 to 0.164.0
Updates opencode-ai from 1.19.3 to 1.19.4

Release notes

Sourced from opencode-ai's releases.

v1.19.4

Core

Improvements

• Upgraded the bundled Bun runtime to 1.4.4, which includes security fixes for Brotli, TLS, HTTP/1.1, HTTP/2, HTTP/3, WebSocket, and fetch, and updates root certificates to NSS 3.131.1.

Commits

• 148842e release: v1.19.4
• c0c7bae fix(opencode): install musl native packages for cross builds on Bun 1.4.4 (#5...
• a8d8224 chore: update nix node_modules hashes
• baec69b chore: bump Bun to 1.4.4 (#58088)
• a1f604b sync release versions for v1.19.3
• See full diff in compare view

Updates pi-mcp-adapter from 5.4.0 to 6.0.0

Release notes

Sourced from pi-mcp-adapter's releases.

v6.0.0

pi-mcp-adapter 6.0.0 makes Pi a better home for your MCP tools, especially if you use Executor. Pi now asks you before an Executor app does anything that needs approval, instead of letting the model approve it. When an app needs an account you haven't connected, Pi opens the sign-in link and finishes the call for you. You can also save a workflow you repeat as your own named tool. The adapter's old mcpScript tool is gone, because Pi's own codemode now does that job and works with the rest of Pi.

Highlights

• Executor approvals and sign-ins happen in Pi. You approve risky actions yourself, and a missing account becomes a browser link instead of a dead end.
• Executor app tools are regular Pi tools. Search for them, set approval rules such as github.*, and call them from Pi's codemode.
• Save repeated workflows as tools. Give a workflow a name and fixed inputs so it's one call next time. When the agent writes a script that works, it can offer to save it, and you review it first.
• MCP works again in Pendant. In the Pendant VS Code extension and other hosts that freeze Pi's theme, every MCP call used to fail.

Need to know

If you…	What changes
Use mcpScript	It's removed. Add "+codemode" to defaultTools in Pi's settings and script MCP calls with Pi's codemode (MCP scripting).
Set scriptMode, scriptSkill or the settings.jev script-evaluation keys	They no longer do anything. Your config still loads and shows a notice naming the file and the keys, so you can delete them.
Import the adapter's types	McpSettings, JevErrorCode and ResolvedJevSettings lose the removed fields, and JevBudget is gone. See Breaking below.
Want the new features	They need Pi 0.99 or later.

Full changelog

Highlights

• If you use Executor, Pi now asks you before an app tool does anything that needs approval, where before the model could approve it for you. When an app needs an account you haven't connected, Pi opens the sign-in link in your browser and finishes the call once you're done.
• Your Executor apps' tools are now regular Pi tools. You can search for them, set approval rules on them such as github.*, and call them from Pi's codemode.
• A workflow you repeat can be saved as a tool with a name and fixed inputs, so next time it's one call. When the agent writes a script that works, it can offer to save it, and you review it first.
• MCP works again in the Pendant VS Code extension and other hosts that freeze Pi's theme. Before, every MCP call failed there.
• mcpScript is gone. Pi's own codemode does the same job and works with the rest of Pi; see Breaking. The new features need Pi 0.99 or later.

Breaking

• The adapter had its own script tool, mcpScript, next to Pi's codemode. Pi's codemode now reaches every adapter tool by name (#861) and lets permission extensions see each call, where mcpScript showed them one call, so mcpScript is gone. So are jev.evaluate(), the settings.scriptMode and settings.scriptSkill settings, the settings.jev keys scriptEvaluation, maxEvaluationsPerScript, maxEvaluationBytesPerScript and maxEvaluationTokensPerScript, the bundled mcp-scripting skill, the examples/jev-*.mjs recipes and the quickjs-wasi dependency. To script MCP calls, add "+codemode" to defaultTools in Pi's settings (MCP scripting). A config that still sets the removed keys loads as before and shows a notice that names the file and the keys. Jev now serves semantic search only. Results a codemode script asks for reach it whole, as they did in mcpScript, while results that go to the model are guarded as before. Observed output shapes, which only script sessions saved, are now saved to mcp-cache.json by every session unless the server's tool list is private. Type changes: McpSettings loses scriptMode and scriptSkill, McpSettings.jev loses the four keys above, JevErrorCode loses "budget_exhausted", JevBudget is gone, and ResolvedJevSettings loses the same four fields. See #862.

Added

• On its default URL, Executor hands an app tool's approval or question to the model and asks it to check with you, but nothing stopped the model from approving by itself. Pi now asks you instead: the adapter shows the request in Pi's dialogs, resumes the program with your answer, and gives the model only the result. The adapter refuses a resume call from the model, and in a session that can't show dialogs the call fails. Executor's execute and call also get a 6-minute timeout unless the server sets requestTimeoutMs, so programs no longer stop at the 60-second default. See #860.
• Pi's codemode scripts and tool_search couldn't see the adapter's MCP tools, apart from direct and search-mode ones, and permission extensions saw a proxy call only as a call to mcp. On Pi 0.99 and later, every cached tool the model could reach through mcp is now also a Pi deferred tool named mcp__<server>__<tool>, the way Pi's built-in MCP names its tools. Scripts can call it by that name and tool_search can find and activate it. A call through mcp or mcp__<server> runs as a nested Pi tool call under that name, so tool_call hooks and permission extensions see the real tool and its annotations; approveTools still asks only once. Nothing new is added to the model's tool list or system prompt, and a tool that tool_search activates has no snippet line, like Pi's built-in MCP tools. The adapter does not take a name another extension registered while the session is running. MCP_DIRECT_TOOLS=__none__, excludeTools and disabled: true keep tools out. A --tools list on Pi 1.1 and later doesn't remove these tools; use --exclude-tools 'mcp__*' for a session without MCP. With 100 servers of 50 tools each, MCP is ready about 90 ms later on a warm metadata cache and about 2.6 seconds later on the first session that has to fetch it. See #861 and Codemode and tool_search.
• A workflow you repeat had to be written again as a new codemode script every time, with no fixed inputs, no name a subagent could be limited to, and nothing a permission extension could match. scriptTools in the adapter config now saves a script file as a tool with its own description and input schema. On Pi 0.99.0 and later each one is a Pi deferred tool named mcp__script__<name>: the model finds it with tool_search or a word or regex mcp({ search }) and calls it like any other tool, and the script runs in Pi's codemode with the call's arguments as input. Nothing new is added to the model's tool list or system prompt unless an entry sets declare: true. Each call inside a script tool goes through approveTools and permission extensions on its own. Script tools from project files need project trust and your approval, as project servers do; the approval covers the entry, not the script file's contents. McpConfig gains scriptTools, typed by the new ScriptToolDefinition in pi-mcp-adapter/types, and pi-mcp-adapter/config now imports the typebox peer when it loads. See #863 and Script tools.
• Turning a script the agent wrote into a script tool meant copying the code into a file and editing the config by hand. Now the model can call mcp({ action: "save-script", args: { name, description, code, inputSchema } }), and Pi asks you twice before anything is written: first a summary of the two files, with diffs of the config change and of any script the save replaces, then the whole script in Pi's editor, where you can change it before saving. The script goes to mcp-scripts/<name>.js beside the global or project adapter config, the entry's file is relative to that config, and the tool works in the same session as mcp__script__<name>. A save is refused in print, JSON and RPC sessions and subagents, from inside another tool, in a project Pi doesn't trust, on Pi older than 0.99.0, for a name another tool has, and when the files changed after you approved. The mcp tool gains one description line and one word in its action parameter, which settings.allowScriptToolSave: false removes along with the action. McpSettings gains allowScriptToolSave. See #864 and Saving a script as a tool.
• When an Executor app needed an account you hadn't connected, the call failed and Executor's instructions had the model create a connect link and paste it into the chat. That took several turns, and on local Executor the link carries a sign-in token. Now, when a single Executor call fails for that reason, Pi gets the link itself, asks before opening it in your browser, checks the connection once you choose Continue, and retries the call once. The link never reaches the model. A batch, execute, a headless or non-TUI session, or a declined prompt still returns Executor's own message. See #865.
• Executor lists only its own six tools, so the tools of your Executor apps were out of reach of tool_search, codemode scripts, approveTools and permission extensions, and the model had to go through Executor's search and call. On Executor's default URL and Pi 0.99 and later, each app tool is now a Pi deferred tool named mcp__<server>__<app>_<tool>, up to 1,000 per Executor server, found with tool_search, codemode's searchTools() and mcp({ search }). A call runs as one Executor call, approveTools matches the tool's path (such as github.*) and asks once, and the result is the tool's own value. Nothing new reaches the model's tool list or system prompt, even with directTools. The catalog is cached, and read again when a call names an unknown path, on reconnect, on Executor's tools/list_changed and after an hour; /mcp-adapter shows the count and the cap. App tools have no JSON input schema: the description holds Executor's TypeScript input type, and mcp({ describe }) fetches the full signature when Executor shortened it. The first session with no cached catalog registers the app tools during startup, about half a second more with 5,000 other tools; later sessions add about 20 ms. The host-managed entry point doesn't reach app tools, and hosted Executor hasn't been tried yet. ServerCacheEntry gains executorApps, ToolMetadata and DirectToolSpec gain executorPath, and pi-mcp-adapter/types exports CachedExecutorAppTool. See #866 and Executor app tools.

Fixed

• On hosts that freeze ctx.ui.theme, such as the Pendant VS Code extension, every MCP call failed with "'get' on proxy: property 'fg' is a read-only and non-configurable data property", so no server could be used. MCP now works there, and its UI calls still stop after a reload as they do elsewhere. Thanks to @​ocean1798 for #872.

Changelog

Sourced from pi-mcp-adapter's changelog.

[6.0.0] - 2026-10-22

Highlights

• If you use Executor, Pi now asks you before an app tool does anything that needs approval, where before the model could approve it for you. When an app needs an account you haven't connected, Pi opens the sign-in link in your browser and finishes the call once you're done.
• Your Executor apps' tools are now regular Pi tools. You can search for them, set approval rules on them such as github.*, and call them from Pi's codemode.
• A workflow you repeat can be saved as a tool with a name and fixed inputs, so next time it's one call. When the agent writes a script that works, it can offer to save it, and you review it first.
• MCP works again in the Pendant VS Code extension and other hosts that freeze Pi's theme. Before, every MCP call failed there.
• mcpScript is gone. Pi's own codemode does the same job and works with the rest of Pi; see Breaking. The new features need Pi 0.99 or later.

Breaking

• The adapter had its own script tool, mcpScript, next to Pi's codemode. Pi's codemode now reaches every adapter tool by name (#861) and lets permission extensions see each call, where mcpScript showed them one call, so mcpScript is gone. So are jev.evaluate(), the settings.scriptMode and settings.scriptSkill settings, the settings.jev keys scriptEvaluation, maxEvaluationsPerScript, maxEvaluationBytesPerScript and maxEvaluationTokensPerScript, the bundled mcp-scripting skill, the examples/jev-*.mjs recipes and the quickjs-wasi dependency. To script MCP calls, add "+codemode" to defaultTools in Pi's settings (MCP scripting). A config that still sets the removed keys loads as before and shows a notice that names the file and the keys. Jev now serves semantic search only. Results a codemode script asks for reach it whole, as they did in mcpScript, while results that go to the model are guarded as before. Observed output shapes, which only script sessions saved, are now saved to mcp-cache.json by every session unless the server's tool list is private. Type changes: McpSettings loses scriptMode and scriptSkill, McpSettings.jev loses the four keys above, JevErrorCode loses "budget_exhausted", JevBudget is gone, and ResolvedJevSettings loses the same four fields. See #862.

Added

• On its default URL, Executor hands an app tool's approval or question to the model and asks it to check with you, but nothing stopped the model from approving by itself. Pi now asks you instead: the adapter shows the request in Pi's dialogs, resumes the program with your answer, and gives the model only the result. The adapter refuses a resume call from the model, and in a session that can't show dialogs the call fails. Executor's execute and call also get a 6-minute timeout unless the server sets requestTimeoutMs, so programs no longer stop at the 60-second default. See #860.
• Pi's codemode scripts and tool_search couldn't see the adapter's MCP tools, apart from direct and search-mode ones, and permission extensions saw a proxy call only as a call to mcp. On Pi 0.99 and later, every cached tool the model could reach through mcp is now also a Pi deferred tool named mcp__<server>__<tool>, the way Pi's built-in MCP names its tools. Scripts can call it by that name and tool_search can find and activate it. A call through mcp or mcp__<server> runs as a nested Pi tool call under that name, so tool_call hooks and permission extensions see the real tool and its annotations; approveTools still asks only once. Nothing new is added to the model's tool list or system prompt, and a tool that tool_search activates has no snippet line, like Pi's built-in MCP tools. The adapter does not take a name another extension registered while the session is running. MCP_DIRECT_TOOLS=__none__, excludeTools and disabled: true keep tools out. A --tools list on Pi 1.1 and later doesn't remove these tools; use --exclude-tools 'mcp__*' for a session without MCP. With 100 servers of 50 tools each, MCP is ready about 90 ms later on a warm metadata cache and about 2.6 seconds later on the first session that has to fetch it. See #861 and Codemode and tool_search.
• A workflow you repeat had to be written again as a new codemode script every time, with no fixed inputs, no name a subagent could be limited to, and nothing a permission extension could match. scriptTools in the adapter config now saves a script file as a tool with its own description and input schema. On Pi 0.99.0 and later each one is a Pi deferred tool named mcp__script__<name>: the model finds it with tool_search or a word or regex mcp({ search }) and calls it like any other tool, and the script runs in Pi's codemode with the call's arguments as input. Nothing new is added to the model's tool list or system prompt unless an entry sets declare: true. Each call inside a script tool goes through approveTools and permission extensions on its own. Script tools from project files need project trust and your approval, as project servers do; the approval covers the entry, not the script file's contents. McpConfig gains scriptTools, typed by the new ScriptToolDefinition in pi-mcp-adapter/types, and pi-mcp-adapter/config now imports the typebox peer when it loads. See #863 and Script tools.
• Turning a script the agent wrote into a script tool meant copying the code into a file and editing the config by hand. Now the model can call mcp({ action: "save-script", args: { name, description, code, inputSchema } }), and Pi asks you twice before anything is written: first a summary of the two files, with diffs of the config change and of any script the save replaces, then the whole script in Pi's editor, where you can change it before saving. The script goes to mcp-scripts/<name>.js beside the global or project adapter config, the entry's file is relative to that config, and the tool works in the same session as mcp__script__<name>. A save is refused in print, JSON and RPC sessions and subagents, from inside another tool, in a project Pi doesn't trust, on Pi older than 0.99.0, for a name another tool has, and when the files changed after you approved. The mcp tool gains one description line and one word in its action parameter, which settings.allowScriptToolSave: false removes along with the action. McpSettings gains allowScriptToolSave. See #864 and Saving a script as a tool.
• When an Executor app needed an account you hadn't connected, the call failed and Executor's instructions had the model create a connect link and paste it into the chat. That took several turns, and on local Executor the link carries a sign-in token. Now, when a single Executor call fails for that reason, Pi gets the link itself, asks before opening it in your browser, checks the connection once you choose Continue, and retries the call once. The link never reaches the model. A batch, execute, a headless or non-TUI session, or a declined prompt still returns Executor's own message. See #865.
• Executor lists only its own six tools, so the tools of your Executor apps were out of reach of tool_search, codemode scripts, approveTools and permission extensions, and the model had to go through Executor's search and call. On Executor's default URL and Pi 0.99 and later, each app tool is now a Pi deferred tool named mcp__<server>__<app>_<tool>, up to 1,000 per Executor server, found with tool_search, codemode's searchTools() and mcp({ search }). A call runs as one Executor call, approveTools matches the tool's path (such as github.*) and asks once, and the result is the tool's own value. Nothing new reaches the model's tool list or system prompt, even with directTools. The catalog is cached, and read again when a call names an unknown path, on reconnect, on Executor's tools/list_changed and after an hour; /mcp-adapter shows the count and the cap. App tools have no JSON input schema: the description holds Executor's TypeScript input type, and mcp({ describe }) fetches the full signature when Executor shortened it. The first session with no cached catalog registers the app tools during startup, about half a second more with 5,000 other tools; later sessions add about 20 ms. The host-managed entry point doesn't reach app tools, and hosted Executor hasn't been tried yet. ServerCacheEntry gains executorApps, ToolMetadata and DirectToolSpec gain executorPath, and pi-mcp-adapter/types exports CachedExecutorAppTool. See #866 and Executor app tools.

Fixed

• On hosts that freeze ctx.ui.theme, such as the Pendant VS Code extension, every MCP call failed with "'get' on proxy: property 'fg' is a read-only and non-configurable data property", so no server could be used. MCP now works there, and its UI calls still stop after a reload as they do elsewhere. Thanks to @​ocean1798 for #872.

Commits

• 6a3dc80 chore: release v6.0.0
• dfc8531 docs: add highlights for the unreleased changes (#877)
• d17bc07 fix: keep MCP working on hosts that freeze ctx.ui.theme (#876)
• 38f2c60 feat: make Executor app tools Pi tools, found by search and approved by path ...
• f7bdf10 feat: connect a missing Executor account from Pi and retry the call (#874)