fix(spawn): harden abort/reset race handling, bump Pi to 0.84.1, clear security allowlist

.github/renovate.json

@@ -0,0 +1,16 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:recommended"],
+  "packageRules": [
+    {
+      "matchPackageNames": [
+        "@earendil-works/pi-ai",
+        "@earendil-works/pi-coding-agent",
+        "@earendil-works/pi-tui",
+        "typebox"
+      ],
+      "groupName": "Pi compatibility dependencies",
+      "rangeStrategy": "pin"
+    }
+  ]
+}

.github/workflows/test.yml

@@ -20,6 +20,7 @@ on:
   pull_request:
     branches: [main]
     paths-ignore: ['*.md', '**/docs/**']
+  workflow_dispatch:
 
 jobs:
   # ── Cross-platform test matrix ──────────────────────────────────────
@@ -71,22 +72,41 @@ jobs:
       - name: E2E tests
         run: npm run test:e2e
 
-      # Compatibility contracts run from a foreign cwd on the floor and Windows lanes.
-      - name: Exact-floor compatibility contract
-        if: (matrix.os == 'ubuntu-latest' && matrix.node-version == '22.19.0') || matrix.os == 'windows-latest'
-        working-directory: ${{ runner.temp }}
-        run: node "${{ github.workspace }}/scripts/test-compat-floor.mjs"
-
-      - name: Packed Pi 0.82.0 host contract
+      # The packed extension is exercised from a foreign cwd with the latest host.
+      - name: Packed latest Pi host contract
         if: (matrix.os == 'ubuntu-latest' && matrix.node-version == '22.19.0') || matrix.os == 'windows-latest'
         working-directory: ${{ runner.temp }}
+        env:
+          COMPAT_ARTIFACT_DIR: ${{ runner.temp }}/packed-host-diagnostics-${{ matrix.os }}-node-${{ matrix.node-version }}
         run: node "${{ github.workspace }}/scripts/test-package-host.mjs"
 
+      - name: Upload packed host diagnostics
+        if: always() && ((matrix.os == 'ubuntu-latest' && matrix.node-version == '22.19.0') || matrix.os == 'windows-latest')
+        uses: actions/upload-artifact@v4
+        with:
+          name: packed-host-diagnostics-${{ matrix.os }}-node-${{ matrix.node-version }}-attempt-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/packed-host-diagnostics-${{ matrix.os }}-node-${{ matrix.node-version }}
+          if-no-files-found: warn
+          overwrite: true
+          retention-days: 30
+
       - name: Synchronized current Pi compatibility on Windows
         if: matrix.os == 'windows-latest'
         working-directory: ${{ runner.temp }}
+        env:
+          COMPAT_ARTIFACT_DIR: ${{ runner.temp }}/current-pi-diagnostics-windows-node-24
         run: node "${{ github.workspace }}/scripts/test-compat-current.mjs"
 
+      - name: Upload current Pi diagnostics on Windows
+        if: always() && matrix.os == 'windows-latest'
+        uses: actions/upload-artifact@v4
+        with:
+          name: current-pi-diagnostics-windows-node-24-attempt-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/current-pi-diagnostics-windows-node-24
+          if-no-files-found: warn
+          overwrite: true
+          retention-days: 30
+
       # Upload test results for debugging — artifacts available for 30 days.
       - name: Upload test results
         if: always()
@@ -108,4 +128,15 @@ jobs:
       - run: npm ci
       - name: Synchronized current Pi compatibility
         working-directory: ${{ runner.temp }}
+        env:
+          COMPAT_ARTIFACT_DIR: ${{ runner.temp }}/current-pi-diagnostics-ubuntu-node-24
         run: node "${{ github.workspace }}/scripts/test-compat-current.mjs"
+      - name: Upload current Pi diagnostics
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: current-pi-diagnostics-ubuntu-node-24-attempt-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/current-pi-diagnostics-ubuntu-node-24
+          if-no-files-found: warn
+          overwrite: true
+          retention-days: 30

audit-ci.jsonc

@@ -1,21 +1,5 @@
 {
   "$schema": "https://github.com/IBM/audit-ci/raw/main/docs/schema.json",
   "moderate": true,
-  "allowlist": [
-    // brace-expansion 5.0.7 is pinned by @earendil-works/pi-coding-agent's
-    // published npm-shrinkwrap.json (the host under test); registry fix 5.0.9
-    // exists but cannot be installed without deviating from the host tree —
-    // remove when a pi-coding-agent release ships brace-expansion ≥5.0.9.
-    { "GHSA-mh99-v99m-4gvg": { "active": true, "expiry": "2026-10-01", "notes": "brace-expansion <5.0.8 DoS via unbounded expansion; 5.0.7 pinned by @earendil-works/pi-coding-agent's npm-shrinkwrap (host under test) — remove when pi-coding-agent ships brace-expansion ≥5.0.8" } },
-    { "GHSA-rgw5-rvv9-x895": { "active": true, "expiry": "2026-10-01", "notes": "brace-expansion <5.0.9 DoS bypassing the CVE-2026-14257 mitigation; 5.0.7 pinned by @earendil-works/pi-coding-agent's npm-shrinkwrap — remove when pi-coding-agent ships brace-expansion ≥5.0.9" } },
-    // undici 8.5.0 is pinned exactly by @earendil-works/pi-coding-agent (the host
-    // under test); no released pi-coding-agent ships undici ≥8.9.0 (upstream
-    // issue #7049, PR #7225 closed unmerged) — remove when a pi-coding-agent
-    // release ships undici ≥8.9.0.
-    { "GHSA-4cwx-7wf7-3272|@earendil-works/pi-coding-agent>undici": { "active": true, "expiry": "2026-10-01", "notes": "undici <8.9.0 high: cross-user cache disclosure / parse-time crash; pinned exact 8.5.0 by @earendil-works/pi-coding-agent 0.82.0 (host under test); no upstream fix released — remove when pi-coding-agent ships undici ≥8.9.0" } },
-    { "GHSA-8xcm-r25x-g524|@earendil-works/pi-coding-agent>undici": { "active": true, "expiry": "2026-10-01", "notes": "undici <8.9.0: retry-interceptor response desynchronization; pinned exact 8.5.0 by @earendil-works/pi-coding-agent 0.82.0 — remove when pi-coding-agent ships undici ≥8.9.0" } },
-    { "GHSA-jr45-8vmc-qm54|@earendil-works/pi-coding-agent>undici": { "active": true, "expiry": "2026-10-01", "notes": "undici <8.9.0: Cache-Control whitespace bypass; pinned exact 8.5.0 by @earendil-works/pi-coding-agent 0.82.0 — remove when pi-coding-agent ships undici ≥8.9.0" } },
-    { "GHSA-m8rv-5g2x-5cg5|@earendil-works/pi-coding-agent>undici": { "active": true, "expiry": "2026-10-01", "notes": "undici <8.9.0: CRLF injection via blob-like body type; pinned exact 8.5.0 by @earendil-works/pi-coding-agent 0.82.0 — remove when pi-coding-agent ships undici ≥8.9.0" } },
-    { "GHSA-v3r7-h72x-cjcm|@earendil-works/pi-coding-agent>undici": { "active": true, "expiry": "2026-10-01", "notes": "undici <8.9.0: cookie attribute injection; pinned exact 8.5.0 by @earendil-works/pi-coding-agent 0.82.0 — remove when pi-coding-agent ships undici ≥8.9.0" } }
-  ]
+  "allowlist": []
 }