[trvon]

Summary

• Bump dev dependencies @earendil-works/pi-coding-agent and @earendil-works/pi-tui from 1.2.0 to 1.4.0 (exact pins, same as before). This replaces Dependabot PRs build(deps-dev): bump @earendil-works/pi-tui from 1.2.0 to 1.3.0 #156 and build(deps-dev): bump @earendil-works/pi-coding-agent from 1.2.0 to 1.3.0 #157 (1.3.0).
• Add an undici: ^8.12.3 entry to overrides, next to the existing postcss override. pi-coding-agent 1.2.0–1.4.0 pins undici@8.10.2, and that version now has several high-severity advisories (GHSA-4qv8-2p9j-2685, GHSA-2m5v-pch6-74hx, …). Because of them, npm run audit:all fails on master's lockfile today. The override only changes the dev install. Published consumers are unaffected.

API migration review (pi 1.2.0 → 1.4.0)

I read the pi-coding-agent CHANGELOG for 1.3.0 and 1.4.0. Neither release has extension-API breaking changes that affect pi-loop, so no source changes were needed. Typecheck and tests pass unchanged.

• 1.4.0: before_provider_headers no longer sees attribution headers, and generateSummary() ignores reserveTokens. pi-loop uses neither.
• 1.4.0: extension tools stay active on resume unless registered with defaultActive: false. pi-loop doesn't use defaultActive, so its tools behave as before (and better on resumed sessions).
• 1.2.0, already on master: BeforeAgentStartEvent became a union on messageType. pi-loop's before_agent_start handler ignores the event payload, so this is still safe.

peerDependencies stay at "*". pi-loop uses no API added in 1.3 or 1.4, so a >=1.4.0 floor would only cause install warnings for users on older pi without protecting anything.

Verification

Command	Result
npm ci	ok
npm run lint	ok, 2 warnings + 1 info that were already there (no linted files changed)
npm run typecheck	ok
npm test	82 files / 1286 tests passed
npm run build	ok
npm run test:package	package smoke passed (73 files; public types compiled)
npm run audit:all	found 0 vulnerabilities (before the override: 1 high, 1 moderate)
git diff --check	clean

Note: I ran test:package and audit:all with npm 11, which matches CI's Node 22 toolchain. Locally, npm 12.0.2 fails test:package because npm pack --json now returns an object keyed by package name instead of an array, so scripts/package-smoke.mjs reads packReport[0] as undefined. npm 12 also refuses npm run audit:all with EALLOWSCRIPTS. Both come from the local npm version and have nothing to do with this change. They're worth a separate follow-up if npm 12 support matters.