chore(deps): update ⬆️ mise-packages

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
aqua:earendil-works/pi	tools	patch	0.84.2 → 0.84.3	0.84.4
aqua:sst/opencode	tools	patch	1.18.21 → 1.18.23	1.18.25 (+1)
aqua:vercel-labs/agent-browser	tools	minor	0.34.0 → 0.35.0	0.35.1
github:anthropics/claude-code	tools	patch	v2.1.241 → v2.1.245	v2.1.251 (+4)
github:backnotprop/plannotator	tools	patch	v0.27.7 → v0.27.8	v0.27.9
github:janosmiko/lfk	tools	patch	v0.18.1 → v0.18.2	v0.18.4 (+1)
github:modem-dev/hunk	tools	patch	v0.19.0 → v0.19.1	v0.20.0
usage	tools	minor	6.2.0 → 6.4.0	6.5.0 (+1)

Release notes are maintained in a PR comment by the renovate-release-notes-comment workflow.

---

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

• Branch creation
  • Between 03:00 AM and 05:59 AM (* 3-5 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[scottames-github-bot]

Renovate Release Notes

Generated from Renovate's update table by the renovate-release-notes-comment workflow.

Packages that cannot be summarized from GitHub releases are listed explicitly below.

earendil-works/pi (aqua:earendil-works/pi)

v0.84.3: v0.84.3

Compare Source

New Features

• PowerShell tool — Use optional native PowerShell command execution on Windows. See PowerShell Tool.
• Safer managed updates — Stage, verify, and atomically activate updates for installer-managed installations. See Install and Manage.
• Model and thinking controls — Select thinking levels with /thinking, search defaults, keep selections session-scoped, and persist them explicitly with Ctrl+S. See Models and Thinking.

Breaking Changes

• Renamed the inherited GoogleThinkingLevel type to GoogleApiThinkingLevel and added ResolvedGoogleThinkingLevel for normalized adapter levels.

Added

• Added an optional powershell tool for Windows, configurable through defaultTools and the SDK. See PowerShell Tool.
• Added a /thinking selector and searchable default choices to the model and thinking selectors; Ctrl+S saves the selected model as the global default. See Models and Thinking.
• Added optional routing session IDs to exported compaction summary helpers so callers can preserve provider routing without enabling prompt cache writes.
• Added transcript usage notices for compaction and branch summaries when cache miss notices are enabled.
• Added session_compact_failed extension events so compaction failures and aborts expose their reason, retry state, source, and error message to handlers (#8175).
• Added inherited provider-neutral toolChoice support to simple stream requests.
• Added inherited automatic Anthropic server-side refusal fallback for supported first-party models, including returned-model usage pricing (#8017).
• Added inherited configurable OpenAI-compatible thinking-token budget fields for vLLM, Qwen/SGLang, and llama.cpp servers. See OpenAI Compatibility (#8275 by @​bnsd55).
• Added inherited China-specific ZAI Coding Plan models, including GLM-4.6V vision support and API-equivalent usage cost estimates (#8220).
• Added inherited deepseek-v4-pro-0813 support to the Qwen Token Plan Individual catalog (#8194).

Changed

• Changed experimental installer-managed installations so pi update stages, verifies, and atomically activates the selected release in place. See Install and Manage.
• Changed inherited built-in xAI models to use the Responses API with encrypted reasoning replay and made Grok 4.6 the default xAI model (#8124 by @​Jaaneek).
• Changed inherited Anthropic, Azure OpenAI, Google, Mistral, and OpenAI adapters to send Pi's default User-Agent unless overridden (#8305).
• Changed Windows and WSL keybinding defaults to avoid terminal-reserved shortcuts for image paste, model cycling, editor undo, fullscreen transcript navigation and search, and message queueing (#8372).
• Changed Bun release archives to ship the native clipboard binary only inside the wrapper package, removing a duplicate platform package from each archive.
• Changed package resource glob expansion to use Node.js's built-in implementation with deterministic visible-path matching, reducing the installed runtime dependency tree.
• Changed the bundled Node.js runtime to load jiti only when importing an extension and Babel only when uncached source needs transformation, reducing CLI startup time and bundle size.
• Changed syntax highlighting to initialize only twenty common languages eagerly and defer the remaining grammars until after the initial TUI render, reducing CLI startup time.
• Changed the Node.js CLI and RPC entrypoints to load a bundled runtime, reducing startup filesystem reads while keeping the public library and legacy module paths on the modular runtime for normal dependency identity.
• Changed session sharing to render clickable terminal links, display only the canonical Radius artifact URL, and include the current system prompt and active tool definitions in Radius session shares.

Fixed

• Fixed failed extension factories leaving event subscriptions, provider registrations, and default flag state active (#8424 by @​acmerfight).
• Fixed models.json typings omitting the documented OpenAI-compatible compat.supportsFinishReason provider and model override (#8487 by @​petrroll).
• Fixed /model and /thinking selections being persisted globally unless explicitly saved with Ctrl+S (#5263).
• Fixed JSON and RPC toolcall_start events omitting the tool call id and name (#7953 by @​christianklotz).
• Fixed extensions failing to load when the Node.js CLI runs as a single-executable application (#8237).
• Fixed nested Markdown skills inside .agents/skills/ grouping directories not being discovered.
• Fixed compaction and branch summarization requests exposing tools to providers.
• Fixed single-object edit tool inputs failing validation by accepting them as one-edit arrays in both coding-agent and harness edit tools (#7835).
• Fixed root Markdown files such as README.md and AGENTS.md in skill directories being reported as broken skills unless they declare valid skill frontmatter (#7805).
• Fixed the default Cerebras model referencing an unavailable Z.AI model.
• Fixed inherited OpenAI-compatible Chat Completions reasoning replay to preserve and resend assistant-level reasoning_details verbatim and in order (#7994).
• Fixed inherited Anthropic server-side fallback responses being priced with the requested model instead of the returned fallback model (#8285).
• Fixed inherited GitHub Copilot login triggering model-policy rate limits by limiting policy updates, retrying model discovery once, and honoring server retry delays (#7850).
• Fixed inherited Amazon Bedrock dropping and failing to replay opaque redacted reasoning from non-Anthropic models (#8314 by @​seiji).
• Fixed inherited Z.AI Coding Plan models deriving incomplete reasoning-effort metadata, including missing GLM-5.3 low, high, and max levels (#8336).
• Fixed inherited DeepSeek V4 Flash on OpenCode and OpenCode Go omitting its supported low thinking level (#8181 by @​tianshuang).
• Fixed inherited Azure OpenAI Responses ignoring toolChoice in provider-specific stream requests.
• Fixed inherited Amazon Bedrock response hooks receiving only a synthesized request id instead of the raw response headers (#8234).
• Fixed inherited Kimi usage reporting so top-level cached_tokens count as cache reads instead of normal input tokens (#8075).
• Fixed inherited Google custom models ignoring thinkingLevelMap, which dropped extended thinking controls (#8135).
• Fixed writes to auth.json and models-store.json overriding administrator-managed file permissions and ACLs (#7779).
• Fixed UTF-8 BOM markers preventing frontmatter and user configuration files from loading (#8337).
• Fixed invalid settings files being easy to miss during interactive startup by rendering warnings with the file path inside the TUI (#7829).
• Fixed the subagent example repeatedly prompting before running project-local agents in trusted repositories (#8261).
• Fixed npm package update checks treating older registry versions as available updates, preventing pi update from downgrading already-newer installed packages (#8226).
• Fixed built-in llama.cpp models disappearing from /model when /llama refreshed a configured server under PI_OFFLINE, and included idle-slept sleeping router models in the selectable catalog (#8167).
• Fixed pi.registerFlag() accepting default values that do not match the declared flag type (#8064).
• Fixed Z.AI Coding Plan defaults referencing the removed GLM-5.1 model (#8096).
• Fixed repeated ambiguous truncated-response recovery being mislabeled as context overflow (#8130).
• Fixed duplicate fullscreen right-click paste in VS Code-based terminals on Windows (#8186).
• Fixed inherited padded text exceeding narrow terminal widths (#8252).
• Fixed inherited wrapped Markdown table links leaking color into borders and neighboring cells, including tables inside blockquotes (#8335).
• Fixed llama.cpp login guidance to direct users to /llama before /model when no local models are loaded (#8203).
• Fixed hung pi.dev model catalog requests consuming the entire refresh deadline without retrying (#8198).
• Fixed inherited Xiaomi model catalogs listing shut-down MiMo V2 models in /model and --list-models (#8187).
• Fixed branch summary entries recording the navigation destination in fromId instead of the pre-navigation source leaf.
• Fixed threshold auto-compaction being skipped when providers omit streaming usage data (#8328).
• Fixed dash-prefixed prompts being parsed as options by supporting -- as an end-of-options delimiter (#7269).

sst/opencode (aqua:sst/opencode)

v1.18.23: v1.18.23

Compare Source

Core

Bugfixes

• Fixed Cloudflare AI Gateway routing for third-party providers so non-Workers models work through the gateway's REST API. (@​superhighfives)
• Fixed Anthropic models through Cloudflare AI Gateway by converting dotted model IDs like claude-haiku-4.5 to the dashed slug Anthropic expects. (@​superhighfives)
• Fixed parent session IDs being sent in request headers for session-aware providers.

TUI

Bugfixes

• Fixed GitHub auth for immutable OIDC subject tokens.

Thank you to 1 community contributor:

• @​superhighfives:
  • fix(provider): send Anthropic's dashed native slug through the AI Gateway (#44281)
  • fix(provider): route non-native Cloudflare AI Gateway providers via the REST API (#44828)

v1.18.22: v1.18.22

Compare Source

Core

Bugfixes

• Removed outdated OpenCode Go first-month discount messaging and pricing.
• Fixed OpenCode device login links when servers return relative verification URLs or use a base path.
• Fixed textVerbosity being sent to OpenAI-compatible providers that do not support it. (@​joelstucki-taulia)
• Updated the Amazon Bedrock provider for compatibility fixes.

Desktop

Bugfixes

• Keep model provider headers visible while scrolling the model picker.

Thank you to 1 community contributor:

• @​joelstucki-taulia:
  • fix(provider): guard textVerbosity injection for @​ai-sdk/openai-compatible providers (#43915)

vercel-labs/agent-browser (aqua:vercel-labs/agent-browser)

v0.35.0: v0.35.0

Compare Source

New Features

• Added private proxy CA trust for locally launched Chromium on Linux. Use --ca-cert <path>, AGENT_BROWSER_CA_CERT, or caCert in config and MCP to import a PEM bundle or DER certificate into an isolated NSS trust store without disabling hostname, validity, or unrelated-authority verification. The effective CA persists across commands in a running session, equivalent certificate content reuses Chromium, and --no-ca-cert explicitly clears retained trust. Unsupported launch modes and conflicting CA options return actionable errors (#1669)

Improvements

• Added a bundled protected Vercel deployments skill that guides agents through short-lived Trusted Sources OIDC authentication, authorized automation bypasses, and explicit human handoffs for dashboard-only configuration (#1705)

Contributors

• @​Railly
• @​ctate
• @​bilby91

anthropics/claude-code (github:anthropics/claude-code)

v2.1.245: v2.1.245

Compare Source

What's changed

• Fixed a crash on startup on Linux distributions that ship glibc 2.44 (for example Arch Linux, CachyOS and Fedora Rawhide)

backnotprop/plannotator (github:backnotprop/plannotator)

v0.27.8: v0.27.8

Compare Source

Follow @​plannotator on X for updates

Missed recent releases?

Release	Highlights
v0.27.7	Pi host crash fix on Windows, Call Flow tree cap, jj fork-point base, plannotator knowledge skill + llms.txt
v0.27.6	Live app annotation lands on Pi, one interaction model for HTML pages (same-day patch on v0.27.5)
v0.27.5	Annotate your running app, Agent TUI placement, collapsed lockfiles, VS Code theme fix, Pi fixes
v0.27.4	Portable Guided Review exports, guides.show share links, guide CLI, favicon switcher, jj Call Flow
v0.27.3	Folder watcher freeze fix on large repos, first SBOM-attested release pipeline
v0.27.2	Mobile plan and code review, Codex CLI 0.147 fix, folder annotate cold-start, configurable markdown extensions
v0.27.1	Open-in-editor launch fix, file headers respect Viewed/Git-add visibility toggles
v0.27.0	Call Flow analysis, --tailscale remote reviews, review panel remembers your view, Pi rebuild (breaking command rename), focus-mode shortcut
v0.26.8	Placed comment markers on HTML pages, shift-click multi-select, live app annotation
v0.26.7	Pinpoint targets any element on HTML pages, smarter hover labels, zero-scan hit testing
v0.26.6	Fixed empty environment variables in sandboxed sessions (Bun 1.3.14 builds)
v0.26.5	HTML pinpoint element annotations, durable annotate submissions, installer fallback for old git, vim HUD cursor fix

What's New in v0.27.8

A patch release with two quality-of-life fixes: Pi sessions stop losing their prompt cache when a plan finishes, and the thumbs-up returns to HTML annotation in a restrained form. Both came from user reports filed within the last week.

Pi keeps your prompt cache when a plan finishes

Finishing plan execution on Pi used to invalidate the LLM provider's prompt cache. Plannotator injects its plan instructions as conversation messages, and when the plan ended it deleted them from the middle of the chat history. Providers cache conversations front to back, so everything after the deleted message was re-billed at full uncached rates on the next turn. In the reporting user's session that meant re-paying for roughly 90 messages.

Plannotator no longer rewrites history. Old plan instructions stay where they are, and a note at the end of the conversation tells the model the plan is over and earlier instructions no longer apply. The phase instructions now state explicitly that they supersede anything Plannotator said before, so stale planning rules cannot keep steering the model. A regression test verifies each outgoing request extends the previous one byte for byte across the full planning, executing, and idle lifecycle.

Thanks @​WinPooh32 for the report, and especially for attaching the exact before/after request payloads. They turned diagnosis into a five minute job.

• #1381 by @​backnotprop, closing #1380 reported by @​WinPooh32

The thumbs-up is back on HTML pages

v0.27.5 made HTML and live-app annotation comment-only: delete and label tools were markdown concepts that never fit arbitrary pages. That ruling had a side effect we did not intend to keep: there was no longer any one-click way to say "this part is good." Approving something meant opening the comment composer and typing it out.

Exactly one label affordance returns: the 👍 "Looks good" button. Select text and it is in the toolbar; pinpoint-click an element and it is a one-click action in the comment composer (disabled once you start typing, so it can never discard a draft). Everything else about comment-only holds: no delete, no label picker, no label keyboard shortcuts, and the security clamp that stops a hostile page from forcing annotations through the bridge is untouched.

• 0ae40e73 by @​backnotprop, from a developer report

Additional Changes

• Embed picker seam for @​plannotator/ui hosts: the /embed slash-menu picker (target list, empty states, kind-aware upload adapter, paragraph splice) is now a host-configurable extension in the published UI package, shipped to npm as @​plannotator/ui@​0.31.0 with @​plannotator/core@​0.24.0. Plannotator's own apps are unaffected. #1382 by @​backnotprop

Install / Update

macOS / Linux:

curl -fsSL https://plannotator.ai/install.sh | bash

Windows:

irm https://plannotator.ai/install.ps1 | iex

Claude Code Plugin: Run /plugin in Claude Code, find plannotator, and click "Update now".

Pi: Update @​plannotator/pi-extension to 0.27.8 and restart Pi.

OpenCode: Clear cache and restart:

rm -rf ~/.bun/install/cache/@​plannotator

What's Changed

• fix(pi): append-only phase framing so plan transitions keep the prompt cache by @​backnotprop in #1381
• feat(ui): add embed media picker seam by @​backnotprop in #1382
• feat(annotate): restore a restricted thumbs-up on comment-only HTML surfaces by @​backnotprop in 0ae40e73

Community

• @​WinPooh32 reported the Pi cache invalidation in #1380 with the request payloads that made the diagnosis immediate
• The thumbs-up gap was reported directly by a developer using HTML annotation for report review

Full Changelog: backnotprop/plannotator@v0.27.7...v0.27.8

janosmiko/lfk (github:janosmiko/lfk)

v0.18.2: v0.18.2

Compare Source

0.18.2 (2026-08-25)

Features

• remember viewer display toggles across restarts (#690) (2bbc6b4)

Bug Fixes

• cluster-scoped views ignore the namespace selection (#677) (d7651e7)
• lock the load-modify-save in column prefs and sort memory (#693) (68113b6)
• respect the kubeconfig context namespace at startup (#688) (dab5baf)

modem-dev/hunk (github:modem-dev/hunk)

v0.19.1: v0.19.1

Compare Source

What's Changed

Hunk 0.19.1 improves CPU compatibility, npm installation, and diff rendering.

Highlights

• Run x64 builds on pre-Haswell processors and conservative VM CPU models by @​elucid in #797.
• Install cleanly from npm with executable platform binaries and without unnecessary Pierre dependencies for CLI-only users by @​benvinegar in #844 and #847.
• Keep reviews fast and visually accurate by caching complex Unicode width measurements and preserving Git moved-line colors on wrapped rows by @​benvinegar and @​HackAttack in #800 and #812.

Release notes: https://hunk.dev/changelog/0.19/
Full Changelog: modem-dev/hunk@v0.19.0...v0.19.1

jdx/usage (usage)

v6.4.0: v6.4.0: XDG config layers and terminal-aware help wrapping

Compare Source

This release adds XDG-based config file resolution, teaches --help to wrap to the terminal width with a smarter column layout, fixes zsh completions at mid-line cursor positions, and slims down the library's dependency tree with an independent Markdown feature.

Added

• XDG file layers for config resolution. FileLayer::xdg(XdgBase, path) resolves a relative path under the standard XDG config, data, state, cache, or runtime bases, honoring each base's defaults, absolute-path rules, and precedence with no new dependencies. Config and data bases include system search directories (with the user file winning), while state, cache, and runtime stay user-scoped. The Config derive gains matching #[usage(file(path = "…", xdg = "config"))] metadata that expands into the standard precedence chain in the emitted spec (#1303, @​jdx).

  use usage::config::{FileLayer, XdgBase};
  
  // Reads $XDG_CONFIG_HOME then $XDG_CONFIG_DIRS in precedence order,
  // falling back to $HOME/.config and /etc/xdg when unset.
  let layer = FileLayer::xdg(XdgBase::Config, "ex/config.toml");

Fixed

• Terminal help now wraps to the terminal width. Help output uses a hybrid column layout: long option spellings keep their description inline when at least 30 columns remain, otherwise the prose stacks under the shared description column. Paragraphs, section intros, annotations, bullet and numbered lists (with hanging indents), and labelled notes/warnings all wrap, while blank lines and preformatted (4-space/tab-indented) lines are preserved. The Rust reference renderer, the dependency-free usage-argv renderer, and the generated Go renderer stay in parity (#1304, @​jdx).
• zsh completions respect the cursor position. Generated zsh scripts now forward zsh's one-based CURRENT to complete-word as a zero-based --cword, so completing a word in the middle of a command line (for example --f before a trailing argument) resolves against the correct word instead of the last one (#1300, @​jdx, fixes #1298).

Changed

• Independent markdown and manpage doc features. Markdown and manpage rendering are now separate features so consumers who only generate Markdown can drop the roff dependency. The existing docs and roff feature names remain as aliases. Internally, heck, shell-words, and strum were replaced with focused in-tree implementations and unicode-width was bumped to 0.2, shrinking the dependency footprint while keeping the public API and error variants stable (#1301, @​jdx).

  usage-lib = { version = "6", default-features = false, features = ["markdown"] }

Full Changelog: jdx/usage@v6.3.0...v6.4.0

💚 Sponsor usage

usage is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools including mise, aube, hk, and more. Work on usage is funded by sponsorships.

If usage powers CLI specs, docs, or completions for a tool you maintain or use, please consider sponsoring at jdx.dev. Every sponsorship helps the project stay independent and moving.

v6.3.0: v6.3.0: Colorful help by default and a slimmer dependency tree

Compare Source

This release brings semantic colors to --help output by default, adds a runtime style vocabulary for help_template, tightens help-column layout, and removes the kdl and default miette dependencies from the library.

Added

• Semantic colors in help output by default. Coloured --help now renders headings, option literals, and metavariables with distinct semantic colors so pages are easier to scan, while plain and piped output stays untouched (#1297, @​jdx).

• Runtime style tags in help_template. Templates can now colour and emphasize their own prose with a dependency-free tag vocabulary of 23 named styles (heading, option, metavar, the 8 standard and 8 bright ANSI colors, plus bold, dim, italic, underline). Styles nest and combine, {$$…}/{/$$} escape a literal tag, and substituted section text stays opaque so prose containing {$red} is left alone. Malformed markup falls back safely instead of panicking, and the vocabulary is validated in both Rust derives and KDL specs (#1297, @​jdx).

  help_template = "{$heading}MY TOOL{/$}\n\n{{usage}}\n\n{$cyan}{{flags}}{/$}"
  

• Optional miette feature. With the library's own error rendering now built in, an opt-in miette feature makes UsageErr and KDL parse diagnostics implement miette::Diagnostic again, preserving source spans, labels, severity, and help text for callers that already use a miette reporter (#1296, @​jdx).

Fixed

• Long entries no longer widen the whole help table. The aligned usage column is now capped at 40% of the remaining width, so a single long flag, argument, or command name (for example --report-unused-disable-directives-severity <SEVERITY>) no longer forces every entry on the page into block layout. Oversized entries drop into a wrapped block under their own spelling while shorter neighbors keep a readable two-column layout. Applied consistently across the reference, zero-allocation, and Go renderers (#1293, @​jdx).
• Repeatability ellipses removed from output. The … marker is no longer appended to repeatable flags in help tables, Usage: synopses, Markdown, or generated SDK docs, so options render with ordinary spellings like --env <ENV>. Value-side ellipses (<arg>…) are unchanged, and repeatability is still preserved structurally in the spec via var (#1295, @​jdx).
• Go renderer now prints section prose. The Go help renderer honours the headings prose field introduced in v6.2.0, so a generated Go CLI renders the same declared section text as the Rust renderer instead of printing the heading alone (#1290, @​jdx).

Changed

• kdl and default miette dependencies removed. usage-lib now vendors a trimmed KDL v2 parser and renders diagnostics (source labels, help, and codes) with a small in-process renderer, dropping two dependencies from the default build without changing spec parsing behaviour. Apache-2.0 notices for the vendored code are recorded in NOTICE.md (#1296, @​jdx).

Breaking Changes

• UsageErr no longer derives miette::Diagnostic by default. Callers who relied on miette integration should enable the new miette feature to restore it (#1296).
• SpecFlag::usage() no longer round-trips the repeatability marker: parsing --flag… still sets var, but reprinting yields --flag. Keep var=#true as the source of truth in specs rather than relying on the … suffix surviving a reparse (#1295).

Full Changelog: jdx/usage@v6.2.0...v6.3.0

💚 Sponsor usage

usage is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools including mise, aube, hk, and more. Work on usage is funded by sponsorships.

If usage powers CLI specs, docs, or completions for a tool you maintain or use, please consider sponsoring at jdx.dev. Every sponsorship helps the project stay independent and moving.