Pi 0.80.8 spawn runtime compatibility

.github/workflows/test.yml

@@ -35,7 +35,7 @@ jobs:
       matrix:
         include:
           - os: ubuntu-latest
-            node-version: "22"    # minimum version on primary platform
+            node-version: "22.19.0" # exact supported floor on primary platform
           - os: ubuntu-latest
             node-version: "24"    # latest on primary platform
           - os: macos-latest
@@ -70,6 +70,21 @@ jobs:
         run: npm run test:e2e
 
       # Upload test results for debugging — artifacts available for 30 days.
+      - name: Exact-floor compatibility contract
+        if: (matrix.os == 'ubuntu-latest' && matrix.node-version == '22.19.0') || matrix.os == 'windows-latest'
+        working-directory: ${{ runner.temp }}
+        run: node "${{ github.workspace }}/scripts/test-compat-floor.mjs"
+
+      - name: Packed Pi 0.80.8 host contract
+        if: (matrix.os == 'ubuntu-latest' && matrix.node-version == '22.19.0') || matrix.os == 'windows-latest'
+        working-directory: ${{ runner.temp }}
+        run: node "${{ github.workspace }}/scripts/test-package-host.mjs"
+
+      - name: Synchronized current Pi compatibility on Windows
+        if: matrix.os == 'windows-latest'
+        working-directory: ${{ runner.temp }}
+        run: node "${{ github.workspace }}/scripts/test-compat-current.mjs"
+
       - name: Upload test results
         if: always()
         uses: actions/upload-artifact@v4
@@ -78,3 +93,16 @@ jobs:
           path: |
             tests/snapshots/
           retention-days: 30
+
+  current-pi:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: "24"
+          cache: "npm"
+      - run: npm ci
+      - name: Synchronized current Pi compatibility
+        working-directory: ${{ runner.temp }}
+        run: node "${{ github.workspace }}/scripts/test-compat-current.mjs"

CHANGELOG.md

@@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- Migrated child spawning to Pi 0.80.8's public selected-model and child-owned runtime APIs, added `max` thinking support, and dispose every created child session exactly once across completion, failure, abort, and reset races. Pi 0.80.8 and Node 22.19.0 are now the documented minimums; parent-only transient provider/auth state fails explicitly without model fallback.
 - Spawned child agents now inherit active registered parent tools executable in the child session, including MCP/extension tools such as ChunkHound when active and registered, while still excluding spawn and handoff and preserving child-local notebook tools.
 
 ## [0.3.0] - 2026-05-23

README.md

@@ -42,6 +42,10 @@ Then disable pi's built-in compaction so handoff stays in control:
 
 That's it. Your agent now has `spawn`, `notebook_write`, `notebook_read`, `notebook_index`, and `handoff`. The status bar shows context usage and notebook count.
 
+### Compatibility
+
+pi-agenticoding requires **Pi 0.80.8 or later** and **Node.js 22.19.0 or later**. Spawn passes Pi's already-selected public model into a child-owned runtime. Persisted, environment-based, and extension-rediscoverable provider/auth configuration is available to children; parent-only transient credentials, inline provider factories, or in-memory catalog changes are not guaranteed to be rediscoverable. In that unsupported case, spawn reports the child resolution/auth failure and does not silently select another model.
+
 ---
 
 ## What You Get
@@ -104,7 +108,7 @@ The agent decided to spawn research children, save reusable findings to the note
 
 ### Spawn — Isolate Noise
 
-Delegate messy work to an isolated child agent with clean context. The child inherits the parent's model, thinking level, cwd, and active registered tools executable in the child session, including MCP/extension tools such as ChunkHound when they are active and registered. Child-local notebook tools remain available, but children cannot spawn grandchildren or handoff. Siblings run in parallel; the parent stays focused on orchestration.
+Delegate messy work to an isolated child agent with clean context. The child inherits the parent's already-selected public model, thinking level (including `max`), cwd, and active registered tools executable in the child session, including MCP/extension tools such as ChunkHound when they are active and registered. Child-local notebook tools remain available, but children cannot spawn grandchildren or handoff. Each child owns an isolated in-memory session that spawn disposes when execution ends. Siblings run in parallel; the parent stays focused on orchestration.
 
 ### Notebook — Continuity Across Cuts
 

audit-ci.jsonc

@@ -2,18 +2,9 @@
   "$schema": "https://github.com/IBM/audit-ci/raw/main/docs/schema.json",
   "moderate": true,
   "allowlist": [
-    // Upstream: pi-coding-agent ships a shrinkwrap that pins vulnerable transitive
-    // deps (ws, protobufjs, undici). The fix must happen in pi-coding-agent itself
-    // — nothing to do from this extension.
-    { "GHSA-96hv-2xvq-fx4p": { "active": true, "expiry": "2026-09-01", "notes": "ws <8.21.0 via pi-coding-agent shrinkwrap" } },
-    { "GHSA-f38q-mgvj-vph7": { "active": true, "expiry": "2026-09-01", "notes": "protobufjs <=7.6.2 via pi-coding-agent shrinkwrap" } },
-    { "GHSA-wcpc-wj8m-hjx6": { "active": true, "expiry": "2026-09-01", "notes": "protobufjs <=7.6.0 via pi-coding-agent shrinkwrap" } },
-    { "GHSA-vmh5-mc38-953g|@earendil-works/pi-coding-agent>undici": { "active": true, "expiry": "2026-09-01", "notes": "undici 8.x via pi-coding-agent shrinkwrap" } },
-    { "GHSA-pr7r-676h-xcf6|@earendil-works/pi-coding-agent>undici": { "active": true, "expiry": "2026-09-01", "notes": "undici 8.x via pi-coding-agent shrinkwrap" } },
-    { "GHSA-38rv-x7px-6hhq|@earendil-works/pi-coding-agent>undici": { "active": true, "expiry": "2026-09-01", "notes": "undici 8.x via pi-coding-agent shrinkwrap" } },
-    { "GHSA-p88m-4jfj-68fv|@earendil-works/pi-coding-agent>undici": { "active": true, "expiry": "2026-09-01", "notes": "undici 8.x via pi-coding-agent shrinkwrap" } },
-    { "GHSA-vxpw-j846-p89q|@earendil-works/pi-coding-agent>undici": { "active": true, "expiry": "2026-09-01", "notes": "undici 8.x via pi-coding-agent shrinkwrap" } }
-    // Low-severity undici advisories (GHSA-35p6-xmwp-9g52, GHSA-g8m3-5g58-fq7m) are
-    // not allowlisted — the config gates moderate+ only, so they don't block CI.
+    // npm's audit report exposes this hoisted advisory as the module path
+    // `protobufjs`; a config invariant separately rejects any vulnerable
+    // protobufjs occurrence outside the exact Pi 0.80.8 development path.
+    { "GHSA-f38q-mgvj-vph7|protobufjs": { "active": true, "expiry": "2026-09-01", "notes": "protobufjs 7.6.1 only via @earendil-works/pi-ai > @google/genai in the exact Pi 0.80.8 development graph" } }
   ]
 }