Evidence record / pi-coding-agent
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.
2026-10-13-pi-coding-agent-npm-installs-stopped-pinning-transitive-dependencies-in-1-0-1-the-installer-is-the-pinned
npm installs stopped pinning transitive dependencies in 1.0.1; the installer is the pinned path, and the Nix channel is stuck on 1.1.0. At the 13 October observation, newest stable is v1.2.0 (GitHub 2026-10-12T23:03:53Z; npm 2026-10-12T23:03:25Z), Node >=22.19.0, npm latest=1.2.0 and legacy-node20=0.74.2, with no prerelease dist-tag or release in the window. The old @mariozechner/pi-coding-agent remains at 0.73.1 and is deprecated in favor of @earendil-works/pi-coding-agent. Registry/API checks on 14 October corroborate this, without establishing an archived 13 October dist-tag history. Through 1.0.0 the npm tarball carried npm-shrinkwrap.json, so npm install -g got the transitive tree the maintainers tested. 1.0.1 removed it so that library consumers can override dependencies (#5653). pi update on a global npm install now recommends moving to the managed installer. The quickstart now leads with curl -fsSL https://pi.dev/install.sh | sh, which runs npm ci --ignore-scripts against a lockfile served by pi.dev. npm comes second, with --ignore-scripts and the note that it “does not pin transitive dependencies”. Nix arrived as a third channel the same day. Its stable ref did not advance to 1.2.0 because the tag build failed everywhere. So on 13 October, nix profile add github:earendil-works/pi/stable installs 1.1.0, while the live docs say it installs “the latest release”. The same release pins brace-expansion 5.0.12 as a direct dependency (section 10), so that fix survives the shrinkwrap removal.
Channel: tagged-release. The Nix packaging fix is main-unreleased.. Half: both. Date: 2026-10-03.
Operator consequence: For reproducible fleets, use the pi.dev installer or maintain your own lockfile; a bare npm install -g now floats its dependency tree. Keep --ignore-scripts. Nix catches up only after a successful tagged build and advancement of stable; the main repair is not a released fix. Check pi --version. Main also pins internal Pi versions (section 12), without pinning every external transitive dependency. Pinning github:earendil-works/pi/v1.2.0 targets the same build that failed in the vendor’s own CI.
Receipt
- https://github.com/earendil-works/pi/releases/tag/v1.0.1
- https://github.com/earendil-works/pi/commit/581e7ba78141a4d8b61cc9d11b8b22ae7e59195e
- https://github.com/earendil-works/pi/blob/v1.2.0/packages/coding-agent/docs/quickstart.md#L7-L30
- https://github.com/earendil-works/pi/blob/v1.2.0/.github/workflows/nix.yml#L11-L13
- https://github.com/earendil-works/pi/commit/0a8cfff4cbcbbdb0071ebe056f1fcb5710e7fcf0
- https://github.com/earendil-works/pi/releases/tag/v1.2.0
- https://registry.npmjs.org/@earendil-works/pi-coding-agent
- https://registry.npmjs.org/@mariozechner/pi-coding-agent
- https://pi.dev/api/installer/releases/latest
- https://github.com/earendil-works/pi/actions/runs/38318646655
- https://api.github.com/repos/earendil-works/pi/git/ref/heads/stable
Finding metadata
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
Finding ID: 2026-10-13-pi-coding-agent-npm-installs-stopped-pinning-transitive-dependencies-in-1-0-1-the-installer-is-the-pinned
Profile citations
- Pi Coding Agent / claim / install-channels
- Pi Coding Agent / posture / accessibility
Source links
Primary links, including exact changelog lines when available.
- github release2026-10-13-pi-coding-agent-npm-installs-stopped-pinning-transitive-dependencies-in-1-0-1-the-installer-is-the-pinnedearendil-works/pi / v1.0.1commit2026-10-13-pi-coding-agent-npm-installs-stopped-pinning-transitive-dependencies-in-1-0-1-the-installer-is-the-pinnedgithub.com/earendil-works/pi/commit/581e7ba78141a4d8b61cc9d11b8b22ae7e59195etagged commit file2026-10-13-pi-coding-agent-npm-installs-stopped-pinning-transitive-dependencies-in-1-0-1-the-installer-is-the-pinnedearendil-works/pi / packages/coding-agent/docs/quickstart.md#L7-L30tagged commit file2026-10-13-pi-coding-agent-npm-installs-stopped-pinning-transitive-dependencies-in-1-0-1-the-installer-is-the-pinnedearendil-works/pi / .github/workflows/nix.yml#L11-L13commit2026-10-13-pi-coding-agent-npm-installs-stopped-pinning-transitive-dependencies-in-1-0-1-the-installer-is-the-pinnedgithub.com/earendil-works/pi/commit/0a8cfff4cbcbbdb0071ebe056f1fcb5710e7fcf0github release2026-10-13-pi-coding-agent-npm-installs-stopped-pinning-transitive-dependencies-in-1-0-1-the-installer-is-the-pinnedearendil-works/pi / v1.2.0official docs2026-10-13-pi-coding-agent-npm-installs-stopped-pinning-transitive-dependencies-in-1-0-1-the-installer-is-the-pinnedregistry.npmjs.org/@earendil-works/pi-coding-agentofficial docs2026-10-13-pi-coding-agent-npm-installs-stopped-pinning-transitive-dependencies-in-1-0-1-the-installer-is-the-pinnedregistry.npmjs.org/@mariozechner/pi-coding-agentofficial docs2026-10-13-pi-coding-agent-npm-installs-stopped-pinning-transitive-dependencies-in-1-0-1-the-installer-is-the-pinnedpi.dev/api/installer/releases/latestofficial docs2026-10-13-pi-coding-agent-npm-installs-stopped-pinning-transitive-dependencies-in-1-0-1-the-installer-is-the-pinnedgithub.com/earendil-works/pi/actions/runs/38318646655official docs2026-10-13-pi-coding-agent-npm-installs-stopped-pinning-transitive-dependencies-in-1-0-1-the-installer-is-the-pinnedapi.github.com/repos/earendil-works/pi/git/ref/heads/stable
Versioned source: run artifact