Pi v0.75.4 - 更新日志

### 新功能 - **加固 npm 安装与发布流程** - Pi 现在随 CLI 附带生成的 shrinkwrap 文件以锁定传递依赖，阻止意外修改 lockfile，在检查中验证依赖固定和生命周期脚本白名单，在支持的平台上为自更新和本地发布安装禁用生命周期脚本，并在发布前对隔离的 npm 和 Bun 安装进行冒烟测试。详见 [供应链加固](https://github.com/earendil-works/pi/blob/v0.75.4/README.md#supply-chain-hardening)。 ### 新增 - 在 `pi update` 运行后添加了交互式更新说明，以便用户在继续操作前查看已安装版本的更新日志 ([#4724](https://github.com/earendil-works/pi/pull/4724) by [@mitsuhiko](https://github.com/mitsuhiko))。 - 从包根目录导出了图像调整大小工具函数，供 SDK 使用者使用 ([#4775](https://github.com/earendil-works/pi/pull/4775) by [@xl0](https://github.com/xl0))。 ### 变更 - 更改了源代码语法，以避免使用需要生成 JavaScript 的 TypeScript 特性，使核心源码与 Node.js 仅剥离类型的 TypeScript 检查保持兼容。 - 从 CLI 包中移除了 Web UI 工作区引用，并删除了包级别的开发监听脚本。 - 发布的 npm 安装现在包含 `npm-shrinkwrap.json` 文件，以锁定 CLI 包的传递依赖。 - 改进了终端主题检测，以更好地处理亮色/暗色主题及真彩色。 - 更改了自更新的包管理器命令，使其在重新安装期间禁用生命周期脚本。 ### 修复 - 修复了系统提示词，指示模型在读取特定主题的相对引用前，先基于绝对包路径解析 pi 文档和示例 ([#4752](https://github.com/earendil-works/pi/issues/4752))。 - 修复了工具调用预检期间扩展的 `ctx.abort()` 方法，以停止后续的确认操作并恢复队列中的交互输入（如 Escape） ([#4276](https://github.com/earendil-works/pi/issues/4276))。 - 修复了 AgentSession 的重试、上下文压缩和事件结算逻辑，改为使用已等待的代理生命周期而非独立的事件队列，并在 `agent_end` 会话事件中添加了 `willRetry` 字段。 - 修复了分叉会话的运行时状态，使活动会话 ID 与分叉目标保持一致 ([#4799](https://github.com/earendil-works/pi/pull/4799) by [@Perlence](https://github.com/Perlence))。 - 修复了子代理扩展的并行模式，使其向父模型返回有用的单任务输出和失败任务诊断信息，而非 100 字符的预览 ([#4710](https://github.com/earendil-works/pi/issues/4710))。 - 修复了 Windows 本地 bash 执行问题，使其在从后台 SDK 进程启动时隐藏辅助控制台窗口 ([#4699](https://github.com/earendil-works/pi/issues/4699))。 - 修复了受管理的 npm 扩展文件夹，使其在支持的平台上设置云同步忽略元数据 ([#4763](https://github.com/earendil-works/pi/issues/4763))。 - 修复了 HTTP 空闲超时配置，使长期运行的提供商流可以避免过早的空闲断开连接 ([#4759](https://github.com/earendil-works/pi/pull/4759) by [@mitsuhiko](https://github.com/mitsuhiko))。 - 修复了默认系统提示词的边界处理，改用显式的 XML 标签以实现更清晰的文件分隔 ([#4709](https://github.com/earendil-works/pi/pull/4709) by [@herrnel](https://github.com/herrnel))。 - 修复了 HTML 分享/导出侧边栏中共享工具条目的点击事件，使其滚动至已渲染的工具调用处 ([#4664](https://github.com/earendil-works/pi/pull/4664) by [@yzhg1983](https://github.com/yzhg1983))。 - 修复了主题调色板，设置明确的文本颜色以避免终端默认颜色的漂移。 - 修复了真彩色检测逻辑，以对齐终端图像渲染和交互式主题决策。 - 修复了继承自 `@earendil-works/pi-tui` 的加载指示器启动问题，确保初始化不会在帧可用前运行。 - 修复了继承自 `@earendil-works/pi-ai` 的 OpenAI 兼容默认输出 token 请求，避免在 vLLM 等服务器上预留无法实现的上下文窗口 ([#4675](https://github.com/earendil-works/pi/issues/4675))。 - 修复了继承自 `@earendil-works/pi-ai` 的 OpenAI 提示词缓存键，使其保持在提供商限制的 64 个字符以内 ([#4720](https://github.com/earendil-works/pi/issues/4720))。 - 修复了 Windows 上 fnm 管理的 Node.js 安装的 npm 系列包命令，这些安装同时暴露无扩展名的 Unix 脚本和 `.cmd` 快捷方式 ([#4793](https://github.com/earendil-works/pi/issues/4793))。

### New Features - **Hardened npm install and release path** - Pi now ships the CLI with a generated shrinkwrap for transitive dependencies, blocks accidental lockfile changes, verifies dependency pinning and lifecycle-script allowlists in checks, disables lifecycle scripts for self-update and local release installs where supported, and smoke-tests isolated npm and Bun installs before release. See [Supply-chain hardening](https://github.com/earendil-works/pi/blob/v0.75.4/README.md#supply-chain-hardening). ### Added - Added interactive update notes after `pi update` runs, so users can see the installed version's changelog before continuing ([#4724](https://github.com/earendil-works/pi/pull/4724) by [@mitsuhiko](https://github.com/mitsuhiko)). - Exported image resize utilities from the package root for SDK consumers ([#4775](https://github.com/earendil-works/pi/pull/4775) by [@xl0](https://github.com/xl0)). ### Changed - Changed source syntax to avoid TypeScript constructs that require JavaScript emit, keeping core sources compatible with Node.js strip-only TypeScript checks. - Removed web UI workspace references from the CLI package and dropped the package-level development watch script. - Published npm installs now include an `npm-shrinkwrap.json` to lock transitive dependencies for the CLI package. - Improved terminal theme detection for light/dark and truecolor handling. - Changed self-update package-manager commands to disable lifecycle scripts during reinstall. ### Fixed - Fixed the system prompt to tell models to resolve pi docs and examples under the absolute package paths before reading topic-specific relative references ([#4752](https://github.com/earendil-works/pi/issues/4752)). - Fixed extension `ctx.abort()` during tool-call preflight to stop later confirmations and restore queued interactive input like Escape ([#4276](https://github.com/earendil-works/pi/issues/4276)). - Fixed AgentSession retry, compaction, and event settlement to use the awaited agent lifecycle instead of a separate event queue, and added `willRetry` to `agent_end` session events. - Fixed forked session runtime state to keep the active session id aligned with the fork target ([#4799](https://github.com/earendil-works/pi/pull/4799) by [@Perlence](https://github.com/Perlence)). - Fixed the subagent extension's parallel mode to return useful per-task output and failed-task diagnostics to the parent model instead of 100-character previews ([#4710](https://github.com/earendil-works/pi/issues/4710)). - Fixed Windows local bash execution to hide helper console windows when launched from background SDK processes ([#4699](https://github.com/earendil-works/pi/issues/4699)). - Fixed managed npm extension folders to set cloud-sync ignore metadata where supported ([#4763](https://github.com/earendil-works/pi/issues/4763)). - Fixed HTTP idle timeout configuration so long-running provider streams can avoid premature idle disconnects ([#4759](https://github.com/earendil-works/pi/pull/4759) by [@mitsuhiko](https://github.com/mitsuhiko)). - Fixed default system prompt boundaries to use explicit XML tags for clearer file separation ([#4709](https://github.com/earendil-works/pi/pull/4709) by [@herrnel](https://github.com/herrnel)). - Fixed HTML share/export sidebar clicks for shared tool entries to scroll to the rendered tool call ([#4664](https://github.com/earendil-works/pi/pull/4664) by [@yzhg1983](https://github.com/yzhg1983)). - Fixed theme palettes to set explicit text colors and avoid terminal-default color drift. - Fixed truecolor detection to align terminal image rendering and interactive theme decisions. - Fixed loader indicator startup inherited from `@earendil-works/pi-tui` so initialization cannot run before frames are available. - Fixed OpenAI-compatible default output token requests inherited from `@earendil-works/pi-ai` to avoid reserving impossible context windows on servers such as vLLM ([#4675](https://github.com/earendil-works/pi/issues/4675)). - Fixed OpenAI prompt cache keys inherited from `@earendil-works/pi-ai` to stay within the 64-character provider limit ([#4720](https://github.com/earendil-works/pi/issues/4720)). - Fixed Windows npm-family package commands for fnm-managed Node.js installs that expose both extensionless Unix scripts and `.cmd` shims ([#4793](https://github.com/earendil-works/pi/issues/4793)).