@huseynsnmz/pi-board 0.15.1 → 0.15.3

package/CHANGELOG.md

@@ -5,6 +5,19 @@ conventional commits by `scripts/release_helper.mjs`. Entries are
 forward-only: they begin with the first release after this file landed —
 for earlier history, see the git log and the pull-request list.
 
+## [0.15.3] - 2026-11-04
+
+### Fixes
+
+- **state**: Pi no longer crashes on `/new`, `/resume`, `/fork` or `/reload` (from 0.15.0)
+
+## [0.15.2] - 2026-11-04
+
+### Changes
+
+- **deps**: exact versions everywhere, with Pi 1.5.0, TypeScript 7 and @types/node 26 for development
+- **deps**: remove the postinstall script, since Pi 1.5.0 no longer ships the versions it patched
+
 ## [0.15.1] - 2026-11-04
 
 ### Features

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@huseynsnmz/pi-board",
-  "version": "0.15.1",
+  "version": "0.15.3",
   "description": "A board for Pi's background sessions: start, watch, reply to and attach to them. A fork of @zhuxixi/pi-agent-board.",
   "type": "module",
   "main": "./index.ts",
@@ -51,7 +51,6 @@
     "image": "https://github.com/zhuxixi/pi-agent-board/raw/refs/heads/main/assets/banner.png"
   },
   "scripts": {
-    "postinstall": "node scripts/patch-vulns.mjs",
     "typecheck": "tsc --noEmit",
     "test": "node scripts/run-tests.mjs",
     "test:coverage": "c8 node scripts/run-tests.mjs",
@@ -73,14 +72,20 @@
     }
   },
   "devDependencies": {
-    "@earendil-works/pi-coding-agent": "1.1.0",
-    "@earendil-works/pi-tui": "1.1.0",
-    "@types/node": "^25.9.1",
-    "c8": "^12.0.0",
-    "typescript": "^5.9.3"
+    "@earendil-works/pi-coding-agent": "1.5.0",
+    "@earendil-works/pi-tui": "1.5.0",
+    "@types/node": "26.6.6",
+    "c8": "12.0.0",
+    "typescript": "7.0.2"
   },
   "dependencies": {
-    "@xterm/headless": "^6.0.0",
-    "node-pty": "^1.1.0"
+    "@xterm/headless": "6.0.0",
+    "node-pty": "1.1.0"
+  },
+  "overrides": {
+    "test-exclude": {
+      "glob": "14.0.3",
+      "minimatch": "11.0.4"
+    }
   }
 }

package/src/index.ts

@@ -198,6 +198,14 @@ export default function piAgentBoard(pi: ExtensionAPI): void {
 		hostedFrameWitness = { stop: () => cleanup("session-shutdown") };
 	}
 
+	// After this the context they hold is stale, and using one takes Pi down.
+	pi.on("session_shutdown", () => {
+		stopDoubleLeft?.();
+		stopDoubleLeft = null;
+		stopWaiting?.();
+		stopWaiting = null;
+	});
+
 	pi.on("session_start", async (event, ctx) => {
 		if (!isHostedChild && ctx.mode === "tui") {
 			stopDoubleLeft?.();

package/src/ui/double-left.ts

@@ -20,7 +20,11 @@ export function watchDoubleLeft(ctx: ExtensionContext): () => void {
 		return { data: "\r" };
 	});
 	return () => {
-		stop();
+		try {
+			stop();
+		} catch {
+			/* see focus.stop */
+		}
 		focus.stop();
 	};
 }

package/src/ui/focus.ts

@@ -21,6 +21,12 @@ export function watchFocus(ctx: ExtensionContext, widget: string): Focus {
 	return {
 		promptText: () => (focused?.() as Editorish | null | undefined)?.getExpandedText?.(),
 		known: () => focused !== null,
-		stop: () => ctx.ui.setWidget(widget, undefined),
+		stop: () => {
+			try {
+				ctx.ui.setWidget(widget, undefined);
+			} catch {
+				/* the session it belonged to has already gone, and its widget with it */
+			}
+		},
 	};
 }

package/src/ui/waiting.ts

@@ -11,11 +11,16 @@ export function watchWaiting(ctx: ExtensionContext, changed: (waiting: boolean)
 	const focus = watchFocus(ctx, "agent-board-waiting");
 	let waiting = false;
 	const timer = setInterval(() => {
-		const now = focus.known() && !ctx.isIdle() && focus.promptText() === undefined;
-		if (now === waiting) return;
-		waiting = now;
-		// If the run has ended too, its own end has already said so, and this would undo that.
-		if (now || !ctx.isIdle()) changed(now);
+		try {
+			const now = focus.known() && !ctx.isIdle() && focus.promptText() === undefined;
+			if (now === waiting) return;
+			waiting = now;
+			// If the run has ended too, its own end has already said so, and this would undo that.
+			if (now || !ctx.isIdle()) changed(now);
+		} catch {
+			// The session was replaced before this could be stopped. An error here would end Pi.
+			clearInterval(timer);
+		}
 	}, CHECK_MS);
 	timer.unref?.();
 	return () => {

package/scripts/patch-vulns.mjs

@@ -1,59 +0,0 @@
-#!/usr/bin/env node
-/**
- * postinstall: patch vulnerable transitive dependencies that are locked behind
- * @earendil-works/pi-coding-agent's npm-shrinkwrap.json (which prevents npm
- * "overrides" from taking effect).
- *
- * Vulnerabilities patched:
- * - brace-expansion <=5.0.7 → 5.0.8 (GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg)
- * - protobufjs 7.5.0–7.6.4 → 7.6.5 (GHSA-j3f2-48v5-ccww)
- */
-import { execSync } from "node:child_process";
-import { existsSync, rmSync, mkdirSync } from "node:fs";
-import { join, dirname } from "node:path";
-import { fileURLToPath } from "node:url";
-
-const root = join(dirname(fileURLToPath(import.meta.url)), "..");
-const nested = join(
-  root,
-  "node_modules",
-  "@earendil-works",
-  "pi-coding-agent",
-  "node_modules",
-);
-
-const patches = [
-  { name: "brace-expansion", version: "5.0.8" },
-  { name: "protobufjs", version: "7.6.5" },
-];
-
-for (const { name, version } of patches) {
-  const target = join(nested, name);
-  if (!existsSync(target)) {
-    console.log(`[patch-vulns] ${name} not found nested, skipping`);
-    continue;
-  }
-
-  console.log(`[patch-vulns] patching ${name} → ${version}`);
-  rmSync(target, { recursive: true, force: true });
-  mkdirSync(target, { recursive: true });
-
-  // Install the patched version into a temp dir, then move it into place
-  const tmp = join(root, `.patch-tmp-${name}`);
-  rmSync(tmp, { recursive: true, force: true });
-  mkdirSync(tmp, { recursive: true });
-
-  try {
-    execSync(`npm install ${name}@${version} --prefix "${tmp}" --ignore-scripts`, {
-      stdio: "pipe",
-      cwd: root,
-    });
-    const installed = join(tmp, "node_modules", name);
-    rmSync(target, { recursive: true, force: true });
-    execSync(`mv "${installed}" "${target}"`);
-  } finally {
-    rmSync(tmp, { recursive: true, force: true });
-  }
-}
-
-console.log("[patch-vulns] done");