@kushalkhemka/opensec-pi-subagents 0.19.3 → 0.19.4-bun.0

package/CHANGELOG.md

@@ -7,6 +7,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.19.4-bun.0] - 2026-10-02
+
+Bun build, published on the `bun` dist-tag (`pi install npm:@kushalkhemka/opensec-pi-subagents@bun`). Same tools, commands, settings and file locations as 0.19.4.
+
+### Changed
+- Ships a prebuilt bundle (`dist-bun/`) with no runtime dependencies: a small ESM loader plus the extension as a CommonJS core loaded with Bun's native `require`, so Pi's loader never transpiles it. `nanoid` is replaced by `crypto.getRandomValues` (same id format), journal keys use `Bun.CryptoHasher` (same keys), croner and the workflow engine and inspector are initialized on first use.
+
+### Fixed
+- Scheduling an `Agent` call with a cron expression left a live croner timer behind (validation scheduled a no-op job and never stopped it): `pi -p` never exited, and interactive sessions kept one extra 30 s timer per validation.
+- `@agent` mentions on Pi 1.0: the conversation clone assigned the now read-only `agent.state.systemPrompt`, so every clone failed and every mention fell back to a direct start with a warning. The clone now forces the live prompt per request and carries the conversation as session entries.
+- Subagent transcripts (`.output` files) on Pi 1.0 duplicated the prompt and recorded system messages as `toolResult` entries.
+- Workflow script line numbers in stack traces were one line off on Bun.
+- Worktree isolation deleted an agent's edits when the preservation commit failed (e.g. no git identity configured): the worktree was force-removed and the result reported no changes. The commit is retried with a placeholder author, and work that still cannot be saved keeps its worktree, whose path is named in the result.
+
 ## [0.19.2] - 2026-09-26
 
 ### Changed