little-coder 1.4.1 → 1.4.3

package/.pi/extensions/benchmark-profiles/index.ts

@@ -1,4 +1,4 @@
-import type { ExtensionAPI } from "@mariozechner/pi-coding-agent";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";

package/.pi/extensions/branding/index.ts

@@ -1,4 +1,4 @@
-import type { ExtensionAPI, Theme } from "@mariozechner/pi-coding-agent";
+import type { ExtensionAPI, Theme } from "@earendil-works/pi-coding-agent";
 import { readFileSync } from "node:fs";
 import { basename, dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -16,7 +16,7 @@ import { fileURLToPath } from "node:url";
 // override quietStartup and see the resource list.
 //
 // Implementation pattern follows the bundled pi example at
-// `node_modules/@mariozechner/pi-coding-agent/examples/extensions/custom-header.ts` —
+// `node_modules/@earendil-works/pi-coding-agent/examples/extensions/custom-header.ts` —
 // the factory returns a duck-typed Component (`render(width): string[]` +
 // `invalidate()`), so no deep imports from pi-tui are needed.
 

package/.pi/extensions/browser/index.ts

@@ -1,4 +1,4 @@
-import type { ExtensionAPI } from "@mariozechner/pi-coding-agent";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { Type } from "@sinclair/typebox";
 
 // Port of local/tools/browser.py. Playwright-powered Browser* tools with

package/.pi/extensions/browser-extract-retention/index.ts

@@ -1,4 +1,4 @@
-import type { ExtensionAPI } from "@mariozechner/pi-coding-agent";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { getSessionStore } from "../evidence/index.ts";
 
 // Post-turn pruning of BrowserExtract tool-result messages.

package/.pi/extensions/browser-extract-retention/retention.test.ts

@@ -2,7 +2,7 @@ import { describe, it, expect } from "vitest";
 import { buildPlaceholder, pruneMessages } from "./index.ts";
 
 // Canned message shapes mirror pi's AgentMessage / ToolResultMessage.
-// See node_modules/@mariozechner/pi-ai/dist/types.d.ts for the real types.
+// See node_modules/@earendil-works/pi-ai/dist/types.d.ts for the real types.
 
 function userMsg(text: string) {
   return { role: "user", content: text };

package/.pi/extensions/checkpoint/index.ts

@@ -1,4 +1,4 @@
-import type { ExtensionAPI } from "@mariozechner/pi-coding-agent";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";

package/.pi/extensions/evidence/index.ts

@@ -1,4 +1,4 @@
-import type { ExtensionAPI } from "@mariozechner/pi-coding-agent";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { Type } from "@sinclair/typebox";
 import { randomBytes } from "node:crypto";
 

package/.pi/extensions/evidence-compact/index.ts

@@ -1,4 +1,4 @@
-import type { ExtensionAPI } from "@mariozechner/pi-coding-agent";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { getSessionStore } from "../evidence/index.ts";
 
 // Port of compaction.py's Evidence-preservation contract.

package/.pi/extensions/extra-tools/index.ts

@@ -1,4 +1,4 @@
-import type { ExtensionAPI } from "@mariozechner/pi-coding-agent";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { Type } from "@sinclair/typebox";
 import { glob as globSync } from "node:fs/promises";
 

package/.pi/extensions/finalize-warn/index.ts

@@ -1,4 +1,4 @@
-import type { ExtensionAPI } from "@mariozechner/pi-coding-agent";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 
 // Pre-cap finalize-warn: when the agent has WARN_REMAINING turns left
 // (this turn included), inject a follow-up user message reminding it to

package/.pi/extensions/hello/index.ts

@@ -1,4 +1,4 @@
-import type { ExtensionAPI } from "@mariozechner/pi-coding-agent";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 
 export default function (pi: ExtensionAPI) {
   pi.on("session_start", async (_event, ctx) => {

package/.pi/extensions/knowledge-inject/index.ts

@@ -1,4 +1,4 @@
-import type { ExtensionAPI } from "@mariozechner/pi-coding-agent";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { readdirSync, readFileSync, existsSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";

package/.pi/extensions/llama-cpp-provider/index.ts

@@ -1,6 +1,6 @@
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import type { ExtensionAPI } from "@mariozechner/pi-coding-agent";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { loadProviders } from "./config.ts";
 
 // Data-driven provider registration. Reads:

package/.pi/extensions/output-parser/index.ts

@@ -1,4 +1,4 @@
-import type { ExtensionAPI } from "@mariozechner/pi-coding-agent";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { parseTextToolCalls } from "./parser.ts";
 
 // Detects malformed/fenced tool calls in assistant text and nudges the model

package/.pi/extensions/permission-gate/index.ts

@@ -1,4 +1,4 @@
-import type { ExtensionAPI } from "@mariozechner/pi-coding-agent";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 
 // Port of tools.py::_SAFE_PREFIXES + agent.py::_check_permission. Bash
 // commands not matching the whitelist are blocked in "auto" mode. In

package/.pi/extensions/quality-monitor/index.ts

@@ -1,4 +1,4 @@
-import type { ExtensionAPI } from "@mariozechner/pi-coding-agent";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { assessResponse, buildCorrectionMessage, type ToolCall } from "./quality.ts";
 
 // Port of local/quality.py. Hooks turn_end, inspects the assistant message

package/.pi/extensions/shell-session/index.ts

@@ -1,4 +1,4 @@
-import type { ExtensionAPI } from "@mariozechner/pi-coding-agent";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { Type } from "@sinclair/typebox";
 import { execSync } from "node:child_process";
 import { formatOutput, DEFAULT_TIMEOUT } from "./helpers.ts";

package/.pi/extensions/skill-inject/index.ts

@@ -1,4 +1,4 @@
-import type { ExtensionAPI } from "@mariozechner/pi-coding-agent";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { readdirSync, readFileSync, existsSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";

package/.pi/extensions/thinking-budget/index.ts

@@ -1,4 +1,4 @@
-import type { ExtensionAPI } from "@mariozechner/pi-coding-agent";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 
 // Port of the thinking-budget cap + partial-trace reuse logic from
 // providers.py. little-coder's Python implementation aborts the stream

package/.pi/extensions/tool-gating/index.ts

@@ -1,4 +1,4 @@
-import type { ExtensionAPI } from "@mariozechner/pi-coding-agent";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 
 // Port of agent.py's _allowed_tools gate. When LITTLE_CODER_ALLOWED_TOOLS
 // is set (comma-separated), any tool_call not in the list is blocked with

package/.pi/extensions/turn-cap/index.ts

@@ -1,4 +1,4 @@
-import type { ExtensionAPI } from "@mariozechner/pi-coding-agent";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 
 // Port of agent.py's max_turns early-break. Counts turn_start events per
 // agent_start span; when the count exceeds LITTLE_CODER_MAX_TURNS (or the

package/.pi/extensions/write-guard/index.ts

@@ -1,4 +1,4 @@
-import type { ExtensionAPI } from "@mariozechner/pi-coding-agent";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { Type } from "@sinclair/typebox";
 import { existsSync, mkdirSync, writeFileSync } from "node:fs";
 import { dirname, isAbsolute, join } from "node:path";

package/CHANGELOG.md

@@ -2,6 +2,37 @@
 
 All notable changes to little-coder are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and little-coder's public interface (CLI, providers, tools, skills) follows semver starting at `v0.0.1` post-rename.
 
+## [v1.4.3] — 2026-05-19
+
+Follow-up to v1.4.2: clean up two cosmetic regressions that the @earendil-works scope migration surfaced.
+
+### Fixed
+- **Pi's `What's New` block no longer appears inside little-coder's TUI after a version bump.** Root cause: pi's interactive mode reads its own bundled `CHANGELOG.md` on startup and renders every entry strictly newer than the `lastChangelogVersion` field in `~/.pi/agent/settings.json` (`interactive-mode.js:getChangelogForDisplay`). v1.4.2 jumped the bundled pi from 0.68.1 to 0.75.3, so users who had previously launched any older little-coder saw pi's full 0.68 → 0.75 upstream changelog dumped *underneath* little-coder's own startup banner. That's wrong because little-coder is the surface and pi is the substrate — the chrome above shouldn't suddenly start advertising the substrate's release notes. The launcher (`bin/little-coder.mjs`) now pre-stamps `lastChangelogVersion` to the currently bundled pi version (resolved from `node_modules/@earendil-works/pi-coding-agent/package.json#version`, the same file we already read to find pi's cli.js, so there's no second source of truth) *before* pi starts. Pi then sees "user already saw this changelog" and the block never renders. The merge into `~/.pi/agent/settings.json` is non-destructive — `quietStartup: true` and every other existing key are preserved. Users who genuinely want pi's upstream changelog can still pull it up with `/changelog` inside the TUI.
+- **`npm install -g little-coder` no longer prints `node-domexception@1.0.0` deprecation warning.** Root cause: a 5-hop transitive — `@earendil-works/pi-ai` → `@google/genai` → `google-auth-library` → `gaxios` → `node-fetch@3` → `fetch-blob@3` → `node-domexception@1.0.0`. The `node-domexception` package is just a 16-line shim that sets `globalThis.DOMException` when undefined, and native `DOMException` has been built into Node since 18 — so on our `Node >= 22.19` floor, the entire shim is dead code. Replaced it via `package.json#overrides` pointing at a bundled stub at `./vendor/node-domexception/` that exports `module.exports = globalThis.DOMException` directly. The stub ships in the npm tarball (`files` array now includes `vendor/`). Since npm's `overrides` field is honored when little-coder is the install root (which it is for `npm install -g little-coder`), the deprecated upstream package never reaches the user's tree, and npm prints no warning. Functional behavior is identical because the only call site (`fetch-blob/from.js:import DOMException from 'node-domexception'`) sees the same `globalThis.DOMException` it would have gotten from the upstream shim.
+
+### Notes for upgraders
+- The bundled stub lives at `vendor/node-domexception/` inside the published package — it's listed under `files` in `package.json`. If you'd added your own `overrides` field that touches `node-domexception` in a hand-rolled fork of little-coder, our entry will take precedence when you publish; in the unlikely case that breaks something for you, override it back in your fork's root `package.json`.
+- The `lastChangelogVersion` pre-stamp is one-directional: it writes the *currently bundled* pi version into settings on every launch. If you'd like to see pi's upstream changelog for a future bump, `/changelog` inside the TUI is the unconditional path — it doesn't consult `lastChangelogVersion`.
+- No CLI flag, models.json shape, skill-pack, extension API, or per-model profile changes. Little-coder's own startup banner, tagline, and keybind hints (the branding extension at `.pi/extensions/branding/`) are byte-for-byte unchanged from v1.4.2.
+
+---
+
+## [v1.4.2] — 2026-05-19
+
+Bundled-pi maintenance release. Closes [#22](https://github.com/itayinbarr/little-coder/issues/22), [#23](https://github.com/itayinbarr/little-coder/issues/23), [#25](https://github.com/itayinbarr/little-coder/issues/25). The pi runtime moves from `@mariozechner/pi-coding-agent@^0.68.1` to `@earendil-works/pi-coding-agent@^0.75.3` — same author, same project, new npm scope — which makes the deprecation warnings disappear, pulls in pi's recent Windows / undici / cmd-shim fixes, and (because pi 0.75 raised its floor) bumps the supported Node range to ≥ 22.19. No CLI flag, settings, extension API, or skill-pack changes.
+
+### Fixed
+- **`npm install -g little-coder` no longer emits `@mariozechner/pi-*` deprecation warnings ([#25](https://github.com/itayinbarr/little-coder/issues/25)).** Upstream pi published the new scope as `@earendil-works/pi-coding-agent` (the `@mariozechner/*` packages remain on npm only to print the migration notice). The little-coder `package.json` dependency entry, all 21 extension import statements under `.pi/extensions/*/index.ts`, the retention-test doc comment, and the README attribution have been migrated. The public `ExtensionAPI`, `Theme`, hook event names (`before_agent_start`, `context`, `before_provider_request`, `tool_call`, `tool_result`, `turn_end`, `session_compact`, `session_start`), `pi.ui.setHeader()` / `pi.ui.setTitle()`, `registerProvider()`, and CLI flags (`--no-context-files`, `--no-extensions`, `--system-prompt`, `--extension`, `--mode rpc`, `--list-models`, `--verbose`, `--offline`) all keep their previous signatures — the rename is purely the npm scope. Full `npm run typecheck` + 152-test vitest suite passes against the new scope.
+- **Windows startup no longer fails with `'C:\Program' is not recognized as an internal or external command` ([#23](https://github.com/itayinbarr/little-coder/issues/23)).** Root cause: `bin/little-coder.mjs` was invoking `node_modules/.bin/pi.cmd` via `cmd.exe /c …`. When npm's prefix or Node's install path contained spaces (the default Windows location is `C:\Program Files\nodejs\`), the chain of nested `.cmd` shims could tokenize on the first space and execute `C:\Program` as a command name. The launcher now resolves pi's JS entry by reading `node_modules/@earendil-works/pi-coding-agent/package.json#bin.pi` and spawns `process.execPath` (the same Node that's already running) with that absolute path as an argv element. Node's `child_process.spawn` handles Windows argv quoting itself, so there is no shell tokenization at any layer — and the same spawn line works on Linux, macOS, and Windows (the previous `isWindows ? cmd.exe : piBin` branch is gone). This also picks up pi 0.75.2's own Windows fixes for cross-spawn / npm-family commands.
+- **Node version requirement bumped to ≥ 22.19.0 ([#22](https://github.com/itayinbarr/little-coder/issues/22)).** The `glob`-cannot-be-used error users hit on Node 20.x came from the bundled pi runtime depending on `glob@^13`, which itself requires Node ≥ 20.19 / 22 to run correctly. Upstream pi 0.75.0 raised its hard minimum to 22.19.0, so the bundled-pi update forces this floor onto us regardless. The launcher's `MIN_NODE` preflight, `package.json#engines.node`, `install.sh`'s version check, and the README install / troubleshooting prose are all moved together. Easiest fix: `nvm install 22 && nvm use 22`.
+
+### Notes for upgraders
+- **You must be on Node ≥ 22.19.0 to upgrade.** If `node --version` is below that, `npm install -g little-coder@1.4.2` will still install but the launcher's preflight will refuse to start pi and print the nvm hint. `npm install -g little-coder@1.4.1` keeps working on Node 20.6+ if you genuinely cannot move yet.
+- The model list, `models.json` shape, `.pi/settings.json` keys (`quietStartup`, per-model context/thinking-budget/temperature profiles, benchmark_overrides), and skill-pack are untouched. Existing `LITTLE_CODER_BASH_ALLOW`, `LITTLE_CODER_PERMISSION_MODE`, `LITTLE_CODER_MODELS_FILE`, `LLAMACPP_BASE_URL` / `OLLAMA_BASE_URL` / `LMSTUDIO_BASE_URL` / `*_API_KEY` env vars all keep their meaning.
+- If you'd hand-written an extension under your local `.pi/extensions/` that imports `from "@mariozechner/pi-coding-agent"`, change the import to `from "@earendil-works/pi-coding-agent"` and re-run. The old scope's last published version was 0.73.1 — it works against an installed `@earendil-works/pi-coding-agent` only via the legacy `@sinclair/typebox` alias that pi 0.69+ keeps for compatibility.
+
+---
+
 ## [v1.4.1] — 2026-05-16
 
 Wire fix for the v1.4.0 startup rebrand. The `[Extensions]` block was still showing for users running from outside the repo root.

package/README.md

@@ -16,7 +16,7 @@ If you've never used pi, it's useful to skim [pi.dev](https://pi.dev) first —
 
 ## Install
 
-One-line install (Node.js 20.6+ required):
+One-line install (Node.js 22.19+ required):
 
 ```bash
 curl -fsSL https://raw.githubusercontent.com/itayinbarr/little-coder/main/install.sh | bash
@@ -36,7 +36,7 @@ bun add -g little-coder
 
 That's the whole install. No clone, no `npm install` in a workspace, no PATH fiddling. `little-coder` is now on your PATH and works from any directory.
 
-> **Note for `bun add -g` users.** The launcher (`bin/little-coder.mjs`) is a Node.js script with `#!/usr/bin/env node` at the top, so Node ≥ 20.6 still has to be on your PATH for the binary to start — bun is fine for installing/updating the package, but the runtime is Node. If you want a fully node-less setup, replace the shebang in `$(bun pm bin -g)/little-coder` with `#!/usr/bin/env bun`.
+> **Note for `bun add -g` users.** The launcher (`bin/little-coder.mjs`) is a Node.js script with `#!/usr/bin/env node` at the top, so Node ≥ 22.19 still has to be on your PATH for the binary to start — bun is fine for installing/updating the package, but the runtime is Node. If you want a fully node-less setup, replace the shebang in `$(bun pm bin -g)/little-coder` with `#!/usr/bin/env bun`.
 
 ## Run
 
@@ -264,7 +264,7 @@ That spans short coding exercises (Polyglot), interactive shell-bound tasks (Ter
 
 **Extension load failures on startup** — run `little-coder --list-models --verbose`; extension errors surface there. If the install looks corrupt: `npm uninstall -g little-coder && npm install -g little-coder`.
 
-**Node version too old** — little-coder needs Node ≥ 20.6.0. Check with `node --version`. Easiest fix: `nvm install 20 && nvm use 20`.
+**Node version too old** — little-coder needs Node ≥ 22.19.0 (matching the minimum of the bundled `@earendil-works/pi-coding-agent` v0.75+). Check with `node --version`. Easiest fix: `nvm install 22 && nvm use 22`.
 
 ---
 
@@ -367,7 +367,7 @@ The paper ran `ollama/qwen3.5` through the Python little-coder at commit **`1d62
 
 little-coder v0.0.x was a derivative work of [CheetahClaws / ClawSpring](https://github.com/SafeRL-Lab/clawspring) by SafeRL-Lab, Apache 2.0. That upstream provided the Python agent substrate, tool system, multi-provider support, and REPL.
 
-little-coder v0.1.0+ replaces that substrate with **[pi](https://github.com/badlogic/pi-mono)** (`@mariozechner/pi-coding-agent`) by Mario Zechner — Apache 2.0 / MIT. pi provides the agent loop, provider abstraction, TUI, and extension model. little-coder rebuilds its small-model adaptations on top of pi as extensions.
+little-coder v0.1.0+ replaces that substrate with **[pi](https://pi.dev)** by Mario Zechner — Apache 2.0 / MIT. The npm package was renamed from `@mariozechner/pi-coding-agent` to `@earendil-works/pi-coding-agent` in upstream's 0.74 release; little-coder v1.4.2+ ships with the new package. pi provides the agent loop, provider abstraction, TUI, and extension model. little-coder rebuilds its small-model adaptations on top of pi as extensions.
 
 All little-coder-specific mechanisms — Write-vs-Edit invariant, skill / knowledge injection, thinking-budget cap, output-parser, quality-monitor, per-model profiles, per-benchmark overrides, ShellSession / Browser / Evidence tool families, evidence-aware compaction — are preserved across versions.
 

package/bin/little-coder.mjs

@@ -17,8 +17,8 @@ import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { checkForUpdate } from "./update-check.mjs";
 
-// ---- 1. Node version preflight (>= 20.6.0, matching pi.dev) ----
-const MIN_NODE = [20, 6, 0];
+// ---- 1. Node version preflight (>= 22.19.0, matching pi.dev) ----
+const MIN_NODE = [22, 19, 0];
 const cur = process.versions.node.split(".").map((n) => parseInt(n, 10));
 const tooOld =
   cur[0] < MIN_NODE[0] ||
@@ -27,7 +27,7 @@ const tooOld =
 if (tooOld) {
   console.error(
     `little-coder requires Node.js >= ${MIN_NODE.join(".")} (you have ${process.versions.node}).\n` +
-      `Install a newer Node from https://nodejs.org or via nvm: 'nvm install 20'.`,
+      `Install a newer Node from https://nodejs.org or via nvm: 'nvm install 22'.`,
   );
   process.exit(1);
 }
@@ -36,13 +36,38 @@ if (tooOld) {
 const here = dirname(fileURLToPath(import.meta.url));
 const pkgRoot = resolve(here, "..");
 
-// ---- 3. Resolve the bundled pi binary ----
-const isWindows = process.platform === "win32";
-const piBinBase = join(pkgRoot, "node_modules", ".bin", "pi");
-const piBin = isWindows && existsSync(`${piBinBase}.cmd`) ? `${piBinBase}.cmd` : piBinBase;
-if (!existsSync(piBin)) {
+// ---- 3. Resolve the bundled pi CLI entry point ----
+// We invoke pi's JS entry directly under the current Node binary instead of
+// the `node_modules/.bin/pi` shim. Two reasons:
+//   1. On Windows, `.bin/pi.cmd` is an npm-generated batch shim. When it (or
+//      anything it transitively invokes) is launched from a path containing
+//      spaces — most notably the default Node install location
+//      `C:\Program Files\nodejs\` — cmd's whitespace tokenization can split
+//      the path at the first space and produce errors like
+//      `'C:\Program' is not recognized as an internal or external command`
+//      (see issue #23). Spawning `process.execPath` with the resolved cli.js
+//      path as an argv element sidesteps cmd entirely — Node's spawn handles
+//      Windows argv quoting itself.
+//   2. We no longer need a separate `cmd.exe /c …` branch, so the same
+//      spawn path works identically on Linux, macOS, and Windows.
+const piPkgRoot = join(pkgRoot, "node_modules", "@earendil-works", "pi-coding-agent");
+let piEntry;
+try {
+  const piPkgJson = JSON.parse(readFileSync(join(piPkgRoot, "package.json"), "utf-8"));
+  const binRel = typeof piPkgJson?.bin === "string" ? piPkgJson.bin : piPkgJson?.bin?.pi;
+  if (typeof binRel !== "string") throw new Error("pi package.json has no bin.pi entry");
+  piEntry = resolve(piPkgRoot, binRel);
+} catch (err) {
   console.error(
-    `little-coder: cannot find pi at ${piBin}.\n` +
+    `little-coder: cannot resolve pi cli entry under ${piPkgRoot}.\n` +
+      `Underlying error: ${err?.message ?? err}\n` +
+      `Try reinstalling: npm install -g little-coder`,
+  );
+  process.exit(1);
+}
+if (!existsSync(piEntry)) {
+  console.error(
+    `little-coder: cannot find pi at ${piEntry}.\n` +
       `Try reinstalling: npm install -g little-coder`,
   );
   process.exit(1);
@@ -106,15 +131,30 @@ if (process.env.PI_SKIP_VERSION_CHECK === undefined) {
   process.env.PI_SKIP_VERSION_CHECK = "1";
 }
 
-// ---- 8. Force pi's global quietStartup so the loaded-resources block stays hidden ----
-// Pi's interactive mode dumps an [Extensions] / [Skills] / [Prompts] block on
-// every launch unless `quietStartup: true` is set in its global settings
-// (~/.pi/agent/settings.json). Our shipped .pi/settings.json doesn't reach pi
-// because pi reads from <cwd>/.pi/settings.json (project) or <agentDir>/settings.json
-// (global), neither of which is our npm-installed package dir. So the launcher
-// non-destructively merges quietStartup: true into the user's actual global
-// settings file. Existing keys are preserved. To see the full inventory, run
-// `little-coder --verbose` — pi's verbose flag overrides quietStartup.
+// ---- 8. Force pi's global quietStartup + pin lastChangelogVersion ----
+// Two non-destructive merges into ~/.pi/agent/settings.json (or the dir pointed
+// to by PI_CODING_AGENT_DIR):
+//
+//   1. quietStartup: true
+//        Pi's interactive mode otherwise dumps an [Extensions] / [Skills] /
+//        [Prompts] inventory on every launch. Pi reads global settings from
+//        <agentDir>/settings.json — NOT from our npm-installed package dir —
+//        so our shipped .pi/settings.json doesn't reach it. To see the
+//        inventory anyway, run `little-coder --verbose`.
+//
+//   2. lastChangelogVersion: <currently installed pi version>
+//        Pi reads its own bundled CHANGELOG.md on startup and renders a
+//        "What's New" block for every entry strictly newer than this stored
+//        version (interactive-mode.js:getChangelogForDisplay). That makes pi's
+//        upstream changelog show up inside little-coder's TUI every time we
+//        bump the bundled pi dep — which is jarring because little-coder is
+//        the surface, not pi. We pre-stamp this field to the version we just
+//        bundled BEFORE pi starts, so pi sees "user already saw this", and
+//        the block never renders. Users who genuinely want to read pi's
+//        upstream changelog can still do so with `/changelog` inside the TUI.
+//
+// Existing keys are preserved. We only write when the desired value differs
+// from what's already on disk, so this is a no-op on warm launches.
 try {
   const agentDirEnv = process.env.PI_CODING_AGENT_DIR;
   let agentDir;
@@ -139,8 +179,32 @@ try {
       globalSettings = {};
     }
   }
+
+  // Read the bundled pi version. We resolve via the same package.json we used
+  // to find piEntry, so this stays consistent with whichever pi we actually
+  // spawn — no second source of truth.
+  let bundledPiVersion;
+  try {
+    const piPkgJson = JSON.parse(
+      readFileSync(join(piPkgRoot, "package.json"), "utf-8"),
+    );
+    if (typeof piPkgJson?.version === "string") bundledPiVersion = piPkgJson.version;
+  } catch {
+    // If we can't read pi's version, fall back to leaving lastChangelogVersion
+    // alone — pi will then show its own changelog on the next launch. Better
+    // than writing garbage into the user's settings.
+  }
+
+  let mutated = false;
   if (globalSettings.quietStartup !== true) {
     globalSettings.quietStartup = true;
+    mutated = true;
+  }
+  if (bundledPiVersion && globalSettings.lastChangelogVersion !== bundledPiVersion) {
+    globalSettings.lastChangelogVersion = bundledPiVersion;
+    mutated = true;
+  }
+  if (mutated) {
     writeFileSync(globalSettingsPath, JSON.stringify(globalSettings, null, 2));
   }
 } catch {
@@ -150,11 +214,11 @@ try {
 }
 
 // ---- 9. Spawn pi in the user's cwd ----
-const [spawnCmd, spawnArgs] = isWindows
-  ? ["cmd.exe", ["/c", piBin, ...piArgs]]
-  : [piBin, piArgs];
-
-const child = spawn(spawnCmd, spawnArgs, {
+// `process.execPath` is the same Node binary that's running this launcher, so
+// pi inherits the exact runtime that already passed our >= 22.19.0 preflight.
+// Passing piEntry as an argv element (not a shell string) avoids any
+// shell-injection / space-in-path classes on every platform.
+const child = spawn(process.execPath, [piEntry, ...piArgs], {
   stdio: "inherit",
   cwd: process.cwd(),
   env: process.env,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "little-coder",
-  "version": "1.4.1",
+  "version": "1.4.3",
   "description": "A pi-based coding agent optimized for small local language models. Reproduces the whitepaper's scaffold-model-fit adaptations as pi extensions.",
   "homepage": "https://github.com/itayinbarr/little-coder",
   "repository": {
@@ -14,7 +14,7 @@
     "little-coder": "bin/little-coder.mjs"
   },
   "engines": {
-    "node": ">=20.6.0"
+    "node": ">=22.19.0"
   },
   "files": [
     "bin/",
@@ -23,6 +23,7 @@
     ".pi/extensions/",
     ".pi/settings.json",
     "models.json",
+    "vendor/",
     "LICENSE",
     "NOTICE",
     "README.md",
@@ -35,10 +36,13 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@mariozechner/pi-coding-agent": "^0.68.1",
+    "@earendil-works/pi-coding-agent": "^0.75.3",
     "@sinclair/typebox": "^0.34.49",
     "playwright": "^1.59.1"
   },
+  "overrides": {
+    "node-domexception": "file:./vendor/node-domexception"
+  },
   "devDependencies": {
     "typescript": "^5.6.0",
     "vitest": "^2.1.0"

package/vendor/node-domexception/index.js

@@ -0,0 +1,9 @@
+// Drop-in replacement for the deprecated `node-domexception@1.0.0` shim.
+// Bundled with little-coder; wired in via `package.json#overrides` so the
+// transitive `fetch-blob -> node-domexception` chain (pulled in via
+// @earendil-works/pi-ai -> @google/genai -> google-auth-library -> gaxios ->
+// node-fetch -> fetch-blob) doesn't emit a deprecation warning during
+// `npm install -g little-coder`. Native `globalThis.DOMException` has been
+// available since Node 18, and little-coder requires Node >= 22.19, so this
+// is always defined at import time.
+module.exports = globalThis.DOMException;

package/vendor/node-domexception/package.json

@@ -0,0 +1,10 @@
+{
+  "name": "node-domexception",
+  "version": "1.0.1",
+  "description": "Bundled with little-coder. Returns Node's native globalThis.DOMException (built-in since Node 18). Replaces the deprecated upstream node-domexception@1.0.0 via npm overrides so `npm install -g little-coder` no longer prints its deprecation warning. We pin engines.node to >= 18 because that's where native DOMException landed; the launcher's own preflight enforces >= 22.19, so this is satisfied transitively.",
+  "main": "index.js",
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "license": "MIT"
+}