Bump pi-coding-agent to 0.82.1 to resolve protobufjs DoS alert #292

[wojtekn]

Related issues

• Fixes Dependabot alert #292 (GHSA-j3f2-48v5-ccww)

How AI was used in this PR

Claude Code traced the alert to its root cause, identified that pi-coding-agent's bundled npm-shrinkwrap.json was pinning the vulnerable transitive dependency, confirmed a newer release ships the fix, applied the version bumps, and ran typecheck + the affected test suites. All findings were reviewed by me.

Proposed Changes

Dependabot flags a medium-severity denial-of-service in protobufjs (>= 7.5.0, <= 7.6.4) — an infinite loop in .proto option parsing, fixed upstream in 7.6.5. We don't depend on protobufjs directly; it arrives transitively through pi-coding-agent → @google/genai.

The catch: pi-coding-agent@0.81.0 publishes its own npm-shrinkwrap.json that hard-pins its entire subtree, including protobufjs@7.6.4. Because npm honors a package's bundled shrinkwrap, the nested copy can't be lifted by a root-level npm dedupe, an install protobufjs@7.6.5, or an overrides entry — the only clean fix is upgrading pi-coding-agent itself. Version 0.82.1 ships protobufjs@7.6.5 in its shrinkwrap.

This bumps @earendil-works/pi-coding-agent (and @earendil-works/pi-ai, declared in apps/cli) from 0.81.0 to 0.82.1. Both the top-level and the nested protobufjs copies now resolve to 7.6.5, clearing the alert. The 0.82.x release notes are additive (new provider support, opt-in constrained tool sampling, fixes) with no breaking API changes; same remediation pattern as the earlier #288 brace-expansion bump.

No user-visible behavior change.

Testing Instructions

• npm install resolves both protobufjs copies (top-level and the one nested under pi-coding-agent) to 7.6.5 — verify with npm ls protobufjs.
• npm run typecheck passes across all workspaces (the pi packages have a wide type-import surface, so this confirms no signatures changed).
• AI test suites pass: npm test -- apps/cli/ai packages/common/ai apps/studio/src/components/studio-code-session apps/cli/remote-session (498 tests).

Pre-merge Checklist

• Have you checked for TypeScript, React or other console errors?

[wpmobilebot]

📊 Performance Test Results

Comparing 91d3995 vs trunk

app-size

Metric	trunk	91d3995	Diff	Change
App Size (Mac)	1375.36 MB	1378.82 MB	+3.46 MB	🔴 0.3%

site-editor

Metric	trunk	91d3995	Diff	Change
load	731 ms	759 ms	+28 ms	⚪ 0.0%

site-startup

Metric	trunk	91d3995	Diff	Change
siteCreation	6521 ms	6493 ms	28 ms	⚪ 0.0%
siteStartup	2375 ms	2378 ms	+3 ms	⚪ 0.0%

---

Results are median values from multiple test runs.

Legend: 🟢 Improvement (faster) | 🔴 Regression (slower) | ⚪ No change (<50ms diff)