Fix dependency vulnerabilities

apps/desktop/package.json

@@ -19,7 +19,7 @@
     "typecheck": "tsc --project tsconfig.json --noEmit"
   },
   "dependencies": {
-    "@mariozechner/pi-coding-agent": "0.57.1",
+    "@earendil-works/pi-coding-agent": "0.79.0",
     "@monaco-editor/react": "^4.7.0",
     "@phosphor-icons/react": "^2.1.10",
     "@pi-desktop/contracts": "workspace:*",
@@ -52,7 +52,7 @@
     "react-virtuoso": "^4.18.5",
     "remark-breaks": "^4.0.0",
     "remark-gfm": "^4.0.1",
-    "sharp": "^0.33.5",
+    "sharp": "^0.35.3",
     "shiki": "^2.3.2",
     "sonner": "^2.0.7",
     "tailwind-merge": "^2.6.0",
@@ -64,11 +64,11 @@
     "@tailwindcss/vite": "^4.0.0",
     "@types/react": "^19.0.8",
     "@types/react-dom": "^19.0.3",
-    "@vitejs/plugin-react": "^6.0.1",
+    "@vitejs/plugin-react": "^5.2.0",
     "electron": "^41.2.1",
-    "electron-builder": "26.8.1",
+    "electron-builder": "26.15.3",
     "electron-vite": "5.0.0",
     "tailwindcss": "^4.0.0",
-    "vite": "8.0.0"
+    "vite": "7.3.6"
   }
 }

apps/desktop/src/main/bootstrap/bootstrap-desktop.ts

@@ -417,7 +417,8 @@ export async function bootstrapDesktop() {
     defaultAgentDirectory,
     getProcessCwd: () => process.cwd(),
     createSettingsManager: async (worktreePath, agentDirectory) => {
-      const { SettingsManager } = await import("@mariozechner/pi-coding-agent");
+      // biome-ignore format: keep this callback within its LOC baseline.
+      const { SettingsManager } = await import("@earendil-works/pi-coding-agent");
       return SettingsManager.create(worktreePath, agentDirectory);
     },
     runtimeManager,

apps/desktop/src/main/pi-oauth-service.ts

@@ -1,4 +1,4 @@
-import { AuthStorage } from "@mariozechner/pi-coding-agent";
+import { AuthStorage } from "@earendil-works/pi-coding-agent";
 import type { OAuthProviderSnapshot } from "@pi-desktop/shared";
 
 type OAuthPromptBridge = {
@@ -42,6 +42,13 @@ export async function loginWithOAuthForAgentDir(
       latestAuthInfo = { url, instructions };
       void bridge.openExternal(url);
     },
+    onDeviceCode: ({ verificationUri, userCode }) => {
+      latestAuthInfo = {
+        url: verificationUri,
+        instructions: `Enter code ${userCode} to continue authentication.`,
+      };
+      void bridge.openExternal(verificationUri);
+    },
     onPrompt: ({ message }) =>
       bridge.requestInput({
         providerId,
@@ -56,6 +63,14 @@ export async function loginWithOAuthForAgentDir(
           "Complete login in browser, then paste requested code or redirected URL here.",
         authUrl: latestAuthInfo?.url,
       }),
+    onSelect: ({ message, options }) =>
+      bridge.requestInput({
+        providerId,
+        message: `${message}\n${options
+          .map((option) => `${option.id}: ${option.label}`)
+          .join("\n")}`,
+        authUrl: latestAuthInfo?.url,
+      }),
   });
 }
 

package.json

@@ -30,6 +30,7 @@
     "@testing-library/react": "^16.3.2",
     "@testing-library/user-event": "^14.6.1",
     "@types/node": "25.5.0",
+    "effect": "^3.21.0",
     "jsdom": "^29.0.2",
     "typescript": "5.9.3",
     "vitest": "4.1.0"
@@ -40,5 +41,35 @@
   ],
   "dependencies": {
     "boneyard-js": "^1.7.6"
+  },
+  "overrides": {
+    "@babel/core": "8.0.1",
+    "@xmldom/xmldom": "0.9.10",
+    "app-builder-lib": "26.15.3",
+    "basic-ftp": "6.0.2",
+    "brace-expansion": "5.0.9",
+    "builder-util-runtime": "9.7.0",
+    "dompurify": "3.4.12",
+    "fast-uri": "4.1.2",
+    "fast-xml-builder": "1.3.0",
+    "fast-xml-parser": "5.10.1",
+    "file-type": "22.0.1",
+    "form-data": "4.0.6",
+    "ip-address": "10.4.0",
+    "js-yaml": "5.2.2",
+    "lodash": "4.18.1",
+    "picomatch": "4.0.5",
+    "postcss": "8.5.25",
+    "protobufjs": "8.7.1",
+    "sharp": "0.35.3",
+    "tar": "7.5.22",
+    "tmp": "0.2.7",
+    "undici": "7.29.0",
+    "vite": "7.3.6",
+    "ws": "8.21.1",
+    "yaml": "2.9.0"
+  },
+  "patchedDependencies": {
+    "electron-vite@5.0.0": "patches/electron-vite@5.0.0.patch"
   }
 }

packages/agent-host/package.json

@@ -10,7 +10,7 @@
     "typecheck": "tsc --project tsconfig.json --noEmit"
   },
   "dependencies": {
-    "@mariozechner/pi-coding-agent": "0.57.1",
+    "@earendil-works/pi-coding-agent": "0.79.0",
     "@pi-desktop/shared": "workspace:*",
     "effect": "^3.21.0"
   }

packages/agent-host/src/events/normalize-agent-session-event.spec.ts

@@ -1,4 +1,4 @@
-import type { AgentSessionEvent } from "@mariozechner/pi-coding-agent";
+import type { AgentSessionEvent } from "@earendil-works/pi-coding-agent";
 import { describe, expect, it } from "vitest";
 
 import { normalizeAgentSessionEvent } from "./normalize-agent-session-event.js";
@@ -269,7 +269,7 @@ describe("normalizeAgentSessionEvent", () => {
   it("returns null for unsupported event types", () => {
     expect(
       normalizeAgentSessionEvent({
-        type: "auto_compaction_start",
+        type: "compaction_start",
         reason: "threshold",
       }),
     ).toBeNull();

packages/agent-host/src/events/normalize-agent-session-event.ts

@@ -1,4 +1,4 @@
-import type { AgentSessionEvent } from "@mariozechner/pi-coding-agent";
+import type { AgentSessionEvent } from "@earendil-works/pi-coding-agent";
 
 import type { AgentMessageRole, PiDesktopAgentEvent } from "@pi-desktop/shared";
 

packages/agent-host/src/pi/pi-cli-rpc-line-handler.spec.ts

@@ -1,4 +1,4 @@
-import type { AgentSessionEvent } from "@mariozechner/pi-coding-agent";
+import type { AgentSessionEvent } from "@earendil-works/pi-coding-agent";
 import type { AgentSnapshot, PiDesktopAgentEvent } from "@pi-desktop/shared";
 import { describe, expect, it, vi } from "vitest";
 

packages/agent-host/src/pi/pi-sdk-agent-runtime.ts

@@ -6,7 +6,7 @@ import {
   createAgentSession as createPiAgentSession,
   ModelRegistry,
   SettingsManager,
-} from "@mariozechner/pi-coding-agent";
+} from "@earendil-works/pi-coding-agent";
 
 import type {
   AgentSnapshot,
@@ -119,7 +119,7 @@ export class PiSdkAgentRuntime {
     agentDir,
     createAgentSession = createPiAgentSession,
     createModelRegistry = (authFilePath, modelsFilePath) =>
-      new ModelRegistry(AuthStorage.create(authFilePath), modelsFilePath),
+      ModelRegistry.create(AuthStorage.create(authFilePath), modelsFilePath),
     createSettingsManager = (nextCwd, nextAgentDir) =>
       SettingsManager.create(nextCwd, nextAgentDir),
   }: PiSdkAgentRuntimeOptions) {

packages/agent-host/src/pi/pi-sdk-session-bootstrap.spec.ts

@@ -1,4 +1,4 @@
-import type { AgentSessionEvent } from "@mariozechner/pi-coding-agent";
+import type { AgentSessionEvent } from "@earendil-works/pi-coding-agent";
 import type {
   AgentMessageSnapshot,
   AgentSnapshot,

packages/agent-host/src/pi/pi-sdk-session-bootstrap.ts

@@ -1,4 +1,4 @@
-import type { AgentSessionEvent } from "@mariozechner/pi-coding-agent";
+import type { AgentSessionEvent } from "@earendil-works/pi-coding-agent";
 
 import type { AgentSnapshot, PiDesktopAgentEvent } from "@pi-desktop/shared";
 

packages/shared/package.json

@@ -21,6 +21,6 @@
     "typecheck": "tsc --project tsconfig.json --noEmit"
   },
   "devDependencies": {
-    "electron": "41.0.1"
+    "electron": "41.2.1"
   }
 }

packages/ui/package.json

@@ -33,7 +33,7 @@
     "@testing-library/react": "^16.3.2",
     "@testing-library/user-event": "^14.6.1",
     "@types/react": "^19.0.8",
-    "@vitejs/plugin-react": "^6.0.1",
+    "@vitejs/plugin-react": "^5.2.0",
     "jsdom": "^29.0.2",
     "vitest": "4.1.0"
   }

patches/electron-vite@5.0.0.patch

@@ -0,0 +1,13 @@
+diff --git a/package.json b/package.json
+index 1af214042bb338911b73e67c882c36fefef7b6bf..d8de03257dd69af37334c4c5ab3c0de808769a61 100644
+--- a/package.json
++++ b/package.json
+@@ -92,7 +92,7 @@
+     "vite": "^7.1.10"
+   },
+   "dependencies": {
+-    "@babel/core": "^7.28.4",
++    "@babel/core": "^8.0.1",
+     "@babel/plugin-transform-arrow-functions": "^7.27.1",
+     "cac": "^6.7.14",
+     "esbuild": "^0.25.11",

tests/integration/agent-host/pi-sdk-agent-runtime.spec.ts

@@ -1,4 +1,4 @@
-import type { AgentSessionEvent } from "@mariozechner/pi-coding-agent";
+import type { AgentSessionEvent } from "@earendil-works/pi-coding-agent";
 import { describe, expect, it, vi } from "vitest";
 
 import { PiSdkAgentRuntime } from "../../../packages/agent-host/src/pi/pi-sdk-agent-runtime";