[vastsa]

Scope

Move the five direct Pi dependencies to exactly 1.3.0:

• packages/agent-runtime: pi-agent-core, pi-ai, pi-coding-agent
• apps/desktop: pi-ai, pi-mcp

The seven-package release group stays aligned through the lockfile. No Host
protocol, database schema, persisted provider endpoint, permission policy,
extension VERSION marker, or storage ownership change.

Compatibility work

• All three Desktop pnpm patches rebased onto the published 1.3.0 tarballs:
  hosted-search streaming/replay/estimation, bounded Anthropic OAuth handling,
  DeepSeek reasoning replay and endpoint-scoped system-message capability, local
  request errors, native session context estimation and image degradation.
• Upstream Anthropic strict-tool fallback and thinking-off handling preserved;
  each fallback attempt now re-enters local request preparation so callback and
  serialization failures stay classified and never expose raw payloads.
• requiresNonEmptyReasoningReplay moved into the new provider compat schema.
• Patch for the deleted experimental assistant-frame codec removed together with
  its codec-only tests; real stream-decoder, hosted-search consumer, and
  final-message coverage kept.
• New upstream guarantees adopted: foreign-model thinking omitted from replay,
  malformed final tool JSON never reaches Host execution, extension startup
  event carries the user discriminator.
• Desktop's own command-argument parser keeps quoted empty arguments, matching
  the upstream 1.3 fix, so an empty quoted argument no longer shifts later
  positionals.

Explicitly unchanged

Desktop still owns model/endpoint projection, retry policy, MCP ownership, and
compaction. ToolCall.argumentsError, provider-native effort replay,
samplingParams/promptCache/inputLimits forwarding, the Kimi For Coding
Anthropic preset, the OpenRouter models.dev route, and the OpenCode /zen route
are intentionally untouched. Details and file locations are in
docs/project/pi-130-adoption.md.

Validation

• pnpm build:js, Desktop typecheck, pnpm lint, pnpm docs:check (581 pages),
  check-architecture, check:agent-policy, check:pr-base — passed.
• pnpm check:pi-dependencies, pnpm check:pi-patches, pi-patch-hash fixture
  tests — passed.
• pnpm -r --workspace-concurrency=1 --if-present test — exit 0. Runtime 102
  files / 1,412 tests; Desktop 4,134 passed; pi-host 61 passed / 1 platform skip.
• Protocol smoke 23 checks (2 real-model checks skipped without credentials).
• Hosted-search bundle E2E 8/8; trusted-extension Electron E2E 57/57.
• test:e2e:provider-api-style is flaky under parallel load (two runs stopped at
  the no-auth save and StepFun selection steps). Its fixture and renderer source
  are unchanged from main; all 26 scenarios pass serially. Recorded, not
  claimed as a pass.
• Rust checks not rerun: no Rust source, Cargo dependency, or Host contract
  changed.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.