Include the fully audited Pi dependency fix in PR 242

Author: Coding-Dev-Tools

.github/workflows/ci.yml

@@ -241,30 +241,15 @@ jobs:
           ENGRAPHIS_PI_TEST_COMMAND: engraphis-mcp
         run: |
           npm ci --ignore-scripts
+          # The test host's published shrinkwrap overrides this package's nested pin.
+          # Repair that exact leaf in the installed host, preserving its other locked deps.
+          # --omit=dev excludes the host's own authoring tools, not this package's test tools.
+          npm install --prefix node_modules/@earendil-works/pi-coding-agent --ignore-scripts --no-save --omit=dev brace-expansion@5.0.12
+          node -e "require('node:assert/strict').equal(require('./node_modules/@earendil-works/pi-coding-agent/node_modules/brace-expansion/package.json').version, '5.0.12')"
           npm run verify
           npm run test:integration
-          npm audit --omit=dev
-          # Development advisories fail too, except inside the Pi test host: it ships its own
-          # npm-shrinkwrap.json, which npm overrides cannot change. Those stay visible as
-          # warnings until a host release with a fixed lockfile is adopted.
-          npm audit --json > "$RUNNER_TEMP/pi-audit.json" || true
-          python - "$RUNNER_TEMP/pi-audit.json" <<'PY'
-          import json
-          import sys
-
-          with open(sys.argv[1], encoding="utf-8") as handle:
-              report = json.load(handle)
-          host = "node_modules/@earendil-works/pi-coding-agent"
-          blocking = []
-          for name, vulnerability in sorted(report.get("vulnerabilities", {}).items()):
-              nodes = vulnerability.get("nodes") or []
-              if nodes and all(node == host or node.startswith(host + "/") for node in nodes):
-                  print(f"::warning::{name} ({vulnerability.get('severity')}) is pinned by the Pi test host")
-              else:
-                  blocking.append(f"{name} ({vulnerability.get('severity')})")
-          if blocking or "vulnerabilities" not in report:
-              sys.exit("npm audit found development advisories: " + (", ".join(blocking) or "no report"))
-          PY
+          npm audit
+          npm audit --no-package-lock --include=dev
 
   browser-accessibility:
     name: browser accessibility smoke

CHANGELOG.md

@@ -14,6 +14,11 @@ All notable changes to Engraphis are documented here. Format loosely follows
 - Retire consumed refresh credentials when a successful response has an invalid
   token subject, and keep empty graph-layer selections separate from all-layer cache entries.
 
+- Updated the Pi extension's locked `fast-uri` to 3.1.8, `ip-address` to 10.7.2 and
+  `brace-expansion` to 5.0.12. CI repairs the Pi test host's embedded vulnerable leaf with
+  that exact pin, verifies the installed version, and audits both the full dependency lock
+  and installed tree. Pi checks use bash on Windows, so every install, build, test and audit
+  failure stops the job.
 - Provide a valid offline decision example in Smart MCP action discovery.
 - Reject coerced numeric/string remote consent before Classic MCP can select a Jev backend.
 - Retain global entities referenced by workspace edges during secure erasure,

integrations/pi/README.md

@@ -112,10 +112,19 @@ in normal recall. This behavior is intentional and unchanged by the Pi extension
 ## Development
 
 ```bash
-npm install --ignore-scripts
+npm ci --ignore-scripts
+npm install --prefix node_modules/@earendil-works/pi-coding-agent --ignore-scripts --no-save --omit=dev brace-expansion@5.0.12
 npm run verify
+npm audit
+npm audit --no-package-lock --include=dev
 ```
 
+The pinned Pi test host includes its own shrinkwrap, which reinstalls an older
+`brace-expansion` despite this package's fixed nested pin. The scoped install repairs
+that exact dependency while retaining the host's other locked dependencies. Its
+`--omit=dev` excludes the host's own authoring tools; the extension's development
+dependencies remain installed and audited. CI also verifies the installed version.
+
 `npm run verify` type-checks the package, runs its configuration tests, and previews
 the publish tarball. The package pins the MCP SDK; update it only with a compatibility
 test against the supported Pi and Engraphis releases.