Changelog

Changed#

• octet migrate pi is one guided command: one question installs and enables the Pi adapter and backs up octet's config. Pi's settings are never written.
• pi-subagents loads through the Pi adapter like any other Pi package, so its commands work.

Fixed#

• Dependencies take the rustix 1.1.6 security fix with xattr 1.7.0. (#729 by @XelHaku)
• Thinking and tool toggles stay independent. (#724 by @gafiatulin)

Fixed#

• A context projection that the provider cannot represent no longer fails request preparation. The request that reached the hook is restored — it has already passed identity, loadout and host-authority checks — and the run continues, reporting one notice per session and extension that names the real validator reason. Previously a large Pi fleet could lose the whole session: provider context preparation refused: invalid canonical provider context.
• A read-only context observation no longer fails when session history contains an assistant message produced by a different model or protocol. The opaque reasoning continuation cannot be represented there, and the refusal propagated into Pi's tool-call guard, which failed closed and blocked every tool call with unsupported_feature context opaque reasoning continuation: signature producer must match the assistant. Observation now keeps the visible reasoning text and omits only the unrepresentable signature; provider replay and projection stay strict, so continuation state is never altered.

Known limitations#

• @gotgenes/pi-permission-system in --print mode still stalls a tool call for about 30 seconds before the host request timeout ends it; the run then exits 0. Root cause is identified (a synchronous tools/snapshot wait that headless mode never answers) and the fix is scheduled next.
• The published octet-codemode bundle still ships only its launcher shim, so it cannot start on a machine without a built runner.

Compatibility#

Pi extension API 0.4 bundles are pinned to this host: run octet extension update <name> for each bundle after updating, since a 0.10.2 bundle is rejected by a 0.10.3 host.

Fixed#

• octet update no longer fails with release metadata exceeds the 65536-byte limit. The bound covered GitHub's whole releases payload, which carries every asset entry and the release notes body: v0.10.1 measured 75,595 bytes, so a healthy release was refused. The bound is 256 KiB, and the response still has a hard size limit, a fixed timeout and strict validation.
• --workspace accepts a working directory outside the workspace instead of failing with invocation directory ... is outside workspace. Relative paths resolve against the workspace, and workspace-trust admission and confinement are unchanged.

Known limitations#

• Binaries published before 0.10.2 carry the old 64 KiB bound and cannot read this fix; use the version-pinned installer if octet update reports a size-limit error.
• @gotgenes/pi-permission-system blocks a --print tool call for about 30 seconds before the host request timeout ends it, and the run still exits 0.

Recovery for 0.10.0 and 0.10.1 installations#

Those binaries carry the old 64 KiB bound and cannot inherit this fix. Until you install 0.10.2, run the version-pinned installer from the release page, or the octet update fallback in installation. The published 0.10.1 release description was shortened so its API payload fits inside the old bound, which restores octet update for those users.

Release tooling#

• Add a default-off force_release manual input to waive source CI qualification explicitly, with an actor/source audit summary. Immutable source checks, dependency audits, release build checks and protected signing remain required; workflow-only repairs can be dispatched from their dedicated tooling tag.

Security#

• Update pulldown-cmark from 0.13.5 to 0.13.6 for RUSTSEC-2026-0433 (quadratic parsing of nested image wikilinks). octet does not enable the affected wikilinks extension.

Fixed#

• A Pi theme you selected, and Pi's built-in palettes, load as they do in Pi instead of ending a reload with rejected resource path: untrusted workspace resource has no explicit path grant and default theme was not an admitted theme file. A palette under your Pi agent directory (or OCTET_PI_AGENT_DIR, ~/.octet, ~/.agents) is a user resource, so it is never classified as a project resource even when the workspace contains it (for example when you start octet from your home directory), and it therefore needs no workspace trust grant. Project palettes still require trust, and a refused theme now names the file and the reason.

• Pi prompt hooks no longer run under an Octet-only deadline. input, before_agent_start and context collection await handlers the way Pi does, so a handler that waits for a user answer still delivers its prompt transform or system-prompt replacement instead of having it silently dropped.

Get started#

Install octet, then follow the Pi setup guide. The release page has downloads and checksums. Extension bundles install separately, and installing one doesn't run it.

Highlights#

• Bring your Pi setup. octet reads your Pi extensions, skills, prompts and themes each time it starts, or you can import a reviewed snapshot. Pi joins codemode, computer use, MCP, subagents and web search as the sixth optional extension bundle.
• Pi 1.4. Setup and the installed-Pi fallback accept Pi 1.0.2 through 1.4.x. The adapter follows Pi 1.4's API additions: messageType on before_agent_start, aborted on agent_settled, tool durations, reachesTools, namespace aliases, getPromptGuidelines() and the pi-ai/models import. Of Pi 1.4.0's 79 example extensions, 69 load directly, 4 load through the installed-Pi fallback, 4 need their own npm install, and 2 use provider features octet doesn't support yet. That's the same result as Pi 1.0.2's examples. Loading is not the same as every feature working; see the ledger.

Trust and permissions#

Turning on the Pi adapter runs your enabled Pi extensions with your OS permissions, as Pi does. It is not a sandbox. Sharing provider credentials with extensions is a separate opt-in.

What changed in 0.9.6#

• Finished subagents no longer block /reload. A worker that completed, reached its turn limit, failed, timed out or was interrupted is parked by the reload with its result and session kept, including across a host binary reload, and subagent_continue resumes it. A turn-limited or detached worker used to block every reload until the session was exited and resumed.
• /reload --force forces. A worker that is still running or has queued work blocks plain and automatic reloads; --force detaches it, keeps its session and queued work, resumes undelivered tasks on the next turn and never replays delivered work.

Status at a glance#

• Pi compatibility is experimental and unstable. Full Pi backwards compatibility is not yet qualified. The octet-pi-compat adapter does not ship in this release; it remains source-only experimental work, and loading real Pi setups can be slow or fail for individual extensions.
• Many extensions work today. Five first-party bundles ship (codemode, computer use, MCP, subagents and web search), any-language subprocess extensions are supported, and in the source preview unchanged Pi extensions such as Doom, drawing, the powerline footer and the rainbow editor run through the adapter. These Pi receipts are development evidence, not release qualification.

What's better since v0.8.1#

• Up to 8× more parallel reads. Read-only tool calls run in waves of one per CPU, from 4 up to 32 (v0.8.1: always 4), and the runtime's worker pool is sized to the machine instead of 2 threads.
• Edits stop filling the model's context. edit and write return one short line (ok, path, verb, content hash); the unified diff moves to result metadata the model never sees. Tool cards still show the diff.

What changed in 0.9.5#

• Audio input on Gemini, Vertex AI and Google-compatible OpenCode models. Audio-capable models keep audio in discovery, attachments and read results and receive inline WAV, MP3, AAC, FLAC and Ogg Opus bytes through native generateContent. Oversized audio reads name the 20 MiB raw-audio cap and suggest compressing or splitting the file. Audio output, raw PCM16 and provider file references remain unsupported.
• Parallel Gemini tool calls remain distinct across stream chunks. Gemini 4 Argon on OpenCode Zen and Argon Contributor on Go retain every call's arguments, thought signature and paired result instead of merging calls at the same chunk-local position. The fix applies to the shared Google codec.

Status at a glance#

• Pi compatibility is experimental and unstable. Full Pi backwards compatibility is not yet qualified. The octet-pi-compat adapter does not ship in this release; it remains source-only experimental work, and loading real Pi setups can be slow or fail for individual extensions.
• Many extensions work today. Five first-party bundles ship (codemode, computer use, MCP, subagents and web search), any-language subprocess extensions are supported, and in the source preview unchanged Pi extensions such as Doom, drawing, the powerline footer and the rainbow editor run through the adapter. These Pi receipts are development evidence, not release qualification.

What's better since v0.8.1#

• Up to 8× more parallel reads. Read-only tool calls run in waves of one per CPU, from 4 up to 32 (v0.8.1: always 4), and the runtime's worker pool is sized to the machine instead of 2 threads.
• Edits stop filling the model's context. edit and write return one short line (ok, path, verb, content hash); the unified diff moves to result metadata the model never sees. Tool cards still show the diff.

What changed in 0.9.4#

• Gemini 4 Argon has thinking levels on OpenCode. OpenCode's model list carries no reasoning information, so Gemini 4 Argon Contributor on OpenCode Go and Gemini 4 Argon on OpenCode Zen offered only off in /thinking. They now offer low, medium and high.
• Gemini thinking levels match each model. Gemini 3.1 Pro offers low, medium and high on the Gemini API, Vertex AI and OpenCode Zen; it offered only low and high before. On OpenCode Zen, Gemini 3 Pro, 3.5 Flash Lite, 3.6 Flash, 3.7 Flash and 3.8 Flash now offer their thinking levels instead of only off. OpenRouter already read each model's levels and is unchanged.

Status at a glance#

• Pi compatibility is experimental and unstable. Full Pi backwards compatibility is not yet qualified. The octet-pi-compat adapter does not ship in this release; it remains source-only experimental work, and loading real Pi setups can be slow or fail for individual extensions.
• Many extensions work today. Five first-party bundles ship (codemode, computer use, MCP, subagents and web search), any-language subprocess extensions are supported, and in the source preview unchanged Pi extensions such as Doom, drawing, the powerline footer and the rainbow editor run through the adapter. These Pi receipts are development evidence, not release qualification.

What's better since v0.8.1#

• Up to 8× more parallel reads. Read-only tool calls run in waves of one per CPU, from 4 up to 32 (v0.8.1: always 4), and the runtime's worker pool is sized to the machine instead of 2 threads.
• Edits stop filling the model's context. edit and write return one short line (ok, path, verb, content hash); the unified diff moves to result metadata the model never sees. Tool cards still show the diff.

What changed in 0.9.3#

• Gemini on OpenCode Go works. OpenCode Go serves its Gemini models, including Gemini 4 Argon Contributor, only under https://opencode.ai/inference/go/v1/. 0.9.2 sent them to the zen/go base, which answered with 404 (route or model not found). Other OpenCode Go models keep their existing endpoint.

Status at a glance#

• Pi compatibility is experimental and unstable. Full Pi backwards compatibility is not yet qualified. The octet-pi-compat adapter does not ship in this release; it remains source-only experimental work, and loading real Pi setups can be slow or fail for individual extensions.
• Many extensions work today. Five first-party bundles ship (codemode, computer use, MCP, subagents and web search), any-language subprocess extensions are supported, and in the source preview unchanged Pi extensions such as Doom, drawing, the powerline footer and the rainbow editor run through the adapter. These Pi receipts are development evidence, not release qualification.

What's better since v0.8.1#

• Up to 8× more parallel reads. Read-only tool calls run in waves of one per CPU, from 4 up to 32 (v0.8.1: always 4), and the runtime's worker pool is sized to the machine instead of 2 threads.
• Edits stop filling the model's context. edit and write return one short line (ok, path, verb, content hash); the unified diff moves to result metadata the model never sees. Tool cards still show the diff.

What changed in 0.9.2#

• Gemini on OpenCode Go works. OpenCode Go's gemini-* models, including Gemini Argon, are sent to its Google endpoint with the Google protocol and every declared thinking level. 0.9.1 sent them to the OpenAI-compatible chat endpoint, where they failed.
• One command installs the first-party extensions. /extensions install downloads every missing first-party bundle concurrently with a live progress row per bundle; octet extension install --all does the same from the shell. Installed bundles are left untouched. Installing still never enables or trusts an extension: turn each one on in /extensions.

Status at a glance#

• Pi compatibility is experimental and unstable. Full Pi backwards compatibility is not yet qualified. The octet-pi-compat adapter does not ship in this release; it remains source-only experimental work, and loading real Pi setups can be slow or fail for individual extensions.
• Many extensions work today. Five first-party bundles ship (codemode, computer use, MCP, subagents and web search), any-language subprocess extensions are supported, and in the source preview unchanged Pi extensions such as Doom, drawing, the powerline footer and the rainbow editor run through the adapter. These Pi receipts are development evidence, not release qualification.

What's better since v0.8.1#

• Up to 8× more parallel reads. Read-only tool calls run in waves of one per CPU, from 4 up to 32 (v0.8.1: always 4), and the runtime's worker pool is sized to the machine instead of 2 threads.
• Edits stop filling the model's context. edit and write return one short line (ok, path, verb, content hash); the unified diff moves to result metadata the model never sees. Tool cards still show the diff.

What changed in 0.9.1#

• Security: rustls 0.23.46. Fixes four rustls advisories published on 2026-10-14: Debug output for client session values could expose TLS secrets (RUSTSEC-2026-0346, medium), an unauthenticated ServerHello could downgrade later connections to classical key exchange (RUSTSEC-2026-0349), Brotli certificate decompression could allocate up to 1 GiB before authentication (RUSTSEC-2026-0348), and buffered data could reach the outer server after an ECH rejection (RUSTSEC-2026-0347).
• Working installer. install-octet.sh accepts the signed checksum manifest now that it also lists the Windows archive and install-octet.ps1; the 0.9.0 installer rejected it, so 0.9.0 published no native binaries.

Status at a glance#

• Pi compatibility is experimental and unstable. Full Pi backwards compatibility is not yet qualified. The octet-pi-compat adapter does not ship in this release; it remains source-only experimental work, and loading real Pi setups can be slow or fail for individual extensions.
• Many extensions work today. Five first-party bundles ship (codemode, computer use, MCP, subagents and web search), any-language subprocess extensions are supported, and in the source preview unchanged Pi extensions such as Doom, drawing, the powerline footer and the rainbow editor run through the adapter. These Pi receipts are development evidence, not release qualification.

What's better since v0.8.1#

• Up to 8× more parallel reads. Read-only tool calls run in waves of one per CPU, from 4 up to 32 (v0.8.1: always 4), and the runtime's worker pool is sized to the machine instead of 2 threads.
• Edits stop filling the model's context. edit and write return one short line (ok, path, verb, content hash); the unified diff moves to result metadata the model never sees. Tool cards still show the diff.

Status at a glance#

• Pi compatibility is experimental and unstable. Full Pi backwards compatibility is not yet qualified. The octet-pi-compat adapter does not ship in this release; it remains source-only experimental work, and loading real Pi setups can be slow or fail for individual extensions.
• Many extensions work today. Five first-party bundles ship (codemode, computer use, MCP, subagents and web search), any-language subprocess extensions are supported, and in the source preview unchanged Pi extensions such as Doom, drawing, the powerline footer and the rainbow editor run through the adapter. These Pi receipts are development evidence, not release qualification.

What's better since v0.8.1#

• Up to 8× more parallel reads. Read-only tool calls run in waves of one per CPU, from 4 up to 32 (v0.8.1: always 4), and the runtime's worker pool is sized to the machine instead of 2 threads.
• Edits stop filling the model's context. edit and write return one short line (ok, path, verb, content hash); the unified diff moves to result metadata the model never sees. Tool cards still show the diff.

Highlights#

• Native coding surface: read, edit, write and bash (PowerShell on Windows). Independent reads and shell calls can overlap under full access; mutations and approval-bearing calls remain ordered. Native Search is removed; content search uses rg or grep through the shell.
• Interactive correctness: model and reasoning changes wait for a safe request boundary; settings apply visibly; paste and attachment chips remain editable text with undo. Fullscreen scrolling retires stale Kitty images.

Highlights#

• Add the version-matched octet-computer-use executable bundle to the official extension catalog. It uses a separately installed MIT-licensed Cua Driver for native desktop observation and actions. Driver setup and OS permission grants are explicit. On macOS, the signed CuaDriver app supplies a visible agent cursor; the default fails closed if that host or its grants are unavailable. In full access, effectful actions do not prompt by default; gated profiles or OCTET_CUA_CONFIRM=1 require confirmation. It is not a sandbox.
• Keep octet-browse installable but deprecated. Its isolated Chromium profile and manual-authentication boundary remain safer for logged-in page work than computer use on the real desktop. The MCP bridge can also connect to a separately configured local Cua Driver server.

Availability and limits#

Native archives and the installer target macOS Apple silicon/Intel and GNU/Linux x86-64. Serve and five executable bundles are separate, exact-version assets; installation does not activate an extension or persist a trust grant. The npm channel is published at @skaft/octet@0.8.1; Homebrew, crates.io, and SDK registry publication remain separate and unpublished channels. The version-pinned GitHub release records signed assets and public-install results.

Highlights#

• Keep startup silent and editable, restore the full /model picker, and keep inspection commands and /goal responsive during streaming.
• Improve activity shimmer, tool disclosure, worker presentation, and usage visibility without replacing durable accounting with display estimates.

Additional reconciled changes#

• Keep model/thinking/subagent and consent surfaces inside the active run loop; renderer layout and terminal writes no longer hold the semantic input lock.
• Bound Bash spill storage and editor history, move optional telemetry writes off the agent path, and advance session/replay projections incrementally.

Reload#

Interactive resource/extension reload is enabled silently by default and applies at idle boundaries. /reload --dry-run previews changes. Host replacement requires /reload --force or explicit reload_host = true, and a replaced binary requires confirmation before its first probe execution. Resource rebuilds refuse while host worker tasks remain attached, including retained idle receivers; force/watch passes cannot bypass that refusal. Finish or stop work, then exit and resume the session to replace that owning host. In-flight provider calls are not silently replayed. A separate running octet serve process needs its own restart to use a new binary.

Fixed#

• Repair stale models.dev integration so discovered models receive reviewed display names, context/output limits and advertised thinking metadata where the provider API leaves them unspecified. Explicit API assertions remain authoritative; metadata does not select a wire protocol or enable unsupported thinking controls.
• Recognize DeepSeek V4.1 Flash correctly instead of falling back to stale model-family defaults.

Changed#

• Refresh the checked-in rich models.dev snapshot before release and review its source identity, names, pricing and capabilities together. Compilation consumes checked-in metadata without a network refresh.
• Align product, SDK, Serve and the four executable-bundle distribution versions to 0.7.6. Extension API and native-host protocol versions, independent examples and historical releases remain unchanged.

Known limitation#

Direct DeepSeek scheduled pricing is not represented by the static price table. Cost remains unknown unless explicit pricing is configured; rates are not borrowed from another provider or presented as zero-cost.