Jeremy McSpadden 2c926c12e3 fix: Phase 1 quick wins — bug fixes, security hardening, and performance ... - Fix loadStoredEnvKeys divergent provider lists: add telegram_bot and custom-openai to wizard.ts (the canonical copy used by CLI), remove dead duplicate from onboarding.ts - Security: add SAFE_COMMAND_PREFIXES allowlist to resolveConfigValue to prevent arbitrary RCE via settings.json shell commands - Security: add TOFU (Trust On First Use) model for project-local extensions — skip untrusted .pi/extensions/ with stderr warning - Performance: debounce sql.js MemoryStorage persistence (500ms window) so rapid mutations coalesce into a single db.export()+writeFileSync - Fix double lstatSync call in tool-bootstrap.ts isRegularFile - Add 26 new tests covering all changes		2026-03-16 13:18:02 -05:00
..
src	fix: Phase 1 quick wins — bug fixes, security hardening, and performance	2026-03-16 13:18:02 -05:00
package.json	fix: add undici as root dependency to resolve startup crash (#372)	2026-03-14 10:45:52 -06:00
tsconfig.json	feat: vendor Pi source into workspace monorepo	2026-03-12 21:55:17 -06:00