Bump pi packages to 0.80.3

[youknowriad]

Related issues

How AI was used in this PR

Fully authored with Claude Code: it checked the latest upstream versions, reviewed the pi changelog from 0.78.0 through 0.80.3 for breaking changes, applied the bump and the one required import migration, and ran the verification suite (typecheck, full tests, CLI build).

Proposed Changes

• Updates all @earendil-works/pi-* packages (pi-ai, pi-agent-core, pi-coding-agent, pi-tui) from 0.78.0 to 0.80.3, and aligns packages/common, which had drifted to 0.79.0 — so we stop shipping two different copies of pi-coding-agent.
• Picks up upstream security patches (stored XSS in HTML session exports, vulnerable undici/protobufjs), agent-quality fixes (fuzzy edit no longer rewrites untouched lines, quadratic slowdown on deep session branches), Claude Sonnet 5 model support, and reliability improvements (auto-retry on retryable provider stream errors, HTTP errors now include response bodies).
• Unblocks upcoming work on new SDK surface: compaction events with reason/willRetry and post-compaction token estimates, exported edit-diff helpers, and new RPC session-inspection commands.
• Hardens agent sessions against prompt injection using the trust controls introduced in pi 0.79/0.80: sessions now declare the sites folder an untrusted pi project and suppress APPEND_SYSTEM.md discovery. Previously (including on 0.78.0), a file planted at ~/Studio/APPEND_SYSTEM.md or ~/Studio/.pi/APPEND_SYSTEM.md would be silently appended to the agent's system prompt on every session. Studio builds its prompt and tools programmatically, so no behavior changes for legitimate use.
• Migrates the one breaking change in 0.80.0: the @earendil-works/pi-ai/anthropic entrypoint was removed, so the Anthropic stream import moves to the new canonical @earendil-works/pi-ai/api/anthropic-messages path (avoiding the temporary /compat shim, which is slated for removal).

Testing Instructions

• npm install && npm run typecheck — passes in all workspaces.
• npm test — full suite green (1985 passed, 9 skipped).
• npm run cli:build && node apps/cli/dist/cli/main.mjs --version — CLI bundles and runs.
• For an end-to-end check, run an agent conversation in Studio (StudioCodeSession or CLI agent) and confirm streaming, tool calls, and edits behave as before.

Pre-merge Checklist

• Have you checked for TypeScript, React or other console errors?

🤖 Generated with Claude Code

[wpmobilebot]

📊 Performance Test Results

Comparing 160d0c4 vs trunk

app-size

Metric	trunk	160d0c4	Diff	Change
App Size (Mac)	1317.38 MB	1345.30 MB	+27.93 MB	🔴 2.1%

site-editor

Metric	trunk	160d0c4	Diff	Change
load	1118 ms	742 ms	376 ms	🟢 -33.6%

site-startup

Metric	trunk	160d0c4	Diff	Change
siteCreation	6493 ms	6510 ms	+17 ms	⚪ 0.0%
siteStartup	1869 ms	1859 ms	10 ms	⚪ 0.0%

---

Results are median values from multiple test runs.

Legend: 🟢 Improvement (faster) | 🔴 Regression (slower) | ⚪ No change (<50ms diff)

[youknowriad]

I run evals before merging.