fix: upgrade pi-tui and streamline runtime validation

[kingsword09]

pi-tui 1.x changes the theme-query and cursor contracts, and the development dependency audit found denial-of-service advisories. Upgrade the adapter and its test tooling while reducing repeated runtime validation in CI.

Changes

• Upgrade pi-tui to 1.3.0 and adapt automatic themes, prompt placeholders and focus-aware cursors. Share PTY trace parsing so ST-terminated OSC 7501 queries do not consume visible output, and synchronize focus assertions with the welcome transition.
• Upgrade just-bash to 3.6.0, removing the vulnerable brace-expansion chain and selecting smol-toml 1.9.1. Override undici to 7.30.0 and apply a reproducible Bun patch for sprintf-js precision bounds.
• Remove the obsolete static manifest fallback. Stable-service failures retain their cause and explain how to explicitly rebuild with sync:locked. Isolate notification tests from the host terminal environment, refresh development documentation and include HOST_INTEGRATION.md in package validation.
• Run the complete runtime suite once on Node 22/Linux. The three additional Node/OS environments run 18 compatibility tests plus the existing installation and real SQLite checks. Reduce focus configurations from five to three, consolidate the duplicated model-search case and remove unused preflight reproduction scripts, fixtures and command aliases.

Validation

• Upgrade verification: sync:locked, the complete verify:tui-perf gate, release:pack, and clean npm/Bun installation checks passed on macOS arm64 with Bun 1.4.1 and Node 26.4.0.
• All 108 performance profiles passed without changing the limits; worst frame P95 was 2.359 ms against a 4 ms budget.
• Final CI/test cleanup: actionlint, typecheck, 46 affected regression tests, all 18 compatibility tests and the three focus configurations passed.
• Frozen-lockfile installation and all four direct sprintf precision regressions passed after final patch-file normalization.

bun audit reports zero high and one moderate advisory: GHSA-hp3w-g68c-fv3c still matches the upstream sprintf-js 1.1.3 version, for which no fixed release exists. The local patch is applied and tested; the advisory is not suppressed. Scope and removal conditions are documented in patches/README.md.

[github-actions]

pkg-pr-new preview for commit 33c5c8e183e2705a80b60e2b944ce93a6cd92f56.

npx --yes https://pkg.pr.new/zcode-app-cli@33c5c8e

Full repository URL

This preview uses the selected commit. PR updates publish automatically after CI succeeds; kingsword09 can also request a preview with /pkg-pr-new.

Workflow logs