opensec-git/Pi-Bolt bolt-v1.0.2

Pi-Bolt 1.0.2

on GitHub

Pi-Bolt 1.0.2 hardens how Pi-Bolt updates itself and how its builds can be checked, makes file search immune to slow
patterns, lets pi-bolt compile take many extensions, and has the subagents extension follow Pi's project trust. Everything else is 1.0.1.

Changed

• pi-bolt update checks the installer before running it: it verifies the target release's SHA256SUMS against the
  release key built into Pi-Bolt, checks the installer's hash against it, and runs exactly those bytes. Releases now include
  install.sh and install.ps1 in their signed files. Updating to 1.0.1 or older still works, after the signature check, with
  a notice (#126).
• Build attestations: every release archive and runtime gets a GitHub build attestation, and a release verifies the
  runtimes it uses before building (#125).
• Subagents follow Pi's project trust: the optional opensec-pi-subagents extension (now 0.20.9) loads a project's own
  agent definitions only for projects you trust in Pi; "projectTrust": "full" in ~/.pi/agent/subagents.json restores the
  old behaviour (#128,
  opensec-pi-subagents#7).

Fixed

• pi-bolt compile with many extensions: 1.0.1 added every extension's top-level code together, so a few small
  extensions could pass the compiler's 256 KB limit with none of them large. Each extension module is now compiled on its own;
  when one is too big, the error names it, and a raised BUN_JSC_maximumAOTCandidateBytecodeSize is kept in compile.json for
  later compiles and updates (#129,
  #131).
• find and grep globs run in linear time, including .gitignore rules, so no pattern can stall a search
  (#127).
• The Windows installer installs nothing you said no to: the key typed at its first question no longer answers the next one,
  as in install.sh since 1.0.1 (#124).
• The npm package's undici is 8.12.3; Pi-Bolt's own builds do not use it
  (#123).

With the default settings Pi draws the same screen as 1.0.1, with the same CPU and memory. find and grep over a large
repository with many .gitignore patterns run about 3% more instructions than in 1.0.1; the next release takes that back.

Pi is 1.4.0, as in 1.0.1. The runtimes are 1.0.1's.

Install

curl -fsSL https://pi-bolt.opensec.in/install.sh | sh

irm https://pi-bolt.opensec.in/install.ps1 | iex

powershell -c "irm https://pi-bolt.opensec.in/install.ps1 | iex"

or pi-bolt update, or npm install -g --allow-scripts=pi-bolt pi-bolt, or bun add -g --trust pi-bolt. New in 1.0.1:

• Homebrew (macOS on Apple silicon, Linux): brew install opensec-git/tap/pi-bolt
• Scoop (Windows): scoop bucket add opensec-git https://github.com/opensec-git/scoop-bucket, then scoop install opensec-git/pi-bolt
• mise: github:opensec-git/Pi-Bolt with the options in the installation guide

pi-bolt update on a copy installed by one of them names that package manager's update command instead of replacing it.

The installer checks the release signature with OpenSSL 3, an installed Pi-Bolt, or ssh-keygen (OpenSSH 8.1 or later).
Every archive also has a GitHub build attestation: gh attestation verify <file> -R opensec-git/Pi-Bolt.

Linux x86-64 or ARM64 with glibc 2.17 or later; Android 7 or later on 64-bit ARM, in Termux; macOS 13 or later on Apple silicon;
Windows 10 1809 or later, or Windows 11, on x64.