chore(deps-dev): pi 1.0.2 + 4 patch bumps; make package-lock.json the only lockfile

[code-yeongyu]

Supersedes #36.

What

• Dev dependency bumps (the same 5 as chore(deps-dev): bump the dev-dependencies group with 5 updates #36): @earendil-works/pi-coding-agent and @earendil-works/pi-tui 0.87.1 -> 1.0.2, @biomejs/biome 2.5.15, @types/node 26.6.4, vitest 5.0.3.
• Test fake: 7 no-op stubs in test/helpers/fake-pi.ts for the members pi 1.0 added to ExtensionAPI.
• Root-cause fix: package-lock.json becomes the only lockfile. bun.lock is removed and gitignored; docs, CI and Dependabot config carry a note explaining the rule.

Why #36 failed: two separate causes

1. Stale bun.lock (this is what failed CI)

All 3 failed test jobs on #36 died in "Install dependencies", before any test ran:

bun install --frozen-lockfile
error: lockfile had changes, but lockfile is frozen

Dependabot's npm ecosystem updated package.json and package-lock.json but not bun.lock. The npm-consumer job passed because it installs with npm ci.

This recurs on every grouped bump: #35 needed a hand-pushed "update bun.lock" commit as well.

2. pi 1.0 grew ExtensionAPI (tests only)

With bun.lock regenerated, bun run check failed with tsgo TS2740 at test/helpers/fake-pi.ts:183 and :270. pi 1.0 added 7 required members to ExtensionAPI. I compared the 0.87.1 and 1.0.2 types.d.ts; nothing was removed or renamed.

Members	Introduced in pi
registerVirtualModel, unregisterVirtualModel	540e174 ("Virtual models", #10035)
registerMcpServer, unregisterMcpServer, getMcpServers	8562bcf ("codemode and MCP")
registerToolRenderer	1144973
getSettings	upstream commit not identified

src/ compiles unchanged. The fake gets no-op stubs.

Why not pi 1.0.4: it also makes hiddenTools required in the system-prompt options type, which breaks fake-pi.ts:17. That is a separate change, left for the next bump.

Why one lockfile, and why package-lock.json

• package-lock.json has real consumers. Extension hosts install pi extensions from git with npm install (README, CONTRIBUTING), and the npm-consumer job runs npm ci. Dependabot's npm ecosystem already maintains it.
• Two lockfiles always drift. No single tool updates both. Dependabot's bun ecosystem would only move the drift to package-lock.json, and running both ecosystems would open two PRs per bump, each failing the other lockfile's check.

Measured with Bun 1.4.2 in a temp dir holding only package.json and package-lock.json:

• In sync: bun install --frozen-lockfile installs from package-lock.json with exit 0 (165 packages). Compared with the lock entries, every installed version matches. The only difference is hoisting, i.e. which copy sits at the top level. For example, the lock has retry 0.13.1 at the root and 0.12.0 nested under proper-lockfile, while Bun hoists 0.12.0 and nests 0.13.1 under p-retry: same versions, same dependents.

• Out of date, the gate still holds:

  • package.json asking for vitest 5.0.2 while the lock has 5.0.3: error: lockfile had changes, but lockfile is frozen, exit 1.
  • a dependency added to package.json but not to the lock: the same error, exit 1.

  So --frozen-lockfile enforces package-lock.json, and the npm-consumer job's npm ci enforces it independently.

Verification (local, Bun 1.4.2, Node 26)

All checks ran in a clean checkout of this branch: no node_modules and no bun.lock.

Command	Result
bun install --frozen-lockfile	exit 0, reads package-lock.json; the generated bun.lock is ignored (git check-ignore)
bun run check (tsgo + biome)	clean
bun run test	281/281
bun run test:integration	47/47
npm ci && npm test (the npm-consumer steps)	281/281
npm pack --dry-run	24 files

---

Summary by cubic

Bumps dev dependencies (pi 1.0.2, biome 2.5.15, @types/node 26.6.4, vitest 5.0.3) and makes package-lock.json the only lockfile so CI no longer fails on a stale bun.lock. pi 1.0 adds seven required ExtensionAPI members, so the test fake gets no-op stubs for them.

Lockfile

• Dependabot's npm updates only touch package-lock.json; the old bun.lock drifted and broke bun install --frozen-lockfile.
• Bun 1.4.2 installs from package-lock.json, and --frozen-lockfile still detects out-of-date locks, so the single lockfile keeps both ecosystems verified.
• bun.lock is removed and gitignored; docs, CI comments, and Dependabot config now note the rule.

^{Written for commit a23ba96. Summary will update on new commits.}