ci(deps): update dependency @myk-org/pi-sidecar to v4.9.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@myk-org/pi-sidecar	4.8.4 → 4.9.0

---

Release Notes

myk-org/pi-config (@​myk-org/pi-sidecar)

v4.9.0

Compare Source

✨ Features

• reviews address subcommand — apply replies and statuses to a fetched reviews JSON in one command: sticky↔thread pairing (mutual-nearest matching), ambiguity guards, multi-group retention, then post + store; the /review-handler prompt is wired to it (mapping files replace hand-edited JSON) (#​906)
• /create-commit prompt template — git-expert commit automation with fence-proof text interpolation, copy records, :(literal) pathspec magic, and subject/body splitting (#​907)
• Opt-in trustKeyScopedListing — agent-dir providers can trust key-scoped model listings pinned to the startup snapshot baseUrl; responses union live listing with manifest models carrying source provenance (listing/manifest) and a unified capability schema, with origin-only URL logging (#​912)

Full Changelog: myk-org/pi-config@v4.8.5...v4.9.0

v4.8.5

Compare Source

What's Changed

✨ Features

• Configurable sidecar agent dir — deployments can supply custom pi providers (models.json with env-var apiKey refs), auth.json, and settings.json via the startSidecar({ agentDir }) option or PI_SIDECAR_AGENT_DIR env var; settings are snapshotted once at startup, per-request agent_dir stays resource-scoped, and the REST API is unchanged (#​904)

🐛 Bug Fixes

• /new keeps the selected model — the #​753 cold-start default restore no longer fires on /new; it fills only an empty selection, never overwrites a selection made mid-retry, and the reason gate and abort guard now share one trimmed reason value (#​903)

📚 Documentation

• Dev-docs consolidation — dev-docs consolidated into the pi-docsite docs/ with a contributing/ split (#​899)
• Scoped logging requirements — logging rules now target the pi runtime and exempt static browser assets (#​896)

🔧 Maintenance

• Generic remap fixtures — remap-node-identity tests use a generic username (ee2196e)

Full Changelog: myk-org/pi-config@v4.8.4...v4.8.5

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[myakove-bot]

Report bugs in Issues

Welcome! 🎉

This pull request will be automatically processed with the following features:

Note: You are an auto-verified user. Your PRs will be automatically verified and may be auto-merged when all requirements are met.

🔄 Automatic Actions

• Reviewer Assignment: Reviewers are automatically assigned based on the OWNERS file in the repository root
• Size Labeling: PR size labels (XS, S, M, L, XL, XXL) are automatically applied based on changes
• Issue Creation: Disabled for this repository
• Pre-commit Checks: pre-commit runs automatically if .pre-commit-config.yaml exists
• Branch Labeling: Branch-specific labels are applied to track the target branch
• Auto-verification: Auto-verified users have their PRs automatically marked as verified
• Labels: All label categories are enabled (default configuration)

📋 Available Commands

PR Status Management

• /wip - Mark PR as work in progress (adds WIP: prefix to title)
• /wip cancel - Remove work in progress status
• /hold - Block PR merging (PR author or approvers)
• /hold cancel - Unblock PR merging (PR author or approvers)
• /verified - Mark PR as verified
• /verified cancel - Remove verification status
• /reprocess - Trigger complete PR workflow reprocessing (useful if webhook failed or configuration changed)
• /regenerate-welcome - Regenerate this welcome message
• /security-override - Set security check runs to pass (maintainers only)
• /security-override cancel - Re-run security checks

Review & Approval

• /lgtm - Approve changes (looks good to me)
• /approve - Approve PR (approvers only)
• /automerge - Enable automatic merging when all requirements are met (maintainers and approvers only)
• /automerge cancel - Remove automerge label (maintainers and approvers only)
• /assign-reviewers - Assign reviewers based on OWNERS file
• /assign-reviewer @username - Assign specific reviewer
• /check-can-merge - Check if PR meets merge requirements

Testing & Validation

• /retest tox - Run Python test suite with tox
• /retest build-container - Rebuild and test container image
• /retest python-module-install - Test Python package installation
• /retest pre-commit - Run pre-commit hooks and checks
• /retest conventional-title - Validate commit message format
• /retest all - Run all available tests

Container Operations

• /build-and-push-container - Build and push container image (tagged with PR number)
  • Supports additional build arguments: /build-and-push-container --build-arg KEY=value

Cherry-pick Operations

• /cherry-pick <branch> - Schedule cherry-pick to target branch when PR is merged
  • Multiple branches: /cherry-pick branch1 branch2 branch3
• /cherry-pick-retry <branch> - Retry a failed cherry-pick (merged PRs only)

Branch Management

• /rebase - Rebase this PR branch onto its base branch

Label Management

• /<label-name> - Add a label to the PR
• /<label-name> cancel - Remove a label from the PR

✅ Merge Requirements

This PR will be automatically approved when the following conditions are met:

1. Approval: /approve from at least one approver
2. LGTM Count: Minimum 1 /lgtm from reviewers
3. Status Checks: All required status checks must pass
4. No Blockers: No wip, hold, has-conflicts labels and PR must be mergeable (no conflicts)
5. Verified: PR must be marked as verified

📊 Review Process

Approvers and Reviewers

Approvers:

• myakove
• rnetser

Reviewers:

• myakove
• rnetser

Available Labels

• hold
• verified
• wip
• lgtm
• approve
• automerge

AI Features

• Conventional Title: Mode: fix (cursor/cursor-grok-4.6-high)
• Cherry-Pick Conflict Resolution: Enabled (cursor/cursor-grok-4.6-high)

Security Checks

• Suspicious Path Detection: Monitors paths: .claude/, .vscode/, .cursor/, .devcontainer/, .pi/, .github/workflows/, .github/actions/
• Committer Identity Check: Verifies last committer matches PR author
• Mandatory: Security checks block merge (use /security-override to bypass — maintainers only)

💡 Tips

• WIP Status: Use /wip when your PR is not ready for review
• Verification: The verified label is removed on new commits unless the push is detected as a clean rebase
• Cherry-picking: Cherry-pick labels are processed when the PR is merged
• Container Builds: Container images are automatically tagged with the PR number
• Permission Levels: Some commands require approver permissions
• Auto-verified Users: Certain users have automatic verification and merge privileges

For more information, please refer to the project documentation or contact the maintainers.

[rnetser]

/approve
/lgtm

[myakove]

/approve
/lgtm

[myakove-bot1]

New container for ghcr.io/myk-org/github-webhook-server:latest published