Eleven pi merges on October 22: OpenRouter-reported costs, confirm-gated device logins, and an HTML export that survives deep sessions

Eleven pull requests merged in pi on October 22, 2026: three features, seven fixes, and one plumbing change for preview package builds.

Two vegarsti PRs rework cost reporting. #10286 makes cost.total on OpenRouter requests carry OpenRouter’s reported billed amount — often different from pi’s catalog estimate because OpenRouter routes to differently priced providers — while the input, output, and cache components stay catalog estimates and the total falls back to their sum when the report is missing or invalid. #11178 adds the usage.totalFromProvider flag, true where the total is provider-reported, false everywhere today.

petrroll’s #9301 adds optional browser-open and code-copy on device-code login behind an extra confirmation (usually enter); the opt-out is provider-side, not a user setting (fixes #9282). vipentti’s #7952 adds messageId and timestamp to the markdown transformer context, undefined for live messages and present when rendering persisted session entries (closes #7828).

The HTML export gets two fixes. #11293 turns the viewer’s recursive tree walks into flat and stack-based loops: around 6,000 entries in one deep parent chain overflowed the call stack into a blank page, and the regression test exports a 20,000-entry chain (closes #11225). #11290 renders the leading system message as the system prompt and tool list and later ones as named section and tool updates; the CLI’s --export shows both (#3464) (closes #11261).

Among the rest: #11296 (petrroll) ranks contiguous fuzzy matches above scattered ones and separates what /model and /resume search — /resume previously matched one string spanning the full message text (closes #11220, also addresses #10552, #10065, #11024). #11289 (petrroll) stops macOS shell groups before killing them, narrowing the race where killing a foreground child wakes its shell first; Linux and Windows termination are unchanged (closes #11252). #11257 (muyiyr) preserves pi.exec() spawn errors by returning the error message as stderr when the child produced none, leaving ordinary silent non-zero exits unchanged (fixes #11085). #11270 (davidbrai) drops the min-release-age override from managed npm ci — its release-lockfile installs never resolve versions — the flag had no effect there, but scanners that block it stopped updates; global npm, pnpm, and bun self-updates keep their age-gate overrides (closes #11262).

#11260 (christianklotz) rounds out the batch with a workflow-and-script setup for preview package builds. All eleven postdate the v1.4.0 tag, so the earliest they ship is the next release; each fix’s diff and regression tests sit on its pull request page.