heypi

Where it stands, 2026-10-13

Through 13 October, heypi’s core had no publication after 22 July, but its optional just-bash adapter’s allowed range admits the 1 October 3.6.0 release. In the reviewed source, the wrapper intended to keep agent skills read-only does not block its new file-creation method, createExclusive, so dependency updates require boundary review even without a heypi release. Use the beta for a supervised shared-chat trial if your team will own isolation, approver selection and the resolved dependency set.

Pi owns the model loop; heypi adds chat routing and approval policy. A team can coordinate agent work in chat, while people retain the decisions about approvers, execution boundaries and interrupted-work recovery.

Channel. For a supervised trial, use heypi 0.3.0-beta.2. There is no stable 0.3.0 at this cutoff. The command below pins only the project generator: npm create heypi@0.3.0-beta.2 -- codex-tag my-agent. Before running the agent, verify that the generated project’s dependencies and lockfile resolve heypi to 0.3.0-beta.2. Use Node >=22.19.0 when resolving Pi 0.79.10. We have not tested deployed skills protections, Gondolin egress or forced Pi and Cloudflare upgrades; the deployment checks below would settle those questions.

Budget a rebuild from 0.2.x. The 0.3 rewrite requires rebuilding configuration and persistence.

Choose isolation and restrict outbound network access explicitly. The scaffold selects Docker and local chat, adding Slack only with both credentials. In your configuration, omitting the runtime runs host Bash; the warning does not block it. Host commands can leave the workspace within the service account’s permissions.

Docker sets no network selector, and normal bridge defaults permit external access, subject to daemon, routing and firewall policy. Test the routes your agent must not reach.

Name approvers and gate consequential tools before sharing the agent. The approval-request path blocks execution on failed required writes, rejection or failed UI posting. Tools require no approval until opted in; omitting both admins and approvers admits any reachable responder.

Use approval.always() for per-call decisions: once() remembers a tool within the session, and approval.command() allows unmatched command text.

Keep decision records and secret backups out of the agent’s reach. The queryable ledger covers approval-request decisions, not every execution; plain JSONL appends are not tamper-evident. If state writers must not rewrite records, export them to independently protected append-only storage.

Browser-encrypted handoff keeps raw secret replies away from Pi, but a readable complete backup contains both ciphertext and its decryption key. Protect state-directory permissions and backups.

Choose whether conversations may share memory. Memory defaults on, with relevant shared records eligible across conversations on the same adapter ID. Recall selects, limits and escapes records. Use memory: false when that surface is unwanted, or separate adapter IDs when shared memory must stay apart.

Keep admin local unless you configure remote access. Admin is opt-in. The beta.2 server defaults to 127.0.0.1 and requires a token to start off loopback, plus configured hosts for wildcard bindings. Before exposing admin, review the secret-submission route, which runs before the general token check and has separate request and host handling.

The skills wrapper missed a new way to write. Check npm ls just-bash and keep a consumer lock. With mktemp available and staged skills writable by the service account, the reviewed source permits empty file or directory creation inside /agent/skills.

Repair or replace the wrapper before relying on read-only skills. Target 3.6.0 for this cutoff: versions below 3.3.0 allow pre-existing hard links to modify the same file outside a mounted root, and 3.6.0 bundles the TOML fix for quadratic parsing that can stall the event loop. To get that fix, replace the just-bash artifact; a downstream parser override cannot replace its inlined code.

Configure Gondolin’s HTTP hooks before trusting egress. heypi’s ^0.12.0 range excludes 0.13.0, released on 4 October 2026 with a fix for hookless guest HTTP/TLS reaching internal addresses. Pass createHttpHooks() with blockInternalRanges: true through the caller’s VM options.

Before overriding to 0.13.0, check changed guest cache paths, CommonJS loading, terminal VM.close() and secret placeholders using a shared marker plus secret name; secretPlaceholderMode: "unique" retains unique placeholders. The adapter needs Node >=23.6 and QEMU.

Resolve the Cloudflare Worker’s SDK to 0.12.10. heypi calls sessions on the sandbox your Worker supplies; Cloudflare 1.0 removes the session interface. Moving to 1.0 requires a session API port. Check both the Worker’s lock and heypi’s. 0.12.10 fits heypi’s range and rejects bucket-root mutations through credentialProxy mounts.

If your Worker uses those mounts, review their credentials and permitted object operations; heypi does not configure them automatically.

Port before moving to Pi 1.2.0, and plan recovery separately. heypi’s ^0.79.6 range excludes Pi 1.x. Pi 1.2.0 does not export AuthStorage, which heypi imports. A forced override needs an API port.

Pi Durable resumes interrupted turns as a separate experimental package; heypi persists queued work but does not replay in-flight model execution. Recovery needs its own integration. Run one supervised process per state directory and reconcile interrupted work.

What is unresolved

• just-bash’s deployed skills boundary: a tagged wrapper repair covering the full mutation API, with tests confirming denied file and directory creation under deployed permissions, would show that deployed skills stay read-only.
• Pi and Cloudflare upgrades: a heypi tag porting the imports and session interfaces, with integration results including the caller-owned Worker, would show those versions work together.
• Gondolin: network probes would show which private-service and metadata routes the deployed VM blocks; passing the compatibility checks above would show the override is viable.
• Recovery: a tested integration with a stable replay contract would settle which interrupted turns and tools recover, and change the operator’s reconciliation work.
• Stronger governance remains open for a future release. Tagged default-deny approver code would establish narrower identity defaults; an independently protected append-only implementation would establish protection against state writers editing decision records.
• Support and adoption: a maintainer status statement would settle stated support intent. A stable release with an upgrade contract would establish a supported migration. A public team deployment with configuration and outcomes would establish an adoption example. Public inactivity alone settles none of these.