Pi Coding Agent

Pi is a coding-agent CLI. Its extensions and separately versioned hosts need their own upgrade checks.

On 22 October 2026, the optional pi-mcp-adapter 6.0.0 removed its QuickJS interpreter in favor of Pi’s codemode. If you use the adapter, review removed script settings and permission hooks before upgrading: nested calls expose real MCP tool identities to permission hooks, and recognized Executor approval pauses reach a person or fail in sessions that cannot show dialogs. Pi gives other builders a layer they can stop maintaining.

Where it stands, 2026-10-24

Channel. Install stable 1.4.0, released on 21 October 2026, with npm install -g --ignore-scripts @earendil-works/pi-coding-agent@1.4.0 on Node 22.19.0 or newer. When checked on 24 October 2026 UTC, npm latest was 1.4.0, with no beta/nightly tag, and the managed installer selected the same release.

Nix’s successful 1.4.0 build closes the earlier delivery warning; pin github:earendil-works/pi/v1.4.0.

Codemode, which lets the model script tool calls, and tool search remain off by default, although MCP’s default exposure can activate codemode automatically. Pi Durable remains a separate experimental library; installing the CLI does not add Durable to its sessions.

For a CLI upgrade, prioritize MCP sign-in targets, dependency exposure, resumed extension tools and sharing settings. Durable users also need a state backup and migration plan; SDK users need API migration tests. Avoid unattended work that depends on Pi itself to contain execution or enforce approvals.

Lock the installation you deploy. Pi’s internal package versions are exact from 1.3.0. The managed installer pins the full dependency set; ordinary npm installs still need your deployment lock. Record the resolved dependency graph before accepting a fleet upgrade.

The host still owns access and tool permissions

Review unfamiliar MCP sign-in targets. Stable permits file: and custom authorization URL schemes, allowing a malicious server to hand sign-in to a platform protocol handler. The HTTP/HTTPS allowlist repair remains main-only. Wait for a release with the repair before treating an upgrade as the fix.

Check the host’s resolved HTTP dependency. Pi 1.4.0 pins Undici 8.10.2 and normally installs its fetch implementation. A hostile server can send more than five content codings and close before the body, causing an unhandled error that terminates Node; 8.12.2 fixes this. Pi Pocket 0.21.0 instead overrides Undici and locks 8.12.3. Check each Pi host’s deployed graph before judging its exposure.

Check compacted approval claims against the original instruction before a consequential action. Research published on 21 October 2026 reports 3/6 poisoned cases versus 0/5 clean controls in Pi 0.79.0, not a measured 1.4.0 exploit rate. Pi 1.4.0 still flattens raw message content beneath text role labels before summarization.

Contain the whole process before admitting unfamiliar code. Extensions retain Pi’s process authority. Enabled MCP servers connect at CLI startup, with project .pi/mcp.json gated by trust; stdio servers by default inherit Pi’s environment plus server overrides. Isolate pi and scrub unwanted credentials. Routing bash alone into a VM leaves the harness outside it.

Enforce permissions when tools run. Nested codemode tools traverse session hooks, but --tools and codemode-only declarations do not define the full callable set; active tools still resolve when called directly. Test denial through both paths.

Classifier/image calls bypass individual tool hooks, so withhold their credentials or reject the enclosing script.

Override context and transcript paths in unfamiliar checkouts. With the default ask policy, undecided headless runs decline protected resources, but context files load regardless of trust, and the initial project session-directory lookup precedes it. Use --no-context-files and --session-dir or PI_CODING_AGENT_SESSION_DIR to override the project’s transcript path.

Choose the upload destination before sharing. The released sessionShareDestination selects auto, gist or radius; auto follows Radius authentication, otherwise using a gist. Review the transcript first: HTML recipients can reveal messages marked display: false.

Durable hosts own wakeups and rollback

Back up Durable state before 1.4 opens it. SQLite automatically migrates to schema 2, which 1.3.0 and earlier cannot open. JSONL avoids that migration, but older code cannot resume sleeping tasks. Prepare rollback, replace the removed runtime.sleep() and supply each document’s required checkpointWhen before upgrading a persistent host.

Make the host wake sleeping jobs. Durable’s sleepUntil() checkpoints a phase and releases its invocation; the host must persist the wake and reopen/resume the harness. Test process death around the checkpoint/alarm handoff. For external effects, retain idempotency or a durable protocol. Check whether an interrupted write happened before retrying it.

Show parked work separately from completed work. Durable by default parks tasks after five interruptions without committed progress and counts every task running at process death. retryTask() clears the count; raising restartLimit can also make parked work runnable. Check host policy: Pi Pocket 0.21.0 disables parking with restartLimit: Infinity. Offer a recovery action wherever the guard is enabled.

CLI and SDK upgrades need separate checks

Review extensions before resuming old sessions. Resume restores recorded tool choices and activates new extension tools with direct or model-only exposure unless defaultActive: false; explicit CLI selection still wins. Retire wrappers used only to restore lost tool selections. Keep explicit exclusions when a resumed job needs a fixed tool set.

Size codemode for memory and wait time. The default is two live workers per process, configurable with PI_CODEMODE_MAX_WORKERS; saturated calls wait FIFO for at most 60 seconds, consuming their script deadline. Pending requests have no explicit count cap, and cancelled workers retain their slots until actual exit.

A returned cancellation cannot certify that side effects stopped; HTTP MCP cancellation checks before dispatch cannot undo work already sent.

Rebudget summaries for the component you run. Coding-agent compaction and branch summaries drop Pi’s fixed output cap. Durable retains its reserve-derived cap and adds exact provider/model policy overrides. Check retained history, summary length and spend per route before removing custom budget logic.

Migrate SDK consumers before updating their host. 1.3.0 removes the frame APIs; 1.4.0 replaces telemetryContext with telemetry, getPiUserAgent() with formatUserAgent(), and the boolean resolveTranscriptTools() argument with TranscriptToolSupport. Installed extensions can now import public pi-ai/models helpers. SDK sessions must load the CLI’s codemode, tool-search and MCP extensions explicitly. Compile and test your embedding application before deployment.

Retest provider-specific configuration. Kimi Coding overrides now need /v1. before_provider_headers no longer sees already-inserted attribution headers; explicit null removals still apply. Update endpoint overrides and header handlers, then pin provider/model IDs before comparing cache usage or cost.

Preserve failed-job exit codes. pi -p text truncation retains the partial answer, warns and exits 1. Raise the output limit or split the task instead of accepting partial output as success.

Upgrade the embedded runtime, too. Updating global Pi leaves Pi-web 0.12.2 on its pinned Pi 1.2.0 and Pi Pocket 0.21.0 on Pi/Durable 1.4.0. Before delegating work, check the host’s Pi version, who can sign in and how failed jobs resume.

What is unresolved

• Summary authority: require a tagged provenance-preserving or escaping repair and current-version adversarial tests to establish whether compaction can still turn untrusted content into apparent approval.
• Execution refusal: require a tagged implementation with direct and nested denial tests for codemode-only mode, plus a separate CLI classifier/image control beyond the extension factory’s models switch.
• Next-release host compatibility: main skips packages that fail to install and continues startup, adds best-effort macOS command-abort repair, and changes Durable’s custom-storage and watch APIs again. A release with these changes plus required-extension, command-list and storage-adapter tests would establish readiness. Check that required policy extensions loaded, even if the process is running.
• Cost and task outcomes: run a matched 1.4.0 trial with fixed models, tools, prices and checked outcomes before extending older efficiency results. Measure completed jobs and recovery exceptions per hour of human attention, including the migration work.