Signals / Pi Coding Agent profile
Pi Coding Agent
Sourced signals for Pi Coding Agent: release changes, governance moves, runtime shifts, and operator consequences. Each links to the run that produced it. The Pi Coding Agent profile carries the current evergreen state.
October 2026
-
A third-party Pi MCP adapter drops its interpreter for Pi's native codemode
- Adapter users on current Pi 1.4.0: port script settings and hook matchers before installing adapter 6.0.0, then compare the native composition path with the interpreter or bridge you maintain. A second interpreter is now a concrete maintenance cost that can be removed.
- Test allowed and forbidden calls through proxy, deferred and scripted paths, plus an Executor pause with and without a person present. Recorded tool identities and refusal results would settle the deployed permission boundary; a visible --tools list does not settle it.
- Review project script contents as well as their configuration entries, and reverse the adapter's native-MCP takeover when removing it. Count migration and review time against accepted work before claiming a net attention saving; the author's context benchmark is configuration-specific.
Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0
-
Pi Durable checkpoints a wait and releases the invocation
- Durable host builders: back up storage before 1.4 opens it, plan the one-way cutover, split post-wait work into a new phase and supply each document's checkpointWhen predicate. This can replace an invocation kept alive solely to wait.
- Persist the wake outside the dying process. Kill a harmless job around checkpoint commit and alarm registration, then verify it resumes once intended and reconciles any uncertain external effect. Those receipts, not a resumed transcript alone, would establish the host's recovery.
- Measure idle resource use, wake latency and recovery interventions against the old host. Attention moves from supervising live waits to scheduling and storage custody; no current host inherits durable wakes merely by sharing Pi's package family.
Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0
-
Pi's CLI connects MCP servers and composes their tools in JavaScript
- CLI integrators: try a configured MCP server and one multi-tool script on 1.2.0 before maintaining an equivalent bridge. Compare accepted outcomes, setup and review time before removing it; no net time saving or current-version quality comparison was measured.
- Read global and trusted-project mcp.json before launch. Stdio servers inherit Pi's environment and run beside the harness, so contain the whole process or scrub its environment. --no-mcp disables built-in MCP; autoEnableCodemode: false only prevents its automatic codemode activation.
- Keep authorization in hooks and govern script model credentials. Tool declarations and codemode-only presentation do not prove a callable-set restriction. Denial tests covering root calls, nested calls and model spend would settle a particular deployment's boundary; watch for tagged repairs to issue 10426 before relying on only-mode enforcement.
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
September 2026
-
The harness changed the bill, not the grade
- For API-metered work, measure your own tasks in a minimal harness before assuming the vendor harness earns its overhead. The study is 30 tasks per benchmark; long-horizon and subscription use are outside it.
- Hooks or transcript parsers keyed on TodoWrite or TaskOutput lose their signal on current Claude models; delete CLAUDE.md shims that only point at AGENTS.md once past 2.1.277.
Run: 2026-09-21-weekly-digest-2026-08-20_2026-09-21-frontier-v0
August 2026
-
Any directory can replace the operator's context file, and it loads before project trust is resolved
- Treat cloning an untrusted repository as an action that can change your agent's instructions before you have decided to trust it.
- The credential commands are ungated from the tool the agent itself drives, so an agent that can run a shell can print your provider token. There are now three such commands where the last window recorded two, which is movement in the wrong direction.
Run: 2026-08-10-weekly-digest-2026-08-03_2026-08-10-frontier-v0
June 2026
-
Pi compaction events now carry reason and willRetry so a harness can tell the trigger apart
- v0.79.10 (PR #5962) adds `reason` and `willRetry` to the extension `session_before_compact` and `session_compact` events, so an extension can distinguish a manual `/compact` from a threshold auto-compaction from an overflow-retry flow. The runtime's context management becomes legible from the outside.
- Harness authors building on Pi extensions can now branch behavior on why compaction fired and whether it will retry, rather than inferring it.
Run: 2026-06-23-weekly-digest-2026-06-16_2026-06-23-frontier-v0
-
Pi gates local settings, instructions, and packages behind a saved trust decision
- v0.79.0 added project trust for local settings, resources, instructions, and packages with saved decisions and --approve/--no-approve CLI controls. Pi now treats local project files as untrusted-by-default; open an untrusted repo and confirm it refuses to load local resources until approved.
Run: 2026-06-16-weekly-digest-2026-06-04_2026-06-16-frontier-v0
-
OAuth browser-launch URI validation closes command-injection path
- An operator authenticating against a third-party or attacker-influenced OAuth server was exposed to shell command injection via the verification URI; upgrading past ba6e529 removes that exposure.
- Verification path: confirm the build includes ba6e529 (non-HTTP(S) URIs rejected, browser launched via spawn() not shell exec()).
Run: 2026-06-03-weekly-digest-2026-05-28_2026-06-03-frontier-v0
-
Git package install path-traversal rejection
- An operator installing a git-sourced package from an untrusted URL was exposed to files being written outside the package install root via traversal sequences; upgrading past a98e087 blocks this at parse and resolution time.
- Verification path: confirm a98e087 is present; a crafted git URL with '../' is rejected with 'Refusing to use path outside package install root'.
Run: 2026-06-03-weekly-digest-2026-05-28_2026-06-03-frontier-v0
May 2026
-
Package scope migration to earendil-works; harness SDK stream config
- Operators with global Pi installs should run `pi update --self` once @earendil-works/pi-coding-agent is published to migrate from the old @mariozechner scope.
- Operators with Pi pinned in CI, Dockerfiles, or package.json by the old @mariozechner/pi-coding-agent name should update their references to @earendil-works/pi-coding-agent.
Run: 2026-05-12-partial-cycle-pi-coding-agent-2026-05-07_2026-05-12-frontier-v0
-
Accessibility is a frontier capability, not marketing polish
- Everyday adoption depends on setup recovery, visible progress, voice/chat surfaces, readable UI, OAuth clarity, and fewer dead ends.
Run: 2026-05-07-commit-harvest-2026-04-23_2026-05-07-frontier-v1
-
Integrations are volatile; the operating loop has to be durable
- Provider lists, plugin systems, transports, and model profiles will keep changing.
Run: 2026-05-07-commit-harvest-2026-04-23_2026-05-07-frontier-v1
-
Authority semantics are explicit but fragmented.
- Permission profiles, workspace trust, env loading, hooks, MCP behavior, extension schemas, and provider transports differ by worker and release.
-
Plugin, extension, and skill ecosystems are becoming the integration surface.
- The practical power of worker CLIs increasingly depends on plugins, hooks, extensions, skills, and transport modules, not just the base model.
-
Worker integrations are not durable doctrine.
- Pi removed built-in Gemini CLI and Antigravity support while adding many providers; Gemini preview/nightly channels differ materially; Codex alpha releases and app-server surfaces move quickly.