Mirror of badlogic/pi-mono - pi coding agent monorepo
Find a file
Christian Klotz 7a52c2108d
feat: release version tags on pkg.earendil.com (#11686)
## Problem

`scripts/release.mjs` pushes `Release vX.Y.Z` and `Add [Unreleased]
section…` to main in one push, then pushes the tag. CI builds only the
pushed head, so the tagged release commit is never built and
pkg.earendil.com has no build of a release. Example: for v1.4.0, v1.3.0
and v1.2.0 the tagged commits have Build Binaries and Nix runs, but no
CI run.

Internal users want to install a release from pkg.earendil.com as soon
as it is tagged, without waiting for the npm release.

## Change

- `ci.yml` also runs for `v*.*.*` tags (the pattern `nix.yml` uses), so
the tagged commit is built and packed.
- `preview-packages.yml` also publishes passing CI runs of release tags:
`POST /_/releases` keeps the packages for good under the tag (it never
moves), then the `latest` ref moves to it. Pre-releases (`v1.2.3-rc.1`)
are released without moving `latest`.
- `scripts/preview-packages.mjs publish` decides what a push run
publishes (the workflow passes the run's branch and conclusion), reading
the GitHub API with `fetch` before anything is uploaded. A tag push's
`head_branch` is the tag's name, and a branch or tag can carry its own
copy of CI, so:
- every push run must be for a commit on main, comparing against main's
resolved SHA (a bare `main` in compare would resolve to a tag named
`main`);
- a release tag must match `^v\d+\.\d+\.\d+(-[0-9A-Za-z.]+)?$`, have
passing CI (CI packs before its tests run), and point at the commit,
dereferencing annotated tags, also nested;
  - other names publish nothing.

This also closes an existing hole: a tag named `main` on an unreviewed
commit could move the `main` ref.
- A release happens after the uploads and before moving refs, so
`latest` never points at a failed release. The job summary lists the
release's install commands.
- A passing push run whose CI artifact expired (3 days) fails with
"re-run CI" instead of passing silently, so a release tag cannot go
unreleased unnoticed.

## Before / after for a release

| | Before | After |
|---|---|---|
| CI of the tagged commit | none | build, test, pack |
| `pkg.earendil.com/<package>@vX.Y.Z` | 404 | kept for good |
| `…@<release sha>` | 404 | kept for good |
| `…@latest` | none | moves to each release |
| npm, binaries, pi.dev, Nix `stable` | unchanged | unchanged |
| main and PR previews | unchanged | unchanged |

Tag CI runs trigger Publish Model Catalog and Nix, which skip them
(`head_branch != main`).

## Before merging

- [x] Deploy pkg.earendil.com with `POST /_/releases` (earendil-pkg
`7955990`); until then a tag run fails at the release call and `latest`
does not move.

## Recommended (not required by this PR)

Add a ruleset restricting creation, update and deletion of `v*` tags to
maintainers / the release process. The checks above already keep
unreviewed code out (every push run must be for a commit on main), but
anyone with write access can push a `v*` tag on any main commit. On
pkg.earendil.com that release is kept for good, takes the version number
(the real release then gets `409` there) and moves `latest`, with no
approval gate like npm's `npm-publish` environment. Build Binaries (npm)
and Nix (`stable`) also act on `v*` tags today.

## Checks

`npm run check`; `node --test scripts/preview-packages.test.mjs` (10
tests, under 2s, against a fake server for pkg.earendil.com and the
GitHub API with raw API responses). Each of these mutations fails a
test: bare `main` in compare, wrong API field names, no on-main check,
no tag target check, one-level tag dereference, `latest` for
pre-releases, unanchored or loose tag pattern, no CI conclusion check,
dropping `identical`. actionlint reports only the existing `queue:`
complaint.
2026-11-05 10:01:01 +00:00
.github feat: release version tags on pkg.earendil.com (#11686) 2026-11-05 10:01:01 +00:00
.husky build: retire Pi Mobile's APK workflow and hook; check apps/p2 instead 2026-10-12 13:57:43 +00:00
.pi feat(ai): refactor provider definitions (#11368) 2026-10-28 11:06:10 +01:00
apps/p2 feat(ui): script to build bundled (#11801) 2026-11-05 09:42:35 +01:00
nix chore: update Nix model catalog pin 2026-11-04 10:53:01 +00:00
packages fix(coding-agent): cycle to the only model in scope when the active model is outside it (#11832) 2026-11-05 10:39:18 +01:00
scripts feat: release version tags on pkg.earendil.com (#11686) 2026-11-05 10:01:01 +00:00
.gitattributes docs(agent): restore non-Pico5 documentation 2026-09-18 13:48:19 +02:00
.gitignore ignore .pi/settings.json 2026-10-19 08:32:15 +00:00
.npmrc chore: harden dependency workflows 2026-05-20 15:57:41 +02:00
AGENTS.md feat: add apps/p2 (imported from pi-private at 7dadff697) 2026-11-03 13:39:06 +00:00
biome.json feat(ai): refactor provider definitions (#11368) 2026-10-28 11:06:10 +01:00
CONTRIBUTING.md fix: target intended users in lgtm approvals (#7023) 2026-07-23 22:49:16 +02:00
flake.lock feat(coding-agent): add Nix flake (#9137) 2026-10-02 18:30:51 +02:00
flake.nix feat(coding-agent): add Nix flake (#9137) 2026-10-02 18:30:51 +02:00
LICENSE Initial monorepo setup with npm workspaces and dual TypeScript configuration 2025-08-09 17:18:38 +02:00
package-lock.json feat(coding-agent): upgrade Mermaid terminal rendering (#8158) 2026-11-04 11:06:51 +01:00
package.json feat(chord): invalid and forbidden exported, page state across plugin reloads, the tutorial app's API a workspace package 2026-11-03 19:02:56 +00:00
pi-test.bat chore: add pi-test batch wrapper 2026-05-18 00:55:01 +02:00
pi-test.ps1 feat: build with TypeScript 7 and run sources with plain node 2026-09-25 13:14:33 +02:00
pi-test.sh fix: unset all supported provider env vars in pi-test.sh --no-env (#11395) 2026-10-25 08:43:53 +01:00
README.md feat(chord): Chord v2 is the package's root 2026-11-02 22:36:55 +00:00
SECURITY.md docs: fix security policy typos 2026-08-11 11:35:10 +02:00
test.sh fix: keep NODE_EXTRA_CA_CERTS in test.sh 2026-10-13 11:23:56 +02:00
tsconfig.base.json feat: build with TypeScript 7 and run sources with plain node 2026-09-25 13:14:33 +02:00
tsconfig.json feat(chord): split the worker base at dynamic imports; workers/child entry 2026-11-05 08:49:17 +01:00
vitest.base.ts feat(chord): remove Chord v1 (/old, /old/node), its tests and docs 2026-11-03 12:11:22 +00:00

pi logo

Discord npm

New issues and PRs from new contributors are auto-closed by default. Maintainers review auto-closed issues daily. See CONTRIBUTING.md.

Pi

Pi is a minimal, extensible agent harness that you can make your own.

Adapt Pi to your workflows, not the other way around. Customize Pi with extensions, skills, prompt templates, and themes. Bundle them as Pi packages and share via npm or git.

Pi ships with powerful defaults but skips features like sub-agents and plan mode. Ask Pi to build what you want, or install a package that does it your way.

Use Pi interactively, automate it in print or JSON mode, control it over RPC, or build apps with the Pi TypeScript SDK. See OpenClaw for a real-world integration.

Getting started

Install the command-line interface:

curl -fsSL https://pi.dev/install.sh | sh

On Windows:

powershell -c "irm https://pi.dev/install.ps1 | iex"

The installer pins all dependencies and updates Pi with pi update. Alternatively, install directly with npm, which does not pin transitive dependencies:

npm install -g --ignore-scripts @earendil-works/pi-coding-agent

Pi requires Node.js 22.19 or newer. The macOS, Linux, and Windows installers can install it if needed. Pi does not require dependency lifecycle scripts for a normal npm installation.

Start Pi in the directory where you want it to work:

cd /path/to/project
pi

For a built-in AI provider, run /login inside Pi to connect a subscription or API key. Then give Pi a task.

See the documentation for full setup and usage instructions, or visit pi.dev for demos.

Run with Nix

nix run github:earendil-works/pi/stable

stable points at the latest release. Install it with nix profile add github:earendil-works/pi/stable and update with nix profile upgrade pi. Use a release tag such as github:earendil-works/pi/v1.0.0 to pin a version, or github:earendil-works/pi for unreleased changes on main. Nix builds Pi from source.

Supports ARM64 and x86-64 on Linux and macOS. Use nix build . or nix run . to build or run your checkout.

Nix builds are offline, so the bundled model data comes from a pi.dev model catalog revision pinned in nix/model-catalog.json. At runtime, Pi still overlays newer catalog data from pi.dev as usual. The Nix workflow replaces the pin on main when it no longer matches the checkout, for example after a provider is added or gains a new model type. To refresh it by hand:

npm run update:model-catalog-pin

Packages

This monorepo contains the Pi CLI and its supporting libraries.

Package Description
@earendil-works/chord Object runtime for apps across processes: contracts, documents, a store, links, plugins with hot reload, HTTP, workers, web and terminal clients
@earendil-works/pi-telemetry Vendor-neutral telemetry contracts, reference adapter, conformance tests, and typed schemas
@earendil-works/pi-ai Unified multi-provider LLM API (OpenAI, Anthropic, Google, etc.)
@earendil-works/pi-durable Durable conversation, task, and document runtime
@earendil-works/pi-agent-core Agent runtime with tool calling and state management
@earendil-works/pi-coding-agent Interactive coding agent CLI
@earendil-works/pi-tui Terminal UI library with differential rendering

For Slack/chat automation and workflows see earendil-works/pi-chat.

Permissions & Containerization

Pi does not include a built-in permission system for restricting filesystem, process, network, or credential access. By default, it runs with the permissions of the user and process that launched it.

If you need stronger boundaries, containerize or sandbox Pi. See packages/coding-agent/docs/containerization.md for three patterns:

  • Gondolin extension: keep pi and provider auth on the host while routing built-in tools and ! commands into a local Linux micro-VM.
  • Plain Docker: run the whole pi process in a local container for simple isolation.
  • OpenShell: run the whole pi process in a policy-controlled sandbox.

Contributing

See CONTRIBUTING.md for contribution guidelines and AGENTS.md for project-specific rules (for both humans and agents). Longer term plans for Pi can also be found in RFCs.

Development

npm install --ignore-scripts  # Install all dependencies without running lifecycle scripts
npm run build         # Refresh model data, then build all packages
npm run build:offline # Rebuild using existing model data without network access
npm run check         # Lint, format, and type check
./test.sh            # Run tests (skips LLM-dependent tests without API keys)
./pi-test.sh         # Run pi from sources (can be run from any directory)

Using local packages outside the monorepo

Build every public package into one coherent local artifact set:

npm run pack:packages -- --out .artifacts/pi-packages

This refreshes model data before building pi-ai. To avoid network access when model data is already hydrated, pass --offline-model-data.

Then configure an external project to consume one package and resolve all of its Pi dependencies from the same artifact set. npm is the default:

node scripts/use-local-packages.mjs \
  --manifest .artifacts/pi-packages/manifest.json \
  --consumer ../my-project \
  --package @earendil-works/pi-durable \
  --package @earendil-works/pi-agent-core
cd ../my-project
npm install --ignore-scripts

For a pnpm project, point --consumer at the workspace root:

node scripts/use-local-packages.mjs \
  --manifest .artifacts/pi-packages/manifest.json \
  --consumer ../my-project \
  --package @earendil-works/pi-agent-core \
  --package-manager pnpm
cd ../my-project
pnpm install --ignore-scripts

Repeat --package for each direct dependency. The command updates the consumer's package.json with content-addressed local file: references. It writes transitive overrides to package.json for npm or pnpm-workspace.yaml for pnpm. Keep the artifact directory available while installing or updating the consumer. Re-run both commands after changing Pi source.

Building standalone binaries from release source

GitHub releases include a versioned source archive covered by the release's SHA256SUMS file. Extract it and run the same build script used for the official standalone binaries:

VERSION="<release-version>"
tar -xzf "pi-${VERSION}-source.tar.gz"
cd "pi-${VERSION}"
./scripts/build-binaries.sh --offline-model-data --platform linux-x64 --out "$PWD/out"

The archive includes release model data and native prebuilds. --offline-model-data uses that model data without refreshing provider catalogs. The script installs dependencies and builds the executable with its runtime assets; pass --skip-install if dependencies are already provided.

Supply-chain hardening

We treat npm dependency changes as reviewed code changes.

  • Direct external dependencies are pinned to exact versions. Internal workspace packages remain version-ranged.
  • .npmrc sets save-exact=true and min-release-age=2 to avoid same-day dependency releases during npm resolution.
  • package-lock.json is the dependency ground truth. Pre-commit blocks accidental lockfile commits unless PI_ALLOW_LOCKFILE_CHANGE=1 is set.
  • npm run check verifies pinned direct deps, native TypeScript import compatibility, and the generated coding-agent install lock.
  • The pi.dev installer installs from packages/coding-agent/install-lock/, generated from the root lockfile, to pin transitive deps. The npm package does not pin transitive deps.
  • Local release smoke tests and npm publication use the same tarball packer; npm publishes the validated tarballs rather than repacking workspace directories.
  • Local release installs, documented npm installs, and pi update --self use --ignore-scripts where supported.
  • CI installs with npm ci --ignore-scripts, and a scheduled GitHub workflow runs npm audit --omit=dev plus npm audit signatures --omit=dev.
  • Install lock generation has an explicit allowlist for dependency lifecycle scripts; new lifecycle-script deps fail checks until reviewed.

Share your OSS coding agent sessions

If you use Pi or other coding agents for open source work, please share your sessions.

Public OSS session data helps improve coding agents with real-world tasks, tool use, failures, and fixes instead of toy benchmarks.

For the full explanation, see this post on X.

To publish sessions, use badlogic/pi-share-hf. Read its README.md for setup instructions. All you need is a Hugging Face account, the Hugging Face CLI, and pi-share-hf.

You can also watch this video, where I show how I publish my pi-mono sessions.

I regularly publish my own pi-mono work sessions here:

License

MIT

pi.dev domain graciously donated by

Exy mascot
exe.dev