pi-setup-share v0.2.0

This release makes profiles easier to share as standard ZIP files and makes portable MCP choices complete and visible without copying machine-specific or secret-bearing configuration.

Added

• New exports are ZIP archives containing exactly one profile.json.
• Legacy plain JSON profiles remain importable.
• The export assistant shows portable MCP servers, explains safe reasons for omissions, and can select all portable servers at once.

Security

Archive parsing is bounded and in memory. It rejects extra entries or bytes, renamed entries, directories, links, encryption, comments, ZIP64, invalid CRC, inconsistent local/central metadata, oversized archives, and oversized decompressed profiles. Validation does not authenticate the sender or make profile contents trustworthy.

Upgrade

Update both the sender and receiver before sharing a new ZIP:

pi install npm:pi-setup-share@0.2.0

Restart Pi after updating. Existing 0.1.x JSON profiles continue to import, but a 0.1.x receiver cannot open the new ZIP container.

Verification

• 186 tests on Windows, macOS, and Linux with Node.js 22.19.0 and 24
• TypeScript checking and CodeQL
• Isolated npm audit with no known vulnerabilities
• Native extension registration through Pi 0.85.0 without personal settings or model calls
• Independent archive/security and release-candidate reviews

Artifact

pi-setup-share-0.2.0.tgz

• 28 files
• 175,936 bytes unpacked
• 46,618 bytes compressed
• SHA-256: 88af2711c24a113c5a18bec63af5d8ab9f835b5b1276f9f766035042fc66a97b

Full changes: v0.1.1...v0.2.0

pi-setup-share v0.1.1

Changed

pi-setup-share is now available as a public npm package and can be installed directly into Pi:

pi install npm:pi-setup-share@0.1.1

This patch adds npm publication and Pi package discovery metadata. It does not change the extension's behavior or profile format from 0.1.0.

Compatibility and limits

• Requires Pi 0.85.0 and Node.js 22.19.0 or newer.
• The global-only profile format remains experimental, with no future migration guarantee.
• Validation and inspection do not execute imported resources. Separately approved package installation can execute third-party scripts; isolated storage is not a sandbox and external effects are outside rollback.
• Tests use synthetic data and native-host renders. They do not replace a full physical-terminal walkthrough or a real installation of third-party profile packages.

GitHub release asset SHA-256: fe4cad698879ba0e14a6e2d7acbe09bb2c7f330a8518f4121cebcb9b70c917b4

pi-setup-share v0.1.0

A native /setup-share assistant for sharing selected Pi settings and resources without copying an entire user directory.

Included

• Selective export and inspection of preferences, keybindings, resources, pinned packages, and documented MCP/subagent settings.
• Separate staging, installation, and activation confirmations, with Later and preservation as defaults.
• Resumable imports, managed backups, restore, and interrupted-change recovery.

Use

Requires Pi 0.85.0 and Node.js 22.19.0 or newer. Download pi-setup-share-0.1.0.tgz, extract it, and run this from its package directory:

pi --no-session --no-context-files --no-extensions -e ./src/index.ts

Enter /setup-share. For the first run, use synthetic data and a disposable Pi directory as described in the README. No npm release is published.

Compatibility and trust

The profile format remains a development draft, without a cross-version migration contract. Inspection does not execute resources. Installation can execute third-party code with your permissions: isolated storage is not a sandbox, and package files/script effects are not restored.

Automated checks pass on Windows, macOS, and Linux with Node 22.19.0 and 24. Native component checks cover 80×24 and 120×40; they are not a full physical-terminal walkthrough or a real network installation.

SHA-256

1b6a29b0117a59fd421aed004b92fd19585dac1c2dd32f992413f1321ed8647d pi-setup-share-0.1.0.tgz