v0.2.4

Patch bump. No runtime change; internal quality and documentation.

• Removed dead exports kept alive only by their tests.
• Added a consistency test so the project-trust trigger cannot drift out of sync with the project config the trust-gated extensions consume.
• Corrected documentation this cycle's changes had made false (the MCP config model and connection lifecycle) and documented the project-approval trust prompt.

v0.2.3

One security fix.

web_fetch resolved the host to validate the address, then let the connection resolve it again independently, so a zero-TTL rebinding record could answer public to the check and private to the connection. The host is now resolved once and the socket is pinned to that validated address; SNI and the Host header stay the real hostname, so TLS and virtual hosts are unaffected. This closes the last item in SECURITY.md's known limitations.

v0.2.2

Security hardening and the last of the documented limitations.

• Agent discovery is bounded by the project root (.git or package.json), so an agent planted in a world-writable ancestor such as /tmp is no longer offered as a project agent. The consent prompt names each agent's actual source and cannot be spoofed by a crafted agent name.
• Hook output is decoded on the stream, so a multi-byte character split across a pipe boundary can no longer mangle a deny decision into a non-blocking one. Each stream is capped at 1MB.
• The hook timeout binds the whole process tree: the shell is spawned detached, the timeout kills the process group, and a timed-out PreToolUse hook fails closed. POSIX only.
• A shared output guard caps every tool at pi's documented 50KB / 2000 line budget; mcp previously capped bytes only.
• Context imports are bounded by a shared 50 file / 256KB budget, with the number skipped stated in the prompt.

v0.2.1

Corrects a security fix that shipped inert in 0.2.0, and the documentation that claimed it worked.

Security

• The trust mechanism in 0.2.0 could never run. pi resolves project trust before emitting project_trust when it finds no trust-requiring resources, and .claude/ and .mcp.json are not on that list, so the event never fired for the projects it targeted. The decision now happens where the project config is consumed, in mcp, hooks and subagent.
• SECURITY.md no longer claims that gap is closed by a project_trust handler. It describes what pi actually does and what the approval check does instead.

Fixes

• Plan mode's per-subcommand split was quote-blind, so ordinary reads were refused: grep "foo;bar", grep 'a|b' and echo "a && b" all split mid-argument and failed the allowlist. The split now ignores separators inside quotes and fails closed on an unbalanced quote.
• Tool output truncation is now one shared guard at pi's documented budget of 50KB or 2000 lines. mcp previously capped bytes only, so a result of thousands of short lines reached the model untouched.

Note for anyone on 0.2.0

0.2.0's trust prompt never appeared. A project shipping only .claude/ and .mcp.json was still trusted without being asked. If you rely on that prompt, upgrade.

v0.2.0

Minor bump: several changes alter behavior a working setup may depend on.

Behavior changes

• Plan mode no longer allows curl, wget, awk, sed, env or printenv, and validates each subcommand of a compound command independently.
• MCP stdio servers receive the SDK's default environment plus their own env block, not the full process environment. A server relying on an ambient variable must now name it.
• A trust prompt appears for projects shipping Claude-shaped config, which pi previously trusted without asking.
• web_fetch refuses more address ranges, fails closed when a host resolves to nothing, and refuses redirects that leave http(s).
• An MCP server can no longer register web_fetch, web_search or plan_mode_complete.
• A project CLAUDE.md can no longer @import from ~/.claude or ~/.pi.
• memory read truncates at pi's 50KB / 2000 line budget.

Fixes

• The question overlay repainted at a stale width after a terminal resize.
• A failed subagent run was reported to the model as a success.
• MCP servers were connected from the extension factory, so pi list, pi config and pi update spawned every configured server.
• A bare - in a paths: block list pushed an empty path and kept scanning.
• stripTags / htmlToText no longer backtrack on unclosed tags.

Quality

Statement coverage 36.9% to 97.7% (698 tests). SECURITY.md rewritten to describe actual behavior, including the limitations that remain.

v0.1.0

Initial release of pi-code — the Claude Code experience for the pi coding agent, in one package.

Point pi at a project that already has a .claude/ directory and it reads your existing config:

• Rules — ~/.claude/rules and .claude/rules (with paths: frontmatter scoping)
• Commands — .claude/commands/*.md as slash commands
• Skills — .claude/skills
• Hooks — .claude/settings.json hooks (PreToolUse can block)
• Output styles — .claude/output-styles + /output-style
• MCP servers — .mcp.json / ~/.claude.json
• Agents — project .claude/agents
• CLAUDE.md @imports — resolves the imports pi's native loader skips

Plus the Claude Code features pi lacks: a todo overlay, checkpoints/rewind, persistent memory, web search/fetch, and subagents.

Untrusted-project config (MCP servers, hooks, agents, output styles, rules, imports) is gated behind pi's project-trust decision. See SECURITY.md.

pi install pi-code      # or: npm install pi-code