You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Adds a second coding-agent harness — Pi (@earendil-works/pi-coding-agent) — alongside the existing Claude Agent SDK, and makes the provider runtime-selectable. Pi routes through a LiteLLM-compatible OpenAI completions endpoint and can run either directly on the host or isolated inside the Docker sandbox, emitting the same normalized AgentMessage union as Claude so consumers don't need to special-case the provider.
The runner stays decoupled from any single SDK via the ProviderAdapter interface: Claude remains the default, and callers opt into Pi with createPiAdapter() / createHarnessAdapter('pi'). Pi uses a package-owned PiQueryOptions type with an explicit built-in tool allowlist and fails closed on Claude-only policy fields it can't faithfully represent (allowedTools, disallowedTools, canUseTool, permissionMode, dangerouslySkipPermissions, command-scoped selectors, unknown tools). Credentials are sourced from the environment only and are never serialized into Pi options or bridge requests.
Changes
Pi adapter (src/adapters/pi-adapter.ts) — lazy Pi SDK provider adapter with isolated lifecycle, plus pi-types.ts (package-owned options + JSON-safe event DTOs), pi-message-translator.ts (shared direct/Docker event translation), and pi-credential-store.ts (env-only LiteLLM credential resolution).
Runtime harness selection — new synchronous createPiAdapter() and createHarnessAdapter('claude' | 'pi') factories exported from the public API.
Pi Docker bridge (src/sandbox/container/pi-bridge.ts) — self-contained in-container Pi bridge, pinned to @earendil-works/pi-coding-agent@0.83.0 with a Node.js >=22.19.0 preflight. Docker now forwards the active adapter's default credential list (Pi gets LITELLM_BASE_URL / LITELLM_API_KEY / proxy keys).
Credential redaction (src/credential-redactor.ts) — recursive redaction of sensitive values from bridge/tool payloads.
Judge + runner updates — Pi judge runs inherit model/model metadata from defaultOptions (no need to repeat the model in JudgeConfig.queryOptions), reject caller tool customization, and expose only the terminating submit_judgment tool.
Docs — README updated with Pi environment variables, runtime harness selection, tooling/policy semantics, and Pi Docker requirements.
Node.js floor raised to 22.19.0 for Pi Docker execution (reflected in package.json and CI build-lint-test.yml).
CHANGELOG — Unreleased → Added entry for the Pi harness.
Extensive unit test coverage for the Pi adapter, message translator, credential store, Docker bridge, and updated runner/judge/telemetry suites.
Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe. @SocketSecurity ignore npm/PACKAGE@VERSION
Notes: This module itself contains no direct malicious logic (no eval/obfuscation/stealthy exfiltration), but it performs a high-impact supply-chain action: it delegates execution to code fetched from a hardcoded remote .tgz via npx at runtime. It also forwards arbitrary extra CLI arguments to that delegated execution without validation. This pattern warrants strict artifact pinning/integrity verification and review of the fetched migration package’s behavior before use in production.
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@anthropic-ai/sdk@0.91.1. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Block
Network access: npm @anthropic-ai/sdk in module globalThis["fetch"]
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@anthropic-ai/sdk@0.91.1. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Block
System shell access: npm @aws-sdk/credential-provider-process in module node:child_process
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@aws-sdk/credential-provider-process@3.972.65. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Notes: No overt covert malware behavior is present in the fragment (no network/exfiltration/persistence/obfuscation). However, the module is inherently high-risk because it directly executes an arbitrary shell command string and can perform powerful filesystem writes/deletes and process termination. Additionally, it inherits the parent environment by default and does not strictly confine absolute filesystem paths to the configured cwd. Security largely depends on whether consuming code treats command/path/env inputs as trusted and enforces allowlists/sandboxing.
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@earendil-works/pi-agent-core@0.83.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Notes: No overt malicious payloads, obfuscation, or exfiltration code is present in this module. The dominant security concern is that it provides an arbitrary bash command execution capability with inherited environment variables, and it streams/returns command output (and truncation metadata including a full-output temp path). If this tool can be reached by untrusted inputs or agents, it represents a high security risk primarily due to command execution and potential sensitive data disclosure.
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@earendil-works/pi-agent-core@0.83.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Block
Network access: npm @earendil-works/pi-agent-core in module globalThis["fetch"]
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@earendil-works/pi-agent-core@0.83.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Notes: This module is a high-risk extension/plugin loader: it discovers and imports executable .js/.ts modules from filesystem directories and package.json manifest entries, then immediately executes their exported factory with a privileged API. The API includes direct command execution (api.exec -> execCommand) and runtime messaging/state mutation methods, so any untrusted/tampered extension can escalate to arbitrary host actions. No explicit malware is shown in the fragment itself, but the design materially enables malicious behavior if extension sources are not strictly controlled.
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@earendil-works/pi-coding-agent@0.83.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Notes: This module is a conditional shell command executor intended for interactive TUI workflows, but it runs event.command via spawnSync(shell, ['-c', command]) after heuristic allowlisting. The allowlist is not a real sandbox (string-prefix/pipe substring matching), there is a forced-interactive bypass (i / i\t), and it passes the full host environment to the child process. If event.command (or allowlist-expanding environment variables) can be influenced by an attacker, the result is a serious arbitrary command execution and potential secret exposure risk.
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@earendil-works/pi-coding-agent@0.83.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Notes: No concrete evidence of covert malware (no obfuscation, credential theft, persistence, or hidden networking in this fragment). However, the module is a powerful RPC dispatcher that directly converts inbound JSON commands into privileged runtime actions. The presence of a direct 'bash' command path that forwards command.command into session.executeBash/emitUserBash is a critical security hazard if the RPC stdin channel is not strictly authenticated/isolated. Additionally, export_html forwards an RPC-controlled path to a downstream file-writing operation without local validation. Overall: the dominant concern is remote command-execution capability via the RPC interface, not stealthy malware.
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@earendil-works/pi-coding-agent@0.83.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Notes: No clear signs of intentional malware (no exfiltration, crypto-mining, or OS-level actions observed). However, this module presents a significant client-side security risk: it performs multiple DOM HTML injections and renders untrusted Markdown via marked.parse() directly into the DOM without an explicit sanitization layer, plus it inserts pre-rendered tool HTML fragments (renderedTools[call.id].*Html) verbatim. If any session/tool content can be attacker-influenced, this can enable DOM-based XSS. Recommend enforcing a strict HTML sanitization allowlist on all marked outputs and eliminating or sanitizing pre-rendered HTML fragments before insertion.
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@earendil-works/pi-coding-agent@0.83.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Notes: This module is effectively a user-driven remote command execution mechanism: it extracts arbitrary command strings from untrusted input (!{...}), executes them via bash -c, and replaces the placeholders with command output while optionally disclosing command/output/error previews through the UI. Unless the surrounding system strictly restricts who can supply event.text and heavily sandboxes/privilege-reduces the execution environment, this represents an extremely high security risk and could be readily abused for data theft, system probing, or other harmful actions.
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@earendil-works/pi-coding-agent@0.83.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Notes: No evidence of covert malware (no obfuscation/payload encoding, no network callbacks, no persistence/backdoor indicators) is present in this module. However, the module is an intentionally high-impact local command execution wrapper: it spawns a configurable shell and executes caller-provided command with minimal validation/allowlisting. If an attacker can influence command (or related configuration like commandPrefix/shellPath/spawnHook), this creates a strong risk of arbitrary OS command execution and sensitive data exposure via captured stdout/stderr and optional fullOutputPath disclosure. Overall security depends primarily on strict upstream authorization/sandboxing of tool invocations and environment/command constraints.
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@earendil-works/pi-coding-agent@0.83.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Notes: No explicit malware/backdoor behavior is evident, but the tool has a critical security design flaw: it builds a shell command string from user-controlled inputs and runs it via execSync(args.join(' ')). This enables command injection and could allow arbitrary command execution under the host process privileges. Separately, when truncation occurs, the full ripgrep output is written to a temp file and the path is returned, which can increase data-at-rest exposure of sensitive search results if not otherwise controlled.
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@earendil-works/pi-coding-agent@0.83.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Block
System shell access: npm @earendil-works/pi-coding-agent in module node:child_process
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@earendil-works/pi-coding-agent@0.83.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Block
System shell access: npm @earendil-works/pi-coding-agent in module child_process
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@earendil-works/pi-coding-agent@0.83.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Block
Network access: npm @earendil-works/pi-coding-agent in module globalThis["fetch"]
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@earendil-works/pi-coding-agent@0.83.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Block
System shell access: npm @earendil-works/pi-tui in module child_process
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@earendil-works/pi-tui@0.83.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Block
System shell access: npm @earendil-works/pi-tui in module node:child_process
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@earendil-works/pi-tui@0.83.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Block
Network access: npm @google/genai in module globalThis["fetch"]
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@google/genai@1.52.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Block
System shell access: npm @mariozechner/clipboard in module child_process
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@mariozechner/clipboard@0.3.9. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Block
Network access: npm @mistralai/mistralai in module globalThis["fetch"]
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@mistralai/mistralai@2.2.6. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Block
Network access: npm @smithy/credential-provider-imds in module node:http
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@smithy/credential-provider-imds@4.4.16. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Block
Network access: npm @smithy/fetch-http-handler in module globalThis["fetch"]
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@smithy/fetch-http-handler@5.6.13. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Adds a second coding-agent harness — Pi (
@earendil-works/pi-coding-agent) — alongside the existing Claude Agent SDK, and makes the provider runtime-selectable. Pi routes through a LiteLLM-compatible OpenAI completions endpoint and can run either directly on the host or isolated inside the Docker sandbox, emitting the same normalizedAgentMessageunion as Claude so consumers don't need to special-case the provider.The runner stays decoupled from any single SDK via the
ProviderAdapterinterface: Claude remains the default, and callers opt into Pi withcreatePiAdapter()/createHarnessAdapter('pi'). Pi uses a package-ownedPiQueryOptionstype with an explicit built-in tool allowlist and fails closed on Claude-only policy fields it can't faithfully represent (allowedTools,disallowedTools,canUseTool,permissionMode,dangerouslySkipPermissions, command-scoped selectors, unknown tools). Credentials are sourced from the environment only and are never serialized into Pi options or bridge requests.Changes
src/adapters/pi-adapter.ts) — lazy Pi SDK provider adapter with isolated lifecycle, pluspi-types.ts(package-owned options + JSON-safe event DTOs),pi-message-translator.ts(shared direct/Docker event translation), andpi-credential-store.ts(env-only LiteLLM credential resolution).createPiAdapter()andcreateHarnessAdapter('claude' | 'pi')factories exported from the public API.src/sandbox/container/pi-bridge.ts) — self-contained in-container Pi bridge, pinned to@earendil-works/pi-coding-agent@0.83.0with a Node.js >=22.19.0 preflight. Docker now forwards the active adapter's default credential list (Pi getsLITELLM_BASE_URL/LITELLM_API_KEY/ proxy keys).src/credential-redactor.ts) — recursive redaction of sensitive values from bridge/tool payloads.model/model metadata fromdefaultOptions(no need to repeat the model inJudgeConfig.queryOptions), reject caller tool customization, and expose only the terminatingsubmit_judgmenttool.package.jsonand CIbuild-lint-test.yml).Unreleased → Addedentry for the Pi harness.References
Checklist