@ilya-lesikov/pi-pi

What this package can reach

Detected automatically from the source at version 0.14.0. This describes access, not safety — you decide whether it's appropriate for what the package claims to do.

• 🤖
  Behavior — Changes how the agent thinks Modifies the system prompt, injects messages, or rewrites conversation context.
• 📡
  Extension bus — Talks to other extensions Uses pi.events to emit or listen on a shared channel, so it can coordinate with — or be driven by — other installed extensions.
• ⚡
  Commands — Runs shell commands Spawns processes on your machine.
• 🔑
  Credentials — Handles your API keys Reads or passes provider credentials. Highest-trust capability there is.
• 📁
  Files — Reads files outside your project Touches paths beyond the working directory, such as your home folder.
• ⇄
  Intercepts tools — Can block or rewrite tool calls Subscribes to tool_call/tool_result/input. Can change a command after you approved the one displayed.
• ⌨
  Keystrokes — Reads raw terminal input Hooks ui.onTerminalInput, so it sees what you type. Legitimate for shortcut handling; the same access a keylogger needs.
• 🌐
  Network — Talks to the internet Makes outbound network requests. Check the destinations are ones you expect.
• 📡
  LLM traffic — Sees raw model API traffic Reads or replaces provider requests, headers or responses — including your prompts.
• 🔀
  Tool control — Can switch pi's tools on and off Calls setActiveTools, so it can disable built-ins — including safety-relevant ones.
• 🔧
  New tools — Adds model-callable tools Gives the agent new abilities. Additive and visible, unlike an override.
• ▤
  UI — Draws its own interface Renders widgets, footers, dialogs or full-screen views.