Migration review of the host pi setup (spec FR-015)
Reviewed on 2026-10-02 against the host pi installation (pi 0.86.1, ~/.pi/agent), for use in
the sandbox with pi 1.0.0. Only settings.json, the names of the skill folders and pi list
were read. auth.json, models-store.json, mcp-cache.json and sessions were not read and
are not copied — the sandbox has its own login and state (credentials).
The host installation stays untouched (spec Assumptions).
Model defaults#
| Host setting | Value | Decision |
|---|---|---|
defaultProvider | anthropic | Kept |
defaultModel | claude-sonnet-4-6 | Kept |
defaultThinkingLevel | high | Kept |
theme | dark | Kept |
lastChangelogVersion | 0.86.1 | Dropped — pi-written runtime bookkeeping, not configuration |
Packages#
All kept packages are pinned to the latest release on 2026-10-02 (owner’s choice), not the
host versions, and were verified to install and load on pi 1.0.0 in the sandbox
(pi-sandbox start … -- --help lists their flags, no load errors).
| Package | Host version | Pinned | Purpose | Decision | Sandbox notes |
|---|---|---|---|---|---|
pi-subagents | 0.70.1 | 0.74.0 | Delegation and multi-agent workflows | Keep | — |
pi-web-access | 0.30.0 | 0.35.0 | Web search, URL fetch, repo clone, PDF/video extraction | Keep | Uses arbitrary outbound hosts (accepted risk, FR-011) |
@juicesharp/rpiv-ask-user-question | 2.10.1 | 2.12.0 | Structured questions to the owner instead of guessing | Keep | — |
@juicesharp/rpiv-todo | 2.10.1 | 2.12.0 | Live todo overlay | Keep | — |
pi-lens | 4.2.1 | 4.3.0 | LSP, linters, formatters, scanners feedback | Keep | Downloads LSPs/scanners into the state volume (slower first start); peer range names older pi-tui but loads on 1.0.0 |
context-mode | 1.0.169 | 1.0.169 | Context-saving MCP plugin | Keep | Native better-sqlite3; its prebuilt binary installs fine |
@plannotator/pi-extension | 0.27.17 | 0.27.25 | Interactive plan review and annotations | Keep | Needs node-pty, which has no linux-arm64 prebuilt → the image ships python3 make g++ to compile it (accepted risk in security). Its browser UI needs a reachable local port; the sandbox publishes none, so the UI is likely unusable |
@vigolium/piolium | 0.0.15 | 0.0.15 | Multi-phase security audits with sub-agents | Keep | Peer deps name pi ^0.74; installs and loads on 1.0.0 — watch for breakage |
pi-mcp-adapter | 2.35.0 | — | MCP adapter | Removed (2026-10-04) | pi ≥ 1.0 ships built-in MCP support (builtin:mcp); the adapter registered /mcp as well, replaced the built-in and caused a startup warning. No MCP servers were configured, so nothing is lost. Future servers go into mcp.json with credentials by env-var name only (FR-014) |
MCP: built-in support instead of pi-mcp-adapter (decision 2026-10-04)#
Assessed against the package page (pi.dev/packages/pi-mcp-adapter, version 5.0.0):
| Adapter advantage | Relevance in this sandbox |
|---|---|
| Lazy server start, idle stop after 10 min | None while no or few servers are configured |
One proxy tool; author states 10–33 % cheaper single lookups than the built-in codemode | Only pays off with many servers; bulk work costs about the same |
| Semantic tool search | Needs a key for an external service (extra credential, data leaves the sandbox) |
| OAuth tokens in the OS keychain | No OS keychain in the container; the built-in keeps tokens in the agent state volume (constitution V) |
| Imports MCP configs of Cursor, Claude Code, VS Code | The sandbox cannot see host configs by design (constitution I) |
| MCP UI apps, interactive forms | Need a browser or published ports, which the sandbox does not offer |
| MCP prompts, elicitation, sampling, Tasks | A real functional gain — only if a server relies on them |
The built-in keeps what matters most here: permission extensions see every MCP call directly
(the adapter routes all calls through one mcp tool), servers receive the session roots, and
there are no extra dependencies (the adapter adds 15).
The adapter’s own installer disables builtin:mcp in pi’s settings, but the sandbox renders
settings.json from the read-only pi-config on every start, so that change never sticks — the
cause of the startup warning.
Reconsider when many MCP servers are configured, or a needed server depends on prompts,
elicitation or sampling. Then re-add the pinned package and add
"extensions": ["-builtin:mcp"] to agent/settings.json in the same change, so only one MCP
implementation loads.
Skills#
| Skill | Decision | Notes |
|---|---|---|
terraform-skill | Keep → agent/skills/terraform-skill | Public skill by Anton Babenko, v1.17.1, Apache-2.0. Scanned before copying: no leaks (gitleaks), no e-mail addresses; only documentation examples (RFC 1918 ranges, a placeholder password in a security example). Fully useful only with a terraform/tofu binary, which the image does not have yet |
find-skills | Drop | Discovers and installs skills at runtime; installs would bypass the versioned, read-only config (constitution Principle III). Add skills to agent/skills/ deliberately instead |