dotfiles-pi-showcase

Lightweight Pi coding-agent extensions for safer, more capable terminal AI workflows. This repository is a sanitized public showcase extracted from private dotfiles work, rebuilt with clean history and public-safe examples.

What it demonstrates

• Loading stdio MCP servers from declarative config and exposing their tools to Pi.
• Adding an exact-URL web_fetch tool without broad web-search behavior.
• Enforcing policy-based guardrails around file tools and bash commands.
• Compacting terminal UI output while preserving full model-facing tool results.
• Managing Pi configuration with backup, verification, and ignored runtime state.

Extension catalog

Extension	Purpose
mcp-loader	Registers MCP server tools as Pi tools using environment-variable placeholders.
web-fetch	Fetches readable text from explicit HTTP/HTTPS URLs with timeout and byte limits.
security-guard	Blocks sensitive paths, broad searches, dangerous shell constructs, and policy-denied commands.
read-renderer	Re-renders built-in read calls as compact status lines, including skill file reads.
thinking-renderer	Customizes the hidden reasoning label using Pi keybinding hints.
custom-footer	Shows a theme-aware footer with model, branch, context usage, cost, and security state.

Quick start

npm install
npm run check

To try one extension in Pi without installing the package globally:

pi --no-extensions -e ./extensions/web-fetch/index.ts --list-models __no_such_model__

For a real interactive test, load an extension and then restart Pi or run /reload when using an auto-discovered location.

Example configuration

MCP server definitions should use environment placeholders instead of literal secrets. See config/mcp.example.json.

Security policy examples live in config/security-policy.example.json. The default example limits managed access to the current working directory and blocks credentials, sessions, shell indirection, and destructive commands.

Safety boundaries

This project demonstrates guardrails, not a sandbox. Extensions run with the same permissions as the Pi process. Review code before installing any Pi package, keep credentials in local ignored files, and use OS/container isolation for hard security boundaries.

Intentionally excluded:

• credentials and auth files;
• local sessions and prompt history;
• private MCP endpoints;
• generated dependency folders;
• compiled CLI output;
• personal model defaults and machine-local paths.

Repository structure

config/       Public-safe example configs
extensions/   Pi extension modules
docs/         Architecture and workflow notes
cli/          Optional managed setup CLI source
scripts/      Validation helpers
tests/        Node test-runner coverage for pure helpers

Status

Implementation is in progress. The repository is designed as a portfolio artifact first and an installable Pi package second.

License

MIT. See LICENSE.