[matallui]

Summary

Adds an optional pi Agent SDK adapter for isolated LiteLLM coding and evaluation runs, using #25 as a reference.

• Keeps Claude as the default and preserves existing Claude callers and custom adapters' Claude judge fallback.
• Adds provider-specific option types and createPiAdapter().
• Shares pi session setup, event normalization, and lifecycle handling between direct and Docker execution.
• Supports turn limits, cancellation, credential scrubbing, and cost reporting that distinguishes unknown pricing from zero.
• Supports pi judging inside the runner's configured sandbox, with only the terminating structured judgment tool enabled.
• Pins pi to 0.83.0 as an optional peer dependency. Claude-only installations retain Node 20 support; pi execution requires Node >=22.19.0.

Pi runs are LiteLLM-only, use fresh in-memory sessions, and do not discover local settings, extensions, skills, or context files. Unsupported Claude permission options fail explicitly. Persistence, resume, custom tools, and native pi providers/OAuth are out of scope.

Validation

• yarn build, yarn typecheck, yarn lint, and yarn test pass.
• 602 tests pass on supported pi runtimes; coverage thresholds pass unchanged.
• Node 20 compatibility suite passes, with SDK integration tests skipped and full coverage measured on supported pi runtimes.
• Real Docker execution and judging pass against a local mock LiteLLM endpoint, without external model credentials.
• Package checks pass for CJS and ESM. Verified imports and runner construction from a clean installation without pi, including Node 20.

Coverage auto-update is disabled so tests no longer modify the working tree.

Review notes

Dependency security review is still required. This PR does not waive Socket alerts or enable dependency install scripts.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​earendil-works/​pi-coding-agent@​0.83.0

View full report

[socket-security]

Caution

MetaMask internal reviewing guidelines:

• Do not ignore-all
• Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
• Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
  @SocketSecurity ignore npm/PACKAGE@VERSION

Action	Severity	Alert  (click "▶" to expand/collapse)
Block		Potential security risk (AI signal): npm @anthropic-ai/sdk is 70.0% likely risky Notes: This module itself contains no direct malicious logic (no eval/obfuscation/stealthy exfiltration), but it performs a high-impact supply-chain action: it delegates execution to code fetched from a hardcoded remote .tgz via npx at runtime. It also forwards arbitrary extra CLI arguments to that delegated execution without validation. This pattern warrants strict artifact pinning/integrity verification and review of the fetched migration package’s behavior before use in production. Confidence: 0.70 Severity: 0.70 From: package.json → npm/@anthropic-ai/claude-agent-sdk@0.3.220 → npm/@earendil-works/pi-coding-agent@0.83.0 → npm/@anthropic-ai/sdk@0.91.1 ℹ Read more on: This package | This alert | What are AI-detected potential security risks? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@anthropic-ai/sdk@0.91.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		System shell access: npm @aws-sdk/credential-provider-process in module node:child_process Module: node:child_process Location: Package overview From: package.json → npm/@earendil-works/pi-coding-agent@0.83.0 → npm/@aws-sdk/credential-provider-process@3.972.70 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@aws-sdk/credential-provider-process@3.972.70. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Potential security risk (AI signal): npm @earendil-works/pi-agent-core is 74.0% likely risky Notes: No overt covert malware behavior is present in the fragment (no network/exfiltration/persistence/obfuscation). However, the module is inherently high-risk because it directly executes an arbitrary shell command string and can perform powerful filesystem writes/deletes and process termination. Additionally, it inherits the parent environment by default and does not strictly confine absolute filesystem paths to the configured cwd. Security largely depends on whether consuming code treats command/path/env inputs as trusted and enforces allowlists/sandboxing. Confidence: 0.74 Severity: 0.70 From: package.json → npm/@earendil-works/pi-coding-agent@0.83.0 → npm/@earendil-works/pi-agent-core@0.83.0 ℹ Read more on: This package | This alert | What are AI-detected potential security risks? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@earendil-works/pi-agent-core@0.83.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Potential security risk (AI signal): npm @earendil-works/pi-agent-core is 78.0% likely risky Notes: No overt malicious payloads, obfuscation, or exfiltration code is present in this module. The dominant security concern is that it provides an arbitrary bash command execution capability with inherited environment variables, and it streams/returns command output (and truncation metadata including a full-output temp path). If this tool can be reached by untrusted inputs or agents, it represents a high security risk primarily due to command execution and potential sensitive data disclosure. Confidence: 0.78 Severity: 0.87 From: package.json → npm/@earendil-works/pi-coding-agent@0.83.0 → npm/@earendil-works/pi-agent-core@0.83.0 ℹ Read more on: This package | This alert | What are AI-detected potential security risks? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@earendil-works/pi-agent-core@0.83.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Potential security risk (AI signal): npm @earendil-works/pi-coding-agent is 70.0% likely risky Notes: This module is a high-risk extension/plugin loader: it discovers and imports executable .js/.ts modules from filesystem directories and package.json manifest entries, then immediately executes their exported factory with a privileged API. The API includes direct command execution (api.exec -> execCommand) and runtime messaging/state mutation methods, so any untrusted/tampered extension can escalate to arbitrary host actions. No explicit malware is shown in the fragment itself, but the design materially enables malicious behavior if extension sources are not strictly controlled. Confidence: 0.70 Severity: 0.78 From: package.json → npm/@earendil-works/pi-coding-agent@0.83.0 ℹ Read more on: This package | This alert | What are AI-detected potential security risks? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@earendil-works/pi-coding-agent@0.83.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Potential security risk (AI signal): npm @earendil-works/pi-coding-agent is 72.0% likely risky Notes: No concrete evidence of covert malware (no obfuscation, credential theft, persistence, or hidden networking in this fragment). However, the module is a powerful RPC dispatcher that directly converts inbound JSON commands into privileged runtime actions. The presence of a direct 'bash' command path that forwards command.command into session.executeBash/emitUserBash is a critical security hazard if the RPC stdin channel is not strictly authenticated/isolated. Additionally, export_html forwards an RPC-controlled path to a downstream file-writing operation without local validation. Overall: the dominant concern is remote command-execution capability via the RPC interface, not stealthy malware. Confidence: 0.72 Severity: 0.85 From: package.json → npm/@earendil-works/pi-coding-agent@0.83.0 ℹ Read more on: This package | This alert | What are AI-detected potential security risks? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@earendil-works/pi-coding-agent@0.83.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Potential security risk (AI signal): npm @earendil-works/pi-coding-agent is 74.0% likely risky Notes: No clear signs of intentional malware (no exfiltration, crypto-mining, or OS-level actions observed). However, this module presents a significant client-side security risk: it performs multiple DOM HTML injections and renders untrusted Markdown via marked.parse() directly into the DOM without an explicit sanitization layer, plus it inserts pre-rendered tool HTML fragments (renderedTools[call.id].*Html) verbatim. If any session/tool content can be attacker-influenced, this can enable DOM-based XSS. Recommend enforcing a strict HTML sanitization allowlist on all marked outputs and eliminating or sanitizing pre-rendered HTML fragments before insertion. Confidence: 0.74 Severity: 0.81 From: package.json → npm/@earendil-works/pi-coding-agent@0.83.0 ℹ Read more on: This package | This alert | What are AI-detected potential security risks? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@earendil-works/pi-coding-agent@0.83.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Potential security risk (AI signal): npm @earendil-works/pi-coding-agent is 75.0% likely risky Notes: No evidence of covert malware (no obfuscation/payload encoding, no network callbacks, no persistence/backdoor indicators) is present in this module. However, the module is an intentionally high-impact local command execution wrapper: it spawns a configurable shell and executes caller-provided command with minimal validation/allowlisting. If an attacker can influence command (or related configuration like commandPrefix/shellPath/spawnHook), this creates a strong risk of arbitrary OS command execution and sensitive data exposure via captured stdout/stderr and optional fullOutputPath disclosure. Overall security depends primarily on strict upstream authorization/sandboxing of tool invocations and environment/command constraints. Confidence: 0.75 Severity: 0.70 From: package.json → npm/@earendil-works/pi-coding-agent@0.83.0 ℹ Read more on: This package | This alert | What are AI-detected potential security risks? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@earendil-works/pi-coding-agent@0.83.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Potential security risk (AI signal): npm @earendil-works/pi-coding-agent is 78.0% likely risky Notes: No explicit malware/backdoor behavior is evident, but the tool has a critical security design flaw: it builds a shell command string from user-controlled inputs and runs it via execSync(args.join(' ')). This enables command injection and could allow arbitrary command execution under the host process privileges. Separately, when truncation occurs, the full ripgrep output is written to a temp file and the path is returned, which can increase data-at-rest exposure of sensitive search results if not otherwise controlled. Confidence: 0.78 Severity: 0.88 From: package.json → npm/@earendil-works/pi-coding-agent@0.83.0 ℹ Read more on: This package | This alert | What are AI-detected potential security risks? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@earendil-works/pi-coding-agent@0.83.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		System shell access: npm @earendil-works/pi-coding-agent in module child_process Module: child_process Location: Package overview From: package.json → npm/@earendil-works/pi-coding-agent@0.83.0 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@earendil-works/pi-coding-agent@0.83.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		System shell access: npm @earendil-works/pi-coding-agent in module node:child_process Module: node:child_process Location: Package overview From: package.json → npm/@earendil-works/pi-coding-agent@0.83.0 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@earendil-works/pi-coding-agent@0.83.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		System shell access: npm @earendil-works/pi-tui in module child_process Module: child_process Location: Package overview From: package.json → npm/@earendil-works/pi-coding-agent@0.83.0 → npm/@earendil-works/pi-tui@0.83.0 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@earendil-works/pi-tui@0.83.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		System shell access: npm @earendil-works/pi-tui in module node:child_process Module: node:child_process Location: Package overview From: package.json → npm/@earendil-works/pi-coding-agent@0.83.0 → npm/@earendil-works/pi-tui@0.83.0 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@earendil-works/pi-tui@0.83.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		System shell access: npm @mariozechner/clipboard in module child_process Module: child_process Location: Package overview From: package.json → npm/@earendil-works/pi-coding-agent@0.83.0 → npm/@mariozechner/clipboard@0.3.9 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@mariozechner/clipboard@0.3.9. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		System shell access: npm google-auth-library in module child_process Module: child_process Location: Package overview From: package.json → npm/@earendil-works/pi-coding-agent@0.83.0 → npm/google-auth-library@10.9.1 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/google-auth-library@10.9.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Publisher changed: npm jwa is now published by panva instead of omsmith New Author: panva Previous Author: omsmith From: package.json → npm/@earendil-works/pi-coding-agent@0.83.0 → npm/jwa@2.0.1 ℹ Read more on: This package | This alert | What is new author? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/jwa@2.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Includes npm shrinkwrap: npm @earendil-works/pi-coding-agent Location: Package overview From: package.json → npm/@earendil-works/pi-coding-agent@0.83.0 ℹ Read more on: This package | This alert | What is a shrinkwrap file? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should never use npm shrinkwrap files due to the dangers they pose. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@earendil-works/pi-coding-agent@0.83.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Network access: npm @anthropic-ai/sdk in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: package.json → npm/@anthropic-ai/claude-agent-sdk@0.3.220 → npm/@earendil-works/pi-coding-agent@0.83.0 → npm/@anthropic-ai/sdk@0.91.1 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@anthropic-ai/sdk@0.91.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Network access: npm @earendil-works/pi-agent-core in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: package.json → npm/@earendil-works/pi-coding-agent@0.83.0 → npm/@earendil-works/pi-agent-core@0.83.0 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@earendil-works/pi-agent-core@0.83.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Network access: npm @earendil-works/pi-coding-agent in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: package.json → npm/@earendil-works/pi-coding-agent@0.83.0 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@earendil-works/pi-coding-agent@0.83.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Install-time scripts: npm @google/genai during preinstall Install script: preinstall Source: echo 'preinstall: no-op' From: package.json → npm/@earendil-works/pi-coding-agent@0.83.0 → npm/@google/genai@1.52.0 ℹ Read more on: This package | This alert | What is an install script? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@google/genai@1.52.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Network access: npm @google/genai in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: package.json → npm/@earendil-works/pi-coding-agent@0.83.0 → npm/@google/genai@1.52.0 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@google/genai@1.52.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Network access: npm @mistralai/mistralai in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: package.json → npm/@earendil-works/pi-coding-agent@0.83.0 → npm/@mistralai/mistralai@2.2.6 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@mistralai/mistralai@2.2.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
See 165 more rows in the dashboard

View full report

[matallui]

Dependency security triage for the new direct dependency @earendil-works/pi-coding-agent@0.83.0 (exact-pinned, optional peer dependency). All flagged packages below are in its transitive tree. Research summary per package:

• @earendil-works/pi-coding-agent / pi-agent-core / pi-tui: These are the optional pi Agent SDK this PR integrates (exact-pinned 0.83.0). The flagged shell/tool execution, extension loading, RPC dispatch, and TUI markdown rendering are inherent capabilities of a coding-agent SDK. This integration does not expose them: sessions disable all discovery (noExtensions, noSkills, noContextFiles, noThemes, noPromptTemplates), tools are an exact built-in allowlist, credential persistence is rejected in code, judging exposes only a single terminating tool, and native pi providers/OAuth are never loaded (ModelRuntime with modelsPath: null and a single custom litellm provider). Docker runs execute model-controlled tools inside the container, and forwarded credentials are scrubbed from all message, error, and telemetry surfaces. The TUI/XSS-flagged code is interactive-mode-only and unreachable from this headless adapter. The included npm shrinkwrap is the SDK's standard distribution format.
• @anthropic-ai/sdk: Transitive of pi. The AI signal (npx-fetched .tgz at runtime) concerns the SDK's doctor/migration helper, which the runner never invokes; network access is inherent to an LLM SDK.
• @aws-sdk/credential-provider-process: Standard AWS SDK process-based credential provider; unreachable here because no AWS/Bedrock provider is registered.
• @google/genai, google-auth-library, jwa: Gemini provider support inside pi-ai plus its Google auth chain; unreachable (only the custom litellm provider is registered). jwa "publisher changed" is the long-standing JWT signing library. @google/genai install scripts are denied via the lavamoat allow-scripts config in this PR.
• @mistralai/mistralai: Mistral provider SDK bundled by pi-ai; unreachable, same reasoning as above.
• @mariozechner/clipboard: Clipboard access for pi's interactive TUI; not used headlessly.
• Network access alerts: the adapter registers exactly one provider whose base URL is the caller-configured LITELLM_BASE_URL (validated as HTTP(S) without credentials/query/fragment); no other endpoint is contacted by the runner itself.

@SocketSecurity ignore npm/@earendil-works/pi-coding-agent@0.83.0
@SocketSecurity ignore npm/@earendil-works/pi-agent-core@0.83.0
@SocketSecurity ignore npm/@earendil-works/pi-tui@0.83.0
@SocketSecurity ignore npm/@anthropic-ai/sdk@0.91.1
@SocketSecurity ignore npm/@aws-sdk/credential-provider-process@3.972.70
@SocketSecurity ignore npm/@google/genai@1.52.0
@SocketSecurity ignore npm/google-auth-library@10.9.1
@SocketSecurity ignore npm/jwa@2.0.1
@SocketSecurity ignore npm/@mistralai/mistralai@2.2.6
@SocketSecurity ignore npm/@mariozechner/clipboard@0.3.9

[matallui]

Superseded by #29 — the branch now lives in MetaMask/agent-runner directly.