For people running Pi, and teams deciding where it runs
Pi coding agent: the other half is an open-source runtime
The open-source AI Operating System
Pi is a minimal agent harness: four tools, four modes, and any model you hold a key for, installed with one shell line. Its README says Pi ships no permission system, so what you put around it decides the result. Kortix is the open-source AI Operating System that puts that part in place.
curl -fsSL https://pi.dev/install.sh | shcd /path/to/projectpiOne isolated sandbox per session. Each session has its own isolated machine and branch.
What Pi is
Pi is a minimal agent harness developed by Earendil Inc., and Mario Zechner created it. As of 28 October 2026, the stable release listed for Pi is 1.4.0. The harness gives a model four built-in tools: read, write, edit and bash. It runs in four modes: interactive, print/JSON, RPC and SDK. Provider keys come from the environment. pi.dev names Anthropic, OpenAI, Google, Bedrock, OpenRouter and Ollama among the providers, and /model switches between them mid-session.
Everything past the four tools arrives as an extension, a skill, a prompt template or a theme. Those bundle as a Pi package and travel over npm or git. Sessions are stored as trees, so /tree walks back to an earlier point in one file, /export writes HTML, and /share uploads a gist. AGENTS.md loads project instructions at startup, from ~/.pi/agent/, from parent directories and from the working directory. Pi harness takes the word itself apart, if that is the part you came for.
What Pi deliberately leaves out
Pi ships with powerful defaults but skips features like sub-agents and plan mode, to quote its own page. Permissions are the larger omission. The README says it without decoration: "Pi does not include a built-in permission system for restricting filesystem, process, network, or credential access. By default, it runs with the permissions of the user and process that launched it."
A Pi session therefore holds whatever your account holds. That is a fair trade for a harness you drive yourself. Pi documents the ways out. The Gondolin extension keeps pi and provider authentication on the host and routes the built-in tools into a local Linux micro-VM. OpenShell runs the whole process in a policy-controlled sandbox. Permission gates exist too, as packages you install, so the gate is code you added rather than something the harness guarantees.
What a team supplies instead
The first thing Pi does not bring is a machine. It runs where you started it, with that account's reach, which works for one developer at one desk. Kortix runs pi inside its own sessions: "Every new session runs pi. OpenCode is deprecated: since 2026-10-23 no new session starts on it, and Kortix will remove it." Each session has its own isolated machine and branch. The sandbox clones the repo to /workspace. Which cloud option leaves your credentials where you want them is the subject of run Pi in the cloud.
The second thing is a rule set the harness does not carry. In Kortix an agent's permission block decides which tools run, which wait for a person and which are refused. The most specific rule wins. The permission block shown with the session steps allows edits, asks before any other shell command, allows three read-only git commands and denies rm -rf. Connector credentials are brokered server-side and never enter the machine. The Kortix docs list every tool key and the action it takes.
The third is a reviewer. In a terminal, the merge is yours to do. In Kortix the branch name is the session_id, the agent commits and pushes to its session branch, and it opens a change request. A person reviews it and merges it. Every action is recorded. Reading, exporting and streaming the audit log depend on the plan. What the machine and the model calls add up to is the last question, and pi coding agent pricing works through it.
Two halves on one screen
The permission block, and the steps a session leaves behind.
An agent's rules live in its own file; the change request is what the project keeps.
permission: edit: allow bash: "*": ask "git status": allow "git diff *": allow "git log *": allow "rm -rf *": deny webfetch: askThe branch name is the session_id.The sandbox clones the repo to /workspace and starts the harness, pi.The agent commits and pushes to its session branch.The agent opens a change request.A person reviews it and merges it.The part Pi does not ship
Three things the runtime holds that the harness does not.
Isolation, a record of what ran, and credentials that stay outside the sandbox.
- One isolated machine per session
- Every action is recorded
- Connector credentials never enter the machine
FAQ
Questions about the Pi coding agent
Pi is a minimal agent harness from Earendil Inc. that runs the model loop and calls four built-in tools: read, write, edit and bash. It installs with one shell line, takes any provider key you hold and extends through packages.
Yes, where a small harness is an advantage. Pi ships four tools, four modes and an extension system, and takes any provider key you have. It also ships no permission system, so the machine and the rules around it carry as much weight as the harness.
Yes. Pi installs from a shell script or npm with no account, and neither the loop nor the four tools is metered. What you pay for is the model behind each call and the machine the session runs on.
In Kortix, the Stop button ends the running turn and leaves the sandbox up, and kortix sessions stop <id> ends the turn and stops the sandbox. In a terminal, closing Pi ends the process, and /tree reopens an earlier point from the session file.
Run Pi where the work can land.
Kortix starts pi in a session with its own branch, and the change request a person reviews is the last step.