---
id: SMH-RESEARCH-6QMOC6X4
type: research
title: "Pi 1.0.0 to 1.1.0 Features and Architecture"
---

# Pi 1.0.0 to 1.1.0 Features and Architecture

## Scope and evidence

Checked 2026-10-11.
Baseline: [previous research](../SMH-RESEARCH-AHDXRKXM-pi-0-85-1-to-1-0-0-delta/index.md), checked 2026-10-02, Pi 1.0.0 at `a13d35a742c6ef8462812a28fbe1d8c8b7431c32`.
Target: npm latest 1.1.0; release tag resolves to `abe508e1b89912adde45528136c3221eb69acdd7`.[^npm][^tag]
Installed package: 1.0.2, read from `PI_CONTEXT_PACKAGE_JSON_PATH`; target features are not assumed installed.
Five post-baseline releases: 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.1.0.
GitHub comparison reports 139 commits ahead.[^compare]
Evidence: complete post-baseline coding-agent release sections, selected package changelogs, documentation, targeted source corroboration.
Durable README inspected at both baseline and target; its existing architecture is separated from new changes.
No runtime tests, full patch audit, independent performance measurements, or unreleased-main review.

## Feature delta

Release claims below come from pinned coding-agent changelog unless otherwise cited.[^changes]

| Release | New behavior | Relevant boundary |
| --- | --- | --- |
| 1.0.1 · Oct 3 | Project MCP overrides; Client ID Metadata Document registration | Config precedence, trust, OAuth |
| 1.0.1 | Tool renderers independent of current registration | Resume/export presentation without live tool connection |
| 1.0.1 | Anthropic inline additions and same-name redefinitions | Durable tool history, stable cached prefix |
| 1.0.1 | Cloudflare Clef classifiers; Nix flake | Provider breadth, distribution |
| 1.0.2 · Oct 4 | Sampling parameters by thinking level | Effective provider request configuration |
| 1.0.3 · Oct 5 | Azure Foundry Chat Completions; provider renamed to `azure` | Breaking identity/config change despite 1.0 patch release |
| 1.0.3 | Codemode images saved to temp files; output files user-readable only | Artifact lifetime, confidentiality |
| 1.0.4 · Oct 5 | Tool wildcard filters; `--no-mcp` | Selection policy distinct from tool advertisement |
| 1.0.4 | Image reads reach scripts; hidden-tool prompt guidelines corrected | Typed output, coherent request loadout |
| 1.1.0 · Oct 7 | Add/remove default tools with `+name`/`-name` | Relative selection versus replacement |
| 1.1.0 | Recorded tool duration; render padding | Persisted metadata versus live presentation |
| 1.1.0 | OSC 7501 status; settlement `aborted` field | Frontend status, cancellation outcome |
| 1.1.0 | Haiku 5.5; GPT-6 Luna image classifier; native llama.cpp classifiers | Typed model capabilities, not new chat-loop semantics |

Other product fixes: Termux clipboard paste, terminal disappearance without crash reporting, session-switch selection reset, chunk-split ANSI cleanup, multiline highlighting, login URL copy key.
Managed updates retain new release plus previous release, rather than every release.
Provider fixes cover retryable busy/error conditions, Bedrock reasoning effort, custom Codex headers, long-context pricing tiers, Anthropic loopback-port fallback.
These are implementation evidence, not requirements to broaden Smith's prototype.

## Architecture findings

### Package boundaries remain distinct

| Surface | Target evidence | Delta assessment |
| --- | --- | --- |
| `pi-agent-core` | Agent, loop, proxy, types | Durable/harness removal happened at baseline, not again in 1.1 |
| `pi-coding-agent` | Interactive CLI, local SDK, stdio RPC; source-only client/plugin exports | No reviewed evidence of a newly supported remote-control network API |
| `pi-codemode` / `pi-mcp` | Separate libraries consumed by coding-agent | Hardening and additive APIs, not new package split |
| `pi-durable` | Experimental durable conversations, tasks, documents over pi-ai and Chord | Significant environment, storage, query, context-cache evolution |
| `chord` | Application composition, state, RPC, plugins | Existing supporting architecture; internals not audited here |

Root README and published metadata support these boundaries.[^root][^npm]
Published coding-agent dependencies do not include `pi-durable`; a durable backend addition is not evidence that interactive sessions migrated to it.
Ordinary Pi extensions retain process/user permissions; default Pi is not a filesystem/process/network permission sandbox.[^root]

### Codemode: host bounds and integrity

1.0.1 adds script output ceilings: 16 Mi characters or 100000 items; crossing either fails the script.
Source constants and accounting corroborate the release claim.[^prelude]
Character and item bounds are not byte bounds, aggregate host-allocation bounds, image-byte bounds, or instruction budgets.
1.0.4 freezes builtins/read-only globals before execution after prototype mutation could crash Pi and leave calls unsettled.[^changes][^prelude]
This protects the bridge's assumptions; it does not prove arbitrary host callbacks are safe.
1.1.0 separates multiple text outputs and groups console output, avoiding ambiguous concatenation.
1.0.3 saves displayed images to temp files and returns paths; 1.0.4 lets image-file reads return image blocks to scripts.
Artifact reachability across later turns is not a proven retention/cleanup contract.
Fresh VMs, branch-local successful-script stores, optional whole-script deadlines remain baseline behavior, not new features.[^codemode]

### MCP: cancellation spans the whole auth workflow

1.0.1 project entries without transport fields override only `enabled`, `exposure`, `toolExposure`, preserving user-level transport/auth fields.[^mcp]
Project config remains trust-gated; trust does not sandbox servers.
1.0.4 fixes closing a session while a server is still connecting.
1.1.0 makes MCP manager responsive before all connections finish.
Sign-in cancellation now covers authorization-server requests and session shutdown; coding-agent release notes specify 15-second request deadlines and whole-login `--timeout`.[^changes]
MCP library threads cancellation through discovery, registration, token exchange, refresh; an aborted refresh no longer falls back to fresh authorization.[^oauth]
Library requests have no intrinsic time limit: caller cancellation/deadline policy is required.
HTTP transport close reuses last request token instead of refreshing credentials, with a one-second DELETE timeout.[^close]
No evidence that remote side effects become rollbackable or that tool calls gain safe automatic retry.

### Context, durations, presentation

Anthropic later tool definitions use inline `tool_addition` blocks; same-name replacement avoids top-level declaration replacement.[^anthropic]
This is provider serialization of effective tool history, not authority to mutate an in-flight Smith generation.
Hidden tools stop appearing in prompt rules; codemode declarations gain each tool's prompt guidelines through `ToolLoadout.getPromptGuidelines()`.[^changes]
Tool selection preserves MCP tools unless a selection entry starts with `mcp__`; wildcard exclusions and explicit `--no-mcp` provide separate controls.

Tool `durationMs` measures execution with a monotonic clock, excluding hooks; calls that never executed have no duration.[^loop]
Durations propagate to result messages, tool-end events, render context; resumed `Took` uses recorded duration instead of current wall time.
Coding-agent settlement now carries explicit `aborted`; source emits it to extensions and session listeners after run activity clears.[^settled]
Cancellation status is not inferred from missing output or duration.

OSC 7501 reports `idle`, `working`, `blocked`, `done`, `error` to supporting terminals; `PI_PROGRAM_STATUS=1|0` overrides detection.[^terminal]
Support is queried before reporting; docs state prompts/model output are not included.
Cancelled runs report idle, not successful completion.[^compare]
This is terminal/frontend status, not a replacement for durable agent outcomes or RPC events.

### Durable runtime: new changes, old laws

`pi-durable` remains explicitly experimental.[^durable]
Existing at 1.0.0: atomic commits before presentation, checkpointed tasks, immutable entries plus documents, owned child work, bounded subscriber backlog, replay-safe tool declarations, SQLite/JSONL storage.[^durable-base]
These close a previous research gap; they are not new 1.1 inventions.

| Release | Durable delta | Architectural significance |
| --- | --- | --- |
| 1.0.2 | Persisted per-conversation provider UUID; forks/children get fresh identity | Cache/session affinity independent of runtime handle |
| 1.0.3 | Positional binary readers, paged directory readers, in-environment line scans | Avoid whole-file payloads and unnecessary remote transfer |
| 1.0.3 | Direct argv exec; stdout/stderr provenance; retained-output window with skipped counts | Shell parsing optional; omissions explicit |
| 1.0.3–1.0.4 | Watch API and environment conformance; symlink, overlap, replacement, permission fixes | Backend semantics earn portable contract through tests |
| 1.0.3 | Configurable partial/output commit intervals; output-tail correctness fixes | Persistence cadence must not change retained output |
| 1.0.4 | PowerShell tool through argv | Tool policy above environment execution |
| 1.1.0 | Scan direction explicit; cursors preserve original order and reject opposite-order reuse | Pagination order becomes storage contract |
| 1.1.0 | Context at visible historical entry; incremental range/view cache | Historical projection without creating fork; avoid repeated full derivation |
| 1.1.0 | Idle context retention default ten minutes; zero drops at idle | Time-based eviction is not byte-bounded residency |
| 1.1.0 | Tool/hook access to harness model runtime; task start/end and response/tool durations | Shared catalog/auth/transforms; recorded observability |
| 1.1.0 | Cloudflare Durable Object SQLite adapter | Additional hosting/storage seam, not new CLI backend |

Delta facts are release notes corroborated by target README, not a storage implementation audit.[^durable-changes][^durable]

Important incompatibilities with Smith remain:

- Durable registry resolves tool/hook code per task phase; current cwd/extension changes may reach calls already emitted by the model.
- Later same-name tools replace earlier tools; stored names resolve against installed code after restart.
- Smith pins advertised definitions and handlers through the complete request/tool batch; replay requires provenance, not merely surviving names.
- Durable SQLite uses WAL with `synchronous = NORMAL`; JSONL fsync is optional; single-process ownership has no cross-process lock.
- Commit-before-show is not proof of survival across power loss or safe multi-process ownership.
- Durable abort withdraws queued inputs; Smith currently preserves queued input unless a separate accepted queue action changes it.

These differences are documented at both baseline and target; they are not new regressions.[^durable-base][^durable]

## Candidate Smith conclusions

No reviewed delta requires replacing Rust core, binary sessions, StreamFn, metered wasm, or frontend separation.
Highest-value evidence concerns failure boundaries and bounded environment APIs, not model catalog breadth.

| Evidence | Candidate transfer | Constraint |
| --- | --- | --- |
| Codemode output/prototype failures | Boundary tests for output accounting and hostile guest values | Bound host conversions, item counts, bytes, artifacts; do not import arbitrary Pi ceilings |
| OAuth cancellation/shutdown | End-to-end cancellation across discovery, refresh, login, close | Record effect outcomes; cancellation must not start fallback auth |
| Bounded durable environment | Positional reads, paged metadata, scan locality, argv execution | Granted mediated effects; conformance per backend; no native env leak to guest |
| Incremental context cache | Head/checkpoint keyed derived context | Byte/allocation bounds and invalidation proof; TTL alone insufficient |
| Ordered cursors | Direction part of cursor validity | Branch/head consistency, explicit mismatch errors |
| Tool rendering before registration | Separate historical presentation from live invocation | Missing plugin cannot create authority; plain fallback remains |
| Tool prompt guidelines and filters | Coherent effective loadout everywhere | Registered/active/advertised/authorized remain distinct |
| Inline tool definitions and sampling overrides | Provider-plugin serialization of recorded effective request | No silent generation drift; cache identity includes effective params |
| Durations and aborted status | Recorded optional metadata plus explicit run outcome | Observation not scheduler input; replay never remeasures |
| OSC 7501 | Optional terminal adapter capability | Render thread owns terminal; typed status, no content leakage or piped escapes |
| Classifier/images and Cloudflare storage | Optional later consumers of existing seams | No prerequisite for prototype; no broad chat-model redesign |

1.0.1 removes npm shrinkwrap; npm installs no longer pin transitive dependencies, while managed installer uses an install lock.[^changes][^root]
1.1.0 disables standalone `.env` autoload from launch directory.
Supply-chain and ambient-environment lessons support Smith's locked builds and controlled guest environment, not another build system.
Azure rename demonstrates that upstream 1.0 patch numbering is not sufficient evidence of stable identifiers.

Human approved later relevant spec revisions referencing this research on 2026-10-11.
Current specs unchanged; reference approval is not approval to amend contracts.

## Unresolved questions

- Which duration fields and terminal outcome tags belong in Smith's durable record vocabulary versus frontend-only state?
- Which reader/watch/remote-output operations have two real Smith consumers before growing the WIT surface?
- What exact aggregate output/artifact limits and retention policy should Smith enforce across nested work?
- Which cache key and byte ceiling reconstruct historical context without mandatory whole-history residency?
- Can missing renderers produce stable replay/export without loading executable plugin code?
- Which OAuth deadlines and teardown guarantees hold for every Smith transport, including cancellation during refresh?
- Does a separate durable-runtime audit establish effect evidence, crash recovery, storage integrity, and ownership guarantees beyond these docs?

Durable internal storage/cache implementation, Chord internals, remote-control protocol changes, classifier backends, and sampling precedence remain unverified.
No upstream speed or memory number is adopted as a Smith performance claim.

## Sources

[^npm]: [Published 1.1.0 package metadata](https://registry.npmjs.org/@earendil-works/pi-coding-agent/1.1.0); latest resolved on check date.
[^tag]: [v1.1.0 tag revision](https://api.github.com/repos/earendil-works/pi/git/ref/tags/v1.1.0).
[^compare]: [Pinned baseline-to-target comparison](https://github.com/earendil-works/pi/compare/a13d35a742c6ef8462812a28fbe1d8c8b7431c32...abe508e1b89912adde45528136c3221eb69acdd7).
[^changes]: [Coding-agent release notes](https://github.com/earendil-works/pi/blob/abe508e1b89912adde45528136c3221eb69acdd7/packages/coding-agent/CHANGELOG.md).
[^root]: [Package boundaries, permissions, distribution](https://github.com/earendil-works/pi/blob/abe508e1b89912adde45528136c3221eb69acdd7/README.md).
[^prelude]: [Codemode output accounting and builtin hardening](https://github.com/earendil-works/pi/blob/abe508e1b89912adde45528136c3221eb69acdd7/packages/codemode/src/runtime/prelude-source.ts).
[^codemode]: [Codemode contracts](https://github.com/earendil-works/pi/blob/abe508e1b89912adde45528136c3221eb69acdd7/packages/coding-agent/docs/codemode.md).
[^mcp]: [MCP config, auth, transport contracts](https://github.com/earendil-works/pi/blob/abe508e1b89912adde45528136c3221eb69acdd7/packages/coding-agent/docs/mcp.md).
[^oauth]: [OAuth cancellation propagation](https://github.com/earendil-works/pi/blob/abe508e1b89912adde45528136c3221eb69acdd7/packages/mcp/src/oauth/flow.ts).
[^close]: [HTTP transport teardown](https://github.com/earendil-works/pi/blob/abe508e1b89912adde45528136c3221eb69acdd7/packages/mcp/src/transports/streamable-http.ts).
[^anthropic]: [Anthropic transcript tool serialization](https://github.com/earendil-works/pi/blob/abe508e1b89912adde45528136c3221eb69acdd7/packages/ai/src/api/anthropic-messages.ts).
[^loop]: [Agent execution duration accounting](https://github.com/earendil-works/pi/blob/abe508e1b89912adde45528136c3221eb69acdd7/packages/agent/src/agent-loop.ts).
[^settled]: [Coding-agent settlement event and dispatch](https://github.com/earendil-works/pi/blob/abe508e1b89912adde45528136c3221eb69acdd7/packages/coding-agent/src/core/agent-session.ts).
[^terminal]: [Terminal program status](https://github.com/earendil-works/pi/blob/abe508e1b89912adde45528136c3221eb69acdd7/packages/coding-agent/docs/terminal-setup.md).
[^durable-base]: [Durable architecture at 1.0.0](https://github.com/earendil-works/pi/blob/a13d35a742c6ef8462812a28fbe1d8c8b7431c32/packages/durable/README.md).
[^durable]: [Durable architecture at 1.1.0](https://github.com/earendil-works/pi/blob/abe508e1b89912adde45528136c3221eb69acdd7/packages/durable/README.md).
[^durable-changes]: [Durable release delta](https://github.com/earendil-works/pi/blob/abe508e1b89912adde45528136c3221eb69acdd7/packages/durable/CHANGELOG.md).