flowchart TB
  h["Raw JSONL branch history"] --> p["Compaction and context-edit projection"]
  p --> t["Transcript with prompt and tool history"]
  t --> x["Per-request context transformations"]
  x --> r["Provider request"]
  h --> u["Raw history and accounting"]

flowchart TB
  s["Model-authored JavaScript"] --> v["Worker: fresh QuickJS wasm VM"]
  v --> b["Explicit tool and model bridge"]
  b --> t["Ordinary tool pipeline"]
  b --> m["Authenticated classifier or image operation"]
  t --> l["Local tools or MCP transport"]

---
id: SMH-RESEARCH-AHDXRKXM
type: research
title: "Pi 0.85.1 to 1.0.0 Delta"
---

# Pi 0.85.1 to 1.0.0 Delta

## Scope

Checked 2026-10-02.
Previous delta ended at 0.85.1, revision `d981de1229ef899957bbe968bc8dcda02a21f477`.
Upstream npm latest: 1.0.0, released 2026-10-01, revision `a13d35a742c6ef8462812a28fbe1d8c8b7431c32`.[^release]
Installed session runtime: 0.87.0; newer upstream features are not installed behavior.
Eight coding-agent release sections follow the baseline: 0.86.0, 0.86.1, 0.87.0, 0.87.1, 0.99.0, 0.99.1, 0.99.2, 1.0.0.
Evidence: pinned release notes, documentation, manifests, selected source; no complete repository diff, runtime tests, or independent performance measurements.

## Feature delta

| Release | Addition or change | Architectural significance |
| --- | --- | --- |
| 0.86.0 | Cost-aware cache warming during tools or idle; per-model compaction budgets | Background provider work has usage accounting and extension decisions |
| 0.86.0 | Transcript-backed prompt/tool changes; normalized `TranscriptContext` | Instruction and tool history survive resume without rewriting cached prefixes |
| 0.86.0 | `/bug`, crash diagnostics, optional transcript upload or ZIP export | Diagnostics become a product workflow; disclosure still needs review |
| 0.87.0 | Canonical session projection; append-only context edits | Model-visible context differs explicitly from raw history |
| 0.87.0 | Actionable turn/settlement boundaries; `prepareRequest`, `finishTurn` | Continuation and terminal notifications become separate decisions |
| 0.87.0 | Full-transcript context hook; per-model image resizing | Explicit override layer and cache-consistent input policy |
| 0.99.0 | Built-in codemode, tool search, MCP client | Script orchestration and remote tools join ordinary tool dispatch |
| 0.99.0 | Experimental virtual models; classifier/image operations | Selected model differs from physical dispatch; catalog spans operation types |
| 0.99.0 | Terminal-derived system theme; richer theme colors | Theme follows terminal appearance rather than fixed defaults |
| 0.99.0–1.0.0 | ChatGPT login on OpenAI, newer models, workload federation, headless auth | Auth/routing evolves independently of provider stream vocabulary |
| 0.99.2 | Background MCP discovery; stable tool descriptions | Connectivity no longer forces prompt-declaration churn or universal startup waits |
| 1.0.0 | Fullscreen default; codemode image generation; MCP OAuth hardening | Existing UI becomes default; script capabilities and auth checks expand |

Release notes also report lazy extension-compiler loading, persistent Node compile caching, progressive session discovery, usage/preview caches, reduced transcript retention.
These are implementation changes, not independently reproduced speed or memory claims.[^changes]

## Context architecture

Append-only history supplies model context through projection, not mutable agent memory.[^session]

```mermaid
flowchart TB
  h["Raw JSONL branch history"] --> p["Compaction and context-edit projection"]
  p --> t["Transcript with prompt and tool history"]
  t --> x["Per-request context transformations"]
  x --> r["Provider request"]
  h --> u["Raw history and accounting"]
```

- Coding-agent persistence remains version 3 parent-linked JSONL.
- `context_edit` omits or replaces earlier message content for future requests; raw entries, UI history, usage remain intact.
- Edits are branch-relative; latest applicable edit wins.
- System messages persist prompt-section and tool-definition changes; compaction carries a complete system/tool checkpoint.
- Assigning `agent.state.messages` no longer replaces future canonical history.
- `context` transforms non-system messages; `context_with_system` subsequently transforms the complete transcript.
- `turn_end` and `agent_before_settle` may append structural entries and ensure one continuation; `agent_settled` is notification-only.
- Runs requested during settled notification wait until all settled handlers finish; no reentrant start inside that dispatch.[^changes]

`finishTurn` replaces `shouldStopAfterTurn`.
It runs after assistant/tool finalization, before `turn_end`; its decision applies afterward.
Error and aborted responses remain hard exits; continuation does not duplicate already-scheduled requests.[^agent]

## Script orchestration boundary

Codemode runs model-authored JavaScript in a fresh QuickJS wasm VM on a worker thread; explicit calls return to host dispatch.[^codemode][^worker]

```mermaid
flowchart TB
  s["Model-authored JavaScript"] --> v["Worker: fresh QuickJS wasm VM"]
  v --> b["Explicit tool and model bridge"]
  b --> t["Ordinary tool pipeline"]
  b --> m["Authenticated classifier or image operation"]
  t --> l["Local tools or MCP transport"]
```

- No Node APIs, direct filesystem/network, or timers inside the script API.
- Documented VM memory limit: 256 MB; whole-script deadline optional, unset by default.
- Host terminates worker on settlement, timeout, abort; spinning script does not execute on the host event thread.
- Nested tools retain validation and permission hooks, causal parent IDs, bounded nested-call records, usage attribution.
- Script-selected output reaches the model; intermediate tool results remain available for script reduction.
- Completed tool effects survive script failure; pending work is cancelled when the script ends.
- Fresh VM does not mean stateless session: bounded JSON store commits on script success through branch-local custom entries.
- Classifier/image calls share session authentication; at most four run concurrently per script; chat models cannot be run from scripts.
- Standard TypeScript extensions still run with Pi's OS permissions; stdio MCP servers are child processes, not wasm guests.[^security]

Sandboxed orchestration does not sandbox native tools or eliminate their process launches.
Reviewed evidence does not establish aggregate host-allocation bounds, deterministic clock/randomness, or durable effect recording equivalent to Smith's execution laws.

## MCP and tool publication

Built-in MCP supports stdio and Streamable HTTP, resources, OAuth, CLI configuration, interactive management, extension registration.[^mcp]
Legacy SSE and MCP Apps rendering are unsupported.
Project MCP configuration is trust-gated; trust is not runtime isolation.

| MCP exposure | Behavior |
| --- | --- |
| `direct` | Declared to model; callable from scripts |
| `codemode` | Default; discovered through script helpers, not enumerated in tool description |
| `deferred` | Search loads declarations onto the active transcript branch |
| `hidden` | Registered but unreachable |

Codemode/deferred tools are reachable through either indirect mechanism when enabled.
Servers connect in background; first prompt waits up to 10 seconds only for direct-tool servers.
Indirect use waits for relevant servers; global search/enumeration waits for all.
Short server summaries enter a changing system-prompt section instead of changing codemode/tool-search declarations.
Tool-name normalization handles collisions explicitly rather than silently binding the wrong tool.

Resource reads can retry transient failures; MCP tool calls do not automatically retry because effects may already have occurred.
OAuth credentials are keyed by server name plus URL; 1.0.0 adds issuer checks and scope-preserving step-up auth.
Provider-token MCP auth is limited to global config/extensions and HTTPS except loopback.

## Model and package boundaries

Virtual models retain user selection while routing each request to a physical model and thinking level.[^virtual]
Assistant messages record physical dispatch; routing state follows session branches; compaction considers routed limits.
Virtual models remain experimental in introduction notes; 1.0.0 alone does not establish their stability.
`ModelRuntime` now distinguishes chat, classifier, image operations while retaining chat-facing catalog APIs.[^changes]

Codemode and MCP have separate published packages consumed by coding-agent.[^release]
Built-in extensions can be disabled or replaced; SDK sessions do not automatically load them.[^mcp]

At 1.0.0, agent-core removes experimental harness, durable sessions/storage, compaction, and related exports.
Its root now exports agent, loop, proxy, stream configuration, types; upstream directs durable-session users to `pi-durable`.[^agent][^core]
That package was not inspected.
This is not a migration of coding-agent JSONL to lane sessions.

Published local SDK and stdio RPC remain distinct from source-only experimental client/plugin entrypoints.
MCP HTTP is remote tool access, not evidence that remote control of Pi became a supported network API.[^release]

## Smith design impact

No reviewed feature requires fundamental redesign.
Rust core, binary append-only sessions, metered wasm components, recorded effects, generation pins, frontend separation remain coherent.
Small contract amendment does not imply small implementation.
Assessment concerns specified design, not implementation completeness.

| Pi change | Verdict | Smith consequence |
| --- | --- | --- |
| Canonical context and branch-relative edits | Additive contract; substantive implementation | Define edit/projection records, branch scope, compaction precedence, pairing validation, replay/version behavior; retain binary history |
| Durable prompt/tool changes | Clarification | Define authoritative effective-request snapshot and reconstruction; runtime-only changes must not silently alter replay or persist user config |
| Actionable continuation and settlement | Small amendment | Define ensure-one-request coalescing, hard-exit precedence, notification-only settlement, deferred starts |
| Tool exposure and discovery | Small amendment | Separate advertised from active/callable/granted; prompt-hidden may remain active, disabled or ungranted may not |
| Virtual models | Optional additive feature | Record selected versus dispatched identity, decision provenance, physical capabilities and cost; no new agent loop |
| Codemode orchestration | Optional plugin/SDK feature; potentially large | Existing hosted child-work model fits; expose mediated tool composition, not a privileged script registry; QuickJS not required |
| Nested-call attribution and script state | Already covered at principle level | Shared budgets/pins, causal effects, host-owned durable state; define concrete resource/commit semantics when consumed |
| MCP client and background discovery | Optional plugin/SDK feature; potentially large | May require bounded duplex process/HTTP primitives; preserve generations and invocation authority; distinct from Smith serving MCP |
| Classifier/image model APIs | Optional breadth; defer | Can enter as plugin capabilities/tools; no reason now to generalize chat StreamFn or adopt Pi's ModelRuntime shapes |
| Cache warming | Optional later feature | Explicit recorded clock triggers, separate bounded work, usage accounting; no hidden provider calls |
| Provider/auth additions and OAuth hardening | Adapter/SDK implementation evidence | Keep vendor knowledge in provider plugins, credential mechanics and secret substitution in host |
| Fullscreen default | Already covered | Smith already requires fullscreen; Pi's regular mode is outside current scope |
| System theme and image policy | Optional product detail | Theme plugins and host render/input primitives suffice; no architecture change |
| Startup, lazy loading, retained-memory fixes | Implementation evidence | Existing off-render I/O and bounded working-set laws apply; measure Smith rather than import Pi claims |
| Bug reporting | Optional command/plugin | Explicit disclosure, redaction, offline export; not core redesign |
| Agent-core package pruning, Node/Bun wiring, JSONL | Not an adoption target | Smith owns different crate, runtime, and storage boundaries; removed Pi harness is a stale reference |

### Constraints on transfer

- Network-backed classification must not enter Smith's network-free alias/group resolver; run a recorded plugin effect, then publish the routing decision before dispatch.
- Codemode reachability must not bypass disabled tools or capability grants; missing model declarations are not invocation authority.
- Pi's unrestricted native extensions and optional script deadlines are incompatible defaults, not reasons to weaken Smith's sandbox or budgets.
- Effect completion and script-state commit remain separate; script failure does not roll back completed external effects.
- MCP tool access over HTTP does not revise daemon authentication, session ownership, or fleet trust.

### Candidate priorities

1. Durable effective context and prompt/tool provenance before context mutation and replay integration.
2. Visibility versus invocation authority before discovery or scripted composition.
3. Continuation and settlement ordering before new lifecycle hooks.
4. Routing provenance when virtual models gain a real consumer.

Codemode, MCP clients, classifiers, cache warming remain separately justified features, not prerequisites for the current prototype.

## Unresolved questions

- Are script clock/randomness inputs controlled or replayable, and which host-side allocations sit outside VM limits?
- Which nested-call limits and cancellation guarantees hold for arbitrary extension tools or remote MCP servers?
- Which bounded record/checkpoint shapes reconstruct edits and effective declarations without whole-history residency?
- What stability guarantees apply to virtual models and experimental entrypoints after 1.0.0?
- What is the actual `pi-durable` contract after removal from agent-core?

## Sources

[^release]: [npm 1.0.0 metadata](https://registry.npmjs.org/@earendil-works/pi-coding-agent/1.0.0); local 0.87.0 package metadata resolved through `PI_CONTEXT_PACKAGE_JSON_PATH`.
[^changes]: [Coding-agent changelog at release revision](https://github.com/earendil-works/pi/blob/a13d35a742c6ef8462812a28fbe1d8c8b7431c32/packages/coding-agent/CHANGELOG.md).
[^session]: [Session format and projection](https://github.com/earendil-works/pi/blob/a13d35a742c6ef8462812a28fbe1d8c8b7431c32/packages/coding-agent/docs/session-format.md).
[^agent]: [Agent-core changelog](https://github.com/earendil-works/pi/blob/a13d35a742c6ef8462812a28fbe1d8c8b7431c32/packages/agent/CHANGELOG.md).
[^codemode]: [Codemode contracts and limits](https://github.com/earendil-works/pi/blob/a13d35a742c6ef8462812a28fbe1d8c8b7431c32/packages/coding-agent/docs/codemode.md).
[^worker]: [QuickJS worker implementation](https://github.com/earendil-works/pi/blob/a13d35a742c6ef8462812a28fbe1d8c8b7431c32/packages/codemode/src/runtime/worker.ts).
[^security]: [Security boundaries](https://github.com/earendil-works/pi/blob/a13d35a742c6ef8462812a28fbe1d8c8b7431c32/packages/coding-agent/docs/security.md).
[^mcp]: [MCP contracts, exposure, retries, authentication](https://github.com/earendil-works/pi/blob/a13d35a742c6ef8462812a28fbe1d8c8b7431c32/packages/coding-agent/docs/mcp.md).
[^virtual]: [Virtual model selection, routing, state](https://github.com/earendil-works/pi/blob/a13d35a742c6ef8462812a28fbe1d8c8b7431c32/packages/coding-agent/docs/virtual-models.md).
[^core]: [Agent-core root exports](https://github.com/earendil-works/pi/blob/a13d35a742c6ef8462812a28fbe1d8c8b7431c32/packages/agent/src/index.ts).