PI-Desktop
A local-first desktop workspace for AI coding agents: bring your own model, open any local project, and keep privileged actions under your control.
- Source repo
- vastsa/PI-Desktop
- Stars
- ★ 7.2k
- Last updated
- today
- License
- LGPL-3.0
- Primary language
- TypeScript
- FA score
- 68/100 · Some gaps
At a glance
- How it runs
- Works with
- Universal · cross-platformOpenAI API · Claude APIClaude Code (Partial support)
- Cost
- Free software; you pay for model usage
- Setup effort
- Low · running in minutes
- You'll need
- Typical use
- Developers who want to manage multiple repositories and long-running coding sessions in a desktop workspace independent of any editor or terminal
- Not a fit if
- Users on Ubuntu 20.04, Debian 11, or other glibc below 2.35
- Production teams needing stable APIs and extension interfaces
- Source review
- 68/100 · Some gaps
What does this agent do, and when should you use it?
PI-Desktop (vastsa/PI-Desktop) is a local-first desktop workspace for running AI coding agents, built on an Electron + React UI, a Rust Host Core (permissions, filesystem, SQLite, secrets), and a pi Agent Sidecar that owns the agent loop and model interaction. It requires no account or mandatory relay and supports OpenAI, Anthropic, OpenAI-compatible APIs, and local gateways like Ollama and LM Studio, with per-session model switching. Privileged actions pass through a permission layer, and users can review diffs, command output, and app previews. It offers Agent / Plan / Goal workflows, background Subagent delegation, Skills, MCP servers, and an installable plugin system with a marketplace. The project is in Early Preview (0.14.x), ships installers for macOS, Windows, and Linux, and is licensed under LGPL-3.0.
You configure providers and credentials in Settings → Model configuration, open a local repository from the sidebar, then launch work in Agent mode (just do it), Plan mode (the agent studies the repo and produces a frozen implementation plan awaiting approval), or Goal mode (you lock the objective and acceptance criteria; the agent picks the path). The agent reads the file tree, patches files, runs commands and tests, and iterates; privileged tools go through the permission layer and results are inspected in the Review panel. Large tasks can be delegated to Subagents with their own context (codebase exploration, multi-file implementation, research, test analysis, adversarial review). Conversations are stored locally as JSONL with a SQLite index and checkpointed for restart recovery; features include @ file references, slash commands, session branching, prompt queuing, and session import from Claude Code, Codex, OpenCode, and Pi. Plugins install via the .piplug package workflow from the marketplace or locally, contributing tools, commands, panels, themes, services, Skills, MCP servers, and Subagents; launching with PI_DESKTOP_MCP_CONTROL=1 enables a local-only MCP control endpoint.
- Developers who want to manage multiple repositories and long-running coding sessions in a desktop workspace independent of any editor or terminal
- Teams that need to approve an implementation plan before execution on large or risky changes, using Plan mode
- Privacy-sensitive users running local models via Ollama or LM Studio who want code context to stay off cloud providers
- Engineers delegating subtasks like codebase exploration and test analysis to background Subagents
- Users of Claude Code, Codex, OpenCode, or Pi who want to migrate existing sessions into one workspace
- Advanced users customizing the agent toolchain deeply via plugins, Skills, and MCP servers
How do you install or deploy this agent?
Download from GitHub Releases (https://github.com/vastsa/PI-Desktop/releases/latest): macOS (Apple Silicon / Intel, .dmg or .zip), Windows x64 (NSIS installer or portable exe), Linux x64 (.AppImage / .deb / .rpm / .asar; requires glibc 2.35+, e.g. Ubuntu 22.04+, Debian 12+, Fedora 36+). macOS builds are unsigned by default; if macOS reports the app is damaged, move PI-Desktop.app to Applications and double-click PI-Desktop-macOS-open.command. To run from source you need Node.js >=22.19, pnpm >=10, and a stable Rust toolchain: git clone https://github.com/vastsa/PI-Desktop.git && cd PI-Desktop && pnpm install && cargo build -p host-core && pnpm build:js && pnpm dev.
How do you use this agent?
1) Open Settings → Model configuration, choose a provider (OpenAI, Anthropic, an OpenAI-compatible API, or Ollama/LM Studio) and add credentials (keys are stored in the OS keychain). 2) Add a local project directory from the sidebar. 3) Pick a model and reasoning level in the Composer, choose Agent / Plan / Goal mode, and send a prompt. 4) Inspect diffs and command output in the Review panel, approve, or continue the conversation. Use @ to reference files and slash commands for actions; import sessions via Settings → Import from Claude Code / Codex / OpenCode / Pi; extend the workspace with Skills, MCP servers, and the plugin marketplace.
What are this agent's strengths and limitations?
- No model lock-in: works with OpenAI, Anthropic, OpenAI-compatible APIs, and local gateways (Ollama, LM Studio), with per-session model switching
- Explicitly local-first: conversations stored as JSONL + SQLite locally, credentials in the OS keychain, no telemetry, no required account or relay
- Permission-aware and reviewable: privileged actions pass a permission layer, Plan mode forces approval of a frozen plan, and the Review panel shows diffs and command output
- Layered extensibility: Skills, MCP, Subagents, and plugins (.piplug packages and marketplace) can add tools, panels, themes, and services
- Architecture separates UI from privilege: the renderer has no Node integration; the Rust Host Core independently owns permissions, filesystem, and secrets
- Early Preview (0.14.x): APIs, extension interfaces, and some desktop behaviors may still change
- Running from source requires Node.js >=22.19, pnpm >=10, and Rust; Linux packages need glibc 2.35+, excluding Ubuntu 20.04, Debian 11, and older releases
- Default macOS builds are unsigned, requiring manual handling of the 'damaged app' warning; signing/notarization needs a manually dispatched CI run
- Plugins are permission-gated and isolated from the renderer but remain user-trusted code rather than a full OS sandbox, with publisher verification still pending
- If you use a remote model provider, request context is still sent to that provider under its own privacy policy
How does this agent compare with similar options?
The README contrasts PI-Desktop with coding agents that live in a terminal, an editor extension, or a hosted service (and names importable tools such as Claude Code, Codex, OpenCode, and Pi). Its stated differentiators are a standalone desktop workspace, bring-your-own-model, local-first storage, and a plugin marketplace rather than editor or hosted-service lock-in.
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| PI-Desktop This agent | 68 · Some gaps | Desktop appFree + model costs | ★ 7.2k | today | TypeScript | OpenAI API · Claude API |
| zerostack | 57 · Major gaps | CLIFree + model costs | ★ 1.7k | 1d ago | Rust | OpenAI API · Claude API |
| Synara | 52 · Major gaps | Desktop appFree + model costs | ★ 2.1k | today | TypeScript | Codex · Claude Code |
| Kun Workspace | 49 · Major gaps | Desktop appFree + model costs | ★ 6.3k | 2d ago | TypeScript | ChatGPT · Codex · OpenAI API · Claude API |
How does FollowAgents rate this agent?
Why each dimension lost points
README asserts a permission layer, no Node integration in renderer, and Rust-owned privileged ops — least privilege and user confirmation are clearly designed but not verifiable in provided code, hence deduction; the data-flow table (local JSONL/SQLite, keychain credentials, zero telemetry, honest 'local-first ≠ offline' clarification) earns full marks; dependency security shows only frozen lockfile and cargo --locked with no audit evidence; external effects (in-app updates, MCP control endpoint) are disclosed but `confirm: true is not a user prompt` is a stated trust gap; rollback is explicitly an unfinished priority; open-source attribution (pi-mono etc.) is present.
package. and Cargo.toml versions agree (0.14.6-rc.4) and CI runs JS and Rust tests — adequate self-consistency; dependency availability is supported by lockfiles, though the README itself admits a pnpm 10 vs pinned pnpm 11 discrepancy; failure/recovery is only claimed as 'checkpointed whenever possible' with no concrete failure-message evidence.
Audience (BYO-model local developers) and environment fit are exceptionally well documented (glibc floor, unsigned macOS handling, Linux package formats), earning 3; capability boundaries are addressed via Plan/Goal gates and the honest 'user-trusted code, not an OS sandbox' plugin caveat, but tool-level boundary docs are not shown; trigger precision (MCP operation catalog, slash commands) is described only at summary level.
Documentation index, per-platform install notes, and known limitations (early preview, glibc, macOS signing) are thorough; the full LICENSE is in-repo and consistent with Cargo metadata, earning 3; no CHANGELOG file is shown despite rc versioning and release-doc check scripts; maintenance responsibility cannot be confirmed since publisher identity is unverified, only inferred from board/milestone links.
Review panels, diff inspection, and session management support output usability but remain claims; marginal value (desktop workspace vs terminal agents, session import) and cost story (local, BYO-model, no mandatory relay) are reasonable; everything is documentation-level with no execution evidence, so no full marks.
Spec index, E2E plan, and architecture doc links make claims traceable (2); however only four source files were provided, so core claims about the permission layer and plugin sandbox cannot be cross-corroborated — deducted; README reasonably separates facts from stated priorities and goals.
- The MCP control endpoint's `confirm: true is not a user prompt`: enabling PI_DESKTOP_MCP_CONTROL grants a local process desktop-equivalent authority — enable only in controlled environments and protect the bearer token.
- macOS artifacts are unsigned by default; verify provenance/hashes before bypassing Gatekeeper. Installer upgrade/rollback is listed as an unfinished priority — back up projects and credentials before updating.
- Plugins are user-trusted code, not a full OS sandbox; install only from trusted sources. Publisher identity is not verified by any enterprise registry.
Recent releases
Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.
-
Release notes excerpt
What's Changed * feat: 同一项目的并行会话隔离在各自的 git worktree 中 by @onerentop in https://github.com/vastsa/PI-Desktop/pull/1604 * fix(markdown-table): show overflow scrollbars in preview by @vastsa in https://github.com/vastsa/PI-Desktop/pull/1647 * fix(desktop): open session HTML artifacts from chat and BrowserPreview by @AR307 in https://github.com/vastsa/PI-Desktop/pull/1650 * fix(plugins): notify the renderer after the startup plugin restore by @mai-ming in https://github.com/vastsa/PI-Desktop/pull/1651 …View on GitHub ↗