Pi Runtime Extensions
Pluggable TypeScript packages that register IM, browser, memory, security, and generative capabilities as MCP tools for the Pi agent runtime.
- Source repo
- TGYD-helige/pi
- Stars
- ★ 71
- Last updated
- 1d ago
- License
- Apache-2.0
- Primary language
- TypeScript
- FA score
- 44/100 · Major gaps
At a glance
- Works with
- Portable with changes
- You'll need
- Typical use
- A developer building a host app who wants session, event, artifact, and scheduled-task persistence while keeping their own HTTP routing and front end installs pi-shared plus pi-storage.
- Main limitation
- Tightly bound to the Pi/DSH runtime: the README states packages are consumed by host applications that provide HTTP routing, auth, model runtime, and deployment config, so this is not a standalone service.
- Source review
- 44/100 · Major gaps 2 safety controls not found
What does this agent do, and when should you use it?
Pi is a monorepo of shared TypeScript packages for Pi runtime applications, published ESM-only under the @amaster.ai npm scope. It splits into two layers: @amaster.ai/pi-shared and @amaster.ai/pi-storage supply runtime contracts and persistence adapters, while the remaining packages are extensions that each register themselves through a ./extension subpath entry point and are loaded on demand by a host application. Extensions cover IM workspaces (Lark/Feishu, WeCom, DingTalk), browser and desktop automation, persistent memory, Langfuse/OpenTelemetry telemetry, cron scheduling, image and video generation, web access, and security policy. Hosts must supply HTTP routing, authentication, model runtime setup, deployment configuration, and product UI; the README documents two loading models, pi2dsh and dsh-pi-host. Runtime requirements are Node.js >=24 and pnpm 10.18.3, licensed Apache-2.0.
Each extension exports an entry point at its ./extension subpath; hosts import it and pass it to the Pi runtime during setup, which registers LLM-callable tools. On the core side, loadPiSettings reads configuration and createRuntimeStorage creates storage, with JsonRuntimeStorage plus MySQL/Prisma adapters persisting sessions, transcripts, events, memory, artifacts, subagents, and scheduled tasks. pi-browser-use wraps chrome-devtools-mcp behind browser_-prefixed tools, pi-computer-use provides cross-platform desktop automation, and pi-web-access handles web search, URL content extraction, and image search. pi-memory injects curated MEMORY.md and USER.md content into the system prompt as a refreshed snapshot, pi-security enforces resource-aware policies and tool authorization, pi-task-scheduler manages cron-based tasks, pi-telemetry exports through createLangfuseExporter and createOtelExporter, and pi-goal derives a goal from the conversation and iterates until it is met. For workspaces, pi-lark calls lark-cli, pi-wecom calls wecom-cli, and pi-dingtalk calls the dws CLI for calendars, docs, sheets, mail, and approvals. pi-image-gen targets OpenAI gpt-image, Google Nano Banana, Alibaba Qwen-Image, OpenRouter, and custom providers, while pi-video-gen performs lossless clip concat and mixed image/video timelines with bundled LGPL/GPL FFmpeg runtimes.
- A developer building a host app who wants session, event, artifact, and scheduled-task persistence while keeping their own HTTP routing and front end installs pi-shared plus pi-storage.
- A team wiring a Pi agent into a Feishu/Lark office workflow needs calendar, docs, drive, sheets, Base, tasks, and IM skills, provided by pi-lark through lark-cli.
- An ops or engineering group wants an agent to search the web, extract page content, and drive a browser, combining pi-web-access and pi-browser-use in one flow.
- An assistant scenario needing durable personalization uses pi-memory to inject MEMORY.md/USER.md into the system prompt instead of restating context each turn.
- A compliance-sensitive team requires per-resource authorization before tool execution and adds the pi-security policy engine and tool authorization.
- A content team switches between image providers via pi-image-gen and assembles clips, subtitles, TTS, and BGM into a finished video with pi-video-gen.
How do you install or deploy this agent?
Requirements are Node.js >=24 and pnpm 10.18.3; the README recommends Corepack:
corepack enable
corepack install -g [email protected]
pnpm installFull local check: pnpm run pr-check. Common commands: pnpm build, pnpm typecheck, pnpm test. pi-storage ships a Prisma schema at packages/storage/prisma/schema.prisma; run pnpm --filter @amaster.ai/pi-storage prisma:generate if needed, though the root build and typecheck scripts generate the Prisma client before compiling. As a consumer, install only what you need:
pnpm add @amaster.ai/pi-shared @amaster.ai/pi-storageThe README does not document credential setup for the IM, image, or video providers; consult each package README.
How do you use this agent?
Import from root entry points or focused subpaths, for example:
import { createRuntimeStorage } from "@amaster.ai/pi-storage";
import { JsonRuntimeStorage } from "@amaster.ai/pi-storage/json";
import { loadPiSettings } from "@amaster.ai/pi-shared/settings";
import { createLangfuseExporter } from "@amaster.ai/pi-telemetry/langfuse";
import { createOtelExporter } from "@amaster.ai/pi-telemetry/otel";
import memoryExtension from "@amaster.ai/pi-memory/extension";Extension packages register themselves through their ./extension subpath entry point; the host imports them and passes them to the Pi runtime during setup. Two host loading models are documented: pi2dsh discovers explicitly installed Pi packages in a DSH profile, while dsh-pi-host loads package names configured in its extensions list. Hosts must supply HTTP routing, authentication, model runtime, and deployment config; the README shows no runnable minimal example.
What are this agent's strengths and limitations?
- Clear separation with per-package installation: pi-shared and pi-storage hold contracts and persistence, while 19 extensions each register through a ./extension entry point so hosts install only what they need.
- Storage offers both JSON-file and MySQL/Prisma adapters, easing the path from local development to database-backed deployment.
- Broad, realistic office coverage: Lark/Feishu, WeCom, and DingTalk integrations reach calendars, docs, sheets, and approvals via lark-cli, wecom-cli, and the dws CLI respectively.
- Telemetry exports to both Langfuse and OpenTelemetry, and image generation can switch among OpenAI, Google, Alibaba, OpenRouter, and custom providers.
- pi-video-gen bundles LGPL/GPL FFmpeg runtimes and supports lossless concat, subtitles, TTS, and BGM in local composition, reducing reliance on external transcoding.
- Tightly bound to the Pi/DSH runtime: the README states packages are consumed by host applications that provide HTTP routing, auth, model runtime, and deployment config, so this is not a standalone service.
- No runnable minimal example or first-invocation walkthrough is documented, and provider credentials/quotas for IM, image, and video packages are absent, understating integration effort.
- Strict runtime floor: Node.js >=24 and pinned pnpm 10.18.3 with Corepack, plus Prisma/MySQL when the database storage adapter is used.
- Compatibility depends on host, DSH, Pi, and extension versions; only the pi2dsh and dsh-pi-host docs are referenced, with no version matrix.
- pi-video-gen ships LGPL/GPL FFmpeg runtimes, which can add redistribution and license-compliance review overhead.
How does this agent compare with similar options?
Key facts side by side with the most closely related agents.
| Agent | Source review | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|
| Pi Runtime Extensions This agent | 44 · Major gaps | ★ 71 | 1d ago | TypeScript | — |
| Interceptor | 57 · Major gaps | ★ 419 | 4d ago | TypeScript | Codex · Claude Code · Claude.ai |
| CamoFox Browser Server | 72 · Some gaps | ★ 396 | 1mo ago | JavaScript | Claude Code |
| Endoplexity Browser Agent | 67 · Some gaps | ★ 179 | 1mo ago | TypeScript | Claude.ai |
How does FollowAgents rate this agent?
Why each dimension lost points
least_privilege: only the eval scripts restrict tools via --tools allowlists; the product itself shows no runtime least-privilege policy, so 1. user_confirmation: no user-confirmation mechanism for risky actions anywhere in the repo, 0. data_flow_transparency: README names Lark/WeCom/DingTalk, Langfuse/OTel, and multiple image/video providers, so direction is visible but no per-item data-flow description, 1. sensitive_data_handling: CI writes API keys under RUNNER_TEMP and does not upload them (good practice), but product-side handling of sessions/memory/attachments is undocumented, 1. dependency_security: only onlyBuiltDependencies and devDependencies are listed; no audit, lockfile policy, or vulnerability handling, 1. external_effects: browser automation, desktop automation, message sending, and scheduled tasks create external side effects, but there is no side-effect inventory or idempotency/rollback note, 1. rollback: no rollback or undo mechanism described, 0. source_attribution: Apache-2.0 and the @amaster.ai scope are visible, but upstream provenance and third-party attribution are not stated, 1.
self_consistency: the README package table, preview table, CI workflows, and eval scripts largely agree on package names; only pi-memory-mem0 appears in the preview table but not the package table, 2. dependency_availability: requires Node>=24 and pnpm 10.18.3 and depends on external CLIs (lark-cli, wecom-cli, dws, chrome-devtools-mcp, cua-driver) and FFmpeg runtimes whose availability is unverified, 1. failure_messages: eval scripts give clear errors for missing Chrome and missing secrets and skip gracefully on non-macOS, 2.
audience_and_scenarios: README clearly targets host-application developers and lists per-extension scenarios, 2. capability_boundaries: it states the host provides routing/auth/model runtime, but per-extension capability boundaries and limits are not systematized, 1. trigger_precision: tool triggering relies on MCP tool descriptions; no trigger conditions or ambiguity handling are shown, 1. environment_fit: Node/pnpm versions, Corepack, Prisma generation, cross-platform Chrome resolution, and macOS skip logic are documented, 2.
information_architecture: README is well organized into package table, previews, requirements, development, consumption, host compatibility, and license, 2. install_notes: installation and common commands are complete, 2. naming_stability: package names and subpath entries (/extension, /json, /settings, etc.) are consistent, 2. examples_and_faq: only a few import examples and no FAQ, 1. known_limitations: only ESM-only and host-version compatibility are mentioned; no limitations list, 1. license: full Apache-2.0 LICENSE matching package.json, 3. versioning_changelog: version 0.1.2-beta.15 with no CHANGELOG or versioning policy, 1. maintenance_responsibility: no maintainer, contact, or governance statement, and publisher identity is unverified, 1.
output_usability: typed contracts and extension entry points make host integration straightforward, 2. marginal_value: covers IM integrations, browser/desktop automation, memory, scheduling, and image/video generation, adding value over generic tooling, 2. cost_benefit: video generation involves paid clips, desktop automation needs TCC grants, and dependencies are heavy; the cost/benefit tradeoff is not discussed, 1.
claim_traceability: README capability claims are not mapped to specific files or tests, 1. cross_source_corroboration: README, CI workflows, and eval scripts partially corroborate each other on package names and flow, but there is no independent source, 1. fact_inference_separation: docs do not separate verified facts from inference, and eval results require actual execution to confirm, 1.
- Not found in source: confirmation before actingTurn on (or add) a confirmation step before it acts, and try it in a sandbox or test environment before real data.
- Not found in source: rollback or recovery pathBack up first, or work on a git branch or snapshot, so its changes can be undone.
- Publisher identity is unverified and no maintainer or governance statement is provided; confirm provenance and update path before adoption.
- Extensions create external side effects (browser/desktop automation, message sending, scheduled tasks) with no side-effect inventory, user confirmation, or rollback mechanism.
- Depends on external CLIs (lark-cli, wecom-cli, dws, chrome-devtools-mcp, cua-driver) and FFmpeg runtimes whose availability and version compatibility are unverified.
- Video generation consumes paid clips and desktop automation requires macOS Accessibility and Screen Recording grants; assess cost and permission impact yourself.
- No CHANGELOG or versioning policy; the current 0.1.2-beta.15 prerelease may change its interfaces.
FAQ
Can I run this as a standalone service?
Do I have to install every package?
pnpm add @amaster.ai/pi-shared @amaster.ai/pi-storage. Extensions are independent and register through their ./extension subpaths for on-demand loading.