Pi Extensions

Index of my custom Pi extension packages.

I built these extensions because my day-to-day agent workflow needs more than generic prompts: repo-aware context, predictable release automation, and security review with safe defaults. Each package is Pi-native, local-first, telemetry-free, and designed to expose focused commands plus LLM tools that keep context bounded instead of dumping whole repositories into the model.

Why custom extensions?

• Workflow fit — commands match how I review code, prepare releases, and audit security changes.
• Local-first behavior — source analysis, Git metadata, reports, and package state stay in the local repo unless an explicit command performs a network write.
• Bounded model context — tools return compact, structured payloads so Pi can reason over relevant facts without excessive token usage.
• Safety by default — write, publish, tag, and GitHub-comment flows default to dry-run or require explicit approval.
• Reusable package surface — each project ships through npm with a Pi package manifest, so it can be installed with pi install npm:<package>.

Packages

Extension	Purpose	Repository	Pi package
pi-code-review-graph	Builds a repo-local code graph, maps changed files to symbols, finds callers/callees/tests, scores review risk, and prepares compact graph-aware review context.	GitHub	Pi package
pi-release-scribe	Reads Git history, classifies commits, suggests semver bumps, drafts release notes, updates changelogs, and can create draft-first GitHub Releases with approval gates.	GitHub	Pi package
pi-security-review	Builds bounded security-review context from Git diffs, asks for high-signal HIGH/MEDIUM findings, normalizes reports, filters false positives, exports SARIF, and can preview or post gated PR comments.	GitHub	Pi package

Quick install

pi install npm:pi-code-review-graph
pi install npm:pi-release-scribe
pi install npm:pi-security-review

Then reload Pi:

/reload

Extension notes

pi-code-review-graph

Use when review quality depends on understanding impact radius, not only changed lines. It indexes supported source files into a local graph and lets Pi retrieve nearby symbols, imports, callers, callees, tests, package boundaries, and risk signals.

Common commands:

/crg-enable
/crg-build
/crg-status
/crg-impact <path>
/crg-review [focus]

pi-release-scribe

Use when release notes should come from actual Git history rather than manual copy-paste. It collects commits from a tag range, classifies changes, recommends the next version, generates audience-aware notes, previews changelog updates, and keeps publishing operations explicit.

Common commands:

/release-scribe-status
/release-scribe-draft
/release-scribe-changelog --dry-run
/release-scribe-tag <version>
/release-scribe-publish <tag> --draft

pi-security-review

Use when changes need focused security review without turning the tool into an autofixer or noisy SAST replacement. It resolves safe diff scopes, filters generated/vendor/secret-like paths, builds bounded prompts, captures structured findings, and stores local Markdown/JSON reports.

Common commands:

/security-review-status
/security-review-config --create
/security-review
/security-review-panel
/security-review-comment --dry-run

Shared principles

All three packages follow the same baseline:

• no telemetry;
• no source edits by default;
• repo-local config under .pi/;
• bounded tool output for model safety;
• explicit approval before external writes;
• npm package metadata with pi.extensions manifest entries.