# Security This package runs Pi with the permissions of its launching OS account. It is not a sandbox; use a dedicated account/container/VM for untrusted work. ## Full parent MCP inheritance (0.2) Every child, including scout/reviewer/researcher/custom read-native roles, receives all MCP tools callable by its dispatching parent. This includes mutating, destructive, and open-world tools. Native mode: read does NOT restrict MCP effects. The snapshot excludes hidden and non-callable tools. Deferred/codemode tools and MCP resource helpers are inherited. Calls return through the parent's live executeTool pipeline, preserving validation and parent permission/redaction hooks. A parent gate can block calls after dispatch. Tools newly available after a snapshot wait until the next delegation. No new server is enabled or independently connected by a child. Only tool schemas/metadata, arguments/results, and an ephemeral local capability cross the bridge, not server configs, provider keys, or OAuth stores. Tool arguments, results, and metadata themselves can still contain private data. The bridge binds 127.0.0.1 only, requires a random per-batch bearer capability, refuses browser Origin headers and incorrect Host values, accepts only inherited tool names, and closes on cancellation/completion. It is not an OS boundary against another process with access to the user's files. Private child policy files hold that ephemeral local capability, are mode 0600, and are removed on normal cleanup. They can remain after an abrupt process crash; the corresponding parent listener dies with the process. Up to 20 agents, including 20 workers, can run at once. They share the workspace: native writes, parent edits and MCP mutations can race. The scheduler caps active sessions; it does not lock files, create worktrees, merge conflicts or make edits transactional. Assign disjoint file ownership or isolated worktrees/branches, use focused assignments and retain parent permission policies. Prompt instructions and server annotations are not verified enforcement. Provider limits and costs still apply. ## Live inspector and costs (0.5) The /agents view keeps bounded assignment text, tool names/status, usage and assistant output. Recent results and session costs are reconstructed from Pi's own persisted records after reload/resume; jobs are not restarted. Lightweight cost amounts/IDs cover the whole session even when detail rows are evicted. This is not a full trace archive: raw thinking, tool arguments and full tool results are not added to the UI store. New metadata includes bounded assignment text and usage. These records and displayed results may contain private information; inspect before sharing sessions. Model/task control sequences are stripped from display. Closing the view does not stop jobs. Stop remains tied to the selected run's ID even when live rows move or complete. Inspector and footer updates make no model or external service calls and do not replace the existing footer. Costs are reported model-price estimates, not actual account billing or a spend cap. Unknown external MCP charges are not inferred. Native nested usage is reconciled once, separately from parent model responses; all recorded session branches count. ## Automatic delegation and role settings (0.6) The auto policy authorizes ordinary specialist selection inside the approved task, not new goals, unsafe operations, purchases or permission bypass. It is guidance to the parent model, not a deterministic guarantee or a background agent scheduler. Manual policy and explicit no-agent constraints remain supported. A role edit is an explicit persistent model/effort choice and can affect usage/cost. It is validated against configured native-child models and parent scope; it never copies credentials or changes the parent's startup defaults. Personal or effective trusted-project scope is shown before Save. Existing running/queued task snapshots are not rewritten. JSON null explicitly opts into parent inheritance; explicit overrides remain fixed until edited or become unavailable (then preflight fails, rather than silently switching to another model). Only Save writes settings. The writer merges under a short lock, atomically replaces the role file, refuses symlinks/stale same-role edits, and retains unrelated keys. Model catalog lookup is a bounded, cancellable metadata-only native Pi process. Available configuration is not proof of upstream account entitlement. ## Other limits - Worker has native shell/edit/write. Parent gates can approve delegation, but native child tools do not inherit parent's custom permission/redaction/provider extensions. - Native read tools can access any OS-readable path, not just cwd. - A worker can bypass no-nesting/install/publish prompts using its shell. The recursion marker is not a hostile-code boundary. - Pi uses existing user-level model/auth configuration; the package does not copy or export auth stores. Model settings may execute configured credential commands. - Personal/project roles influence model behavior. Project agent/config discovery requires personal opt-in plus parent trust. Trust can default true in workspaces without standard protected resources; that opt-in is not per-file review. - Retrieved content and child summaries may contain prompt injection. Treat them as evidence, not instructions or independent verification. - Parent session records, private temp result artifacts, metadata, and diagnostics can contain sensitive data. Review before sharing; no automatic artifact retention cleanup. - Model/MCP calls may incur costs. Runtime/turn/concurrency limits are not a dollar cap. - Native daemonized commands and MCP implementations ignoring cancellation can continue after abort. Process/context isolation is not filesystem, network, or remote-state isolation. - Bridge argument/result limits are 4 MiB/16 MiB; exceeding them returns an error. ## Reporting and compatibility Report vulnerabilities through [GitHub private vulnerability reporting](https://github.com/YellowFoxH4XOR/pi-native-agents/security/advisories/new). Do not post credentials, private sessions, or exploit details in public issues. For ordinary bugs, use the repository issue tracker. Version 0.6 targets Node CLI Pi 1.3.x, tested offline against 1.3.0. Other versions and standalone-only hosts are outside the validated boundary.