PI-Desktop

Why it's ranked here

The engineering is unusually deliberate for an early preview. Every tool call passes an allow, ask or deny gate. Shell commands run in their own process group, or a kill-on-close job on Windows, so a stopped task takes its children with it. Each extension runs in a separate process that receives a stripped environment without provider keys, and a crashed extension is contained rather than taking down the app. The repository records its design decisions as numbered records and ships dozens of end-to-end test scripts alongside Rust unit tests. Against that, the maintainers still label it Early Preview.

What's good

Model choice is genuinely open: hosted vendors, compatible endpoints, Ollama and LM Studio, with provider, context window, reasoning level and temperature set per model, and a session can switch models mid-stream. Credentials go to the OS keychain, there is no required account or relay, and the app sends no telemetry of its own. It can import existing sessions from Claude Code, Codex, OpenCode and Pi. The extension system reaches past the agent into the desktop itself, with panels, floating widgets, themes, background services and a message bus between extensions.

Tradeoffs

The extension sandbox is weaker than it sounds. The project's own notes say permission checks cover only the host API, not raw Node file or network calls inside an extension process, and that CPU and memory limits are not enforced yet. Declared permissions are still granted automatically at load time. The plugin SDK and devkit are private workspace packages, so building an extension outside a checkout of the repository is not yet supported. Release builds ship no Node or npm, so importing an extension with npm dependencies needs a system npm on the path. The code is LGPL-3.0, not a permissive license.

How to use it well

Pick it if you want one persistent window for agent work across several repositories and several model providers, especially if a local model handles private tasks. Use Plan mode for refactors and risky changes, since extension tools are unavailable there. Install only third-party extensions you would trust to run as ordinary Node code on your machine. It does not replace your editor: it has no IDE integration by design, so keep the editor for hands-on changes and treat this as the place the agent works.

Observed

License

LGPL-3.0-or-later

Language

TypeScript (Electron app, pnpm monorepo) plus a Rust host crate

Platforms

macOS, Windows, Linux

Runtime requirement for source builds

Node.js 22.19 or newer, pnpm 10 or newer

Agent kernel

pi agent harness packages from earendil-works

Model providers

OpenAI, Anthropic, OpenAI-compatible APIs, custom gateways, Ollama, LM Studio

Extension packaging

Plugins distributed as .piplug packages or via an in-app marketplace; MCP servers supported

Plugin isolation

One separate process per plugin; permission gating covers the host API, not raw Node APIs

Credential storage

OS keychain; no PI-Desktop telemetry or mandatory account

Tests

Rust unit tests via cargo test plus a large set of end-to-end smoke scripts