Less setup.
More shipping.

Pi is the coding-agent harness. Pi-Bolt is its ahead-of-time compiled build: the same workflow in a native executable. You don’t need Node.js just to run Pi-Bolt.

curl -fsSL https://pi-bolt.opensec.in/install.sh | sh

irm https://pi-bolt.opensec.in/install.ps1 | iex

Review remote install scripts before running them. On Android, use supported Termux; the installer handles its glibc setup. Check platform requirements.

pi-bolt --version
pi-bolt

Run /login inside Pi-Bolt and connect your chosen provider. Provider access and model usage may have their own costs. Update the runtime later with pi-bolt update.

For the Anthropic-based workflow, add the auth extension. For faster repository lookup, add fff. If the installer already added fff, skip that command.

pi-bolt install npm:@gotgenes/pi-anthropic-auth
pi-bolt install npm:opensec-pi-fff

Restart Pi-Bolt after installing, then use /login for the provider you need. Review third-party packages before installing them: extensions execute code.

The installer offers these three extensions; you do not have to accept them. Todo: opensec-pi-todo. Subagents: opensec-pi-subagents.

Tell your agent: “Set Pi to use +codemode and only mode.” Here is what that means in ~/.pi/agent/settings.json:

{
  "defaultTools": [
    "+codemode"
  ],
  "codemode": {
    "mode": "only"
  }
}

+codemode adds codemode without removing the default tools. only hides direct tool declarations so the model calls tools through JavaScript orchestration instead.

Preserve existing settings and tool selections. Use /reload after changes, or restart the session. Codemode is orchestration, not an extra security boundary.

Your global instructions belong in ~/.pi/agent/AGENTS.md. Ask the agent to append these rules while preserving what is already there.

## Code lookup
Prefer pi-fff: fffind for paths, ffgrep for content.
Results are ranked and capped. Paginate or use rg to confirm exhaustive results.

## Skills
Always use npx skills to manage skills.
Always pass -a pi when adding skills.
Check installed skills for the project's technologies and apply relevant ones.
Review unfamiliar skills before running their scripts.

## Tool orchestration
Use codemode to batch independent calls with Promise.allSettled,
chain dependent calls, and filter large output before returning it.

Then ask for skills in plain English.

“Install the relevant Astro skills for Pi.” The agent should use npx skills to discover and manage them, with -a pi when adding them. You don’t need to repeat your preference in every project.

npx skills list -a pi

The skills CLI uses Node.js/npm. That is separate from Pi-Bolt’s standalone runtime. Skills are instructions; review their source and any scripts they include.

Install Pi-Bolt and connect a model first. Then paste this into your agent. It is deliberately explicit about preserving your existing configuration.

Set up my Pi-Bolt workflow. Read my existing configuration first and preserve unrelated settings.

1. Check that pi-bolt is installed. Use pi-bolt, not pi, for all Pi commands.
2. Install npm:@gotgenes/pi-anthropic-auth if I need Anthropic authentication. Let me complete /login; never ask me to paste credentials into chat.
3. Install npm:opensec-pi-fff if it is not already installed. Do not install todo or subagents unless I request them.
4. Merge these settings into ~/.pi/agent/settings.json:
   "defaultTools": ["+codemode"]
   "codemode": { "mode": "only" }
   Preserve existing tool selections and other codemode options.
5. Add to ~/.pi/agent/AGENTS.md: Prefer pi-fff: fffind for file paths and ffgrep for content. Results are ranked and capped; paginate or confirm with rg when exhaustive results matter.
6. Add to that same file: Always use npx skills to manage skills. When adding skills, pass -a pi so they target Pi only. Inspect relevant installed skills and use them automatically.
7. If I use T3 Code, configure its Pi provider to launch the resolved absolute path of pi-bolt, not pi.
8. If I need MCP, inspect the installed version and existing setup first. This workflow uses npm:pi-mcp-adapter. Avoid configuring native MCP and the adapter as competing integrations. Add only the servers I request.
9. Verify the resulting configuration and explain any login or restart I must complete. Do not overwrite existing files wholesale.

This is an instruction, not an unattended installer. Provider login and any permission approvals still belong to you.