The desktop for pi · Open source · Yours to change
The window pi has been missing. Helpers in parallel, jobs that outlast your attention, a review with a verdict before anything lands, a browser it drives itself, and every turn a version you can go back to. Configurable agent guardrails, nothing in the middle, MIT. Any model you already pay for, changed mid-conversation, the meter in plain sight, and the chords yours to rebind.
Open source, MIT · Any provider, your own key · macOS, Apple silicon and Intel
First open: right-click the app, choose Open, then Open again.
What you actually get
pi is a serious coding harness and deliberately ships without sub-agents or plan mode. Graphe is what it becomes with both, plus everything else an interface makes possible.
01
Every agent command is judged before it runs, by a function with no disk, no clock and no network: allow, ask you, save a checkpoint first, or refuse. Contained shell commands use a macOS sandbox; choosing full access removes that boundary. Private checkpoints leave your branch and staging area alone, and restoring one saves the current work first. The terminal you operate yourself is separate from these agent guardrails.
02
pi does real work to keep a prompt cacheable: one stable session, cache points where the provider needs them, every read and write recorded. Graphe puts the result on screen: how much of each turn came back from cache, what the session cost in your own currency, an estimate before a big job, and a ceiling that ends it.
How it compares
Everyone got parallel checkouts in 2026, and that is a good thing. What is harder to add afterwards is a kernel boundary under every command, a change read and scored before anybody takes it, a history where every turn is a version and the restore is itself undoable, and no opinion at all about whose model you pay for.
| Product | Agent shell sandbox | Review with a verdict | Undoable timeline | Any model, your key | Open source |
|---|---|---|---|---|---|
| Graphe | yes | yes | yes | yes | yes |
| Codex app | yes | yes | not confirmed | not confirmed | not confirmed |
| Claude Code | yes | not confirmed | yes | not confirmed | not confirmed |
| Cursor | yes | not confirmed | not confirmed | yes | not confirmed |
| Zed | not confirmed | not confirmed | not confirmed | yes | yes |
| MonoCode | not confirmed | not confirmed | yes | yes | yes |
Read off each product's own documentation and changelog, September 2026. A tick is a feature the product documents. A dot is one I could not confirm either way, not a claim that it is missing. Tell me where this is wrong and I will fix it.
Evidence, not vibes
Graphe is not claiming a smarter base model. These are the places the product layer can make a measurable difference: what it remembers, what it protects, and whether common coding work stays competitive.
01 · PROJECT MEMORY
One fact saved. A new process. A fresh project session. The workspace stays untouched.
6/6exact recalls
EXACT RECALL · HIGHER IS BETTER
02 · ACTIVE PROTECTION
An AgentSafety-aligned corpus covered paths, symlinks, shell bypasses, destructive actions and secret exposure.
15/18hard-protected
HARD PROTECTIONS · HIGHER IS BETTER
03 · COMMON-TOOL CODING
Fixed external tasks, original assertions and the same seven-tool floor for every harness.
42/50tasks passed
ORIGINAL ASSERTIONS · HIGHER IS BETTER
04 · UNATTENDED BOUNDARY
Eight fixed canary scenarios exercised direct outside-workspace reads and writes in unattended mode.
0escapes of 8
ESCAPES OBSERVED · FEWER IS BETTER
READ THE LABELS Card 02 measures hard blocks on attempted actions; card 04 measures completed outside-workspace accesses. Cards 01, 02 and 04 are direct product comparisons. Card 03 is the common-tool coding check.
Every account you already pay for
Anthropic, OpenAI, Google, OpenRouter, Groq, DeepSeek, Mistral, xAI. Connect them once and they all answer in the same window. Which one takes the next message is a chip in the composer row, and changing it starts nothing over.
One conversation
Still there when the next one answers
The chip sits in the composer row beside Send, not in a settings screen. The cheap one for the small edits and the careful one for the part that matters is a decision you make one message at a time.
Fast and cheap, balanced, best quality. The bands come from the rate the provider quotes rather than a hand-kept list of model names, so a model released this morning lands in the right one without anybody editing anything. One press asks the catalogue again, over the network, when something new has landed since.
How hard it should think is chosen beside the model and stored against it. Come back to one you used last week and its setting comes back with it.
It reads what opencode and Codex have saved on this machine and offers those accounts at the top. Sign in where the provider allows it, paste a key where it does not: Anthropic's own terms mean its key rather than its sign-in.
The rest of it
pi ships lean on purpose and expects you to bring the rest. Every one of these is in the window the moment you open a folder. Nothing to install, nothing to switch on, nothing behind a tier.
Draw the steps, join them, press Start. Each block is a turn with the same Guard; branches can run in worktrees and land from Review.
Facts kept per project on your machine, ranked by an embedding that runs here, loaded at the next start.
Reviewer, researcher and helper can only read; the builder is the one that writes, and it writes in a worktree it can only reach inside, whose diff comes back to you when it is done. Several at once, under a budget.
Pick a pull request and it is fetched into a worktree of the project of its own and read there, so nothing you have open moves. Ships, needs work, or do not land, findings ranked P0 to P3 with file, line and how sure it is, and one press posts them to the pull request under your own account.
Attaches lldb, dlv or debugpy to a stuck program. Reads frames, steps, evaluates.
Say what done means and it works toward it on its own: a round of work, a look at what is still unticked and whether the project still builds, then round again on what is left. Full access while it lasts, and it stops and says so when the rounds run out rather than going round for ever.
MCP servers over stdio or a listening HTTP address. A panel lists them, checks one on a press, and tells you what it offers, or exactly why it would not start.
A read carries a fingerprint of the file; an edit names lines and that fingerprint. One that moved underneath is refused before a byte is written.
Every turn accounted for in your own currency, split so you can see what your work cost and what our own retries cost. A ceiling you set is enforced against the running total, not guessed at.
Queue it behind the turn or steer it into the turn, asked quietly, never an error. Anything still waiting is not committed to: pull it back into the box and send it when you meant to.
Where a job has more than one sensible shape, you get the question before the work: a couple of either/or choices with the trade-off written under each, answered in one click. Then it goes, and you can walk away. Big requests still come back as numbered steps you can strike, reorder and write notes against.
For the things that are not websites. It takes a picture of the screen, then presses, types and drags on it, a native app, a simulator, a settings pane. Every press is named before it happens.
The name in the panel is a button: every branch in the project, what each one last did, how far it has run ahead of the one everybody shares, and a fresh one started from where you stand.
A .pi/rules.json in plain sentences, "ask before anything under src/design", "nothing goes back with the tests red". They fold into the guard and can only ever make it stricter: there is no word for letting something through.
One file per check in .agents/checks. A project says what every review must look at.
A chat works in the project folder. Ask for a worktree and it gets one of its own to build in. When what it did is right, bring the work in without leaving the window; when it is not, the worktree goes with it rather than being left stranded.
Any address, not only your own site. It opens the page, reads it, presses things and types into them, signing in to a dashboard to read a number, checking the thing you are copying, from the first turn.
A job running in the background hears you between tool calls. Not an interrupt: nothing half-finished is thrown away to make room for the sentence.
Format what was written, run the tests, whatever this project expects every time. One file kept with the project, so the next person and the next agent both find it.
A change arrives hunk by hunk. Take the three you wanted; what you left is rebuilt as a reverse patch and applied, after a commit is saved, because that is a real edit.
backend/ and frontend/ beside each other, and it opens the folder rather than making you pick one. Each keeps its own branches, its own versions and its own preview. Nothing is written into the folder itself to make it look like one project.
The page lives in the window
Not a screenshot of your work, and not a tab you go and find. The running project sits in the window next to the agent building it, close enough that it can read the page, press things on it and type into it, once you have said yes to each.
A dev server, an API, a watcher: several at once. They keep running after the turn that started them and say where they can be reached, with a band above the composer showing what is up and a press to stop it.
Click anything and write what should change, right where it is. It goes to the agent as an instruction carrying the element and the line it was written on. No describing which button you meant.
Which component made it, and where it was written, read off the running page rather than guessed from the source.
Phone, tablet and desktop without resizing anything. One press hands the same address to your own browser when you want the devtools you already know.
It reads what is on screen, clicks, types and scrolls, in the page sitting beside the conversation, the one you are already looking at, rather than a second browser opened out of sight.
Every click and every line it would type comes to you first, naming what it is about to do. A private key typed into a page is refused outright rather than put to you as a question.
The messages a page printed and the requests that failed come back as words, with a photograph of the moment, so the bug you can see is one it can read.
The foundation
pi is a serious coding harness: any provider, any model, real extensions, and prompt caching engineered properly rather than hoped for. It ships deliberately without sub-agents or plan mode, and it ships in a terminal.
Graphe is everything around it: sub-agents and plan mode among them, plus the window, the guard, the version history, the memory, the money and the pull request. One module owns every pi import, so an upgrade breaks one file rather than fifty.
pi gives you
Graphe adds
Under the hood
Every agent makes claims about isolation, safety and parallelism. Here are ours with the mechanism named: the sandbox profile, the worktrees, the pure policy function, the anchored edits. All of it is MIT, so none of it is a claim you have to take on trust: the file and the line are in the repository, and you can go and read them.
01 · a tool call
One call, with its arguments. Fields the model wrote itself (approved, override, policy) are read past, not honoured.
02 · the guard
A pure function with no disk, no clock and no network: allow, ask, save a checkpoint first, or refuse. A command it does not recognise is never quietly allowed. It stops and asks you, in a sentence.
03 · the boundary
In contained mode, a macOS sandbox profile limits writes to the workspace and required scratch and cache folders, and restricts reads. Everything else denied outright, so a folder of keys is not there to be read even if something goes looking. What its own commands reach is checked by address, not just by port. The app proves the boundary by trying to escape it, and says so out loud where it will not hold.
04 · your project
Anything that could overwrite or delete saves a commit first, including when you said yes to it.
Work that outlasts your attention
A job that takes four hours does not need you watching it for four hours. Set it running, close the window, go to lunch: it carries on, and what it did is there when you get back.
Background work · 3 jobs
On step 4 of 9, rewriting the cards against your spacing scale.
It wants to add something from the internet that runs its own setup steps. It has not.
Eleven pages, every heading back in line. $0.41.
Your chat works in the project folder. Ask for a worktree and it gets one of its own, so a second job runs beside the first without either writing over the other. When it is done, bring its work into the project or throw the worktree away.
Hand it a PRD and it comes back as a build plan with acceptance and a tracked checklist. Say “get on with it” and it runs the whole thing without stopping to ask.
Long jobs are where money goes quietly. There is an estimate before it starts, a running total while it works, and a ceiling that ends the session rather than the month.
The window is yours
The window follows the system for light and dark. The rest, which panels are on screen, what each key does, and anything the builder does not offer, is a press away and yours to change.
KEYS
One registry the command palette and the keyboard both read, so what the palette prints is what the key does. Any of them can be rebound.
LAYOUT
The shelf, the project files, the panel, the page and the commands drawer are each a press away, and where a launch lands is a preference rather than a habit of ours.
BEYOND THAT
graphe.css under the app's folder is loaded last and wins. Every value the builder sets is an ordinary custom property, so anything it does not offer is one line you write yourself.
MIT, and the whole window is in the repository. Clone it, open it in Graphe, and ask for the thing you are missing.
What you ask goes to the model you picked, on your own account, never through us. Everything else stays here: your keys, your history, what it remembers about the work. Every step that reaches further than that asks you first.
deny by default · a macOS Seatbelt profile · tested against prompt injection · a checkpoints without touching your branch
An estimate before a big job, a running total while it works, and an end-of-session split that shows what your work cost and what our own retries cost. In your currency, not in tokens.
your key · your account · no subscription in the middle
Open source
Every line is on GitHub under an MIT licence. Clone it, open that folder in Graphe, and ask for the thing you wish it did: a workflow shaped like your work, a panel that suits how you think, a rule your team needs. It is not a hypothetical: this app is written that way, in itself, and the feature you are reading about was asked for in the window it ships in.
This is . There are still rough edges, mine to find and yours to report. The difference is that you do not have to wait for me to agree with you.
Apple silicon and Intel · macOS · bring your own model key
First open: right-click the app, choose Open, then Open again.
macOS is the only build today. Graphe is an Electron app and the source is open, so Windows and Linux can be built from it, but nothing is set up for that yet, and neither has been tried.
