
Research
Trivy Under Attack Again: Widespread GitHub Actions Tag Compromise Exposes CI/CD Secrets
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.
@howaboua/pi-codex-conversion
Advanced tools
Codex-oriented tool and prompt adapter for pi coding agent
Codex-oriented adapter for Pi.
This package replaces Pi's default Codex/GPT experience with a narrower Codex-like surface while staying close to Pi's own runtime and prompt construction:
exec_command, write_stdin, apply_patch, view_image, and native OpenAI Codex Responses web_search on openai-codex
[!NOTE] Native OpenAI Codex Responses web search runs silently. Pi does not expose native web-search usage events to extensions, so the adapter shows a one-time session notice instead of per-search tool-call history.
When the adapter is active, the LLM sees these tools:
exec_command — shell execution with Codex-style cmd parameters and resumable sessionswrite_stdin — continue or poll a running exec sessionapply_patch — patch toolview_image — image-only wrapper around Pi's native image reading, enabled only for image-capable modelsweb_search — native OpenAI Codex Responses web search, enabled only on the openai-codex providerNotably:
read, edit, or write tool in adapter modeexec_commandapply_patchparallel; the prompt is written to tolerate that instead of assuming a fixed four-tool universesrc/index.ts — extension entrypoint, model gating, tool-set swapping, prompt transformationsrc/adapter/ — model detection and active-tool constantssrc/tools/ — Pi tool wrappers, exec session management, and execution renderingsrc/shell/ — shell tokenization, parsing, and exploration summariessrc/patch/ — patch parsing, path policy, and executionsrc/prompt/ — Codex delta transformer over Pi's composed prompttests/ — deterministic unit testsnpm run typecheck
npm test
npm run check
rg -n foo src -> Explored / Search foo in srcrg --files src | head -n 50 -> Explored / List srccat README.md -> Explored / Read README.mdexec_command({ cmd: "npm test", yield_time_ms: 1000 }) may return session_id, then continue with write_stdinwrite_stdin({ session_id, chars: "" }) renders like Waited for background terminalwrite_stdin({ session_id, chars: "y\\n" }) renders like Interacted with background terminalview_image({ path: "/absolute/path/to/screenshot.png" }) is available on image-capable modelsweb_search is surfaced only on openai-codex, and the adapter rewrites it into the native OpenAI Responses type: "web_search" payload instead of executing a local function toolRaw command output is still available by expanding the tool result.
pi install npm:@howaboua/pi-codex-conversion
Local development:
pi install ./pi-codex-conversion
Alternative Git install:
pi install git:github.com/IgorWarzocha/pi-codex-conversion
The adapter does not build a standalone replacement prompt anymore. Instead it:
Guidelines sectionThat keeps the prompt much closer to pi-mono while still steering the model toward Codex-style tool use.
gpt* and codex* models.view_image resolves paths against the active session cwd and only exposes detail: "original" for Codex-family image-capable models.web_search is exposed only for the openai-codex provider and is forwarded as the native OpenAI Codex Responses web search tool.apply_patch paths stay restricted to the current working directory.exec_command / write_stdin use a custom PTY-backed session manager via node-pty for interactive sessions.\r, \b, erase-in-line, and common escape cleanup) so interactive redraws replay sensibly.MIT
FAQs
Codex-oriented tool and prompt adapter for pi coding agent
We found that @howaboua/pi-codex-conversion demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.

Security News
ENISA’s new package manager advisory outlines the dependency security practices companies will need to demonstrate as the EU’s Cyber Resilience Act begins enforcing software supply chain requirements.

Research
/Security News
We identified over 20 additional malicious extensions, along with over 20 related sleeper extensions, some of which have already been weaponized.