
Security News
/Research
Fake Corepack Site Distributes Infostealer and Proxyware to Developers
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.
pi-git-delegate
Advanced tools
Pi extension: delegate git operations (diff/log/blame) to cheaper models via subagents, saving costs and keeping parent context clean.
Delegate git operations (diff/log/blame) to cheaper models via subagents — keeping parent context clean and cutting costs.
Pi Git Delegate provides typed tools that internally delegate heavy git read operations (diff, log, blame) to subagents. The subagent processes the raw git output and returns only a concise summary to the parent session. This prevents large diffs from polluting the parent's context window and lets you route expensive operations to cheaper models.
The cost leverage principle: delegate only when input is large and output is small.
| Operation | Delegation | Why |
|---|---|---|
git diff (→ summary) | ✅ Delegate | Diff is large (1000+ tokens), summary is tiny |
git log (→ changelog) | ✅ Delegate | Many commits → compact digest |
git blame (→ context) | ✅ Delegate | Full blame is verbose; what matters is who/when/why |
git status | ❌ Direct | Output is tiny; subagent overhead not worth it |
git push / git commit | ❌ Direct | Write operations stay in parent for safety |
git_diff_summary — delegate git diff to a subagent, return a 1-3 sentence summarygit_log_summary — delegate git log range, return a structured digestgit_blame_summary — delegate git blame, return who changed what and whyprovider and model per tool in .pi/settings.json (null uses the session defaults)/git-delegate:configure — interactive help for writing the settings block/git-delegate:status — show current model routing and example JSONpi install npm:pi-git-delegate
Install locally (project-scoped):
pi install npm:pi-git-delegate -l
Try without installing:
pi -e .
After installing (see above) or running pi -e . from this repo, call each tool in Pi:
git_diff_summary({ref: "HEAD~3"})
git_log_summary({range: "main..feature"})
git_blame_summary({path: "src/auth.ts"})
The tools are registered automatically — no extra setup required.
Model routing is optional. Run in Pi:
/git-delegate:configure
This shows what each key does, prints a starter JSON block, and can save it to .pi/settings.json interactively.
Check the current routing anytime with:
/git-delegate:status
Manual example for .pi/settings.json:
{
"pi-git-delegate": {
"diff": { "provider": "anthropic", "model": "claude-3-5-haiku-latest" },
"log": { "provider": null, "model": null },
"blame": { "provider": null, "model": null }
}
}
null means "use the current session provider/model".
Once installed, the tools are available automatically. Pi calls them via pi list.
git_diff_summary({ref: "HEAD~3"})
→ "feat: add avatar upload with resize (3 files, 2 commits)"
git_log_summary({range: "main..feature"})
→ "3 commits: feat(avatar), fix(crop), chore(deps)"
git_blame_summary({path: "src/auth.ts"})
→ "src/auth.ts: 3 authors, most recent by @alice (2026-06-01)"
| Path | Purpose |
|---|---|
extensions/ | Pi TypeScript extension entrypoints |
lib/ | Shared TypeScript helpers |
docs/ | Optional supporting docs |
npm install
npm run ci
This package is set up for npm Trusted Publishing, so no NPM_TOKEN is required.
npm version patch
git push
See docs/release.md for setup details.
docs/ is optional supporting documentation, not a fixed six-file set. README stays the GitHub/npm entrypoint; add docs/*.md only when they help users or maintainers.
docs/examples.md — tool usage examplesdocs/release.md — Trusted Publishing details (README Release summarizes the flow)ROADMAP.md — maintenance direction and bounded seed candidatesPi packages can execute code with your local permissions. Review extensions before installing third-party packages.
For vulnerability reporting, see SECURITY.md.
MIT
FAQs
Pi extension: delegate git operations (diff/log/blame) to cheaper models via subagents, saving costs and keeping parent context clean.
We found that pi-git-delegate demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Research
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.

Research
/Security News
A large-scale campaign abused GitHub Actions in compromised repositories to exploit CVE-2026-41940 in cPanel and WHM and steal server credentials.

Security News
Five frontier LLMs generated the same nonexistent package names, leaving 53 available for potential slopsquatting across PyPI and npm.