
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
Pi coding agent extension for memory with qmd-powered semantic search across daily logs, long-term memory, and scratchpad
Memory extension for pi with semantic search powered by qmd.
Thanks to https://github.com/skyfallsin/pi-mem for inspiration.
Persistent memory across coding sessions — long-term facts, daily logs, and a scratchpad checklist. Core memory works as plain markdown files. Optional qmd integration adds keyword, semantic, and hybrid search across all memory files, plus automatic selective injection of relevant past memories into every turn.
# Install from npm (recommended)
pi install npm:pi-memory
# Install from local checkout
pi install ./pi-memory
# Optional (enables `memory_search` + selective injection, requires Bun)
command -v qmd >/dev/null 2>&1 || bun install -g https://github.com/tobi/qmd
Or copy to your extensions directory:
cp -r pi-memory ~/.pi/agent/extensions/pi-memory
When qmd is installed, the extension automatically creates the pi-memory collection and path contexts on first session start.
Note: memory_search semantic/deep modes require vector embeddings. If you see a warning like “need embeddings”, run qmd embed once and retry.
If you prefer manual setup:
qmd collection add ~/.pi/agent/memory --name pi-memory
qmd context add /daily "Daily append-only work logs organized by date" -c pi-memory
qmd context add / "Curated long-term memory: decisions, preferences, facts, lessons" -c pi-memory
qmd embed
Without qmd, all core tools (write/read/scratchpad) work normally. Only memory_search and selective injection require qmd.
| Tool | Description |
|---|---|
memory_write | Write to MEMORY.md (long-term) or daily log |
memory_read | Read any memory file or list daily logs |
scratchpad | Add/done/undo/clear/list checklist items |
memory_search | Search across all memory files (requires qmd) |
| Mode | Speed | Method | Best for |
|---|---|---|---|
keyword | ~30ms | BM25 | Specific terms, dates, names, #tags, [[links]] |
semantic | ~2s | Vector search | Related concepts, different wording |
deep | ~10s | Hybrid + reranking | When other modes miss |
If the first search doesn't find what you need, try rephrasing or switching modes.
~/.pi/agent/memory/
MEMORY.md # Curated long-term memory
SCRATCHPAD.md # Checklist of things to fix/remember
daily/
2026-02-15.md # Daily append-only log
2026-02-14.md
...
Before every agent turn, the following are injected into the system prompt (in priority order):
Total injection is capped at 16K chars. When qmd is unavailable, step 3 is skipped and the rest works as before.
When qmd is available, the extension automatically searches memory using the user's prompt before each turn. The top 3 keyword results are injected alongside the standard context. This surfaces relevant past decisions, preferences, and notes — even from daily logs older than yesterday — without the agent needing to explicitly call memory_search.
The search has a 3-second timeout and fails silently. If qmd is down or the query returns nothing, injection falls back to the standard behavior.
Use #tags and [[wiki-links]] in memory content to improve searchability:
#decision [[database-choice]] Chose PostgreSQL for all backend services.
#preference [[editor]] User prefers Neovim with LazyVim config.
#lesson [[api-versioning]] URL prefix versioning (/v1/) avoids CDN cache issues.
These are content conventions, not enforced metadata. qmd's full-text indexing makes them searchable for free.
When the context window compacts, the extension automatically captures a handoff entry in today's daily log:
<!-- HANDOFF 2026-02-15 14:30:00 [a1b2c3d4] -->
## Session Handoff
**Open scratchpad items:**
- [ ] Fix auth bug
- [ ] Review PR #42
**Recent daily log context:**
...last 15 lines of today's log...
This ensures in-progress context survives compaction and is visible in the next turn (via today's daily log injection).
qmd update runs in the background (fire-and-forget, non-blocking) unless disabled via PI_MEMORY_QMD_UPDATE.qmd embed once and retry.memory_search returns install instructions.| Variable | Values | Default | Description |
|---|---|---|---|
PI_MEMORY_QMD_UPDATE | background, manual, off | background | Controls automatic qmd update after writes |
PI_MEMORY_NO_SEARCH | 1 | unset | Disable selective injection (for A/B testing) |
# Unit tests (no LLM, no qmd — fast, deterministic)
bun test/unit.ts
# End-to-end tests (requires pi + API key, optionally qmd)
bun test/e2e.ts
# Recall effectiveness eval (requires pi + API key + qmd)
bun test/eval-recall.ts
# Pin provider/model for cheaper eval runs
PI_E2E_PROVIDER=openai PI_E2E_MODEL=gpt-4o-mini bun test/eval-recall.ts
# Multiple runs for statistical robustness
EVAL_RUNS=3 bun test/eval-recall.ts
All tests back up and restore existing memory files.
| Level | File | Requirements | What it tests |
|---|---|---|---|
| Unit | test/unit.ts | None | Context builder, truncation, handoff, scratchpad parsing |
| E2E | test/e2e.ts | pi + API key | Tool registration, write/recall, scratchpad lifecycle, search |
| Eval | test/eval-recall.ts | pi + API key + qmd | Recall accuracy with vs without selective injection |
This is a single-file extension (index.ts). No build step required — pi loads TypeScript directly.
# Test with pi directly
pi -p -e ./index.ts "remember: I prefer dark mode"
# Verify memory was written
cat ~/.pi/agent/memory/MEMORY.md
# Confirm package name is available
npm view pi-memory
# Bump version (choose patch/minor/major)
npm version patch
# Publish to npm (public)
npm publish --access public
# Verify install
pi install npm:pi-memory
PI_MEMORY_DIR so memory storage can be redirected from the default ~/.pi/agent/memory path.0.3.6.pi-memory collection and path contexts on session start when qmd is available. No manual qmd collection add needed.memory_write and context injection now encourage #tags and [[wiki-links]] as searchable content conventions.session_before_compact automatically writes a handoff entry to today's daily log with open scratchpad items and recent context, preserving in-progress state across context compaction.PI_MEMORY_NO_SEARCH env var: Disable selective injection for A/B testing.test/unit.ts with 18 deterministic tests (no LLM/qmd needed).test/eval-recall.ts for measuring recall effectiveness with/without selective injection.memory_write, memory_read, scratchpad, memory_search tools.qmd update after writes.FAQs
Pi coding agent extension for memory with qmd-powered semantic search across daily logs, long-term memory, and scratchpad
We found that pi-memory demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.