
Security News
Agent Baseline Publishes Security Reference Architecture for Software Factories
Agent Baseline’s new reference architecture shows how to secure software factories with four boundaries enforced outside the AI agent.
Recursive Language Model (RLM) extension for Pi coding agent.
This extension adds an rlm tool that performs depth-limited recursive decomposition:
solve vs decomposeIt includes guardrails for depth, node budget, branching, and cycle detection.
pi install /path/to/pi-rlm
Or as a package:
pi install npm:pi-rlm
This package also ships a lightweight CLI wrapper:
pi-rlm --task "Analyze architecture of this repo" --mode auto --tools-profile read-only
Or with a positional task:
pi-rlm "Find top reliability risks in this codebase" --backend sdk --max-depth 3
Local shortcut from this repo:
npm run cli -- "Find top reliability risks in this codebase" --backend sdk --max-depth 3
JSON output:
pi-rlm "Summarize repo" --mode solve --json
Live tree visualization (TTY):
pi-rlm "Analyze architecture of this repo" --tools-profile read-only --live
Use current tmux session windows instead of a separate pi-rlm-<runId> session:
pi-rlm "Analyze architecture of this repo" --backend tmux --tmux-current-session
Notes:
op=start operation.pi CLI and loads this extension automatically.--live renders a real-time tree by reading events.jsonl while the run executes.src/cli.ts) and built with npm run build:cli (Node + tsc, no Bun runtime required).npm publish runs prepack, so the built CLI (bin/pi-rlm.mjs) is included in the published package.The extension registers one tool: rlm.
op=start (default)rlm({
task: "Implement auth refactor and validate tests",
backend: "sdk", // sdk | cli | tmux
mode: "auto", // auto | solve | decompose
tmuxUseCurrentSession: false,
maxDepth: 2,
maxNodes: 24,
maxBranching: 3,
concurrency: 2,
toolsProfile: "coding", // coding | read-only
timeoutMs: 180000,
async: false
})
op=statusrlm({ op: "status", id: "a1b2c3d4" })
If id is omitted, returns recent runs.
op=waitrlm({ op: "wait", id: "a1b2c3d4", waitTimeoutMs: 120000 })
op=cancelrlm({ op: "cancel", id: "a1b2c3d4" })
backend: "sdk" (default)pi CLI process per subcallbackend: "cli"pi -p subprocessbackend: "tmux"Default behavior:
pi-rlm-<runId>)depth-0, depth-1, ...)Optional behavior:
tmuxUseCurrentSession: true (or CLI flag --tmux-current-session) to place panes in the current tmux sessionrlm-depth-0, rlm-depth-1, ... in that current sessionGeneral:
pi process per subcallEach run writes artifacts to:
/tmp/pi-rlm-runs/<runId>/
events.jsonl
tree.json
output.md
maxDepth: recursion depth capmaxNodes: total node budgetmaxBranching: child count cap per decompositionop=cancel)npm install
npm run typecheck
FAQs
Recursive Language Model (RLM) extension for Pi coding agent
We found that pi-rlm demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Agent Baseline’s new reference architecture shows how to secure software factories with four boundaries enforced outside the AI agent.

Security News
arXiv now limits authors to two submissions a month as AI slop overwhelms moderators, delays good papers, and sparks debate over applying the limit to everyone.

Research
/Security News
A new GhostAction wave hits hundreds of GitHub repos, expanding CI/CD secret theft to cloud and AI credentials in source code and git history.