
Security News
Socket Releases Free Certified Patches for Critical vm2 Sandbox Escape
A critical vm2 sandbox escape can allow untrusted JavaScript to break isolation and execute commands on the host Node.js process.
pi-side-chat
Advanced tools
Fork the current conversation into a side chat while the main agent keeps working.
pi install npm:pi-side-chat
https://github.com/user-attachments/assets/3a359f47-c706-46b9-8b16-d05f430d402c
You're in the middle of a longer task and want to ask something small without derailing the main thread — check an API detail, sanity-check an approach, search something, or peek at what the main agent is doing. Open the overlay, ask, close it. Main thread never gets interrupted.
Open side chat with Alt+/ or /side. Ask a question and press Enter.
Press Esc to close it. Reopen with Alt+/ to continue where you left off.
Toggle focus — Alt+/ switches between the side chat and main editor without closing the overlay.
Toggle mode — Ctrl+T switches between read-only and edit mode.
Start fresh — Alt+R re-forks from the latest main context. Alt+N starts a blank conversation.
Forks the conversation — Starts with a copy of the current branch context. All extension tools (web_search, fetch_content, etc.) are available. Does not write back to the main conversation history.
Persists across close/reopen — Closing preserves the conversation. Reopening restores it. Use Alt+R or Alt+N to explicitly start fresh.
Read-only by default — Safe for quick questions and code reading. Toggle to edit mode when you need write access.
| Mode | Tools |
|---|---|
| Read-only | read, grep, find, ls |
| Edit | read, bash, edit, write (with overlap warnings) |
File overlap warnings — If the side chat tries to modify a file the main agent has touched, it asks before proceeding.
Peek at the main agent — The peek_main tool reads recent activity from the main session.
What is the main agent doing right now?
What changed since I opened this side chat?
Non-capturing overlay — Leave it visible and switch focus back to the main editor. Opens at the top of the screen so the main editor stays visible underneath.
| Key | Action |
|---|---|
Alt+/ | Open side chat / toggle focus |
Enter | Send message |
Esc | Interrupt streaming, or close when idle |
Alt+R | Re-fork from latest main context |
Alt+N | Start empty conversation |
Ctrl+T | Toggle read-only / edit mode |
PgUp / Shift+↑ | Scroll up |
PgDn / Shift+↓ | Scroll down |
/sideOpens the side chat overlay.
peek_mainAvailable to the side agent only.
| Param | Type | Description |
|---|---|---|
lines | integer | Max items to inspect (default: 20, max: 50) |
since_fork | boolean | Only show activity after the side chat was opened |
Create a config.json next to the extension to change the shortcut:
{
"shortcut": "alt+/"
}
The extension clones the current session context, creates a separate agent instance with all extension-registered tools, and renders it in a TUI overlay. Closing saves the conversation in memory so reopening restores it.
Main-agent tool execution events are tracked to maintain a set of written file paths. In edit mode, write-capable tools are wrapped to warn before touching those paths.
peek_main reads the current session branch on demand and returns a compact summary.
peek_main is on-demand, not liveFAQs
Pi extension that forks the current conversation into a side chat
The npm package pi-side-chat receives a total of 54 weekly downloads. As such, pi-side-chat popularity was classified as not popular.
We found that pi-side-chat demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
A critical vm2 sandbox escape can allow untrusted JavaScript to break isolation and execute commands on the host Node.js process.

Research
Five malicious NuGet packages impersonate Chinese .NET libraries to deploy a stealer targeting browser credentials, crypto wallets, SSH keys, and local files.

Security News
pnpm 11 turns on a 1-day Minimum Release Age and blocks exotic subdeps by default, adding safeguards against fast-moving supply chain attacks.