opensec-pi-todo is OpenSec's build of @juicesharp/rpiv-todo for Pi-Bolt, Pi compiled ahead of time on Bun.

• It ships as a prebuilt bundle with no runtime dependencies, and is localized without extra packages.
• It caches its configuration and reports problems once, in Pi's UI.

Install

pi-bolt install npm:opensec-pi-todo

• The Pi-Bolt installer offers to install it for you.
• After installing, restart Pi-Bolt or run /reload.
• Update it with pi-bolt update --extensions, and remove it with pi-bolt remove npm:opensec-pi-todo.

Requirements

• Pi-Bolt 0.6 or later (Pi 1.0), or Pi run by Bun 1.3 or later.
• This build runs on Bun only. For Pi on Node, use @juicesharp/rpiv-todo.
• Install one of the two, not both: they register the same todo tool.
• The panel and /todos need an interactive session. Headless runs still get the todo tool.

Features

• The plan stays on screen. A panel above the editor shows every task with a status glyph, the label of the task in progress, and a Todos (done/total) heading.
• Tasks survive /reload and compaction. Each tool call carries the full list after the change, and the list is replayed from the session. Nothing is written to disk.
• Finished work gets out of the way. When every task is done, the panel closes as soon as the model stops. A list with work left keeps its completed rows until your next prompt, then drops them. Compaction, /reload and resuming a session do not bring finished tasks back.
• Forgotten tasks get noticed. If the model leaves a task in progress, or stops updating the list for a few turns, its next request carries a short reminder of the open tasks. The reminder is not saved in the session.
• The panel never takes over the terminal. Past its row budget it hides completed tasks first, and says what it hid: +3 more (2 completed, 1 pending).
• The model can sequence work. blockedBy dependencies are validated before anything is written: dangling ids, deleted dependencies, self-blocks and cycles are rejected.
• Parallel sessions stay separate. Task state is kept per session, so a child session cannot read or overwrite the foreground list.
• Localized. Nine locales ship with the package. The locale comes from ~/.config/rpiv-i18n/locale.json, then LANG / LC_ALL, then English.

Usage

| Tool / command | What it does | |---|---| | todo | The model's tool for adding and updating tasks. | | /todos | Prints the full list, grouped by status. | | ctrl+shift+t | Collapses the panel to its heading and a one-line hint, and expands it again (configurable). |

Run /todos to check that the extension is loaded. A new session prints No todos yet. Ask the agent to add some!.

Then ask for something with several steps, for example "add a repository layer with tests, and track it as todos". The model calls todo, and the panel appears above the input box and updates as the work moves on.

Configuration

Optional. Create ~/.config/rpiv-todo/config.json, or $XDG_CONFIG_HOME/rpiv-todo/config.json if that variable is set:

{
  "maxWidgetLines": 8,
  "collapseKey": "alt+t",
  "staleReminder": false
}

| Setting | Default | Meaning | |---|---|---| | maxWidgetLines | 12 | Rows the panel may use, heading included. Minimum 3. | | collapseKey | "ctrl+shift+t" | The key that collapses and expands the panel, in Pi's keybinding form. "off" registers none. Needs /reload. | | staleReminder | true | Reminds the model of open tasks it has stopped updating. false turns the reminder off. | | guidance | built in | Replaces the instructions the extension gives the model about using the todo list. Needs /reload. |

A missing or malformed file falls back to these defaults. The extension only reads this file.

More detail: the todo tool, configuration, and the panel and /todos.

How this build is packaged

The package holds two files and the locales/ directory:

• dist-bun/index.js is a small ESM entry that Pi loads.
• dist-bun/core.cjs is the extension itself, as readable CommonJS that Bun loads natively, fresh on every load.

Pi never has to transpile the extension, and /reload or an upgrade re-evaluates it.

Changes from upstream

Based on @juicesharp/rpiv-todo 2.12.0. The tool name and schema, /todos, the panel, the config file and the session format are unchanged.

• Ships as a prebuilt bundle instead of TypeScript sources. @juicesharp/rpiv-config and @juicesharp/rpiv-i18n are bundled in, so it has no runtime dependencies.
• Localization works without installing @juicesharp/rpiv-i18n separately. An installed rpiv-i18n extension (/languages, --locale) still controls it.
• The panel no longer reads and parses the config file on every render; it is cached until the file changes.
• Config and panel warnings are shown once, through Pi's notifications, instead of being printed on every frame.
• The panel closes reliably once the work is done (2.13.1). Upstream hides a completed task only if the panel drew it and the next prompt starts, so a finished list stayed open after the run, a collapsed panel never dropped its completed tasks, and compaction or /reload brought them back. Hiding is now decided from the task list at run boundaries, and the model is reminded of tasks it left open.

License

Copyright 2026 OpenSec. Licensed under the Apache License, Version 2.0.

Based on @juicesharp/rpiv-todo by juicesharp (MIT). The bundle includes @juicesharp/rpiv-config and @juicesharp/rpiv-i18n (MIT). Their notices are in NOTICE.