PI-Desktop puts agent secrets behind a Rust process

PI-Desktop splits an agent app into two processes instead of one. The React renderer has no Node access at all. A separate Rust process owns permissions, the filesystem, SQLite, and secrets, and runs the pi agent loop as a sidecar. The UI talks to that process over a boundary it can't cross on its own.

That's the design decision worth paying attention to if you're building or picking one of these tools. Keeping secrets in a process the renderer can't reach means a bug or compromised dependency in the UI layer can't read those secrets or write to disk directly, because the renderer never had that access to begin with.

The app ships three modes: Agent for direct action, Plan for changes gated behind approval, and Goal for longer-running work. It's model-agnostic, working with any OpenAI-compatible endpoint including local Ollama setups, so the isolation isn't tied to one vendor's API.

The repo is LGPL-3.0 with 2,602 stars total, and its git history goes back to 2023, older than the current product built on top of it. The 624-star day is a spike on an existing project, not a new repo's launch. The repo doesn't say how the Rust sidecar gets sandboxed at the OS level, so the real test is whether that process boundary holds up once someone tries to break it from the renderer side.