A terminal coding agent you can run with your own provider key — or with Vinci's managed
service.
Same guard rails either way.
Vinci Code is a distribution of Pi — a thin fork of the
Pi agent harness (MIT) by
Mario Zechner, maintained under
SimpleDirect® by Alpine Pacific Trading Inc. Pi's engine
and packages are kept intact; Vinci adds an additive layer on top. Provenance, including the
exact upstream commit this forked from, is in UPSTREAM.md.
That is one unedited turn on a user's own key — the header reads Anthropic: Claude Haiku 4.5
and /login to connect, because no Vinci account is involved. It ends the way every turn here
ends: with what was actually verified, what was not, and what it cost.
flowchart LR
You["your terminal"] --> Guard
subgraph Local["on your machine — identical in both modes"]
direction LR
Guard[guard] --> Mask[secret redaction] --> Agent[agent loop]
Agent -.-> Receipts[("receipts<br/>checkpoints<br/>review")]
end
Agent -->|BYOK| Provider["your provider<br/>Anthropic · OpenAI · Google · Groq"]
Agent -->|Managed| Gateway["Vinci gateway"] --> Managed["a model Vinci selects"]
style Provider fill:#0A84FF,color:#fff
style Gateway fill:#6C3483,color:#fff
In BYOK the right-hand Vinci path does not exist — your key and your prompts go straight to your provider, and Vinci's servers are not involved. Everything in the grey box runs locally and is the same either way.
| Direct / BYOK | Managed | |
|---|---|---|
| Vinci account | not required | required |
| Provider | you choose | Vinci selects |
| Your API key | stored locally; sent only to your provider, never to Vinci | you have none |
| Vinci sees your prompts | no | yes, in transit |
| Guard · receipts · checkpoints · review | ✅ | ✅ |
| Capability | Status | What it does |
|---|---|---|
| Command guard | Shipped | Classifies destructive operations and confirms before running them |
| Secret redaction | Shipped | Masks credentials before the terminal, diffs, previews, and /feedback + /issue egress |
| Honest terminal states | Shipped | A run blocked awaiting permission says so, instead of reporting a read-only success |
| Checkpoints | Shipped | Durable recovery points you can roll back to |
| Review / accept | Shipped | A workflow for inspecting and accepting agent output |
| Sandbox | Shipped | Bounded execution for agent-run commands |
| BYOK | Shipped | Any Pi-supported provider, with every guard above still active |
The first row is the one worth seeing rather than taking on trust. Asked to delete a directory
with rm -rf, it names the classification, prints the exact command it would run, and waits —
with no selected. The directory in this capture still had all four files in it afterwards.
Layout, the branch model, and the patch inventory: vinci/README.md.
vinci-code-cli/
├── packages/ # upstream Pi — kept intact
│ ├── ai/ # unified multi-provider LLM API
│ ├── agent/ # agent runtime: tool calling and state
│ ├── coding-agent/ # the coding agent CLI
│ ├── tui/ # terminal UI with differential rendering
│ └── orchestrator/ # multi-agent orchestration
├── vinci/ # the Vinci layer — almost everything Vinci is here
│ ├── extensions/ # guard, receipts, checkpoints, review, crew, …
│ ├── updater/ # signed update client and pinned public key
│ ├── themes/ # vinci-dark, vinci-light
│ ├── assets/ # logomark, lockup, demo captures
│ ├── docs/ # architecture, persistence, verification, environment
│ ├── test/ # integration harness for the Vinci layer
│ └── release-notes/ # mirrored to the public releases repository
├── scripts/ # repo tooling: checks, release, shrinkwrap
└── .github/workflows/ # CI, tests, benchmarks, signed release
Everything under packages/ is upstream Pi. Everything Vinci adds lives in vinci/, plus a
small number of vinci-* files inside packages/. That seam is what keeps upstream syncs
cheap, and it is the first thing to know before contributing.
Extension-by-extension detail, the patch inventory and the branch model → vinci/README.md
| Requirement | Minimum |
|---|---|
| Node | 22.19+ |
| OS | macOS or Linux |
| Sandbox | sandbox-exec (built into macOS) · bubblewrap (Linux) |
| Provider key | Any Pi-supported provider, for BYOK mode |
# From source — the path this repository supports (Node 22.19+)
git clone https://github.com/getsimpledirect/vinci-code-cli
cd vinci-code-cli
npm install && bash vinci/build.sh
./vinci/bin/vinci# Or the signed release (installs the built binary and self-updates)
curl -fsSL https://vinci.getsimpledirect.com/install | shThere is no
vincinpm package. The npm packages in this repo are upstream Pi's (@earendil-works/*, binarypi) — installing those gives you Pi, not Vinci Code.
Nothing to configure. Install it, run it, pick a provider:
./vinci/bin/vinci
/login # pick Anthropic, OpenAI, Google, Groq, … or Vinci
/model # pick a model — foreign ones show their exact id and a provider badge/login asks how you want to authenticate before it asks who with. "Use an API key" lists every
provider Pi supports — 33 of them at the time of writing — each marked unconfigured until you
add a key. A Vinci account is one of the options, never a prerequisite.
Providers are visible before you configure anything — on a fresh checkout --list-models already
lists other providers' models next to Vinci's own classes, which simply sort first:
No account, no environment variable, no sign-up. Vinci's own classes are offered first, so
signing in to Vinci stays one keystroke away if you want managed inference — but nothing makes
you. Credentials are stored by Pi in ~/.pi/agent/auth.json. Vinci Code adds no second credential
store, and your key is sent only to the provider you picked — authenticating to them requires
it — and never to Vinci.
Want the lean, Vinci-only view back? VINCI_SHOW_OTHER_PROVIDERS=0, or showOtherProviders: false in settings.
These are the commands /help lists in a session:
/login Connect to Vinci
/logout Disconnect from Vinci
/model Choose which Vinci model to use
/new Start a fresh conversation
/resume Pick up an earlier conversation
/undo Undo the last changes Vinci made to your files
/usage See this task's model calls, tokens, and cost
/security Show Vinci's active confidentiality and sandbox controls
/support Get help and support
/feedback Send private feedback without uploading your transcript
/issue Report a bug or request a feature on the public tracker
/hotkeys Keyboard shortcuts
The Vinci layer adds more on top of these — /review, /checkpoint, /plan, /todo,
/crew and others come from the extensions in vinci/extensions/.
| Variable | Effect |
|---|---|
VINCI_SHOW_OTHER_PROVIDERS=0 |
Hide the other providers and go back to the lean, Vinci-only view. The full catalogue is shown by default — this is an opt-out, not an opt-in. |
VINCI_PROVIDER |
vinci (default) or openrouter |
VINCI_MODEL |
With VINCI_PROVIDER=vinci: auto (default), forte, or fortissimo. auto resolves server-side to your account's class. With openrouter: a full vendor/model id. |
VINCI_NO_SANDBOX=1 |
Disable the sandbox. A development escape hatch — it removes a real safety boundary. |
VINCI_ISSUE_REPO_URL |
Override where /issue files reports |
Full extension list and behaviour → vinci/README.md
| Document | What it covers |
|---|---|
vinci/README.md |
The Vinci layer in detail — extensions, layout, branch model |
vinci/PRIVACY.md |
Exactly what leaves your machine, in each mode |
SECURITY.md |
Reporting a vulnerability; known limits |
UPSTREAM.md |
Fork provenance and how to sync with Pi |
CONTRIBUTING.md |
How to contribute |
SUPPORT.md |
Where to take a bug, a question, or a billing issue |
CODE_OF_CONDUCT.md |
Expected conduct, and how to report a concern |
Releases are tagged vinci-v* and published on this repository.
Signing happens in a private repository, because the AWS release role is deliberately not reachable from a public one. So a release is cut there and mirrored here: the tarball attached to a release is downloaded from the published URL and its checksum compared against the signed manifest before it is uploaded. Where the two could ever disagree, the manifest is the authority — it is what the installer actually verifies.
| What you want | Where it is |
|---|---|
| What version am I running | vinci --version — nothing is pinned in these docs, so it cannot go stale |
| What changed | the releases page, and vinci/release-notes/ |
| The build itself | the installer above, which verifies a signed manifest and its sha256 |
| Bug reports and questions | SUPPORT.md |
main here is the source for the current release. It is published as a fast-forward, so an
open pull request against it stays open.
Actively maintained by a small team. Security fixes go to the latest release only — there is no LTS branch. APIs and settings may change before 1.0. Issues and pull requests are welcome.
Security reports: SECURITY.md. Report the format of a missed
credential, never a live key.
Read CONTRIBUTING.md before opening a PR. Most of packages/ is
upstream Pi, so the first question is whether a change belongs here or upstream — sending an
engine fix only to us means Pi's users never get it, and we carry the patch forever.
AGENTS.md carries the engineering rules for this codebase and applies to humans
as well as agents.
MIT, throughout — see LICENSE.
- Upstream Pi is © 2025 Mario Zechner, MIT. That notice is preserved verbatim.
- Vinci's modifications are © 2026 Alpine Pacific Trading Inc., under the same MIT grant.
- Third-party notices:
THIRD_PARTY_NOTICES.md. - "Vinci" and "SimpleDirect" are trademarks of Alpine Pacific Trading Inc.; the code grant
conveys no trademark rights. See
TRADEMARKS.md— if you fork and ship this, rename it.
There is no separately-licensed or source-available tier in this repository. Everything here is MIT.