my-pi, nopeek and CityJS - April 2026

Right, so April was a lot. I gave a talk at CityJS, accidentally went all-in on my own coding agent harness, shipped nopeek, wrote five posts, and still kept the usual open source plates spinning. The month started with “I’m tired of Claude doxxing my secrets” and somehow ended with me using my own Claude Code alternative most days. Normal stuff. 😅

CityJS London

I spoke at CityJS London on the Svelte track with a talk called Pigeon-Driven Development. Rich Harris was in the room too, watching, engaged, and somehow interested in my waffling about AI in the trenches, which was only mildly terrifying. 😂 The talk was about using AI tools in practice without turning your workflow into a vibes-only liability: research first, plan with evidence, use skills deliberately, keep secrets out of transcript history, and make the harness work for you instead of around you.

The talk prep also became part of the work. I built and refined the slide system, added QR code helpers, wrote reusable slide design skills, and used the whole thing as another excuse to dogfood my-pi. Very on brand, honestly.

my-pi

The big one this month was my-pi, my opinionated coding agent harness built on top of Pi. This went from “nice local wrapper” to something I am actually using properly.

The headline bits: LSP tools (thanks for the nerd-snipe Kev!), local SQLite telemetry, redaction evals, prompt presets, managed skills, extension toggles, HTTP MCP support, session recall via pirecall, destructive action confirmations, headless defaults, and a bunch of security hardening around local MCP config, hooks, LSP binaries, child process environments, and oversized MCP output.

I wrote four posts about it:

• Add LSP to my-pi - wiring language-server diagnostics, symbols, references and hover info into the harness
• Add telemetry to my-pi - local SQLite telemetry for runs, turns, tool calls and evals
• Hardening redaction in my-pi with evals and telemetry - using fake-secret evals and recall scans to prove redaction was actually working
• Building my-pi: my own Claude Code alternative with Pi - the overview post on why I built it and what changed in my workflow

The funny bit is the posts are already a little out of date. Since writing them, I turned the add-ons I made for my-pi into proper Pi packages: LSP, telemetry, redaction, MCP handling, recall, and the little reminder shims for SQLite and Omnisearch. my-pi is still my opinionated harness, but the useful bits are now installable pieces other Pi users can take or ignore.

That last post has the bit I keep coming back to: with a closed harness you learn the quirks and route around them. With your own harness, the quirks become backlog items.

nopeek

I also shipped nopeek, a CLI for loading secrets into Claude Code sessions without putting the secret values into the conversation transcript.

The short version: Claude can know that $DATABASE_URL exists without ever seeing the value. It can use the environment variable in commands, but the key value stays out of model context and tool output.

Since the initial release I added .tfvars and .tfvars.json support, secure temp-file loading, persisted keys, stricter key validation, config directory permission hardening, template rendering for {{KEY}} placeholders, JSON-first output, and extra cloud CLI safety checks for AWS, Hetzner, GCP and Azure.

I wrote the longer version here:

• nopeek - Keep Your Secrets Out of Claude Code

check-skills

I also made check-skills, a vendor-neutral validator for portable Agent Skills against the open agentskills.io spec.

That came out of moving my skills out of the Claude-specific wrapper repos, claude-code-toolkit and svelte-skills-kit, and into spences10/skills as the canonical source. The wrapper repos can still exist for Claude Code distribution, but the actual skills are now vendor agnostic.

Open Source Bits

A few other things moved too:

• mcpick got vendor-neutral MCP client support, LLM-friendly help output, tests, CI, and a shell-injection fix by replacing exec with execFile
• ccrecall moved from Bun to Node + vite-plus, added --json, recall, enriched context, compact, and fixes for --session / --after filtering
• pirecall started taking shape as the Pi-side recall tool, so my my-pi sessions are searchable in the same way my Claude Code sessions are with ccrecall
• sveltest got more LLM-friendly docs/API access, a citty-powered CLI, remote function helper examples, and a vite-plus migration
• sveltekit-github-stats got a dashboard refresh and Cloudflare deployment work

Also lots of dependency churn, skill syncing, and general toolchain cleanup. The glamorous stuff, obviously.

Blog Posts

Five posts this month:

• nopeek - Keep Your Secrets Out of Claude Code
• Add LSP to my-pi
• Add telemetry to my-pi
• Hardening redaction in my-pi with evals and telemetry
• Building my-pi: my own Claude Code alternative with Pi

Fin

So yeah, not a quiet one. CityJS was great, nopeek is already useful, and my-pi has crossed the dangerous line from experiment to default habit. If you want to poke around any of it, the repos and posts are linked above, or come say hi on Bluesky. Thanks for reading!