# Hosted-runtime limitations

Know which Pi extension capabilities are supported, bounded, or not exposed by Salambo.

Salambo hosts customer extensions inside the sandbox and exposes a deliberate subset of Pi through an authenticated boundary.

## Current boundaries

| Area                  | Current hosted behavior                                                                                                     |
| --------------------- | --------------------------------------------------------------------------------------------------------------------------- |
| Module format         | TypeScript, ESM JavaScript, files, directories, globs, and supported Pi package resources                                   |
| Pi type package       | Use `@earendil-works/pi-coding-agent@0.83` as a development or peer dependency                                              |
| Build                 | Depot transpiles TypeScript and preserves source maps; run your own semantic typecheck in CI                                |
| Filesystem            | Extension code runs in the sandbox and can use the agent workspace; protected runtime paths remain platform-owned           |
| Worker access         | No access to trusted worker process memory                                                                                  |
| Context               | A read-only, JSON-safe session, model, tool, usage, system-prompt, and external-event projection                            |
| Tool execution        | Progress and cancellation follow the Pi 0.83 tool contract                                                                  |
| Commands              | `pi.exec()` uses the same sandbox filesystem, cancellation, and command policy as built-in tools                            |
| Models and tools      | Server-safe selection is supported and restored for durable follow-ups                                                      |
| Providers             | Declarative provider registration is supported; executable transports and OAuth factories are not                           |
| Interactive Pi client | Commands, shortcuts, flags, renderers, terminal UI, editor methods, and session-tree navigation are not hosted product APIs |

## Discovery is not execution

Depot builds an immutable extension artifact without executing its factory. The factory executes once in the sandbox sidecar for each hosted session. Runtime-only operations such as `setModel()` and `setActiveTools()` belong inside handlers.

## Multiple mutating handlers

The host executes handlers sequentially, but different hook families compose differently. Prefer a single owner for each mutating event and test ordering explicitly before relying on multiple extensions changing the same event.

## Compatibility rule

Use the generated [Hosted Pi compatibility profile](/docs/reference/extensions/hosted-pi-compatibility) as the exact contract. Pi CLI commands and interactive terminal behavior remain local-only unless the profile says otherwise.