Persist Pi state in the Flatpak

README.md

@@ -100,17 +100,21 @@ that app directory:
 | Inside the sandbox | Stored on the host | Contents | Mechanism |
 |---|---|---|---|
 | `~/.t3` | `~/.var/app/com.t3tools.t3code/.t3` | T3 Code settings, keybindings, threads (`state.sqlite`), login tokens, secrets, worktrees | `--persist=.t3` |
+| `~/.pi` | `~/.var/app/com.t3tools.t3code/.pi` | Pi settings, sessions, and provider credentials (including `agent/auth.json`) | `--persist=.pi` |
 | `~/.codex` | `~/.var/app/com.t3tools.t3code/.codex` | Codex CLI config and auth | `--persist=.codex` |
 | `~/.claude` | `~/.var/app/com.t3tools.t3code/.claude` | Claude Code config, including `.claude.json` | `--persist=.claude` + `CLAUDE_CONFIG_DIR` |
 | `~/.ssh` | `~/.var/app/com.t3tools.t3code/.ssh` | sandbox-local SSH configuration and verified `known_hosts`; not the host SSH directory | `--persist=.ssh` |
 | `$XDG_CONFIG_HOME/git/config` | `~/.var/app/com.t3tools.t3code/config/git/config` | `git config --global` settings | launcher creates the file so git prefers it over `~/.gitconfig` |
 | `$HISTFILE` | `~/.var/app/com.t3tools.t3code/.local/state/bash/history` | terminal shell history | launcher sets `HISTFILE` |
 | `$XDG_CONFIG_HOME`, `$XDG_DATA_HOME`, `$XDG_CACHE_HOME` | `~/.var/app/com.t3tools.t3code/{config,data,cache}` | Electron profile, OpenCode, npm globals and cache | Flatpak default |
 
-The app-specific state is separate from the host's `~/.t3`, `~/.codex`,
-`~/.claude`, `~/.ssh`, and `~/.gitconfig`. Host credential and tool directories
-are not exposed. If you grant `--filesystem=home`, Flatpak ignores `--persist`
-and uses the host home directly.
+The app-specific state is separate from the host's `~/.t3`, `~/.pi`,
+`~/.codex`, `~/.claude`, `~/.ssh`, and `~/.gitconfig`. Host credential and tool
+directories are not exposed. If you grant `--filesystem=home`, Flatpak ignores
+`--persist` and uses the host home directly. From a terminal opened on a
+project, `cd .pi` looks for a `.pi` directory inside that project; use
+`cd ~/.pi/agent` to inspect Pi's sandbox-local data. On the host, that data is
+stored under `~/.var/app/com.t3tools.t3code/.pi/agent`.
 
 T3 Code worktrees live under `~/.t3/worktrees` inside the sandbox. Host-side
 git sees those worktree paths as missing, so `git worktree prune` on the host

com.t3tools.t3code.yml

@@ -31,6 +31,7 @@ finish-args:
   # on exit. Map app state dirs that ignore XDG onto persistent app storage.
   # SSH configuration and known_hosts are app-private, not host mounts.
   - --persist=.t3 # T3 Code settings, state DB, auth tokens, secrets, worktrees
+  - --persist=.pi # Pi settings, sessions, and provider credentials
   - --persist=.codex # Codex CLI
   - --persist=.claude # Claude Code (startt3code points CLAUDE_CONFIG_DIR here)
   - --persist=.ssh # sandbox-local SSH configuration and verified host keys

docs/flatpak-security.md

@@ -8,9 +8,10 @@ not a security isolation boundary; its binaries and libraries inherit the
 application's effective filesystem, bus, network, and user override grants.
 
 Keep app state persistent using Flatpak's XDG app directories, and preserve
-`--persist=.t3`, `--persist=.codex`, `--persist=.claude`, and `--persist=.ssh` if the launcher
-and application require those paths. Allow individual projects by explicit
-per-directory overrides, not `home` or `host` defaults.
+`--persist=.t3`, `--persist=.pi`, `--persist=.codex`, `--persist=.claude`, and
+`--persist=.ssh` if the launcher and application require those paths. Allow
+individual projects by explicit per-directory overrides, not `home` or `host`
+defaults.
 
 For SSH remotes, prefer the documented
 [opt-in SSH-agent access](../README.md#optional-ssh-agent-access). It lets all

tests/check-ssh-boundary.sh

@@ -52,7 +52,9 @@ p.read(sys.argv[1])
 context = p['Context']
 sockets = context.get('sockets', '').split(';')
 assert 'ssh-auth' not in sockets, 'SSH agent must be opt-in'
-assert '.ssh' in context.get('persistent', '').split(';'), 'App-private SSH state must persist'
+persistent = context.get('persistent', '').split(';')
+assert '.ssh' in persistent, 'App-private SSH state must persist'
+assert '.pi' in persistent, 'App-private Pi credentials must persist'
 filesystems = context.get('filesystems', '').split(';')
 for grant in filesystems:
     path = grant.split(':', 1)[0]

tests/test_flatpak_security.py

@@ -72,6 +72,7 @@ def test_safe_yaml_and_app_private_persistence_remain_allowed(self):
             'finish-args:\n'
             '  - *network\n'
             '  - --persist=.ssh\n'
+            '  - --persist=.pi\n'
             '  - --persist=.codex\n'
             '  - --persist=.claude\n'
             '  - --persist=.t3\n'