---
title: MiniCPM5-2B Pi workspace experiment
emoji: 🥧
colorFrom: green
colorTo: blue
sdk: static
app_file: index.html
pinned: false
license: apache-2.0
short_description: Browser coding agent with local folders and HTTP
models:
  - openbmb/MiniCPM5-2B
  - Mike0021/MiniCPM5-2B-ONNX
tags:
  - transformers.js
  - webgpu
  - agents
  - pi
  - just-bash
---

# Pi browser workspace experiment

An independent duplicate of [victor/MiniCPM5-2B-WebGPU-Pi](https://huggingface.co/spaces/victor/MiniCPM5-2B-WebGPU-Pi) at revision `959e272adeb7931e32d3eb2177dc1d5e96c3e967`. The original Space is unchanged.

## Local folder experiment

The demo remains the default. In the [standalone app](https://mike0021-minicpm5-2b-webgpu-pi-http.static.hf.space/), choose **Link a folder**. The selected folder replaces `/workspace` in the existing file panel and agent tools. Edits from Pi, the Shell, and the editor are staged. **Review & apply → Apply to folder** shows a diff and requests write permission before saving to disk. **Back to demo** restores the demo files and conversation; **Reconnect folder** resumes the local session, including staged edits saved separately in browser storage.

This uses the File System Access API, available in supported Chromium browsers. The Hugging Face iframe offers a link to the standalone app because cross-origin frames cannot request folder permissions. Safari and Firefox retain the existing Import/Export workflow for copies of individual files; they cannot save directly to a selected folder.

Files load on demand. **Refresh** reloads names and content from disk and starts a fresh chat; apply or discard staged edits first. Application compares each changed file with the version originally read and stops on conflicts. Multi-file application is not atomic: on a write failure, applied files are reported and the remaining changes stay staged. Avoid editing the same files in another program during Apply.

Current bounds: 1 MiB per file, 16 MiB staged content and 16 MiB read baselines, 5,000 indexed entries, depth 40. `.git`, `node_modules`, `.venv`, and `__pycache__` are excluded. Create/edit/delete/rename files and create directories are supported. Removing/renaming existing directories, symlinks, hard links, Unix permissions and timestamp changes are unsupported. Paths outside `/workspace` remain temporary virtual files. Local folder access does not provide Node, Python, npm or native programs. HTTP commands still send explicitly requested URLs/data to external servers.

Implementation: `app/src/local-folder.mjs`, `local-folder-ui.mjs`, and the existing worker/workspace modules. Tests: `cd app && npm test`; with the preview server on port 4193, run `node tests/local-folder-browser.mjs`. See [local-folder validation](validation/LOCAL-FOLDER.md).

## HTTP experiment

MiniCPM5-2B inference and just-bash run in a browser worker. This copy adds real `curl` requests through browser `fetch`, with no backend or proxy. The first model download is about 1.84 GB, verified and cached locally. WebGPU with shader-f16 is required for inference; the Shell can run HTTP commands without loading the model.

Try in Shell:

```bash
curl -fsS https://jsonplaceholder.typicode.com/todos/1 -o todo.json
jq '{id, title, completed}' todo.json
```

Or ask Pi: **Fetch https://jsonplaceholder.typicode.com/todos/1, save it as todo.json, and tell me its title and whether it is completed.**

Any HTTPS URL is allowed, including GitHub Gists; there is no host allowlist. GET, HEAD, and POST are enabled, with an 8-second deadline and 1 MiB response limit. Use `set -o pipefail` before pipelines to retain download failures.

Browser CORS applies. Redirects require the final URL directly: browsers hide redirect destinations, so this copy reports an error instead of silently returning empty output or following unchecked redirect schemes. Cookies are omitted. Explicit request URLs, headers, and bodies are sent to the destination; inference and workspace storage remain local. Node.js, Python, npm, and native programs remain unavailable.

Source is under `app/`. Rebuild with `cd app && npm ci && npm test && npm run build`, then `python3 scripts/stage.py`. The HTTP implementation is in `app/src/browser-http.mjs`; it uses just-bash's existing curl commands and custom transport hook. Tests and results are in `validation/`.

The small 4-bit model can make mistakes. Shell transport checks and actual-model trials are reported separately; they do not establish general agent reliability or physical-phone performance.

## Deployed results

The current [evaluation report](validation/REPORT.md) records 17 passing live shell checks, including previously unlisted hosts, and a successful real-model public Gist fetch. It also preserves the initial seven model trials (five fully passed; two partial results). Basic API fetching works well. Duplicate POSTs and excessive retries on blocked requests remain model limitations.