feat(agents): add pi as the 7th agent - #553
Merged
Merged
Conversation
- agents/pi.sh: oauth mounts ~/.pi writable (auth.json auto-refreshes in place; everything pi persists lives under .pi/agent); api-key passes the set provider env keys (ANTHROPIC/OPENAI/GEMINI/XAI/ OPENROUTER), mounts nothing, blank-overlays .pi/agent/auth.json (it outranks env keys). At least one key required; tag from the first set key. - deva.sh: registration across auth tag, version label, mount categorize, status, autolink, config-home scaffold/warning, $HOME fallback, env scrub of the 5 provider keys (oauth leak guard) - sandbox: pi has no permission system by design (its security doc: run it in a container). --approve unlocks the one interactive gate (project trust); PI_SKIP_VERSION_CHECK=1 since the image pins the CLI - --trace rejected until cctrace ships a pi profile - image/pins: @earendil-works/pi-coding-agent PI_CODING_AGENT_VERSION through versions.env, Makefile, Dockerfiles, installer, registry, version-upgrade, CI/release/nightly workflows. NOTE: the old @mariozechner scope is dead and @mariozechner/pi is an unrelated vLLM tool - earendil-works is canonical - tests: scripts/test-pi-auth.sh (hermetic dry-run, 16 asserts); fixtures updated in install-tooling and release-utils tests Close #552 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- fake docker labels gain pi_coding_agent_version (fallback current) - both curl fixtures answer @earendil-works/pi-coding-agent dist-tags + packument - main/rust build-arg and pin-write assertions cover PI_CODING_AGENT_VERSION Refs #552 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c952a8da32
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| grok_ver="${_CLI_GROK:-$(get_latest "grok-cli")}" | ||
| kimi_ver="${_CLI_KIMI:-$(get_latest "kimi-code")}" | ||
| opencode_ver="${_CLI_OPENCODE:-$(get_latest "opencode")}" | ||
| pi_ver="${_CLI_PI:-$(get_latest "pi")}" |
There was a problem hiding this comment.
This new unconditional lookup breaks the checked CI job at .github/workflows/ci.yml's bash tests/version-upgrade.sh, because that test's fake image labels and npm registry responses contain no pi entries. Running the test exits nonzero after Cannot determine version for pi, and its registry-outage path then proceeds with an empty pi version instead of reaching the expected up-to-date result; extend the pi image-label, dist-tag, packument, build-argument, and pin expectations for every fixture path.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Pull request overview
Adds pi (earendil-works/pi-coding-agent) as a first-class, pinned, containerized agent in deva (deva.sh pi), including OAuth vs api-key auth contracts, env scrubbing, tool registry/version plumbing, CI coverage, and docs.
Changes:
- Introduces
agents/pi.shand wires pi intodeva.shauth tagging, mount/overlay rules, and env-scrub behavior. - Pins and propagates
PI_CODING_AGENT_VERSIONthrough build/release/version tooling (Makefile, Dockerfiles, version scripts, workflows). - Adds CI + test coverage (
scripts/test-pi-auth.sh) and updates docs/changelog/readmes to include pi.
Reviewed changes
Copilot reviewed 34 out of 34 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| versions.env | Adds PI_CODING_AGENT_VERSION pin. |
| tests/test_release_utils.sh | Updates expected tool lists to include pi. |
| scripts/version-upgrade.sh | Adds pi to upgrade/only-filter/version manifest/build-args. |
| scripts/version-pins.sh | Adds PI_CODING_AGENT_VERSION to pin-vars and output. |
| scripts/update-version-pins.sh | Maps PI_CODING_AGENT_VERSION to pi and pins npm package. |
| scripts/test-pi-auth.sh | New smoke test for pi auth wiring (oauth mounts, api-key env-only, overlays, trace rejection). |
| scripts/test-install-agent-tooling.sh | Extends fake installer test to include pi binary/version substitution. |
| scripts/resolve-tool-versions.sh | Resolves pi_coding_agent_version from tool registry. |
| scripts/release-utils.sh | Registers pi in TOOL_REGISTRY (npm package + image label). |
| scripts/install-agent-tooling.sh | Installs @earendil-works/pi-coding-agent, precreates ~/.pi/agent, disables version check for verification. |
| README.zh-CN.md | Updates marketing/quickstart to list pi as the 7th agent. |
| README.md | Updates marketing/quickstart to list pi as the 7th agent. |
| Makefile | Adds pi build arg/override + includes pi in “already up-to-date” version comparison output. |
| llms.txt | Updates short project description to include pi. |
| install.sh | Installs the new agents/pi.sh file and mentions deva.sh pi in quick start. |
| docs/troubleshooting.md | Mentions pi in config-home warning symptom list. |
| docs/quick-start.md | Adds agents/pi.sh to installed files + api-key example for pi. |
| docs/philosophy.md | Updates agent list to include pi. |
| docs/index.md | Updates top-level docs overview to include pi. |
| docs/how-it-works.md | Adds pi to config-home layouts + explains pi auth/mount behavior. |
| docs/authentication.md | Documents pi oauth and api-key contracts and provider env key set. |
| docs/advanced-usage.md | Notes --trace is rejected for pi (no cctrace profile yet). |
| Dockerfile.rust | Adds pi version ARG + image label. |
| Dockerfile | Adds pi version ARG + image label. |
| deva.sh | Adds pi to usage/examples, auth tagging, version label mapping, config mounts, autolink scaffolding, env scrub, overlay target path, and CI smoke invocation. |
| DEV-LOGS.md | Adds dev log entry for pi agent addition. |
| CHANGELOG.md | Adds “pi as the 7th agent” entry under Unreleased/Added. |
| agents/shared_auth.sh | Declares pi supports oauth and api-key and defaults to oauth. |
| agents/pi.sh | New agent wrapper implementing oauth mount + api-key env-only contract + trace rejection. |
| .github/workflows/release.yml | Propagates pi_coding_agent_version outputs and build args into release workflow. |
| .github/workflows/nightly-images.yml | Propagates pi_coding_agent_version outputs and build args into nightly workflow. |
| .github/workflows/ci.yml | Adds build-arg propagation + deva.sh pi -Q -- --version + scripts/test-pi-auth.sh smoke step. |
| .deva.example | Updates hybrid-agent documentation comments to include pi. |
Suppressed comments (1)
scripts/test-pi-auth.sh:71
- Same issue as above: the current needle includes a quote that won’t appear in the debug output, so the test can pass even if a
~/.pimount leaks into api-key mode. Match the directory mount more precisely (container path + space).
want_absent "hybrid layout: no ~/.pi mount in api-key mode" ":/home/deva/.pi\"" "$hybrid_apikey_out"
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+3
to
5
| > Docker-first launcher for AI coding agents — Claude Code, Codex, Gemini, Grok, Kimi, opencode, and pi. | ||
| > The container is the sandbox, mounts are the explicit contract, and one warm | ||
| > project container serves all six agents. A bash script, not a framework. MIT. |
| Symptom: | ||
|
|
||
| - first run warns that `.claude`, `.codex`, `.gemini`, `.grok`, `.kimi-code`, or `.local/share/opencode` is empty | ||
| - first run warns that `.claude`, `.codex`, `.gemini`, `.grok`, `.kimi-code`, `.pi`, or `.local/share/opencode` is empty |
| want "second provider key travels too" "XAI_API_KEY=<redacted>" "$apikey_out" | ||
| want "first-key last-4 tags container" "--api-key-1234--" "$apikey_out" | ||
| want "passes agent args after --" "pi --approve -p hi" "$apikey_out" | ||
| want_absent "no ~/.pi mount in api-key mode" ":/home/deva/.pi\"" "$apikey_out" |
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 34 out of 34 changed files in this pull request and generated no new comments.
Suppressed comments (1)
llms.txt:5
- llms.txt still says the warm container “serves all six agents”, but this PR adds pi as a 7th agent. This makes the one-line project description inconsistent with the rest of the update.
> Docker-first launcher for AI coding agents — Claude Code, Codex, Gemini, Grok, Kimi, opencode, and pi.
> The container is the sandbox, mounts are the explicit contract, and one warm
> project container serves all six agents. A bash script, not a framework. MIT.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Close #552
pi (earendil-works/pi, ex badlogic/pi-mono) as
deva.sh pi. Cleanest container fit in the herd: pi ships no permission system at all - its own security doc says to run it in a contained environment. That is deva's whole thesis.Contract:
~/.pirw. Everything pi persists lives under.pi/agent/(auth.json, sessions, settings, trust.json). Writable matters: OAuth tokens auto-refresh in place. First login via in-app/login(paste-URL / device-code flows work headless)..pi/agent/auth.json- it OUTRANKS env keys, same no-mount contract as grok/kimi/opencode.--approveappended (project-trust gate would stall unattended runs),PI_SKIP_VERSION_CHECK=1(image pins the CLI, no pi.dev phone-home nag).--tracerejected until cctrace grows a pi profile.Image/pins:
@earendil-works/pi-coding-agent@0.84.1(binpi, needs node >= 22.19 - NODE_MAJOR=22 covers it), PI_CODING_AGENT_VERSION wired through versions.env, Makefile, both Dockerfiles, installer, tool registry, version-upgrade, ci/nightly/release workflows.Trap dodged: the
@mariozechnernpm scope is deprecated (project moved to earendil-works), and@mariozechner/piis an unrelated vLLM deployment tool. earendil-works is canonical.Verified:
deva.sh pi --debug --dry-runshowspi --approvein an auth-default container🤖 Generated with Claude Code