[salman1993]

Adds Pi as an agent type: agents that run on Pi durable on this computer, with any provider Pi supports. It ships turned off until enabled in Settings → Plugins, on macOS, Linux and Windows.

This replaces #1103. That branch was 99 commits behind main, and the agent-type API had moved on since. The first commit ports its src/bundled/pi/ as is. The commits after it bring Pi up to date.

What changed

• Port of feat(pi): add the Pi agent type on Pi durable #1103 (05c77e8e8): the Pi plugin, its host (host.mjs, run by pi.sh on this computer's Node), and its registration. The only fixes needed were main's renames: Me chat → Solo chat, and the now-optional Instructions label.
• Current agent-type API (20964bd50):
  • Stop on a turn's activity aborts the Pi run it is in, and posts no failure.
  • sessions lists each agent's Pi conversations for plugins.
  • A Solo chat's Canvas is handed to each turn.
  • The Buzz tools get the relay, audience and workflow authorities, as the other harnesses' do.
  • The plugin has catalog tags.
• Pi durable 1.3.0 (5bb2898c1): pi-durable, pi-ai and chord move from 1.1.0 to 1.3.0.
  • 1.2.0 renamed a tool result's content to output. On 1.3.0 every Buzz tool result reached the model empty until this was fixed.
  • Storage that fails now closes the Harness for good. The host drops it and opens the agent again.
• Tool search (753e75077): Buzz tools that Claude and Codex load on search (the attention tools and those plugins add) are deferred: true in Pi. Each agent's registry has pi-durable's tool_search, which loads them when the model looks for them.
• Review fixes (62fec4349):
  • A wait that a storage failure cut off waits again once the agent is opened again.
  • A new conversation is listed as soon as its first turn is handed over.
  • Listing sessions only opens the storage of an agent that runs here.
  • The README opens with the Getting started guide every bundled plugin needs.
• Windows (63be0e3dd), now that feat(plugins): native file reads so Goose agents run on Windows #1378 is merged:
  • The install logic moves from bash into launch.mjs, plain Node. On Mac and Linux, pi.sh now only finds Node (app PATH, then a login shell) and starts the launcher. Windows starts node directly.
  • The host source and the lock go to the launcher on stdin. Together they are ~65 KB, past Windows' 32 KB command line.
  • File uploads read through host.files instead of base64, so the Mac/Linux gate is gone.
  • npm now runs inside the install folder, because npm 11 rejects npm ci --prefix pointing outside where it runs. This was already broken in the old pi.sh.
  • On Windows, packages go under %LOCALAPPDATA%\Buzz\pi. Pi's bash tool needs Git Bash there.

Testing

• bin/pnpm exec tsc --noEmit is clean.
• bin/pnpm exec vitest run src/bundled/pi: 47 tests pass.
• The live host test on the real 1.3.0 packages passes: PI_DEPS=<folder pi.sh installed> bin/pnpm exec vitest run src/bundled/pi/host.live.test.ts. It now also checks three things, and each check fails when its change is reverted:
  • the model reads what a Buzz tool answered
  • aborting a run leaves its request aborted
  • a deferred Buzz tool is only offered once tool_search finds it
• cargo test -p buzzodz-plugins --test management bundled_defaults passes.
• Full vitest run passes, apart from codex-sh.test.ts and browser-host/project-git.test.mjs. Those failed under load, pass on their own, and are untouched here.

Follow-up PR

• Agent settings page: Harness defaults for Pi. Pi's defaults currently come from ~/.pi/agent/settings.json.
• Usage plugin integration: Pi's usage will show up in the Usage plugin, through the agent type's usage hook as Claude, Codex and goose do.

Known gaps

• Pi has no catalog icon.png; it needs artwork.
• Reopening after a storage failure is only unit-tested on the runtime side.
• Linux and Windows are not validated. On macOS, the real install and host start were checked end to end both ways: through pi.sh, and as node -e alone as on Windows.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-20T18:33:43.979355Z	62fec43	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 62fec43495

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[salman1993]

Pi is using tool search (deferred tool loading):

[wesbillman]

🤖 Carl, an automated reviewer, commenting via Wes's GitHub account.

Not ready to merge until the two medium findings are fixed: Node discovery misses nvm/fnm users, and Pi usage undercounts while reporting no gap. The resumed-transcript finding is lower severity. The CreateModel accessibility note is optional.

Checked at head 3e771044 against base main. The branch merges cleanly with current main (738b29ee): tsc --noEmit is clean and vitest run src/bundled/pi passes (52 passed, 1 live test skipped). Tool authorities match the other harnesses, and main's new owner/gitAuth arrive through appClient. The disabled-by-default gating agrees in the TS registry, the Rust catalog and both tests. The lockfile pins integrity hashes for all 95 packages and installs without lifecycle scripts.

Validation gaps (not run here): storage-failure reopen, the host dying during handover, and Stop with queued steering are covered only against the fake host. Linux and Windows are source-reviewed only.

[kalvinnchau]

🤖 [P2] Storage failure before wait registration abandons an accepted turn — host.mjs:714

Revalidated at 3e771044ec36b4eb49df90fab3256fcdb94482c8 through PiRuntime → transport → real Pi 1.3.0/SQLite. Buffering the accepted deliver reply while another SQLite connection holds BEGIN IMMEDIATE produces a real storage failure. The host removes the agent (:340–343); the subsequent wait throws The agent is not open (:351–353). runtime.ts:698–704 retries only PiStopped or explicit reopen, so it reports failure and abandons the receipt. Manual reopening completes the same durable submission.

Preserve a typed reopen outcome for late waiters after storage failure, distinguish intentional removal, and retain bounded retry. Add failure-before-wait coverage; the existing fake-host test supplies reopen directly. This is distinct from the repaired host-exit-before-deliver-response path.

[kalvinnchau]

🤖 [P2] Transcript storage is readable by other local accounts when ancestors permit traversal — host.mjs:267

Revalidated at 3e771044ec36b4eb49df90fab3256fcdb94482c8 with the unchanged host, real Pi/SQLite and synthetic prompts. Under umask 022 and traversable 0755 ancestors, agents/ is created as 0755 and the database, WAL and SHM as 0644; the WAL contains the private prompt. Closing and reopening under umask 077 leaves the existing database and recreated sidecars 0644.

Another local account with ancestor traversal can therefore read plaintext transcripts. A private ancestor prevents exposure; this check did not execute as a second account. Enforce 0700 on the agents directory, including existing directories, and normalize database/sidecar permissions to 0600 while storage is closed. Cover both fresh and existing storage across WAL recreation.

[kalvinnchau]

🤖 [P2] Durable runs resume after restart without runtime ownership — runtime.ts:312, host.mjs:264

Revalidated at 3e771044ec36b4eb49df90fab3256fcdb94482c8 through the real runtime and Pi/SQLite: start A, dispose while its provider call is held, then restart and deliver B in another thread. B's delivery resumes both runs, but working() contains only B's conversation 13, omitting A's conversation 2. Only B's answer is published; durable inspection finds A completed with an unpublished plain answer. The new runtime has no wait/receipt for A. Reading Usage alone did not resume it.

Reconcile unfinished submissions with routing/receipts, activity and Stop controls, and standalone deadlines before driving progress. Add restart-plus-cross-thread coverage. This concerns graceful dispose/restart, separate from the repaired delivery-response crash window.

[salman1993]

🤖 Re: [P2] Storage failure before wait registration. Fixed in e0a814e. The host now remembers an agent whose storage failed. A wait that arrives after the failure returns {status: "reopen"}, and the runtime's existing settle retry reopens the agent and finds the accepted turn. That retry is still bounded: a second failure ends with "keeps failing". Removing an agent clears the flag, so a removal still reads as closed. Tests: a live case that holds BEGIN IMMEDIATE from another process while the run commits, and a runtime case for the bounded retry.

[salman1993]

🤖 Re: [P2] Transcript storage readable by other local accounts. Fixed in e0a814e. Before the storage opens, the host sets the agents folder to 0700 and the database plus any -wal/-shm to 0600, including storage that already exists. SQLite gives sidecars it creates later the database's mode. I didn't use a process umask, since that would also make the agent's workspace files 0600. The live test starts from 0755/0644 storage and checks the modes afterwards.

[salman1993]

🤖 Re: [P2] Durable runs resume after restart without runtime ownership. Fixed in e0a814e.

• What changed: at the first delivery or standalone turn after the app starts, the runtime asks the host for unfinished runs that have a place (harness.inspect). It takes those runs on: they show as Working, their answer is posted to their thread (deduped against send), and a failure is reported. A delivery of the same request takes the run back over.
• Not restored: Stop and the standalone deadline. Both need a runner job handle that doesn't exist after a restart. The README Limits section now says so.
• Tests: runtime cases for an answer posted in another thread, a failure reported, a stopped run kept silent, a shared conversation, and listing again after a failed listing. The live test checks that unfinished lists the interrupted run.

[wesbillman]

🤖 Star Lord’s automated source review via Wes’s account, integrating independent Rocket, Mantis and Groot lanes.

Follow-up review: head e0a814e3e55ccacd146b506bba0b749b6f737f65, base dbb0a9de8016a04b6eb79a3edc4a0d6964bc9d25; changes since previously reviewed 3e771044ec36b4eb49df90fab3256fcdb94482c8. Two new P2 findings are inline. Source assessment: 8/10 until those routing and usage-period defects are addressed.

The previous Node-discovery and resumed-transcript findings, and optional model-button accessibility note, are addressed in source. Watch/timer usage exclusion remains explicitly author-retained in the existing discussion; this review does not reopen it.

Validation: source-only; no tests, builds, app runs, dependency installation or live-provider/restart exercises performed. One hosted CI snapshot showed CI required and WebKit 2/12 failing, with Windows validation skipped; cause not reproduced. Native lifecycle, performance, rendered error/retry focus, themes and assistive-technology behavior remain unverified. Inspected the public PR description (no attached images) and follow-up commit metadata; no disclosure finding. Unchanged feature areas were not exhaustively re-audited. This COMMENT is not approval or merge authorization.

[loganj]

🤖 Larry, an automated reviewer working for Logan.

I reviewed head e0a814e3e from the source. I read the launcher (pi.sh, launch.mjs), the stdio client (pi.ts), the host (host.mjs), runtime.ts, setup.ts, and the setup and Activity parts of tabs.tsx. I did not repeat the open findings from Codex, Carl or Star Lord. I found two new issues and put them inline. Neither one puts saved data or startup at risk.

• P2: Setup tells the user to sign in with pi's /login and then pick the provider in Buzz. Buzz keeps the provider list until it restarts, so it still shows the provider as not set up after the login.
• P3: The host runs a !command API key with execSync, and one host process serves every Pi agent. While the command runs, every agent waits, for up to 10 s each time it runs. A command that returns no key runs again on the next read.

I also checked these and found no problem: the install folder named by the hash of the package and lock files; npm ci --ignore-scripts with integrity for all 95 packages and no resolved hosts, so the user's registry is used; the rename that keeps two installs from colliding; the stdin handoff past the 32 KB Windows command line; the owner/delegate check before a mention runs Pi's unsandboxed tools; and the guard that lets only a running agent open its storage. The Activity tab can only appear for an agent that runs here, because agent.place === "elsewhere" gets no type tabs.

What I did not run: tests, a build, the app, or the live host.

[wesbillman]

🤖 Star Lord’s automated source review via Wes’s account, integrating independent Rocket, Mantis and Groot lanes.

Follow-up at head 1a708fb791cdc74816646ab4f90f5cbd11e41ebb, base 683733abbe465c729b0ea98a6e4f580bd8dd8ab0, since reviewed e0a814e3e55ccacd146b506bba0b749b6f737f65. One new P2 recovery-ordering finding is inline. Source assessment: 8/10 until the send baseline is captured before recovered work resumes.

Provider/default refresh and rejection of command/environment keys are addressed in source. The prior compaction-date limitation remains explicitly author-deferred in the existing discussion; this review does not reopen it.

Source-only: no tests, builds, installs, app runs or live-provider/restart exercises performed; CI was not assessed. Native recovery timing, performance, rendered focus/retry behavior, themes and assistive technology remain unverified. Inspected the public PR description (no attached images) and follow-up commit metadata; no disclosure finding. Unchanged feature areas were not exhaustively re-audited. This COMMENT is not approval or merge authorization.

[wesbillman]

🤖 Carl, an automated reviewer, commenting via Wes's GitHub account.

Follow-up at head 1a708fb791cdc74816646ab4f90f5cbd11e41ebb, base 683733abbe465c729b0ea98a6e4f580bd8dd8ab0. It merges cleanly with current main (9676a38d). This round integrates independent Court lanes: install/credentials, runtime lifecycle, user-facing flows, integration, and a challenge pass.

Merge criteria: the open recovery-baseline P2 in the existing thread, which we independently confirmed against pi-durable 1.3.0 (Submissions.wait resumes the Harness-wide scheduler), plus the new P2 inline on auth.json reads. The four P3s are optional, non-gating.

The $NAME/!command rejection in the latest commit matches pi-coding-agent 1.3.0's resolver for whole-value references. Node discovery, the stdin handoff, the --ignore-scripts install with integrity hashes, and owner/delegate admission before unsandboxed tools all look right in source.

Validation gaps: the auth.json race was reproduced with a local probe on this head's AuthFile, real filesystem and pi-ai 1.3.0. That rate is stress evidence, not expected production frequency. The Stop-display gap was reproduced with a scratch piTurns run. Everything else is source review. Recovery ordering, Linux and Windows are not exercised at runtime. Local probes only, no broad suites rerun; hosted CI is green at this head. This COMMENT is not approval.

[wesbillman]

🤖 Star Lord’s automated source review via Wes’s account, integrating independent Rocket, Mantis and Groot lanes.

Follow-up at head 1847369cef214ca3e16a3e2d4e525ad5ae1679d7, base 683733abbe465c729b0ea98a6e4f580bd8dd8ab0, focused on the repair delta since 1a708fb791cdc74816646ab4f90f5cbd11e41ebb. One P2 is inline: dropping a placed one-off resumes the shared scheduler before later recovered mentions have their send baselines, reopening the duplicate-fallback race. Source assessment: 8/10 until recovery preparation precedes every resume path.

Credential reads now use the shared auth-file lock; repository-context wiring and Identity-tab guidance are addressed in source. The explicit-wait ordering is repaired, but cancellation supplies the additional resume path described inline. The existing author-retained usage and recovered-Stop limitations are not reopened.

Validation: source only, including published Pi 1.3.0 dependency source; no tests, builds, installs, app runs or live-provider/restart exercises performed. CI was not assessed. Native lock takeover, filesystem behavior, performance, rendered error/retry focus, accessibility and human acceptance remain unverified. Inspected the public description (no attached images) and follow-up commit material; no disclosure finding. Unchanged feature areas were not exhaustively re-audited. This COMMENT is not approval or merge authorization.

[wesbillman]

🤖 Star Lord’s automated source review via Wes’s account, integrating independent Rocket, Mantis, and Groot lanes.

No changes requested in this follow-up. The prior scheduler-resume finding is addressed in source: host.mjs:764–780 withdraws queued one-offs and marks placed runs aborted without resuming Pi; runtime.ts:712–786 captures all recovered mentions’ routes and send baselines before the batched drop and subsequent waits. The Pi durable 1.3.0 source confirms these cancellation primitives do not enable scheduling and preserve cancellation of owned foreground work. The new regression cases cover two abandoned one-offs beside a recovered mention and delayed route lookup. No new actionable defect found. Assessment: 9/10 for minimalness, elegance, and correctness within this repair scope.

Scope: changes since 1847369cef214ca3e16a3e2d4e525ad5ae1679d7, including the four-file repair and merge integration preserving Pi and relay-notes as disabled by default. Public PR description and follow-up commit metadata inspected; no attached images or disclosure finding. Unchanged feature areas and unrelated upstream changes were not freshly audited.

Reviewed head: 26abc3ad52c18df9e23035b762cf3ffe7e9e2ebe.
Base: 2adcea400c546e266a87a5f7f1c971272ac71e5a.

Source-only: tests were read, not run; no builds, app launches, live recovery/provider/filesystem checks, CI assessment, performance measurements, rendered focus/accessibility checks, or human acceptance validation. Author-reported test results remain unverified. This COMMENT is not approval or merge authorization.

[wesbillman]

🤖 Star Lord’s automated source review via Wes’s account, integrating independent Rocket, Mantis, and Groot lanes.

No changes requested in this merge-only follow-up. The Pi feature patch is byte-identical to the previously reviewed head 26abc3ad52c18df9e23035b762cf3ffe7e9e2ebe, including the recovery-ordering repair. The 19-file endpoint delta imports the plugin-notes API and the Settings test label correction from main. No new actionable integration defect found. Assessment: 9/10 for minimalness, elegance, and correctness within this follow-up scope.

Optional integration follow-up: Pi currently does not consume AgentHandle.notes (src/bundled/pi/runtime.ts:391–405,902–904), although AgentRunners.note can accept a note for a running Pi agent. A plugin using that API would receive true but its note would not reach Pi’s prompt. We found no production producer of these notes in the pinned repository, so this is recorded as a limitation rather than requiring speculative adapter parity. When a concrete caller is introduced, consume notes at delivery with the conversation’s root policy, preserving them on definite non-delivery; alternatively return false while unsupported. Host-restart responses can be ambiguous, so restoration must not blindly duplicate already accepted input.

Reviewed head: 7bb1878296d08c46d5e607220223adcd9a43956e.
Base: 3d26215564dde0f670b8707de49f822a36a0120f.

Source-only: no tests, builds, app launches, installs, CI assessment, live provider/recovery checks, performance measurements, rendered focus/accessibility checks, or human acceptance validation. Public PR description and follow-up commit metadata inspected; no attached images or disclosure finding. Prior accepted/deferred decisions remain unchanged. Unrelated upstream behavior and unchanged feature areas were not exhaustively re-audited. This COMMENT is not approval or merge authorization.