feat: bundle pi so the backend works with zero install - #141
Merged
Conversation
pi previously required a separate global install; a missing binary surfaced only as a spawn error on the user's first turn. Now: - @earendil-works/pi-coding-agent is a pinned optionalDependency. The pin is a safety property, not just convenience: the injected approval bridge is coupled to pi's RPC + extension API, and the lockfile freezes exactly the pi version the bridge was tested against. - pi/resolve.ts resolves the binary ONCE at startup: explicit providers.pi.command (verified — a typo'd path is loud at startup, not a first-turn failure) → system pi on PATH → the bundled copy run via the daemon's own runtime (process.execPath + cli entry, so the fallback doesn't additionally require node). PiRpcProcess gains an argsPrefix that precedes --mode rpc for the bundled form. - ProviderRegistry learns supported-but-unavailable backends (markUnavailable/unavailableHint): when nothing resolves, pi stays out of the switchable catalog but session.set_provider answers with the actionable install hint instead of 'unknown provider', and the daemon logs the fix at startup. Tests: resolution order (config hit/miss, bare-name PATH lookup, system beats bundled, bundled fallback), a live smoke that RUNS the bundled pi under the daemon runtime (--version, no network), registry activation/ unavailable/disabled states, and the switch-error hint path.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
🤖 Gemini code reviewBundles pi as a pinned optional dependency to enable zero-install usage out of the box. Implements a startup-time resolution strategy (explicit config -> system PATH -> bundled fallback) to fail-fast with actionable installation hints instead of failing on the first user turn. Findings: 🔴 0 · 🟠 0 · 🟡 0 · 🟢 1
Tokens spent · ⬆️ Input: 6,773 · ⬇️ Output: 209 · Σ Total: 11,254 |
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #141 +/- ##
==========================================
+ Coverage 82.07% 82.11% +0.04%
==========================================
Files 97 98 +1
Lines 16867 16922 +55
==========================================
+ Hits 13843 13895 +52
- Misses 3024 3027 +3
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
saucam
added a commit
that referenced
this pull request
Jul 10, 2026
…lice) (#142) * feat: OpenAI Codex as a codeoid backend (app-server JSON-RPC, first slice) Codex CLI becomes the third native harness backend, riding ChatGPT- subscription auth that lives entirely in codex's own ~/.codex store. Grounded against a live probe of @openai/codex@0.144.1 app-server (newline JSON-RPC over stdio; see docs/provider-codex-design.md). - codex/rpc.ts: JSON-RPC client — requests, notifications, and SERVER→client requests (the native approval seam; unlike pi, no injected bridge extension is needed). - codex/index.ts: CodexProvider (SessionProvider) — warm process, one codex thread per backing session (thread id = backingSessionId, thread/resume on reconnect, fresh thread on rotation), turn/start pinned to approvalPolicy 'untrusted' so codex ASKS before privileged actions and codeoid's canUseTool is authoritative (fail-closed: no gate wired → denied; unknown server requests → refused). item/tool/requestUserInput maps to requestUserInput (session.ui_request). Non-gated items (codex-trusted reads) are recorded retrospectively as paired tool_start/tool_complete so scrollback + canonical history stay honest. systemPromptAppend → developerInstructions; seedFromHistory prepends the structured transcript (warm-backend ceiling). model/list → live catalog. - buildCodexEnv: hardened subprocess env (CODEX_/OPENAI_/LC_ prefixes, *_API_KEY suffix; ~/.codex via HOME) — GHSA-38vh posture. - Config providers.codex {enabled, command}; registry activation via resolveCodexCommand (config → PATH; no bundled fallback yet — native per-platform binary, needs a size audit) with the #141 supported-but-unavailable hint otherwise. Tests: fake-codex fixture (newline JSON-RPC subprocess) driving C1-C9: text/thinking streaming + usage, approval approve/deny round-trips, retrospective non-gated items, structured history seed (one-shot), user-input select round-trip, missing binary, model mapping, resolution + registry hints. No wire changes. * fix: guard codex stdin against EPIPE + import randomUUID explicitly (Gemini review) * fix: close codex coverage gaps flagged by codecov patch report Patch coverage 89.4% → ~99%: C9 lifecycle (thread id round-trips as the backing id, reset/setHasQueried/dispose, onModels catalog), C10 interrupt → turn/interrupt → stopReason 'interrupted', C11 unknown server→client request refused with a JSON-RPC error (fail closed), C12 rpc edges (spawn failure rejects in-flight requests, request timeout, request/notify after exit), plus bare-name and system-PATH codex resolution. fake-codex grows hang-forever/unknown-request/noReply behaviors and surfaces error responses to turn scripts.
saucam
added a commit
that referenced
this pull request
Jul 10, 2026
…ription auth) (#143) * feat: gemini-cli as a codeoid backend over ACP (bundled, Google-subscription auth) Fourth native harness backend: Google's gemini-cli driven over ACP (the Agent Client Protocol — standardized editor<->agent JSON-RPC/stdio; gemini-cli exposes it via the stable --acp flag). Auth is the user's Google-account OAuth in ~/.gemini (free tier / AI Pro / Code Assist) — subscription posture like claude/codex; codeoid never touches tokens. - providers/jsonrpc-stdio.ts: the codex transport generalized into a shared StdioJsonRpcProcess (codex/rpc.ts is now a thin wrapper baking in the app-server subcommand — all codex tests unchanged). - acp/index.ts: GeminiAcpProvider — session/new is the backing session, session/prompt resolves at turn end (stopReason -> turn_done; honest zero usage, ACP carries none), session/update chunks -> text/thinking deltas + tool_call/tool_call_update -> tool records, session/request_permission -> canUseTool (deny picks the reject option; fail-closed: no gate or no reject option -> cancelled; fs/terminal capabilities DECLINED at initialize and any stray request refused), session/cancel -> interrupt. Deliberately protocol-thin: any ACP agent can reuse the shape with a different binary. - Bundled: @google/gemini-cli@0.80->0.50.0 pinned optionalDependency (pure JS, runs under the daemon runtime — live smoke in tests); resolution config -> PATH -> bundled, with the #141 unavailable-hint path. buildGeminiCliEnv allowlist (GEMINI_/GOOGLE_/LC_ + *_API_KEY). - Config providers.geminiCli {enabled, command}; provider id gemini-cli (distinct from the stateless gemini API backend). No wire changes. Tests: fake-acp fixture (long-running session/prompt answered at turn end, permission options, cancellation) driving A1-A9 + resolution/ registry states + live bundled smoke. Registry catalog test updated for the bundled backend. * fix: tolerate synchronous stdin write failures on a dead child (Gemini review) write() on a destroyed stream throws synchronously — the #exited flag and the stdin error listener only cover the async paths. All frame writes now go through a #write helper that swallows the throw (exit handler owns diagnostics) and routes request-path write errors to the pending rejection.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Makes the pi backend seamless. Previously pi required a separate
npm i -g— the catalog advertised it regardless, and a missing binary only surfaced as a spawn error on the user's first turn.How
@earendil-works/pi-coding-agent@0.80.6becomes anoptionalDependency. The exact pin is a safety property, not just convenience — the injected approval bridge (fail-closed tool gating) is coupled to pi's RPC + extension API, and the lockfile freezes precisely the pi version the bridge was tested against. A system install or explicitproviders.pi.commandstill wins for users who want their own build; they own that pairing's compatibility.pi/resolve.ts), first match wins: explicitproviders.pi.command(verified — a typo'd path is loud at startup, not a first-turn failure) → systempion PATH → the bundled copy, spawned via the daemon's own runtime (process.execPath+ cli entry, so the fallback doesn't additionally require node on PATH).PiRpcProcessgains anargsPrefixthat precedes--mode rpcfor the bundled form.ProviderRegistrylearns supported-but-unavailable backends (markUnavailable/unavailableHint). When nothing resolves, pi stays out of the switchable set, the daemon logs the fix at startup, andsession.set_provideranswers"pi" is supported but not available: <install hint>instead of a bare "unknown provider". This is generic on purpose — the upcoming codex provider reuses it.Tests
Resolution order (config hit/miss, bare-name PATH lookup, system-beats-bundled, bundled fallback shape), a live smoke that runs the bundled pi under the daemon runtime (
--versionfromnode_modules, no network — this CI machine has no system pi, so the zero-install path is what's actually exercised), registry activation/unavailable/disabled states, and the switch-error hint path.bun run test(1236 pass),typecheck,lintgreen.🤖 Generated with Claude Code