feat(#6464): add the pi runtime (stream parser, Bootstrap/Run, Vertex provider, enablement) - #6467
Conversation
Register PiRuntime (earendil-works/pi, CLI `pi`) in runtime.Resolve() following the OpenCode stub precedent (#6035): resolvable internally for dev/testing, deliberately NOT added to config.ValidRuntimes() — a selectable stub would burn pre-script side effects and a sandbox before failing — so it is not user-selectable via `fullsend admin install --runtime` until the runtime is functional. - internal/runtime/pi.go: Name "pi", System "pi" (multi-provider, OpenCode precedent), ConfigDir /sandbox/pi-config (new sandbox.SandboxPiConfig, outside the agent-writable workspace), EnvExports pinning PI_CODING_AGENT_DIR / PI_CODING_AGENT_SESSION_DIR to runner-owned paths plus PI_OFFLINE=1 and PI_SKIP_VERSION_CHECK=1; Bootstrap/Run and transcript extraction return explicit not-implemented errors (#6464). - images/sandbox/Containerfile: ARG PI_VERSION=0.84.2, npm install --ignore-scripts, with a renovate customManagers regex tracking the pin; the install comment records that pin bumps must re-verify the upcoming stream-parser fixtures (pi changed its --mode json shape within 0.84). - docs/runtimes.md: registered-runtimes row, pi (stub) column in the security feature matrix and the config-key support matrix. - Tests: pi_test.go (metadata, env exports, not-implemented, no-ops, capability defaults — no CLAUDE.md bridge, default debug-log name); registry and config tests extended with the resolvable-but-not-selectable cases. Next steps tracked in #6464: stream parser with recorded fixtures, Bootstrap/Run with the ADR 0090 hook-adapter extension, transcript extraction, then ValidRuntimes() enable. Refs #6464 Assisted-by: Claude Signed-off-by: Wayne Sun <gsun@redhat.com>
|
🤖 Finished Review · ✅ Success · Started 9:35 PM UTC · Completed 9:50 PM UTC Commit: |
…ract Read tool_response (fallback tool_result) and replace output via hookSpecificOutput.updatedToolOutput, with suppress → unicode → redact enforced in a single posttool_chain.py driver because Claude runs hooks in parallel. Canary post-tool also redacts leaked tokens, since decision:block does not hide the original result. Signed-off-by: Wayne Sun <gsun@redhat.com>
Claude Code Bash payloads always have stdout, so first-key scan_text missed stderr-only canary leaks. Two PostToolUse hooks also raced on updatedToolOutput; the chain now owns suppress → unicode → redact → canary in one process. Assisted-by: Grok (fix), Claude (review), Gemini (review), Codex (review) Signed-off-by: Wayne Sun <gsun@redhat.com>
FULLSEND_POSTTOOL_SKIP was a test-only env knob the agent could write into workspace .env and disable the chain. Stages are gated by sibling files only. Also type the chain metadata map and add Bash-object tests for unicode and suppress. Assisted-by: Grok (fix) Signed-off-by: Wayne Sun <gsun@redhat.com>
ReviewFindingsMedium
Low
Previous runReviewFindingsMedium
Low
Next steps:
Previous run (2)ReviewFindingsMedium
Low
Previous run (3)ReviewFindingsMedium
Low
Previous run (4)ReviewFindingsMedium
Low
Previous run (5)ReviewFindingsMedium
Low
Previous run (6)ReviewFindingsMedium
Low
Labels: PR modifies sandbox image (Containerfile, sandbox.go constants) and adds documentation for the new pi runtime Previous run (7)ReviewFindingsMedium
Low
Previous run (8)ReviewFindingsMedium
Low
Previous run (9)ReviewFindingsLow
Info
Previous run (10)ReviewFindingsLow
Previous run (11)ReviewFindingsMedium
Low
Previous run (12)ReviewFindingsMedium
Low
Labels: PR adds a new runtime implementation under internal/runtime/ with documentation updates |
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
fullsend-ai-review
Bot
added
requires-manual-review
|
🤖 Finished Review · ✅ Success · Started 10:13 PM UTC · Completed 10:28 PM UTC Commit: |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
🤖 Finished Review · ✅ Success · Started 10:41 PM UTC · Completed 10:55 PM UTC Commit: |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
fullsend-ai-review
Bot
added
ready-for-merge
# Conflicts: # docs/runtimes.md
Bake pi's safety env vars (PI_OFFLINE, PI_SKIP_VERSION_CHECK, PI_CODING_AGENT_DIR/SESSION_DIR) into the sandbox image directly, since the binary ships to every sandbox regardless of runtime selection while PiRuntime.EnvExports() only runs once Bootstrap is implemented. Add a build-time Node engine check (pi requires >=22.19.0) so an incompatible base image fails loudly instead of silently. Disable renovate automerge for pi's version pin given its documented history of breaking --mode json wire changes within a minor. Align docs/runtimes.md's pi columns with OpenCode's existing phrasing for stub hook rows. Add missing pi test parity alongside existing opencode cases (config validation rejection, SandboxPiConfig pinning, capability-table coverage) and cite sources for env var/CLI-flag claims in code comments. Assisted-by: Claude (fix), Claude (review), Grok (review) Signed-off-by: Wayne Sun <gsun@redhat.com>
|
🤖 Finished Review · ✅ Success · Started 12:22 AM UTC · Completed 12:36 AM UTC Commit: |
Derive PiRuntime.EnvExports() paths from ConfigDir() via fmt.Sprintf (matching ClaudeRuntime's pattern) instead of a second raw reference to sandbox.SandboxPiConfig, so a future path change only needs one update. Pass nil (not ui.New(nil)) for the *ui.Printer param in TestPiRuntimeRun_NotImplemented, matching OpenCode's equivalent test. Assisted-by: Claude (fix), Claude (review) Signed-off-by: Wayne Sun <gsun@redhat.com>
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
Add PiRuntime as a stub implementation of the Runtime and
TranscriptHandler interfaces for the pi agent runtime
(earendil-works/pi), following the same pattern as
OpenCodeRuntime. The runtime is resolvable via
runtime.Resolve("pi") but intentionally excluded from
ValidRuntimes() until Bootstrap/Run are functional (per
the #6035 precedent).
Key additions:
- PiRuntime stub (pi.go): implements Runtime and
TranscriptHandler with not-implemented errors, mirroring
OpenCodeRuntime.
- parsePiStream (pi_progress.go): maps pi's --mode json
NDJSON event stream to AgentEvent values. Handles session
header (InitEvent), text, thinking, tool_result,
message_end (TokensEvent), agent_end (ResultEvent), and
error events. Detects stop_reason=error/aborted for the
exit-0-override since --mode json exits 0 on model error.
Falls back to synthesized ResultEvent on truncated streams.
- Test fixtures (testdata/pi/): recorded from pi 0.84.2
--mode json output covering basic run, error run,
reasoning, multi-step, malformed input, empty input, and
truncated stream scenarios.
- Registry wiring: "pi" case in Resolve() switch.
- Documentation: pi column in docs/runtimes.md security
feature matrix, config key support table, registered
runtimes row, and pi-specific known constraints section.
Note: pre-commit could not run (sandbox network policy
blocked git fetch during hook environment init).
golangci-lint not available in sandbox. go vet passes.
Related to #6464
The stub parser and fixtures used invented event names. Map the documented --mode json schema so tests cover the real contract. Assisted-by: Grok (fix), Claude (review) Signed-off-by: Wayne Sun <gsun@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com>
Retry checkpoints must not sticky-fail a later success, tool summaries must read content[].text and stay bounded, and pi stays out of ValidRuntimes until the stub is selectable. Assisted-by: Grok (fix), Claude (review) Signed-off-by: Wayne Sun <gsun@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com>
pi's built-in default thinking level is "medium" (core/defaults.js DEFAULT_THINKING_LEVEL) while Claude Code runs at "high" on Vertex and API-key accounts, and the fleet agents set no `effort:` — so the same agent reasoned a level lower on pi. The run command now always passes --thinking: the harness effort when it is a pi level, "high" otherwise (unset, or an unrecognised value, which is still warned about). pi maps the level onto Anthropic adaptive effort and clamps it for models without reasoning. Assisted-by: Claude Signed-off-by: Wayne Sun <gsun@redhat.com>
|
🤖 Review · Commit: |
- the known-prefix exemption only covers word-shaped remainders (`ghs_maskable`, `glpat-new`); real GitLab (`glpat-`/`glrt-`...), Google OAuth (`ya29.`) and AWS STS (`ASIA`) tokens get prefix patterns of their own, so the exemption can no longer unmask them - keyword arguments whose value is a bare identifier (`Client(token=accessToken)`) are expressions; the non-ASCII tail test that let `TOKEN=...é` through is gone - the constant-name exemption (`"FULLSEND_GCP_WIF_PROVIDER"`) applies to quoted source literals only, not to env-style lines - `NextToken`/`ContinuationToken` (AWS pagination) are not secrets - suppression: the quoted-region regex was over-escaped, so an `\"`-terminated string could hide a following pipe; a lowercase `error:` line also blocks condensing - chain: the NFKC redaction fallback also fires when the normalized copy finds strictly more, covering two secrets that share a mask prefix - `TestPiThinkingFor` encodes the new default (unset → high) Assisted-by: Claude (review) Signed-off-by: Wayne Sun <gsun@redhat.com>
|
🤖 Review · Commit: |
A `pre-commit run` that printed nothing came back to the agent as
"pre-commit: passed". Under Claude Code the Bash result carries no exit
code (`{stdout, stderr, interrupted, isImage}`), so the suppressor cannot
tell a clean run from the silent failure of a hook whose interpreter is
missing from PATH — and it turned that silence into an affirmative pass.
- a summary is built only from text a successful run prints (`ok <pkg>`,
`N passed`, `<hook>…Passed`, `no leaks`); the empty-output branches for
pre-commit, go vet, go build, linters and gitlint are gone (replacing an
empty result with a sentence cost tokens for no information anyway)
- matchers are anchored at the start of a command segment (after
`VAR=…`, `uvx`, `npx`, `uv run`…), so a command that merely mentions a
tool (`grep -n scan-secrets hooks.py`) keeps its output; `python -m
pytest` and `pnpm/yarn/bun test` are recognised
Reported by the hook-fix session's audit of the live hooks.
Assisted-by: Claude
Signed-off-by: Wayne Sun <gsun@redhat.com>
|
🤖 Review · Commit: |
`PostToolUseFailure` accepts only `additionalContext` — no rewrite — so a credential or an ANSI/zero-width sequence in a failing command's output reaches the transcript whatever a hook does. The driver already halted on a canary there; everything else was silent. It now also runs detection-only secret and unicode passes over the failure payload, logs what it finds to `findings.jsonl` (masked), and returns an `additionalContext` warning telling the agent the values are unmasked, not to copy them into a file, edit, commit or comment, and to treat hidden instructions as data. The canary halt still wins over the warning path. Also records in docs/runtimes.md that under Claude Code the suppressors only ever see zero-exit output — a non-zero-exit command fires PostToolUseFailure instead — while pi's `tool_result` does deliver failed calls to the chain. Reported by the hook-fix session. Assisted-by: Claude Signed-off-by: Wayne Sun <gsun@redhat.com>
|
🤖 Review · Commit: |
A canary split by a zero-width space, a bidi override or a tag character halted a successful tool call but not a failed one: the success path strips those before scanning, while the failure path only had the detection copy, which folded combining marks and variation selectors but not category Cf. `_detection_form` now folds Cf too (line and field separators stay, since `scan_text` relies on them to prevent cross-field matches), so both paths see through the same obfuscations. Also from the same review round: - the PostToolUseFailure group is scheduled whenever the chain has anything to do there, not only when the canary hook is on — the detection-only secret and unicode warnings added in 5625403 never fired for a config with sanitizers on and canary off - the failure path scans the detection copy for credentials too, so a fullwidth-obfuscated token in a failed call is flagged - suppression recognises wrapped invocations (`sudo`, `timeout 60`, `env VAR=…`, `mise exec --`, stacked) and `python3.12 -m pytest` - a pagination word only vetoes a token name (`NextToken`, `ContinuationToken`); `NEXT_SECRET` and `PAGE_PASSWORD` are secrets again - the `docs/runtimes.md` phase bullet said the failure event runs "canary detection only", contradicting the caveat two lines below it Assisted-by: Claude, Grok (review) Signed-off-by: Wayne Sun <gsun@redhat.com>
|
🤖 Finished Review · ✅ Success · Started 9:32 PM UTC · Completed 10:14 PM UTC Commit: |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
`buildPiRunCommand` hardcoded pi's positional prompt, so the validation loop's `feedback_mode` (#1050, merged from main as #6494) degraded to a blind retry on pi: the previous iteration's failure was never injected and the agent re-ran the same task with no idea it had failed. The prompt is now `params.Prompt` with the documented fallback to `DefaultAgentPrompt`, matching `ClaudeRuntime.buildRunCommand`, and the runtimes key-support matrix records pi as honouring the key. Reported by the review bot on PR #6467. Assisted-by: Claude Signed-off-by: Wayne Sun <gsun@redhat.com>
|
🤖 Finished Review · ✅ Success · Started 10:20 PM UTC · Completed 10:39 PM UTC Commit: |
The detection copy learned format characters last round but still left the line and paragraph separators (U+2028/U+2029), NUL and ANSI/OSC escapes that `unicode_posttool` strips on a successful call — so those still split a canary on a failed one, the same success/failure asymmetry the previous commit set out to close. `_detection_form` now removes `Cf`, `Zl`, `Zp`, `Cc` (except the newline `scan_text` uses as its field separator, and the tab/carriage return beside it) and whole escape sequences, since dropping only the ESC would leave the parameter bytes splitting the token anyway. Also from the same review round: - a pagination word no longer vetoes a qualified key name: `NEXT_API_KEY` and `PAGE_ACCESS_KEY` are secrets again, while `NextToken`, `nextPageToken` and `NEXT_PUBLIC_API_KEY` stay exempt - the failure phase is scheduled only when something actually runs there — suppression rewrites output, which the event does not allow, so a suppress-only configuration no longer schedules a no-op hook - `_handle_failure` uses the public `hook_io.nfkc` rather than the private helper, so it cannot drift from the success path - `timeout` is matched before `time` in the wrapper prefix instead of relying on backtracking - stale wording: the phase godoc, the sanitizer-scope bullet's prefix list and the detection-copy description in docs/runtimes.md Assisted-by: Claude, Grok (review) Signed-off-by: Wayne Sun <gsun@redhat.com>
|
🤖 Finished Review · ✅ Success · Started 10:43 PM UTC · Completed 11:03 PM UTC Commit: |
waynesun09
left a comment
waynesun09
left a comment
There was a problem hiding this comment.
Approving after four multi-agent review rounds (Claude + Grok) on the sanitizer/hook work and three on the pi runtime, with every finding either fixed or answered in-thread.
Verified locally on the merged tree: 231 hook tests + 9 subtests, go build ./..., go test ./internal/..., node --test internal/runtime/pi_extension/ (16), ruff/ty/bandit/gitleaks clean. CI green on the merge head that includes main's latest, with the two known flakes (#6489 waitForFork, functional-tests judge) re-run.
Behaviour changes worth knowing at release: PostToolUse sanitizers are effective under Claude Code for the first time (#6468/#6357), so their heuristics were scoped to stop rewriting ordinary source, condensing compound commands that failed, or NFKC-rewriting non-ASCII content — a 900-file Read sweep went from 105 rewrites to 14, all real-shaped fixtures. Suppression now condenses only on positive evidence a tool printed, never from silence. Failed tool calls are wired to PostToolUseFailure for canary halt plus detect-and-warn, which is the ceiling that event's contract allows.
Follow-ups filed rather than folded in: #6502 (validation feedback injected unframed/unsanitized), #6485 (local minimal pi run doc). Accepted risks answered in-thread: manifest TOCTOU (matches Claude Code's posture, sandbox is the boundary) and the interim Vertex extension's vendored lockfile (deleted when upstream pi#5262 lands).
|
🤖 Finished Retro · ✅ Success · Started 10:56 PM UTC · Completed 11:51 PM UTC Commit: |
|
Review skipped — this PR is already merged. The Posted by fullsend post-review check |
Retro: PR #6467 — pi runtime implementationTimeline: Issue #6464 was created by waynesun09 at 21:05 UTC on Aug 21. Triage ran at 21:06. The code agent (run 32527743227) produced 1 commit — a stub runtime with stream parser — in ~16 minutes at $4.25 cost (75 turns, 111 tool calls). The human author then expanded the PR to 84 files / +9,819 lines across 58 additional commits over ~25 hours, implementing Bootstrap/Run, the Vertex provider, the sandbox hook adapter, PostToolUse sanitizer scoping (#6357/#6468), behaviour tests, documentation with click-to-enlarge diagrams, and landing-page updates. The review agent ran 48 times (14 successful, ~34 cancelled by rapid pushes). The human approved after thorough local verification (231 hook tests, Code agent assessmentThe code agent performed well within its constraints. It correctly scoped to a deliverable subset (acceptance criteria 1–3 of 8), followed existing runtime patterns (OpenCode precedent), delegated codebase exploration to a sub-agent, and set Review agent assessmentValue delivered: The review agent found genuinely useful issues. The piTruncate UTF-8 boundary edge case was fixed ( Cost concerns: 12 successful review runs with valid telemetry cost $111.49 total (avg $9.29/run). Two additional runs crashed (exit_code=-1, 256–478 tool calls over ~44 min each) but reported $0 in telemetry. ~34 cancelled runs consumed approximately 6.2 hours of GHA compute time. Conservative total estimate: $150–250 across all 48 runs. Evidence for existing open issues
Autonomy assessmentThe review agent's useful-finding rate (several findings drove real code changes) demonstrates value, but the 48-run cost burden and repeated findings mean the current pipeline requires active human engagement to filter signal from noise. The human's approval added verification the review agent cannot currently perform: running the full test suite locally, tracing execution order empirically, validating against external tools (Claude, Grok, Cursor, Codex were all used), and filing follow-up issues (#6502, #6485). Closing the dedup gap (agents#721) would be the single highest-impact improvement for this class of PR. No new proposals filed — all improvement opportunities map to existing open issues. The evidence from this PR is noted above for reference. |
1 participant
Summary
Adds pi (earendil-works/pi 0.84.2) as a fullsend agent runtime, following the OpenCode precedent (#6035/#6147) but landing plan steps 2–5 together: the runtime is registered and functional —
Bootstrap,Run, transcript handling and the sandbox-hook adapter — and is user-selectable withruntime: pi(org defaults, per-repo config,fullsend admin install --runtime pi). No fleet lifecycle run on Vertex has been recorded yet;docs/runtimes.mdlists exactly what is not yet exercised and recommends pilotingtriage/prioritizeon a disposable org first. Includes #6466 (merged in) and supersedes it, and merges in #6468 (fix(#6357): PostToolUse sanitizers honour Claude Code's hook contract —tool_responsein,hookSpecificOutput.updatedToolOutputout, oneposttool_chain.pydriver) so both runtimes land on the same v2 hook contract together.Security posture is evaluated control-by-control against the Claude Code runtime in
docs/runtimes.md; pi is equal on every control (with #6468 merged, PostToolUse sanitizers run through the sameposttool_chain.pyon both — and, because the v2 contract makes them effective under Claude Code for the first time, their heuristics were scoped in63a0a7d6/02fcaa3aso they no longer rewrite ordinary source, condense compound commands that failed, or NFKC-rewrite non-ASCII file content; every rewrite now tells the agent viaadditionalContext,PostToolUseFailureruns canary detection, hooks carrytimeout: 30) and stricter on three (failed tool calls are sanitized too, repo-owned runtime config never loads, an unreadable hook manifest blocks every tool call). Credentials use the same WIFexternal_account+ runner-refreshed OIDC token path as Claude Code on Vertex, under the same egress allowlist; for the Vertex providerRununsetsANTHROPIC_API_KEY/ANTHROPIC_AUTH_TOKEN/ANTHROPIC_BASE_URL/ANTHROPIC_VERTEX_BASE_URLafter sourcing.envand pinsGOOGLE_CLOUD_PROJECTtoANTHROPIC_VERTEX_PROJECT_ID, so pi cannot be routed past Vertex or at a different project. Whether the hook adapter is loaded is decided from the runner's security signal (not the agent-writable manifest);Runrefuses to start when security is enabled but the manifest carries no hook plan, and the run command fails closed (exit 97) if the adapter or manifest is missing or the adapter's SHA-256 differs from the embedded copy — checked before the agent-writable.envis sourced, viacommand -p sha256sum, because pi silently skips a missing-epath.Changes
PiRuntime(internal/runtime/pi.go,pi_bootstrap.go,pi_run.go,pi_transcript.go,pi_agent.go)ConfigDir() = /sandbox/pi-config(sandbox.SandboxPiConfig, outside the cloned repo tree);EnvExportspinsPI_CODING_AGENT_DIR/PI_CODING_AGENT_SESSION_DIRand setsPI_OFFLINE=1,PI_SKIP_VERSION_CHECK=1,PI_TELEMETRY=0..md(frontmattername/description/model/tools, body) and writesAPPEND_SYSTEM.md, a locked-downsettings.json(defaultProjectTrust: never), skills, the hook scripts +fullsend-hooks.jswhen security is enabled, andfullsend-manifest.json(pi tool names for--tools,Bash(a,b)allowlist,HookPlan, pi version from api --versionpreflight). Plugins are skipped with a warning.pi --print --mode json --no-approve --no-extensions --no-prompt-templates --no-themes --session-dir … -e /opt/pi-extensions/anthropic-vertex [-e fullsend-hooks.js] [--tools …] --model <provider/id> [--thinking <effort>] 'Run the agent task', streams throughparsePiStream, emitsInitEventwith the pi version and bare model id, teesoutput.jsonl, and returns 1 when pi exited 0 on a stream error. Model:opus|sonnet|haiku→ pi catalog ids (claude-opus-4-6,claude-sonnet-4-6,claude-haiku-4-5), provider prefixanthropic-vertex,FULLSEND_PI_MODEL/FULLSEND_PI_PROVIDERoverrides; harnessmodel:wins over frontmatter.--debugsends pi's stderr topi-debug.log.ParseTranscriptFilejudges--mode jsoncaptures by theirResultEventand session files by the last assistantstopReason.parsePiStream(pi_progress.go) — NDJSON →AgentEvents, verified against pi v0.84.2 sources. Tool summaries come from call arguments (redacted before any cap);agent_end{willRetry:false}is not terminal (compaction / queued follow-ups continue;agent_settledends the prompt; one prompt per positional message), so exactly oneResultEventis emitted at stream end, failing closed on incomplete/mid-compaction/lost streams;auto_retry_start→RetryEvent;lengthis not an error.internal/runtime/pi_extension/fullsend-hooks.js, embedded) — runs the runtime-neutral hook scripts (ADR 0090) from pi'stool_call/tool_resultwith Claude tool names/inputs; PreToolUse groups inHookPlanorder, block on exit ≠ 0 ordecision:block, fail closed on spawn failure; PostToolUse chained sequentially accepting v1tool_resultand v2updatedToolOutput(PostToolUse sandbox hooks readtool_resultbut Claude Code sendstool_response— sanitizers are inert under Claude Code #6357/fix(#6357): make PostToolUse sanitizers honor Claude Code's hook contract #6468) replies.Bash(a,b)is advisory by default (Claude Code parity, ADR 0027),FULLSEND_PI_BASH_ALLOWLIST=enforceblocks (first-token check on every;/|/&&/||/&-separated command — fd redirections such as2>&1are not separators — refusing substitution, subshells, binary paths, everyVAR=prefix andeval/exec/sh/command/env/xargs-style wrappers). Agents that listSkillor ship skills get pi'sreadtool, which pi's prompt-driven skills require.node --testsuite wired intomake script-test.ARG PI_VERSION=0.84.2(npm install -g --ignore-scripts), image-levelPI_*ENV defaults (test-guarded againstSandboxPiConfig), and the vendoredtwoGiants/pi-anthropic-vertexv0.1.13 (commitd3c9d10d, tag + tarball SHA256,npm ci --omit=dev --omit=peer --ignore-scripts, read-only under/opt/pi-extensions) as the interim Claude-on-Vertex provider until upstream feat(ai): add Anthropic Vertex provider earendil-works/pi#5262 ships. Renovate tracks both pins (no automerge).config.ValidRuntimes()+=pi(config validation,--runtimehelp, CLI/layered-config references);skills/analyze-transcriptnormalizes pi session files (toolCall→tool_use,toolResult→tool_result, camelCase usage/stop reason) so every subcommand works on<agent>-<timestamp>_<id>.jsonl.case "pi"inResolve();docs/runtimes.mdpi column (no longer a stub), switching quickstart, a runtime-agnostic run sequence diagram, a trust-zones diagram ahead of the security matrix, config-key rows, sandbox layout, "Pi-specific known constraints" with an at-a-glance table and the pi iteration flowchart (all pi claims cited to v0.84.2);docs/architecture.md"one contract, two runtimes" and claude-vs-pi sandbox diagrams (mermaid, rendered by the site's component in both themes); the site gains click-to-enlarge for every mermaid diagram, every markdown table and long or wide code blocks (sharedEnlargeDialog.vuewith the theme's styles applied inside; diagrams at natural size with a fit toggle, tables/code reflowed to the full viewport; keyboard-reachable pill, Escape/backdrop close, closes on navigation) after Playwright measurements showed wide diagrams scaled to 0.3 and the security matrix scroll-boxed in the content column, and the runtime diagrams are drawn top-to-bottom; glossary/roadmap mentions; landing page (web/public/index.html) gains a "Multi-runtime / Claude Code · pi" hero stat, and the hero chip/subtitle name GitHub and GitLab (the rest of the page stays GitHub-only until GitLab is fully rolled out);cli-internals.md,images/README.md, topology docs.Testing
go build ./...,go vet, fullgo test ./...pass; 90+ pi tests (parser, agent parsing, Bootstrap/Run against a fakeopenshell, transcripts, image-ENV guard)node --test internal/runtime/pi_extension/— 15 tests (incl. a realpython3hook script); the hook guard fragment exercised under realshand Debiandash, including function/PATH shadowing ofsha256sum.env)medium(core/defaults.js) while Claude Code runs athighon Vertex/API-key and the fleet agents set noeffort:, soRunnow always passes--thinking— the harness effort when it is a pi level,highotherwise (4619aa3e; pi maps the level onto Anthropic adaptive effort and clamps it for non-reasoning models)analyze-transcript: 16 unit tests (make script-test) on pi session files and a Claude-shape transcript; ruff/ty/bandit clean--no-approvekeeps a planted.pi/extensions/evil.jsunloaded, missing credentials exit 1; the one blocker (print mode reads an open stdin to EOF) is closed with</dev/nullin the run commandmetrics.jsonruntime), andfeatures/runtime/pi.featureruns a minimal tool-using agent on haiku underruntime: piasserting the runtime, atoolCallin the pi session transcript and token usage — gated onBEHAVIOUR_CAPABILITIES=runtime-piuntilfullsend-sandbox:latestcarriesPI_VERSION; no change to the deprecated org-modee2e/adminsuitetool_responsein,hookSpecificOutput.updatedToolOutputout, shape-preserving); the first bot-review run on the merge head shows the v2 path live ([REDACTED PRIVATE KEY]in the review transcripts). An adversarial review then showed the now-effective heuristics rewriting ordinary output — reproduced (Readrewrote 105 of 900 fullsend files;pytest; go testwith 3 failures condensed to "passed"; CJK content NFKC-rewritten) and fixed in63a0a7d6, then hardened again in02fcaa3aafter a second Claude + Grok round (keyword-argument calls,id_token/system-qualified names, human passwords as literals,.txt/your_/dotted evasions, quoted|and comment/continuation command shapes, idempotent db-URL masking, detection copy immune to combining-mark/selector interleaving, key-agnosticPostToolUseFailurescan). a third verify-only round (3316308f) then closed what the exemptions had opened (realglpat-/glrt-/ya29./ASIAtokens get their own prefix patterns, the known-prefix exemption covers word-shaped fakes only, bare-identifier keyword arguments, AWS pagination tokens, an over-escaped quoted-region regex). A Grok round on the five follow-up commits then found the failure path blind toCf-split canaries (zero-width, bidi, tag characters) that the success path caught, plus four smaller gaps;e20d933bfolds format characters into the detection copy, schedules the failure phase whenever the chain has work there (not only when the canary is on), scans the detection copy for credentials on failures, teaches suppression about wrapped invocations (sudo/timeout/env/mise exec --), and stops pagination words vetoingNEXT_SECRET.56254034before it closed the failed-call gap as far as Claude Code's contract allows —PostToolUseFailureaccepts onlyadditionalContext, so the driver halts on a canary there and otherwise detects, logs (masked) and warns about credentials and control characters it cannot strip. Note the suppressors only ever see zero-exit output under Claude Code (a non-zero exit firesPostToolUseFailureinstead), while pi'stool_resultdoes deliver failed calls to the same chain.e7881dffbefore it adopted the invariant a parallel audit of the live hooks surfaced — condense only on positive evidence a tool printed, never from silence (a no-outputpre-commit runhad been reported as passed; Claude Code's Bash result carries no exit code to tell a clean run from a hook whose interpreter is missing) — and anchors the command matchers so a command that merely mentions a tool (grep -n scan-secrets …) keeps its output. 215 hook tests (was 160); the 900-file Read sweep went 105 → 14, all of them test files or doc examples holding real-shaped tokens/private keys that should be maskedcompatflags on Vertex, the fleet prompts under pi's system-prompt preamble, and records real fixtures viaregen.shRefs #6464. Supersedes #6466. Includes #6468 — closes #6357.
Post-script verification
agent/6464-pi-runtime-stub)