@edgehero/pi-dispatch 3.0.0 → 3.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@edgehero/pi-dispatch",
-  "version": "3.0.0",
+  "version": "3.1.0",
   "type": "module",
   "description": "The pi-dispatch worker and CLI: runs the pi coding agent as a self-hosted service, one locked down Docker or Podman container per job, with spend caps checked before anything is spent, plus init, up, doctor and service install.",
   "keywords": [
@@ -105,7 +105,7 @@
     "start": "node src/cli.mjs worker"
   },
   "dependencies": {
-    "@earendil-works/pi-ai": "0.99.1",
+    "@earendil-works/pi-ai": "1.0.3",
     "@octokit/auth-app": "8.2.0",
     "@octokit/rest": "22.0.1",
     "bullmq": "5.80.4",

package/src/config.mjs

@@ -195,7 +195,7 @@ function forwardEnvList(raw, egressArmed = false) {
 	if (owned.length > 0) {
 		throw configError(`PI_FORWARD_ENV must not forward ${owned.join(", ")} -- the worker writes ${owned.length === 1 ? "it" : "them"} into every job's container itself, and a forwarded host value would replace the per-job one (a forwarded PI_MODEL runs a model the pre-spend checks never saw)`);
 	}
-	// Issue #500: the two names the runner sets in its own environment for its descendants (RUNNER_ENV_NAMES). A forwarded
+	// Issue #500: the names the runner sets in its own environment for its descendants (RUNNER_ENV_NAMES). A forwarded
 	// host value would sit in the runner's environment before the runner sets its own.
 	const runnerOwned = names.filter((n) => RUNNER_ENV_NAMES.has(n));
 	if (runnerOwned.length > 0) {

package/src/doctor.mjs

@@ -66,7 +66,7 @@ import { isTransientOverlayRead, overlayProviderProblem } from "./model-catalog.
 import { EMPTY_USD_FINGERPRINT, usdFingerprint } from "./dollar-fingerprint.mjs";
 import { splitModelEntry } from "./model-ref.mjs";
 import { ignoredOutputCapModels, outputCapView, outputUnboundable } from "./output-cap.mjs";
-import { KEYLESS_API_KEY, KEYLESS_HOW, MODEL_ENDPOINTS_FILE_NAME, MODEL_ENDPOINTS_INCLUDE_NAME, MODEL_ENDPOINT_ID_RE, OVERLAY_LINK_FIX, OVERLAY_NOT_A_FILE_FIX, baseUrlTarget, keylessVerdict, loadModelEndpoints, readOverlayModels, renderEndpointsInclude, unreportedUsageModels } from "./model-endpoints.mjs";
+import { KEYLESS_API_KEY, KEYLESS_HOW, MODEL_ENDPOINTS_FILE_NAME, MODEL_ENDPOINTS_INCLUDE_NAME, MODEL_ENDPOINT_ID_RE, OVERLAY_LINK_FIX, OVERLAY_NOT_A_FILE_FIX, RENAMED_PROVIDERS, baseUrlTarget, keylessVerdict, loadModelEndpoints, providerRenameHint, readOverlayModels, renderEndpointsInclude, unreportedUsageModels } from "./model-endpoints.mjs";
 import { declaredEndpointsIn, endpointsDeclaredIn, reloadCommand, rulesFileIncludes, rulesPredateEndpointsLine } from "./egress-cli.mjs";
 import { loadPauseWindows, parseScopeString } from "./pause-windows.mjs";
 import { WAIT_AFTER_MAX_DEFAULT_MS, afterInstantMs, parseWaitProfiles } from "./wait-for.mjs";
@@ -2554,7 +2554,17 @@ export async function collectChecks(shellVars, seams) {
 			if (typeof error?.code === "string") keylessUnreadable = error.code;
 		}
 	}
-	const keyCheck = providerKeyCheck({ provider, env: { ...env, ...keyFromFile }, agentDir: keyAgentDir, oracle, nodeOk: checks[0]?.ok, keyless: { endpoints: keylessEndpoints, models: keylessModels, unreadable: keylessUnreadable } });
+	// Issue #587's review: the rename hint is judged on the overlay itself, read whenever there is one, endpoint or not.
+	let hintModels = keylessModels;
+	let hintUnread = false;
+	if (unknownToPi && hintModels === null && Object.hasOwn(RENAMED_PROVIDERS, provider) && typeof env.PI_GLOBAL_PI_DIR === "string" && isAbsolute(env.PI_GLOBAL_PI_DIR)) {
+		try {
+			hintModels = readOverlayModels(env.PI_GLOBAL_PI_DIR, keylessIo);
+		} catch {
+			hintUnread = true;
+		}
+	}
+	const keyCheck = providerKeyCheck({ provider, env: { ...env, ...keyFromFile }, agentDir: keyAgentDir, oracle, nodeOk: checks[0]?.ok, keyless: { endpoints: keylessEndpoints, models: keylessModels, unreadable: keylessUnreadable, hintModels, hintUnread } });
 	const keyNamed = Object.keys(keyFromFile).filter((name) => keyCheck.label?.includes(`: ${name})`));
 	// Issue #481 (PR #485 review round 2): a key found nowhere doctor can look is one an env-setup script may export, which
 	// is the documented home for a provider key fetched from a secrets manager (docs/secrets.md).
@@ -2692,7 +2702,20 @@ export async function collectChecks(shellVars, seams) {
 				// `overlayProviderProblem`). pi drops that whole entry, so the worker refuses every job on the provider.
 				const providers = overlayModels?.providers;
 				for (const name of providers !== null && typeof providers === "object" && !Array.isArray(providers) ? Object.keys(providers) : []) {
-					const problem = overlayProviderProblem(providers[name], name);
+					// Issue #587: an entry under an id pi renamed that lacks what a provider of its own needs (an api, a baseUrl
+					// and models). It was an override of the builtin provider; under the new pi it is a custom provider with no
+					// models, so it overrides nothing, and the builtin models it meant run with their own (empty) baseUrl.
+					const entry = providers[name];
+					if (Object.hasOwn(RENAMED_PROVIDERS, name) && entry !== null && typeof entry === "object" && !Array.isArray(entry) && (entry.api === undefined || entry.baseUrl === undefined || !Array.isArray(entry.models))) {
+						const renamedTo = RENAMED_PROVIDERS[name];
+						checks.push({
+							ok: false,
+							warn: true,
+							label: `Overlay models.json entry ${JSON.stringify(name)} no longer overrides anything: pi 1.0.3 renamed that provider to ${JSON.stringify(renamedTo)}, so this entry is now a provider of its own, holding only what it declares itself, and the ${renamedTo} models do not get its settings`,
+							fix: `rename the entry to ${JSON.stringify(renamedTo)} in ${modelsPath} (and every ${name}/ model reference in the triggers to ${renamedTo}/), then re-run doctor`,
+						});
+					}
+					const problem = overlayProviderProblem(entry, name);
 					if (problem === null) continue;
 					checks.push({
 						ok: false,
@@ -4241,10 +4264,14 @@ function noKeyVariableCheck(provider, oracle, keyless = null) {
 	const owner = oracle.piProviders().find((id) => oracle.providerKeyCandidates(id).includes(wanted));
 	// Why a custom provider the overlay defines is not keyless, when it is one: the one fact the operator has to change.
 	const why = verdict.why ? `; it is not keyless because ${verdict.why}` : "";
+	// Issue #587: an id pi renamed (azure-openai-responses is `azure` since pi 1.0.3), named, unless the overlay declares it.
+	const renamed = providerRenameHint(provider, { models: keyless?.hintModels ?? keyless?.models ?? null, overlayUnread: keyless?.hintUnread === true, piProviders: oracle.piProviders() });
 	return {
 		ok: false,
-		label: `PI_PROVIDER is ${JSON.stringify(provider)}, which is not a provider pi has${why}`,
-		fix: owner
+		label: `PI_PROVIDER is ${JSON.stringify(provider)}, which is not a provider pi has${why}${renamed ? `;${renamed}` : ""}`,
+		fix: renamed
+			? `set PI_PROVIDER=${RENAMED_PROVIDERS[provider]}, and rename the provider in every trigger's model and allowed-models entries and in models.json the same way (docs/triggers.md)`
+			: owner
 			? `set PI_PROVIDER=${owner}, the provider pi reads ${wanted} from -- or unset it for the default \`anthropic\`; or, ${KEYLESS_HOW}`
 			: `set PI_PROVIDER to a provider id pi has, or unset it for the default \`anthropic\`: ${oracle.piProviders().join(", ")}; or, ${KEYLESS_HOW}`,
 	};

package/src/env-allowlist.mjs

@@ -33,7 +33,7 @@ import { egressEnv } from "./egress.mjs";
 import { forgeSpec } from "./forges.mjs";
 import { apiKeyVariable } from "./provider-key.mjs";
 import { isDeterminateFsCode } from "./transient.mjs";
-import { KEYLESS_HOW, keylessVerdict } from "./model-endpoints.mjs";
+import { KEYLESS_HOW, keylessVerdict, providerRenameHint, readOverlayModels, RENAMED_PROVIDERS } from "./model-endpoints.mjs";
 import { KEYLESS_ENV_NAME } from "./reserved-env.mjs";
 
 function configError(message) {
@@ -161,7 +161,7 @@ export function resolveProviderCredential({ provider, hostEnv, authFromPi = fals
 			error.code = unreadable.code;
 			throw error;
 		}
-		throw configError(unknownProviderMessage(provider));
+		throw configError(unknownProviderMessage(provider, hintOverlay(provider, modelEndpoints, hostEnv)));
 	}
 	const held = candidates
 		.map((name) => [name, hostEnv[name]])
@@ -209,8 +209,24 @@ export function keylessEndpointsFor(provider, modelEndpoints) {
 	return verdict.keyless ? verdict.endpoints : null;
 }
 
-function unknownProviderMessage(provider) {
-	return `pi has no provider "${provider}", so there is no key variable to give it a key. Use one of pi's provider ids with its key in the worker environment or in pi's auth.json, or, ${KEYLESS_HOW}.`;
+function unknownProviderMessage(provider, overlay = {}) {
+	return `pi has no provider "${provider}", so there is no key variable to give it a key.${providerRenameHint(provider, { ...overlay, piProviders: piProviders() })} Use one of pi's provider ids with its key in the worker environment or in pi's auth.json, or, ${KEYLESS_HOW}.`;
+}
+
+/**
+ * The overlay models.json the rename hint is judged on (issue #587's review): the pickup's snapshot when it read one, else
+ * the overlay itself, read here, only for an id pi renamed. The snapshot reads the overlay only when an endpoint is
+ * declared, so a full custom provider under the old id, with no endpoint, was told "did you mean". A read that fails
+ * is `overlayUnread`: no guess.
+ */
+function hintOverlay(provider, modelEndpoints, hostEnv) {
+	if (modelEndpoints?.models) return { models: modelEndpoints.models };
+	if (!Object.hasOwn(RENAMED_PROVIDERS, provider)) return {};
+	try {
+		return { models: readOverlayModels(hostEnv?.PI_GLOBAL_PI_DIR) };
+	} catch {
+		return { overlayUnread: true };
+	}
 }
 
 function defaultAgentDir(hostEnv) {
@@ -524,13 +540,15 @@ export function buildContainerEnv({ provider, model, maxTurns, maxTokens, maxCos
 	if (exitAuth === true) env.PI_EXIT_AUTH = "stdin";
 	else delete env.PI_EXIT_AUTH;
 
-	// Issue #500: the runner sets these two in its own environment, for its child processes, and no value from outside
+	// Issue #500: the runner sets these in its own environment, for its child processes, and no value from outside
 	// may arrive first. Both lists refuse them upstream (config.mjs for PI_FORWARD_ENV, the triggers loader for
 	// run.secrets, through RUNNER_ENV_NAMES); this is the line that holds if either refusal is ever bypassed.
 	// env-internal PI_DISPATCH_CHILD_LEDGER: set by the runner inside the container, never by the worker, so removed here.
 	delete env.PI_DISPATCH_CHILD_LEDGER;
 	// env-internal PI_DISPATCH_RUNNER_PID: set by the runner inside the container, never by the worker, so removed here.
 	delete env.PI_DISPATCH_RUNNER_PID;
+	// env-internal PI_DISPATCH_PRICE_TABLE: set by the runner inside the container, never by the worker, so removed here.
+	delete env.PI_DISPATCH_PRICE_TABLE;
 
 	// Forge-backed jobs, and local cron jobs that opted in via run.github. Other local-folder jobs have
 	// no token (CONST-TOKEN-SCOPED-PER-JOB). The mint goes into BOTH of its forge's variables because

package/src/host-pi.mjs

@@ -15,7 +15,7 @@
  * What it must never become. Nothing on the worker's BOOT path may import this file. It reads host paths and
  * may spawn a package manager, and neither belongs anywhere near `start.mjs`.
  *
- * Everything here MIRRORS a private detail of the pinned pi (0.99.1) rather than calling it: pi exports no
+ * Everything here MIRRORS a private detail of the pinned pi (1.0.3) rather than calling it: pi exports no
  * public answer to "where is this package installed" or "is this resource enabled", and importing the whole
  * coding-agent SDK to read two well-known paths is not worth the weight. That mirroring is a real risk --
  * pi could change the grammar and we would silently start staging something the operator turned off -- so it

package/src/model-catalog.mjs

@@ -91,7 +91,7 @@ function overlayDeclares(overlay, provider, id) {
 
 /**
  * Would pi COMPOSE this overlay provider (PR #536's review)? A file that passes pi's schema can still lose a provider
- * at the next step: pi 0.99.1's `applyModelsJson` and `modelFromJson` (`pi-coding-agent/dist/core/provider-composer.js`)
+ * at the next step: the pinned pi's `applyModelsJson` and `modelFromJson` (`pi-coding-agent/dist/core/provider-composer.js`)
  * throw for `oauth` with no `baseUrl`, and per model no resolvable `api` or
  * `baseUrl`, or a `contextWindow` or `maxTokens` at or below zero. pi then keeps the provider's BUILTIN models
  * (`ModelRuntime.composeProvider` falls back to the base) and drops every model the overlay added, so such a model

package/src/model-endpoints.mjs

@@ -518,6 +518,28 @@ export function unreportedUsageModels(models, { builtinModel = () => null, built
 /** The exact `apiKey` a keyless provider's models.json entry carries: pi resolves `$NAME` from the job's environment. */
 export const KEYLESS_API_KEY = `$${KEYLESS_ENV_NAME}`;
 
+/**
+ * Provider ids pi renamed, old to new (issue #587: pi 1.0.3 renamed `azure-openai-responses` to `azure`, and its catalog
+ * file with it; the api id `azure-openai-responses` is unchanged). Pinned against the catalog by
+ * worker/test/env-allowlist.test.mjs: every old id is gone from pi, every new id is there. A rename is not a refusal of
+ * its own: the old id is already refused before spend as a provider pi does not have, and this only lets that refusal
+ * and doctor say which id was meant.
+ */
+export const RENAMED_PROVIDERS = Object.freeze({ "azure-openai-responses": "azure" });
+
+/**
+ * The "did you mean" for a provider pi renamed, or "" (issue #587). Only for an old id pi no longer has, whose new id pi
+ * does have, and that the overlay's models.json (`models`, parsed, or null when there is none) does not declare: a
+ * provider the file declares under the old id is the operator's own custom provider, and the hint would be wrong there.
+ * `overlayUnread`: the overlay exists but could not be read, so whether it declares the id is not known: no guess.
+ */
+export function providerRenameHint(provider, { models = null, piProviders = [], overlayUnread = false } = {}) {
+	if (typeof provider !== "string" || !Object.hasOwn(RENAMED_PROVIDERS, provider)) return "";
+	const renamed = RENAMED_PROVIDERS[provider];
+	if (overlayUnread || piProviders.includes(provider) || !piProviders.includes(renamed) || providerOf(models, provider) !== null) return "";
+	return ` pi renamed the provider "${provider}" to "${renamed}" in pi 1.0.3: did you mean "${renamed}"?`;
+}
+
 /**
  * The second way into the credential gate, said once for every refusal and doctor line that names it (issue #503).
  */

package/src/models-json.mjs

@@ -1,5 +1,5 @@
 /**
- * The overlay `models.json`, read the way pi reads it (issue #502, PR #536's review): pi 0.99.1's
+ * The overlay `models.json`, read the way pi reads it (issue #502, PR #536's review): pi's
  * `ModelConfig.load` (`pi-coding-agent/dist/core/model-config.js`) strips a leading BOM, strips `//` comments and
  * trailing commas outside strings, parses, and then checks the whole document against its TypeBox schema. ANY
  * schema error drops the WHOLE file: pi then knows none of its providers or models.
@@ -121,7 +121,8 @@ const T = {
 const opt = (check) => [check, true];
 const req = (check) => [check, false];
 
-// The schema, transcribed from model-config.js at the 0.99.1 pin, in its order.
+// The schema, transcribed from model-config.js at the pin (1.0.3; worker/test/models-json.test.mjs holds the file's
+// content hash), in its order.
 const PercentileCutoffs = T.obj({ p50: opt(T.num()), p75: opt(T.num()), p90: opt(T.num()), p99: opt(T.num()) });
 const numOrStr = T.union(T.num(), T.str());
 const OpenRouterRouting = T.obj({
@@ -142,6 +143,9 @@ const OpenRouterRouting = T.obj({
 const VercelGatewayRouting = T.obj({ only: opt(T.arr(T.str())), order: opt(T.arr(T.str())) });
 const ThinkingValue = T.union(T.str(), T.nul());
 const ThinkingLevelMap = T.obj({ off: opt(ThinkingValue), minimal: opt(ThinkingValue), low: opt(ThinkingValue), medium: opt(ThinkingValue), high: opt(ThinkingValue), xhigh: opt(ThinkingValue), max: opt(ThinkingValue) });
+// pi 1.0.2 (issue #587): a model's sampling parameters, and the same per thinking level, merged per call over them.
+const SamplingParams = T.rec(T.unknown());
+const SamplingParamsByThinkingLevel = T.obj({ off: opt(SamplingParams), minimal: opt(SamplingParams), low: opt(SamplingParams), medium: opt(SamplingParams), high: opt(SamplingParams), xhigh: opt(SamplingParams), max: opt(SamplingParams) });
 const KwargScalar = T.union(T.str(), T.num(), T.bool(), T.nul());
 const KwargVariable = T.obj({ $var: req(T.union(T.lit("thinking.enabled"), T.lit("thinking.effort"))), omitWhenOff: opt(T.bool()) });
 const Kwarg = T.union(KwargScalar, KwargVariable);
@@ -214,7 +218,8 @@ const ModelDefinition = T.obj({
 	promptCache: opt(ModelPromptCache),
 	contextWindow: opt(T.num()),
 	maxTokens: opt(T.num()),
-	samplingParams: opt(T.rec(T.unknown())),
+	samplingParams: opt(SamplingParams),
+	samplingParamsByThinkingLevel: opt(SamplingParamsByThinkingLevel),
 	headers: opt(headers),
 	compat: opt(ProviderCompat),
 });
@@ -228,7 +233,8 @@ const ModelOverride = T.obj({
 	promptCache: opt(ModelPromptCache),
 	contextWindow: opt(T.num()),
 	maxTokens: opt(T.num()),
-	samplingParams: opt(T.rec(T.unknown())),
+	samplingParams: opt(SamplingParams),
+	samplingParamsByThinkingLevel: opt(SamplingParamsByThinkingLevel),
 	headers: opt(headers),
 	compat: opt(ProviderCompat),
 });

package/src/output-cap.mjs

@@ -13,7 +13,7 @@
 
 import { composedCost, endpointsForModel, isZeroCost, modelEntryOf } from "./model-endpoints.mjs";
 
-/** The hosts pi's catalog serves openai-completions on: the runner's `COMPLETIONS_CATALOG_HOSTS`, copied. */
+/** The hosts pi's catalog serves openai-completions on: the runner's `COMPLETIONS_CATALOG_HOSTS`, generated the same way. */
 export const COMPLETIONS_CATALOG_HOSTS = Object.freeze([
 	"api.ant-ling.com",
 	"api.cerebras.ai",
@@ -56,7 +56,7 @@ export function completionsOwnServer(model) {
 }
 
 /**
- * The parts of a model the rule reads, composed as pi 0.99.1's provider-composer.js composes them from the overlay
+ * The parts of a model the rule reads, composed as the pinned pi's provider-composer.js composes them from the overlay
  * `models.json` (`models`, parsed, or null) and the builtin catalog (`builtinModel(provider, id)`, injected):
  *   - a model the overlay DEFINES: its own `api` and `baseUrl`, else its provider's, else those of pi's DEFAULTS
  *     model (`findModelDefaults`, mirrored in `definedDefaults`); its compat field from its `modelOverrides` entry,
@@ -94,7 +94,7 @@ export function outputCapView({ models, provider, modelId, builtinModel = () =>
 const str = (v) => (typeof v === "string" ? v : undefined);
 
 /**
- * The `{ api, baseUrl }` pi 0.99.1 composes for the overlay-defined model `modelId` (provider-composer.js
+ * The `{ api, baseUrl }` the pinned pi composes for the overlay-defined model `modelId` (provider-composer.js
  * `applyModelsJson`): the provider's chat models start as the catalog's (each on the provider's `baseUrl` when it sets
  * one), and each definition in the file's order is composed and then replaces the model of its id or joins the list.
  * A definition's `api` is its own, else the provider's, else its DEFAULTS model's, and its `baseUrl` likewise, where the

package/src/reserved-env.mjs

@@ -64,11 +64,12 @@ export const CONTAINER_ENV_NAMES = new Set([
 
 /**
  * Issue #500: the names the RUNNER sets in its own environment inside the container, for its descendants: the child
- * ledger directory and the runner's pid (image/runner/src/usage-meter.mjs, openChildLedger). The worker never writes
+ * ledger directory and the runner's pid (image/runner/src/usage-meter.mjs, openChildLedger), and the hash of the price
+ * table the runner hands its children (publishPriceTable, issue #587's review). The worker never writes
  * them, so they are not in the set above (which a test pins to what buildContainerEnv emits). They are reserved all the
  * same: a trigger binding one through `run.secrets`, or a host value forwarded through `PI_FORWARD_ENV`, would arrive in
  * the runner's environment before the runner sets its own, and a value the runner then failed to replace would point
  * every pi child's ledger at a directory the agent chose. Refused at load in both lists, and deleted by
  * buildContainerEnv after both loops as the backstop.
  */
-export const RUNNER_ENV_NAMES = new Set(["PI_DISPATCH_CHILD_LEDGER", "PI_DISPATCH_RUNNER_PID"]);
+export const RUNNER_ENV_NAMES = new Set(["PI_DISPATCH_CHILD_LEDGER", "PI_DISPATCH_PRICE_TABLE", "PI_DISPATCH_RUNNER_PID"]);

package/src/triggers.mjs

@@ -173,12 +173,14 @@ export const REVIEW_STATES = new Set(["approved", "changes_requested", "commente
 const REVIEW_ACTION = "review_submitted";
 
 /**
- * The pi tool names a trigger may exclude (issue #291) -- the built-in set of the PINNED pi, 0.99.1, in pi's
- * own `allToolNames` order. `powershell` joined it at the 0.99.1 bump (issue #509): pi registers it as a
+ * The pi tool names a trigger may exclude (issue #291) -- the built-in set of the PINNED pi (the version
+ * image/runner/package.json pins), in pi's own `allToolNames` order. `powershell` joined it at the 0.99.1 bump (issue #509): pi registers it as a
  * built-in but does not activate it by default (`DEFAULT_TOOL_NAMES` is read, bash, edit, write), so a
  * trigger that means "no shell" names it beside `bash`.
- * Hand-written because this validator is pure and pi-free (the worker does not depend on the agent
- * package), and therefore BOLTED twice to the artifact it restates: `worker/test/exclude-tools.pinned.test.mjs`
+ * A literal because this validator is pure and pi-free (the worker does not depend on the agent
+ * package). The line is GENERATED from the pinned pi by .github/scripts/pi-derived.mjs (issue #587; a pi bump
+ * reruns it), held to that generation by worker/test/pi-derived.test.mjs, and BOLTED twice to the artifact it
+ * restates: `worker/test/exclude-tools.pinned.test.mjs`
  * and `image/runner/test/pinned-api.test.mjs` both derive the set from the pinned package and fail with a
  * grow-these-together message when a pin bump moves it. Extension and custom tool names are deliberately
  * NOT here: they register at container start (a staged package, a serviced repo's own `.pi/extensions`),