pi-daddy 0.21.0 → 0.22.0

package/src/grant-store.ts

@@ -52,6 +52,12 @@ export interface StoredGrant {
   projectLedger: boolean;
 }
 
+export type GrantStoreRefusalReason = "malformed" | "unsupported-version" | "unreadable" | "wrong-cwd";
+export type StoredGrantState =
+  | { state: "absent" }
+  | { state: "valid"; stored: StoredGrant }
+  | { state: "refuse"; reason: GrantStoreRefusalReason };
+
 export interface SaveGrantOptions {
   projectLedger?: boolean;
 }
@@ -84,26 +90,36 @@ export function grantStorePath(cwd: string): string {
  * treats absent and invalid stores alike (R-175), so do not call that wider behavior fail-closed. The `cwd`
  * check is R-27's: a copied file describes a directory nobody authorised it for.
  */
-export function parseStoredGrant(text: string, cwd: string): StoredGrant | null {
+export function parseStoredGrantState(text: string, cwd: string): StoredGrantState {
+  let parsed: { version?: unknown; cwd?: unknown; grant?: unknown; projectLedger?: unknown };
   try {
-    const parsed = JSON.parse(text) as {
-      version?: unknown;
-      cwd?: unknown;
-      grant?: unknown;
-      projectLedger?: unknown;
-    };
-    if (parsed.version !== 1 && parsed.version !== 2) return null;
-    if (parsed.cwd !== cwd) return null;
-    if (!Array.isArray(parsed.grant)) return null;
-    if (!parsed.grant.every((c) => typeof c === "string" && c.length > 0)) return null;
-    if (parsed.version === 2 && parsed.projectLedger !== true) return null;
-    return {
-      grant: parsed.grant as Capability[],
-      projectLedger: parsed.version === 2,
-    };
+    parsed = JSON.parse(text) as typeof parsed;
   } catch {
-    return null;
+    return { state: "refuse", reason: "malformed" };
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return { state: "refuse", reason: "malformed" };
+  }
+  if (parsed.version !== 1 && parsed.version !== 2) {
+    return { state: "refuse", reason: "unsupported-version" };
+  }
+  if (parsed.cwd !== cwd) return { state: "refuse", reason: "wrong-cwd" };
+  if (!Array.isArray(parsed.grant)) return { state: "refuse", reason: "malformed" };
+  if (!parsed.grant.every((c) => typeof c === "string" && c.length > 0)) {
+    return { state: "refuse", reason: "malformed" };
+  }
+  if (parsed.version === 2 && parsed.projectLedger !== true) {
+    return { state: "refuse", reason: "malformed" };
   }
+  return {
+    state: "valid",
+    stored: { grant: parsed.grant as Capability[], projectLedger: parsed.version === 2 },
+  };
+}
+
+export function parseStoredGrant(text: string, cwd: string): StoredGrant | null {
+  const result = parseStoredGrantState(text, cwd);
+  return result.state === "valid" ? result.stored : null;
 }
 
 /** Compatibility view for callers that need only the capability ceiling. */
@@ -120,27 +136,41 @@ export function parseGrantFile(text: string, cwd: string): Capability[] | null {
  * decision it exists to inform, so the store would silently fail to grant delegation — the exact class of
  * defect R-38 and R-39 were.
  */
-export function loadStoredGrantSync(cwd: string): StoredGrant | null {
+export function loadStoredGrantStateSync(cwd: string): StoredGrantState {
   try {
-    return parseStoredGrant(readFileSync(grantStorePath(cwd), "utf8"), cwd);
-  } catch {
-    return null;
+    return parseStoredGrantState(readFileSync(grantStorePath(cwd), "utf8"), cwd);
+  } catch (error) {
+    return (error as NodeJS.ErrnoException).code === "ENOENT"
+      ? { state: "absent" }
+      : { state: "refuse", reason: "unreadable" };
   }
 }
 
+export function loadStoredGrantSync(cwd: string): StoredGrant | null {
+  const result = loadStoredGrantStateSync(cwd);
+  return result.state === "valid" ? result.stored : null;
+}
+
 export function loadGrantSync(cwd: string): Capability[] | null {
   return loadStoredGrantSync(cwd)?.grant ?? null;
 }
 
 /** Async twin, for callers that already have one. Same parser, so they cannot disagree. */
-export async function loadStoredGrant(cwd: string): Promise<StoredGrant | null> {
+export async function loadStoredGrantState(cwd: string): Promise<StoredGrantState> {
   try {
-    return parseStoredGrant(await readFile(grantStorePath(cwd), "utf8"), cwd);
-  } catch {
-    return null;
+    return parseStoredGrantState(await readFile(grantStorePath(cwd), "utf8"), cwd);
+  } catch (error) {
+    return (error as NodeJS.ErrnoException).code === "ENOENT"
+      ? { state: "absent" }
+      : { state: "refuse", reason: "unreadable" };
   }
 }
 
+export async function loadStoredGrant(cwd: string): Promise<StoredGrant | null> {
+  const result = await loadStoredGrantState(cwd);
+  return result.state === "valid" ? result.stored : null;
+}
+
 export async function loadGrant(cwd: string): Promise<Capability[] | null> {
   return (await loadStoredGrant(cwd))?.grant ?? null;
 }

package/src/herdr-poll.ts

@@ -67,7 +67,7 @@ export async function waitForSettled(
 ): Promise<{ status?: string; timedOut?: boolean; aborted?: boolean; spawnError?: string }> {
   const interval = request.pollIntervalMs ?? POLL_INTERVAL_MS;
   // ADR-0032. The pane is read on every poll so the parent can show what the child is doing, rather than the
-  // one word `delegate` for up to ten minutes.
+  // one word `delegate` for up to twenty minutes by default.
   //
   // No cross-poll state is kept, deliberately: the previous design remembered what it had reported so it could
   // send a diff, and that is what broke — see `tailLines`. A snapshot needs no memory.

package/src/init.ts

@@ -26,6 +26,7 @@ import { mkdir, open, rm, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { agentCapability, workspaceCapability } from "./capabilities.ts";
 import { ceilingForDefinition } from "./definitions.ts";
+import { runWithFinalizers } from "./finalization.ts";
 import { ALWAYS_LIVE, assertGrantIsWritable, isLiveByDefault, renderGrantEnv, type GrantEnvSkill } from "./grant-env.ts";
 import { PI_BUILTIN_TOOLS } from "./pi-tools.ts";
 import type { Capability } from "./resolve.ts";
@@ -332,11 +333,10 @@ async function createUnlessPresent(path: string, content: string, outcome: InitO
   try {
     await mkdir(join(path, ".."), { recursive: true });
     const handle = await open(path, "wx");
-    try {
-      await handle.writeFile(content, "utf8");
-    } finally {
-      await handle.close();
-    }
+    await runWithFinalizers(
+      () => handle.writeFile(content, "utf8"),
+      [{ label: "new-file handle cleanup failed", run: () => handle.close() }],
+    );
     outcome.written.push(path);
   } catch (error) {
     if ((error as { code?: string }).code === "EEXIST") outcome.kept.push(path);

package/src/model-preflight.ts

@@ -0,0 +1,32 @@
+import { refusal, type StructuredRefusal } from "./refusals.ts";
+
+export const ENV_ALLOW_UNRESOLVED_MODELS = "PI_GRANTS_ALLOW_UNRESOLVED_MODELS";
+
+export interface ModelCatalogue {
+  find(provider: string, modelId: string): unknown;
+}
+
+/** Resolve an explicit provider/id against pi's own session catalogue without probing credentials or network. */
+export function preflightModel(
+  model: string | undefined,
+  catalogue: ModelCatalogue,
+  cache: Map<string, boolean>,
+  allowUnresolved: boolean,
+): StructuredRefusal | undefined {
+  if (model === undefined || allowUnresolved) return undefined;
+  const slash = model.indexOf("/");
+  const provider = slash > 0 ? model.slice(0, slash) : "";
+  const id = slash > 0 ? model.slice(slash + 1) : "";
+  let resolved = cache.get(model);
+  if (resolved === undefined) {
+    resolved = provider.length > 0 && id.length > 0 && catalogue.find(provider, id) !== undefined;
+    cache.set(model, resolved);
+  }
+  if (resolved) return undefined;
+  return refusal(
+    "MODEL_UNRESOLVED",
+    `grants: model ${model || "(empty)"} is not in pi's session catalogue; use provider/id from /model, ` +
+      `or set ${ENV_ALLOW_UNRESOLVED_MODELS}=1 to let pi attempt custom resolution`,
+    { model: model || "(empty)" },
+  );
+}

package/src/refusals.ts

@@ -11,6 +11,8 @@ export const REFUSAL_CODES = [
   "DEPTH_EXCEEDED",
   "FANOUT_EXCEEDED",
   "EXECUTOR_UNAVAILABLE",
+  "MODEL_UNRESOLVED",
+  "GRANT_STORE_INVALID",
   // Execution-phase outcomes. Without these, an external controller could distinguish a policy refusal
   // from an internal error but not a lost writer lease from a user pressing stop (R-103).
   "CHILD_TIMED_OUT",

package/src/run-child.ts

@@ -111,8 +111,8 @@ export interface ChildRunResult {
 
 /** 1 MiB. A delegation returns a summary; anything larger is a runaway, not an answer. */
 export const DEFAULT_MAX_OUTPUT_BYTES = 1024 * 1024;
-/** 10 minutes. Long enough for a real sub-agent task, short enough that a hang is not forever. */
-export const DEFAULT_TIMEOUT_MS = 10 * 60 * 1000;
+/** 20 minutes. Long-running sub-agent work often exceeded ten; a hang remains bounded. */
+export const DEFAULT_TIMEOUT_MS = 20 * 60 * 1000;
 /** Grace between SIGTERM and SIGKILL. A child that ignores SIGTERM must not make the timeout advisory. */
 export const DEFAULT_KILL_GRACE_MS = 5000;
 

package/src/run-herdr.ts

@@ -22,6 +22,7 @@
  */
 
 import { rm } from "node:fs/promises";
+import { runWithFinalizers } from "./finalization.ts";
 import type { ChildRunResult } from "./run-child.ts";
 import { DEFAULT_MAX_OUTPUT_BYTES, DEFAULT_TIMEOUT_MS } from "./run-child.ts";
 import { MAX_OPEN_PANES, markPaneSettled, trackPane, trimOpenPanes, untrackPane } from "./pane-reaper.ts";
@@ -293,7 +294,7 @@ export async function runHerdrPane(request: HerdrRunRequest): Promise<ChildRunRe
   // early `return` from a failed start or prompt — leaves it false, so `cleanup` closes the tab.
   let settledCleanly = false;
 
-  try {
+  return runWithFinalizers(async () => {
     const started = await startAgent(exec, agentName, paneId, effectiveArgs, deadline);
     if (started.error) return { ...empty, spawnError: `herdr agent start failed: ${started.error}` };
 
@@ -352,9 +353,10 @@ export async function runHerdrPane(request: HerdrRunRequest): Promise<ChildRunRe
       timedOut: false,
       aborted: false,
     };
-  } finally {
-    await cleanup(settledCleanly);
-  }
+  }, [{
+    label: "herdr pane finalizer failed",
+    run: () => cleanup(settledCleanly),
+  }]);
 }
 
 /**