pi-daddy 0.21.1 → 0.22.0

package/src/init.ts

@@ -26,6 +26,7 @@ import { mkdir, open, rm, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { agentCapability, workspaceCapability } from "./capabilities.ts";
 import { ceilingForDefinition } from "./definitions.ts";
+import { runWithFinalizers } from "./finalization.ts";
 import { ALWAYS_LIVE, assertGrantIsWritable, isLiveByDefault, renderGrantEnv, type GrantEnvSkill } from "./grant-env.ts";
 import { PI_BUILTIN_TOOLS } from "./pi-tools.ts";
 import type { Capability } from "./resolve.ts";
@@ -332,11 +333,10 @@ async function createUnlessPresent(path: string, content: string, outcome: InitO
   try {
     await mkdir(join(path, ".."), { recursive: true });
     const handle = await open(path, "wx");
-    try {
-      await handle.writeFile(content, "utf8");
-    } finally {
-      await handle.close();
-    }
+    await runWithFinalizers(
+      () => handle.writeFile(content, "utf8"),
+      [{ label: "new-file handle cleanup failed", run: () => handle.close() }],
+    );
     outcome.written.push(path);
   } catch (error) {
     if ((error as { code?: string }).code === "EEXIST") outcome.kept.push(path);

package/src/model-preflight.ts

@@ -0,0 +1,32 @@
+import { refusal, type StructuredRefusal } from "./refusals.ts";
+
+export const ENV_ALLOW_UNRESOLVED_MODELS = "PI_GRANTS_ALLOW_UNRESOLVED_MODELS";
+
+export interface ModelCatalogue {
+  find(provider: string, modelId: string): unknown;
+}
+
+/** Resolve an explicit provider/id against pi's own session catalogue without probing credentials or network. */
+export function preflightModel(
+  model: string | undefined,
+  catalogue: ModelCatalogue,
+  cache: Map<string, boolean>,
+  allowUnresolved: boolean,
+): StructuredRefusal | undefined {
+  if (model === undefined || allowUnresolved) return undefined;
+  const slash = model.indexOf("/");
+  const provider = slash > 0 ? model.slice(0, slash) : "";
+  const id = slash > 0 ? model.slice(slash + 1) : "";
+  let resolved = cache.get(model);
+  if (resolved === undefined) {
+    resolved = provider.length > 0 && id.length > 0 && catalogue.find(provider, id) !== undefined;
+    cache.set(model, resolved);
+  }
+  if (resolved) return undefined;
+  return refusal(
+    "MODEL_UNRESOLVED",
+    `grants: model ${model || "(empty)"} is not in pi's session catalogue; use provider/id from /model, ` +
+      `or set ${ENV_ALLOW_UNRESOLVED_MODELS}=1 to let pi attempt custom resolution`,
+    { model: model || "(empty)" },
+  );
+}

package/src/refusals.ts

@@ -11,6 +11,8 @@ export const REFUSAL_CODES = [
   "DEPTH_EXCEEDED",
   "FANOUT_EXCEEDED",
   "EXECUTOR_UNAVAILABLE",
+  "MODEL_UNRESOLVED",
+  "GRANT_STORE_INVALID",
   // Execution-phase outcomes. Without these, an external controller could distinguish a policy refusal
   // from an internal error but not a lost writer lease from a user pressing stop (R-103).
   "CHILD_TIMED_OUT",

package/src/run-herdr.ts

@@ -22,6 +22,7 @@
  */
 
 import { rm } from "node:fs/promises";
+import { runWithFinalizers } from "./finalization.ts";
 import type { ChildRunResult } from "./run-child.ts";
 import { DEFAULT_MAX_OUTPUT_BYTES, DEFAULT_TIMEOUT_MS } from "./run-child.ts";
 import { MAX_OPEN_PANES, markPaneSettled, trackPane, trimOpenPanes, untrackPane } from "./pane-reaper.ts";
@@ -293,7 +294,7 @@ export async function runHerdrPane(request: HerdrRunRequest): Promise<ChildRunRe
   // early `return` from a failed start or prompt — leaves it false, so `cleanup` closes the tab.
   let settledCleanly = false;
 
-  try {
+  return runWithFinalizers(async () => {
     const started = await startAgent(exec, agentName, paneId, effectiveArgs, deadline);
     if (started.error) return { ...empty, spawnError: `herdr agent start failed: ${started.error}` };
 
@@ -352,9 +353,10 @@ export async function runHerdrPane(request: HerdrRunRequest): Promise<ChildRunRe
       timedOut: false,
       aborted: false,
     };
-  } finally {
-    await cleanup(settledCleanly);
-  }
+  }, [{
+    label: "herdr pane finalizer failed",
+    run: () => cleanup(settledCleanly),
+  }]);
 }
 
 /**