pi-orchestrator-config 4.3.4 → 4.3.5

package/README.md

@@ -452,28 +452,34 @@ variables. Pi-config settings (image_model, acpx_agents, vertex_claude_1m, etc.)
 go in `.pi/pi-config-settings.json` — not here:
 
 ```env
-# Timezone (host timezone for correct timestamps)
-TZ=Asia/Jerusalem
+# Timezone (host timezone for correct timestamps) — plain value, no inline comment:
+# `docker run --env-file` does not strip trailing comments.
+TZ=America/New_York
 
 # Host username (creates /home/<user> -> container home symlink so host paths resolve)
-PI_HOST_USER=myakove
+PI_HOST_USER=youruser
+
+# Host UID/GID belong on the docker alias (see below), not hardcoded here:
+#   -e PI_HOST_UID="$(id -u)" -e PI_HOST_GID="$(id -g)"
+# The entrypoint remaps user `node` to those ids so bind-mounted 0600/0700
+# files (~/.npmrc, ~/.ssh) are readable. IPA/LDAP users are not UID 1000.
 
 # Google Cloud / Vertex AI
 GOOGLE_CLOUD_PROJECT=your-project-id
 GOOGLE_CLOUD_LOCATION=us-east5
-GOOGLE_APPLICATION_CREDENTIALS=/home/myakove/.config/gcloud/application_default_credentials.json
+GOOGLE_APPLICATION_CREDENTIALS=/home/youruser/.config/gcloud/application_default_credentials.json
 
 # GitHub
 GITHUB_TOKEN=ghp_xxx
 GITHUB_API_TOKEN=ghp_xxx
-GH_CONFIG_DIR=/home/myakove/.config/gh
+GH_CONFIG_DIR=/home/youruser/.config/gh
 
 # Gemini (optional — required for image generation)
 GEMINI_API_KEY=xxx
 
 # mcpl (MCP Launchpad) config path inside the container (must match mount target)
 # Use your actual home path — it resolves inside the container via the PI_HOST_USER symlink
-MCPL_CONFIG_FILES=/home/myakove/.config/mcpl/mcp.json
+MCPL_CONFIG_FILES=/home/youruser/.config/mcpl/mcp.json
 ```
 
 Pass via `--env-file /path/to/.env` in the docker run command.
@@ -645,6 +651,7 @@ PI_PIDIFF_ENABLE=false pi
 | `kubectl` / `oc` | Kubernetes and OpenShift CLI |
 | `agent-browser` | Browser automation CLI (navigate, click, screenshot, forms) |
 | `procps` | Process utilities (ps, top, pgrep, pkill) |
+| `passwd` | `usermod`/`groupmod` — init remaps user `node` to `PI_HOST_UID`/`PI_HOST_GID` |
 | `docker` / `podman` | Container CLIs (used via `docker-safe` read-only wrapper) |
 | `docker-safe` | Restricted Docker/Podman wrapper — container only (ps, logs, inspect, top, stats) |
 | `jq` | JSON processing |
@@ -701,6 +708,8 @@ alias pi-docker='docker pull ghcr.io/myk-org/pi-config:latest && \
   --name "pi-config-$(basename $PWD)-$(date +%s)" \
   --network host \
   --env-file "$HOME/.pi/.env" \
+  -e PI_HOST_UID="$(id -u)" \
+  -e PI_HOST_GID="$(id -g)" \
   -v "$PWD":"$PWD":rw \
   -v "$HOME/.pi":"$HOME/.pi":rw \
   -v "$HOME/.gitconfig":"$HOME/.gitconfig":ro \
@@ -722,7 +731,10 @@ alias pi-docker='docker pull ghcr.io/myk-org/pi-config:latest && \
 
 Then just run `pi-docker` from any project directory.
 
-> **Startup note:** The container runs as non-root user `node` (UID 1000).
+> **Startup note:** The container runs as non-root user `node`. At start the
+> entrypoint remaps `node` to `PI_HOST_UID`/`PI_HOST_GID` (pass `$(id -u)` /
+> `$(id -g)` on the alias) so bind-mounted secrets match the host user.
+> Without those env vars, `node` stays UID 1000 (breaks IPA/LDAP hosts).
 > `pi install` runs on each start.
 > A `WARNING` on stderr is normal when the package is already cached in `~/.pi`.
 > If pi misbehaves or the warning persists, verify network connectivity

package/extensions/orchestrator/async-agents.ts

@@ -919,15 +919,31 @@ export function registerAsyncAgents(
     }), { mode: 0o600 });
 
     // Find the runner script
-    const runnerPath = path.join(path.dirname(new URL(import.meta.url).pathname), "async-runner.ts");
+    const runnerPath = path.join(path.dirname(fileURLToPath(import.meta.url)), "async-runner.ts");
 
     // Find jiti for TypeScript execution
     let jitiCliPath: string | undefined;
     // Strategy 1: resolve from pi's own require context
+    // NOTE: newer pi SDK "exports" maps hide ./package.json — fall back to
+    // resolving the main entry and walking up to its package root.
     try {
-      const piPkgDir = path.dirname(require.resolve("@earendil-works/pi-coding-agent/package.json"));
-      const candidate = path.join(piPkgDir, "node_modules/jiti/lib/jiti-cli.mjs");
-      if (fs.existsSync(candidate)) jitiCliPath = candidate;
+      const req = createRequire(import.meta.url);
+      let piPkgJsonPath: string | undefined;
+      try {
+        piPkgJsonPath = req.resolve("@earendil-works/pi-coding-agent/package.json");
+      } catch {
+        const entry = req.resolve("@earendil-works/pi-coding-agent");
+        let dir = path.dirname(entry);
+        while (dir !== path.dirname(dir)) {
+          const pj = path.join(dir, "package.json");
+          if (fs.existsSync(pj) && JSON.parse(fs.readFileSync(pj, "utf8"))?.name === "@earendil-works/pi-coding-agent") { piPkgJsonPath = pj; break; }
+          dir = path.dirname(dir);
+        }
+      }
+      if (piPkgJsonPath) {
+        const candidate = path.join(path.dirname(piPkgJsonPath), "node_modules/jiti/lib/jiti-cli.mjs");
+        if (fs.existsSync(candidate)) jitiCliPath = candidate;
+      }
     } catch (e: any) {
       log.debug(`jiti strategy 1 (require.resolve) failed: ${e?.message || e}`);
     }
@@ -947,6 +963,28 @@ export function registerAsyncAgents(
       }
     }
 
+    // Strategy 3: this package's own node_modules — git/stow installs ship
+    // jiti themselves (npm consumers are covered by strategies 1-2).
+    if (!jitiCliPath) {
+      try {
+        const pkgRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
+        const candidate = path.join(pkgRoot, "node_modules/jiti/lib/jiti-cli.mjs");
+        if (fs.existsSync(candidate)) jitiCliPath = candidate;
+      } catch (e: any) {
+        log.debug(`jiti strategy 3 (package root) failed: ${e?.message || e}`);
+      }
+    }
+
+    // Fail fast with a self-explanatory error instead of spawning a child that
+    // cannot load TypeScript (bare node dies on ".js"→".ts" specifiers).
+    if (!jitiCliPath) {
+      log.error(`async-spawn: ${id} — no jiti-cli.mjs found (strategies 1-3 failed); refusing to spawn`);
+      // Clean up the artifacts we already created — nothing will consume them.
+      try { fs.rmSync(configPath, { force: true }); } catch {}
+      try { fs.rmSync(workerDir, { recursive: true, force: true }); } catch {}
+      return { id, error: "jiti-cli.mjs not found — cannot execute async agent (see orchestrator logs)" };
+    }
+
     const spawnArgs = jitiCliPath
       ? [jitiCliPath, runnerPath, configPath]
       : [runnerPath, configPath];
@@ -957,6 +995,10 @@ export function registerAsyncAgents(
       PI_SUBAGENT_CHILD: "1",
       PI_AGENT_NAME: agentName,
       PI_PRIMARY_MODEL: process.env.PI_PRIMARY_MODEL || process.env.PI_MODEL || "",
+      // Isolate children from the shared jiti FS cache — other sessions running
+      // different node/jiti versions can poison it and kill children at boot.
+      JITI_CACHE: "false",
+      JITI_FS_CACHE: "false",
       __PI_CONFIG_SESSION_ID: (globalThis as any).__piConfigSessionId || "",
       __PI_PARENT_SESSION_ID: (globalThis as any).__piConfigSessionId || "",
     };
@@ -1004,14 +1046,21 @@ export function registerAsyncAgents(
     };
     asyncState.jobs.set(id, job);
 
+    const stderrLogPath = path.join(workerDir, "child-stderr.log");
+    const stderrLog = fs.createWriteStream(stderrLogPath, { flags: "w" });
+    stderrLog.on("error", () => {}); // never let a log write failure crash the session
+    log.debug(`async-spawn: ${job.id} stderr → ${stderrLogPath}`);
+
     const proc = spawn(process.execPath, spawnArgs, {
       cwd,
-      stdio: "ignore",
+      stdio: ["ignore", "ignore", "pipe"],
       windowsHide: true,
       env: spawnEnv,
     });
+    proc.stderr?.pipe(stderrLog);
 
     proc.once("error", (err) => {
+      try { stderrLog.destroy(); } catch {}
       log.info(`spawn-error: ${job.id} — ${err.message}`);
       if (job.status === "complete" || job.status === "failed") return;
       job.status = "failed";
@@ -1037,8 +1086,27 @@ export function registerAsyncAgents(
         setTimeout(() => {
           if (job.status === "complete" || job.status === "failed") return;
           log.info(`spawn-exit: ${job.id} — code=${code} signal=${signal}`);
+          let stderrTail = "";
+          try {
+            if (fs.existsSync(stderrLogPath)) {
+              // Tail-read only — the log can be arbitrarily large on noisy failures.
+              const size = fs.statSync(stderrLogPath).size;
+              const start = Math.max(0, size - 4096);
+              let raw = "";
+              if (size > 0) {
+                const fd = fs.openSync(stderrLogPath, "r");
+                try {
+                  const buf = Buffer.alloc(Math.min(size - start, 4096));
+                  fs.readSync(fd, buf, 0, buf.length, start);
+                  raw = buf.toString("utf8");
+                } finally { fs.closeSync(fd); }
+              }
+              stderrTail = raw.trim().slice(-1200);
+            }
+          } catch {}
+          log.warn(`async-child failed: ${job.id} code=${code}${stderrTail ? " (see child-stderr.log)" : " (no stderr captured)"}`);
           job.status = "failed";
-          job.output = `Process exited with code ${code} signal ${signal}`;
+          job.output = `Process exited with code ${code} signal ${signal}${stderrTail ? `\n--- child stderr (tail) ---\n${stderrTail}` : ""}`;
           job.durationMs = Date.now() - job.startedAt;
           job.updatedAt = Date.now();
           job.sideEffectsApplied = true;

package/extensions/orchestrator/utils.ts

@@ -152,18 +152,28 @@ export const MIN_PI_VERSION = "0.84.0";
 
 /** Get the installed pi version from its package.json. */
 export function getPiVersion(): string | null {
+  // 1) Resolve from the running binary — walk up until we find the package
+  // root (works for any layout: dist/cli.js, dist/bundle/cli.js, src/…).
   try {
-    // Resolve from pi's own install location (process.argv[1] → dist/cli.js → package root)
     const piScript = process.argv[1];
     if (piScript) {
-      const realPath = fs.realpathSync(piScript);
-      const piPkgPath = path.join(path.dirname(path.dirname(realPath)), "package.json");
-      if (fs.existsSync(piPkgPath)) {
-        const pkg = JSON.parse(fs.readFileSync(piPkgPath, "utf-8"));
-        if (pkg.name === "@earendil-works/pi-coding-agent" && pkg.version) return pkg.version;
+      let dir = path.dirname(fs.realpathSync(piScript));
+      while (dir !== path.dirname(dir)) {
+        const pkgPath = path.join(dir, "package.json");
+        if (fs.existsSync(pkgPath)) {
+          const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
+          if (pkg.name === "@earendil-works/pi-coding-agent" && pkg.version) return pkg.version;
+        }
+        dir = path.dirname(dir);
       }
     }
   } catch {}
+  // 2) Ask the CLI the user actually runs — authoritative for wrapper/bundle layouts.
+  try {
+    const out = execFileSync("pi", ["--version"], { timeout: 5000, encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] });
+    const m = out.match(/\d+\.\d+\.\d+(?:-[\w.]+)?/);
+    if (m) return m[0];
+  } catch {}
   return null;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-orchestrator-config",
-  "version": "4.3.4",
+  "version": "4.3.5",
   "description": "Orchestrator pattern for pi: specialist subagents, enforcement, code review loop, workflow commands",
   "keywords": [
     "pi-package"