[bug]: Can't make it work with pi agent

[pablorq]

Which skill (or area)?

gateway

What happened?

I've tried to make it run with pi agent was I was unable to make it run. Didn't find clear instructions about how to do it in a simple way (there are a lot of info in different places inside the docs, but sometimes are confusing or not clear.
Tried different actions but none works.

What did you expect to happen?

To use Aeon with pi agent and an openrouter model.
A better and simpler documentation could help a lot.

Failure type

Config (missing secret, wrong var, schedule)

Where did it run?

Other / not sure

Steps to reproduce / what triggered it

Agent configuration

Agent: pi
Provider: openroute

Test 01 - Web UI

After starting the server (gateway?), I've selected the (no name) dropdown pi option, then click in "auth". Entered the openroute api key and received the message "openrouter_api_key saved".
Go to "Heartbeat" and click in "run now": message "no provider key set".

Test 02 - CLI

Set the environment variable:

# export OPENROUTER_API_KEY=sk-or-v1-XXX

Run the command found in docs:

# ./aeon auth --harness pi --key sk-or-v1-XXX
Installing Aeon CLI runtime (tsx, yaml — one-time, ~12MB)…

up to date, audited 2 packages in 806ms

1 package is looking for funding
  run `npm fund` for details

found 0 vulnerabilities
/app/apps/cli/aeon: line 35: /app/apps/cli/node_modules/.bin/tsx: No such file or directory

Checking the directory

# ls -hal apps/cli/node_modules/.bin/
total 8.0K
drwxr-xr-x 2 root root 4.0K Aug 17 08:01 .
drwxr-xr-x 5 root root 4.0K Aug 17 09:58 ..
lrwxrwxrwx 1 root root   15 Aug 17 08:01 yaml -> ../yaml/bin.mjs

Relevant logs

No logs.

Did you receive a notification?

Not applicable

Environment

node: v20.20.2, Linux c973e9c2f470 7.0.0-29-generic #29-Ubuntu SMP PREEMPT_DYNAMIC Fri Jul 17 20:52:35 UTC 2026 x86_64 GNU/Linux

Before submitting

• I searched existing issues and this isn't a duplicate.
• I removed all secrets (API keys, tokens, wallet/chat IDs) from the logs and text above.

[aaronjmars]

Thanks for the detailed report, both parts were reproducible.

Test 02 (CLI tsx: No such file or directory) is a real bug. tsx was declared as a devDependency, so the launcher's one-time npm install skips it whenever npm runs in production mode (NODE_ENV=production / --omit=dev), which is exactly your container's case, leaving only yaml. Fixed in #882 (moves tsx to dependencies). After that lands, aeon auth --harness pi ... runs.

Test 01 (web UI "no provider key set" after saving the key) we could not reproduce as a code bug: the save -> read -> run-gate path is correct, and with only OPENROUTER_API_KEY set on the pi harness the gate passes. What we did hit repeatedly during testing was the GitHub API returning 503 on the secrets endpoint. When that read fails, the dashboard kept an empty secret list and then wrongly reported "no provider key set". #882 also hardens that: it optimistically reflects a just-saved key, and shows a "couldn't read repo secrets" message instead of blaming a missing key when the vault read fails.

To confirm whether that is what bit you (vs. something else in your setup), could you share:

1. gh auth status from inside the container.
2. Which repo the dashboard is managing, and whether that account has admin on it (secrets are stored as GitHub repo secrets, so the dashboard needs a repo you own, typically your own fork).
3. After saving the OpenRouter key, does the Settings secrets list show OPENROUTER_API_KEY as set? And does the browser Network tab show /api/secrets returning 200 (vs. 503/500) when the dashboard loads?

One architecture note that may be the root of the confusion: Aeon executes skills on GitHub Actions, not locally. The dashboard is a control panel that stores credentials as repo secrets and dispatches workflow runs; there is no pure-local run path. So "Run now" needs Actions enabled on a repo you control, with the provider key set as a repo secret there. If the docs made that unclear, that is on us and we will tighten the pi + OpenRouter onboarding.