Repository navigation
Conversation
|
You must have Developer access to commit code to Vercel Labs on Vercel. If you contact an administrator and receive Developer access, commit again to see your changes. Learn more: https://vercel.com/docs/accounts/team-members-and-roles/access-roles#team-level-roles |
![vercel[bot]](https://avatars.githubusercontent.com/in/8329?s=60&v=4){kind=small}
kajogo777
force-pushed
the
harnesses-pi
branch
from
October 28, 2026 19:51
e2d3913 to
a01262d
Compare
…t-off answer is not the reply
Security review: pi reads a project's sessionDir before trust, so a repository can commit a session file whose id is a path; resuming it made the session lock rmtree that path as a stale lock. - The session lock refuses any id that is not a plain name, in Python and again in the helper where the files are; the helper also checks on disk that the lock directory is a direct child of its root, so a planted symlink cannot lead out. - pi's session store skips files whose id breaks pi's own id rule, and resume/fork/history refuse such an id before the lock is touched.
Follow-up to the pi finding, for all harnesses: Harness.resume, fork, history and tui check the id where it enters (it may come from a Handle out of a database), before any adapter turns it into a lock directory, a transcript path or a CLI argument. The remote Claude store refuses a key whose parts would leave the store.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #318. Adds Pi as a third harness:
harnesses.pi(), overpi --mode rpc.What it is
pi --mode rpcprocess per conversation. The SDK mints the id (--session-id), sopi --session <id>opens the same conversation in pi's own TUI.claude_code()/codex(): run, stream, steer, stop, resume, fork,history()/sessions()(read from pi's session files),tui(), handoff (history=), the session lock, gateway, MCP servers, images, structured output.pi()takes everyclaude_code()argument;max_turnsraisesUnsupportedError._adapters/pi_extension.js) whosetool_callhandler asks the hook through an RPC dialog. Coverage is"all",Allow(input=)rewrites the call, andDeny(reason)reaches the agent. Startup refuses to continue unless the extension proves it loaded, so the gate can't fail open.x-api-key, which sandbox egress injection doesn't rewrite. The extension sendsAuthorization: Bearerinstead. Measured: the gateway accepts it, and a wrong key comes back as a 401.provider_metadata["pi"]). Measured: without this, a pushed conversation ran on pi's default model, which the gateway refused.Also in this PR:
examples/harnesses/pi.py.Tested
test_pi_adapter.py. Format, lint, mypy and ty are clean.--bg, thenwait,peekandpull --filesstop, then attach (resumes from the snapshot)--bgone (ends the agent, opens the TUI), thenrmharnesses/pi.pypasses inrun-examples.py./review(gpt-6.1-sol). Every P1 is fixed.Known gaps
pistarted in a terminal isn't shown as running: pi hides its arguments fromps.history()but not in the livesession.messages. The SDK has no event for it.session.messages; it is excluded fromresult.text.RuntimeError: aclose(): asynchronous generator is already runningis sometimes printed when a turn is abandoned (afkpush --bg). It also happens with codex, so it comes from the sharedTurnclose path in Add ai.harnesses.experimental and ai.workspaces.experimental #318, not from pi.