fix: bind pi runtime config at spawn

2026-08-05 05:23:58 +02:00
parent 2703864572
commit 4422568f61
4 changed files with 375 additions and 46 deletions
@@ -1,8 +1,9 @@
 import {
-  closeSync, constants, fstatSync, lstatSync, openSync, readFileSync,
+  chmodSync, closeSync, constants, fstatSync, lstatSync, mkdtempSync, openSync,
+  readFileSync, readdirSync, rmSync, symlinkSync, writeFileSync, type Dirent,
 } from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
+import { homedir, tmpdir } from "node:os";
+import { join, resolve } from "node:path";

 const MAX_AGENT_CONFIG_BYTES = 1024 * 1024;

@@ -55,13 +56,15 @@ export function validateDeclarativePiConfig(raw: string): void {
  assertDeclarativePiConfig(parsePiConfigJson(raw));
 }

-export function readConfiguredPiAgentFile(name: "auth.json"): string;
-export function readConfiguredPiAgentFile(name: "models.json", optional: true): string | undefined;
-export function readConfiguredPiAgentFile(
+function configuredPiAgentDir(): string {
+  return resolve(process.env.PI_CODING_AGENT_DIR ?? join(homedir(), ".pi", "agent"));
+}
+
+function readPiAgentFile(
+  configuredAgentDir: string,
  name: "auth.json" | "models.json",
-  optional = false,
+  optional: boolean,
 ): string | undefined {
-  const configuredAgentDir = process.env.PI_CODING_AGENT_DIR ?? join(homedir(), ".pi", "agent");
  const path = join(configuredAgentDir, name);
  let fd: number | undefined;
  try {
@@ -85,3 +88,74 @@ export function readConfiguredPiAgentFile(
    }
  }
 }
+
+export function readConfiguredPiAgentFile(name: "auth.json"): string;
+export function readConfiguredPiAgentFile(name: "auth.json", optional: true): string | undefined;
+export function readConfiguredPiAgentFile(name: "models.json", optional: true): string | undefined;
+export function readConfiguredPiAgentFile(
+  name: "auth.json" | "models.json",
+  optional = false,
+): string | undefined {
+  return readPiAgentFile(configuredPiAgentDir(), name, optional);
+}
+
+export interface PiRuntimeAgentSnapshot {
+  agentDir: string;
+  sessionDir: string;
+  cleanup: () => void;
+}
+
+/**
+ * Bind a session Pi process to the exact managed auth/model bytes validated at spawn time.
+ * Other agent resources remain live through symlinks, while session storage stays persistent.
+ */
+export function createPiRuntimeAgentSnapshot(): PiRuntimeAgentSnapshot {
+  const sourceAgentDir = configuredPiAgentDir();
+  const auth = readPiAgentFile(sourceAgentDir, "auth.json", true);
+  const models = readPiAgentFile(sourceAgentDir, "models.json", true);
+  if (auth !== undefined) validateDeclarativePiConfig(auth);
+  if (models !== undefined) validateDeclarativePiConfig(models);
+
+  let snapshotDir: string | undefined;
+  try {
+    snapshotDir = mkdtempSync(join(tmpdir(), "thoth-pi-runtime-agent-"));
+    chmodSync(snapshotDir, 0o700);
+    let entries: Dirent[];
+    try {
+      entries = readdirSync(sourceAgentDir, { withFileTypes: true });
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException)?.code !== "ENOENT") throw error;
+      entries = [];
+    }
+    for (const entry of entries) {
+      if (entry.name === "auth.json" || entry.name === "models.json") continue;
+      symlinkSync(
+        join(sourceAgentDir, entry.name),
+        join(snapshotDir, entry.name),
+        entry.isDirectory() ? (process.platform === "win32" ? "junction" : "dir") : "file",
+      );
+    }
+    if (auth !== undefined) {
+      writeFileSync(join(snapshotDir, "auth.json"), auth, { flag: "wx", mode: 0o600 });
+    }
+    if (models !== undefined) {
+      writeFileSync(join(snapshotDir, "models.json"), models, { flag: "wx", mode: 0o600 });
+    }
+  } catch {
+    if (snapshotDir !== undefined) {
+      try { rmSync(snapshotDir, { recursive: true, force: true }); } catch { /* sanitized */ }
+    }
+    throw new PiManagedConfigError();
+  }
+
+  let cleaned = false;
+  return {
+    agentDir: snapshotDir,
+    sessionDir: process.env.PI_CODING_AGENT_SESSION_DIR || join(sourceAgentDir, "sessions"),
+    cleanup: () => {
+      if (cleaned) return;
+      cleaned = true;
+      try { rmSync(snapshotDir, { recursive: true, force: true }); } catch { /* sanitized */ }
+    },
+  };
+}
@@ -7,6 +7,7 @@ import { buildPiChildEnv, canonicalPiProvider } from "./provider-credentials.js"
 import { loadPiAuthProviders } from "./auth-providers.js";
 import { secretValue } from "../config/secret-bundle.js";
 import { clearPrincipalEnvironment, principalEnvironment, type PrincipalContext } from "../auth/principal.js";
+import { createPiRuntimeAgentSnapshot } from "./managed-config.js";

 export interface SessionRuntime {
  rpc: RpcClient;
@@ -37,13 +38,14 @@ export class PiProcessManager {
  private spawnFn: (
    sessionId: string, author: string, provider: string | undefined, principal?: PrincipalContext,
  ) => ChildProcessWithoutNullStreams;
-  private loadAuthProviders: () => ReadonlySet<string>;
+  private loadAuthProviders: (agentDir: string) => ReadonlySet<string>;

  constructor(
    private cfg: AppConfig,
-    opts?: { spawnFn?: SpawnFn; authProviders?: () => ReadonlySet<string> },
+    opts?: { spawnFn?: SpawnFn; authProviders?: (agentDir: string) => ReadonlySet<string> },
  ) {
-    this.loadAuthProviders = opts?.authProviders ?? (() => loadPiAuthProviders());
+    this.loadAuthProviders = opts?.authProviders
+      ?? ((agentDir) => loadPiAuthProviders({ agentDir }));
    if (opts?.spawnFn) {
      this.spawnFn = (sessionId, author, provider, principal) =>
        this.spawnPi(opts.spawnFn!, sessionId, author, provider, principal);
@@ -56,45 +58,57 @@ export class PiProcessManager {
  private spawnPi(
    spawnFn: SpawnFn, sessionId: string, author: string, provider: string | undefined, principal?: PrincipalContext,
  ): ChildProcessWithoutNullStreams {
-    const env = buildPiChildEnv({
-      provider,
-      authProviders: this.loadAuthProviders(),
-      credentialValue: secretValue(this.cfg, "THT_MODEL_API_KEY"),
-      credentialFile: this.cfg.modelApiKeyFile,
-      additions: { THT_SESSION: sessionId, THT_AUTHOR: author },
-    });
-    clearPrincipalEnvironment(env);
-    if (principal) Object.assign(env, principalEnvironment(principal));
-    // The Thoth gate executes the deterministic `tht` CLI as a Pi tool. Give only
-    // this managed session process the adapter values already loaded by the core
-    // entrypoint; the generic provider helper continues to scrub them by default.
-    for (const name of [
-      "THT_DWH_API_KEY", "THT_VEC_API_KEY", "THT_VEC_WRITE_API_KEY",
-    ] as const) {
-      const value = secretValue(this.cfg, name) ?? process.env[name];
-      if (value !== undefined) env[name] = value;
-    }
-    const ca = secretValue(this.cfg, "THT_SSL_CA")
-      ?? secretValue(this.cfg, "THT_CA")
-      ?? process.env.THT_SSL_CA
-      ?? process.env.THT_CA;
-    if (ca !== undefined) {
-      env.THT_CA = ca;
-      env.THT_SSL_CA = ca;
-    }
-    delete env.THT_DATA_ROOT;
-    if (this.cfg.dataRoot !== undefined) env.THT_DATA_ROOT = this.cfg.dataRoot;
-    // pi 0.73 removed `--approve`: rpc mode is headless and its argv is intentionally minimal.
-    const child = spawnFn(this.cfg.piBin, ["--mode", "rpc"], {
-      cwd: this.cfg.harnessDir,
-      env,
-    });
+    // This is the final shared boundary for createFor(), spawnFor(), and resume(). Validate
+    // before auth-provider inspection, then make Pi consume the exact copied bytes rather than
+    // reopening mutable mounted auth/models files after this check.
+    const agent = createPiRuntimeAgentSnapshot();
+    let child: ChildProcessWithoutNullStreams | undefined;
    try {
+      const env = buildPiChildEnv({
+        provider,
+        authProviders: this.loadAuthProviders(agent.agentDir),
+        credentialValue: secretValue(this.cfg, "THT_MODEL_API_KEY"),
+        credentialFile: this.cfg.modelApiKeyFile,
+        additions: { THT_SESSION: sessionId, THT_AUTHOR: author },
+      });
+      env.PI_CODING_AGENT_DIR = agent.agentDir;
+      env.PI_CODING_AGENT_SESSION_DIR = agent.sessionDir;
+      clearPrincipalEnvironment(env);
+      if (principal) Object.assign(env, principalEnvironment(principal));
+      // The Thoth gate executes the deterministic `tht` CLI as a Pi tool. Give only
+      // this managed session process the adapter values already loaded by the core
+      // entrypoint; the generic provider helper continues to scrub them by default.
+      for (const name of [
+        "THT_DWH_API_KEY", "THT_VEC_API_KEY", "THT_VEC_WRITE_API_KEY",
+      ] as const) {
+        const value = secretValue(this.cfg, name) ?? process.env[name];
+        if (value !== undefined) env[name] = value;
+      }
+      const ca = secretValue(this.cfg, "THT_SSL_CA")
+        ?? secretValue(this.cfg, "THT_CA")
+        ?? process.env.THT_SSL_CA
+        ?? process.env.THT_CA;
+      if (ca !== undefined) {
+        env.THT_CA = ca;
+        env.THT_SSL_CA = ca;
+      }
+      delete env.THT_DATA_ROOT;
+      if (this.cfg.dataRoot !== undefined) env.THT_DATA_ROOT = this.cfg.dataRoot;
+      // pi 0.73 removed `--approve`: rpc mode is headless and its argv is intentionally minimal.
+      child = spawnFn(this.cfg.piBin, ["--mode", "rpc"], {
+        cwd: this.cfg.harnessDir,
+        env,
+      });
+      child.once("exit", agent.cleanup);
+      child.once("close", agent.cleanup);
      // Log stderr for debugging (was silently drained)
      child.stderr.on("data", (d: Buffer) => console.error(`[pi:${sessionId}] stderr:`, d.toString().trim()));
      return child;
    } catch (error) {
-      try { child.kill(); } catch { /* preserve the initialization error */ }
+      if (child) {
+        try { child.kill(); } catch { /* preserve the initialization error */ }
+      }
+      agent.cleanup();
      throw error;
    }
  }