Stage Pi CLI in the docker-sbx-visible path so Pi agents run under microVM sandboxes by Copilot · Pull Request #53110 · github/gh-aw

Copilot · 2026-08-16T12:39:34Z

The Daily Documentation Updater workflow (engine.id: pi + sandbox.agent.runtime: docker-sbx) succeeded with zero safe outputs. The agent never ran:

[INFO] [sbx] Launching agent command in sandbox "awf-agent-7574" (timeout: 45 min)
/bin/bash: line 1: pi: command not found
[INFO] [sbx] Agent command exited with code 0

The Pi engine only installed the CLI via npm install -g, which lands in the hosted tool cache — not visible inside the microVM. The trailing | tee in the agent command masked the 127 exit status, so the job reported success. Claude and Codex already stage a second copy under ${RUNNER_TEMP}/gh-aw/engine-cli and export it onto PATH; the Pi engine was missing both halves.

Changes

pkg/workflow/pi_engine.go
- GetInstallationSteps: appends GenerateDockerSbxNpmCLIInstallStep for @earendil-works/pi-coding-agent when the runtime is docker-sbx or cloud-hypervisor.
- buildPiExecutionCommand: prepends GetDockerSbxNpmCLIPathSetup(workflowData), keeping the same export ordering as Claude/Codex (mcp-cli && engine-cli && hostedtoolcache && pi …).
pkg/workflow/docker_sbx_test.go — new pi install and execution use sbx-visible CLI path subtest in TestDockerSbxEngineCLIWiring, asserting both the staged install/symlink and the PATH export.
Lock files — make recompile regenerated daily-doc-updater.lock.yml and daily-awf-spec-compiler-surfacing.lock.yml, the only Pi + docker-sbx workflows in the repo.

Generated diff:

      - name: Install Pi CLI
        run: npm install --ignore-scripts -g @earendil-works/pi-coding-agent@0.84.2
+     - name: Install Pi CLI in docker-sbx path
+       run: |
+         mkdir -p "${RUNNER_TEMP}/gh-aw/engine-cli/bin"
+         npm install --ignore-scripts --prefix "${RUNNER_TEMP}/gh-aw/engine-cli" @earendil-works/pi-coding-agent@0.84.2
+         ln -sf "../node_modules/.bin/pi" "${RUNNER_TEMP}/gh-aw/engine-cli/bin/pi"

Not addressed

The cmd | tee log pipeline inside the sandbox still has no pipefail, so a failing agent CLI is reported as a successful run rather than a hard failure. This affects every engine, not just Pi, and is left for a separate change.

Fixes [aw] Daily Documentation Updater produced no safe outputs #53097

Run: https://github.com/github/gh-aw/actions/runs/31950301208> Generated by 👨‍🍳 PR Sous Chef · gpt54 · 12.5 AIC · ⌖ 5.77 AIC · ⊞ 8.7K · ◷

_{Comment /souschef to run again}

…icroVM sandboxes Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions · 2026-08-16T12:57:09Z

✅ Ponytail Reviewer completed successfully!

Lean already. Ship. This PR mirrors the existing GenerateDockerSbxNpmCLIInstallStep/GetDockerSbxNpmCLIPathSetup pattern already used identically by Claude and Codex engines, applying it to Pi. No new abstractions, no reinvented logic, minimal targeted test addition. Nothing to cut.

Generated by Ponytail Reviewer for #53110

github-actions · 2026-08-16T12:57:10Z

✅ Test Quality Sentinel completed test quality analysis.

🧪 Test quality analysis by Test Quality Sentinel

github-actions · 2026-08-16T12:57:10Z

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

github-actions · 2026-08-16T12:57:11Z

✅ Design Decision Gate 🏗️ completed the design decision gate check.

No ADR enforcement needed: PR #53110 does not have the 'implementation' label and has only 30 new lines of code in business logic directories (threshold: 100).

🏗️ ADR gate enforced by Design Decision Gate 🏗️

github-actions · 2026-08-16T12:57:16Z

✅ PR Code Quality Reviewer completed the code quality review.

Completed PR review with no GitHub write because no actionable changed-line issues were found; sub-agent unavailable (grumpy-coder binary missing).

🔎 Code quality review by PR Code Quality Reviewer

Copilot

Pull request overview

Stages the Pi CLI in a microVM-visible path so Pi workflows run correctly under docker-sbx and cloud-hypervisor.

Changes:

Adds microVM-specific Pi installation and PATH setup.
Tests docker-sbx installation and execution wiring.
Regenerates affected workflow lock files.

Show a summary per file

File	Description
`pkg/workflow/pi_engine.go`	Adds Pi CLI staging and path export.
`pkg/workflow/docker_sbx_test.go`	Verifies Pi microVM CLI wiring.
`.github/workflows/daily-doc-updater.lock.yml`	Regenerates the affected Pi workflow.
`.github/workflows/daily-awf-spec-compiler-surfacing.lock.yml`	Regenerates the affected Pi workflow.

Review details

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

Files reviewed: 4/4 changed files
Comments generated: 0
Review effort level: Balanced

github-actions · 2026-08-16T13:01:48Z

Comment Memory

reviewed_at: 2026-08-16T00:00:00Z
review_event: COMMENT
top_themes:
  - no actionable changed-line issues found
  - sub-agent unavailable (grumpy-coder missing)
files_reviewed:
  - .github/workflows/daily-awf-spec-compiler-surfacing.lock.yml
  - .github/workflows/daily-doc-updater.lock.yml
  - pkg/workflow/docker_sbx_test.go
  - pkg/workflow/pi_engine.go
comment_count: 0

Note

This comment is managed by comment memory.

It stores persistent context for this thread in the code block at the top of this comment.
Edit only the text inside the backtick fences; workflow metadata and the footer are regenerated automatically.

Learn more about comment memory

🔎 Code quality review by PR Code Quality Reviewer · gpt54 · 9.57 AIC · ⌖ 6.23 AIC · ⊞ 4.5K · ◷
_{Comment /review to run again}

github-actions

The changes correctly stage the Pi CLI binary under ${RUNNER_TEMP}/gh-aw/engine-cli/bin — consistent with the existing mcp-cli staging pattern — and expose it inside microVM sandboxes by prepending the path to PATH in the firewall-enabled execution branch. Lock files are compiler-generated and match the Go source. Test coverage is adequate.

🧵 Reviewed using Impeccable skills by Impeccable Skills Reviewer · sonnet46 · 15.2 AIC · ⌖ 7.04 AIC · ⊞ 5.6K

github-actions

✅ Test Quality Sentinel: 70/100 Acceptable. Design test ratio 100% (1/1), implementation tests 0% (threshold 30%), no violations. Single new subcase validates Pi CLI docker-sbx path staging fix (#53097) with 4 focused assertions. Happy-path coverage sufficient for critical user-visible behavior.

github-actions

Skills-Based Review 🧠

Applied /diagnosing-bugs — requesting one change before merge.

📋 Key Themes & Highlights

Key Themes

Incomplete fix scope: The engine-cli PATH export is only wired into the firewallEnabled == true branch of buildPiExecutionCommand. When docker-sbx is combined with sandbox.agent: false (firewall disabled), the non-firewall code path at line 405 does not export the engine-cli PATH, so the bug reproduces.

Positive Highlights

✅ Root cause well-diagnosed: the original issue (tool cache invisibility inside microVM) is correctly identified.
✅ Install step pattern matches the established Claude/Codex approach exactly — consistent codebase.
✅ Test subtest is well-structured and uses the same workflowData fixture (firewall enabled + docker-sbx) as peers.
✅ PR description is thorough and correctly flags the pipefail gap as a separate concern.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · sonnet46 · 48.9 AIC · ⌖ 8.59 AIC · ⊞ 7.7K
_{Comment /matt to run again}

Comments that could not be inline-anchored

pkg/workflow/pi_engine.go:404

[/diagnosing-bugs] The engine-cli PATH export is only injected inside the if firewallEnabled branch (line 383), so this fix does not apply when docker-sbx is used with sandbox.agent: false (firewall disabled). The same pi: command not found failure would recur in that configuration.

<details>
<summary>💡 Suggested fix</summary>

Move the dockerSbxCLIPath injection outside the firewall guard so it applies unconditionally when the runtime requires it:

// Non-firewall p…

</details>

Done

gh-aw-bot · 2026-08-16T13:43:03Z

@copilot PR #53110 still needs follow-up before merge.

Quick triage

Failed checks on the current head:
- Unit tests (D-L)
- impacted-go-tests
There is prior reviewer feedback pointing out that the engine-cli PATH export appears to be limited to the firewall-enabled path, leaving the docker-sbx + sandbox.agent: false path uncovered.

Next step

Please fix the remaining issue(s), rerun the relevant tests, and then run the pr-finisher skill.

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 12.5 AIC · ⌖ 5.77 AIC · ⊞ 8.7K · ◷
_{Comment /souschef to run again}

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot · 2026-08-16T13:54:35Z

@copilot PR #53110 still needs follow-up before merge.

Quick triage...

Fixed the PATH export gap: buildPiExecutionCommand's non-firewall branch now also prepends GetDockerSbxNpmCLIPathSetup(workflowData), so a workflow that pairs sandbox.agent.runtime: docker-sbx with an explicit network.firewall: false still finds the staged pi CLI. Added a regression test (pi execution uses sbx-visible CLI path even with firewall disabled) in docker_sbx_test.go. See commit for details.

The two failing checks (TestLoadRepoConfig_ContainerPinsRequireSHA256Digest / TestLoadRepoConfig_ContainerPinsKeyNoDigestAllowed) are unrelated to this PR — I reproduced the same failures directly on origin/main in a clean worktree, confirming they're pre-existing.

github-actions · 2026-08-18T22:25:16Z

🎉 This pull request is included in a new release.

Release: v0.87.1

Initial plan

dd509b2

Copilot AI assigned Copilot and pelikhan Aug 16, 2026

Copilot started work on behalf of pelikhan August 16, 2026 12:39 View session

Copilot AI linked an issue Aug 16, 2026 that may be closed by this pull request

[aw] Daily Documentation Updater produced no safe outputs #53097

Closed

Install Pi CLI into docker-sbx-visible path so the agent can run in m…

af21653

…icroVM sandboxes Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Fix workflow failure in daily documentation updater~~ Stage Pi CLI in the docker-sbx-visible path so Pi agents run under microVM sandboxes Aug 16, 2026

Copilot finished work on behalf of pelikhan August 16, 2026 12:55

Copilot AI requested a review from pelikhan August 16, 2026 12:55

pelikhan marked this pull request as ready for review August 16, 2026 12:55

Copilot AI balanced review requested due to automatic review settings August 16, 2026 12:55

Copilot started reviewing on behalf of pelikhan August 16, 2026 12:56 View session

Copilot AI reviewed Aug 16, 2026

View reviewed changes

github-actions Bot approved these changes Aug 16, 2026

View reviewed changes

github-actions Bot mentioned this pull request Aug 16, 2026

[aw] No-Op Runs #48838

Open

github-actions Bot approved these changes Aug 16, 2026

View reviewed changes

github-actions Bot previously requested changes Aug 16, 2026

View reviewed changes

github-actions Bot mentioned this pull request Aug 16, 2026

[pr-sous-chef] PR Sous Chef run report #52990

Closed

Merge branch 'main' into copilot/aw-fix-daily-documentation-updater

3529924

Copilot started work on behalf of gh-aw-bot August 16, 2026 13:43 View session

Fix Pi docker-sbx CLI PATH export for the non-firewall execution path

ead3584

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot finished work on behalf of gh-aw-bot August 16, 2026 13:54

Copilot AI requested a review from gh-aw-bot August 16, 2026 13:54

pelikhan merged commit 24ed22f into main Aug 16, 2026

pelikhan deleted the copilot/aw-fix-daily-documentation-updater branch August 16, 2026 13:55

github-actions Bot mentioned this pull request Aug 16, 2026

Smoke Test: MAI-Code-1-Flash - 31974724676 #53212

Closed

Uh oh!

Conversation

Copilot AI commented Aug 16, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Not addressed

Uh oh!

github-actions Bot commented Aug 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

github-actions Bot commented Aug 16, 2026

Comment Memory

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Skills-Based Review 🧠

Key Themes

Positive Highlights

Comments that could not be inline-anchored

Uh oh!

gh-aw-bot commented Aug 16, 2026

Quick triage

Next step

Uh oh!

Copilot AI commented Aug 16, 2026

Quick triage...

Uh oh!

github-actions Bot commented Aug 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Aug 16, 2026 •

edited by github-actions Bot

Loading

github-actions Bot commented Aug 16, 2026 •

edited

Loading

github-actions Bot commented Aug 16, 2026 •

edited

Loading

github-actions Bot commented Aug 16, 2026 •

edited

Loading

github-actions Bot commented Aug 16, 2026 •

edited

Loading

github-actions Bot commented Aug 16, 2026 •

edited

Loading