chore(#7021): bump pi-xai-vertex from 0.2.0 to 0.2.1 by fullsend-ai-coder[bot] · Pull Request #7024 · fullsend-ai/fullsend

fullsend-ai-coder · 2026-09-04T19:57:00Z

Summary

Bumps the vendored pi-xai-vertex extension in the sandbox image from v0.2.0 to v0.2.1. v0.2.0 aborts Grok-on-Vertex requests when the endpoint sends keepalive frames (data: : keepalive) during high reasoning effort — the OpenAI SDK decoder inside pi fails on the non-JSON frame. v0.2.1 filters those frames before the SDK sees them (fullsend-ai/pi-xai-vertex#5, fixed by fullsend-ai/pi-xai-vertex#6).

Related Issue

Fixes #7021

Changes

Update PI_XAI_VERTEX_VERSION from 0.2.0 to 0.2.1 in images/sandbox/Containerfile
Update PI_XAI_VERTEX_SHA256 to match the v0.2.1 release tarball (2d910e500c1052f5a8b10d0f9a39149629fd1fff93e5cac71ae963211a71ee30)

Testing

No Go code changes — the extension's provider id, model id, env contract, and install layout are unchanged between v0.2.0 and v0.2.1
Existing sandbox_pi_image_test.go validates the extension installs at the pinned path
The sandbox image build validates the SHA256 checksum at build time

Checklist

PR title follows Conventional Commits (correct type, ! for breaking changes)
No secrets or sensitive data committed

Closes #7021

Post-script verification

Branch is not main/master (agent/7021-bump-pi-xai-vertex)
Secret scan passed (gitleaks — 403540d77c8c32f89ec7e813bf68c7ff016f582e..HEAD)
PR body secret scan passed (gitleaks — no-git)

Verification (@waynesun09, 2026-09-04)

SHA: curl -fsSL https://github.com/fullsend-ai/pi-xai-vertex/archive/refs/tags/v0.2.1.tar.gz | shasum -a 256 → 2d910e500c1052f5a8b10d0f9a39149629fd1fff93e5cac71ae963211a71ee30, matching the pin. Tag v0.2.1 = release commit 5216a88c on the extension's main; it contains fix commit 7d1a651b (fix(#5): filter Vertex AI keepalive frames from SSE streams pi-xai-vertex#6).
Tarball diff v0.2.0 → v0.2.1: src/index.ts (the keepalive filter), src/index.test.ts, README, package.json version, and the two root version lines of package-lock.json. Dependencies unchanged (google-auth-library 9.15.1 exact), so npm ci --omit=dev --omit=peer --ignore-scripts installs the identical tree.
Bump checklist (per the renovate.json manager note and pi_bootstrap.go): peerDependencies floor @earendil-works/pi-ai >=0.84.0, pi-coding-agent >=0.84.0 still covers PI_VERSION=0.84.4; PROVIDER_ID (xai-vertex), MODEL_ID (xai/grok-4.6, matches piXaiVertexModels), the project env-var list and buildBaseUrl are byte-identical between the tags, so the runtime's model table and env contract need no change.
Local image build with this pin: podman build -f images/sandbox/Containerfile on this branch succeeds (checksum step passes); inside the image /usr/local/share/pi-extensions/xai-vertex/package.json is 0.2.1 and src/index.ts carries the filter; pi 0.84.4. go test ./internal/sandbox/ passes.
Multi-model review (Claude Fable 5.1, Grok 4.6, Codex gpt-5.6-sol): no MEDIUM+ code findings. Lows left as-is: the tarball now also ships the extension repo's .fullsend/config.yaml, which the rm -rf cleanup does not strip (inert, not read by anything); chore vs fix for the release notes; pi-xai-vertex is patch-automerge-eligible in renovate.json without an automerge: false rule like pi-anthropic-vertex has, while the SHA must be refreshed by hand — worth a follow-up.
End-to-end on this pin (2026-09-04, local): images/code/Containerfile built on the sandbox image from this branch, then fullsend run review --runtime pi --model xai-vertex/xai/grok-4.6 (fleet review harness, pr-review roster, target feat(dispatch): let a repository preserve the agent run already in flight #7007 — the run that aborted on the keepalive frame with v0.2.0 earlier today): → Result: stop, exit 0, schema-valid result (request-changes, 7 findings), 25 turns, 1219 s, 8 Agent dispatches (opus ×3, sonnet ×5, all stop), no stream error; metrics.json total $6.67 = grok 3.04 + opus 1.45 + sonnet 2.18.

v0.2.0 aborts Grok-on-Vertex requests when the endpoint sends keepalive frames during high reasoning effort. The OpenAI SDK decoder inside pi fails with an unexpected token error. v0.2.1 filters those frames before the SDK sees them (fullsend-ai/pi-xai-vertex#5, fixed by #6). Update PI_XAI_VERTEX_VERSION and PI_XAI_VERTEX_SHA256 in the sandbox Containerfile. No Go code changes needed: the extension provider id, model id, env contract, and install layout are unchanged between v0.2.0 and v0.2.1. Closes #7021

fullsend-ai-review · 2026-09-04T19:58:49Z

🤖 Finished Review · ✅ Success · Started 7:58 PM UTC · Completed 8:11 PM UTC

Commit: 8caf3df · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.51

codecov · 2026-09-04T20:01:02Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

fullsend-ai-review · 2026-09-04T20:11:29Z

Risk Assessment: moderate (2/5)

Details

Two-line version bump in images/sandbox/Containerfile by a bot with a clear linked issue; the protected-path flag and high file churn lift the score slightly above 1, but the change is mechanical, well-scoped, and trivially rollable.

fullsend-ai-review · 2026-09-04T20:11:31Z

Review

Findings

Medium

[protected-path] images/sandbox/Containerfile — This PR modifies images/sandbox/Containerfile, which is under the protected images/ path. The PR links to issue pi: bump the vendored pi-xai-vertex extension to v0.2.1 (Grok streams abort on Vertex keepalive frames) #7021 and explains the rationale (fixing Grok-on-Vertex keepalive frame handling via a version bump from v0.2.0 to v0.2.1). Human approval is always required for protected-path changes, regardless of context.

fullsend-ai-retro · 2026-09-04T21:38:20Z

🤖 Finished Retro · ✅ Success · Started 9:38 PM UTC · Completed 9:48 PM UTC

Commit: 8caf3df · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.76

fullsend-ai-retro · 2026-09-04T21:48:10Z

Retro: PR #7024 — bump pi-xai-vertex from 0.2.0 to 0.2.1

Verdict: workflow went well; no novel proposals. All identified improvement areas are already tracked by existing open issues.

Timeline

Time (UTC)	Event	Cost
19:42	Issue #7021 filed by waynesun09 with detailed context	—
19:44–19:48	Triage agent (run 33912553071) confirmed severity high	$0.54
19:48–19:57	Code agent (run 33913067695) produced correct 2-line change, first attempt	$1.45
19:57–20:11	Review agent (run 33913761634) — 1 medium finding (protected-path), risk moderate (2/5)	$2.51
21:35	waynesun09 approved after thorough independent verification (SHA check, tarball diff, local build, multi-model review, end-to-end test)	—
21:36	PR merged	—

Total agent cost: ~$4.50 for a 2-line mechanical version bump. Zero rework iterations.

What went well

Code agent efficiency: Correct change on first attempt in 8 minutes. The well-specified issue (pi: bump the vendored pi-xai-vertex extension to v0.2.1 (Grok streams abort on Vertex keepalive frames) #7021 included exact file, version, and SHA256) gave the agent everything it needed.
Review agent correctness: No false positives on code quality. Correctly flagged the only process concern (protected path in images/).
Human review depth: waynesun09's verification was exceptionally thorough — SHA verification against the release tag, tarball diff between v0.2.0 and v0.2.1, peer dependency compatibility check, local image build, multi-model code review (Claude Fable 5.1, Grok 4.6, Codex gpt-5.6-sol), and end-to-end test running the Grok orchestrator against a PR that previously failed.

Evidence for existing issues (no new proposals needed)

Add pre-flight scope heuristic to adjust review effort/model for trivially-scoped PRs #6891 (pre-flight scope heuristic): This PR is a textbook case — a 2-line ARG-only Containerfile change reviewed at opus/high effort with 4 sub-agents + challenger for $2.51 and 14 minutes. A scope heuristic recognizing this as trivially-scoped could have selected a lighter model/effort.
pr-review skill: reduce sub-agent dispatch for mechanical/value-only changes like dependency bumps #4060 (reduce sub-agent dispatch for mechanical changes): The review dispatched correctness, security, intent-coherence, and style-conventions sub-agents. All returned zero findings. A fast-path for value-only dependency bumps could skip most of these.
Protected-path policy should distinguish mechanical version bumps from governance changes in .github/ #5370 / Expand protected-path agent-approval exemption to cover single-ARG version bumps in Dockerfiles #3910 (protected-path policy for mechanical version bumps): The protected-path finding inflated the risk score from 1 to 2 (moderate) despite the change being a single-ARG version bump in a Containerfile. The finding itself was low-signal — the human already knew protected paths require approval.
Track autonomy readiness: review agent verdicts match human approvals on all 15 recent bot dependency PRs in tekton-tools with zero human delta #5092 / Track autonomy readiness: review agent fully covered human review on bot Dockerfile image bump in integration-service PR #1627 #4817 (autonomy readiness for bot dependency PRs): The review agent's analysis was a strict subset of the human review. The human went deeper on supply chain verification (tarball contents, local build, e2e test). For mechanical version bumps, the agent consistently matches human verdicts on code quality — the gap is in supply chain and runtime verification.

The vendored Claude-on-Vertex extension no longer carries an Anthropic SDK and its CI covers 0.85.0, which was the last thing holding the pi bump on the Dependency Dashboard (#2682). PI_VERSION 0.84.4 -> 0.85.0. The Node floor assertion beside it still holds: npm metadata gives engines.node ">=22.19.0" for both releases. The 0.84.4 comment is kept but reworded as a FLOOR (the https-proxy-agent named-export bug that breaks google-vertex under HTTPS_PROXY was fixed in 0.84.4, so the rationale still applies below the pin, #8610). piGoogleVertexModels gains gemini-3.8-flash. This table is the bundled google-vertex catalog copied verbatim and is what the Agent tool accepts as a Gemini id, so a missed entry makes us reject a model the running pi serves. 0.85.0's data file adds exactly that one id and changes nothing else. Worth recording how this is checked: diff dist/providers/data/google-vertex.json between the pins, not the generated wrapper -- the wrapper is unchanged and reading it says the catalog is unchanged, which is wrong. The docs re-check column now says so. Closes #7018 by moving the example/default Gemini reference from gemini-3.7-flash to gemini-3.8-flash across config, docs and fixtures. gemini-3.7-flash stays in the catalog table: 0.85.0 removes nothing. Provenance comments are annotated, not rewritten, and only where the cited module was actually re-diffed between 0.84.4 and 0.85.0. Byte-identical: modes/json-event.js, modes/print-mode.js, core/sdk.js, core/package-manager.js, core/auth-storage.js, core/pi-manifest.js, and defaultActiveToolNames; jiti stays 2.7.0. cli/args.js differs only in help text (new PI_SERVER_DIR and PI_SERVER_ID env docs, no new option -- and the pluginformat env denylist already wildcards PI_*). core/tools/bash.js differs by 120 lines but the killProcessTree call sites are identical, so stray_processes.go's claim survives. Because json-event.js is byte-identical the --mode json wire contract did not move, so the parsePiStream fixtures stay valid. pi_run.go's alias comment is flipped rather than deleted: it warned that the table can name an id the pinned pi lacks, with "fable" -> claude-fable-5-1 as the example. 0.85.0's catalog adds that id, so the bump closes the gap the comment described (#6882). Verified locally against an image built from this Containerfile with the xai-vertex 0.2.1 pin from #7024 applied on top, so it matches main after that merge: pi --version -> 0.85.0 pi -ne -e .../anthropic-vertex -e .../xai-vertex --list-models -> 14 anthropic-vertex ids incl. claude-fable-5-1 (new in 0.85.0), plus xai-vertex; no stderr pi -ne --list-models | google-vertex -> 14 gemini ids, and that set is byte-identical to piGoogleVertexModels pi --print --mode json --model anthropic-vertex/claude-sonnet-5 -> exit 0, 14 NDJSON lines, session version 3 that captured stream through parsePiStream -> sessionID captured, no error, exactly one ResultEvent, subtype stop go build, go vet, and ./internal/{config,runtime,harness,sandbox,pluginformat} pass; node --test on fullsend-agent.test.mjs passes 32/32. Assisted-by: Claude (fix), Grok (review), Codex (review) Signed-off-by: Wayne Sun <gsun@redhat.com>

fullsend-ai-coder Bot requested a review from a team as a code owner September 4, 2026 19:57

fullsend-ai-coder Bot added the ready-for-review Triggers review agent dispatch label Sep 4, 2026

fullsend-ai-coder Bot assigned waynesun09 Sep 4, 2026

fullsend-ai-coder Bot temporarily deployed to dev September 4, 2026 19:57 Inactive

fullsend-ai-review Bot added the risk/moderate PR risk: moderate label Sep 4, 2026

fullsend-ai-review Bot added the requires-manual-review Review requires human judgment label Sep 4, 2026

waynesun09 approved these changes Sep 4, 2026

View reviewed changes

waynesun09 added this pull request to the merge queue Sep 4, 2026

Merged via the queue into main with commit 4cc6475 Sep 4, 2026
68 of 69 checks passed

waynesun09 deleted the agent/7021-bump-pi-xai-vertex branch September 4, 2026 21:36

waynesun09 mentioned this pull request Sep 4, 2026

fix(#7020): point fable at claude-fable-5-1 and thread config aliases into sub-agent dispatch #7028

Merged

10 tasks

Navigation Menu

Uh oh!

chore(#7021): bump pi-xai-vertex from 0.2.0 to 0.2.1 - #7024

chore(#7021): bump pi-xai-vertex from 0.2.0 to 0.2.1#7024
waynesun09 merged 1 commit into
mainfrom
agent/7021-bump-pi-xai-vertex

fullsend-ai-coder Bot commented Sep 4, 2026 •

edited by waynesun09

Loading

Uh oh!

fullsend-ai-review Bot commented Sep 4, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Sep 4, 2026

Uh oh!

fullsend-ai-review Bot commented Sep 4, 2026

Uh oh!

fullsend-ai-review Bot commented Sep 4, 2026

Uh oh!

Uh oh!

fullsend-ai-retro Bot commented Sep 4, 2026 •

edited

Loading

Uh oh!

fullsend-ai-retro Bot commented Sep 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

fullsend-ai-coder Bot commented Sep 4, 2026 • edited by waynesun09 Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Related Issue

Changes

Testing

Checklist

Post-script verification

Verification (@waynesun09, 2026-09-04)

Uh oh!

fullsend-ai-review Bot commented Sep 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov Bot commented Sep 4, 2026

Codecov Report

Uh oh!

fullsend-ai-review Bot commented Sep 4, 2026

Uh oh!

fullsend-ai-review Bot commented Sep 4, 2026

Review

Findings

Medium

Uh oh!

Uh oh!

fullsend-ai-retro Bot commented Sep 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fullsend-ai-retro Bot commented Sep 4, 2026

Retro: PR #7024 — bump pi-xai-vertex from 0.2.0 to 0.2.1

Timeline

What went well

Evidence for existing issues (no new proposals needed)

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

fullsend-ai-coder Bot commented Sep 4, 2026 •

edited by waynesun09

Loading

fullsend-ai-review Bot commented Sep 4, 2026 •

edited

Loading

fullsend-ai-retro Bot commented Sep 4, 2026 •

edited

Loading