Pin pi-claude-code-provider to 0.3.0, the last release supporting Pi 0.85.1

.env.example

@@ -21,6 +21,9 @@ LOG_LEVEL=info
 # /connect_calendar and follow the two-step flow — no refresh token needed here.
 GOOGLE_CLIENT_ID=
 GOOGLE_CLIENT_SECRET=
+# Deprecated. If set at startup, seeded once into workspace/.secretary/google-token.json
+# and then ignored. Use /connect_calendar in the bot for new setups.
+GOOGLE_REFRESH_TOKEN=
 
 # Playwright browser tools (MCP bridge). When PLAYWRIGHT_ENABLED=true the agent
 # gets ~60 browser_* tools (navigate, click, type, screenshot, run arbitrary

Dockerfile

@@ -33,7 +33,11 @@ RUN apt-get update && apt-get install -y --no-install-recommends python3-venv \
   && /opt/tilion/bin/python -c "import tilion_fortress as t; tag = t._CHANNELS['latest']['tag']; t._download('linux-x64', t._host(tag), tag)"
 
 # Claude Code CLI must be on PATH: pi-claude-code-provider shells out to `claude`.
-RUN npm install -g @anthropic-ai/claude-code
+# Pinned to the version pi-claude-code-provider 0.4.0 is tested against (its
+# src/compatibility.ts). The provider rejects any stream-json record ahead of
+# system/init, so an unpinned newer CLI can break every turn with
+# "Claude emitted a record before initialization". Bump together with the provider.
+RUN npm install -g @anthropic-ai/claude-code@2.1.278
 
 COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
 RUN chmod +x /usr/local/bin/docker-entrypoint.sh

README.md

@@ -98,6 +98,7 @@ The agent's edits to `MEMORY.md` are local runtime data. Leave them uncommitted,
 | `CAPTCHA_API_KEY` | no | | Captcha solver key; enables `fortress_solve_captcha` and auto-solve during fetch |
 | `GOOGLE_CLIENT_ID` | no | | OAuth client id (TVs and Limited Input devices) — enables the calendar tool |
 | `GOOGLE_CLIENT_SECRET` | no | | OAuth client secret — required alongside `GOOGLE_CLIENT_ID` |
+| `GOOGLE_REFRESH_TOKEN` | no | | Deprecated. If set, seeded once into `workspace/.secretary/google-token.json`, then ignored. |
 
 ## Keeping it running on Windows
 

docker-compose.yml

@@ -17,6 +17,7 @@ services:
       - LOG_LEVEL=${LOG_LEVEL:-info}
       - GOOGLE_CLIENT_ID=${GOOGLE_CLIENT_ID:-}
       - GOOGLE_CLIENT_SECRET=${GOOGLE_CLIENT_SECRET:-}
+      - GOOGLE_REFRESH_TOKEN=${GOOGLE_REFRESH_TOKEN:-}
       - FORTRESS_ENABLED=${FORTRESS_ENABLED:-false}
       - FORTRESS_HEADLESS=${FORTRESS_HEADLESS:-true}
       - FORTRESS_CHANNEL=${FORTRESS_CHANNEL:-}
@@ -24,6 +25,6 @@ services:
       - TILION_REGION=${TILION_REGION:-}
       - CAPTCHA_API_KEY=${CAPTCHA_API_KEY:-}
     volumes:
-      - /media/disk1/containers/volcanic_secretary/workspace:/workspace
-      - /media/disk1/containers/volcanic_secretary/pi-agent:/pi-agent
-      - /media/disk1/containers/volcanic_secretary/claude:/root/.claude
+      - /media/disk1/containers/volcanic_secretary_vova/workspace:/workspace
+      - /media/disk1/containers/volcanic_secretary_vova/pi-agent:/pi-agent
+      - /media/disk1/containers/volcanic_secretary_vova/claude:/root/.claude

docker-entrypoint.sh

@@ -2,26 +2,24 @@
 set -e
 
 PI_DIR="${PI_CODING_AGENT_DIR:-/pi-agent}"
-PKG=pi-claude-code-provider
-PKG_DIR="$PI_DIR/npm/node_modules/$PKG"
+# Pinned: 0.4.0+ calls piAi.getCurrentSystemPrompt, which Pi 0.85.1 (package.json) lacks,
+# so an unpinned install on a fresh volume breaks every turn. 0.3.0 is the last release that
+# supports Pi 0.85.1. The version is part of the marker so changing it forces a reinstall.
+PROVIDER_VERSION="0.3.0"
+MARKER="$PI_DIR/.pi-claude-code-provider.installed.$PROVIDER_VERSION"
 
-# Keep pi-claude-code-provider on the latest npm release: on every start compare the
-# installed version with the registry and force a clean reinstall when they differ.
-# If the registry is unreachable, keep whatever is installed.
-# Install the exact version: an unversioned `npm install` keeps the range already in
-# $PI_DIR/npm/package.json (e.g. ^0.2.0), which silently reinstalls the old release.
-installed=$(node -p "require('$PKG_DIR/package.json').version" 2>/dev/null || true)
-latest=$(npm view "$PKG" version 2>/dev/null || true)
-
-if [ -z "$installed" ] || { [ -n "$latest" ] && [ "$installed" != "$latest" ]; }; then
-  echo "[entrypoint] pi install npm:$PKG (installed: ${installed:-none}, latest: ${latest:-unknown})"
+if [ ! -f "$MARKER" ]; then
+  echo "[entrypoint] pi install npm:pi-claude-code-provider@$PROVIDER_VERSION"
   mkdir -p "$PI_DIR"
-  rm -rf "$PKG_DIR"
-  if ! /app/node_modules/.bin/pi install "npm:$PKG${latest:+@$latest}"; then
+  # Wipe any previous (possibly-patched) install so pi restores the canonical package.
+  rm -rf "$PI_DIR/npm/node_modules/pi-claude-code-provider"
+  if /app/node_modules/.bin/pi install "npm:pi-claude-code-provider@$PROVIDER_VERSION"; then
+    touch "$MARKER"
+  else
     echo "[entrypoint] pi install failed; will retry on next start" >&2
   fi
 else
-  echo "[entrypoint] $PKG $installed is up to date"
+  echo "[entrypoint] pi-claude-code-provider@$PROVIDER_VERSION already installed"
 fi
 
 if [ $# -gt 0 ]; then

package.json

@@ -13,7 +13,7 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@earendil-works/pi-coding-agent": "*",
+    "@earendil-works/pi-coding-agent": "^0.85.1",
     "@grammyjs/auto-retry": "^2.0.2",
     "@modelcontextprotocol/sdk": "^1.30.0",
     "@playwright/mcp": "^0.0.80",

src/config.test.ts

@@ -72,12 +72,25 @@ describe("loadConfig", () => {
     });
   });
 
-  it("accepts Google client_id + client_secret", () => {
+  it("accepts Google client_id + client_secret without a refresh token", () => {
     const cfg = loadConfig(
       { ...base, GOOGLE_CLIENT_ID: "cid", GOOGLE_CLIENT_SECRET: "csecret" },
       "/p",
     );
-    expect(cfg.google).toEqual({ clientId: "cid", clientSecret: "csecret" });
+    expect(cfg.google).toEqual({ clientId: "cid", clientSecret: "csecret", refreshToken: undefined });
+  });
+
+  it("accepts Google client_id + client_secret + refresh_token together", () => {
+    const cfg = loadConfig(
+      {
+        ...base,
+        GOOGLE_CLIENT_ID: "cid",
+        GOOGLE_CLIENT_SECRET: "csecret",
+        GOOGLE_REFRESH_TOKEN: "rt",
+      },
+      "/p",
+    );
+    expect(cfg.google).toEqual({ clientId: "cid", clientSecret: "csecret", refreshToken: "rt" });
   });
 
   it("rejects Google config that has client_id without client_secret", () => {
@@ -92,6 +105,12 @@ describe("loadConfig", () => {
     ).toThrow(/GOOGLE_CLIENT_ID.*GOOGLE_CLIENT_SECRET/);
   });
 
+  it("rejects a lone GOOGLE_REFRESH_TOKEN without client_id/secret", () => {
+    expect(() =>
+      loadConfig({ ...base, GOOGLE_REFRESH_TOKEN: "rt" }, "/p"),
+    ).toThrow(/GOOGLE_CLIENT_ID.*GOOGLE_CLIENT_SECRET/);
+  });
+
   it("leaves google undefined when no GOOGLE_* vars are set", () => {
     expect(loadConfig(base, "/p").google).toBeUndefined();
   });

src/config.ts

@@ -19,6 +19,7 @@ export interface Config {
 export interface GoogleConfig {
   clientId: string;
   clientSecret: string;
+  refreshToken?: string;
 }
 
 export interface PlaywrightConfig {
@@ -64,16 +65,17 @@ export function loadConfig(env: NodeJS.ProcessEnv = process.env, cwd: string = p
 
   const googleClientId = blankToUndefined(env.GOOGLE_CLIENT_ID);
   const googleClientSecret = blankToUndefined(env.GOOGLE_CLIENT_SECRET);
+  const googleRefreshToken = blankToUndefined(env.GOOGLE_REFRESH_TOKEN);
   const hasClientId = Boolean(googleClientId);
   const hasClientSecret = Boolean(googleClientSecret);
-  if (hasClientId !== hasClientSecret) {
+  if (hasClientId !== hasClientSecret || (!hasClientId && googleRefreshToken)) {
     throw new ConfigError(
-      "Google Calendar needs both GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET.",
+      "Google Calendar needs both GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET (refresh token is optional; if set at startup it will be migrated into the workspace store).",
     );
   }
   const google: GoogleConfig | undefined =
     googleClientId && googleClientSecret
-      ? { clientId: googleClientId, clientSecret: googleClientSecret }
+      ? { clientId: googleClientId, clientSecret: googleClientSecret, refreshToken: googleRefreshToken }
       : undefined;
 
   const playwright: PlaywrightConfig | undefined = parseBool(env.PLAYWRIGHT_ENABLED)

src/main.ts

@@ -91,6 +91,13 @@ async function main(): Promise<void> {
   let tokenStore: GoogleTokenStore | null = null;
   if (config.google) {
     tokenStore = createGoogleTokenStore(config.workspaceDir);
+    if (config.google.refreshToken && tokenStore.read() === null) {
+      tokenStore.write(config.google.refreshToken);
+      logger.warn(
+        "GOOGLE_REFRESH_TOKEN env var seeded into workspace/.secretary/google-token.json. " +
+        "You can remove GOOGLE_REFRESH_TOKEN from .env now — future updates come through /connect_calendar.",
+      );
+    }
     customTools.push(createCalendarTool({
       clientId: config.google.clientId,
       clientSecret: config.google.clientSecret,

src/telegram/bridge.test.ts

@@ -299,7 +299,7 @@ describe("registerBridge", () => {
     const h = harness();
     await h.bot.handleUpdate(textUpdate("/usr/local/bin is on my path", OWNER, "private", false));
     expect(h.texts()).toEqual([]);
-    await vi.waitFor(() => expect(h.host.sent).toEqual([{ text: "/usr/local/bin is on my path", images: undefined }]));
+    expect(h.host.sent).toEqual([{ text: "/usr/local/bin is on my path", images: undefined }]);
   });
 
   it("tells the owner it cannot handle unsupported media", async () => {