Agents created before the default-template fix still run with no read, bash, edit or write
outside the playground. The fix for #5590 changes what a NEW agent gets; it does not touch an
agent that was already saved.
On one development deployment, 66 of 73 agents on a Pi harness have no built-in tool in their
saved configuration. That is nearly all of them. The number on a real deployment is unknown and
should be measured before deciding what to do.
How to count them
with latest as (
select distinct on (variant_id) variant_id, data::jsonb as d
from workflow_revisions
where data::jsonb #> '{parameters,agent}' is not null
order by variant_id, created_at desc
)
select coalesce(d #>> '{parameters,agent,harness,kind}', 'unset') as harness,
count(*) filter (where not exists (
select 1 from jsonb_array_elements(coalesce(d #> '{parameters,agent,tools}', '[]'::jsonb)) t
where t->>'type' = 'builtin')) as no_builtins,
count(*) as total
from latest group by 1 order by 3 desc;What an affected user sees
The agent works when they chat with it in the playground and reports that it has no shell or
filesystem tool whenever anything else runs it, such as a schedule. Same symptom as #5590.
What would repair them
Someone has to add the built-in tools to each agent by hand today. The tool editor has a picker
under Advanced in the Permissions section.
Three shapes worth weighing, and the choice is not obvious:
- Leave it. Affected agents stay broken until an author edits them.
- Treat "a Pi agent saved before the fix with no built-in entries" as "the author never chose"
and grant Pi's defaults at run time. This repairs everything with no data change, but it
reinterprets a saved configuration, so an author who genuinely wanted no built-in tools gets
them back.
- Rewrite the affected saved revisions to include the four tools. Explicit and visible in the
configuration afterwards, but it edits data an author owns.
Notes
Raised in review of the fix for #5590, which was deliberately scoped to new agents.
Agents created before the default-template fix still run with no read, bash, edit or write
outside the playground. The fix for #5590 changes what a NEW agent gets; it does not touch an
agent that was already saved.
On one development deployment, 66 of 73 agents on a Pi harness have no built-in tool in their
saved configuration. That is nearly all of them. The number on a real deployment is unknown and
should be measured before deciding what to do.
How to count them
What an affected user sees
The agent works when they chat with it in the playground and reports that it has no shell or
filesystem tool whenever anything else runs it, such as a schedule. Same symptom as #5590.
What would repair them
Someone has to add the built-in tools to each agent by hand today. The tool editor has a picker
under Advanced in the Permissions section.
Three shapes worth weighing, and the choice is not obvious:
and grant Pi's defaults at run time. This repairs everything with no data change, but it
reinterprets a saved configuration, so an author who genuinely wanted no built-in tools gets
them back.
configuration afterwards, but it edits data an author owns.
Notes
Raised in review of the fix for #5590, which was deliberately scoped to new agents.