ZacharyZhang-NY
7f23f40e87
`init()` ran three implicit data-repair queries on every boot: `reconcileOrphanedTasks`, `reconcileUnreviewableTasks`, and a secrets-table migration whose fallback glued legacy rows onto a synthetic zero UUID when no current company existed. The first two papered over state-machine leaks at init time — hiding the real bug and making startup observably mutate production data; the third silently connected ciphertext to a non-existent company with no UI visibility and no deletion path. Root fix: the startup path is now allowed exactly one mutation — `interruptStaleRuns`, which is crash recovery (running-at-boot = worker died mid-turn) and cannot be expressed anywhere else. The dead-letter `in_review` case moves to the transition point: `tasks-status.guardInReviewHasReviewer` refuses to advance a task into `in_review` when its assignee is a top-level agent (`reports_to IS NULL`) and the task is not flagged for user review. Callers either pre-flag the task (the CEO-completion path in `automation-run-completion.advanceToInReview` now does this) or the transition is rejected. No more silent resurrection at boot; the failure is visible and actionable at source. The orphan-task reconcile disappears entirely — the `finishRun` guard already enforces the invariant at the one place a run can leave the in-progress state, and `recoverStaleLocks` handles stuck executions at runtime. The secrets migration now throws when neither `settings.current_company_id` nor any company row exists, rather than binding legacy ciphertext to `00000000-0000-0000-0000-000000000000`. Legacy rows stay on the old table until the operator creates a real company, at which point the upgrade succeeds deterministically. Tests rewritten: the reconciliation regression suite now asserts the transition-time guard and the lone `interruptStaleRuns` behavior. `resolve-workspace.test.ts` catches up with the exclusive-by-default lock policy committed earlier.
AgentCompany
Run an AI company from your desktop.
What it does
Type a company name and a goal. A CEO agent boots, hires specialists, forms departments, and runs the business. You approve or steer from the desktop.
Local, SQLite-backed, no external services. Inspired by Paperclip.
26 providers, no CLI
The runtime links pi-mono directly.
OAuth (5): Claude Pro/Max · ChatGPT Plus/Pro (Codex) · GitHub Copilot · Gemini CLI · Antigravity
API key (18): Anthropic · OpenAI · Google · Mistral · Groq · Cerebras · xAI · OpenRouter · Vercel AI Gateway · ZAI · OpenCode · OpenCode Go · Hugging Face · Kimi · MiniMax · MiniMax CN · Fireworks · Fireworks Firepass
Cloud (3): Azure OpenAI · AWS Bedrock · Google Vertex AI
Credentials are SecretVault-encrypted in SQLite.
Two execution modes
- AI CEO — autonomous. Hiring, tasks, deliverables run without you.
- AI Co-Founder — pauses at
hire_agent/document_review/plan_review/strategy_reviewfor your decision.
Switch at Settings → Execution mode.
Features
Self-organizing teams
CEO builds the org chart from one goal.
Agent messaging
Threads and DMs between agents. Messages land in each recipient's transcript as pi AgentMessage turns.
Tasks
Goals break into tasks. Agents pick them up, report progress, escalate blockers.
Approvals
Hiring, deliverables, plan/scope/strategy reviews, budget overrides, production deploys pause for the board.
Documents
Plans, strategies, and specs in a shared center, linked to the tasks that produced them.
Launch in a minute
Name, mission, goal, provider, mode.
Quick Start
Download the latest release — macOS (Apple Silicon & Intel), Windows, Linux.
Build from source
# Node.js 22+, pnpm 10+
pnpm install
pnpm dev
First run
- Onboarding probes your shell PATH for
node(agents call the local HTTP API vianode -e). - Settings → Providers. Sign in or drop a key.
- Create a company: name, mission, goal, mode, workspace.
Verification
pnpm typecheck
pnpm lint
pnpm test:unit
pnpm test:integration
pnpm test:e2e
pnpm build:verify
Packaging
pnpm build # Package for current platform → /build/release
pnpm build:dir # Unpackaged directory
pnpm build:current # Current host platform
pnpm release:local # Signed release pipeline — see docs/release/local-r2.md
Targets: macOS .dmg, Windows .exe (NSIS), Linux .AppImage. Built with electron-builder. Local builds use ad-hoc signing (CSC_IDENTITY_AUTO_DISCOVERY=false). Defaults to --publish never.
Architecture
src/
main/
agent-runtime/ RuntimeBridge, SqliteSessionStore, CostWriter
credentials/ CredentialStore, Resolver, OAuthLoginService
api-server/ Agent HTTP API
orchestration/ Scheduler, run dispatch
prompt-builder/ System prompt assembly
thread-integration/ Thread runtime event routing
worker/ utilityProcess worker — direct new Agent(...)
database/ SQLite schema + migrations
preload/ Typed DesktopApi via contextBridge
renderer/ React 19 UI
shared/ Zod schemas shared across processes
- SQLite local; no external services.
contextIsolation: true,nodeIntegration: false, Zod-validated IPC.- Worker constructs
new Agent({...})from@mariozechner/pi-agent-coredirectly. - Sessions persist as
session_entries; auto-compact viashouldCompact/compact. - Thread runtime (
conversation_threads/conversation_events/thread_wait_states) sits above pi'sAgentMessagestream.
Tech Stack
| Layer | Tech |
|---|---|
| Framework | Electron 39.8.0 |
| Language | TypeScript 5.9 |
| UI | React 19, Tailwind CSS 4, Framer Motion, Zustand |
| Build | electron-vite, Vite 7, electron-builder |
| Database | SQLite via node:sqlite (WAL) |
| Validation | Zod 4 |
| Agent runtime | @mariozechner/pi-ai, @mariozechner/pi-agent-core, @mariozechner/pi-coding-agent |
| Testing | Vitest, Playwright |