{"record":{"id":"81a368720b94ea28","repo":"coleam00/Archon","slug":"pi-auth-storage-init-failed-e-message-check-t","errorCode":null,"errorMessage":"Pi auth storage init failed: ${e.message}. Check that ~/.pi/agent/auth.json (or $PI_CODING_AGENT_DIR/auth.json) is valid JSON and readable.","messagePattern":"Pi auth storage init failed: (.+?)\\. Check that ~/\\.pi/agent/auth\\.json \\(or \\$PI_CODING_AGENT_DIR/auth\\.json\\) is valid JSON and readable\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/providers/src/community/pi/provider.ts","lineNumber":465,"sourceCode":"      // there first and fall back to process.env for a shell-level override.\n      const archonAuthPath =\n        (requestOptions?.env?.ARCHON_PI_AUTH_PATH ?? process.env.ARCHON_PI_AUTH_PATH)?.trim() ||\n        undefined;\n      // pi-coding-agent 0.84.0 folded AuthStorage + ModelRegistry into a single\n      // ModelRuntime; ModelRegistry is now a thin facade constructed from a\n      // runtime. authPath still feeds the file-backed CredentialStore inside\n      // ModelRuntime — the per-user auth.json path is honoured the same way.\n      // modelsPath follows the same per-call pattern for custom providers'\n      // `${VAR}` substitution.\n      modelRuntime = await piCodingAgent.ModelRuntime.create({\n        authPath: archonAuthPath,\n        ...(customProviderModelsPath ? { modelsPath: customProviderModelsPath } : {}),\n      });\n      modelRegistry = new piCodingAgent.ModelRegistry(modelRuntime);\n    } catch (err) {\n      const e = err as Error;\n      getLog().error({ err: e, piProvider: parsed.provider }, 'pi.auth_storage_init_failed');\n      throw new Error(\n        `Pi auth storage init failed: ${e.message}. Check that ~/.pi/agent/auth.json ` +\n          '(or $PI_CODING_AGENT_DIR/auth.json) is valid JSON and readable.'\n      );\n    } finally {\n      // The per-call models.json holds the literal substituted secret in\n      // cleartext. ModelRuntime.create reads it once at construction (via\n      // ModelConfig.load); the runtime carries the loaded values for the\n      // rest of the session, so the file can be removed as soon as the\n      // create() promise resolves. Without this cleanup, long-running\n      // processes accumulate one file per sendQuery and eventually hit\n      // ENOSPC, after which buildCustomProviderModelsPath's mkdirSync fails\n      // and the SDK silently falls through to the unsubstituted user\n      // models.json — re-opening the round-1 R1 leak surface. Errors here\n      // are non-fatal (the file may already be gone, or the FS may be in\n      // an odd state); the original error has already been surfaced.\n      if (customProviderModelsPath) {\n        try {\n          rmSync(customProviderModelsPath, { force: true });","sourceCodeStart":447,"sourceCodeEnd":483,"githubUrl":"https://github.com/coleam00/Archon/blob/0773b9745896ef0612e709c80845a0f7db315b19/packages/providers/src/community/pi/provider.ts#L447-L483","documentation":"sendQuery constructs a Pi ModelRuntime backed by the auth storage (~/.pi/agent/auth.json or $PI_CODING_AGENT_DIR/auth.json). If that construction throws (malformed JSON, unreadable file, bad permissions), the error is rethrown with guidance pointing at the auth file, preserving the original message and logging pi.auth_storage_init_failed.","triggerScenarios":"sendQuery when auth.json contains invalid JSON (e.g. from a truncated write or hand edit), has wrong permissions, is a directory, or PI_CODING_AGENT_DIR points somewhere without a readable auth.json.","commonSituations":"Hand-editing ~/.pi/agent/auth.json and breaking JSON, syncing tools copying partial files, permissions changed by chown/chmod, or a custom PI_CODING_AGENT_DIR with a stale/invalid auth file.","solutions":["Validate ~/.pi/agent/auth.json parses as JSON (e.g. `jq . ~/.pi/agent/auth.json`); fix or delete it and re-run `pi /login`","Check file permissions (readable by the running user)","If PI_CODING_AGENT_DIR is set, check auth.json at $PI_CODING_AGENT_DIR/auth.json instead","Restore auth.json by running `pi` and `/login` to regenerate it"],"exampleFix":"// before (truncated file)\n{\"anthropic\": {\"type\": \"oauth\", \"access\"\n// after\n$ rm ~/.pi/agent/auth.json && pi   # then /login","handlingStrategy":"try-catch","validationCode":"import { readFileSync } from 'node:fs';\nconst authPath = process.env.PI_CODING_AGENT_DIR\n  ? `${process.env.PI_CODING_AGENT_DIR}/auth.json` : `${process.env.HOME}/.pi/agent/auth.json`;\ntry {\n  JSON.parse(readFileSync(authPath, 'utf8'));\n} catch (e) {\n  throw new Error(`Pi auth file unreadable/invalid at ${authPath}: ${e.message}; run 'pi' + /login to regenerate`);\n}","typeGuard":"function isReadableJsonFile(path: string): boolean {\n  try { JSON.parse(readFileSync(path, 'utf8')); return true; } catch { return false; }\n}","tryCatchPattern":"try {\n  await sendQuery(q);\n} catch (err) {\n  if (err.message.startsWith('Pi auth storage init failed')) {\n    log.error({ cause: err }, 'pi auth file invalid; regenerating via pi /login is required');\n  }\n  throw err;\n}","preventionTips":["Never hand-edit auth.json; use `pi /login` to write it","Back up auth.json before provisioning changes","Check auth.json health (JSON.parse) in a startup health check","Avoid processes that truncate-write shared files like sync tools"],"tags":["auth","filesystem","json","pi"],"backgroundTag":"corrupt-credentials-file","analyzedSha":"0773b9745896ef0612e709c80845a0f7db315b19","analyzedAt":"2026-09-01T02:28:07.064Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}