@pi-harness/pi-harness 0.1.23 → 0.1.24

package/packages/api-gateway/src/index.ts

@@ -1,7 +1,7 @@
 import { execFile, type ExecFileException } from "node:child_process";
 import { mkdir, mkdtemp, readFile, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
 import type { IncomingMessage, ServerResponse } from "node:http";
-import { basename, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { tmpdir } from "node:os";
 import type { Context } from "@deepseek-ai/cordis";
 import { SessionManager, type AgentSessionEvent, type ExtensionUIContext } from "@earendil-works/pi-coding-agent";
@@ -18,6 +18,7 @@ import {
   paginateMarketplace,
   searchMarketplace,
   needsMarketplacePackageInstall,
+  marketplaceNpmPackageName,
   sortMarketplaceByRecommendation,
   type MarketplacePlugin,
 } from "./marketplace.js";
@@ -55,17 +56,18 @@ function sendJson(response: ServerResponse, status: number, payload: unknown): v
   response.end(body);
 }
 
+// A multi-byte UTF-8 sequence can straddle a chunk boundary, so the raw bytes are collected and decoded once; decoding each chunk on its own would replace the split sequence with U+FFFD.
 async function bodyText(request: IncomingMessage, maxBytes = DEFAULT_BODY_LIMIT_BYTES): Promise<string> {
-  const chunks: string[] = [];
+  const chunks: Buffer[] = [];
   let length = 0;
   for await (const chunk of request) {
     const input: string | Uint8Array = chunk as string | Uint8Array;
-    const value = typeof input === "string" ? input : Buffer.from(input).toString("utf8");
-    length += Buffer.byteLength(value);
+    const buffer = typeof input === "string" ? Buffer.from(input, "utf8") : Buffer.isBuffer(input) ? input : Buffer.from(input);
+    length += buffer.length;
     if (length > maxBytes) throw new PayloadTooLargeError();
-    chunks.push(value);
+    chunks.push(buffer);
   }
-  return chunks.join("");
+  return Buffer.concat(chunks).toString("utf8");
 }
 
 function errorText(error: unknown): string {
@@ -80,9 +82,14 @@ function jsonSafe(value: unknown, seen = new WeakSet<object>()): unknown {
   if (value instanceof Date) return value.toISOString();
   if (typeof value !== "object") return Object.prototype.toString.call(value);
   if (seen.has(value)) return "[Circular]";
+  // Only the ancestors of the current node stay marked: a sibling that repeats the same object (Pi pushes one AgentMessage instance into both the message list and its events) is legitimate data, not a cycle.
   seen.add(value);
-  if (Array.isArray(value)) return value.map((item) => jsonSafe(item, seen));
-  return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, jsonSafe(item, seen)]));
+  try {
+    if (Array.isArray(value)) return value.map((item) => jsonSafe(item, seen));
+    return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, jsonSafe(item, seen)]));
+  } finally {
+    seen.delete(value);
+  }
 }
 
 function createStatus(services: ApiServices, events: readonly AgentSessionEvent[]) {
@@ -350,6 +357,7 @@ function sanitizeLogValue(value: unknown, state: LogSanitizeState, depth = 0): u
   if (typeof value !== "object") return Object.prototype.toString.call(value);
   if (depth >= loggerPanelDepthLimit) return "[Max Depth]";
   if (state.seen.has(value)) return "[Circular]";
+  // Unmarked once its subtree is done, so an object logged twice as a sibling is rendered twice instead of being mistaken for a cycle.
   state.seen.add(value);
 
   try {
@@ -379,6 +387,8 @@ function sanitizeLogValue(value: unknown, state: LogSanitizeState, depth = 0): u
     return Object.fromEntries(entries);
   } catch {
     return "[Unavailable]";
+  } finally {
+    state.seen.delete(value);
   }
 }
 
@@ -530,17 +540,18 @@ interface GitStatusResult {
   readonly truncated: boolean;
 }
 
+// `-z` is what makes the paths usable: without it git wraps any path holding a space, a quote or a non-ASCII byte in C-style quoting, and the quoted form is not a pathspec git will accept back on diff, add or ls-files.
 function gitStatus(cwd: string): Promise<GitStatusResult> {
   return new Promise((resolveStatus, rejectStatus) => {
-    execFile("git", ["status", "--short", "--untracked-files=all"], { cwd, timeout: GIT_TIMEOUT_MS, maxBuffer: 512 * 1024 }, (error, stdout, stderr) => {
+    execFile("git", ["status", "--short", "-z", "--untracked-files=all"], { cwd, timeout: GIT_TIMEOUT_MS, maxBuffer: 512 * 1024 }, (error, stdout, stderr) => {
       if (error === null) {
         resolveStatus({ output: stdout, truncated: false });
         return;
       }
       const termination = gitTermination(error);
       if (termination === "output-limit") {
-        // Keep the complete lines that arrived before the kill; the final line may have been cut mid-path.
-        resolveStatus({ output: stdout.slice(0, stdout.lastIndexOf("\n") + 1), truncated: true });
+        // Keep the complete records that arrived before the kill; the final one may have been cut mid-path.
+        resolveStatus({ output: stdout.slice(0, stdout.lastIndexOf("\0") + 1), truncated: true });
         return;
       }
       if (termination === undefined && error.code === 128 && /not a git repository/i.test(stderr)) {
@@ -610,6 +621,26 @@ async function isDirectory(path: string): Promise<boolean> {
   }
 }
 
+async function isFile(path: string): Promise<boolean> {
+  try {
+    return (await stat(path)).isFile();
+  } catch {
+    return false;
+  }
+}
+
+// The loader resolves a bare plugin specifier from the profile file upwards (`createRequire(profilePath).resolve(name)`), never from the shell the harness was started in, so a marketplace package has to land in the package that owns the profile or it installs successfully and then fails to load.
+async function marketplaceInstallDirectory(configPath: string, fallback: string): Promise<string> {
+  let directory = dirname(resolve(configPath));
+  let parent = dirname(directory);
+  while (parent !== directory) {
+    if (await isFile(join(directory, "package.json"))) return directory;
+    directory = parent;
+    parent = dirname(directory);
+  }
+  return fallback;
+}
+
 function pickDirectory(): Promise<string> {
   return new Promise((resolvePath, reject) => {
     execFile(
@@ -1073,15 +1104,17 @@ export default {
             sendJson(response, 409, { error: "Plugin is already installed", plugin });
             return;
           }
-          const packageJsonPath = join(services.launch.cwd, "package.json");
-          const packageLockPath = join(services.launch.cwd, "package-lock.json");
+          const installDirectory = await marketplaceInstallDirectory(configPath, services.launch.cwd);
+          const packageJsonPath = join(installDirectory, "package.json");
+          const packageLockPath = join(installDirectory, "package-lock.json");
           const packageJsonBefore = await readFile(packageJsonPath, "utf8").catch(() => undefined);
           const packageLockBefore = await readFile(packageLockPath, "utf8").catch(() => undefined);
           let profileBefore: string | undefined;
           let entryId: string | undefined;
           try {
             if (needsMarketplacePackageInstall(plugin)) {
-              await runProcess("npm", ["install", "--save-exact", "--package-lock=false", `${plugin.packageName}@${plugin.version}`], services.launch.cwd);
+              const specifier = `${marketplaceNpmPackageName(plugin.packageName)}@${plugin.version}`;
+              await runProcess("npm", ["install", "--save-exact", "--package-lock=false", specifier], installDirectory);
             }
             profileBefore = await appendMarketplaceProfile(configPath, plugin);
             if (!needsMarketplacePackageInstall(plugin)) {
@@ -1101,8 +1134,11 @@ export default {
           } catch (error) {
             if (entryId !== undefined) await loader.remove(entryId).catch(() => {});
             if (profileBefore !== undefined) await writeFile(configPath, profileBefore, "utf8").catch(() => {});
-            if (packageJsonBefore !== undefined) await writeFile(packageJsonPath, packageJsonBefore, "utf8").catch(() => {});
-            if (packageLockBefore !== undefined) await writeFile(packageLockPath, packageLockBefore, "utf8").catch(() => {});
+            // A manifest npm created for this install is removed rather than left behind; restoring is only possible when one existed before.
+            if (packageJsonBefore === undefined) await unlink(packageJsonPath).catch(() => {});
+            else await writeFile(packageJsonPath, packageJsonBefore, "utf8").catch(() => {});
+            if (packageLockBefore === undefined) await unlink(packageLockPath).catch(() => {});
+            else await writeFile(packageLockPath, packageLockBefore, "utf8").catch(() => {});
             sendJson(response, 502, { error: errorText(error) });
           }
         } catch (error) {
@@ -1198,15 +1234,17 @@ export default {
           }
           const profileEntryId = entry.options.id;
           const profileBefore = await readFile(configPath, "utf8");
-          const packageJsonPath = join(services.launch.cwd, "package.json");
-          const packageLockPath = join(services.launch.cwd, "package-lock.json");
+          const installDirectory = await marketplaceInstallDirectory(configPath, services.launch.cwd);
+          const packageJsonPath = join(installDirectory, "package.json");
+          const packageLockPath = join(installDirectory, "package-lock.json");
           const packageJsonBefore = await readFile(packageJsonPath, "utf8").catch(() => undefined);
           const packageLockBefore = await readFile(packageLockPath, "utf8").catch(() => undefined);
           await entry.parent.remove(entry.options.id);
           entry.parent.tree.write();
           try {
             await updateMarketplaceProfile(configPath, profileEntryId, { remove: true });
-            if (needsMarketplacePackageInstall(plugin)) await runProcess("npm", ["uninstall", "--package-lock=false", plugin.packageName], services.launch.cwd);
+            if (needsMarketplacePackageInstall(plugin))
+              await runProcess("npm", ["uninstall", "--package-lock=false", marketplaceNpmPackageName(plugin.packageName)], installDirectory);
             sendJson(response, 200, { uninstalled: true, id: payload.id });
           } catch (error) {
             await writeFile(configPath, profileBefore, "utf8").catch(() => {});
@@ -1309,18 +1347,20 @@ export default {
           sendJson(response, 500, { error: errorText(error) });
           return;
         }
-        const items = status.output
-          .split("\n")
-          .map((line) => line.trimEnd())
-          .filter((line) => line.length > 0)
-          .map((line) => {
-            const status = line.slice(0, 2).trim() || "??";
-            return {
-              path: line.slice(3),
-              status,
-              label: status === "??" ? "untracked" : status.includes("D") ? "deleted" : status.includes("A") ? "added" : "modified",
-            };
+        const records = status.output.split("\0");
+        const items: { path: string; status: string; label: string }[] = [];
+        for (let index = 0; index < records.length; index += 1) {
+          const record = records[index] ?? "";
+          if (record.length < 4) continue;
+          const code = record.slice(0, 2).trim() || "??";
+          // Rename and copy records carry the original path in a second NUL-terminated field, which is not a workspace change of its own.
+          if (code.startsWith("R") || code.startsWith("C")) index += 1;
+          items.push({
+            path: record.slice(3),
+            status: code,
+            label: code === "??" ? "untracked" : code.includes("D") ? "deleted" : code.includes("A") ? "added" : "modified",
           });
+        }
         sendJson(response, 200, { items, ...(status.truncated ? { truncated: true } : {}) });
       },
     });
@@ -1803,20 +1843,44 @@ export default {
             sendJson(response, 409, { error: "Cannot batch-delete the active session" });
             return;
           }
-          await mutateSessionMetadata(manager, context.logger, async (metadata) => {
+          if (action === "delete") {
+            // The unlinks run outside the metadata mutation: a failure halfway through must not discard the key removals for the files that are already gone from disk.
+            const removed: string[] = [];
+            const failed: { path: string; error: string }[] = [];
             for (const path of paths) {
-              if (action === "delete") {
+              try {
                 await unlink(path);
-                delete metadata[path];
-              } else {
-                const current = metadata[path] ?? {};
-                metadata[path] = {
-                  ...current,
-                  ...(action === "archive" || action === "unarchive" ? { archived: action === "archive" } : {}),
-                  ...(action === "pin" || action === "unpin" ? { pinned: action === "pin" } : {}),
-                };
+                removed.push(path);
+              } catch (error) {
+                // A session another tab already deleted leaves nothing to unlink, but its metadata entry still has to go.
+                if ((error as NodeJS.ErrnoException).code === "ENOENT") removed.push(path);
+                else failed.push({ path, error: errorText(error) });
               }
             }
+            await mutateSessionMetadata(manager, context.logger, (metadata) => {
+              for (const path of removed) delete metadata[path];
+            });
+            if (failed.length > 0) {
+              sendJson(response, 409, {
+                error: `Some sessions could not be deleted: ${failed.map((item) => item.path).join(", ")}`,
+                action,
+                count: removed.length,
+                failed,
+              });
+              return;
+            }
+            sendJson(response, 200, { action, count: removed.length });
+            return;
+          }
+          await mutateSessionMetadata(manager, context.logger, (metadata) => {
+            for (const path of paths) {
+              const current = metadata[path] ?? {};
+              metadata[path] = {
+                ...current,
+                ...(action === "archive" || action === "unarchive" ? { archived: action === "archive" } : {}),
+                ...(action === "pin" || action === "unpin" ? { pinned: action === "pin" } : {}),
+              };
+            }
           });
           sendJson(response, 200, { action, count: paths.length });
         } catch (error) {

package/packages/api-gateway/src/marketplace-entries/official/agent-teams.json

@@ -1,7 +1,7 @@
 {
   "id": "agent-teams",
   "packageName": "@pi-harness/core/plugins/agent-teams",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "name": "Agent Team Board",
   "description": "Maintain a bounded, session-local collaboration ledger of named roles, dependency-aware tasks, and mailbox notes without spawning agents or sending external messages.",
   "author": "Pi Harness",

package/packages/api-gateway/src/marketplace-entries/official/anchored-standard.json

@@ -1,7 +1,7 @@
 {
   "id": "anchored-standard",
   "packageName": "@pi-harness/core/plugins/anchored-standard",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "name": "Anchored Standard",
   "description": "Audit agent trajectories against an explicit tool-call allowlist and flag activity outside the anchored run.",
   "author": "Pi Harness",

package/packages/api-gateway/src/marketplace-entries/official/annotation.json

@@ -1,7 +1,7 @@
 {
   "id": "annotation",
   "packageName": "@pi-harness/core/plugins/annotation",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "name": "Annotations",
   "description": "Capture bounded selections and notes from the conversation for later agent context.",
   "author": "Pi Harness",

package/packages/api-gateway/src/marketplace-entries/official/archify.json

@@ -1,7 +1,7 @@
 {
   "id": "archify",
   "packageName": "@pi-harness/core/plugins/archify",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "name": "Architecture Map",
   "description": "Build a bounded, read-only architecture map from workspace components and package dependencies.",
   "author": "Pi Harness",

package/packages/api-gateway/src/marketplace-entries/official/at-file.json

@@ -1,7 +1,7 @@
 {
   "id": "at-file",
   "packageName": "@pi-harness/core/plugins/at-file",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "name": "@file Context",
   "description": "Attach a bounded 256 KiB strict UTF-8 workspace file using canonical workspace path confinement and no-follow regular-file reads, framing it as offline, read-only, untrusted model context with closing-tag neutralization and cancellable sequential execution.",
   "author": "Pi Harness",

package/packages/api-gateway/src/marketplace-entries/official/auto-mode.json

@@ -1,7 +1,7 @@
 {
   "id": "auto-mode",
   "packageName": "@pi-harness/core/plugins/auto-mode",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "name": "Auto Mode",
   "description": "Execute argv commands under a safe policy that blocks shell wrappers and requires confirmation for risky operations.",
   "author": "Pi Harness",

package/packages/api-gateway/src/marketplace-entries/official/better-sidebar.json

@@ -1,7 +1,7 @@
 {
   "id": "better-sidebar",
   "packageName": "@pi-harness/core/plugins/better-sidebar",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "name": "Better Sidebar",
   "description": "Show a compact workspace, Git, and session overview beside the conversation without modifying files.",
   "author": "Pi Harness",

package/packages/api-gateway/src/marketplace-entries/official/browser-fetch.json

@@ -1,7 +1,7 @@
 {
   "id": "browser-fetch",
   "packageName": "@pi-harness/core/plugins/browser-fetch",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "name": "Browser Fetch",
   "description": "Fetch public HTTP and HTTPS pages as bounded text with descriptor-safe inputs, DNS pinning, per-redirect private-network validation, textual MIME enforcement, cancellation, a whole-request timeout, and validated fail-closed panel reporting.",
   "author": "Pi Harness",

package/packages/api-gateway/src/marketplace-entries/official/browser-session.json

@@ -1,7 +1,7 @@
 {
   "id": "browser-session",
   "packageName": "@pi-harness/core/plugins/browser-session",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "name": "Browser Session",
   "description": "Control a loopback-only Chrome DevTools session with descriptor-safe commands, bounded discovery, cancellable operations, screenshot metadata protection, and validated fail-closed panel previews.",
   "author": "Pi Harness",

package/packages/api-gateway/src/marketplace-entries/official/canvas-draw.json

@@ -1,7 +1,7 @@
 {
   "id": "canvas-draw",
   "packageName": "@pi-harness/core/plugins/canvas-draw",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "name": "Canvas Draw",
   "description": "Generate validated, bounded Mermaid flowchart source from structured nodes and edges in the workspace UI.",
   "author": "Pi Harness",

package/packages/api-gateway/src/marketplace-entries/official/change-verifier.json

@@ -1,7 +1,7 @@
 {
   "id": "change-verifier",
   "packageName": "@pi-harness/core/plugins/change-verifier",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "name": "Change Verifier",
   "description": "Combine project tests and Git change review into one explicit verification gate before handoff.",
   "author": "Pi Harness",

package/packages/api-gateway/src/marketplace-entries/official/cleaner.json

@@ -1,7 +1,7 @@
 {
   "id": "cleaner",
   "packageName": "@pi-harness/core/plugins/cleaner",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "name": "Cleaner",
   "description": "Strict descriptor-safe configuration and parameters, display-safe bounded Pi Harness Git capsule inventory, removal with explicit confirmation and retention controls, symlink and replacement defenses, cancellable serialization, and a fail-closed normalized panel.",
   "author": "Pi Harness",

package/packages/api-gateway/src/marketplace-entries/official/cli-notifier.json

@@ -1,7 +1,7 @@
 {
   "id": "cli-notifier",
   "packageName": "@pi-harness/core/plugins/cli-notifier",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "name": "CLI Notifier",
   "description": "Send local desktop notifications when an agent turn completes, fails, or is aborted, and when context compaction fails.",
   "author": "Pi Harness",

package/packages/api-gateway/src/marketplace-entries/official/code2skill.json

@@ -1,7 +1,7 @@
 {
   "id": "code2skill",
   "packageName": "@pi-harness/core/plugins/code2skill",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "name": "Code2Skill",
   "description": "Package selected workspace source files into a bounded local Pi skill with a generated SKILL.md manifest and preserved references.",
   "author": "Pi Harness",

package/packages/api-gateway/src/marketplace-entries/official/colleague-skill.json

@@ -1,7 +1,7 @@
 {
   "id": "colleague-skill",
   "packageName": "@pi-harness/core/plugins/colleague-skill",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "name": "Colleague Skill",
   "description": "Create durable, structured handoff packets for another role without hidden agents or external message delivery.",
   "author": "Pi Harness",

package/packages/api-gateway/src/marketplace-entries/official/context-doctor.json

@@ -1,7 +1,7 @@
 {
   "id": "context-doctor",
   "packageName": "@pi-harness/core/plugins/context-doctor",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "name": "Context Doctor",
   "description": "Descriptor-safe bounded context audits detect pressure, oversized or uninspectable messages, and tool errors. Compaction requests are queued until the agent has settled; confirmed model-backed compaction may incur cost and provides cancellable waits with dedicated cancellation.",
   "author": "Pi Harness",

package/packages/api-gateway/src/marketplace-entries/official/context.json

@@ -1,7 +1,7 @@
 {
   "id": "context-insights",
   "packageName": "@pi-harness/core/plugins/context",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "name": "Context Insights",
   "description": "Inspect context usage and descriptor-safe bounded message composition with cached active-session lifecycle counters and a fixed-limit normalized browser panel.",
   "author": "Pi Harness",

package/packages/api-gateway/src/marketplace-entries/official/cost-meter.json

@@ -1,7 +1,7 @@
 {
   "id": "cost-meter",
   "packageName": "@pi-harness/core/plugins/cost-meter",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "name": "Cost Meter",
   "description": "Track runtime-reported costs as UTC daily increments in a bounded local ledger, with session snapshots and optional daily budget monitoring; no model prices are guessed.",
   "author": "Pi Harness",

package/packages/api-gateway/src/marketplace-entries/official/dependency-checker.json

@@ -1,7 +1,7 @@
 {
   "id": "dependency-checker",
   "packageName": "@pi-harness/core/plugins/dependency-checker",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "name": "Dependency Checker",
   "description": "Run a bounded, offline, read-only check of workspace package.json and requirements*.txt manifests for local package presence, duplicate declaration consistency, unresolved constraints, and unsupported Python directives.",
   "author": "Pi Harness",

package/packages/api-gateway/src/marketplace-entries/official/docker-sandbox.json

@@ -1,7 +1,7 @@
 {
   "id": "docker-sandbox",
   "packageName": "@pi-harness/core/plugins/docker-sandbox",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "name": "Docker Sandbox",
   "description": "Run descriptor-safe argv commands with local-only Docker images, no container network, a read-only workspace by default, fixed CPU, memory, and PID limits, sanitized output, strict panel reporting, and cancellation cleanup.",
   "author": "Pi Harness",

package/packages/api-gateway/src/marketplace-entries/official/fail-logger.json

@@ -1,7 +1,7 @@
 {
   "id": "fail-logger",
   "packageName": "@pi-harness/core/plugins/fail-logger",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "name": "Failure Logger",
   "description": "Aggregate bounded extension, Agent, and non-aborted compaction failures through descriptor-safe event inspection, safe diagnostic summaries, and occurrence counts without retaining full payloads.",
   "author": "Pi Harness",

package/packages/api-gateway/src/marketplace-entries/official/genui.json

@@ -1,7 +1,7 @@
 {
   "id": "genui",
   "packageName": "@pi-harness/core/plugins/genui",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "name": "GenUI",
   "description": "Render bounded structured cards with text, badge, and decimal progress blocks while displaying HTML and scripts as plain text.",
   "author": "Pi Harness",

package/packages/api-gateway/src/marketplace-entries/official/git-time-capsule.json

@@ -1,7 +1,7 @@
 {
   "id": "git-time-capsule",
   "packageName": "@pi-harness/core/plugins/git-time-capsule",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "name": "Git Time Capsule",
   "description": "Capture the current unstaged tracked Git diff as a byte-exact, validated undo capsule without external diff or textconv helpers, then reverse-apply it only after explicit confirmation.",
   "author": "Pi Harness",

package/packages/api-gateway/src/marketplace-entries/official/graph-memory.json

@@ -1,7 +1,7 @@
 {
   "id": "graph-memory",
   "packageName": "@pi-harness/core/plugins/graph-memory",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "name": "Graph Memory",
   "description": "Store bounded typed task, skill, and event nodes with validated directed relations, atomic locked persistence, and inspectable cross-session search.",
   "author": "Pi Harness",

package/packages/api-gateway/src/marketplace-entries/official/history-compressor.json

@@ -1,7 +1,7 @@
 {
   "id": "history-compressor",
   "packageName": "@pi-harness/core/plugins/history-compressor",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "name": "History Compressor",
   "description": "Compact the current Pi session automatically when context usage approaches a configured threshold.",
   "author": "Pi Harness",

package/packages/api-gateway/src/marketplace-entries/official/hol-guard.json

@@ -1,7 +1,7 @@
 {
   "id": "hol-guard",
   "packageName": "@pi-harness/core/plugins/hol-guard",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "name": "HOL Guard",
   "description": "Audit tool arguments and preflight text for destructive commands, sensitive paths, credentials, and remote exfiltration. Advisory only: reports risk, does not block execution.",
   "author": "Pi Harness",

package/packages/api-gateway/src/marketplace-entries/official/i18n-pair.json

@@ -1,7 +1,7 @@
 {
   "id": "i18n-pair",
   "packageName": "@pi-harness/core/plugins/i18n-pair",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "name": "I18n Pair",
   "description": "Strict read-only comparison of bounded JSON locale files from no-follow workspace paths, with collision-safe missing and extra keys, stable failures, cancellation, and validated panel status.",
   "author": "Pi Harness",

package/packages/api-gateway/src/marketplace-entries/official/image-compressor.json

@@ -1,7 +1,7 @@
 {
   "id": "image-compressor",
   "packageName": "@pi-harness/core/plugins/image-compressor",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "name": "Image Compressor",
   "description": "Create bounded image copies for model context while preserving the original file and reporting saved bytes.",
   "author": "Pi Harness",

package/packages/api-gateway/src/marketplace-entries/official/llm-verifier.json

@@ -1,7 +1,7 @@
 {
   "id": "llm-verifier",
   "packageName": "@pi-harness/core/plugins/llm-verifier",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "name": "LLM Verifier",
   "description": "Ask a configured verifier model to judge a claim against bounded, untrusted evidence.",
   "author": "Pi Harness",

package/packages/api-gateway/src/marketplace-entries/official/mcp-client.json

@@ -1,7 +1,7 @@
 {
   "id": "mcp-client",
   "packageName": "@pi-harness/core/plugins/mcp-client",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "name": "MCP Client",
   "description": "Connect to direct-argv MCP stdio servers with bounded pagination and protocol validation, tool, resource, and prompt bridging, cancellable queued requests, and lifecycle-owned process cleanup.",
   "author": "Pi Harness",

package/packages/api-gateway/src/marketplace-entries/official/mcp-panel.json

@@ -1,7 +1,7 @@
 {
   "id": "mcp-panel",
   "packageName": "@pi-harness/core/plugins/mcp-panel",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "name": "MCP Panel",
   "description": "Inspect MCP server health and tools, preview profile patches, and apply changes only with an explicit confirmation and backup.",
   "author": "Pi Harness",

package/packages/api-gateway/src/marketplace-entries/official/memory.json

@@ -1,7 +1,7 @@
 {
   "id": "memory",
   "packageName": "@pi-harness/core/plugins/memory",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "name": "Memory",
   "description": "Persist bounded cross-session notes with explicit recall and update operations.",
   "author": "Pi Harness",

package/packages/api-gateway/src/marketplace-entries/official/mirage-bridge.json

@@ -1,7 +1,7 @@
 {
   "id": "mirage-bridge",
   "packageName": "@pi-harness/core/plugins/mirage-bridge",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "name": "Mirage Bridge",
   "description": "Connect Pi Harness to the official Mirage virtual-terminal CLI without adding a second host shell.",
   "author": "Pi Harness",

package/packages/api-gateway/src/marketplace-entries/official/mock-server.json

@@ -1,7 +1,7 @@
 {
   "id": "mock-server",
   "packageName": "@pi-harness/core/plugins/mock-server",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "name": "Mock Server",
   "description": "Start a local, bounded HTTP mock server from explicit routes for integration testing without external services.",
   "author": "Pi Harness",

package/packages/api-gateway/src/marketplace-entries/official/modlens.json

@@ -1,7 +1,7 @@
 {
   "id": "modlens",
   "packageName": "@pi-harness/core/plugins/modlens",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "name": "ModLens Vision Bridge",
   "description": "Send bounded workspace images to native vision models or return schema-validated evidence from the bundled ModLens engine for text-only models.",
   "author": "Pi Harness",