pi-harness-runtime 0.10.13 → 0.10.15

package/packages/config-capture/src/index.js

@@ -0,0 +1,268 @@
+/**
+ * Config Capture Extension
+ *
+ * Automatically detects API responses containing constant configuration values
+ * (DNS records, routes, feature flags, etc.) and logs a suggestion to document
+ * them to AGENTS.md.
+ *
+ * Pattern: Like todo-bd-sync, this listens to tool execution end events
+ * and logs when constant config is detected. The agent decides whether to
+ * document based on context.
+ *
+ * Usage:
+ *   import { registerConfigCapture } from "@moocoding/config-capture";
+ *   registerConfigCapture(pi);
+ */
+// ─── Config Type Detection ────────────────────────────────────────────────────
+const DNS_PATTERNS = [
+    "zone_id",
+    "zoneId",
+    "dns_record",
+    "dns-record",
+    "cloudflare",
+    "name_servers",
+    "@",
+    "ttl",
+    "proxied",
+    "record_type",
+    " a ",
+    "aaaa",
+    "cname",
+    "txt",
+    "mx",
+    "ns",
+    "spf",
+];
+const ROUTE_PATTERNS = [
+    "routes",
+    "endpoints",
+    "api_routes",
+    "api_rout",
+    "path",
+    "method",
+    " get ",
+    " post ",
+    " put ",
+    " delete ",
+    " patch ",
+    "/api/",
+    "route_path",
+];
+const FEATURE_FLAG_PATTERNS = [
+    "feature_flags",
+    "feature-flags",
+    "feature_toggle",
+    "feature-toggle",
+    "enabled",
+    "disabled",
+    "rollout",
+    "variants",
+];
+const INTEGRATION_PATTERNS = [
+    "integration_id",
+    "integrationId",
+    "webhook_url",
+    "webhookUrl",
+    "webhook_id",
+    "redirect_url",
+    "account_id",
+    "project_id",
+];
+// ─── Detection Logic ─────────────────────────────────────────────────────────
+/**
+ * Detect if a tool result contains constant configuration data
+ */
+export function detectConfig(result) {
+    if (!result || typeof result !== "object") {
+        return { detected: false, configType: null, confidence: "low" };
+    }
+    const resultStr = JSON.stringify(result).toLowerCase();
+    const scores = [
+        { type: "dns_records", score: countMatches(resultStr, DNS_PATTERNS) },
+        { type: "routes", score: countMatches(resultStr, ROUTE_PATTERNS) },
+        { type: "feature_flags", score: countMatches(resultStr, FEATURE_FLAG_PATTERNS) },
+        { type: "integration_ids", score: countMatches(resultStr, INTEGRATION_PATTERNS) },
+    ];
+    // Sort by score descending
+    scores.sort((a, b) => b.score - a.score);
+    const best = scores[0];
+    if (best.score < 2) {
+        return { detected: false, configType: null, confidence: "low" };
+    }
+    // Check for array of objects (typical config structure)
+    const hasArrayOfObjects = detectArrayOfObjects(result);
+    let confidence = "low";
+    if (best.score >= 4 || (best.score >= 2 && hasArrayOfObjects)) {
+        confidence = "high";
+    }
+    else if (best.score >= 2) {
+        confidence = "medium";
+    }
+    // Extract sample data for logging
+    const sampleData = extractSampleData(result, best.type);
+    return {
+        detected: true,
+        configType: best.type,
+        confidence,
+        sampleData,
+    };
+}
+function countMatches(text, patterns) {
+    return patterns.filter((p) => text.includes(p.toLowerCase())).length;
+}
+function detectArrayOfObjects(result) {
+    if (Array.isArray(result)) {
+        return result.some((item) => typeof item === "object" && item !== null);
+    }
+    if (typeof result === "object" && result !== null) {
+        const values = Object.values(result);
+        return values.some((v) => Array.isArray(v) && v.length > 0 && typeof v[0] === "object");
+    }
+    return false;
+}
+function extractSampleData(result, _type) {
+    if (!Array.isArray(result) || result.length === 0)
+        return undefined;
+    const sample = result[0];
+    if (typeof sample !== "object" || sample === null)
+        return undefined;
+    const entries = Object.entries(sample).slice(0, 5);
+    if (entries.length === 0)
+        return undefined;
+    const lines = entries.map(([k, v]) => `${k}: ${JSON.stringify(v)}`);
+    return lines.join(", ");
+}
+// ─── Privacy Filter ────────────────────────────────────────────────────────────
+const SENSITIVE_PATTERNS = [
+    "token",
+    "secret",
+    "password",
+    "key",
+    "credential",
+    "auth",
+    "api_key",
+    "apiKey",
+    "bearer",
+    "authorization",
+    "private_",
+    "private-",
+];
+/**
+ * Check if a field name is sensitive (should not be documented)
+ */
+export function isSensitiveField(fieldName) {
+    const lower = fieldName.toLowerCase();
+    return SENSITIVE_PATTERNS.some((p) => lower.includes(p));
+}
+/**
+ * Remove sensitive fields from a config object
+ */
+export function removeSensitiveFields(config) {
+    const sanitized = {};
+    for (const [key, value] of Object.entries(config)) {
+        if (!isSensitiveField(key)) {
+            sanitized[key] = value;
+        }
+    }
+    return sanitized;
+}
+/**
+ * Format detected config for AGENTS.md
+ */
+export function formatForAgentsMd(detection, sampleData) {
+    const lines = [];
+    switch (detection.configType) {
+        case "dns_records":
+            lines.push("### DNS Records");
+            lines.push("");
+            lines.push("| Name | Type | Content | Notes |");
+            lines.push("|------|------|---------|-------|");
+            lines.push("| ... | ... | ... | ... |");
+            lines.push("");
+            lines.push("*Source: Auto-captured from API*");
+            break;
+        case "routes":
+            lines.push("### API Routes");
+            lines.push("");
+            lines.push("- `GET /api/resource` - Description");
+            lines.push("- `POST /api/resource` - Create");
+            lines.push("");
+            lines.push("*Source: Auto-captured from API*");
+            break;
+        case "feature_flags":
+            lines.push("### Feature Flags");
+            lines.push("");
+            lines.push("| Flag | Enabled | Notes |");
+            lines.push("|------|---------|-------|");
+            lines.push("| flag_name | true/false | ... |");
+            lines.push("");
+            lines.push("*Source: Auto-captured from API*");
+            break;
+        default:
+            lines.push("### Configuration");
+            lines.push("");
+            if (sampleData) {
+                lines.push("```");
+                lines.push(sampleData);
+                lines.push("```");
+            }
+            lines.push("");
+            lines.push("*Source: Auto-captured from API*");
+    }
+    return lines.join("\n");
+}
+const DEFAULT_CONFIG = {
+    debug: false,
+    minConfidence: "medium",
+};
+/**
+ * Register the config-capture extension
+ */
+export function registerConfigCapture(pi, config = {}) {
+    const cfg = { ...DEFAULT_CONFIG, ...config };
+    // Track if we've already suggested documenting this config in this session
+    const documentedConfigs = new Set();
+    // Listen to tool execution end
+    pi.on("tool_execution_end", (event) => {
+        // Skip errors
+        if (event.isError)
+            return;
+        // Skip non-API tools (focus on bash/curl/http calls)
+        const apiTools = ["bash", "http_request", "fetch", "curl"];
+        if (!apiTools.includes(event.toolName))
+            return;
+        // Detect config in result
+        const detection = detectConfig(event.result);
+        if (!detection.detected)
+            return;
+        // Check confidence threshold
+        const confidenceLevels = { low: 0, medium: 1, high: 2 };
+        const minLevel = confidenceLevels[cfg.minConfidence];
+        const currentLevel = confidenceLevels[detection.confidence];
+        if (currentLevel < minLevel)
+            return;
+        // Create a unique key for this config type + rough content hash
+        const contentStr = JSON.stringify(event.result).slice(0, 100);
+        const configKey = `${detection.configType}-${contentStr}`;
+        // Skip if already suggested in this session
+        if (documentedConfigs.has(configKey))
+            return;
+        // Log detection
+        if (cfg.debug) {
+            console.log(`[config-capture] Detected ${detection.configType} (${detection.confidence})`);
+            console.log(`[config-capture] Sample: ${detection.sampleData}`);
+        }
+        // Mark as documented
+        documentedConfigs.add(configKey);
+        // Log the suggestion - agent will notice this
+        console.log(`[config-capture] Config detected: ${detection.configType}`);
+        console.log(`[config-capture] Confidence: ${detection.confidence}`);
+        console.log(`[config-capture] Sample: ${detection.sampleData?.slice(0, 200)}`);
+        // Suggest action
+        const actionMsg = `[config-capture] Consider documenting this to AGENTS.md section "Discovered Configuration"`;
+        console.log(actionMsg);
+    });
+    console.log("[config-capture] Started - detecting API config responses");
+}
+// Default export
+export default registerConfigCapture;

package/packages/cookie-sanitizer/src/atomic-write.js

@@ -0,0 +1,66 @@
+/**
+ * Atomic file write — write to temp, fsync, then rename.
+ *
+ * POSIX `rename(2)` is atomic — on partial-write crash, the prior target
+ * file remains valid. We pair this with `fsync(tempfile)` so the temp
+ * file's data is durable on disk before the rename.
+ *
+ * Permissions: `0o600` (owner R/W only) to keep the canonical cache
+ * owner-readable.
+ *
+ * Sec-001: Cookie values go into the file content. The caller is
+ * responsible for value-handling hygiene; this module just writes
+ * bytes. We do not log the content.
+ */
+import { mkdirSync, openSync, writeSync, fsyncSync, closeSync, renameSync, chmodSync, } from "node:fs";
+import { dirname, join } from "node:path";
+import { randomBytes } from "node:crypto";
+/**
+ * Atomically write `content` to `finalPath`.
+ *
+ * Steps:
+ *   1. mkdir -p the parent directory
+ *   2. write to <finalPath>.tmp.<rand>  with mode 0o600
+ *   3. fsync the temp file
+ *   4. rename temp → final  (atomic on POSIX)
+ *   5. chmod final to 0o600  (in case rename preserved looser perms)
+ *
+ * Throws if any step fails. The original `finalPath` is unchanged
+ * until step 4 succeeds.
+ */
+export function atomicWriteFileSync(finalPath, content) {
+    mkdirSync(dirname(finalPath), { recursive: true });
+    const rand = randomBytes(6).toString("hex");
+    const tempPath = `${finalPath}.tmp.${rand}`;
+    let fd;
+    try {
+        fd = openSync(tempPath, "w", 0o600);
+        writeSync(fd, Buffer.from(content, "utf8"));
+        fsyncSync(fd);
+    }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+    }
+    renameSync(tempPath, finalPath);
+    // Belt-and-braces in case rename preserved a looser mode from an
+    // existing file on some systems.
+    try {
+        chmodSync(finalPath, 0o600);
+    }
+    catch {
+        // Filesystems that don't support chmod (e.g. FAT32) are not a
+        // target platform here — drop the error silently.
+    }
+}
+/**
+ * Compute the default cache path for a given provider, e.g.:
+ *   defaultCachePathFor("minimax") → "~/.config/minimax-cookies.txt"
+ *
+ * The home directory is read via `process.env.HOME` so tests can
+ * override it.
+ */
+export function defaultCachePathFor(provider) {
+    const home = process.env.HOME ?? "/tmp";
+    return join(home, ".config", `${provider}-cookies.txt`);
+}

package/packages/cookie-sanitizer/src/detect-format.js

@@ -0,0 +1,87 @@
+/**
+ * Format detection — does the input look like Netscape or EditThisCookie JSON?
+ *
+ * Detection rule:
+ *  - File extension `.json` AND first non-blank byte is `[` or `{`  →  JSON
+ *  - File content has `# Netscape HTTP Cookie File` header OR
+ *    ≥ 1 tab-separated 7-column row                              →  Netscape
+ *  - Otherwise                                                    →  unknown
+ *
+ * Cookie VALUES are never copied into return values that get logged.
+ * Only the basename and a 64-char prefix of the first non-blank line.
+ */
+import { basename } from "node:path";
+const HEADER_RE = /^# Netscape HTTP Cookie File/im;
+const MIN_TAB_COLS = 7;
+/**
+ * Returns the basename only, never a path that could leak directory
+ * structure. Safe to log.
+ */
+export function safeBasename(filePath) {
+    return basename(filePath);
+}
+/**
+ * Safely truncated preview of a file's content (for diagnostics).
+ * Strips cookie values to avoid leaking secrets.
+ *
+ * Heuristic: any line that has a tab-separated name=value pair,
+ * replace the value column with `<redacted>`.
+ */
+export function safePreview(text, maxChars = 64) {
+    const firstLine = text
+        .split("\n")
+        .map((l) => l.trim())
+        .find((l) => l.length > 0) ?? "";
+    const redacted = firstLine
+        .split("\t")
+        .map((col, i) => (i >= 5 ? "<redacted>" : col))
+        .join("\t");
+    return redacted.length > maxChars
+        ? `${redacted.slice(0, maxChars)}…`
+        : redacted;
+}
+/**
+ * Detect the format of cookie file text.
+ */
+export function detectFormat(text) {
+    if (typeof text !== "string" || text.length === 0)
+        return null;
+    const trimmed = text.trimStart();
+    const firstByte = trimmed[0];
+    // JSON heuristic — array or object at the top.
+    if (firstByte === "[" || firstByte === "{") {
+        return "edit-this-cookie-json";
+    }
+    // Netscape heuristic — header OR a tab-separated 7-column row.
+    if (HEADER_RE.test(text)) {
+        return "netscape";
+    }
+    const lines = text.split(/\r?\n/);
+    for (const line of lines) {
+        if (!line || (line.startsWith("#") && !line.startsWith("#HttpOnly_"))) {
+            continue;
+        }
+        const trimmedLine = line.startsWith("#HttpOnly_")
+            ? line.slice("#HttpOnly_".length)
+            : line;
+        const cols = trimmedLine.split("\t");
+        if (cols.length >= MIN_TAB_COLS) {
+            return "netscape";
+        }
+    }
+    return null;
+}
+/**
+ * Build a DetectedFile from a path and its text contents.
+ * Used by sync.ts after reading the file from disk.
+ */
+export function buildDetectedFile(filePath, text) {
+    const format = detectFormat(text);
+    return {
+        path: filePath,
+        basename: safeBasename(filePath),
+        format,
+        text,
+        // No error if format is null — unknown format is a normal case.
+    };
+}

package/packages/cookie-sanitizer/src/index.js

@@ -0,0 +1,38 @@
+/**
+ * Cookie Sanitizer — public API.
+ *
+ * Forgiving input → strict canonical cache for downstream consumers
+ * (e.g. MiniMaxQuotaScraper reads only `~/.config/minimax-cookies.txt`).
+ *
+ * The package is provider-agnostic but currently shipping with:
+ *   - filename hints: minimax, anthropic, openai, glm, openrouter
+ *   - domain hints : the matching provider domains
+ *
+ * Inputs accepted (auto-detected per file):
+ *   - Netscape HTTP Cookie File
+ *   - EditThisCookie / Chrome devtools JSON export
+ *
+ * @example
+ * ```typescript
+ * import { sync, hasAnyCookieSource, CookieWatcher } from "@pi-harness/cookie-sanitizer";
+ *
+ * // One-shot sync.
+ * const result = sync();
+ * console.log(result.provider, result.cachePath, result.totalCookies);
+ *
+ * // Live updates.
+ * const watcher = new CookieWatcher({
+ *   dropDir: "~/.pi-harness-runtime/cookies",
+ *   onEvent: (e) => console.log(e),
+ * });
+ * watcher.start();
+ * ```
+ */
+export { sync, hasAnyCookieSource, inferCachePath, enumerateDropFiles, readInputFile, DEFAULT_DROP_DIR, } from "./sync.js";
+export { parseNetscape, serializeNetscape, } from "./parse-netscape.js";
+export { parseEditThisCookieJson } from "./parse-json.js";
+export { inferProvider, inferProviderFromFilename, inferProviderFromCookies, knownProviders, } from "./infer-provider.js";
+export { normalize, domainMatchesProvider, isExpired, } from "./normalize.js";
+export { detectFormat, buildDetectedFile, safeBasename, safePreview, } from "./detect-format.js";
+export { atomicWriteFileSync, defaultCachePathFor, } from "./atomic-write.js";
+export { CookieWatcher, createWatcher, defaultDropDir, } from "./watcher.js";

package/packages/cookie-sanitizer/src/infer-provider.js

@@ -0,0 +1,95 @@
+/**
+ * Provider inference — figure out which provider a cookie dump belongs to
+ * without the user having to organize by subfolder.
+ *
+ * Three inference passes, first hit wins:
+ *   1. Filename hint    (e.g. `minimax-*.txt`, `*minimax.json` → "minimax")
+ *   2. Dominant domain  (≥ 80% of cookies on `*.minimax.io` → "minimax")
+ *   3. Nothing           → null (caller will surface a friendly error)
+ *
+ * Provider hint from SyncOptions overrides all of the above.
+ */
+const FILENAME_HINTS = [
+    { pattern: /minimax/i, provider: "minimax" },
+    { pattern: /anthropic|claude/i, provider: "anthropic" },
+    { pattern: /openai|gpt|chatgpt/i, provider: "openai" },
+    { pattern: /glm|z\.ai|zhipuai/i, provider: "glm" },
+    { pattern: /openrouter/i, provider: "openrouter" },
+];
+const DOMAIN_HINTS = [
+    { pattern: /\.minimax\.io$|^minimax\.io$/i, provider: "minimax" },
+    { pattern: /\.anthropic\.com$|^anthropic\.com$/i, provider: "anthropic" },
+    {
+        pattern: /\.openai\.com$|^openai\.com$|\.chatgpt\.com$|^chatgpt\.com$/i,
+        provider: "openai",
+    },
+    {
+        pattern: /\.z\.ai$|^z\.ai$|\.zhipuai\.cn$|^zhipuai\.cn$/i,
+        provider: "glm",
+    },
+    { pattern: /\.openrouter\.ai$|^openrouter\.ai$/i, provider: "openrouter" },
+];
+/** Returns the first provider whose filename pattern matches, or null. */
+export function inferProviderFromFilename(filename) {
+    if (!filename)
+        return null;
+    for (const { pattern, provider } of FILENAME_HINTS) {
+        if (pattern.test(filename))
+            return provider;
+    }
+    return null;
+}
+/** Returns the provider whose domain is the dominant (≥ 80%) match. */
+export function inferProviderFromCookies(cookies) {
+    if (!Array.isArray(cookies) || cookies.length === 0)
+        return null;
+    const counts = new Map();
+    let total = 0;
+    for (const c of cookies) {
+        if (!c.domain)
+            continue;
+        total += 1;
+        for (const { pattern, provider } of DOMAIN_HINTS) {
+            if (pattern.test(c.domain.toLowerCase())) {
+                counts.set(provider, (counts.get(provider) ?? 0) + 1);
+                break;
+            }
+        }
+    }
+    if (total === 0)
+        return null;
+    const threshold = Math.ceil(total * 0.8); // ≥ 80 %
+    let best = null;
+    for (const [provider, count] of counts) {
+        if (count >= threshold && (!best || count > best.count)) {
+            best = { provider, count };
+        }
+    }
+    return best?.provider ?? null;
+}
+/**
+ * Combined inference: hint → filename → dominant domain → null.
+ *
+ * If `filename` is provided it takes priority over domain inference
+ * (filename hints are explicit). Domain inference is the fallback.
+ */
+export function inferProvider(filename, cookies, hint) {
+    if (hint)
+        return hint;
+    if (filename) {
+        const fromName = inferProviderFromFilename(filename);
+        if (fromName)
+            return fromName;
+    }
+    return inferProviderFromCookies(cookies);
+}
+/**
+ * Build a list of provider rules used by other parts of the package.
+ * Exposed for UI display (e.g. "which providers does this sanitizer know?").
+ */
+export function knownProviders() {
+    const set = new Set();
+    for (const { provider } of FILENAME_HINTS)
+        set.add(provider);
+    return Array.from(set);
+}

package/packages/cookie-sanitizer/src/normalize.js

@@ -0,0 +1,74 @@
+/**
+ * Normalize step — dedupe, drop invalid/expired, set provider.
+ *
+ * Rules (applied in order):
+ *  1. Drop cookies with empty `name` or `value`.
+ *  2. Drop cookies whose domain doesn't match the inferred provider.
+ *  3. Drop expired cookies (expires in the past, not session).
+ *  4. Dedupe by `(domain, name)` — keep the LAST entry (most recent wins).
+ *  5. Mark each surviving cookie with the provider id.
+ *
+ * SEC-001: Cookie values are not touched here, but never logged.
+ */
+/** Returns true if the cookie's domain matches the given provider's domain scope. */
+export function domainMatchesProvider(domain, provider) {
+    if (!domain)
+        return false;
+    const d = domain.toLowerCase();
+    switch (provider) {
+        case "minimax":
+            return d === "minimax.io" || d.endsWith(".minimax.io");
+        case "anthropic":
+            return d === "anthropic.com" || d.endsWith(".anthropic.com");
+        case "openai":
+            return (d === "openai.com" ||
+                d.endsWith(".openai.com") ||
+                d === "chatgpt.com" ||
+                d.endsWith(".chatgpt.com"));
+        case "glm":
+            return (d === "z.ai" ||
+                d.endsWith(".z.ai") ||
+                d === "zhipuai.cn" ||
+                d.endsWith(".zhipuai.cn"));
+        case "openrouter":
+            return d === "openrouter.ai" || d.endsWith(".openrouter.ai");
+        default:
+            // Unknown provider — accept all and let downstream reject.
+            return true;
+    }
+}
+/** Returns true if the cookie is expired (in the past). Session cookies never expire. */
+export function isExpired(cookie, nowSec = Math.floor(Date.now() / 1000)) {
+    if (cookie.expires == null)
+        return false; // session cookie
+    if (cookie.expires <= 0)
+        return false; // 0 = session in Netscape
+    return cookie.expires < nowSec;
+}
+/**
+ * Normalize the union of all parsed cookies.
+ *
+ * @param cookies     Raw cookies from all parsed files
+ * @param provider    Inferred (or hinted) provider; used for domain filtering and tagging
+ * @param nowSec      Override for the current Unix seconds (test seam)
+ */
+export function normalize(cookies, provider, nowSec = Math.floor(Date.now() / 1000)) {
+    if (!Array.isArray(cookies) || cookies.length === 0)
+        return [];
+    const dedup = new Map();
+    for (const c of cookies) {
+        // Rule 1: empty fields.
+        if (!c.name || !c.value)
+            continue;
+        // Rule 2: domain must match provider (skip for unknown provider).
+        if (provider && !domainMatchesProvider(c.domain, provider))
+            continue;
+        // Rule 3: expired.
+        if (isExpired(c, nowSec))
+            continue;
+        // Rule 4 + 5: dedupe by (domain, name); last wins. Tag with provider.
+        const key = `${c.domain}::${c.name}`;
+        dedup.set(key, { ...c, provider });
+    }
+    return Array.from(dedup.values());
+}