pi-harness-runtime 0.9.7 → 0.9.11

package/packages/codex-adapter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/codex-adapter",
-  "version": "0.9.6",
+  "version": "0.9.11",
   "type": "module",
   "description": "OpenAI Codex provider adapter for pi-harness",
   "main": "dist/index.js",

package/packages/context-compiler/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/context-compiler",
-  "version": "0.9.6",
+  "version": "0.9.11",
   "description": "Bounded context selection engine for pi-harness-runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/context-manager/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/context-manager",
-  "version": "0.9.6",
+  "version": "0.9.11",
   "description": "Context Window Manager — prevents model context overflow via compaction and resume prompts (RFC-0010)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/cookie-sanitizer/README.md

@@ -0,0 +1,141 @@
+# @pi-harness/cookie-sanitizer
+
+> Forgiving input → strict canonical cache for provider-quota mirroring.
+
+A normalization boundary that lets users drop **any** cookie file (any name, any format) into a known folder, and turns it into a single standard Netscape file the rest of the runtime can rely on.
+
+```
+~/.pi-harness-runtime/cookies/          ← user drops anything here
+            │
+            ▼
+   Cookie Sanitizer                     ← THIS PACKAGE
+            │
+            ▼
+~/.config/<provider>-cookies.txt        ← canonical, runtime-owned
+            │
+            ▼
+   MiniMaxQuotaScraper (unchanged)      ← reads only the canonical
+```
+
+## Why
+
+The previous design expected users to know the exact path (`~/.config/minimax-cookies.txt`) and the exact format (Netscape). On a fresh machine, no-one ever set this up — the scraper silently no-op'd and the footer lost its `5h:` / `week:` lines. This package is the discoverable, forgiving adapter between messy human input and the clean contract downstream code already understands.
+
+## What it accepts
+
+**Input formats** (auto-detected per file):
+
+1. **Netscape HTTP Cookie File** — the canonical format
+2. **EditThisCookie / Chrome devtools JSON export** — array of records in the Chrome/Edge cookie store shape
+
+**File names** — any name in the drop folder. Inference prefers:
+
+1. Filename hint (`minimax-*.txt`, `*claude*`, etc.) → provider
+2. Dominant cookie domain (≥ 80% match) → provider
+3. `providerHint` option overrides all of the above
+
+**Provider scope** — currently shipping with: `minimax`, `anthropic`, `openai`, `glm`, `openrouter`. The registry is open and inference by domain works for any provider whose cookies are in the drop folder.
+
+## Usage
+
+### One-shot sync
+
+```typescript
+import { sync } from "@pi-harness/cookie-sanitizer";
+
+const result = sync();
+
+if (result.wrote) {
+  console.log(`Synced ${result.totalCookies} cookies for ${result.provider} → ${result.cachePath}`);
+} else {
+  console.log(`No-op: ${result.errors[0]?.message ?? "nothing to sync"}`);
+}
+```
+
+### Live watcher
+
+```typescript
+import { CookieWatcher } from "@pi-harness/cookie-sanitizer";
+
+const watcher = new CookieWatcher({
+  dropDir: "~/.pi-harness-runtime/cookies",
+  onEvent: (e) => {
+    if (e.kind === "sync-ok") console.log(`Synced ${e.cookies} cookies → ${e.cachePath}`);
+    if (e.kind === "sync-error") console.error(`Sync error: ${e.message}`);
+  },
+});
+
+watcher.start();
+// ... later
+await watcher.stop();
+```
+
+### Custom drop folder / cache path
+
+```typescript
+import { sync } from "@pi-harness/cookie-sanitizer";
+
+const result = sync({
+  dropDir: "/var/spool/cookies",
+  cachePath: "/var/spool/canonical/minimax-cookies.txt",
+  providerHint: "minimax", // skip inference
+});
+```
+
+## Storage contract
+
+| Path | Owned by | Mode | Format |
+|---|---|---|---|
+| `~/.pi-harness-runtime/cookies/` | user (writes freely) | `0o644` | anything |
+| `~/.config/<provider>-cookies.txt` | sanitizer (single writer) | `0o600` | standard Netscape |
+
+The sanitizer is the **only** writer of the canonical cache. Manual edits are overwritten on next sync — by design. If you want a manual override, set `QUOTA_COOKIE_FILE` env var to a different path; the sanitizer will then skip its work and the scraper reads the override directly.
+
+## What is NOT logged
+
+- Cookie **values** — never. Diagnostics use file basenames and 64-char previews with values redacted.
+- Cookie **paths** (except the canonical cache path, which is a configuration location).
+- Cookie **domains** are OK to print (public).
+
+## Tests
+
+```bash
+bun test                 # all package tests
+bun test test/parse.test.ts
+bun test test/sync.test.ts
+```
+
+## Security
+
+- The canonical cache is `0o600` (owner R/W only) — atomic write with `0o600` parent, `fsync` before `rename`, `chmod` to `0o600` after rename.
+- The drop folder is gitignored by convention (`.gitleaks.toml` allowlists `cookies.txt` files in both locations).
+- `chokidar` v5 watches the drop folder; sandboxed to `depth: 2` so we don't follow symlinks into the rest of the home directory.
+
+## Files
+
+```
+src/
+├── index.ts            # public API surface
+├── types.ts            # canonical types
+├── detect-format.ts    # Netscape vs JSON detection
+├── parse-netscape.ts   # Netscape parser + serializer
+├── parse-json.ts       # EditThisCookie JSON parser
+├── normalize.ts        # dedupe, expire, domain-match
+├── infer-provider.ts   # filename + domain inference
+├── atomic-write.ts     # POSIX atomic write
+├── sync.ts             # orchestrator
+└── watcher.ts          # chokidar v5 wrapper
+
+test/
+├── parse.test.ts       # 14 cases — Netscape + JSON
+├── normalize.test.ts   # 12 cases — dedupe/expire/domain
+├── infer.test.ts       # 13 cases — filename + domain + combined
+├── sync.test.ts        # 12 cases — end-to-end
+└── watcher.test.ts     # 2 cases — config sanity (chokidar is exercised live)
+```
+
+## Limitations
+
+- Watcher tests are light-touch (chokidar needs a real OS-level fs watcher). Real behavior is exercised by the live runtime.
+- Multi-format inputs (e.g. raw `Cookie:` headers, single-line `k=v`) are deferred. Add on demand.
+- Provider scope is currently hard-coded to a small set. Adding a new provider = adding an entry in `infer-provider.ts`.

package/packages/cookie-sanitizer/dist/atomic-write.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Atomic file write — write to temp, fsync, then rename.
+ *
+ * POSIX `rename(2)` is atomic — on partial-write crash, the prior target
+ * file remains valid. We pair this with `fsync(tempfile)` so the temp
+ * file's data is durable on disk before the rename.
+ *
+ * Permissions: `0o600` (owner R/W only) to keep the canonical cache
+ * owner-readable.
+ *
+ * Sec-001: Cookie values go into the file content. The caller is
+ * responsible for value-handling hygiene; this module just writes
+ * bytes. We do not log the content.
+ */
+import type { ProviderId } from "./types.js";
+/**
+ * Atomically write `content` to `finalPath`.
+ *
+ * Steps:
+ *   1. mkdir -p the parent directory
+ *   2. write to <finalPath>.tmp.<rand>  with mode 0o600
+ *   3. fsync the temp file
+ *   4. rename temp → final  (atomic on POSIX)
+ *   5. chmod final to 0o600  (in case rename preserved looser perms)
+ *
+ * Throws if any step fails. The original `finalPath` is unchanged
+ * until step 4 succeeds.
+ */
+export declare function atomicWriteFileSync(finalPath: string, content: string): void;
+/**
+ * Compute the default cache path for a given provider, e.g.:
+ *   defaultCachePathFor("minimax") → "~/.config/minimax-cookies.txt"
+ *
+ * The home directory is read via `process.env.HOME` so tests can
+ * override it.
+ */
+export declare function defaultCachePathFor(provider: ProviderId): string;
+//# sourceMappingURL=atomic-write.d.ts.map

package/packages/cookie-sanitizer/dist/atomic-write.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"atomic-write.d.ts","sourceRoot":"","sources":["../src/atomic-write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAaH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAyB5E;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,UAAU,GAAG,MAAM,CAGhE"}

package/packages/cookie-sanitizer/dist/atomic-write.js

@@ -0,0 +1,67 @@
+/**
+ * Atomic file write — write to temp, fsync, then rename.
+ *
+ * POSIX `rename(2)` is atomic — on partial-write crash, the prior target
+ * file remains valid. We pair this with `fsync(tempfile)` so the temp
+ * file's data is durable on disk before the rename.
+ *
+ * Permissions: `0o600` (owner R/W only) to keep the canonical cache
+ * owner-readable.
+ *
+ * Sec-001: Cookie values go into the file content. The caller is
+ * responsible for value-handling hygiene; this module just writes
+ * bytes. We do not log the content.
+ */
+import { mkdirSync, openSync, writeSync, fsyncSync, closeSync, renameSync, chmodSync, } from "node:fs";
+import { dirname, join } from "node:path";
+import { randomBytes } from "node:crypto";
+/**
+ * Atomically write `content` to `finalPath`.
+ *
+ * Steps:
+ *   1. mkdir -p the parent directory
+ *   2. write to <finalPath>.tmp.<rand>  with mode 0o600
+ *   3. fsync the temp file
+ *   4. rename temp → final  (atomic on POSIX)
+ *   5. chmod final to 0o600  (in case rename preserved looser perms)
+ *
+ * Throws if any step fails. The original `finalPath` is unchanged
+ * until step 4 succeeds.
+ */
+export function atomicWriteFileSync(finalPath, content) {
+    mkdirSync(dirname(finalPath), { recursive: true });
+    const rand = randomBytes(6).toString("hex");
+    const tempPath = `${finalPath}.tmp.${rand}`;
+    let fd;
+    try {
+        fd = openSync(tempPath, "w", 0o600);
+        writeSync(fd, Buffer.from(content, "utf8"));
+        fsyncSync(fd);
+    }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+    }
+    renameSync(tempPath, finalPath);
+    // Belt-and-braces in case rename preserved a looser mode from an
+    // existing file on some systems.
+    try {
+        chmodSync(finalPath, 0o600);
+    }
+    catch {
+        // Filesystems that don't support chmod (e.g. FAT32) are not a
+        // target platform here — drop the error silently.
+    }
+}
+/**
+ * Compute the default cache path for a given provider, e.g.:
+ *   defaultCachePathFor("minimax") → "~/.config/minimax-cookies.txt"
+ *
+ * The home directory is read via `process.env.HOME` so tests can
+ * override it.
+ */
+export function defaultCachePathFor(provider) {
+    const home = process.env.HOME ?? "/tmp";
+    return join(home, ".config", `${provider}-cookies.txt`);
+}
+//# sourceMappingURL=atomic-write.js.map

package/packages/cookie-sanitizer/dist/atomic-write.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"atomic-write.js","sourceRoot":"","sources":["../src/atomic-write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EACN,SAAS,EACT,QAAQ,EACR,SAAS,EACT,SAAS,EACT,SAAS,EACT,UAAU,EACV,SAAS,GACT,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG1C;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,OAAe;IACrE,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEnD,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,GAAG,SAAS,QAAQ,IAAI,EAAE,CAAC;IAE5C,IAAI,EAAsB,CAAC;IAC3B,IAAI,CAAC;QACJ,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACpC,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QAC5C,SAAS,CAAC,EAAE,CAAC,CAAC;IACf,CAAC;YAAS,CAAC;QACV,IAAI,EAAE,KAAK,SAAS;YAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IACrC,CAAC;IAED,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAEhC,iEAAiE;IACjE,iCAAiC;IACjC,IAAI,CAAC;QACJ,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACR,8DAA8D;QAC9D,kDAAkD;IACnD,CAAC;AACF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAoB;IACvD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC;IACxC,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,QAAQ,cAAc,CAAC,CAAC;AACzD,CAAC"}

package/packages/cookie-sanitizer/dist/detect-format.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Format detection — does the input look like Netscape or EditThisCookie JSON?
+ *
+ * Detection rule:
+ *  - File extension `.json` AND first non-blank byte is `[` or `{`  →  JSON
+ *  - File content has `# Netscape HTTP Cookie File` header OR
+ *    ≥ 1 tab-separated 7-column row                              →  Netscape
+ *  - Otherwise                                                    →  unknown
+ *
+ * Cookie VALUES are never copied into return values that get logged.
+ * Only the basename and a 64-char prefix of the first non-blank line.
+ */
+import type { CookieFileFormat, DetectedFile } from "./types.js";
+/**
+ * Returns the basename only, never a path that could leak directory
+ * structure. Safe to log.
+ */
+export declare function safeBasename(filePath: string): string;
+/**
+ * Safely truncated preview of a file's content (for diagnostics).
+ * Strips cookie values to avoid leaking secrets.
+ *
+ * Heuristic: any line that has a tab-separated name=value pair,
+ * replace the value column with `<redacted>`.
+ */
+export declare function safePreview(text: string, maxChars?: number): string;
+/**
+ * Detect the format of cookie file text.
+ */
+export declare function detectFormat(text: string): CookieFileFormat | null;
+/**
+ * Build a DetectedFile from a path and its text contents.
+ * Used by sync.ts after reading the file from disk.
+ */
+export declare function buildDetectedFile(filePath: string, text: string): DetectedFile;
+//# sourceMappingURL=detect-format.d.ts.map

package/packages/cookie-sanitizer/dist/detect-format.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect-format.d.ts","sourceRoot":"","sources":["../src/detect-format.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAKjE;;;GAGG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,SAAK,GAAG,MAAM,CAa/D;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CA+BlE;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAChC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,GACV,YAAY,CASd"}

package/packages/cookie-sanitizer/dist/detect-format.js

@@ -0,0 +1,88 @@
+/**
+ * Format detection — does the input look like Netscape or EditThisCookie JSON?
+ *
+ * Detection rule:
+ *  - File extension `.json` AND first non-blank byte is `[` or `{`  →  JSON
+ *  - File content has `# Netscape HTTP Cookie File` header OR
+ *    ≥ 1 tab-separated 7-column row                              →  Netscape
+ *  - Otherwise                                                    →  unknown
+ *
+ * Cookie VALUES are never copied into return values that get logged.
+ * Only the basename and a 64-char prefix of the first non-blank line.
+ */
+import { basename } from "node:path";
+const HEADER_RE = /^# Netscape HTTP Cookie File/im;
+const MIN_TAB_COLS = 7;
+/**
+ * Returns the basename only, never a path that could leak directory
+ * structure. Safe to log.
+ */
+export function safeBasename(filePath) {
+    return basename(filePath);
+}
+/**
+ * Safely truncated preview of a file's content (for diagnostics).
+ * Strips cookie values to avoid leaking secrets.
+ *
+ * Heuristic: any line that has a tab-separated name=value pair,
+ * replace the value column with `<redacted>`.
+ */
+export function safePreview(text, maxChars = 64) {
+    const firstLine = text
+        .split("\n")
+        .map((l) => l.trim())
+        .find((l) => l.length > 0) ?? "";
+    const redacted = firstLine
+        .split("\t")
+        .map((col, i) => (i >= 5 ? "<redacted>" : col))
+        .join("\t");
+    return redacted.length > maxChars
+        ? `${redacted.slice(0, maxChars)}…`
+        : redacted;
+}
+/**
+ * Detect the format of cookie file text.
+ */
+export function detectFormat(text) {
+    if (typeof text !== "string" || text.length === 0)
+        return null;
+    const trimmed = text.trimStart();
+    const firstByte = trimmed[0];
+    // JSON heuristic — array or object at the top.
+    if (firstByte === "[" || firstByte === "{") {
+        return "edit-this-cookie-json";
+    }
+    // Netscape heuristic — header OR a tab-separated 7-column row.
+    if (HEADER_RE.test(text)) {
+        return "netscape";
+    }
+    const lines = text.split(/\r?\n/);
+    for (const line of lines) {
+        if (!line || (line.startsWith("#") && !line.startsWith("#HttpOnly_"))) {
+            continue;
+        }
+        const trimmedLine = line.startsWith("#HttpOnly_")
+            ? line.slice("#HttpOnly_".length)
+            : line;
+        const cols = trimmedLine.split("\t");
+        if (cols.length >= MIN_TAB_COLS) {
+            return "netscape";
+        }
+    }
+    return null;
+}
+/**
+ * Build a DetectedFile from a path and its text contents.
+ * Used by sync.ts after reading the file from disk.
+ */
+export function buildDetectedFile(filePath, text) {
+    const format = detectFormat(text);
+    return {
+        path: filePath,
+        basename: safeBasename(filePath),
+        format,
+        text,
+        // No error if format is null — unknown format is a normal case.
+    };
+}
+//# sourceMappingURL=detect-format.js.map

package/packages/cookie-sanitizer/dist/detect-format.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect-format.js","sourceRoot":"","sources":["../src/detect-format.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAGrC,MAAM,SAAS,GAAG,gCAAgC,CAAC;AACnD,MAAM,YAAY,GAAG,CAAC,CAAC;AAEvB;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC5C,OAAO,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,QAAQ,GAAG,EAAE;IACtD,MAAM,SAAS,GACd,IAAI;SACF,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,SAAS;SACxB,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;SAC9C,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,OAAO,QAAQ,CAAC,MAAM,GAAG,QAAQ;QAChC,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG;QACnC,CAAC,CAAC,QAAQ,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACxC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE/D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IACjC,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAE7B,+CAA+C;IAC/C,IAAI,SAAS,KAAK,GAAG,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;QAC5C,OAAO,uBAAuB,CAAC;IAChC,CAAC;IAED,+DAA+D;IAC/D,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,OAAO,UAAU,CAAC;IACnB,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;YACvE,SAAS;QACV,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;YAChD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC;YACjC,CAAC,CAAC,IAAI,CAAC;QACR,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,MAAM,IAAI,YAAY,EAAE,CAAC;YACjC,OAAO,UAAU,CAAC;QACnB,CAAC;IACF,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAChC,QAAgB,EAChB,IAAY;IAEZ,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAClC,OAAO;QACN,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,YAAY,CAAC,QAAQ,CAAC;QAChC,MAAM;QACN,IAAI;QACJ,gEAAgE;KAChE,CAAC;AACH,CAAC"}

package/packages/cookie-sanitizer/dist/index.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Cookie Sanitizer — public API.
+ *
+ * Forgiving input → strict canonical cache for downstream consumers
+ * (e.g. MiniMaxQuotaScraper reads only `~/.config/minimax-cookies.txt`).
+ *
+ * The package is provider-agnostic but currently shipping with:
+ *   - filename hints: minimax, anthropic, openai, glm, openrouter
+ *   - domain hints : the matching provider domains
+ *
+ * Inputs accepted (auto-detected per file):
+ *   - Netscape HTTP Cookie File
+ *   - EditThisCookie / Chrome devtools JSON export
+ *
+ * @example
+ * ```typescript
+ * import { sync, hasAnyCookieSource, CookieWatcher } from "@pi-harness/cookie-sanitizer";
+ *
+ * // One-shot sync.
+ * const result = sync();
+ * console.log(result.provider, result.cachePath, result.totalCookies);
+ *
+ * // Live updates.
+ * const watcher = new CookieWatcher({
+ *   dropDir: "~/.pi-harness-runtime/cookies",
+ *   onEvent: (e) => console.log(e),
+ * });
+ * watcher.start();
+ * ```
+ */
+export { sync, hasAnyCookieSource, inferCachePath, enumerateDropFiles, readInputFile, DEFAULT_DROP_DIR, } from "./sync.js";
+export { parseNetscape, serializeNetscape, } from "./parse-netscape.js";
+export { parseEditThisCookieJson } from "./parse-json.js";
+export { inferProvider, inferProviderFromFilename, inferProviderFromCookies, knownProviders, } from "./infer-provider.js";
+export { normalize, domainMatchesProvider, isExpired, } from "./normalize.js";
+export { detectFormat, buildDetectedFile, safeBasename, safePreview, } from "./detect-format.js";
+export { atomicWriteFileSync, defaultCachePathFor, } from "./atomic-write.js";
+export { CookieWatcher, createWatcher, defaultDropDir, } from "./watcher.js";
+export type { CanonicalCookie, CookieFileFormat, DetectedFile, ProviderId, SyncOptions, SyncResult, WatcherEvent, } from "./types.js";
+export type { CookieWatcherConfig } from "./watcher.js";
+//# sourceMappingURL=index.d.ts.map

package/packages/cookie-sanitizer/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EACN,IAAI,EACJ,kBAAkB,EAClB,cAAc,EACd,kBAAkB,EAClB,aAAa,EACb,gBAAgB,GAChB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACN,aAAa,EACb,iBAAiB,GACjB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAE1D,OAAO,EACN,aAAa,EACb,yBAAyB,EACzB,wBAAwB,EACxB,cAAc,GACd,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACN,SAAS,EACT,qBAAqB,EACrB,SAAS,GACT,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACN,YAAY,EACZ,iBAAiB,EACjB,YAAY,EACZ,WAAW,GACX,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACN,mBAAmB,EACnB,mBAAmB,GACnB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACN,aAAa,EACb,aAAa,EACb,cAAc,GACd,MAAM,cAAc,CAAC;AAEtB,YAAY,EACX,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,UAAU,EACV,WAAW,EACX,UAAU,EACV,YAAY,GACZ,MAAM,YAAY,CAAC;AAEpB,YAAY,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC"}

package/packages/cookie-sanitizer/dist/index.js

@@ -0,0 +1,39 @@
+/**
+ * Cookie Sanitizer — public API.
+ *
+ * Forgiving input → strict canonical cache for downstream consumers
+ * (e.g. MiniMaxQuotaScraper reads only `~/.config/minimax-cookies.txt`).
+ *
+ * The package is provider-agnostic but currently shipping with:
+ *   - filename hints: minimax, anthropic, openai, glm, openrouter
+ *   - domain hints : the matching provider domains
+ *
+ * Inputs accepted (auto-detected per file):
+ *   - Netscape HTTP Cookie File
+ *   - EditThisCookie / Chrome devtools JSON export
+ *
+ * @example
+ * ```typescript
+ * import { sync, hasAnyCookieSource, CookieWatcher } from "@pi-harness/cookie-sanitizer";
+ *
+ * // One-shot sync.
+ * const result = sync();
+ * console.log(result.provider, result.cachePath, result.totalCookies);
+ *
+ * // Live updates.
+ * const watcher = new CookieWatcher({
+ *   dropDir: "~/.pi-harness-runtime/cookies",
+ *   onEvent: (e) => console.log(e),
+ * });
+ * watcher.start();
+ * ```
+ */
+export { sync, hasAnyCookieSource, inferCachePath, enumerateDropFiles, readInputFile, DEFAULT_DROP_DIR, } from "./sync.js";
+export { parseNetscape, serializeNetscape, } from "./parse-netscape.js";
+export { parseEditThisCookieJson } from "./parse-json.js";
+export { inferProvider, inferProviderFromFilename, inferProviderFromCookies, knownProviders, } from "./infer-provider.js";
+export { normalize, domainMatchesProvider, isExpired, } from "./normalize.js";
+export { detectFormat, buildDetectedFile, safeBasename, safePreview, } from "./detect-format.js";
+export { atomicWriteFileSync, defaultCachePathFor, } from "./atomic-write.js";
+export { CookieWatcher, createWatcher, defaultDropDir, } from "./watcher.js";
+//# sourceMappingURL=index.js.map

package/packages/cookie-sanitizer/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EACN,IAAI,EACJ,kBAAkB,EAClB,cAAc,EACd,kBAAkB,EAClB,aAAa,EACb,gBAAgB,GAChB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACN,aAAa,EACb,iBAAiB,GACjB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAE1D,OAAO,EACN,aAAa,EACb,yBAAyB,EACzB,wBAAwB,EACxB,cAAc,GACd,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACN,SAAS,EACT,qBAAqB,EACrB,SAAS,GACT,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACN,YAAY,EACZ,iBAAiB,EACjB,YAAY,EACZ,WAAW,GACX,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACN,mBAAmB,EACnB,mBAAmB,GACnB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACN,aAAa,EACb,aAAa,EACb,cAAc,GACd,MAAM,cAAc,CAAC"}

package/packages/cookie-sanitizer/dist/infer-provider.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Provider inference — figure out which provider a cookie dump belongs to
+ * without the user having to organize by subfolder.
+ *
+ * Three inference passes, first hit wins:
+ *   1. Filename hint    (e.g. `minimax-*.txt`, `*minimax.json` → "minimax")
+ *   2. Dominant domain  (≥ 80% of cookies on `*.minimax.io` → "minimax")
+ *   3. Nothing           → null (caller will surface a friendly error)
+ *
+ * Provider hint from SyncOptions overrides all of the above.
+ */
+import type { CanonicalCookie, ProviderId } from "./types.js";
+/** Returns the first provider whose filename pattern matches, or null. */
+export declare function inferProviderFromFilename(filename: string): ProviderId | null;
+/** Returns the provider whose domain is the dominant (≥ 80%) match. */
+export declare function inferProviderFromCookies(cookies: CanonicalCookie[]): ProviderId | null;
+/**
+ * Combined inference: hint → filename → dominant domain → null.
+ *
+ * If `filename` is provided it takes priority over domain inference
+ * (filename hints are explicit). Domain inference is the fallback.
+ */
+export declare function inferProvider(filename: string | undefined, cookies: CanonicalCookie[], hint?: ProviderId): ProviderId | null;
+/**
+ * Build a list of provider rules used by other parts of the package.
+ * Exposed for UI display (e.g. "which providers does this sanitizer know?").
+ */
+export declare function knownProviders(): ProviderId[];
+//# sourceMappingURL=infer-provider.d.ts.map

package/packages/cookie-sanitizer/dist/infer-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"infer-provider.d.ts","sourceRoot":"","sources":["../src/infer-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAwB9D,0EAA0E;AAC1E,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAM7E;AAED,uEAAuE;AACvE,wBAAgB,wBAAwB,CACvC,OAAO,EAAE,eAAe,EAAE,GACxB,UAAU,GAAG,IAAI,CAyBnB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAC5B,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,OAAO,EAAE,eAAe,EAAE,EAC1B,IAAI,CAAC,EAAE,UAAU,GACf,UAAU,GAAG,IAAI,CAOnB;AAED;;;GAGG;AACH,wBAAgB,cAAc,IAAI,UAAU,EAAE,CAI7C"}

package/packages/cookie-sanitizer/dist/infer-provider.js

@@ -0,0 +1,96 @@
+/**
+ * Provider inference — figure out which provider a cookie dump belongs to
+ * without the user having to organize by subfolder.
+ *
+ * Three inference passes, first hit wins:
+ *   1. Filename hint    (e.g. `minimax-*.txt`, `*minimax.json` → "minimax")
+ *   2. Dominant domain  (≥ 80% of cookies on `*.minimax.io` → "minimax")
+ *   3. Nothing           → null (caller will surface a friendly error)
+ *
+ * Provider hint from SyncOptions overrides all of the above.
+ */
+const FILENAME_HINTS = [
+    { pattern: /minimax/i, provider: "minimax" },
+    { pattern: /anthropic|claude/i, provider: "anthropic" },
+    { pattern: /openai|gpt|chatgpt/i, provider: "openai" },
+    { pattern: /glm|z\.ai|zhipuai/i, provider: "glm" },
+    { pattern: /openrouter/i, provider: "openrouter" },
+];
+const DOMAIN_HINTS = [
+    { pattern: /\.minimax\.io$|^minimax\.io$/i, provider: "minimax" },
+    { pattern: /\.anthropic\.com$|^anthropic\.com$/i, provider: "anthropic" },
+    {
+        pattern: /\.openai\.com$|^openai\.com$|\.chatgpt\.com$|^chatgpt\.com$/i,
+        provider: "openai",
+    },
+    {
+        pattern: /\.z\.ai$|^z\.ai$|\.zhipuai\.cn$|^zhipuai\.cn$/i,
+        provider: "glm",
+    },
+    { pattern: /\.openrouter\.ai$|^openrouter\.ai$/i, provider: "openrouter" },
+];
+/** Returns the first provider whose filename pattern matches, or null. */
+export function inferProviderFromFilename(filename) {
+    if (!filename)
+        return null;
+    for (const { pattern, provider } of FILENAME_HINTS) {
+        if (pattern.test(filename))
+            return provider;
+    }
+    return null;
+}
+/** Returns the provider whose domain is the dominant (≥ 80%) match. */
+export function inferProviderFromCookies(cookies) {
+    if (!Array.isArray(cookies) || cookies.length === 0)
+        return null;
+    const counts = new Map();
+    let total = 0;
+    for (const c of cookies) {
+        if (!c.domain)
+            continue;
+        total += 1;
+        for (const { pattern, provider } of DOMAIN_HINTS) {
+            if (pattern.test(c.domain.toLowerCase())) {
+                counts.set(provider, (counts.get(provider) ?? 0) + 1);
+                break;
+            }
+        }
+    }
+    if (total === 0)
+        return null;
+    const threshold = Math.ceil(total * 0.8); // ≥ 80 %
+    let best = null;
+    for (const [provider, count] of counts) {
+        if (count >= threshold && (!best || count > best.count)) {
+            best = { provider, count };
+        }
+    }
+    return best?.provider ?? null;
+}
+/**
+ * Combined inference: hint → filename → dominant domain → null.
+ *
+ * If `filename` is provided it takes priority over domain inference
+ * (filename hints are explicit). Domain inference is the fallback.
+ */
+export function inferProvider(filename, cookies, hint) {
+    if (hint)
+        return hint;
+    if (filename) {
+        const fromName = inferProviderFromFilename(filename);
+        if (fromName)
+            return fromName;
+    }
+    return inferProviderFromCookies(cookies);
+}
+/**
+ * Build a list of provider rules used by other parts of the package.
+ * Exposed for UI display (e.g. "which providers does this sanitizer know?").
+ */
+export function knownProviders() {
+    const set = new Set();
+    for (const { provider } of FILENAME_HINTS)
+        set.add(provider);
+    return Array.from(set);
+}
+//# sourceMappingURL=infer-provider.js.map

package/packages/cookie-sanitizer/dist/infer-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"infer-provider.js","sourceRoot":"","sources":["../src/infer-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,MAAM,cAAc,GAAqD;IACxE,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE;IAC5C,EAAE,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,WAAW,EAAE;IACvD,EAAE,OAAO,EAAE,qBAAqB,EAAE,QAAQ,EAAE,QAAQ,EAAE;IACtD,EAAE,OAAO,EAAE,oBAAoB,EAAE,QAAQ,EAAE,KAAK,EAAE;IAClD,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE;CAClD,CAAC;AAEF,MAAM,YAAY,GAAqD;IACtE,EAAE,OAAO,EAAE,+BAA+B,EAAE,QAAQ,EAAE,SAAS,EAAE;IACjE,EAAE,OAAO,EAAE,qCAAqC,EAAE,QAAQ,EAAE,WAAW,EAAE;IACzE;QACC,OAAO,EAAE,8DAA8D;QACvE,QAAQ,EAAE,QAAQ;KAClB;IACD;QACC,OAAO,EAAE,gDAAgD;QACzD,QAAQ,EAAE,KAAK;KACf;IACD,EAAE,OAAO,EAAE,qCAAqC,EAAE,QAAQ,EAAE,YAAY,EAAE;CAC1E,CAAC;AAEF,0EAA0E;AAC1E,MAAM,UAAU,yBAAyB,CAAC,QAAgB;IACzD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,KAAK,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,cAAc,EAAE,CAAC;QACpD,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,QAAQ,CAAC;IAC7C,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,wBAAwB,CACvC,OAA0B;IAE1B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEjE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC7C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,CAAC,MAAM;YAAE,SAAS;QACxB,KAAK,IAAI,CAAC,CAAC;QACX,KAAK,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,YAAY,EAAE,CAAC;YAClD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;gBAC1C,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBACtD,MAAM;YACP,CAAC;QACF,CAAC;IACF,CAAC;IAED,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,SAAS;IACnD,IAAI,IAAI,GAAmD,IAAI,CAAC;IAChE,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QACxC,IAAI,KAAK,IAAI,SAAS,IAAI,CAAC,CAAC,IAAI,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,IAAI,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;IACF,CAAC;IACD,OAAO,IAAI,EAAE,QAAQ,IAAI,IAAI,CAAC;AAC/B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC5B,QAA4B,EAC5B,OAA0B,EAC1B,IAAiB;IAEjB,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,QAAQ,EAAE,CAAC;QACd,MAAM,QAAQ,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;IAC/B,CAAC;IACD,OAAO,wBAAwB,CAAC,OAAO,CAAC,CAAC;AAC1C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc;IAC7B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAc,CAAC;IAClC,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,cAAc;QAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACxB,CAAC"}