pi-harness-runtime 1.1.158 → 1.1.159

package/harness/secret-schema.ts

@@ -0,0 +1,163 @@
+/**
+ * Secret Schema Module
+ *
+ * Generates Varlock schema files and manages secret name mappings.
+ */
+
+import type { InfisicalConfig, ServiceSecretMapping, ServiceName } from "./infisical-config.js";
+
+export type { ServiceName, ServiceSecretMapping } from "./infisical-config.js";
+
+/**
+ * Standard secret keys for each service
+ */
+export const SERVICE_SECRET_KEYS: Record<ServiceName, string[]> = {
+  infisical: [],  // No secrets for the Infisical provider itself
+  jev: ["TYPESAFE_API_KEY", "OPENROUTER_API_KEY"],
+  honcho: ["HONCHO_API_KEY"],
+  qdrant: ["QDRANT_CLUSTER_ENDPOINT", "QDRANT_API_KEY", "QDRANT_COLLECTION"],
+  telegram: ["TELEGRAM_BOT_TOKEN", "TELEGRAM_CHAT_ID", "TELEGRAM_WEBHOOK_SECRET"],
+  embeddings: ["OPENAI_API_KEY"],
+  planner: ["PLANNER_API_KEY", "PLANNER_BASE_URL", "PLANNER_MODEL"],
+  minimax: ["MINIMAX_API_KEY", "MINIMAX_BASE_URL", "MINIMAX_MODEL"],
+  glm: ["GLM_API_KEY", "GLM_BASE_URL", "GLM_MODEL"],
+};
+
+/**
+ * Generate Varlock schema for Infisical config
+ */
+export function generateSchema(config: InfisicalConfig): string {
+  const lines: string[] = [
+    "# @plugin(@varlock/infisical-plugin)",
+    `# @initInfisical(projectId=${config.projectId}, environment=${config.environment}, siteUrl=${getSiteUrl(config)}, secretPath=${config.secretPath}, clientId=$INFISICAL_CLIENT_ID, clientSecret=$INFISICAL_CLIENT_SECRET, cacheTtl=false)`,
+    "# ---",
+    "",
+  ];
+
+  // Internal bootstrap variables (not resolved secrets)
+  lines.push("# @type=string @internal");
+  lines.push("INFISICAL_PROJECT_ID=");
+  lines.push("# @type=string @internal");
+  lines.push(`INFISICAL_ENVIRONMENT=${config.environment}`);
+  lines.push("# @type=string @internal");
+  lines.push(`INFISICAL_SITE_URL=${getSiteUrl(config)}`);
+  lines.push("# @type=infisicalClientId @internal");
+  lines.push("INFISICAL_CLIENT_ID=");
+  lines.push("# @type=infisicalClientSecret @sensitive @internal");
+  lines.push("INFISICAL_CLIENT_SECRET=");
+  lines.push("");
+
+  // Add secrets for each enabled service
+  for (const serviceMapping of config.services) {
+    const service = serviceMapping.service;
+    const keys = SERVICE_SECRET_KEYS[service] ?? [];
+    const mapping = serviceMapping.keys;
+
+    lines.push(`# Service: ${service}`);
+    lines.push("");
+
+    for (const key of keys) {
+      // Map to Infisical secret name
+      const infisicalName = mapping[key] ?? key;
+      const isSensitive = isSensitiveKey(key);
+
+      lines.push(
+        `# @type=string ${serviceMapping.required ? "@required" : ""} ${isSensitive ? "@sensitive" : ""}`
+      );
+      lines.push(`${key}=infisical("${infisicalName}")`);
+    }
+
+    lines.push("");
+  }
+
+  return lines.join("\n");
+}
+
+/**
+ * Get site URL from config
+ */
+function getSiteUrl(config: InfisicalConfig): string {
+  switch (config.site) {
+    case "us":
+      return "https://app.infisical.com";
+    case "eu":
+      return "https://eu.infisical.com";
+    case "custom":
+      return config.customSiteUrl ?? "https://app.infisical.com";
+  }
+}
+
+/**
+ * Check if a key is sensitive
+ */
+function isSensitiveKey(key: string): boolean {
+  const sensitivePatterns = [
+    /API[_-]?KEY$/i,
+    /SECRET$/i,
+    /TOKEN$/i,
+    /PASSWORD$/i,
+    /CREDENTIAL$/i,
+  ];
+
+  return sensitivePatterns.some(pattern => pattern.test(key));
+}
+
+/**
+ * Validate schema doesn't contain dangerous content
+ */
+export function validateSchemaContent(schema: string): { valid: boolean; error?: string } {
+  // Check for obvious injection patterns
+  const dangerous = [
+    /\$\{.*\}/,                    // Variable interpolation
+    /`[^`]*`/,                     // Backtick commands
+    /\|\s*\w+/,                    // Pipe to command
+    /;\s*\w+/,                      // Command chaining
+    /&&\s*\w+/,                    // And chaining
+    /\|\|\s*\w+/,                  // Or chaining
+  ];
+
+  for (const pattern of dangerous) {
+    if (pattern.test(schema)) {
+      return {
+        valid: false,
+        error: `Schema contains potentially dangerous pattern: ${pattern.toString()}`,
+      };
+    }
+  }
+
+  return { valid: true };
+}
+
+/**
+ * Get default secret name mapping for a service
+ */
+export function getDefaultMapping(service: ServiceName): Record<string, string> {
+  const keys = SERVICE_SECRET_KEYS[service] ?? [];
+  const mapping: Record<string, string> = {};
+
+  for (const key of keys) {
+    // Default mapping: same name in Infisical
+    mapping[key] = key;
+  }
+
+  return mapping;
+}
+
+/**
+ * Check if a service has all required keys
+ */
+export function validateServiceMapping(
+  service: ServiceName,
+  mapping: Record<string, string>
+): { valid: boolean; missing?: string[] } {
+  const requiredKeys = SERVICE_SECRET_KEYS[service] ?? [];
+  const missing: string[] = [];
+
+  for (const key of requiredKeys) {
+    if (!mapping[key]) {
+      missing.push(key);
+    }
+  }
+
+  return missing.length > 0 ? { valid: false, missing } : { valid: true };
+}

package/harness/varlock-worker.ts

@@ -0,0 +1,379 @@
+/**
+ * Varlock Worker Module
+ *
+ * Spawns Varlock CLI as an async child process for secret resolution.
+ * All secrets stay in private pipes - never touch main process stdout.
+ *
+ * Security:
+ * - Uses shell: false to prevent injection
+ * - Captures output in memory only
+ * - Enforces deadlines and termination
+ * - Never logs secret values
+ */
+
+import { spawn } from "node:child_process";
+import { join } from "node:path";
+import { homedir } from "node:os";
+import { existsSync } from "node:fs";
+
+/**
+ * Varlock worker options
+ */
+export interface VarlockWorkerOptions {
+  /** Path to Varlock schema file (.env.schema) */
+  schemaPath: string;
+
+  /** Working directory for Varlock */
+  cwd?: string;
+
+  /** Environment variables to pass (bootstrap vars only) */
+  env?: Record<string, string>;
+
+  /** Maximum time to wait for resolution (ms) */
+  timeoutMs?: number;
+
+  /** Skip cache for this resolution */
+  skipCache?: boolean;
+}
+
+/**
+ * Resolved secret value
+ */
+export interface ResolvedSecret {
+  key: string;
+  value: string;
+}
+
+/**
+ * Resolution result
+ */
+export interface ResolutionResult {
+  success: boolean;
+  secrets?: ResolvedSecret[];
+  error?: string;
+  errorCode?: "timeout" | "exit_error" | "parse_error" | "no_binary" | "cancelled";
+}
+
+/**
+ * Error categories for safe logging
+ */
+export type ErrorCategory =
+  | "no_binary"
+  | "schema_not_found"
+  | "timeout"
+  | "exit_error"
+  | "parse_error"
+  | "cancelled"
+  | "unknown";
+
+
+/**
+ * Resolution error codes (subset of ErrorCategory that can be returned)
+ */
+export type ResolutionErrorCode =
+  | "no_binary"
+  | "timeout"
+  | "exit_error"
+  | "parse_error"
+  | "cancelled";
+
+/**
+ * Find Varlock CLI binary
+ */
+function findVarlockBinary(): string | null {
+  // Check common locations
+  const possiblePaths = [
+    // Global npm
+    join(homedir(), ".nvm", "versions", "node", process.version.split(".")[0].slice(1), "lib", "node_modules", "varlock", "bin", "cli.js"),
+    // User npm
+    join(homedir(), ".npm-global", "bin", "varlock"),
+    // Local node_modules
+    join(process.cwd(), "node_modules", ".bin", "varlock"),
+    // pi-harness-runtime node_modules
+    join(__dirname, "..", "node_modules", ".bin", "varlock"),
+    // Direct global
+    "/usr/local/bin/varlock",
+    "/usr/bin/varlock",
+  ];
+
+  for (const path of possiblePaths) {
+    if (existsSync(path)) {
+      return path;
+    }
+  }
+
+  return null;
+}
+
+/**
+ * Map error to safe category for logging
+ */
+function categorizeError(error: unknown): ErrorCategory {
+  if (error instanceof Error) {
+    const msg = error.message.toLowerCase();
+
+    if (msg.includes("enoent") || msg.includes("not found")) {
+      return "no_binary";
+    }
+    if (msg.includes("timeout")) {
+      return "timeout";
+    }
+    if (msg.includes("enoent") || msg.includes("no such file")) {
+      return "schema_not_found";
+    }
+  }
+
+  return "unknown";
+}
+
+/**
+ * Parse Varlock JSON output
+ */
+function parseVarlockOutput(stdout: string, maxSize: number = 1024 * 1024): ResolvedSecret[] | null {
+  // Enforce size limit
+  if (stdout.length > maxSize) {
+    return null;
+  }
+
+  try {
+    const parsed = JSON.parse(stdout);
+
+    // Varlock JSON format: { "KEY": "value", ... }
+    // Only return string-to-string mappings
+    const secrets: ResolvedSecret[] = [];
+
+    for (const [key, value] of Object.entries(parsed)) {
+      if (typeof key === "string" && typeof value === "string") {
+        secrets.push({ key, value });
+      }
+    }
+
+    return secrets;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Resolve secrets using Varlock CLI
+ *
+ * @param options - Worker options
+ * @param signal - AbortSignal for cancellation
+ * @returns Resolution result
+ */
+export async function resolveSecrets(
+  options: VarlockWorkerOptions,
+  signal?: AbortSignal
+): Promise<ResolutionResult> {
+  const {
+    schemaPath,
+    cwd = process.cwd(),
+    env = {},
+    timeoutMs = 60000,
+    skipCache = true,
+  } = options;
+
+  const varlockPath = findVarlockBinary();
+
+  if (!varlockPath) {
+    console.error("[varlock-worker] Varlock binary not found");
+    return {
+      success: false,
+      error: "Varlock binary not found",
+      errorCode: "no_binary",
+    };
+  }
+
+  // Build arguments
+  const args = [
+    "load",
+    "--format", "json",
+    "--path", schemaPath,
+  ];
+
+  if (skipCache) {
+    args.push("--skip-cache");
+  }
+
+  // Create promise with deadline
+  const result = await Promise.race([
+    new Promise<ResolutionResult>((resolve) => {
+      const child = spawn(varlockPath, args, {
+        cwd,
+        env: {
+          ...process.env,
+          ...env,
+        },
+        shell: false,
+        stdio: ["ignore", "pipe", "pipe"],
+      });
+
+      let stdout = "";
+      let stderr = "";
+
+      child.stdout?.on("data", (chunk: Buffer) => {
+        stdout += chunk.toString();
+      });
+
+      child.stderr?.on("data", (chunk: Buffer) => {
+        stderr += chunk.toString();
+      });
+
+      child.on("close", (code) => {
+        if (code === 0) {
+          const secrets = parseVarlockOutput(stdout);
+          if (secrets) {
+            resolve({
+              success: true,
+              secrets,
+            });
+          } else {
+            resolve({
+              success: false,
+              error: "Failed to parse Varlock output",
+              errorCode: "parse_error",
+            });
+          }
+        } else {
+          // Log stderr without secrets
+          console.error("[varlock-worker] Varlock exited with code:", code);
+          if (stderr) {
+            // Only log first line of stderr, no secrets
+            const firstLine = stderr.split("\n")[0];
+            console.error("[varlock-worker] Error:", firstLine?.slice(0, 200));
+          }
+          resolve({
+            success: false,
+            error: `Varlock exited with code ${code}`,
+            errorCode: "exit_error",
+          });
+        }
+      });
+
+      child.on("error", (err) => {
+        const category = categorizeError(err);
+        console.error(`[varlock-worker] ${category}:`, err instanceof Error ? err.message : String(err));
+        // Map to allowed error codes
+        const errorCode: ResolutionErrorCode =
+          category === "schema_not_found" || category === "unknown"
+            ? "exit_error"
+            : category as ResolutionErrorCode;
+        resolve({
+          success: false,
+          error: `${category}: ${err instanceof Error ? err.message : String(err)}`,
+          errorCode,
+        });
+      });
+
+      // Handle cancellation
+      signal?.addEventListener("abort", () => {
+        console.log("[varlock-worker] Cancelled, terminating child");
+        child.kill("SIGTERM");
+      });
+    }),
+    // Timeout
+    new Promise<ResolutionResult>((resolve) =>
+      setTimeout(() => {
+        resolve({
+          success: false,
+          error: "Resolution timed out",
+          errorCode: "timeout",
+        });
+      }, timeoutMs)
+    ),
+  ]);
+
+  return result;
+}
+
+/**
+ * Get Varlock version
+ */
+export async function getVarlockVersion(): Promise<string | null> {
+  const varlockPath = findVarlockBinary();
+
+  if (!varlockPath) {
+    return null;
+  }
+
+  return new Promise((resolve) => {
+    const child = spawn(varlockPath, ["--version"], {
+      shell: false,
+      stdio: ["ignore", "pipe", "ignore"],
+    });
+
+    let version = "";
+
+    child.stdout?.on("data", (chunk: Buffer) => {
+      version += chunk.toString();
+    });
+
+    child.on("close", (code) => {
+      if (code === 0) {
+        resolve(version.trim());
+      } else {
+        resolve(null);
+      }
+    });
+
+    child.on("error", () => {
+      resolve(null);
+    });
+
+    // Timeout
+    setTimeout(() => {
+      child.kill();
+      resolve(null);
+    }, 5000);
+  });
+}
+
+/**
+ * Validate schema file syntax using Varlock
+ */
+export async function validateSchema(schemaPath: string): Promise<{ valid: boolean; error?: string }> {
+  const varlockPath = findVarlockBinary();
+
+  if (!varlockPath) {
+    return { valid: false, error: "Varlock binary not found" };
+  }
+
+  return new Promise((resolve) => {
+    const child = spawn(varlockPath, ["validate", "--path", schemaPath], {
+      shell: false,
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+
+    let stderr = "";
+
+    child.stderr?.on("data", (chunk: Buffer) => {
+      stderr += chunk.toString();
+    });
+
+    child.on("close", (code) => {
+      if (code === 0) {
+        resolve({ valid: true });
+      } else {
+        // Return first error line only
+        const errorLine = stderr.split("\n")[0];
+        resolve({
+          valid: false,
+          error: errorLine?.slice(0, 500) ?? "Validation failed",
+        });
+      }
+    });
+
+    child.on("error", (err) => {
+      resolve({
+        valid: false,
+        error: err instanceof Error ? err.message : "Unknown error",
+      });
+    });
+
+    // 10 second validation timeout
+    setTimeout(() => {
+      child.kill();
+      resolve({ valid: false, error: "Validation timed out" });
+    }, 10000);
+  });
+}

package/index.ts

@@ -903,9 +903,18 @@ async function initHermesSkills(pi: ExtensionAPI): Promise<void> {
 
 			// Register harness services diagnostic commands
 			try {
-				const { initServiceCommands } = await import("./harness/service-commands.js");
-				initServiceCommands(pi);
-				logStartup("[pi-harness] Registered service diagnostic commands");
+			const { initServiceCommands } = await import("./harness/service-commands.js");
+			initServiceCommands(pi);
+			logStartup("[pi-harness] Registered service diagnostic commands");
+
+			// Register Infisical setup command
+			try {
+			const { registerInfisicalSetup } = await import("./harness/infisical-setup.js");
+			registerInfisicalSetup(pi);
+			logStartup("[pi-harness] Registered /setup-infisical command");
+		} catch (err) {
+			logStartup("[pi-harness] Infisical setup not available:", err instanceof Error ? err.message : String(err));
+		}
 			} catch (err) {
 				logStartup(`[pi-harness] Failed to register service commands:`, err instanceof Error ? err.message : String(err));
 			}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-harness-runtime",
-  "version": "1.1.158",
+  "version": "1.1.159",
   "description": "[BETA] Codex-style /usage status + autonomous coding harness for pi. Not production ready — expect breaking changes.",
   "type": "module",
   "scripts": {

package/packages/a2a-adapter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/a2a-adapter",
-  "version": "1.1.158",
+  "version": "1.1.159",
   "type": "module",
   "description": "Google Agent-to-Agent (A2A) protocol adapter for pi-harness",
   "main": "dist/index.js",

package/packages/agent-policy/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/agent-policy",
-  "version": "1.1.158",
+  "version": "1.1.159",
   "description": "Agent policy runtime for pi-harness - enforces mandatory rule delivery and mutation gating",
   "type": "module",
   "main": "./dist/index.js",

package/packages/architecture-generator/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/architecture-generator",
-  "version": "1.1.158",
+  "version": "1.1.159",
   "description": "Generate ADR and Mermaid diagrams from project analysis",
   "type": "module",
   "main": "./dist/index.js",

package/packages/auth/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/auth",
-  "version": "1.1.158",
+  "version": "1.1.159",
   "description": "pi-harness-runtime — auth",
   "type": "module",
   "main": "./dist/index.js",

package/packages/autonomous-refactor/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/autonomous-refactor",
-  "version": "1.1.158",
+  "version": "1.1.159",
   "type": "module",
   "description": "Autonomous refactoring engine",
   "main": "dist/index.js",

package/packages/autonomous-runtime/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/autonomous-runtime",
-  "version": "1.1.158",
+  "version": "1.1.159",
   "description": "Autonomous Operations Runtime — task inbox, lease management, and worker lifecycle (RFC-0101)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/cache-strategy/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/cache-strategy",
-  "version": "1.1.158",
+  "version": "1.1.159",
   "type": "module",
   "description": "Smart caching with TTL and invalidation strategies (RFC-0022)",
   "main": "dist/index.js",

package/packages/capability-registry/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/capability-registry",
-  "version": "1.1.158",
+  "version": "1.1.159",
   "description": "Capability Registry for pi-harness-runtime — tracks model capabilities and enables capability-based routing",
   "type": "module",
   "main": "./dist/index.js",

package/packages/checkpoint/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/checkpoint",
-  "version": "1.1.158",
+  "version": "1.1.159",
   "description": "Enhanced checkpoint system with incremental snapshots, diff-based storage, and recovery strategies",
   "type": "module",
   "main": "./dist/index.js",

package/packages/cli-plugin-sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/cli-plugin-sdk",
-  "version": "1.1.158",
+  "version": "1.1.159",
   "type": "module",
   "description": "CLI Plugin SDK for pi-harness — install, list, remove, update, invoke plugins",
   "main": "dist/index.js",

package/packages/clipboard/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/clipboard",
-  "version": "1.1.158",
+  "version": "1.1.159",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/clipboard-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/clipboard-plugin",
-  "version": "1.1.158",
+  "version": "1.1.159",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/code-generation/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/code-generation",
-  "version": "1.1.158",
+  "version": "1.1.159",
   "description": "Code generation pipeline for pi-harness-runtime",
   "type": "module",
   "main": "./dist/index.js",