pi-harness-runtime 1.1.159 → 1.1.161

package/packages/notification/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,0BAA0B,CAAC;AACzC,cAAc,mBAAmB,CAAC;AAClC,cAAc,YAAY,CAAC;AAC3B,cAAc,+BAA+B,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,0BAA0B,CAAC;AACzC,cAAc,mBAAmB,CAAC;AAClC,cAAc,YAAY,CAAC;AAC3B,cAAc,+BAA+B,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EACN,UAAU,EACV,SAAS,EACT,UAAU,EACV,WAAW,EACX,gBAAgB,GAChB,MAAM,mBAAmB,CAAC"}

package/packages/notification/dist/mask-secrets.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Secret Masking Utility
+ *
+ * Masks sensitive values in strings before sending to Telegram/other channels.
+ * Shows first 4 + last 4 characters for identification.
+ */
+/**
+ * Mask a value showing first and last characters
+ */
+export declare function maskValue(value: string): string;
+/**
+ * Check if a field name is sensitive
+ */
+export declare function isSensitiveField(fieldName: string): boolean;
+/**
+ * Mask sensitive patterns in a string
+ */
+export declare function maskString(input: string): string;
+/**
+ * Mask JSON object fields that are sensitive
+ */
+export declare function maskObject(obj: unknown, depth?: number): Record<string, unknown> | unknown[] | string | number | boolean | null;
+/**
+ * Mask a message/notification payload
+ */
+export declare function maskPayload(obj: unknown): Record<string, unknown> | unknown[] | string | number | boolean | null;
+/**
+ * Format a value for display, masking if sensitive
+ */
+export declare function formatValue(key: string, value: unknown): string;
+//# sourceMappingURL=mask-secrets.d.ts.map

package/packages/notification/dist/mask-secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mask-secrets.d.ts","sourceRoot":"","sources":["../src/mask-secrets.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAwCH;;GAEG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAK/C;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAU3D;AAuBD;;GAEG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,GAAE,MAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,EAAE,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CA+BlI;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,EAAE,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAEhH;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,CAK/D"}

package/packages/notification/dist/mask-secrets.js

@@ -0,0 +1,132 @@
+/**
+ * Secret Masking Utility
+ *
+ * Masks sensitive values in strings before sending to Telegram/other channels.
+ * Shows first 4 + last 4 characters for identification.
+ */
+/**
+ * Patterns that match sensitive values
+ */
+const SENSITIVE_PATTERNS = [
+    // Generic API keys, tokens, secrets
+    /[a-zA-Z0-9_-]{32,}/g, // Long alphanumeric strings (likely keys)
+    /[A-Fa-f0-9]{32,}/g, // Hex strings (likely hashes/keys)
+    /sk-[a-zA-Z0-9]{20,}/g, // OpenAI-style keys
+    /Bearer\s+[a-zA-Z0-9_-]{20,}/gi, // Bearer tokens
+    /token[=:]\s*[a-zA-Z0-9_-]{20,}/gi, // token=xxx patterns
+    /secret[=:]\s*[a-zA-Z0-9_-]{20,}/gi, // secret=xxx patterns
+    /key[=:]\s*[a-zA-Z0-9_-]{20,}/gi, // key=xxx patterns
+    /password[=:]\s*[^\s,}]+/gi, // password=xxx patterns
+    /client[_-]?secret[=:]\s*[^\s,}]+/gi, // client_secret=xxx
+    /client[_-]?id[=:]\s*[a-zA-Z0-9_-]{20,}/gi, // client_id=xxx
+    /infisical[_-]?(client[_-])?(secret|id)[=:]\s*[a-zA-Z0-9_-]{20,}/gi,
+];
+// Specific Infisical field names to mask
+const INFISICAL_FIELDS = [
+    "infisical_client_secret",
+    "infisical_client_id",
+    "infisical_project_id",
+    "INFISICAL_CLIENT_SECRET",
+    "INFISICAL_CLIENT_ID",
+    "INFISICAL_PROJECT_ID",
+];
+// General sensitive field patterns
+const SENSITIVE_FIELD_PATTERNS = [
+    /_api_key$/i,
+    /_secret$/i,
+    /_token$/i,
+    /_password$/i,
+    /_credential$/i,
+    /_auth$/i,
+];
+/**
+ * Mask a value showing first and last characters
+ */
+export function maskValue(value) {
+    if (!value || value.length <= 8) {
+        return "****";
+    }
+    return `${value.slice(0, 4)}...${value.slice(-4)}`;
+}
+/**
+ * Check if a field name is sensitive
+ */
+export function isSensitiveField(fieldName) {
+    const lower = fieldName.toLowerCase();
+    // Check specific Infisical fields
+    if (INFISICAL_FIELDS.some(f => lower === f.toLowerCase())) {
+        return true;
+    }
+    // Check general patterns
+    return SENSITIVE_FIELD_PATTERNS.some(pattern => pattern.test(lower));
+}
+/**
+ * Mask a string value
+ */
+function maskStringValue(input) {
+    let result = input;
+    // First, mask any field=value patterns for sensitive fields
+    for (const field of INFISICAL_FIELDS) {
+        const escapedField = field.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+        const pattern = new RegExp(`(${escapedField})\\s*[=:]\\s*([a-zA-Z0-9_-]+)`, "gi");
+        result = result.replace(pattern, (_match, _field, value) => `${field}: ${maskValue(value)}`);
+    }
+    // Then mask generic patterns
+    for (const pattern of SENSITIVE_PATTERNS) {
+        result = result.replace(pattern, (match) => maskValue(match));
+    }
+    return result;
+}
+/**
+ * Mask sensitive patterns in a string
+ */
+export function maskString(input) {
+    return maskStringValue(input);
+}
+/**
+ * Mask JSON object fields that are sensitive
+ */
+export function maskObject(obj, depth = 0) {
+    // Prevent infinite recursion
+    if (depth > 10 || obj === null || obj === undefined) {
+        return obj;
+    }
+    if (typeof obj === "string") {
+        return maskStringValue(obj);
+    }
+    if (typeof obj === "number" || typeof obj === "boolean") {
+        return obj;
+    }
+    if (Array.isArray(obj)) {
+        return obj.map(item => maskObject(item, depth + 1));
+    }
+    if (typeof obj === "object") {
+        const result = {};
+        for (const [key, value] of Object.entries(obj)) {
+            if (isSensitiveField(key)) {
+                result[key] = typeof value === "string" ? maskValue(value) : value;
+            }
+            else {
+                result[key] = maskObject(value, depth + 1);
+            }
+        }
+        return result;
+    }
+    return obj;
+}
+/**
+ * Mask a message/notification payload
+ */
+export function maskPayload(obj) {
+    return maskObject(obj);
+}
+/**
+ * Format a value for display, masking if sensitive
+ */
+export function formatValue(key, value) {
+    if (isSensitiveField(key) && typeof value === "string") {
+        return `${key}: ${maskValue(value)}`;
+    }
+    return `${key}: ${value}`;
+}
+//# sourceMappingURL=mask-secrets.js.map

package/packages/notification/dist/mask-secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mask-secrets.js","sourceRoot":"","sources":["../src/mask-secrets.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;GAEG;AACH,MAAM,kBAAkB,GAAa;IACpC,oCAAoC;IACpC,qBAAqB,EAAqB,0CAA0C;IACpF,mBAAmB,EAAsB,mCAAmC;IAC5E,sBAAsB,EAAoB,oBAAoB;IAC9D,+BAA+B,EAAW,gBAAgB;IAC1D,kCAAkC,EAAO,qBAAqB;IAC9D,mCAAmC,EAAO,sBAAsB;IAChE,gCAAgC,EAAU,mBAAmB;IAC7D,2BAA2B,EAAc,wBAAwB;IACjE,oCAAoC,EAAM,oBAAoB;IAC9D,0CAA0C,EAAE,gBAAgB;IAC5D,mEAAmE;CACnE,CAAC;AAEF,yCAAyC;AACzC,MAAM,gBAAgB,GAAG;IACxB,yBAAyB;IACzB,qBAAqB;IACrB,sBAAsB;IACtB,yBAAyB;IACzB,qBAAqB;IACrB,sBAAsB;CACtB,CAAC;AAEF,mCAAmC;AACnC,MAAM,wBAAwB,GAAG;IAChC,YAAY;IACZ,WAAW;IACX,UAAU;IACV,aAAa;IACb,eAAe;IACf,SAAS;CACT,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa;IACtC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC;IACf,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACpD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IACjD,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;IAEtC,kCAAkC;IAClC,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC;IACb,CAAC;IAED,yBAAyB;IACzB,OAAO,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AACtE,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CAAC,KAAa;IACrC,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,4DAA4D;IAC5D,KAAK,MAAM,KAAK,IAAI,gBAAgB,EAAE,CAAC;QACtC,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;QAClE,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,IAAI,YAAY,+BAA+B,EAAE,IAAI,CAAC,CAAC;QAClF,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,KAAK,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,6BAA6B;IAC7B,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;QAC1C,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa;IACvC,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,GAAY,EAAE,KAAK,GAAW,CAAC;IACzD,6BAA6B;IAC7B,IAAI,KAAK,GAAG,EAAE,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACrD,OAAO,GAAW,CAAC;IACpB,CAAC;IAED,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,SAAS,EAAE,CAAC;QACzD,OAAO,GAAG,CAAC;IACZ,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAA8B,CAAC,EAAE,CAAC;YAC3E,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YACpE,CAAC;iBAAM,CAAC;gBACP,MAAM,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC5C,CAAC;QACF,CAAC;QACD,OAAO,MAAiC,CAAC;IAC1C,CAAC;IAED,OAAO,GAAG,CAAC;AACZ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,GAAY;IACvC,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC;AACxB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,KAAc;IACtD,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxD,OAAO,GAAG,GAAG,KAAK,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;IACtC,CAAC;IACD,OAAO,GAAG,GAAG,KAAK,KAAK,EAAE,CAAC;AAC3B,CAAC"}

package/packages/notification/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/notification",
-  "version": "1.1.159",
+  "version": "1.1.161",
   "description": "pi-harness-runtime — notification",
   "type": "module",
   "main": "./dist/index.js",

package/packages/notification/src/adapters/telegram-adapter.ts

@@ -18,6 +18,7 @@ import type {
 	TelegramConfig,
 } from "../types.js";
 import { BaseChannelAdapter } from "../base-adapter.js";
+import { maskString } from "../mask-secrets.js";
 
 export class TelegramAdapter extends BaseChannelAdapter {
 readonly id = "telegram";
@@ -336,7 +337,9 @@ return this._botUsername;
 	private formatMessage(payload: NotificationPayload): string {
 		const emoji = this.getEmoji(payload.event);
 		const title = `${emoji} ${payload.title}`;
-		const lines = [title, "", payload.message];
+		// Mask any secrets in message before sending to Telegram
+		const maskedMessage = maskString(payload.message);
+		const lines = [title, "", maskedMessage];
 
 		if (payload.details?.taskTitle) {
 			lines.push("", `Task: ${payload.details.taskTitle}`);
@@ -345,7 +348,10 @@ return this._botUsername;
 			lines.push(`Job: ${payload.details.jobId}`);
 		}
 		if (payload.details?.error) {
-			lines.push("", `Error: ${payload.details.error}`);
+			// Mask secrets in error messages too
+			const errorStr = String(payload.details.error);
+			const maskedError = maskString(errorStr);
+			lines.push("", `Error: ${maskedError}`);
 		}
 
 		return lines.filter(Boolean).join("\n");

package/packages/notification/src/index.ts

@@ -10,3 +10,10 @@ export * from "./types.js";
 export * from "./telegram-webhook-handler.js";
 export { LineAdapter } from "./adapters/line-adapter.js";
 export { TelegramAdapter } from "./adapters/telegram-adapter.js";
+export {
+	maskString,
+	maskValue,
+	maskObject,
+	maskPayload,
+	isSensitiveField,
+} from "./mask-secrets.js";

package/packages/notification/src/mask-secrets.ts

@@ -0,0 +1,150 @@
+/**
+ * Secret Masking Utility
+ *
+ * Masks sensitive values in strings before sending to Telegram/other channels.
+ * Shows first 4 + last 4 characters for identification.
+ */
+
+/**
+ * Patterns that match sensitive values
+ */
+const SENSITIVE_PATTERNS: RegExp[] = [
+	// Generic API keys, tokens, secrets
+	/[a-zA-Z0-9_-]{32,}/g,                    // Long alphanumeric strings (likely keys)
+	/[A-Fa-f0-9]{32,}/g,                     // Hex strings (likely hashes/keys)
+	/sk-[a-zA-Z0-9]{20,}/g,                   // OpenAI-style keys
+	/Bearer\s+[a-zA-Z0-9_-]{20,}/gi,          // Bearer tokens
+	/token[=:]\s*[a-zA-Z0-9_-]{20,}/gi,      // token=xxx patterns
+	/secret[=:]\s*[a-zA-Z0-9_-]{20,}/gi,      // secret=xxx patterns
+	/key[=:]\s*[a-zA-Z0-9_-]{20,}/gi,         // key=xxx patterns
+	/password[=:]\s*[^\s,}]+/gi,             // password=xxx patterns
+	/client[_-]?secret[=:]\s*[^\s,}]+/gi,     // client_secret=xxx
+	/client[_-]?id[=:]\s*[a-zA-Z0-9_-]{20,}/gi, // client_id=xxx
+	/infisical[_-]?(client[_-])?(secret|id)[=:]\s*[a-zA-Z0-9_-]{20,}/gi,
+];
+
+// Specific Infisical field names to mask
+const INFISICAL_FIELDS = [
+	"infisical_client_secret",
+	"infisical_client_id",
+	"infisical_project_id",
+	"INFISICAL_CLIENT_SECRET",
+	"INFISICAL_CLIENT_ID",
+	"INFISICAL_PROJECT_ID",
+];
+
+// General sensitive field patterns
+const SENSITIVE_FIELD_PATTERNS = [
+	/_api_key$/i,
+	/_secret$/i,
+	/_token$/i,
+	/_password$/i,
+	/_credential$/i,
+	/_auth$/i,
+];
+
+/**
+ * Mask a value showing first and last characters
+ */
+export function maskValue(value: string): string {
+	if (!value || value.length <= 8) {
+		return "****";
+	}
+	return `${value.slice(0, 4)}...${value.slice(-4)}`;
+}
+
+/**
+ * Check if a field name is sensitive
+ */
+export function isSensitiveField(fieldName: string): boolean {
+	const lower = fieldName.toLowerCase();
+
+	// Check specific Infisical fields
+	if (INFISICAL_FIELDS.some(f => lower === f.toLowerCase())) {
+		return true;
+	}
+
+	// Check general patterns
+	return SENSITIVE_FIELD_PATTERNS.some(pattern => pattern.test(lower));
+}
+
+/**
+ * Mask a string value
+ */
+function maskStringValue(input: string): string {
+	let result = input;
+
+	// First, mask any field=value patterns for sensitive fields
+	for (const field of INFISICAL_FIELDS) {
+		const escapedField = field.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+		const pattern = new RegExp(`(${escapedField})\\s*[=:]\\s*([a-zA-Z0-9_-]+)`, "gi");
+		result = result.replace(pattern, (_match, _field, value) => `${field}: ${maskValue(value)}`);
+	}
+
+	// Then mask generic patterns
+	for (const pattern of SENSITIVE_PATTERNS) {
+		result = result.replace(pattern, (match) => maskValue(match));
+	}
+
+	return result;
+}
+
+/**
+ * Mask sensitive patterns in a string
+ */
+export function maskString(input: string): string {
+	return maskStringValue(input);
+}
+
+/**
+ * Mask JSON object fields that are sensitive
+ */
+export function maskObject(obj: unknown, depth: number = 0): Record<string, unknown> | unknown[] | string | number | boolean | null {
+	// Prevent infinite recursion
+	if (depth > 10 || obj === null || obj === undefined) {
+		return obj as null;
+	}
+
+	if (typeof obj === "string") {
+		return maskStringValue(obj);
+	}
+
+	if (typeof obj === "number" || typeof obj === "boolean") {
+		return obj;
+	}
+
+	if (Array.isArray(obj)) {
+		return obj.map(item => maskObject(item, depth + 1));
+	}
+
+	if (typeof obj === "object") {
+		const result: Record<string, unknown> = {};
+		for (const [key, value] of Object.entries(obj as Record<string, unknown>)) {
+			if (isSensitiveField(key)) {
+				result[key] = typeof value === "string" ? maskValue(value) : value;
+			} else {
+				result[key] = maskObject(value, depth + 1);
+			}
+		}
+		return result as Record<string, unknown>;
+	}
+
+	return obj;
+}
+
+/**
+ * Mask a message/notification payload
+ */
+export function maskPayload(obj: unknown): Record<string, unknown> | unknown[] | string | number | boolean | null {
+	return maskObject(obj);
+}
+
+/**
+ * Format a value for display, masking if sensitive
+ */
+export function formatValue(key: string, value: unknown): string {
+	if (isSensitiveField(key) && typeof value === "string") {
+		return `${key}: ${maskValue(value)}`;
+	}
+	return `${key}: ${value}`;
+}

package/packages/observability/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/observability",
-  "version": "1.1.159",
+  "version": "1.1.161",
   "description": "Comprehensive observability system with structured logging, tracing, metrics, and alerting",
   "type": "module",
   "main": "./dist/index.js",

package/packages/okf-indexer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/okf-indexer",
-  "version": "1.1.159",
+  "version": "1.1.161",
   "description": "OKF document indexer for SKILL.md files (RFC-0106)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/paperclip-integration/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/paperclip-integration",
-  "version": "1.1.159",
+  "version": "1.1.161",
   "description": "Paperclip API integration: poll agent inbox, route tasks to pi.dev, Telegram alerts",
   "type": "module",
   "main": "./dist/index.js",

package/packages/performance-optimizer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/performance-optimizer",
-  "version": "1.1.159",
+  "version": "1.1.161",
   "description": "Performance optimization analyzer for pi-harness runtime (RFC-0056)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/privilege-broker/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/privilege-broker",
-  "version": "1.1.159",
+  "version": "1.1.161",
   "description": "Privilege Broker — capability registry and command executor for autonomous runtime (RFC-0101 §7)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/project-analyzer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/project-analyzer",
-  "version": "1.1.159",
+  "version": "1.1.161",
   "description": "Project analysis system for pi-harness-runtime - detects frameworks, rules, and project structure",
   "type": "module",
   "main": "./dist/index.js",

package/packages/project-bootstrap/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/project-bootstrap",
-  "version": "1.1.159",
+  "version": "1.1.161",
   "description": "Project scaffolding from typed ProjectSpec",
   "type": "module",
   "main": "./dist/index.js",

package/packages/projection-engine/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/projection-engine",
-  "version": "1.1.159",
+  "version": "1.1.161",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/prompt-compiler/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/prompt-compiler",
-  "version": "1.1.159",
+  "version": "1.1.161",
   "description": "Deterministic prompt compiler for pi-harness-runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/prompt-versioning/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/prompt-versioning",
-  "version": "1.1.159",
+  "version": "1.1.161",
   "type": "module",
   "description": "Version control for prompts with rollback support (RFC-0019)",
   "main": "dist/index.js",

package/packages/provider-adapter-sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/provider-adapter-sdk",
-  "version": "1.1.159",
+  "version": "1.1.161",
   "description": "SDK for building, testing, and registering AI provider adapters",
   "type": "module",
   "main": "./dist/index.js",

package/packages/provider-router/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/provider-router",
-  "version": "1.1.159",
+  "version": "1.1.161",
   "description": "Enhanced Provider Router for pi-harness-runtime — intelligent routing with capabilities, costs, and quotas",
   "type": "module",
   "main": "./dist/provider-router.js",

package/packages/provider-selector/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/provider-selector",
-  "version": "1.1.159",
+  "version": "1.1.161",
   "description": "Multi-Provider Selector — route requests by cost, quality, and latency (RFC-0012)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/providers/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/providers",
-  "version": "1.1.159",
+  "version": "1.1.161",
   "description": "pi-harness-runtime — providers",
   "type": "module",
   "main": "./dist/index.js",

package/packages/qdrant-skills/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/qdrant-skills",
-  "version": "1.1.159",
+  "version": "1.1.161",
   "description": "Qdrant vector search integration for Hermes-style skill system",
   "type": "module",
   "main": "./dist/index.js",

package/packages/quota-manager/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/quota-manager",
-  "version": "1.1.159",
+  "version": "1.1.161",
   "description": "pi-harness-runtime — quota-manager",
   "type": "module",
   "main": "./dist/index.js",

package/packages/rate-limiter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/rate-limiter",
-  "version": "1.1.159",
+  "version": "1.1.161",
   "type": "module",
   "description": "Rate limiting with token bucket algorithm (RFC-0023)",
   "main": "dist/index.js",

package/packages/react-vite-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/react-vite-plugin",
-  "version": "1.1.159",
+  "version": "1.1.161",
   "description": "React/Vite framework analysis — components, config, TypeScript setup",
   "type": "module",
   "main": "./dist/index.js",

package/packages/release-manager/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/release-manager",
-  "version": "1.1.159",
+  "version": "1.1.161",
   "type": "module",
   "description": "Release management for pi-harness",
   "main": "dist/index.js",

package/packages/requirement-compiler/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/requirement-compiler",
-  "version": "1.1.159",
+  "version": "1.1.161",
   "description": "Compiles raw requirements into validated CompiledRequirement with ambiguity detection and risk tagging",
   "type": "module",
   "main": "./dist/index.js",

package/packages/runtime/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/runtime",
-  "version": "1.1.159",
+  "version": "1.1.161",
   "description": "pi-harness-runtime — runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/scheduler/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/scheduler",
-  "version": "1.1.159",
+  "version": "1.1.161",
   "description": "pi-harness-runtime — scheduler",
   "type": "module",
   "main": "./dist/index.js",

package/packages/scheduler-adapter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/scheduler-adapter",
-  "version": "1.1.159",
+  "version": "1.1.161",
   "description": "Scheduler Adapter — cron, systemd, launchd, internal adapters for autonomous runtime (RFC-0101 §6)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/session/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/session",
-  "version": "1.1.159",
+  "version": "1.1.161",
   "description": "Session management system for pi-harness-runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/session-api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/session-api",
-  "version": "1.1.159",
+  "version": "1.1.161",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/session-export/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/session-export",
-  "version": "1.1.159",
+  "version": "1.1.161",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/shared-context/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/shared-context",
-  "version": "1.1.159",
+  "version": "1.1.161",
   "description": "pi-harness-runtime — shared-context",
   "type": "module",
   "main": "./dist/index.js",

package/packages/skill-mcp-client/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/skill-mcp-client",
-  "version": "1.1.159",
+  "version": "1.1.161",
   "description": "MCP client for Skills SaaS backend",
   "type": "module",
   "main": "./dist/index.js",

package/packages/skill-registry/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/skill-registry",
-  "version": "1.1.159",
+  "version": "1.1.161",
   "description": "Skill Registry for pi-harness-runtime — dynamic skill discovery and invocation",
   "type": "module",
   "main": "./dist/index.js",