pi-harness-runtime 1.1.160 → 1.1.162

package/packages/notification/src/mask-secrets.ts

@@ -0,0 +1,160 @@
+/**
+ * Secret Masking Utility
+ *
+ * Masks sensitive values in strings before sending to Telegram/other channels.
+ * Shows first 4 + last 4 characters for identification.
+ */
+
+/**
+ * Patterns that match sensitive values
+ */
+const SENSITIVE_PATTERNS: RegExp[] = [
+	// Telegram bot tokens: format is \d+:[-A-Za-z0-9_]{35,}
+	/\d+:[-A-Za-z0-9_]{35,}/g,
+	// Generic API keys, tokens, secrets
+	/[a-zA-Z0-9_-]{32,}/g,                    // Long alphanumeric strings (likely keys)
+	/[A-Fa-f0-9]{32,}/g,                     // Hex strings (likely hashes/keys)
+	/sk-[a-zA-Z0-9]{20,}/g,                   // OpenAI-style keys
+	/Bearer\s+[a-zA-Z0-9_-]{20,}/gi,          // Bearer tokens
+	/token[=:]\s*[a-zA-Z0-9_-]{20,}/gi,      // token=xxx patterns
+	/secret[=:]\s*[a-zA-Z0-9_-]{20,}/gi,      // secret=xxx patterns
+	/key[=:]\s*[a-zA-Z0-9_-]{20,}/gi,         // key=xxx patterns
+	/password[=:]\s*[^\s,}]+/gi,             // password=xxx patterns
+	/client[_-]?secret[=:]\s*[^\s,}]+/gi,     // client_secret=xxx
+	/client[_-]?id[=:]\s*[a-zA-Z0-9_-]{20,}/gi, // client_id=xxx
+	/infisical[_-]?(client[_-])?(secret|id)[=:]\s*[a-zA-Z0-9_-]{20,}/gi,
+];
+
+// Specific Infisical field names to mask
+const INFISICAL_FIELDS = [
+	"infisical_client_secret",
+	"infisical_client_id",
+	"infisical_project_id",
+	"INFISICAL_CLIENT_SECRET",
+	"INFISICAL_CLIENT_ID",
+	"INFISICAL_PROJECT_ID",
+];
+
+// General sensitive field patterns
+const SENSITIVE_FIELD_PATTERNS = [
+	/_api_key$/i,
+	/_secret$/i,
+	/_token$/i,
+	/_password$/i,
+	/_credential$/i,
+	/_auth$/i,
+];
+
+/**
+ * Mask a value showing first and last characters
+ */
+export function maskValue(value: string): string {
+	// Telegram bot tokens use the format \d+:[-A-Za-z0-9_]{35,}
+	// Mask these completely - no prefix/suffix preserved
+	if (/^\d+:[-A-Za-z0-9_]+$/.test(value)) {
+		return "[REDACTED]";
+	}
+
+	// For other values, show first 4 + last 4
+	if (!value || value.length <= 8) {
+		return "****";
+	}
+	return `${value.slice(0, 4)}...${value.slice(-4)}`;
+}
+
+/**
+ * Check if a field name is sensitive
+ */
+export function isSensitiveField(fieldName: string): boolean {
+	const lower = fieldName.toLowerCase();
+
+	// Check specific Infisical fields
+	if (INFISICAL_FIELDS.some(f => lower === f.toLowerCase())) {
+		return true;
+	}
+
+	// Check general patterns
+	return SENSITIVE_FIELD_PATTERNS.some(pattern => pattern.test(lower));
+}
+
+/**
+ * Mask a string value
+ */
+function maskStringValue(input: string): string {
+	let result = input;
+
+	// First, mask any field=value patterns for sensitive fields
+	for (const field of INFISICAL_FIELDS) {
+		const escapedField = field.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+		const pattern = new RegExp(`(${escapedField})\\s*[=:]\\s*([a-zA-Z0-9_-]+)`, "gi");
+		result = result.replace(pattern, (_match, _field, value) => `${field}: ${maskValue(value)}`);
+	}
+
+	// Then mask generic patterns
+	for (const pattern of SENSITIVE_PATTERNS) {
+		result = result.replace(pattern, (match) => maskValue(match));
+	}
+
+	return result;
+}
+
+/**
+ * Mask sensitive patterns in a string
+ */
+export function maskString(input: string): string {
+	return maskStringValue(input);
+}
+
+/**
+ * Mask JSON object fields that are sensitive
+ */
+export function maskObject(obj: unknown, depth: number = 0): Record<string, unknown> | unknown[] | string | number | boolean | null {
+	// Prevent infinite recursion
+	if (depth > 10 || obj === null || obj === undefined) {
+		return obj as null;
+	}
+
+	if (typeof obj === "string") {
+		return maskStringValue(obj);
+	}
+
+	if (typeof obj === "number" || typeof obj === "boolean") {
+		return obj;
+	}
+
+	if (Array.isArray(obj)) {
+		return obj.map(item => maskObject(item, depth + 1));
+	}
+
+	if (typeof obj === "object") {
+		const result: Record<string, unknown> = {};
+		for (const [key, value] of Object.entries(obj as Record<string, unknown>)) {
+			if (isSensitiveField(key)) {
+				result[key] = typeof value === "string" ? maskValue(value) : value;
+			} else {
+				result[key] = maskObject(value, depth + 1);
+			}
+		}
+		return result as Record<string, unknown>;
+	}
+
+	// SAFETY: obj is one of the primitive types at this point
+	return obj as unknown as (Record<string, unknown> | unknown[] | string | number | boolean | null);
+}
+
+/**
+ * Mask a message/notification payload
+ */
+export function maskPayload(obj: unknown): Record<string, unknown> | unknown[] | string | number | boolean | null {
+	return maskObject(obj);
+}
+
+/**
+ * Format a value for display, masking if sensitive
+ */
+export function formatValue(key: string, value: unknown): string {
+	if (isSensitiveField(key) && typeof value === "string") {
+		return `${key}: ${maskValue(value)}`;
+	}
+	return `${key}: ${value}`;
+}

package/packages/observability/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/observability",
-  "version": "1.1.160",
+  "version": "1.1.162",
   "description": "Comprehensive observability system with structured logging, tracing, metrics, and alerting",
   "type": "module",
   "main": "./dist/index.js",

package/packages/okf-indexer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/okf-indexer",
-  "version": "1.1.160",
+  "version": "1.1.162",
   "description": "OKF document indexer for SKILL.md files (RFC-0106)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/paperclip-integration/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/paperclip-integration",
-  "version": "1.1.160",
+  "version": "1.1.162",
   "description": "Paperclip API integration: poll agent inbox, route tasks to pi.dev, Telegram alerts",
   "type": "module",
   "main": "./dist/index.js",

package/packages/performance-optimizer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/performance-optimizer",
-  "version": "1.1.160",
+  "version": "1.1.162",
   "description": "Performance optimization analyzer for pi-harness runtime (RFC-0056)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/privilege-broker/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/privilege-broker",
-  "version": "1.1.160",
+  "version": "1.1.162",
   "description": "Privilege Broker — capability registry and command executor for autonomous runtime (RFC-0101 §7)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/project-analyzer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/project-analyzer",
-  "version": "1.1.160",
+  "version": "1.1.162",
   "description": "Project analysis system for pi-harness-runtime - detects frameworks, rules, and project structure",
   "type": "module",
   "main": "./dist/index.js",

package/packages/project-bootstrap/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/project-bootstrap",
-  "version": "1.1.160",
+  "version": "1.1.162",
   "description": "Project scaffolding from typed ProjectSpec",
   "type": "module",
   "main": "./dist/index.js",

package/packages/projection-engine/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/projection-engine",
-  "version": "1.1.160",
+  "version": "1.1.162",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/prompt-compiler/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/prompt-compiler",
-  "version": "1.1.160",
+  "version": "1.1.162",
   "description": "Deterministic prompt compiler for pi-harness-runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/prompt-versioning/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/prompt-versioning",
-  "version": "1.1.160",
+  "version": "1.1.162",
   "type": "module",
   "description": "Version control for prompts with rollback support (RFC-0019)",
   "main": "dist/index.js",

package/packages/provider-adapter-sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/provider-adapter-sdk",
-  "version": "1.1.160",
+  "version": "1.1.162",
   "description": "SDK for building, testing, and registering AI provider adapters",
   "type": "module",
   "main": "./dist/index.js",

package/packages/provider-router/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/provider-router",
-  "version": "1.1.160",
+  "version": "1.1.162",
   "description": "Enhanced Provider Router for pi-harness-runtime — intelligent routing with capabilities, costs, and quotas",
   "type": "module",
   "main": "./dist/provider-router.js",

package/packages/provider-selector/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/provider-selector",
-  "version": "1.1.160",
+  "version": "1.1.162",
   "description": "Multi-Provider Selector — route requests by cost, quality, and latency (RFC-0012)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/providers/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/providers",
-  "version": "1.1.160",
+  "version": "1.1.162",
   "description": "pi-harness-runtime — providers",
   "type": "module",
   "main": "./dist/index.js",

package/packages/qdrant-skills/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/qdrant-skills",
-  "version": "1.1.160",
+  "version": "1.1.162",
   "description": "Qdrant vector search integration for Hermes-style skill system",
   "type": "module",
   "main": "./dist/index.js",

package/packages/quota-manager/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/quota-manager",
-  "version": "1.1.160",
+  "version": "1.1.162",
   "description": "pi-harness-runtime — quota-manager",
   "type": "module",
   "main": "./dist/index.js",

package/packages/rate-limiter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/rate-limiter",
-  "version": "1.1.160",
+  "version": "1.1.162",
   "type": "module",
   "description": "Rate limiting with token bucket algorithm (RFC-0023)",
   "main": "dist/index.js",

package/packages/react-vite-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/react-vite-plugin",
-  "version": "1.1.160",
+  "version": "1.1.162",
   "description": "React/Vite framework analysis — components, config, TypeScript setup",
   "type": "module",
   "main": "./dist/index.js",

package/packages/release-manager/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/release-manager",
-  "version": "1.1.160",
+  "version": "1.1.162",
   "type": "module",
   "description": "Release management for pi-harness",
   "main": "dist/index.js",

package/packages/requirement-compiler/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/requirement-compiler",
-  "version": "1.1.160",
+  "version": "1.1.162",
   "description": "Compiles raw requirements into validated CompiledRequirement with ambiguity detection and risk tagging",
   "type": "module",
   "main": "./dist/index.js",

package/packages/runtime/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/runtime",
-  "version": "1.1.160",
+  "version": "1.1.162",
   "description": "pi-harness-runtime — runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/scheduler/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/scheduler",
-  "version": "1.1.160",
+  "version": "1.1.162",
   "description": "pi-harness-runtime — scheduler",
   "type": "module",
   "main": "./dist/index.js",

package/packages/scheduler-adapter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/scheduler-adapter",
-  "version": "1.1.160",
+  "version": "1.1.162",
   "description": "Scheduler Adapter — cron, systemd, launchd, internal adapters for autonomous runtime (RFC-0101 §6)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/session/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/session",
-  "version": "1.1.160",
+  "version": "1.1.162",
   "description": "Session management system for pi-harness-runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/session-api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/session-api",
-  "version": "1.1.160",
+  "version": "1.1.162",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/session-export/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/session-export",
-  "version": "1.1.160",
+  "version": "1.1.162",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/shared-context/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/shared-context",
-  "version": "1.1.160",
+  "version": "1.1.162",
   "description": "pi-harness-runtime — shared-context",
   "type": "module",
   "main": "./dist/index.js",

package/packages/skill-mcp-client/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/skill-mcp-client",
-  "version": "1.1.160",
+  "version": "1.1.162",
   "description": "MCP client for Skills SaaS backend",
   "type": "module",
   "main": "./dist/index.js",

package/packages/skill-registry/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/skill-registry",
-  "version": "1.1.160",
+  "version": "1.1.162",
   "description": "Skill Registry for pi-harness-runtime — dynamic skill discovery and invocation",
   "type": "module",
   "main": "./dist/index.js",

package/packages/skills/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/skills",
-  "version": "1.1.160",
+  "version": "1.1.162",
   "description": "File-based skill system with pi.dev compatibility and Hermes self-improvement",
   "type": "module",
   "main": "src/index.ts",

package/packages/sprint-planner/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/sprint-planner",
-  "version": "1.1.160",
+  "version": "1.1.162",
   "type": "module",
   "description": "Sprint planning engine for pi-harness",
   "main": "dist/index.js",

package/packages/subscription-engine/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/subscription-engine",
-  "version": "1.1.160",
+  "version": "1.1.162",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/task-compiler/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/task-compiler",
-  "version": "1.1.160",
+  "version": "1.1.162",
   "description": "Task Compiler for pi-harness-runtime — produces deterministic task DAG from CompiledRequirement",
   "type": "module",
   "main": "./dist/index.js",

package/packages/tencentdb-memory/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moocoding/tencentdb-memory",
-  "version": "1.1.160",
+  "version": "1.1.162",
   "description": "TencentDB Agent Memory client - sync skills to centralized knowledge base",
   "type": "module",
   "main": "src/index.ts",

package/packages/tencentdb-sync/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/tencentdb-sync",
-  "version": "1.1.160",
+  "version": "1.1.162",
   "description": "Sync SKILL.md skills to TencentDB-Agent-Memory server (RFC-0105/0106)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/test-data-generator/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/test-data-generator",
-  "version": "1.1.160",
+  "version": "1.1.162",
   "description": "Test data generation for pi-harness-runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/test-generator/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/test-generator",
-  "version": "1.1.160",
+  "version": "1.1.162",
   "description": "Auto-Test Generator — generate unit and E2E tests from source code (RFC-0013)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/todo-bd-sync/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moocoding/todo-bd-sync",
-  "version": "1.1.160",
+  "version": "1.1.162",
   "description": "Two-way sync between rpiv-todo overlay and bd issue tracker",
   "type": "module",
   "main": "src/index.ts",

package/packages/token-estimation/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/token-estimation",
-  "version": "1.1.160",
+  "version": "1.1.162",
   "description": "pi-harness-runtime — token-estimation",
   "type": "module",
   "main": "./dist/index.js",

package/packages/token-optimizer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/token-optimizer",
-  "version": "1.1.160",
+  "version": "1.1.162",
   "description": "Token Budget Optimizer — maximize prompt value within token limits (RFC-0011)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/trajectory/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/trajectory",
-  "version": "1.1.160",
+  "version": "1.1.162",
   "description": "Trajectory capture for the write-review loop — persists cycle records for learning",
   "type": "module",
   "main": "./dist/src/index.js",

package/packages/tui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/tui",
-  "version": "1.1.160",
+  "version": "1.1.162",
   "description": "pi-harness-runtime — tui",
   "type": "module",
   "main": "./dist/index.js",

package/packages/types/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/types",
-  "version": "1.1.160",
+  "version": "1.1.162",
   "description": "Shared TypeScript types for pi-harness-runtime packages",
   "type": "module",
   "main": "./src/index.js",

package/packages/workflow-events/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/workflow-events",
-  "version": "1.1.160",
+  "version": "1.1.162",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/workspace-scanner/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/workspace-scanner",
-  "version": "1.1.160",
+  "version": "1.1.162",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/worktree/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/worktree",
-  "version": "1.1.160",
+  "version": "1.1.162",
   "description": "pi-harness-runtime — worktree",
   "type": "module",
   "main": "./dist/index.js",

package/packages/write-review/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moocoding/write-review",
-  "version": "1.1.160",
+  "version": "1.1.162",
   "description": "Two-agent write-review loop with blackboard coordination",
   "type": "module",
   "main": "src/index.ts",