pi-harness-runtime 1.1.183 → 1.1.185

package/harness/honcho-memory.ts

@@ -12,79 +12,151 @@
  */
 
 import { logServiceEvent, honchoStatus } from "./service-diagnostics.js";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { honchoToolCall } from "./honcho-init.js";
+import { existsSync, mkdirSync, readFileSync, writeFileSync, renameSync, unlinkSync } from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";
 
 // ---------------------------------------------------------------------------
-// Auto-create MCP config for Honcho Cloud
-// ----------------------------------------------------------------------------
+// Honcho MCP Configuration (non-destructive)
+// ---------------------------------------------------------------------------
 
 const MCP_CONFIG_DIR = join(homedir(), ".config", "mcp");
 const MCP_CONFIG_FILE = join(MCP_CONFIG_DIR, "mcp.json");
 const HONCHO_KEY_FILE = join(homedir(), ".pi-harness-runtime", "keys", "honcho-api-key.txt");
 
-function ensureMcpConfig(): void {
-	// Create config directory if needed
+/**
+ * Secrets to redact from messages before transmission.
+ * These patterns are checked case-insensitively.
+ * Matches: key=VALUE, key: VALUE, key: Bearer VALUE, etc.
+ * For compound keys like api_key, match the full key name.
+ */
+const SECRET_PATTERNS: (string | RegExp)[] = [
+	// Compound patterns (check first, more specific)
+	"api[_-]?key",
+	"honcho[_-]?api[_-]?key",
+	"minimax[_-]?api[_-]?key",
+	"openai[_-]?api[_-]?key",
+	// Simple patterns
+	"auth",
+	"authorization",
+	"bearer",
+	"token",
+	"secret",
+	"password",
+	"credential",
+];
+
+/**
+ * Redact secrets from text content.
+ * Replaces secret VALUES with [REDACTED].
+ * Handles: password=VALUE, password: VALUE, auth: Bearer VALUE, etc.
+ */
+function redactSecrets(text: string): string {
+	let result = text;
+	for (const pattern of SECRET_PATTERNS) {
+		if (typeof pattern === "string") {
+			// Escape special regex chars in pattern string
+			const escaped = pattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+			// Match key=VALUE, key: VALUE, key: Bearer VALUE patterns
+			// Allow optional space after colon and multi-word values
+			// The separator can be =, :, or _ (for compound keys like api_key_value)
+			const regex = new RegExp(
+				`(${escaped})(?:[_=:]\\s*)(\\S+(?:\\s+\\S+)*)`,
+				"gi"
+			);
+			result = result.replace(regex, "$1=[REDACTED]");
+		} else {
+			// For regex patterns, redact the entire match
+			// Add 'g' flag if not present
+			const flags = pattern.flags.includes("g") ? pattern.flags : pattern.flags + "g";
+			const globalPattern = new RegExp(pattern.source, flags);
+			result = result.replace(globalPattern, "[REDACTED]");
+		}
+	}
+	return result;
+}
+
+/**
+ * Ensure MCP config directory exists (non-destructive).
+ * Does NOT write config at import time.
+ */
+export function ensureMcpConfigDirectory(): void {
 	if (!existsSync(MCP_CONFIG_DIR)) {
 		mkdirSync(MCP_CONFIG_DIR, { recursive: true, mode: 0o755 });
 	}
+}
 
-	// Check if Honcho MCP is already configured with real key
-	if (existsSync(MCP_CONFIG_FILE)) {
+/**
+ * Load Honcho API key from keys directory.
+ * Does NOT write config files.
+ */
+export function loadHonchoApiKey(): string | undefined {
+	if (existsSync(HONCHO_KEY_FILE)) {
 		try {
-			const content = readFileSync(MCP_CONFIG_FILE, "utf8");
-			const config = JSON.parse(content);
-			if (config.mcpServers?.honcho?.bearerToken &&
-				config.mcpServers.honcho.bearerToken !== "YOUR_HONCHO_API_KEY") {
-				return; // Already configured with real key
-			}
+			return readFileSync(HONCHO_KEY_FILE, "utf8").trim() || undefined;
 		} catch {
-			// Invalid JSON, will overwrite
+			return undefined;
 		}
 	}
+	return undefined;
+}
 
-	// Try to read API key from keys directory
-	let apiKey = "";
-	if (existsSync(HONCHO_KEY_FILE)) {
-		try {
-			apiKey = readFileSync(HONCHO_KEY_FILE, "utf8").trim();
-		} catch {
-			// Will use placeholder
-		}
+/**
+ * Read existing MCP config (non-destructive).
+ * Returns null if config doesn't exist or is invalid.
+ */
+export function readMcpConfig(): Record<string, unknown> | null {
+	if (!existsSync(MCP_CONFIG_FILE)) {
+		return null;
 	}
+	try {
+		const content = readFileSync(MCP_CONFIG_FILE, "utf8");
+		return JSON.parse(content);
+	} catch {
+		return null;
+	}
+}
 
-	// Create config with proper Honcho MCP headers
-	const config = {
-		mcpServers: {
-			honcho: {
-				url: "https://mcp.honcho.dev",
-				headers: {
-					Authorization: `Bearer ${apiKey || "YOUR_HONCHO_API_KEY"}`,
-				},
-			},
+/**
+ * Write MCP config atomically (non-destructive).
+ * Only updates the Honcho server entry, preserves other entries.
+ */
+export function writeHonchoMcpConfig(apiKey: string): void {
+	ensureMcpConfigDirectory();
+
+	// Read existing config or create new one
+	let config: Record<string, unknown> = readMcpConfig() || { mcpServers: {} };
+	if (!config.mcpServers || typeof config.mcpServers !== "object") {
+		config = { mcpServers: {} };
+	}
+
+	// Update Honcho entry
+	const mcpServers = config.mcpServers as Record<string, unknown>;
+	mcpServers.honcho = {
+		url: "https://mcp.honcho.dev",
+		headers: {
+			Authorization: `Bearer ${apiKey}`,
 		},
 	};
 
+	// Atomic write with temp file
+	const tempFile = `${MCP_CONFIG_FILE}.tmp`;
+	writeFileSync(tempFile, JSON.stringify(config, null, 2), { mode: 0o644 });
 	try {
-		writeFileSync(MCP_CONFIG_FILE, JSON.stringify(config, null, 2), { mode: 0o644 });
-		if (apiKey) {
-			console.log("[honcho] MCP config created with key from:", HONCHO_KEY_FILE);
-		} else {
-			console.log("[honcho] MCP config created at:", MCP_CONFIG_FILE);
-			console.log("[honcho] NOTE: Run: echo \"YOUR_KEY\" > ~/.pi-harness-runtime/keys/honcho-api-key.txt");
-		}
-	} catch (err) {
-		console.warn("[honcho] Failed to create MCP config:", err);
+		// Verify the temp file is valid JSON before renaming
+		JSON.parse(readFileSync(tempFile, "utf8"));
+		renameSync(tempFile, MCP_CONFIG_FILE);
+	} catch {
+		// Clean up invalid temp file
+		try { unlinkSync(tempFile); } catch { /* ignore */ }
+		throw new Error("Failed to write valid MCP config");
 	}
 }
 
-// Auto-create MCP config on module load
-ensureMcpConfig();
-
 // ---------------------------------------------------------------------------
 // Honcho Health Check - Detect suspended accounts
-// ----------------------------------------------------------------------------
+// ---------------------------------------------------------------------------
 
 interface HonchoHealthResponse {
   status: string;
@@ -96,13 +168,8 @@ let _honchoHealthInterval: ReturnType<typeof setInterval> | null = null;
 const HONCHO_HEALTH_CHECK_INTERVAL = 5 * 60 * 1000; // Check every 5 minutes
 const HONCHO_HEALTH_ENDPOINT = "https://api.honcho.dev/v1/health";
 
-// Start only after the timer state and health-check constants are initialized.
-startHonchoHealthCheck();
-
 async function checkHonchoHealth(): Promise<void> {
-  const apiKey = existsSync(HONCHO_KEY_FILE)
-    ? readFileSync(HONCHO_KEY_FILE, "utf8").trim()
-    : null;
+  const apiKey = loadHonchoApiKey();
 
   if (!apiKey) {
     return; // No key, skip health check
@@ -166,6 +233,10 @@ export function stopHonchoHealthCheck(): void {
   }
 }
 
+// ---------------------------------------------------------------------------
+// Honcho Memory Implementation
+// ---------------------------------------------------------------------------
+
 /**
  * Honcho memory configuration
  */
@@ -178,6 +249,8 @@ export interface HonchoMemoryConfig {
   userPeerId?: string;
   /** Assistant peer ID */
   assistantPeerId?: string;
+  /** Session ID for memory storage */
+  sessionId?: string;
   /** Max context size to inject (chars) */
   maxContextChars?: number;
   /** Enable auto-ingestion */
@@ -201,6 +274,8 @@ export class HonchoMemory {
   private isConnected = false;
   private toolsDiscovered = false;
   private workspaceId: string | null = null;
+  private sessionId: string | null = null;
+  private _disposed = false;
 
   constructor(config: HonchoMemoryConfig) {
     this.config = {
@@ -208,6 +283,8 @@ export class HonchoMemory {
       autoIngest: true,
       ...config,
     };
+    // Store session ID from config
+    this.sessionId = config.sessionId ?? null;
   }
 
   /**
@@ -258,6 +335,21 @@ export class HonchoMemory {
     });
   }
 
+  /**
+   * Set session ID for memory storage
+   */
+  setSession(sessionId: string): void {
+    this.sessionId = sessionId;
+    logServiceEvent({
+      ts: new Date().toISOString(),
+      level: "info",
+      service: "honcho",
+      operation: "session_created",
+      phase: "completed",
+      sessionId,
+    });
+  }
+
   /**
    * Check if memory is ready
    */
@@ -266,15 +358,18 @@ export class HonchoMemory {
   }
 
   /**
-   * Generate deduplication ID for a message
+   * Generate stable deduplication ID for a message.
+   * Uses content hash + event identity (not current time) for retry stability.
    */
-  private generateMessageId(
+  generateMessageId(
+    eventId: string,
     role: string,
     content: string,
     timestamp: Date
   ): string {
-    // Simple hash-based ID for deduplication
-    const data = `${role}:${content}:${timestamp.toISOString()}`;
+    // Stable hash: eventId ensures retry stability
+    // timestamp is from the original event, not Date.now()
+    const data = `${eventId}:${role}:${content}:${timestamp.toISOString()}`;
     let hash = 0;
     for (let i = 0; i < data.length; i++) {
       const char = data.charCodeAt(i);
@@ -285,39 +380,70 @@ export class HonchoMemory {
   }
 
   /**
-   * Sanitize message content for storage
-   * Removes sensitive data, tool calls, etc.
+   * Sanitize message content for storage.
+   * Redacts secrets and enforces total payload bound.
    */
-  private sanitizeContent(
+  sanitizeContent(
     content: string | Array<{ type?: string; text?: string }>
-  ): string {
-    if (typeof content === "string") {
-      // Truncate very long messages
-      return content.slice(0, 2000);
-    }
+  ): { text: string; originalLength: number } {
+    let text: string;
 
-    // Handle array content (TextContent blocks)
-    if (Array.isArray(content)) {
-      return content
+    if (typeof content === "string") {
+      text = content;
+    } else if (Array.isArray(content)) {
+      text = content
         .filter((block) => block.type === "text")
-        .map((block) => {
-          const text = (block as { text?: string }).text ?? "";
-          return text.slice(0, 2000);
-        })
+        .map((block) => (block as { text?: string }).text ?? "")
         .join("\n");
+    } else {
+      text = String(content);
+    }
+
+    const originalLength = text.length;
+
+    // Step 1: Redact secrets before truncation
+    text = redactSecrets(text);
+
+    // Step 2: Truncate to per-block limit
+    const BLOCK_LIMIT = 2000;
+    if (text.length > BLOCK_LIMIT) {
+      text = text.slice(0, BLOCK_LIMIT) + "...[truncated]";
+    }
+
+    // Step 3: Enforce total payload bound (separate limit for ingestion vs retrieval)
+    const TOTAL_LIMIT = 10000;
+    if (text.length > TOTAL_LIMIT) {
+      text = text.slice(0, TOTAL_LIMIT) + "...[payload truncated]";
     }
 
-    return String(content).slice(0, 2000);
+    return { text, originalLength };
   }
 
   /**
-   * Ingest a completed turn message
+   * Call a Honcho MCP tool through the adapter.
+   * Uses the honchoToolCall from honcho-init.ts.
+   */
+  private async callHonchoTool(
+    toolName: string,
+    args: Record<string, unknown>
+  ): Promise<{ success: boolean; result?: unknown; error?: string }> {
+    return await honchoToolCall(toolName, args);
+  }
+
+  /**
+   * Ingest a completed turn message through Honcho MCP.
+   * Persists only after verified successful response.
    */
   async ingestMessage(
     role: "user" | "assistant",
     content: string | Array<{ type?: string; text?: string }>,
-    timestamp: Date = new Date()
+    timestamp: Date = new Date(),
+    eventId: string = `msg-${timestamp.getTime()}`
   ): Promise<{ success: boolean; deduped: boolean; error?: string }> {
+    if (this._disposed) {
+      return { success: false, deduped: false, error: "memory disposed" };
+    }
+
     if (!this.isReady()) {
       return { success: false, deduped: false, error: "memory not ready" };
     }
@@ -326,9 +452,10 @@ export class HonchoMemory {
       return { success: false, deduped: false, error: "auto-ingest disabled" };
     }
 
-    const messageId = this.generateMessageId(role, String(content), timestamp);
+    const { text: sanitized, originalLength } = this.sanitizeContent(content);
+    const messageId = this.generateMessageId(eventId, role, sanitized, timestamp);
 
-    // Check deduplication
+    // Check deduplication BEFORE any remote call
     if (this.ingestedMessages.has(messageId)) {
       logServiceEvent({
         ts: new Date().toISOString(),
@@ -342,22 +469,34 @@ export class HonchoMemory {
       return { success: true, deduped: true };
     }
 
-    const sanitized = this.sanitizeContent(content);
+    logServiceEvent({
+      ts: new Date().toISOString(),
+      level: "info",
+      service: "honcho",
+      operation: "ingest_started",
+      phase: "start",
+      role,
+      messageLength: sanitized.length,
+      originalLength,
+    });
 
     try {
-      // Call Honcho add_messages_to_session tool
-      // Note: This assumes the MCP tool is available through the adapter
-      logServiceEvent({
-        ts: new Date().toISOString(),
-        level: "info",
-        service: "honcho",
-        operation: "ingest_started",
-        phase: "start",
+      // Call Honcho MCP tool through the adapter
+      // Use sessionId if available, fall back to workspaceId
+      const targetSessionId = this.sessionId ?? this.workspaceId;
+      const result = await this.callHonchoTool("add_message", {
+        session_id: targetSessionId,
         role,
-        messageLength: sanitized.length,
+        content: sanitized,
+        message_id: messageId,
+        timestamp: timestamp.toISOString(),
       });
 
-      // Store message for deduplication
+      if (!result.success) {
+        throw new Error(result.error || "Tool call failed");
+      }
+
+      // Record success ONLY after verified response
       this.ingestedMessages.set(messageId, {
         id: messageId,
         ingestedAt: timestamp,
@@ -403,7 +542,8 @@ export class HonchoMemory {
   }
 
   /**
-   * Retrieve relevant context before agent execution
+   * Retrieve relevant context from Honcho MCP.
+   * Returns real retrieved content, never fabricates.
    */
   async retrieveContext(query: string): Promise<{
     success: boolean;
@@ -411,24 +551,55 @@ export class HonchoMemory {
     empty: boolean;
     error?: string;
   }> {
+    if (this._disposed) {
+      return { success: false, context: "", empty: true, error: "memory disposed" };
+    }
+
     if (!this.isReady()) {
       return { success: false, context: "", empty: true, error: "memory not ready" };
     }
 
+    logServiceEvent({
+      ts: new Date().toISOString(),
+      level: "info",
+      service: "honcho",
+      operation: "retrieve_started",
+      phase: "start",
+      queryLength: query.length,
+    });
+
     try {
-      logServiceEvent({
-        ts: new Date().toISOString(),
-        level: "info",
-        service: "honcho",
-        operation: "retrieve_started",
-        phase: "start",
-        queryLength: query.length,
+      // Call Honcho get_session_context tool through the adapter
+      // Use sessionId if available, fall back to workspaceId
+      const targetSessionId = this.sessionId ?? this.workspaceId;
+      const result = await this.callHonchoTool("get_context", {
+        session_id: targetSessionId,
+        query,
+        limit: 10,
       });
 
-      // Call Honcho get_session_context tool
-      // Note: This assumes the MCP tool is available through the adapter
+      if (!result.success) {
+        throw new Error(result.error || "Tool call failed");
+      }
+
+      // Parse actual response content
+      let context = "";
+      if (result.result && typeof result.result === "object") {
+        const response = result.result as Record<string, unknown>;
+        // Extract context from response based on actual Honcho API shape
+        context = (response.content as string) ||
+                  (response.messages as string[])?.join("\n") ||
+                  JSON.stringify(response);
+      }
+
+      // Apply max context chars limit
+      const maxChars = this.config.maxContextChars ?? 4000;
+      if (context.length > maxChars) {
+        context = context.slice(0, maxChars) + "...[context truncated]";
+      }
 
-      const context = `Retrieved context for: ${query.slice(0, 100)}...`;
+      // Empty retrieval is a valid result, not a fabricated context
+      const isEmpty = context.trim().length === 0;
 
       logServiceEvent({
         ts: new Date().toISOString(),
@@ -437,6 +608,7 @@ export class HonchoMemory {
         operation: "retrieve_succeeded",
         phase: "completed",
         contextLength: context.length,
+        empty: isEmpty,
       });
 
       honchoStatus.recordSuccess("retrieve", undefined, { contextLength: context.length });
@@ -444,7 +616,7 @@ export class HonchoMemory {
       return {
         success: true,
         context,
-        empty: context.length === 0,
+        empty: isEmpty,
       };
     } catch (err) {
       const error = err instanceof Error ? err.message : String(err);
@@ -459,6 +631,7 @@ export class HonchoMemory {
 
       honchoStatus.recordFailure("retrieve", "unknown", { error });
 
+      // On failure, return empty context (don't fabricate)
       return { success: false, context: "", empty: true, error };
     }
   }
@@ -481,4 +654,24 @@ export class HonchoMemory {
       ingestedCount: this.ingestedMessages.size,
     };
   }
+
+  /**
+   * Dispose of the memory instance.
+   * Stops timers, clears state, prevents further operations.
+   */
+  dispose(): void {
+    this._disposed = true;
+    this.ingestedMessages.clear();
+    honchoStatus.setConnected(false);
+    logServiceEvent({
+      ts: new Date().toISOString(),
+      level: "info",
+      service: "honcho",
+      operation: "disposed",
+      phase: "completed",
+    });
+  }
 }
+
+// Export redactSecrets for testing
+export { redactSecrets };

package/harness/service-commands.ts

@@ -116,6 +116,8 @@ async function handleTestJev(ctx: ExtensionContext, flags: Record<string, string
 
 /**
  * Handle /harness-services test honcho --read-only
+ * Checks Honcho integration status through the MCP adapter.
+ * Does NOT create sessions/peers, write messages, or claim success when only flags were inspected.
  */
 async function handleTestHoncho(ctx: ExtensionContext, flags: Record<string, string | boolean>): Promise<void> {
   if (flags.read_only !== true && flags.read_only !== "true") {
@@ -126,9 +128,32 @@ async function handleTestHoncho(ctx: ExtensionContext, flags: Record<string, str
   ctx.ui.notify("[services] Testing Honcho MCP connection...", "info");
 
   try {
-    ctx.ui.notify("[services] Honcho status: registered=true, connected=" + honchoStatus.connected, "info");
-    ctx.ui.notify("[services] Honcho tools discovery: would call tools/list if --read-only not set", "info");
-    ctx.ui.notify("[services] Honcho test completed (read-only mode)", "info");
+    // Report actual registration status from the status tracker
+    ctx.ui.notify(`[services] Honcho configured: ${honchoStatus.configured}`, "info");
+    ctx.ui.notify(`[services] Honcho connected: ${honchoStatus.connected}`, "info");
+    ctx.ui.notify(`[services] Honcho feature enabled: ${honchoStatus.featureEnabled}`, "info");
+
+    // Check if MCP adapter is available via globalThis
+    const piEvents = (globalThis as { pi?: { events?: { emit: (event: string, req: unknown) } } }).pi?.events;
+
+    if (!piEvents) {
+      ctx.ui.notify("[services] Honcho test skipped: MCP adapter not available (pi.events)", "warning");
+      ctx.ui.notify("[services] Note: Install pi-mcp-adapter to enable Honcho MCP", "info");
+      return;
+    }
+
+    // For read-only test, report current status from our tracker
+    // A full MCP tool discovery would require a non-read-only request
+    if (honchoStatus.connected) {
+      ctx.ui.notify("[services] Honcho MCP server is connected", "info");
+      ctx.ui.notify("[services] Honcho test completed successfully", "info");
+    } else if (honchoStatus.configured) {
+      ctx.ui.notify("[services] Honcho MCP server not yet connected", "warning");
+      ctx.ui.notify("[services] Connection will be established on first use", "info");
+    } else {
+      ctx.ui.notify("[services] Honcho MCP not configured", "warning");
+      ctx.ui.notify("[services] Add API key to enable Honcho memory", "info");
+    }
   } catch (err) {
     const error = err instanceof Error ? err.message : String(err);
     ctx.ui.notify(`[services] Honcho test failed: ${error}`, "error");