pi-harness-runtime 1.1.183 → 1.1.185

package/packages/agent-policy/src/extension.ts

@@ -24,6 +24,7 @@ import {
   renderFullRules, 
 } from "./policy-renderer.js";
 import { classifyToolCall } from "./types.js";
+import { randomUUID } from "node:crypto";
 
 // ---------------------------------------------------------------------------
 // Extension Registration
@@ -43,6 +44,7 @@ export function registerAgentPolicy(
   
   const store = getPolicyStore();
   const toolClassifier = config.toolClassifier ?? classifyToolCall;
+  const fallbackSessionId = `policy-${randomUUID()}`;
 
   // Track if pi-lens is available
   let piLensAvailable = false;
@@ -65,7 +67,7 @@ export function registerAgentPolicy(
       const manifest = await loader.load(cwd);
       
       // Record delivery in store
-      const sessionId = getSessionIdFromCtx(ctx);
+      const sessionId = getSessionIdFromCtx(ctx, fallbackSessionId);
       const receipt = store.noteDelivered(
         sessionId,
         manifest,
@@ -113,7 +115,7 @@ Use harness_rules to check policy status.
     }
 
     const cwd = getCwdFromContext(ctx);
-    const sessionId = getSessionIdFromCtx(ctx);
+    const sessionId = getSessionIdFromCtx(ctx, fallbackSessionId);
     const targetPath = capability.affectedPaths?.[0];
 
     try {
@@ -121,7 +123,7 @@ Use harness_rules to check policy status.
       const receipt = store.getReceipt(sessionId, manifest.projectRoot);
 
       // Check if current revision is covered
-      if (!receipt || receipt.revision !== manifest.revision) {
+      if (config.requireReceiptBeforeMutation && (!receipt || receipt.revision !== manifest.revision)) {
         const blockReason = receipt
           ? `Policy revision changed (expected ${manifest.revision}, received ${receipt.revision})`
           : `Policy revision ${manifest.revision} not yet delivered`;
@@ -200,8 +202,8 @@ Use harness_rules to check policy status.
     } as const,
 
     async execute(_toolCallId, params, _signal, _onUpdate, ctx) {
-      const cwd = ctx.cwd;
-      const sessionId = getSessionIdFromCtx(ctx);
+      const cwd = getCwdFromContext(ctx);
+      const sessionId = getSessionIdFromCtx(ctx, fallbackSessionId);
 
       try {
         const input = params as HarnessRulesInput;
@@ -324,7 +326,7 @@ Use harness_rules to check policy status.
   // ---------------------------------------------------------------------------
   
   pi.on("session_start", (_event: SessionStartEvent, ctx: unknown) => {
-    const sessionId = getSessionIdFromCtx(ctx);
+    const sessionId = getSessionIdFromCtx(ctx, fallbackSessionId);
     const cwd = getCwdFromContext(ctx);
     
     console.log(`[agent-policy] Session started: ${sessionId} in ${cwd}`);
@@ -348,8 +350,13 @@ Use harness_rules to check policy status.
 /**
  * Extract session ID from context.
  */
-function getSessionIdFromCtx(ctx: unknown): string {
+function getSessionIdFromCtx(ctx: unknown, fallbackSessionId: string): string {
   const ctxObj = ctx as Record<string, unknown>;
+  const manager = ctxObj?.sessionManager as { getSessionId?: () => string } | undefined;
+  const managedId = manager?.getSessionId?.();
+  if (typeof managedId === "string" && managedId) {
+    return managedId;
+  }
   
   if (typeof ctxObj?.sessionId === "string") {
     return ctxObj.sessionId;
@@ -359,8 +366,8 @@ function getSessionIdFromCtx(ctx: unknown): string {
     return ctxObj.id;
   }
   
-  // Fallback to a generated ID
-  return `session-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+  // Legacy hosts without session identity must reuse the registration's ID.
+  return fallbackSessionId;
 }
 
 /**

package/packages/agent-policy/src/policy-loader.ts

@@ -87,28 +87,11 @@ export class PolicyLoader {
    * Load policy for a specific target file (considers scoped rules).
    */
   async loadForTarget(projectRoot: string, targetPath?: string): Promise<PolicyManifest> {
-    if (!targetPath) {
-      return this.load(projectRoot);
-    }
-
-    // Check if target is in a specific scope
-    const relativePath = relative(projectRoot, targetPath);
-    const scope = this.inferScope(relativePath);
-    
-    const manifest = await this.load(projectRoot);
-    
-    // Filter sources to only those applicable to this scope
-    if (scope) {
-      manifest.sources = manifest.sources.filter(s => 
-        s.scope === "" || scope.startsWith(s.scope) || s.scope.startsWith(scope)
-      );
-      // Recompute revision if sources changed
-      if (manifest.sources.length > 0) {
-        manifest.revision = this.computeRevision(manifest.sources);
-      }
-    }
-    
-    return manifest;
+    // The current loader collects only project-root and ancestor rules, all of
+    // which apply to every target. Use the same manifest as harness_rules.
+    // Filtering here mutated the cached manifest, dropped ancestor rules, and
+    // hashed advisory sources that load() deliberately excludes from revision.
+    return this.load(projectRoot);
   }
 
   /**

package/packages/agent-policy/test/interlock.test.ts

@@ -0,0 +1,101 @@
+import { afterEach, beforeEach, expect, test } from "bun:test";
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { pathToFileURL } from "node:url";
+import { registerAgentPolicy } from "../src/extension.js";
+import { PolicyLoader } from "../src/policy-loader.js";
+import { resetPolicyStore } from "../src/policy-store.js";
+
+let root: string;
+let cwd: string;
+let harnessRulesPath: URL;
+beforeEach(() => {
+  resetPolicyStore();
+  root = mkdtempSync(join(tmpdir(), "policy-interlock-"));
+  cwd = join(root, "project");
+  mkdirSync(join(cwd, "src"), { recursive: true });
+  mkdirSync(join(cwd, ".git"));
+  writeFileSync(join(root, "harness.md"), "Harness mandatory rules");
+  writeFileSync(join(root, "AGENTS.md"), "Ancestor mandatory rules");
+  writeFileSync(join(cwd, "AGENTS.md"), "Project mandatory rules");
+  writeFileSync(join(cwd, "RULES.md"), "Advisory rules");
+  harnessRulesPath = pathToFileURL(join(root, "harness.md"));
+});
+afterEach(() => rmSync(root, { recursive: true, force: true }));
+
+function runtime(requireReceiptBeforeMutation = true) {
+  const hooks = new Map<string, Function[]>();
+  let tool: any;
+  registerAgentPolicy({
+    on(name: string, handler: Function) {
+      hooks.set(name, [...(hooks.get(name) ?? []), handler]);
+    },
+    registerTool(value: unknown) { tool = value; },
+  } as any, { harnessRulesPath, requireReceiptBeforeMutation, lspMode: "pi-lens" });
+  return {
+    call: (params: unknown, ctx: unknown) => tool.execute("test", params, undefined, undefined, ctx),
+    gate: (ctx: unknown, path = "src/file.ts") => hooks.get("tool_call")![0](
+      { toolName: "edit", input: { path } }, ctx),
+  };
+}
+
+test("target checks preserve mandatory revision, ancestor rules, and cached manifest", async () => {
+  const loader = new PolicyLoader({ harnessRulesPath });
+  const manifest = await loader.load(cwd);
+  const snapshot = JSON.stringify(manifest);
+  for (const path of ["src/file.ts", join(cwd, "src/file.ts"), "packages/a/file.ts"]) {
+    const target = await loader.loadForTarget(cwd, path);
+    expect(target.revision).toBe(manifest.revision);
+    expect(target.sources.some(s => s.path === join(root, "AGENTS.md"))).toBe(true);
+    expect(JSON.stringify(manifest)).toBe(snapshot);
+  }
+  loader.invalidateCache();
+  expect((await loader.load(cwd)).revision).toBe(manifest.revision);
+});
+
+test("acknowledgment unlocks the next target call using Pi sessionManager identity", async () => {
+  const r = runtime();
+  const context = (id = "session-a") => ({ cwd, sessionManager: { getSessionId: () => id } });
+  expect((await r.gate(context())).block).toBe(true);
+  const revision = (await r.call({ action: "manifest" }, context())).details.manifest.revision;
+  expect((await r.call({ action: "acknowledge", revision }, context())).isError).not.toBe(true);
+  expect((await r.gate(context())).block).not.toBe(true);
+  expect((await r.gate(context(), join(cwd, "src/file.ts"))).block).not.toBe(true);
+  expect((await r.gate(context("session-b"))).block).toBe(true);
+});
+
+test("legacy contexts reuse a stable fallback identity", async () => {
+  const r = runtime();
+  const revision = (await r.call({ action: "manifest" }, { cwd })).details.manifest.revision;
+  await r.call({ action: "acknowledge", revision }, { cwd });
+  expect((await r.gate({ cwd })).block).not.toBe(true);
+});
+
+test("explicitly disabled receipt enforcement allows tools without an acknowledgment", async () => {
+  const r = runtime(false);
+  expect((await r.gate({ cwd })).block).not.toBe(true);
+});
+
+test("wrong revisions remain rejected when receipt enforcement is enabled", async () => {
+  const r = runtime();
+  const ctx = { cwd, sessionId: "session-a" };
+  const result = await r.call({ action: "acknowledge", revision: "stale" }, ctx);
+  expect(result.isError).toBe(true);
+  expect((await r.gate(ctx)).block).toBe(true);
+});
+
+test("rule changes still require a new receipt after policy cache refresh", async () => {
+  const r = runtime();
+  const ctx = { cwd, sessionId: "session-a" };
+  const revision = (await r.call({ action: "manifest" }, ctx)).details.manifest.revision;
+  await r.call({ action: "acknowledge", revision }, ctx);
+  writeFileSync(join(cwd, "AGENTS.md"), "Updated mandatory rules");
+  // A fresh loader/registration models cache refresh without a five-second wait.
+  const refreshed = runtime();
+  expect((await refreshed.gate(ctx)).block).toBe(true);
+  const current = (await refreshed.call({ action: "manifest" }, ctx)).details.manifest.revision;
+  expect(current).not.toBe(revision);
+  await refreshed.call({ action: "acknowledge", revision: current }, ctx);
+  expect((await refreshed.gate(ctx)).block).not.toBe(true);
+});

package/packages/architecture-generator/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/architecture-generator",
-  "version": "1.1.183",
+  "version": "1.1.185",
   "description": "Generate ADR and Mermaid diagrams from project analysis",
   "type": "module",
   "main": "./dist/index.js",

package/packages/auth/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/auth",
-  "version": "1.1.183",
+  "version": "1.1.185",
   "description": "pi-harness-runtime — auth",
   "type": "module",
   "main": "./dist/index.js",

package/packages/autonomous-refactor/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/autonomous-refactor",
-  "version": "1.1.183",
+  "version": "1.1.185",
   "type": "module",
   "description": "Autonomous refactoring engine",
   "main": "dist/index.js",

package/packages/autonomous-runtime/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/autonomous-runtime",
-  "version": "1.1.183",
+  "version": "1.1.185",
   "description": "Autonomous Operations Runtime — task inbox, lease management, and worker lifecycle (RFC-0101)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/cache-strategy/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/cache-strategy",
-  "version": "1.1.183",
+  "version": "1.1.185",
   "type": "module",
   "description": "Smart caching with TTL and invalidation strategies (RFC-0022)",
   "main": "dist/index.js",

package/packages/capability-registry/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/capability-registry",
-  "version": "1.1.183",
+  "version": "1.1.185",
   "description": "Capability Registry for pi-harness-runtime — tracks model capabilities and enables capability-based routing",
   "type": "module",
   "main": "./dist/index.js",

package/packages/checkpoint/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/checkpoint",
-  "version": "1.1.183",
+  "version": "1.1.185",
   "description": "Enhanced checkpoint system with incremental snapshots, diff-based storage, and recovery strategies",
   "type": "module",
   "main": "./dist/index.js",

package/packages/cli-plugin-sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/cli-plugin-sdk",
-  "version": "1.1.183",
+  "version": "1.1.185",
   "type": "module",
   "description": "CLI Plugin SDK for pi-harness — install, list, remove, update, invoke plugins",
   "main": "dist/index.js",

package/packages/clipboard/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/clipboard",
-  "version": "1.1.183",
+  "version": "1.1.185",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/clipboard-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/clipboard-plugin",
-  "version": "1.1.183",
+  "version": "1.1.185",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/code-generation/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/code-generation",
-  "version": "1.1.183",
+  "version": "1.1.185",
   "description": "Code generation pipeline for pi-harness-runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/code-review/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/code-review",
-  "version": "1.1.183",
+  "version": "1.1.185",
   "description": "Automated code review engine for pi-harness-runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/codex-adapter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/codex-adapter",
-  "version": "1.1.183",
+  "version": "1.1.185",
   "type": "module",
   "description": "OpenAI Codex provider adapter for pi-harness",
   "main": "dist/index.js",

package/packages/codex-watcher/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/codex-watcher",
-  "version": "1.1.183",
+  "version": "1.1.185",
   "description": "Watches Codex CLI sessions and emits visible messages for PING-PONG monitoring",
   "type": "module",
   "main": "./dist/src/index.js",

package/packages/config-capture/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moocoding/config-capture",
-  "version": "1.1.183",
+  "version": "1.1.185",
   "description": "Auto-capture API-fetched configuration values to AGENTS.md",
   "type": "module",
   "main": "src/index.ts",

package/packages/context-compiler/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/context-compiler",
-  "version": "1.1.183",
+  "version": "1.1.185",
   "description": "Bounded context selection engine for pi-harness-runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/context-discovery/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/context-discovery",
-  "version": "1.1.183",
+  "version": "1.1.185",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/context-manager/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/context-manager",
-  "version": "1.1.183",
+  "version": "1.1.185",
   "description": "Context Window Manager — prevents model context overflow via compaction and resume prompts (RFC-0010)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/cookie-sanitizer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/cookie-sanitizer",
-  "version": "1.1.183",
+  "version": "1.1.185",
   "description": "pi-harness-runtime — cookie sanitizer (provider-quota cookie file normaliser)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/cost-optimizer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/cost-optimizer",
-  "version": "1.1.183",
+  "version": "1.1.185",
   "description": "Cost Optimizer for pi-harness-runtime — budget tracking, forecasting, and model selection optimization",
   "type": "module",
   "main": "./dist/index.js",

package/packages/dependency-analyzer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/dependency-analyzer",
-  "version": "1.1.183",
+  "version": "1.1.185",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/django-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/django-plugin",
-  "version": "1.1.183",
+  "version": "1.1.185",
   "description": "Django framework analysis — models, management commands, settings",
   "type": "module",
   "main": "./dist/index.js",

package/packages/doc-generator/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/doc-generator",
-  "version": "1.1.183",
+  "version": "1.1.185",
   "description": "Auto-Doc Generator — generate documentation from source code (RFC-0014)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/e2e-tester/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/e2e-tester",
-  "version": "1.1.183",
+  "version": "1.1.185",
   "description": "WebMCP-powered E2E testing for pi-harness - natural language test scenarios",
   "type": "module",
   "main": "./dist/index.js",

package/packages/evaluation-engine/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/evaluation-engine",
-  "version": "1.1.183",
+  "version": "1.1.185",
   "description": "Evaluation engine for pi-harness runtime (RFC-0057)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/evaluation-runner/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/evaluation-runner",
-  "version": "1.1.183",
+  "version": "1.1.185",
   "type": "module",
   "description": "Framework-agnostic evaluation framework for AI outputs (RFC-0020)",
   "main": "dist/index.js",

package/packages/event-bus/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/event-bus",
-  "version": "1.1.183",
+  "version": "1.1.185",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/event-store/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/event-store",
-  "version": "1.1.183",
+  "version": "1.1.185",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/experience-replay/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/experience-replay",
-  "version": "1.1.183",
+  "version": "1.1.185",
   "description": "Experience replay for debugging and reproducibility (RFC-0059)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/feedback-collector/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/feedback-collector",
-  "version": "1.1.183",
+  "version": "1.1.185",
   "type": "module",
   "description": "Collect and aggregate human/automated feedback (RFC-0021)",
   "main": "dist/index.js",

package/packages/file-copy-helper/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moocoding/file-copy-helper",
-  "version": "1.1.183",
+  "version": "1.1.185",
   "description": "Injects cp/sudo cp rule when user asks to mimic/copy files",
   "type": "module",
   "main": "dist/index.js",

package/packages/framework-detector/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/framework-detector",
-  "version": "1.1.183",
+  "version": "1.1.185",
   "description": "Framework detection system for pi-harness-runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/framework-plugin-sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/framework-plugin-sdk",
-  "version": "1.1.183",
+  "version": "1.1.185",
   "description": "Framework plugin SDK for pi-harness-runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/frappe-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/frappe-plugin",
-  "version": "1.1.183",
+  "version": "1.1.185",
   "description": "Frappe/ERPNext framework analysis — DocTypes, hooks, bench sites, site config",
   "type": "module",
   "main": "./dist/index.js",

package/packages/generic-web-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/generic-web-plugin",
-  "version": "1.1.183",
+  "version": "1.1.185",
   "description": "Generic web framework analysis — REST/GraphQL endpoints, OpenAPI, auth",
   "type": "module",
   "main": "./dist/index.js",

package/packages/health-monitor/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/health-monitor",
-  "version": "1.1.183",
+  "version": "1.1.185",
   "type": "module",
   "description": "Health monitoring and auto-healing",
   "main": "dist/index.js",

package/packages/intent-analyzer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/intent-analyzer",
-  "version": "1.1.183",
+  "version": "1.1.185",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/jev-judge/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/jev-judge",
-  "version": "1.1.183",
+  "version": "1.1.185",
   "description": "Jev Judge - Structured decision model for agent routing, E2E testing, and automated decisions",
   "type": "module",
   "main": "./dist/index.js",

package/packages/knowledge-graph/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/knowledge-graph",
-  "version": "1.1.183",
+  "version": "1.1.185",
   "description": "Knowledge Graph extraction and provenance linking for SKILL.md files",
   "type": "module",
   "main": "./dist/index.js",

package/packages/knowledge-retrieval/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/knowledge-retrieval",
-  "version": "1.1.183",
+  "version": "1.1.185",
   "description": "Knowledge retrieval via TencentDB-Agent-Memory MCP (RFC-0105)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/laravel-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/laravel-plugin",
-  "version": "1.1.183",
+  "version": "1.1.185",
   "description": "Laravel framework analysis — artisan commands, Eloquent models, Blade",
   "type": "module",
   "main": "./dist/index.js",

package/packages/learning-engine/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/learning-engine",
-  "version": "1.1.183",
+  "version": "1.1.185",
   "description": "Learning engine for extracting lessons from runtime execution (RFC-0058)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/mcp-adapter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/mcp-adapter",
-  "version": "1.1.183",
+  "version": "1.1.185",
   "type": "module",
   "description": "MCP server adapter for pi-harness — exposes harness capabilities as MCP tools/resources/prompts (RFC-0068)",
   "main": "dist/index.js",

package/packages/memory-engine/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/memory-engine",
-  "version": "1.1.183",
+  "version": "1.1.185",
   "description": "Memory engine with OKF integration for durable knowledge management (RFC-0060)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/milestone-manager/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/milestone-manager",
-  "version": "1.1.183",
+  "version": "1.1.185",
   "description": "Track milestones and alerts when items are at risk",
   "type": "module",
   "main": "./dist/index.js",