pi-harness-runtime 1.1.320 → 1.1.322

package/packages/agent-policy/src/policy-loader.ts

@@ -86,13 +86,33 @@ export class PolicyLoader {
 
   /**
    * Load policy for a specific target file (considers scoped rules).
+   * Resolves applicable rules from workspace toward the target directory.
    */
   async loadForTarget(projectRoot: string, targetPath?: string): Promise<PolicyManifest> {
-    // The current loader collects only project-root and ancestor rules, all of
-    // which apply to every target. Use the same manifest as harness_rules.
-    // Filtering here mutated the cached manifest, dropped ancestor rules, and
-    // hashed advisory sources that load() deliberately excludes from revision.
-    return this.load(projectRoot);
+    // Load base manifest first
+    const baseManifest = await this.load(projectRoot);
+
+    // If no target path, return base manifest
+    if (!targetPath) {
+      return baseManifest;
+    }
+
+    // Determine target scope by finding the most specific matching rule
+    const targetDir = resolve(targetPath);
+    
+    // Filter sources to only those applicable to this target
+    // Rules apply if their scope is empty (root) or is a prefix of the target path
+    const applicableSources = baseManifest.sources.filter(source => {
+      if (!source.scope) return true; // Root scope applies everywhere
+      const scopePath = resolve(projectRoot, source.scope);
+      return targetDir.startsWith(scopePath) || targetDir.startsWith(source.scope);
+    });
+
+    // Return manifest with filtered sources
+    return {
+      ...baseManifest,
+      sources: applicableSources,
+    };
   }
 
   /**
@@ -117,17 +137,13 @@ export class PolicyLoader {
     const harnessSources = await this.loadHarnessRules();
     sources.push(...harnessSources);
 
-    // 2. Load project rules (if project is trusted)
+    // 2. Load project rules
+    // Load both AGENTS.md (mandatory if present) and RULES.md (advisory if present)
+    const projectSources = await this.loadProjectRules(projectRoot);
+    sources.push(...projectSources);
+
+    // Evaluate trust after loading rules (trust is determined by host, not just files)
     const trust = this.evaluateTrust(projectRoot);
-    
-    if (trust !== "unknown") {
-      const projectSources = await this.loadProjectRules(projectRoot);
-      sources.push(...projectSources);
-    } else {
-      // Project not trusted, but we still try to load AGENTS.md as advisory
-      const untrustedSources = await this.loadProjectRules(projectRoot, true);
-      sources.push(...untrustedSources);
-    }
 
     // 3. Compute revision from mandatory sources
     const mandatorySources = sources.filter(s => s.priority === "mandatory");
@@ -251,26 +267,39 @@ export class PolicyLoader {
 
   /**
    * Evaluate trust level for a project.
+   * 
+   * NOTE: Trust should ultimately be determined by host authorization (ctx.isProjectTrusted()),
+   * not by file presence alone. This method provides a fallback assessment.
+   * The presence of .git or package.json indicates a repository but does not confer trust
+   * without host authorization.
    */
   private evaluateTrust(projectRoot: string): "trusted" | "untrusted" | "unknown" {
+    // Check for trust indicators
     let trustIndicatorsFound = 0;
-    let untrustIndicatorsFound = 0;
-
     for (const indicator of TRUST_INDICATORS) {
       if (existsSync(join(projectRoot, indicator))) {
         trustIndicatorsFound++;
       }
     }
 
-    // Check for untrusted indicators (e.g., downloaded zip, unknown origin)
-    // For now, presence of .git or package.json means trusted
+    // Trust is "unknown" unless explicitly set by host authorization
+    // File presence alone does not determine trust
     if (trustIndicatorsFound > 0) {
-      return "trusted";
+      // Repository detected, but trust requires host authorization
+      return "unknown";
     }
 
     return "unknown";
   }
 
+  /**
+   * Check if project has explicit trust from host.
+   * This should be called with host authorization state.
+   */
+  hasExplicitTrust(projectRoot: string): boolean {
+    return this.evaluateTrust(projectRoot) === "trusted";
+  }
+
   /**
    * Infer the scope from a relative path.
    */

package/packages/agent-policy/src/ssh-guard.ts

@@ -0,0 +1,204 @@
+/**
+ * SSH Guard Tool
+ *
+ * Intercepts SSH commands and checks if the destination matches the local environment.
+ * Combines automatic checking with a fresh reminder when the agent proposes SSH.
+ */
+
+import { execSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import dns from "node:dns";
+import { promisify } from "node:util";
+
+const lookupAsync = promisify(dns.lookup);
+
+/**
+ * Result of SSH guard check
+ */
+export interface SshGuardResult {
+  /** Whether SSH is allowed to proceed */
+  allowed: boolean;
+  /** Message explaining the decision */
+  message: string;
+  /** Whether the destination matches local */
+  isLocal: boolean;
+  /** Resolved destination address */
+  destinationAddress?: string;
+}
+
+/**
+ * Parse SSH destination from command line
+ */
+function parseSshDestination(command: string): string | null {
+  // Match patterns like:
+  // ssh user@host
+  // ssh host
+  // ssh -p port user@host
+  // ssh host.domain.com
+  const match = command.match(/ssh\s+(?:-[a-z]+\s+)*((?:[a-zA-Z0-9_-]+\@)?[a-zA-Z0-9._-]+)/);
+  return match ? match[1] : null;
+}
+
+/**
+ * Get local IP addresses (cross-platform)
+ */
+function getLocalAddresses(): string[] {
+  try {
+    const isWindows = process.platform === "win32";
+    let output: string;
+    
+    if (isWindows) {
+      // Windows: use ipconfig
+      output = execSync("ipconfig", { encoding: "utf8", timeout: 5000, windowsHide: true });
+    } else {
+      // Unix-like: use ip address
+      output = execSync("ip -j address 2>/dev/null || ip address 2>/dev/null", {
+        encoding: "utf8",
+        timeout: 5000,
+      });
+    }
+
+    const addresses: string[] = ["127.0.0.1", "::1", "localhost"];
+
+    // Parse JSON output if available (Linux)
+    try {
+      const json = JSON.parse(output);
+      for (const iface of json) {
+        for (const addr of iface.addr_info || []) {
+          if (addr.local !== addr.peer) {
+            addresses.push(addr.local);
+          }
+        }
+      }
+    } catch {
+      // Fallback to text parsing
+      if (isWindows) {
+        // Windows ipconfig: parse "IPv4 Address. . . . . . . . . . : X.X.X.X"
+        const windowsMatch = output.matchAll(/IPv4[^:]*:\s*([0-9.]+)/gi);
+        for (const match of windowsMatch) {
+          const ip = match[1];
+          if (ip !== "127.0.0.1") {
+            addresses.push(ip);
+          }
+        }
+        // Also check for IPv6
+        const ipv6Match = output.matchAll(/IPv6[^:]*:\s*([0-9a-f:]+)/gi);
+        for (const match of ipv6Match) {
+          addresses.push(match[1]);
+        }
+      } else {
+        // Unix-like: parse "inet X.X.X.X"
+        const ipMatch = output.match(/inet\s+([0-9.]+)/g);
+        if (ipMatch) {
+          for (const match of ipMatch) {
+            const ip = match.replace("inet ", "");
+            if (ip !== "127.0.0.1") {
+              addresses.push(ip);
+            }
+          }
+        }
+      }
+    }
+
+    return [...new Set(addresses)];
+  } catch {
+    return ["127.0.0.1", "::1", "localhost"];
+  }
+}
+
+/**
+ * Resolve hostname to IP address
+ */
+async function resolveHost(hostname: string): Promise<string | null> {
+  // Skip if already an IP
+  if (/^[0-9.]+$/.test(hostname)) return hostname;
+  if (/^[0-9a-f:]+$/i.test(hostname)) return hostname;
+
+  try {
+    const result = await lookupAsync(hostname);
+    return result.address;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Check if destination is local
+ */
+export async function checkSshNecessity(command: string): Promise<SshGuardResult> {
+  const destination = parseSshDestination(command);
+
+  if (!destination) {
+    return {
+      allowed: true,
+      message: "Could not parse SSH destination",
+      isLocal: false,
+    };
+  }
+
+  const localAddresses = getLocalAddresses();
+  const resolved = await resolveHost(destination);
+
+  if (!resolved) {
+    return {
+      allowed: true,
+      message: `Could not resolve SSH destination: ${destination}`,
+      isLocal: false,
+      destinationAddress: undefined,
+    };
+  }
+
+  const isLocal = localAddresses.some(
+    (addr) => addr === resolved || resolved === addr
+  );
+
+  if (isLocal) {
+    return {
+      allowed: false,
+      message: `SSH destination ${destination} (${resolved}) matches this environment (local addresses: ${localAddresses.join(", ")}). Run the command locally, or explain why a separate SSH session is required.`,
+      isLocal: true,
+      destinationAddress: resolved,
+    };
+  }
+
+  return {
+    allowed: true,
+    message: `SSH to ${destination} (${resolved}) appears necessary - destination differs from local addresses`,
+    isLocal: false,
+    destinationAddress: resolved,
+  };
+}
+
+/**
+ * Tool definition for SSH guard
+ */
+export const SshGuardTool = {
+  name: "ssh_guard_check",
+  description: "Check if SSH destination matches local environment before allowing SSH",
+  parameters: {
+    type: "object",
+    properties: {
+      command: {
+        type: "string",
+        description: "The SSH command to check",
+      },
+    },
+    required: ["command"],
+  },
+} as const;
+
+/**
+ * Execute SSH guard check
+ */
+export async function executeSshGuard(
+  args: { command: string },
+  _api: unknown,
+  _context: unknown
+): Promise<{ allowed: boolean; message: string; isLocal: boolean }> {
+  const result = await checkSshNecessity(args.command);
+  return {
+    allowed: result.allowed,
+    message: result.message,
+    isLocal: result.isLocal,
+  };
+}

package/packages/agent-policy/test/policy-retention.test.ts

@@ -0,0 +1,299 @@
+/**
+ * Policy Retention Tests
+ *
+ * Tests for lifecycle retention after compaction, reset, resume.
+ */
+
+import { describe, it, before, after } from "node:test";
+import assert from "node:assert";
+import { existsSync, mkdirSync, writeFileSync, unlinkSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { randomUUID } from "node:crypto";
+import type { PolicyManifest } from "../dist/types.js";
+import { PolicyLoader } from "../dist/policy-loader.js";
+import { getPolicyStore, resetPolicyStore } from "../dist/policy-store.js";
+
+// Test workspace
+const TEST_DIR = "/tmp/policy-retention-test-" + Date.now();
+const AGENTS_MD = join(TEST_DIR, "AGENTS.md");
+const RULES_MD = join(TEST_DIR, "RULES.md");
+
+describe("Policy Retention Tests", () => {
+  before(() => {
+    mkdirSync(TEST_DIR, { recursive: true });
+    resetPolicyStore();
+  });
+
+  after(() => {
+    try {
+      rmSync(TEST_DIR, { recursive: true, force: true });
+    } catch {
+      // ignore cleanup errors
+    }
+    resetPolicyStore();
+  });
+
+  // --- Session Epoch Tests ---
+  describe("Session epochs", () => {
+    it("should track session epochs separately", async () => {
+      const store = getPolicyStore();
+      const session1 = "session-1-" + randomUUID().slice(0, 8);
+      const session2 = "session-2-" + randomUUID().slice(0, 8);
+
+      // Create a manifest
+      const manifest: PolicyManifest = {
+        revision: "abc123",
+        projectRoot: TEST_DIR,
+        trust: "unknown",
+        coverage: "complete",
+        sources: [],
+        loadedAt: Date.now(),
+      };
+
+      // Note delivery for session 1
+      const receipt1 = store.noteDelivered(session1, manifest, "system_prompt");
+      assert.strictEqual(receipt1.sessionId, session1);
+
+      // Session 2 should NOT have a receipt
+      const receipt2 = store.getReceipt(session2, TEST_DIR);
+      assert.strictEqual(receipt2, null);
+    });
+
+    it("should not leak receipts between sessions after reset", async () => {
+      const store = getPolicyStore();
+      const sessionId = "session-reset-" + randomUUID().slice(0, 8);
+
+      const manifest: PolicyManifest = {
+        revision: "abc123",
+        projectRoot: TEST_DIR,
+        trust: "unknown",
+        coverage: "complete",
+        sources: [],
+        loadedAt: Date.now(),
+      };
+
+      // Deliver to session
+      store.noteDelivered(sessionId, manifest, "system_prompt");
+
+      // Clear session
+      store.clearSession(sessionId);
+
+      // Receipt should be gone
+      const receipt = store.getReceipt(sessionId, TEST_DIR);
+      assert.strictEqual(receipt, null);
+    });
+  });
+
+  // --- Source Change Tests ---
+  describe("Source changes", () => {
+    it("should invalidate receipts when AGENTS.md changes", async () => {
+      const store = getPolicyStore();
+      const sessionId = "session-change-" + randomUUID().slice(0, 8);
+
+      // Write initial content
+      writeFileSync(AGENTS_MD, "# Original Agents\n\nFollow the rules.", "utf8");
+
+      const loader = new PolicyLoader({
+        harnessRulesPath: new URL(`file://${AGENTS_MD}`),
+      });
+
+      // Load and deliver
+      const manifest1 = await loader.load(TEST_DIR);
+      store.noteDelivered(sessionId, manifest1, "system_prompt");
+
+      // Modify file
+      writeFileSync(AGENTS_MD, "# Updated Agents\n\nDifferent rules.", "utf8");
+
+      // Invalidate cache
+      loader.invalidateCache(TEST_DIR);
+
+      // Load new manifest
+      const manifest2 = await loader.load(TEST_DIR);
+
+      // Revision should be different
+      assert.notStrictEqual(manifest1.revision, manifest2.revision);
+
+      // Old receipt should NOT cover new manifest
+      const hasCoverage = store.hasValidReceipt(sessionId, manifest2);
+      assert.strictEqual(hasCoverage, false);
+    });
+
+    it("should include RULES.md in sources", async () => {
+      // Write RULES.md
+      writeFileSync(RULES_MD, "# Rules\n\nThese are rules.", "utf8");
+
+      const loader = new PolicyLoader({
+        harnessRulesPath: new URL(`file://${AGENTS_MD}`),
+      });
+
+      const manifest = await loader.load(TEST_DIR);
+
+      // RULES.md should be included as advisory at minimum
+      const rulesSource = manifest.sources.find(s => s.path.includes("RULES.md"));
+      assert.ok(rulesSource, "RULES.md should be included in sources");
+
+      // Clean up
+      unlinkSync(RULES_MD);
+    });
+  });
+
+  // --- Bounded Delivery Tests ---
+  describe("Bounded delivery", () => {
+    it("should track exact revision and source coverage", async () => {
+      const store = getPolicyStore();
+      const sessionId = "session-exact-" + randomUUID().slice(0, 8);
+
+      writeFileSync(AGENTS_MD, "# Agents\n\nContent.", "utf8");
+
+      const loader = new PolicyLoader({
+        harnessRulesPath: new URL(`file://${AGENTS_MD}`),
+      });
+
+      const manifest = await loader.load(TEST_DIR);
+
+      // Note delivery with specific sections
+      const receipt = store.noteDelivered(sessionId, manifest, "tool", ["section-1"]);
+
+      assert.strictEqual(receipt.revision, manifest.revision);
+      assert.deepStrictEqual(receipt.sectionsDelivered, ["section-1"]);
+    });
+
+    it("should reject acknowledgement of wrong revision", async () => {
+      const store = getPolicyStore();
+      const sessionId = "session-wrong-rev-" + randomUUID().slice(0, 8);
+
+      writeFileSync(AGENTS_MD, "# Agents v1\n\nContent.", "utf8");
+
+      const loader = new PolicyLoader({
+        harnessRulesPath: new URL(`file://${AGENTS_MD}`),
+      });
+
+      const manifest1 = await loader.load(TEST_DIR);
+      store.noteDelivered(sessionId, manifest1, "system_prompt");
+
+      // Update content
+      writeFileSync(AGENTS_MD, "# Agents v2\n\nDifferent content.", "utf8");
+      loader.invalidateCache(TEST_DIR);
+      const manifest2 = await loader.load(TEST_DIR);
+
+      // Old receipt should NOT cover new manifest
+      const hasCoverage = store.hasValidReceipt(sessionId, manifest2);
+      assert.strictEqual(hasCoverage, false);
+    });
+  });
+
+  // --- Trust Evaluation Tests ---
+  describe("Trust evaluation", () => {
+    it("should evaluate trust appropriately", async () => {
+      // Create a .git directory (indicates repository)
+      mkdirSync(join(TEST_DIR, ".git"), { recursive: true });
+
+      const loader = new PolicyLoader({
+        harnessRulesPath: new URL(`file://${AGENTS_MD}`),
+      });
+
+      const manifest = await loader.load(TEST_DIR);
+
+      // Trust should be evaluated
+      assert.ok(["trusted", "untrusted", "unknown"].includes(manifest.trust));
+
+      // Clean up
+      rmSync(join(TEST_DIR, ".git"), { recursive: true, force: true });
+    });
+  });
+
+  // --- Compaction Recovery Tests ---
+  describe("Compaction recovery", () => {
+    it("should invalidate receipts on session_compact event", async () => {
+      const store = getPolicyStore();
+      const sessionId = "session-compact-" + randomUUID().slice(0, 8);
+
+      writeFileSync(AGENTS_MD, "# Agents\n\nContent.", "utf8");
+
+      const loader = new PolicyLoader({
+        harnessRulesPath: new URL(`file://${AGENTS_MD}`),
+      });
+
+      const manifest = await loader.load(TEST_DIR);
+      store.noteDelivered(sessionId, manifest, "system_prompt");
+
+      // Simulate compaction: invalidate all
+      store.invalidateAll();
+
+      // Receipt should be gone
+      const receipt = store.getReceipt(sessionId, TEST_DIR);
+      assert.strictEqual(receipt, null);
+    });
+  });
+
+  // --- Nested Scope Tests ---
+  describe("Nested scope resolution", () => {
+    it("should load scoped rules for subdirectories", async () => {
+      // Create nested structure
+      mkdirSync(join(TEST_DIR, "packages", "my-pkg"), { recursive: true });
+      writeFileSync(AGENTS_MD, "# Root Agents\n\nRoot rules.", "utf8");
+      writeFileSync(join(TEST_DIR, "packages", "AGENTS.md"), "# Package Agents\n\nPackage rules.", "utf8");
+
+      const loader = new PolicyLoader({
+        harnessRulesPath: new URL(`file://${AGENTS_MD}`),
+      });
+
+      const manifest = await loader.load(TEST_DIR);
+
+      // Should have both root and package rules
+      assert.ok(manifest.sources.length >= 2, "Should include both root and package rules");
+
+      // Clean up nested structure
+      rmSync(join(TEST_DIR, "packages"), { recursive: true, force: true });
+    });
+  });
+
+  // --- Delivery Deduplication Tests ---
+  describe("Delivery deduplication", () => {
+    it("should not create duplicate receipts in same session", async () => {
+      const store = getPolicyStore();
+      const sessionId = "session-dedup-" + randomUUID().slice(0, 8);
+
+      writeFileSync(AGENTS_MD, "# Agents\n\nContent.", "utf8");
+
+      const loader = new PolicyLoader({
+        harnessRulesPath: new URL(`file://${AGENTS_MD}`),
+      });
+
+      const manifest = await loader.load(TEST_DIR);
+
+      // First delivery
+      const receipt1 = store.noteDelivered(sessionId, manifest, "system_prompt");
+
+      // Second delivery should update, not create duplicate
+      const receipt2 = store.noteDelivered(sessionId, manifest, "system_prompt");
+
+      // Should be same session
+      assert.strictEqual(receipt1.sessionId, receipt2.sessionId);
+
+      // Should have same revision
+      assert.strictEqual(receipt1.revision, receipt2.revision);
+    });
+  });
+
+  // --- Partial Read Tracking Tests ---
+  describe("Partial read tracking", () => {
+    it("should track which sections were actually delivered", async () => {
+      const store = getPolicyStore();
+      const sessionId = "session-partial-" + randomUUID().slice(0, 8);
+
+      writeFileSync(AGENTS_MD, "# Agents\n\n## Section 1\n\nContent 1.\n\n## Section 2\n\nContent 2.", "utf8");
+
+      const loader = new PolicyLoader({
+        harnessRulesPath: new URL(`file://${AGENTS_MD}`),
+      });
+
+      const manifest = await loader.load(TEST_DIR);
+
+      // Note partial delivery (only section 1)
+      const receipt = store.noteDelivered(sessionId, manifest, "tool", ["section-1"]);
+
+      assert.deepStrictEqual(receipt.sectionsDelivered, ["section-1"]);
+    });
+  });
+});

package/packages/architecture-generator/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/architecture-generator",
-  "version": "1.1.320",
+  "version": "1.1.322",
   "description": "Generate ADR and Mermaid diagrams from project analysis",
   "type": "module",
   "main": "./dist/index.js",

package/packages/auth/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/auth",
-  "version": "1.1.320",
+  "version": "1.1.322",
   "description": "pi-harness-runtime — auth",
   "type": "module",
   "main": "./dist/index.js",

package/packages/autonomous-refactor/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/autonomous-refactor",
-  "version": "1.1.320",
+  "version": "1.1.322",
   "type": "module",
   "description": "Autonomous refactoring engine",
   "main": "dist/index.js",

package/packages/autonomous-runtime/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/autonomous-runtime",
-  "version": "1.1.320",
+  "version": "1.1.322",
   "description": "Autonomous Operations Runtime — task inbox, lease management, and worker lifecycle (RFC-0101)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/cache-strategy/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/cache-strategy",
-  "version": "1.1.320",
+  "version": "1.1.322",
   "type": "module",
   "description": "Smart caching with TTL and invalidation strategies (RFC-0022)",
   "main": "dist/index.js",

package/packages/capability-registry/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/capability-registry",
-  "version": "1.1.320",
+  "version": "1.1.322",
   "description": "Capability Registry for pi-harness-runtime — tracks model capabilities and enables capability-based routing",
   "type": "module",
   "main": "./dist/index.js",

package/packages/checkpoint/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/checkpoint",
-  "version": "1.1.320",
+  "version": "1.1.322",
   "description": "Enhanced checkpoint system with incremental snapshots, diff-based storage, and recovery strategies",
   "type": "module",
   "main": "./dist/index.js",

package/packages/cli-plugin-sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/cli-plugin-sdk",
-  "version": "1.1.320",
+  "version": "1.1.322",
   "type": "module",
   "description": "CLI Plugin SDK for pi-harness — install, list, remove, update, invoke plugins",
   "main": "dist/index.js",

package/packages/clipboard/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/clipboard",
-  "version": "1.1.320",
+  "version": "1.1.322",
   "type": "module",
   "main": "src/index.ts",
   "exports": {