pi-harness-runtime 1.1.321 → 1.1.323

package/packages/agent-policy/src/extension.ts

@@ -26,8 +26,11 @@ import { getPolicyStore } from "./policy-store.js";
 import { 
   renderSystemContract, 
   renderFullRules, 
+  renderFullPolicyText,
+  checkPolicyTextSize,
 } from "./policy-renderer.js";
 import { classifyToolCall } from "./types.js";
+import { checkSshNecessity } from "./ssh-guard.js";
 import { randomUUID } from "node:crypto";
 
 // ---------------------------------------------------------------------------
@@ -78,11 +81,26 @@ export function registerAgentPolicy(
         "system_prompt"
       );
 
-      // Render and inject contract
-      const contract = renderSystemContract(manifest);
+      // Decide what to deliver based on compaction state
+      let policyText: string;
+      if (needsFullDelivery) {
+        // After compaction, deliver FULL policy text so model has actual rules
+        const sizeCheck = checkPolicyTextSize(manifest);
+        if (sizeCheck.fits) {
+          policyText = renderFullPolicyText(manifest);
+        } else {
+          // Too large, deliver contract with warning
+          policyText = renderSystemContract(manifest) +
+            `\n[WARNING: ${sizeCheck.reason}]`;
+        }
+        needsFullDelivery = false;
+      } else {
+        // Normal delivery: compact contract
+        policyText = renderSystemContract(manifest);
+      }
 
       // Build augmented system prompt
-      const augmentedPrompt = event.systemPrompt + "\n\n" + contract;
+      const augmentedPrompt = event.systemPrompt + "\n\n" + policyText;
 
       // Log for debugging
       logInfo("[agent-policy]", `Delivered policy ${manifest.revision} to session ${receipt.sessionId}`);
@@ -155,12 +173,30 @@ Use harness_rules to check policy status.
         }
       }
 
+      // Check SSH guard for shell/bash commands
+      if ((toolName === "bash" || toolName === "shell" || toolName === "ctx_execute") && input && typeof input === "object") {
+        const inputObj = input as Record<string, unknown>;
+        const command = String(inputObj.command ?? "");
+        
+        // Check if this is an SSH command
+        if (/\bssh\b/.test(command)) {
+          const sshCheck = await checkSshNecessity(command);
+          if (!sshCheck.allowed) {
+            logInfo("[agent-policy]", `Blocked SSH to local destination: ${sshCheck.message}`);
+            return {
+              block: true,
+              reason: `[SSH GUARD] ${sshCheck.message}`,
+            };
+          }
+        }
+      }
+
       // Policy satisfied, allow the call
       return {};
     } catch (err) {
       const errorMessage = err instanceof Error ? err.message : String(err);
       logError("[agent-policy]", `Policy check failed: ${errorMessage}`);
-      
+
       // On error, fail open for the command but log the issue
       // This matches pi-lens's total handler guard behavior
       return {};
@@ -336,24 +372,26 @@ Use harness_rules to check policy status.
     logInfo("[agent-policy]", `Session started: ${sessionId} in ${cwd}`);
   });
 
+  // Track if we need full policy delivery (after compaction)
+  let needsFullDelivery = false;
+
   // ---------------------------------------------------------------------------
-  // context: Request-time policy delivery
-  // ---------------------------------------------------------------------------
-  // session_compact: Invalidate delivery coverage for next request
+  // session_compact: Flag for full policy delivery
   // ---------------------------------------------------------------------------
   //
-  // After compaction, clear receipts so the next before_agent_start delivers fresh policy.
-  // This ensures the model sees current rules after context recovery.
+  // After compaction, we must deliver FULL policy text on next before_agent_start.
+  // The model needs actual rule content, not a reminder pointer.
   //
-
   pi.on("session_compact", (_event: SessionCompactEvent, ctx: unknown) => {
     const sessionId = getSessionIdFromCtx(ctx, fallbackSessionId);
-    
-    // Clear receipts for this session so next request gets fresh policy delivery
-    // This ensures rules are re-delivered after compaction without stale receipt blocking
+
+    // Clear receipts so before_agent_start will re-deliver
     store.clearSession(sessionId);
-    
-    logInfo("[agent-policy]", `Session compact: cleared receipts for session ${sessionId}`);
+
+    // Flag that next before_agent_start should deliver full text
+    needsFullDelivery = true;
+
+    logInfo("[agent-policy]", `Session compact: flagged for full policy delivery to session ${sessionId}`);
   });
 
   // ---------------------------------------------------------------------------

package/packages/agent-policy/src/index.ts

@@ -40,6 +40,8 @@ export {
   renderFullRules, 
   renderManifestSummary,
   renderFindingEnvelope,
+  renderFullPolicyText,
+  checkPolicyTextSize,
   parseSections,
   createCleanEnvelope,
   createDegradedEnvelope,

package/packages/agent-policy/src/policy-renderer.ts

@@ -139,6 +139,79 @@ export function parseSections(content: string, source: string, scope: string, pr
   return sections;
 }
 
+// ---------------------------------------------------------------------------
+// Full Policy Text Rendering
+// ---------------------------------------------------------------------------
+
+/**
+ * Render full policy text for injection after compaction.
+ * This includes the ACTUAL rule file contents, not just a contract pointer.
+ * Used after session_compact to deliver fresh policy text to the model.
+ */
+export function renderFullPolicyText(manifest: PolicyManifest): string {
+  const lines: string[] = [];
+
+  lines.push(`PI-HARNESS POLICY (full text) revision=${manifest.revision} coverage=${manifest.coverage}`);
+  lines.push("");
+
+  // Include all mandatory sources with their full content
+  for (const source of manifest.sources) {
+    if (source.priority === "mandatory" || source.harnessOwned) {
+      const content = readSourceContent(source.path);
+      if (content) {
+        lines.push(`--- ${source.path} [${source.priority}] ---`);
+        lines.push("");
+        lines.push(content);
+        lines.push("");
+      }
+    }
+  }
+
+  // Include advisory sources if they exist
+  for (const source of manifest.sources) {
+    if (source.priority === "advisory" && !source.harnessOwned) {
+      const content = readSourceContent(source.path);
+      if (content) {
+        lines.push(`--- ${source.path} [advisory] ---`);
+        lines.push("");
+        lines.push(content);
+        lines.push("");
+      }
+    }
+  }
+
+  return lines.join("\n");
+}
+
+/**
+ * Check if full policy text would fit in context.
+ * Returns { fits: true } or { fits: false, reason: string, bytes: number }.
+ */
+export function checkPolicyTextSize(manifest: PolicyManifest, maxBytes = 100 * 1024): {
+  fits: boolean;
+  bytes?: number;
+  reason?: string;
+} {
+  let totalBytes = 0;
+
+  for (const source of manifest.sources) {
+    const content = readSourceContent(source.path);
+    if (content) {
+      totalBytes += Buffer.byteLength(content, "utf8");
+    }
+  }
+
+  if (totalBytes <= maxBytes) {
+    return { fits: true, bytes: totalBytes };
+  }
+
+  return {
+    fits: false,
+    bytes: totalBytes,
+    reason: `Full policy text (${totalBytes} bytes) exceeds limit (${maxBytes} bytes). Use harness_rules read for selective retrieval.`,
+  };
+}
+
 // ---------------------------------------------------------------------------
 // Full Rules Rendering
 // ---------------------------------------------------------------------------

package/packages/agent-policy/src/ssh-guard.ts

@@ -0,0 +1,204 @@
+/**
+ * SSH Guard Tool
+ *
+ * Intercepts SSH commands and checks if the destination matches the local environment.
+ * Combines automatic checking with a fresh reminder when the agent proposes SSH.
+ */
+
+import { execSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import dns from "node:dns";
+import { promisify } from "node:util";
+
+const lookupAsync = promisify(dns.lookup);
+
+/**
+ * Result of SSH guard check
+ */
+export interface SshGuardResult {
+  /** Whether SSH is allowed to proceed */
+  allowed: boolean;
+  /** Message explaining the decision */
+  message: string;
+  /** Whether the destination matches local */
+  isLocal: boolean;
+  /** Resolved destination address */
+  destinationAddress?: string;
+}
+
+/**
+ * Parse SSH destination from command line
+ */
+function parseSshDestination(command: string): string | null {
+  // Match patterns like:
+  // ssh user@host
+  // ssh host
+  // ssh -p port user@host
+  // ssh host.domain.com
+  const match = command.match(/ssh\s+(?:-[a-z]+\s+)*((?:[a-zA-Z0-9_-]+\@)?[a-zA-Z0-9._-]+)/);
+  return match ? match[1] : null;
+}
+
+/**
+ * Get local IP addresses (cross-platform)
+ */
+function getLocalAddresses(): string[] {
+  try {
+    const isWindows = process.platform === "win32";
+    let output: string;
+    
+    if (isWindows) {
+      // Windows: use ipconfig
+      output = execSync("ipconfig", { encoding: "utf8", timeout: 5000, windowsHide: true });
+    } else {
+      // Unix-like: use ip address
+      output = execSync("ip -j address 2>/dev/null || ip address 2>/dev/null", {
+        encoding: "utf8",
+        timeout: 5000,
+      });
+    }
+
+    const addresses: string[] = ["127.0.0.1", "::1", "localhost"];
+
+    // Parse JSON output if available (Linux)
+    try {
+      const json = JSON.parse(output);
+      for (const iface of json) {
+        for (const addr of iface.addr_info || []) {
+          if (addr.local !== addr.peer) {
+            addresses.push(addr.local);
+          }
+        }
+      }
+    } catch {
+      // Fallback to text parsing
+      if (isWindows) {
+        // Windows ipconfig: parse "IPv4 Address. . . . . . . . . . : X.X.X.X"
+        const windowsMatch = output.matchAll(/IPv4[^:]*:\s*([0-9.]+)/gi);
+        for (const match of windowsMatch) {
+          const ip = match[1];
+          if (ip !== "127.0.0.1") {
+            addresses.push(ip);
+          }
+        }
+        // Also check for IPv6
+        const ipv6Match = output.matchAll(/IPv6[^:]*:\s*([0-9a-f:]+)/gi);
+        for (const match of ipv6Match) {
+          addresses.push(match[1]);
+        }
+      } else {
+        // Unix-like: parse "inet X.X.X.X"
+        const ipMatch = output.match(/inet\s+([0-9.]+)/g);
+        if (ipMatch) {
+          for (const match of ipMatch) {
+            const ip = match.replace("inet ", "");
+            if (ip !== "127.0.0.1") {
+              addresses.push(ip);
+            }
+          }
+        }
+      }
+    }
+
+    return [...new Set(addresses)];
+  } catch {
+    return ["127.0.0.1", "::1", "localhost"];
+  }
+}
+
+/**
+ * Resolve hostname to IP address
+ */
+async function resolveHost(hostname: string): Promise<string | null> {
+  // Skip if already an IP
+  if (/^[0-9.]+$/.test(hostname)) return hostname;
+  if (/^[0-9a-f:]+$/i.test(hostname)) return hostname;
+
+  try {
+    const result = await lookupAsync(hostname);
+    return result.address;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Check if destination is local
+ */
+export async function checkSshNecessity(command: string): Promise<SshGuardResult> {
+  const destination = parseSshDestination(command);
+
+  if (!destination) {
+    return {
+      allowed: true,
+      message: "Could not parse SSH destination",
+      isLocal: false,
+    };
+  }
+
+  const localAddresses = getLocalAddresses();
+  const resolved = await resolveHost(destination);
+
+  if (!resolved) {
+    return {
+      allowed: true,
+      message: `Could not resolve SSH destination: ${destination}`,
+      isLocal: false,
+      destinationAddress: undefined,
+    };
+  }
+
+  const isLocal = localAddresses.some(
+    (addr) => addr === resolved || resolved === addr
+  );
+
+  if (isLocal) {
+    return {
+      allowed: false,
+      message: `SSH destination ${destination} (${resolved}) matches this environment (local addresses: ${localAddresses.join(", ")}). Run the command locally, or explain why a separate SSH session is required.`,
+      isLocal: true,
+      destinationAddress: resolved,
+    };
+  }
+
+  return {
+    allowed: true,
+    message: `SSH to ${destination} (${resolved}) appears necessary - destination differs from local addresses`,
+    isLocal: false,
+    destinationAddress: resolved,
+  };
+}
+
+/**
+ * Tool definition for SSH guard
+ */
+export const SshGuardTool = {
+  name: "ssh_guard_check",
+  description: "Check if SSH destination matches local environment before allowing SSH",
+  parameters: {
+    type: "object",
+    properties: {
+      command: {
+        type: "string",
+        description: "The SSH command to check",
+      },
+    },
+    required: ["command"],
+  },
+} as const;
+
+/**
+ * Execute SSH guard check
+ */
+export async function executeSshGuard(
+  args: { command: string },
+  _api: unknown,
+  _context: unknown
+): Promise<{ allowed: boolean; message: string; isLocal: boolean }> {
+  const result = await checkSshNecessity(args.command);
+  return {
+    allowed: result.allowed,
+    message: result.message,
+    isLocal: result.isLocal,
+  };
+}

package/packages/agent-policy/test/policy-retention.test.ts

@@ -292,8 +292,47 @@ describe("Policy Retention Tests", () => {
 
       // Note partial delivery (only section 1)
       const receipt = store.noteDelivered(sessionId, manifest, "tool", ["section-1"]);
-
       assert.deepStrictEqual(receipt.sectionsDelivered, ["section-1"]);
     });
   });
+
+  // --- Full Policy Text Delivery Tests ---
+  describe("Full policy text delivery", () => {
+    it("should compute full policy text after revision change", async () => {
+      writeFileSync(AGENTS_MD, "# Full Agents\n\n## Rule 1\n\nContent 1.\n\n## Rule 2\n\nContent 2.", "utf8");
+
+      const loader = new PolicyLoader({
+        harnessRulesPath: new URL(`file://${AGENTS_MD}`),
+      });
+
+      const manifest = await loader.load(TEST_DIR);
+
+      // Full text should include actual content, not just contract pointers
+      const { renderFullPolicyText } = await import("../dist/policy-renderer.js");
+      const fullText = renderFullPolicyText(manifest);
+
+      assert.ok(fullText.includes("Full Agents"), "Should include source title");
+      assert.ok(fullText.includes("Rule 1"), "Should include section heading");
+      assert.ok(fullText.includes("Content 1"), "Should include actual content");
+      assert.ok(fullText.includes("revision="), "Should include revision info");
+    });
+
+    it("should detect when full policy exceeds size limit", async () => {
+      const loader = new PolicyLoader({
+        harnessRulesPath: new URL(`file://${AGENTS_MD}`),
+      });
+
+      const manifest = await loader.load(TEST_DIR);
+      const { checkPolicyTextSize } = await import("../dist/policy-renderer.js");
+
+      // With normal-sized content, should fit in 100KB limit
+      const result = checkPolicyTextSize(manifest, 100 * 1024);
+      assert.strictEqual(result.fits, true, "Normal policy should fit in 100KB");
+
+      // With very small limit, should report overflow
+      const smallResult = checkPolicyTextSize(manifest, 10);
+      assert.strictEqual(smallResult.fits, false, "Should report when limit is too small");
+      assert.ok(smallResult.reason?.includes("exceeds limit"), "Should explain overflow");
+    });
+  });
 });

package/packages/architecture-generator/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/architecture-generator",
-  "version": "1.1.321",
+  "version": "1.1.323",
   "description": "Generate ADR and Mermaid diagrams from project analysis",
   "type": "module",
   "main": "./dist/index.js",

package/packages/auth/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/auth",
-  "version": "1.1.321",
+  "version": "1.1.323",
   "description": "pi-harness-runtime — auth",
   "type": "module",
   "main": "./dist/index.js",

package/packages/autonomous-refactor/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/autonomous-refactor",
-  "version": "1.1.321",
+  "version": "1.1.323",
   "type": "module",
   "description": "Autonomous refactoring engine",
   "main": "dist/index.js",

package/packages/autonomous-runtime/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/autonomous-runtime",
-  "version": "1.1.321",
+  "version": "1.1.323",
   "description": "Autonomous Operations Runtime — task inbox, lease management, and worker lifecycle (RFC-0101)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/cache-strategy/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/cache-strategy",
-  "version": "1.1.321",
+  "version": "1.1.323",
   "type": "module",
   "description": "Smart caching with TTL and invalidation strategies (RFC-0022)",
   "main": "dist/index.js",

package/packages/capability-registry/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/capability-registry",
-  "version": "1.1.321",
+  "version": "1.1.323",
   "description": "Capability Registry for pi-harness-runtime — tracks model capabilities and enables capability-based routing",
   "type": "module",
   "main": "./dist/index.js",

package/packages/checkpoint/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/checkpoint",
-  "version": "1.1.321",
+  "version": "1.1.323",
   "description": "Enhanced checkpoint system with incremental snapshots, diff-based storage, and recovery strategies",
   "type": "module",
   "main": "./dist/index.js",

package/packages/cli-plugin-sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/cli-plugin-sdk",
-  "version": "1.1.321",
+  "version": "1.1.323",
   "type": "module",
   "description": "CLI Plugin SDK for pi-harness — install, list, remove, update, invoke plugins",
   "main": "dist/index.js",

package/packages/clipboard/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/clipboard",
-  "version": "1.1.321",
+  "version": "1.1.323",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/clipboard-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/clipboard-plugin",
-  "version": "1.1.321",
+  "version": "1.1.323",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/code-generation/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/code-generation",
-  "version": "1.1.321",
+  "version": "1.1.323",
   "description": "Code generation pipeline for pi-harness-runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/code-review/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/code-review",
-  "version": "1.1.321",
+  "version": "1.1.323",
   "description": "Automated code review engine for pi-harness-runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/codex-adapter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/codex-adapter",
-  "version": "1.1.321",
+  "version": "1.1.323",
   "type": "module",
   "description": "OpenAI Codex provider adapter for pi-harness",
   "main": "dist/index.js",

package/packages/codex-watcher/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/codex-watcher",
-  "version": "1.1.321",
+  "version": "1.1.323",
   "description": "Watches Codex CLI sessions and emits visible messages for PING-PONG monitoring",
   "type": "module",
   "main": "./dist/src/index.js",

package/packages/config-capture/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moocoding/config-capture",
-  "version": "1.1.321",
+  "version": "1.1.323",
   "description": "Auto-capture API-fetched configuration values to AGENTS.md",
   "type": "module",
   "main": "src/index.ts",

package/packages/context-compiler/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/context-compiler",
-  "version": "1.1.321",
+  "version": "1.1.323",
   "description": "Bounded context selection engine for pi-harness-runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/context-discovery/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/context-discovery",
-  "version": "1.1.321",
+  "version": "1.1.323",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/context-manager/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/context-manager",
-  "version": "1.1.321",
+  "version": "1.1.323",
   "description": "Context Window Manager — prevents model context overflow via compaction and resume prompts (RFC-0010)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/cookie-sanitizer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/cookie-sanitizer",
-  "version": "1.1.321",
+  "version": "1.1.323",
   "description": "pi-harness-runtime — cookie sanitizer (provider-quota cookie file normaliser)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/cost-optimizer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/cost-optimizer",
-  "version": "1.1.321",
+  "version": "1.1.323",
   "description": "Cost Optimizer for pi-harness-runtime — budget tracking, forecasting, and model selection optimization",
   "type": "module",
   "main": "./dist/index.js",

package/packages/dependency-analyzer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/dependency-analyzer",
-  "version": "1.1.321",
+  "version": "1.1.323",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/django-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/django-plugin",
-  "version": "1.1.321",
+  "version": "1.1.323",
   "description": "Django framework analysis — models, management commands, settings",
   "type": "module",
   "main": "./dist/index.js",

package/packages/doc-generator/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/doc-generator",
-  "version": "1.1.321",
+  "version": "1.1.323",
   "description": "Auto-Doc Generator — generate documentation from source code (RFC-0014)",
   "type": "module",
   "main": "./dist/index.js",