pi-harness-runtime 1.1.335 → 1.1.337

package/packages/permission-mode/src/checker.ts

@@ -0,0 +1,103 @@
+/**
+ * Permission Checker
+ * 
+ * Checks if an action requires approval based on current permission mode.
+ */
+
+import type { PermissionMode } from './mode.js';
+import { requiresApproval } from './mode.js';
+
+/**
+ * Action that can be checked for permission
+ */
+export interface Action {
+  /** Tool or command name */
+  tool: string;
+  /** File path if applicable */
+  file?: string;
+  /** Command string if applicable */
+  command?: string;
+  /** Additional context */
+  context?: Record<string, unknown>;
+}
+
+/**
+ * Permission check result
+ */
+export interface PermissionCheck {
+  /** Whether approval is required */
+  requiresApproval: boolean;
+  /** Reason for approval requirement */
+  reason?: string;
+  /** Tool that triggered the check */
+  tool: string;
+}
+
+/**
+ * Permission Checker
+ */
+export class PermissionChecker {
+  private mode: PermissionMode;
+  private auditLog: Array<{ action: Action; result: PermissionCheck; timestamp: string }> = [];
+
+  constructor(mode: PermissionMode) {
+    this.mode = mode;
+  }
+
+  /**
+   * Update the current permission mode
+   */
+  setMode(mode: PermissionMode): void {
+    this.mode = mode;
+  }
+
+  /**
+   * Get current permission mode
+   */
+  getMode(): PermissionMode {
+    return { ...this.mode };
+  }
+
+  /**
+   * Check if an action requires approval
+   */
+  check(action: Action): PermissionCheck {
+    const needsApproval = requiresApproval(this.mode, action.tool);
+    
+    const result: PermissionCheck = {
+      requiresApproval: needsApproval,
+      tool: action.tool,
+      reason: needsApproval ? `Tool "${action.tool}" requires approval in ${this.mode.type} mode` : undefined,
+    };
+
+    // Audit log
+    this.auditLog.push({
+      action,
+      result,
+      timestamp: new Date().toISOString(),
+    });
+
+    return result;
+  }
+
+  /**
+   * Check multiple actions
+   */
+  checkMany(actions: Action[]): PermissionCheck[] {
+    return actions.map(action => this.check(action));
+  }
+
+  /**
+   * Get audit log
+   */
+  getAuditLog(): Array<{ action: Action; result: PermissionCheck; timestamp: string }> {
+    return [...this.auditLog];
+  }
+
+  /**
+   * Clear audit log
+   */
+  clearAuditLog(): void {
+    this.auditLog = [];
+  }
+}

package/packages/permission-mode/src/index.ts

@@ -0,0 +1,13 @@
+/**
+ * Permission Mode - Runtime approval system
+ * 
+ * Inspired by T3Code's permission modes:
+ * - Supervised: Requests approval for commands/edits
+ * - Auto-accept edits: Approves edits, questions still need approval
+ * - Auto: Uses automatic review for routine actions
+ * - Full access: No approval needed
+ */
+
+export { PermissionMode, type PermissionModeType } from './mode.js';
+export { PermissionChecker } from './checker.js';
+export { ApprovalManager } from './manager.js';

package/packages/permission-mode/src/manager.ts

@@ -0,0 +1,154 @@
+/**
+ * Approval Manager
+ * 
+ * Manages the approval workflow for pending actions.
+ */
+
+/**
+ * Approval request interface
+ */
+export interface ApprovalRequest {
+  type: string;
+  workspaceId: string;
+  sessionId: string;
+  description: string;
+  tool?: string;
+  command?: string;
+  file?: string;
+  reason?: string;
+  expiresIn?: number;
+}
+
+/**
+ * Approval response interface
+ */
+export interface ApprovalResponse {
+  id: string;
+  approved: boolean;
+  reason?: string;
+}
+
+/**
+ * Pending approval entry
+ */
+export interface PendingApproval {
+  id: string;
+  request: ApprovalRequest;
+  status: 'pending' | 'approved' | 'rejected' | 'expired';
+  createdAt: Date;
+  expiresAt?: Date;
+  respondedAt?: Date;
+}
+
+/**
+ * Approval manager options
+ */
+export interface ApprovalManagerOptions {
+  defaultTimeout?: number;
+  onApprovalRequest?: (approval: PendingApproval) => void;
+  onApprovalGranted?: (approval: PendingApproval) => void;
+  onApprovalRejected?: (approval: PendingApproval) => void;
+  onApprovalExpired?: (approval: PendingApproval) => void;
+}
+
+/**
+ * Approval Manager
+ */
+export class ApprovalManager {
+  private pending = new Map<string, PendingApproval>();
+  private options: Required<ApprovalManagerOptions>;
+
+  constructor(options: ApprovalManagerOptions = {}) {
+    this.options = {
+      defaultTimeout: options.defaultTimeout ?? 300,
+      onApprovalRequest: options.onApprovalRequest ?? (() => {}),
+      onApprovalGranted: options.onApprovalGranted ?? (() => {}),
+      onApprovalRejected: options.onApprovalRejected ?? (() => {}),
+      onApprovalExpired: options.onApprovalExpired ?? (() => {}),
+    };
+  }
+
+  requestApproval(request: ApprovalRequest): PendingApproval {
+    const id = this.generateId();
+    const createdAt = new Date();
+    const timeoutSeconds = request.expiresIn ?? this.options.defaultTimeout;
+    const expiresAt = new Date(createdAt.getTime() + timeoutSeconds * 1000);
+
+    const approval: PendingApproval = { id, request, status: 'pending', createdAt, expiresAt };
+    this.pending.set(id, approval);
+    this.options.onApprovalRequest(approval);
+
+    if (timeoutSeconds > 0) {
+      // SAFETY: globalThis always has setTimeout in JS runtimes (browsers, Node.js)
+      const global = globalThis as unknown as { setTimeout: (fn: () => void, ms: number) => void };
+      global.setTimeout(() => this.checkExpiration(id), timeoutSeconds * 1000);
+    }
+
+    return approval;
+  }
+
+  respond(response: ApprovalResponse): PendingApproval | null {
+    const approval = this.pending.get(response.id);
+    if (!approval) return null;
+
+    approval.status = response.approved ? 'approved' : 'rejected';
+    approval.respondedAt = new Date();
+
+    if (response.approved) {
+      this.options.onApprovalGranted(approval);
+    } else {
+      this.options.onApprovalRejected(approval);
+    }
+
+    // Remove from pending after a short delay
+    // SAFETY: globalThis always has setTimeout in JS runtimes
+    const global = globalThis as unknown as { setTimeout: (fn: () => void, ms: number) => void };
+    global.setTimeout(() => this.pending.delete(response.id), 1000);
+
+    return approval;
+  }
+
+  getPending(): PendingApproval[] {
+    return Array.from(this.pending.values()).filter(a => a.status === 'pending');
+  }
+
+  get(id: string): PendingApproval | undefined {
+    return this.pending.get(id);
+  }
+
+  hasPending(): boolean {
+    return this.getPending().length > 0;
+  }
+
+  countPending(): number {
+    return this.getPending().length;
+  }
+
+  cancel(id: string): boolean {
+    const approval = this.pending.get(id);
+    if (approval && approval.status === 'pending') {
+      approval.status = 'rejected';
+      approval.respondedAt = new Date();
+      this.options.onApprovalRejected(approval);
+      return true;
+    }
+    return false;
+  }
+
+  private checkExpiration(id: string): void {
+    const approval = this.pending.get(id);
+    if (approval && approval.status === 'pending') {
+      const now = new Date();
+      if (approval.expiresAt && now >= approval.expiresAt) {
+        approval.status = 'expired';
+        approval.respondedAt = now;
+        this.pending.delete(id);
+        this.options.onApprovalExpired(approval);
+      }
+    }
+  }
+
+  private generateId(): string {
+    return `approval-${Date.now()}-${Math.random().toString(36).slice(2, 11)}`;
+  }
+}

package/packages/permission-mode/src/mode.ts

@@ -0,0 +1,73 @@
+/**
+ * Permission Mode Types
+ */
+
+/**
+ * Permission mode types - inspired by T3Code
+ */
+export type PermissionModeType = 
+  | 'supervised'      // Requests approval for all commands/edits
+  | 'auto-accept-edits' // Approves file edits, questions need approval
+  | 'auto'              // Uses automatic review for routine actions
+  | 'full-access';      // No approval needed
+
+/**
+ * Permission mode configuration
+ */
+export interface PermissionMode {
+  type: PermissionModeType;
+  /** Project override for this mode */
+  projectOverride?: string;
+  /** Auto-accept certain tools without approval */
+  autoAcceptTools?: string[];
+  /** Block certain tools regardless of mode */
+  blockedTools?: string[];
+}
+
+/**
+ * Default permission modes
+ */
+export const DEFAULT_PERMISSION_MODES: Record<PermissionModeType, PermissionMode> = {
+  supervised: {
+    type: 'supervised',
+  },
+  'auto-accept-edits': {
+    type: 'auto-accept-edits',
+    autoAcceptTools: ['write', 'edit', 'create'],
+  },
+  auto: {
+    type: 'auto',
+    autoAcceptTools: ['read', 'search', 'list'],
+  },
+  'full-access': {
+    type: 'full-access',
+  },
+};
+
+/**
+ * Get default mode for new sessions
+ */
+export function getDefaultMode(): PermissionMode {
+  return { ...DEFAULT_PERMISSION_MODES['full-access'] };
+}
+
+/**
+ * Check if mode requires approval for tool
+ */
+export function requiresApproval(mode: PermissionMode, tool: string): boolean {
+  if (mode.blockedTools?.includes(tool)) {
+    return true;
+  }
+  
+  switch (mode.type) {
+    case 'full-access':
+      return false;
+    case 'auto-accept-edits':
+      return !mode.autoAcceptTools?.includes(tool);
+    case 'auto':
+      return !mode.autoAcceptTools?.includes(tool);
+    case 'supervised':
+    default:
+      return true;
+  }
+}

package/packages/privilege-broker/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/privilege-broker",
-  "version": "1.1.335",
+  "version": "1.1.337",
   "description": "Privilege Broker — capability registry and command executor for autonomous runtime (RFC-0101 §7)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/project-analyzer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/project-analyzer",
-  "version": "1.1.335",
+  "version": "1.1.337",
   "description": "Project analysis system for pi-harness-runtime - detects frameworks, rules, and project structure",
   "type": "module",
   "main": "./dist/index.js",

package/packages/project-bootstrap/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/project-bootstrap",
-  "version": "1.1.335",
+  "version": "1.1.337",
   "description": "Project scaffolding from typed ProjectSpec",
   "type": "module",
   "main": "./dist/index.js",

package/packages/projection-engine/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/projection-engine",
-  "version": "1.1.335",
+  "version": "1.1.337",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/prompt-compiler/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/prompt-compiler",
-  "version": "1.1.335",
+  "version": "1.1.337",
   "description": "Deterministic prompt compiler for pi-harness-runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/prompt-versioning/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/prompt-versioning",
-  "version": "1.1.335",
+  "version": "1.1.337",
   "type": "module",
   "description": "Version control for prompts with rollback support (RFC-0019)",
   "main": "dist/index.js",

package/packages/provider-adapter-sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/provider-adapter-sdk",
-  "version": "1.1.335",
+  "version": "1.1.337",
   "description": "SDK for building, testing, and registering AI provider adapters",
   "type": "module",
   "main": "./dist/index.js",

package/packages/provider-router/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/provider-router",
-  "version": "1.1.335",
+  "version": "1.1.337",
   "description": "Enhanced Provider Router for pi-harness-runtime — intelligent routing with capabilities, costs, and quotas",
   "type": "module",
   "main": "./dist/provider-router.js",

package/packages/provider-selector/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/provider-selector",
-  "version": "1.1.335",
+  "version": "1.1.337",
   "description": "Multi-Provider Selector — route requests by cost, quality, and latency (RFC-0012)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/providers/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/providers",
-  "version": "1.1.335",
+  "version": "1.1.337",
   "description": "pi-harness-runtime — providers",
   "type": "module",
   "main": "./dist/index.js",

package/packages/qdrant-skills/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/qdrant-skills",
-  "version": "1.1.335",
+  "version": "1.1.337",
   "description": "Qdrant vector search integration for Hermes-style skill system",
   "type": "module",
   "main": "./dist/index.js",

package/packages/quota-manager/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/quota-manager",
-  "version": "1.1.335",
+  "version": "1.1.337",
   "description": "pi-harness-runtime — quota-manager",
   "type": "module",
   "main": "./dist/index.js",

package/packages/rate-limiter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/rate-limiter",
-  "version": "1.1.335",
+  "version": "1.1.337",
   "type": "module",
   "description": "Rate limiting with token bucket algorithm (RFC-0023)",
   "main": "dist/index.js",

package/packages/react-vite-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/react-vite-plugin",
-  "version": "1.1.335",
+  "version": "1.1.337",
   "description": "React/Vite framework analysis — components, config, TypeScript setup",
   "type": "module",
   "main": "./dist/index.js",

package/packages/relay/dist/client.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Relay Client - Connect to relay server for remote access
+ */
+import type { RelayConfig, RelayTunnel, RelayMessage } from './types.js';
+/**
+ * Relay Client options
+ */
+export interface RelayClientOptions {
+    /** Called when connected */
+    onConnected?: () => void;
+    /** Called when disconnected */
+    onDisconnected?: () => void;
+    /** Called when tunnel is established */
+    onTunnel?: (tunnel: RelayTunnel) => void;
+    /** Called on error */
+    onError?: (error: Error) => void;
+}
+/**
+ * Relay Client
+ *
+ * Connects to a relay server and establishes tunnels for remote access.
+ */
+export declare class RelayClient {
+    private config;
+    private options;
+    private connected;
+    private tunnel?;
+    constructor(config: RelayConfig, options: RelayClientOptions);
+    /**
+     * Connect to relay server
+     */
+    connect(): Promise<void>;
+    /**
+     * Disconnect from relay server
+     */
+    disconnect(): Promise<void>;
+    /**
+     * Create a tunnel
+     */
+    createTunnel(localPort: number): Promise<RelayTunnel>;
+    /**
+     * Send a message through the tunnel
+     */
+    send(_message: RelayMessage): Promise<void>;
+    /**
+     * Check if connected
+     */
+    isConnected(): boolean;
+    /**
+     * Get current tunnel
+     */
+    getTunnel(): RelayTunnel | undefined;
+}

package/packages/relay/dist/client.js

@@ -0,0 +1,95 @@
+/**
+ * Relay Client - Connect to relay server for remote access
+ */
+/**
+ * Generate a UUID v4
+ */
+function generateUUID() {
+    // Use crypto.randomUUID if available (Node.js 14.17+)
+    const crypto = globalThis;
+    if (crypto.crypto?.randomUUID) {
+        return crypto.crypto.randomUUID();
+    }
+    // Fallback: simple UUID generation
+    return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, (c) => {
+        const r = (Math.random() * 16) | 0;
+        const v = c === 'x' ? r : (r & 0x3) | 0x8;
+        return v.toString(16);
+    });
+}
+/**
+ * Relay Client
+ *
+ * Connects to a relay server and establishes tunnels for remote access.
+ */
+export class RelayClient {
+    config;
+    options;
+    connected = false;
+    tunnel;
+    constructor(config, options) {
+        this.config = config;
+        this.options = options;
+    }
+    /**
+     * Connect to relay server
+     */
+    async connect() {
+        if (this.connected)
+            return;
+        try {
+            // In a real implementation, this would establish WebSocket connection
+            // to the relay server and authenticate
+            this.connected = true;
+            this.options.onConnected?.();
+        }
+        catch (error) {
+            this.options.onError?.(error);
+            throw error;
+        }
+    }
+    /**
+     * Disconnect from relay server
+     */
+    async disconnect() {
+        this.connected = false;
+        this.tunnel = undefined;
+        this.options.onDisconnected?.();
+    }
+    /**
+     * Create a tunnel
+     */
+    async createTunnel(localPort) {
+        const tunnel = {
+            id: generateUUID(),
+            url: `${this.config.serverUrl}/tunnel/${localPort}`,
+            localPort,
+            status: this.connected ? 'connected' : 'disconnected',
+            createdAt: new Date().toISOString(),
+        };
+        this.tunnel = tunnel;
+        this.options.onTunnel?.(tunnel);
+        return tunnel;
+    }
+    /**
+     * Send a message through the tunnel
+     */
+    async send(_message) {
+        if (!this.connected) {
+            throw new Error('Not connected to relay server');
+        }
+        // In a real implementation, this would send the message over WebSocket
+    }
+    /**
+     * Check if connected
+     */
+    isConnected() {
+        return this.connected;
+    }
+    /**
+     * Get current tunnel
+     */
+    getTunnel() {
+        return this.tunnel;
+    }
+}

package/packages/relay/dist/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Cloud Relay - T3 Connect Style
+ *
+ * Enables remote access to pi-harness without router/port forwarding.
+ * Based on T3Code's T3 Connect architecture.
+ */
+export { RelayServer } from './server.js';
+export { RelayClient } from './client.js';
+export { RelayConfig, RelayTunnel } from './types.js';

package/packages/relay/dist/index.js

@@ -0,0 +1,8 @@
+/**
+ * Cloud Relay - T3 Connect Style
+ *
+ * Enables remote access to pi-harness without router/port forwarding.
+ * Based on T3Code's T3 Connect architecture.
+ */
+export { RelayServer } from './server.js';
+export { RelayClient } from './client.js';