pi-harness-runtime 1.1.387 → 1.1.388

package/packages/relay/src/relay-endpoint.ts

@@ -0,0 +1,304 @@
+/**
+ * Relay endpoint resolution.
+ *
+ * Resolves the relay WebSocket URL and the auth token from the SAME sources
+ * the relay server uses (see scripts/unified-webhook-server.ts), so a client
+ * and the server always agree:
+ *
+ *   URL:   RELAY_WS_URL env -> keys/relay-ws-url.txt -> derived from keys/telegram-webhook-url.txt
+ *   Token: RELAY_AUTH_TOKEN env -> keys/relay-auth-token.txt -> keys/telegram-webhook-secret.txt
+ *
+ * The token value is never logged: only the NAME of the source it came from.
+ */
+
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+/** Environment variables consulted by the resolver. */
+export interface RelayEndpointEnv {
+  RELAY_WS_URL?: string;
+  RELAY_AUTH_TOKEN?: string;
+}
+
+/** Result of a relay endpoint resolution. */
+export interface RelayEndpointResolution {
+  /** WebSocket URL, or null when it could not be resolved. */
+  url: string | null;
+  /** Where the URL came from (e.g. "env RELAY_WS_URL"). Never contains a secret. */
+  urlSource: string | null;
+  /** Auth token, or null when it could not be resolved. */
+  token: string | null;
+  /** Where the token came from (e.g. "keys/telegram-webhook-secret.txt"). Never contains the token. */
+  tokenSource: string | null;
+  /** Human readable description of what is missing (never contains a token). */
+  missing: string[];
+  /** Human readable caveats about the resolved endpoint (never contains a token). */
+  notes: string[];
+}
+
+/** Options for {@link resolveRelayEndpoint}. */
+export interface ResolveRelayEndpointOptions {
+  /** Environment to read (defaults to process.env). */
+  env?: RelayEndpointEnv;
+  /** Directory holding the key files (e.g. ~/.pi-harness-runtime/keys). */
+  keysDir: string;
+  /** Optional file reader override (used by the tests). */
+  readFile?: (path: string) => string | undefined;
+}
+
+/** Source names, in the order they are consulted. */
+export const RELAY_URL_SOURCES = [
+  "env RELAY_WS_URL",
+  "keys/relay-ws-url.txt",
+  "keys/telegram-webhook-url.txt (derived)",
+] as const;
+
+export const RELAY_TOKEN_SOURCES = [
+  "env RELAY_AUTH_TOKEN",
+  "keys/relay-auth-token.txt",
+  "keys/telegram-webhook-secret.txt",
+] as const;
+
+/**
+ * The token sources are the SAME chain the relay server uses, so the client
+ * and the server can never disagree about the credential.
+ *
+ * Note: `keys/telegram-webhook-secret.txt` is also the secret the Telegram
+ * webhook expects in its `x-telegram-bot-api-secret-token` header. Sharing it
+ * with the WebSocket relay widens the blast radius of that secret - put a
+ * dedicated token in `keys/relay-auth-token.txt` (it is preferred) when the
+ * relay and the webhook do not have to share one.
+ *
+ * The Telegram webhook secret itself may also come from the environment
+ * variable TELEGRAM_WEBHOOK_SECRET; that variable belongs to the HTTP
+ * webhook, not to the relay, and is therefore not part of this chain.
+ */
+
+/**
+ * Derive the relay WebSocket URL from the Telegram webhook URL.
+ *
+ * The derivation keeps the host (and port) of the webhook URL and replaces the
+ * path with /ws, because the relay is exposed on the same origin as the
+ * webhook:
+ *
+ *   https://webhook.bunchee.online/telegram -> wss://webhook.bunchee.online/ws
+ *
+ * That only works when the origin serves /ws, i.e. behind the reverse proxy
+ * that maps /ws to the relay port (nginx: location /ws -> 127.0.0.1:8444).
+ * When the webhook URL addresses the application DIRECTLY, the relay listens
+ * on WS_PORT (default 8444), not on the HTTP port - use RELAY_WS_URL or
+ * keys/relay-ws-url.txt for that setup.
+ */
+export function deriveRelayWsUrl(webhookUrl: string): string | null {
+  const trimmed = webhookUrl?.trim();
+  if (!trimmed) return null;
+  try {
+    const parsed = new URL(trimmed);
+    if (!parsed.host) return null;
+    const secure = parsed.protocol === "https:" || parsed.protocol === "wss:";
+    const scheme = secure ? "wss:" : "ws:";
+    return `${scheme}//${parsed.host}/ws`;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * True when the value looks like a WebSocket URL.
+ *
+ * Credentials ("wss://user:pass@host") and query strings are rejected: the
+ * resolved URL is written to the log, and neither belongs there.
+ */
+export function isRelayWsUrl(value: string): boolean {
+  const trimmed = value?.trim() ?? "";
+  if (!/^wss?:\/\//i.test(trimmed)) return false;
+  if (trimmed.includes("@") || trimmed.includes("?")) return false;
+  try {
+    const parsed = new URL(trimmed);
+    if (parsed.protocol !== "ws:" && parsed.protocol !== "wss:") return false;
+    return parsed.host.length > 0;
+  } catch {
+    return false;
+  }
+}
+
+function defaultReadFile(path: string): string | undefined {
+  try {
+    return readFileSync(path, "utf-8");
+  } catch {
+    return undefined;
+  }
+}
+
+/** Host of a URL, or an empty string when it cannot be parsed. */
+function hostOf(url: string): string {
+  try {
+    return new URL(url).host;
+  } catch {
+    return "";
+  }
+}
+
+/** True for hosts that address the machine itself. */
+function isLoopbackHost(host: string): boolean {
+  const name = host.replace(/:\d+$/, "").replace(/^\[|\]$/g, "").toLowerCase();
+  return name === "127.0.0.1" || name === "localhost" || name === "::1" || name.startsWith("127.");
+}
+
+interface UrlResolution {
+  url: string | null;
+  source: string | null;
+  rejected: string[];
+  notes: string[];
+}
+
+interface TokenResolution {
+  token: string | null;
+  source: string | null;
+}
+
+/**
+ * Transport warnings for a resolved URL.
+ *
+ * A plaintext ws:// URL to a remote host sends the auth token in cleartext.
+ */
+function transportNotes(url: string): string[] {
+  if (!url.toLowerCase().startsWith("ws://")) return [];
+  if (isLoopbackHost(hostOf(url))) return [];
+  return [
+    "the relay url is plaintext (ws://) for a remote host - the auth token is sent unencrypted, use wss://",
+  ];
+}
+
+/**
+ * Resolve the WebSocket URL: env -> dedicated key file -> derived from the
+ * telegram webhook url. The first usable source wins; a source that holds a
+ * rejected value is reported so the operator can see why it was skipped.
+ */
+function resolveUrl(
+  env: RelayEndpointEnv,
+  readKey: (name: string) => string | undefined,
+): UrlResolution {
+  const rejected: string[] = [];
+  const notes: string[] = [];
+
+  const envUrl = env.RELAY_WS_URL?.trim();
+  if (envUrl) {
+    if (isRelayWsUrl(envUrl)) {
+      notes.push(...transportNotes(envUrl));
+      return { url: envUrl, source: "env RELAY_WS_URL", rejected, notes };
+    }
+    rejected.push("env RELAY_WS_URL (not a ws:// or wss:// URL)");
+  }
+
+  const fileUrl = readKey("relay-ws-url.txt");
+  if (fileUrl) {
+    if (isRelayWsUrl(fileUrl)) {
+      notes.push(...transportNotes(fileUrl));
+      return { url: fileUrl, source: "keys/relay-ws-url.txt", rejected, notes };
+    }
+    rejected.push("keys/relay-ws-url.txt (not a ws:// or wss:// URL)");
+  }
+
+  const webhookUrl = readKey("telegram-webhook-url.txt");
+  const derived = webhookUrl ? deriveRelayWsUrl(webhookUrl) : null;
+  if (derived) {
+    if (isLoopbackHost(hostOf(derived))) {
+      notes.push(
+        "derived url points at a loopback host: the relay listens on WS_PORT (default 8444), not on the webhook port - set RELAY_WS_URL or keys/relay-ws-url.txt",
+      );
+    }
+    notes.push(...transportNotes(derived));
+    return { url: derived, source: "keys/telegram-webhook-url.txt (derived)", rejected, notes };
+  }
+  if (webhookUrl) {
+    rejected.push("keys/telegram-webhook-url.txt (no ws:// or wss:// URL could be derived)");
+  }
+
+  return { url: null, source: null, rejected, notes };
+}
+
+/** Resolve the auth token: env -> dedicated key file -> webhook secret. */
+function resolveToken(
+  env: RelayEndpointEnv,
+  readKey: (name: string) => string | undefined,
+): TokenResolution {
+  const envToken = env.RELAY_AUTH_TOKEN?.trim();
+  if (envToken) {
+    return { token: envToken, source: "env RELAY_AUTH_TOKEN" };
+  }
+
+  const fileToken = readKey("relay-auth-token.txt");
+  if (fileToken) {
+    return { token: fileToken, source: "keys/relay-auth-token.txt" };
+  }
+
+  const secret = readKey("telegram-webhook-secret.txt");
+  if (secret) {
+    return { token: secret, source: "keys/telegram-webhook-secret.txt" };
+  }
+
+  return { token: null, source: null };
+}
+
+/**
+ * Resolve the relay WebSocket URL and auth token.
+ *
+ * The first non-empty source wins. A blank file counts as missing (an empty
+ * value is a configuration mistake, not a valid endpoint). A source that holds
+ * a value which was REJECTED is reported in `missing` so the operator can see
+ * why the resolver moved on.
+ */
+export function resolveRelayEndpoint(options: ResolveRelayEndpointOptions): RelayEndpointResolution {
+  const env = options.env ?? (process.env as RelayEndpointEnv);
+  const read = options.readFile ?? defaultReadFile;
+
+  const readKey = (name: string): string | undefined => {
+    try {
+      const raw = read(join(options.keysDir, name));
+      const value = raw?.trim();
+      return value ? value : undefined;
+    } catch {
+      // An unreadable key file is treated as absent - the source list in
+      // `missing` tells the operator where to look.
+      return undefined;
+    }
+  };
+
+  const urlResolution = resolveUrl(env, readKey);
+  const tokenResolution = resolveToken(env, readKey);
+
+  const missing: string[] = [];
+  if (!urlResolution.url) {
+    missing.push(`url not resolved (looked at ${RELAY_URL_SOURCES.join(", ")})`);
+  }
+  if (!tokenResolution.token) {
+    missing.push(`token not resolved (looked at ${RELAY_TOKEN_SOURCES.join(", ")})`);
+  }
+  for (const reason of urlResolution.rejected) {
+    missing.push(`rejected source: ${reason}`);
+  }
+
+  return {
+    url: urlResolution.url,
+    urlSource: urlResolution.source,
+    token: tokenResolution.token,
+    tokenSource: tokenResolution.source,
+    missing,
+    notes: urlResolution.notes,
+  };
+}
+
+/**
+ * Log-safe description of a resolution (contains no token value).
+ */
+export function describeRelayEndpoint(resolution: RelayEndpointResolution): string {
+  const parts: string[] = [];
+  parts.push(resolution.url ? `url from ${resolution.urlSource}` : "url NOT resolved");
+  parts.push(resolution.token ? `token from ${resolution.tokenSource}` : "token NOT resolved");
+  let description = parts.join(", ");
+  if (resolution.notes.length > 0) {
+    description += ` (${resolution.notes.join("; ")})`;
+  }
+  return description;
+}

package/packages/relay/test/relay-endpoint.test.ts

@@ -0,0 +1,278 @@
+import { describe, expect, test } from "bun:test";
+import {
+	deriveRelayWsUrl,
+	describeRelayEndpoint,
+	isRelayWsUrl,
+	resolveRelayEndpoint,
+} from "../src/relay-endpoint.js";
+
+/** Build a fake key directory reader. */
+function makeKeys(files: Record<string, string>) {
+	return (path: string): string | undefined => {
+		const name = path.split("/").pop() ?? path;
+		return Object.prototype.hasOwnProperty.call(files, name) ? files[name] : undefined;
+	};
+}
+
+describe("deriveRelayWsUrl", () => {
+	test("maps an https webhook url to the relay websocket url", () => {
+		expect(deriveRelayWsUrl("https://webhook.bunchee.online/telegram")).toBe(
+			"wss://webhook.bunchee.online/ws",
+		);
+	});
+
+	test("documents the direct-app case: the relay listens on WS_PORT, not on the webhook port", () => {
+		// Behind a proxy (nginx `location /ws -> 127.0.0.1:8444`) the derived
+		// URL is correct. When the webhook URL addresses the app DIRECTLY the
+		// relay listens on WS_PORT (default 8444), so the derived URL is only
+		// a starting point - resolveRelayEndpoint() adds a note about it.
+		expect(deriveRelayWsUrl("http://127.0.0.1:8443/telegram")).toBe("ws://127.0.0.1:8443/ws");
+	});
+
+	test("keeps a wss url on the same host", () => {
+		expect(deriveRelayWsUrl("wss://webhook.bunchee.online/ws")).toBe("wss://webhook.bunchee.online/ws");
+	});
+
+	test("returns null for garbage", () => {
+		expect(deriveRelayWsUrl("not a url")).toBeNull();
+		expect(deriveRelayWsUrl("")).toBeNull();
+	});
+});
+
+describe("isRelayWsUrl", () => {
+	test("accepts ws and wss urls only", () => {
+		expect(isRelayWsUrl("ws://127.0.0.1:8444/ws")).toBe(true);
+		expect(isRelayWsUrl("wss://host/ws")).toBe(true);
+		expect(isRelayWsUrl("https://host/telegram")).toBe(false);
+		expect(isRelayWsUrl("")).toBe(false);
+	});
+
+	test("rejects urls that carry credentials or a query string", () => {
+		expect(isRelayWsUrl("wss://user:pass@host/ws")).toBe(false);
+		expect(isRelayWsUrl("wss://host/ws?token=secret")).toBe(false);
+	});
+});
+
+describe("resolveRelayEndpoint", () => {
+	test("prefers the environment over the key files", () => {
+		const resolution = resolveRelayEndpoint({
+			env: { RELAY_WS_URL: "wss://from-env/ws", RELAY_AUTH_TOKEN: "env-token" },
+			keysDir: "/keys",
+			readFile: makeKeys({
+				"relay-ws-url.txt": "wss://from-file/ws",
+				"relay-auth-token.txt": "file-token",
+			}),
+		});
+
+		expect(resolution.url).toBe("wss://from-env/ws");
+		expect(resolution.urlSource).toBe("env RELAY_WS_URL");
+		expect(resolution.token).toBe("env-token");
+		expect(resolution.tokenSource).toBe("env RELAY_AUTH_TOKEN");
+		expect(resolution.missing).toEqual([]);
+	});
+
+	test("falls back to the dedicated key files", () => {
+		const resolution = resolveRelayEndpoint({
+			env: {},
+			keysDir: "/keys",
+			readFile: makeKeys({
+				"relay-ws-url.txt": "wss://from-file/ws",
+				"relay-auth-token.txt": "file-token",
+			}),
+		});
+
+		expect(resolution.url).toBe("wss://from-file/ws");
+		expect(resolution.urlSource).toBe("keys/relay-ws-url.txt");
+		expect(resolution.token).toBe("file-token");
+		expect(resolution.tokenSource).toBe("keys/relay-auth-token.txt");
+		expect(resolution.missing).toEqual([]);
+	});
+
+	test("derives the url from the telegram webhook url and the token from the webhook secret", () => {
+		const resolution = resolveRelayEndpoint({
+			env: {},
+			keysDir: "/keys",
+			readFile: makeKeys({
+				"telegram-webhook-url.txt": "https://webhook.bunchee.online/telegram",
+				"telegram-webhook-secret.txt": "shared-secret",
+			}),
+		});
+
+		expect(resolution.url).toBe("wss://webhook.bunchee.online/ws");
+		expect(resolution.urlSource).toBe("keys/telegram-webhook-url.txt (derived)");
+		expect(resolution.token).toBe("shared-secret");
+		expect(resolution.tokenSource).toBe("keys/telegram-webhook-secret.txt");
+		expect(resolution.missing).toEqual([]);
+		expect(resolution.notes).toEqual([]);
+	});
+
+	test("reports what is missing when nothing is configured", () => {
+		const resolution = resolveRelayEndpoint({
+			env: {},
+			keysDir: "/keys",
+			readFile: makeKeys({}),
+		});
+
+		expect(resolution.url).toBeNull();
+		expect(resolution.token).toBeNull();
+		expect(resolution.missing).toHaveLength(2);
+		expect(resolution.missing[0]).toContain("url");
+		expect(resolution.missing[1]).toContain("token");
+	});
+
+	test("treats a blank key file as missing", () => {
+		const resolution = resolveRelayEndpoint({
+			env: {},
+			keysDir: "/keys",
+			readFile: makeKeys({
+				"relay-ws-url.txt": "   \n",
+				"relay-auth-token.txt": "",
+			}),
+		});
+
+		expect(resolution.url).toBeNull();
+		expect(resolution.token).toBeNull();
+		expect(resolution.missing).toHaveLength(2);
+	});
+
+	test("ignores a key file that does not hold a websocket url", () => {
+		const resolution = resolveRelayEndpoint({
+			env: {},
+			keysDir: "/keys",
+			readFile: makeKeys({
+				"relay-ws-url.txt": "https://webhook.bunchee.online/telegram",
+				"telegram-webhook-url.txt": "https://webhook.bunchee.online/telegram",
+			}),
+		});
+
+		expect(resolution.url).toBe("wss://webhook.bunchee.online/ws");
+		expect(resolution.urlSource).toBe("keys/telegram-webhook-url.txt (derived)");
+		expect(resolution.missing.join(" ")).toContain(
+			"rejected source: keys/relay-ws-url.txt (not a ws:// or wss:// URL)",
+		);
+	});
+
+	test("rejects an env url that carries credentials", () => {
+		const resolution = resolveRelayEndpoint({
+			env: { RELAY_WS_URL: "wss://user:pass@host/ws" },
+			keysDir: "/keys",
+			readFile: makeKeys({ "relay-ws-url.txt": "wss://from-file/ws" }),
+		});
+
+		expect(resolution.url).toBe("wss://from-file/ws");
+		expect(resolution.missing.join(" ")).toContain("rejected source: env RELAY_WS_URL");
+		// The rejected value must not be echoed back - it may hold a secret.
+		expect(resolution.missing.join(" ")).not.toContain("user:pass");
+		expect(describeRelayEndpoint(resolution)).not.toContain("user:pass");
+	});
+
+	test("warns when a remote host would be used over plaintext ws", () => {
+		const resolution = resolveRelayEndpoint({
+			env: { RELAY_WS_URL: "ws://relay.example.com/ws" },
+			keysDir: "/keys",
+			readFile: makeKeys({}),
+		});
+
+		expect(resolution.url).toBe("ws://relay.example.com/ws");
+		expect(resolution.notes.join(" ")).toContain("plaintext");
+	});
+
+	test("does not warn about a plaintext ws url on the loopback interface", () => {
+		const resolution = resolveRelayEndpoint({
+			env: { RELAY_WS_URL: "ws://127.0.0.1:8444/ws" },
+			keysDir: "/keys",
+			readFile: makeKeys({}),
+		});
+
+		expect(resolution.notes.join(" ")).not.toContain("plaintext");
+	});
+
+	test("never leaks the token in the description", () => {
+		const resolution = resolveRelayEndpoint({
+			env: {},
+			keysDir: "/keys",
+			readFile: makeKeys({
+				"relay-ws-url.txt": "wss://host/ws",
+				"relay-auth-token.txt": "super-secret-token",
+			}),
+		});
+
+		const description = describeRelayEndpoint(resolution);
+		expect(description).toContain("url from keys/relay-ws-url.txt");
+		expect(description).toContain("token from keys/relay-auth-token.txt");
+		expect(description).not.toContain("super-secret-token");
+	});
+
+	test("describes a missing endpoint without a secret", () => {
+		const resolution = resolveRelayEndpoint({ env: {}, keysDir: "/keys", readFile: makeKeys({}) });
+		const description = describeRelayEndpoint(resolution);
+		expect(description).toContain("url NOT resolved");
+		expect(description).toContain("token NOT resolved");
+		// The source list lives in `missing`; the description must not repeat it.
+		expect(description).not.toContain("looked at");
+	});
+
+	test("records a rejected env url so the operator can see why it was skipped", () => {
+		const resolution = resolveRelayEndpoint({
+			env: { RELAY_WS_URL: "https://host/telegram" },
+			keysDir: "/keys",
+			readFile: makeKeys({ "relay-ws-url.txt": "wss://from-file/ws" }),
+		});
+
+		expect(resolution.url).toBe("wss://from-file/ws");
+		expect(resolution.urlSource).toBe("keys/relay-ws-url.txt");
+		expect(resolution.missing.join(" ")).toContain("rejected source: env RELAY_WS_URL");
+	});
+
+	test("treats an unreadable key file as absent", () => {
+		const resolution = resolveRelayEndpoint({
+			env: {},
+			keysDir: "/keys",
+			readFile: () => {
+				throw new Error("EACCES");
+			},
+		});
+
+		expect(resolution.url).toBeNull();
+		expect(resolution.token).toBeNull();
+		expect(resolution.missing).toHaveLength(2);
+	});
+
+	test("resolves nothing when the keys directory does not exist", () => {
+		const resolution = resolveRelayEndpoint({
+			env: {},
+			keysDir: "/definitely/not/a/keys/dir",
+		});
+
+		expect(resolution.url).toBeNull();
+		expect(resolution.token).toBeNull();
+		expect(resolution.missing).toHaveLength(2);
+	});
+
+	test("trims a token that ends with CRLF", () => {
+		const resolution = resolveRelayEndpoint({
+			env: {},
+			keysDir: "/keys",
+			readFile: makeKeys({
+				"relay-ws-url.txt": "wss://host/ws",
+				"relay-auth-token.txt": "token-with-crlf\r\n",
+			}),
+		});
+
+		expect(resolution.token).toBe("token-with-crlf");
+	});
+
+	test("warns when the derived url points at a loopback host", () => {
+		const resolution = resolveRelayEndpoint({
+			env: {},
+			keysDir: "/keys",
+			readFile: makeKeys({
+				"telegram-webhook-url.txt": "http://127.0.0.1:8443/telegram",
+			}),
+		});
+
+		expect(resolution.url).toBe("ws://127.0.0.1:8443/ws");
+		expect(resolution.notes.join(" ")).toContain("WS_PORT");
+		expect(describeRelayEndpoint(resolution)).toContain("WS_PORT");
+	});
+});

package/packages/release-manager/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/release-manager",
-  "version": "1.1.387",
+  "version": "1.1.388",
   "type": "module",
   "description": "Release management for pi-harness",
   "main": "dist/index.js",

package/packages/requirement-compiler/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/requirement-compiler",
-  "version": "1.1.387",
+  "version": "1.1.388",
   "description": "Compiles raw requirements into validated CompiledRequirement with ambiguity detection and risk tagging",
   "type": "module",
   "main": "./dist/index.js",

package/packages/runtime/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/runtime",
-  "version": "1.1.387",
+  "version": "1.1.388",
   "description": "pi-harness-runtime — runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/scheduler/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/scheduler",
-  "version": "1.1.387",
+  "version": "1.1.388",
   "description": "pi-harness-runtime — scheduler",
   "type": "module",
   "main": "./dist/index.js",

package/packages/scheduler-adapter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/scheduler-adapter",
-  "version": "1.1.387",
+  "version": "1.1.388",
   "description": "Scheduler Adapter — cron, systemd, launchd, internal adapters for autonomous runtime (RFC-0101 §6)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/session/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/session",
-  "version": "1.1.387",
+  "version": "1.1.388",
   "description": "Session management system for pi-harness-runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/session-api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/session-api",
-  "version": "1.1.387",
+  "version": "1.1.388",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/session-export/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/session-export",
-  "version": "1.1.387",
+  "version": "1.1.388",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/shared-context/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/shared-context",
-  "version": "1.1.387",
+  "version": "1.1.388",
   "description": "pi-harness-runtime — shared-context",
   "type": "module",
   "main": "./dist/index.js",

package/packages/skill-mcp-client/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/skill-mcp-client",
-  "version": "1.1.387",
+  "version": "1.1.388",
   "description": "MCP client for Skills SaaS backend",
   "type": "module",
   "main": "./dist/index.js",

package/packages/skill-registry/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/skill-registry",
-  "version": "1.1.387",
+  "version": "1.1.388",
   "description": "Skill Registry for pi-harness-runtime — dynamic skill discovery and invocation",
   "type": "module",
   "main": "./dist/index.js",