pi-harness-runtime 1.1.387 → 1.1.388

package/packages/skills/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/skills",
-  "version": "1.1.387",
+  "version": "1.1.388",
   "description": "File-based skill system with pi.dev compatibility and Hermes self-improvement",
   "type": "module",
   "main": "src/index.ts",

package/packages/sprint-planner/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/sprint-planner",
-  "version": "1.1.387",
+  "version": "1.1.388",
   "type": "module",
   "description": "Sprint planning engine for pi-harness",
   "main": "dist/index.js",

package/packages/subscription-engine/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/subscription-engine",
-  "version": "1.1.387",
+  "version": "1.1.388",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/task-compiler/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/task-compiler",
-  "version": "1.1.387",
+  "version": "1.1.388",
   "description": "Task Compiler for pi-harness-runtime — produces deterministic task DAG from CompiledRequirement",
   "type": "module",
   "main": "./dist/index.js",

package/packages/telegram/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/telegram",
-  "version": "1.1.387",
+  "version": "1.1.388",
   "description": "pi-harness-runtime — Telegram inbound/outbound",
   "type": "module",
   "main": "./src/index.js",

package/packages/tencentdb-memory/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moocoding/tencentdb-memory",
-  "version": "1.1.387",
+  "version": "1.1.388",
   "description": "TencentDB Agent Memory client - sync skills to centralized knowledge base",
   "type": "module",
   "main": "src/index.ts",

package/packages/tencentdb-sync/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/tencentdb-sync",
-  "version": "1.1.387",
+  "version": "1.1.388",
   "description": "Sync SKILL.md skills to TencentDB-Agent-Memory server (RFC-0105/0106)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/test-data-generator/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/test-data-generator",
-  "version": "1.1.387",
+  "version": "1.1.388",
   "description": "Test data generation for pi-harness-runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/test-generator/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/test-generator",
-  "version": "1.1.387",
+  "version": "1.1.388",
   "description": "Auto-Test Generator — generate unit and E2E tests from source code (RFC-0013)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/todo-bd-sync/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moocoding/todo-bd-sync",
-  "version": "1.1.387",
+  "version": "1.1.388",
   "description": "Two-way sync between rpiv-todo overlay and bd issue tracker",
   "type": "module",
   "main": "src/index.ts",

package/packages/token-estimation/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/token-estimation",
-  "version": "1.1.387",
+  "version": "1.1.388",
   "description": "pi-harness-runtime — token-estimation",
   "type": "module",
   "main": "./dist/index.js",

package/packages/token-optimizer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/token-optimizer",
-  "version": "1.1.387",
+  "version": "1.1.388",
   "description": "Token Budget Optimizer — maximize prompt value within token limits (RFC-0011)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/trajectory/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/trajectory",
-  "version": "1.1.387",
+  "version": "1.1.388",
   "description": "Trajectory capture for the write-review loop — persists cycle records for learning",
   "type": "module",
   "main": "./dist/src/index.js",

package/packages/tui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/tui",
-  "version": "1.1.387",
+  "version": "1.1.388",
   "description": "pi-harness-runtime — tui",
   "type": "module",
   "main": "./dist/index.js",

package/packages/tui/test/harness-footer.test.ts

@@ -76,7 +76,7 @@ function makeSessionInfo(overrides: Partial<FooterSessionInfo> = {}): FooterSess
 }
 
 const QUOTA = "MiniMax: 5h: 98% left (resets 3 hr 15 min) - week: 85% left";
-const WORKSPACE = "Workspace: DEV | dev server: running | build: explicit request | RAM: 6.4/15";
+const WORKSPACE = "Workspace: DEVELOPMENT | dev server: running | build: not running (script available) | RAM: 6.4/15";
 
 // ---------------------------------------------------------------------------
 // Tests

package/packages/types/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/types",
-  "version": "1.1.387",
+  "version": "1.1.388",
   "description": "Shared TypeScript types for pi-harness-runtime packages",
   "type": "module",
   "main": "./src/index.js",

package/packages/voice-api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/voice-api",
-  "version": "1.1.387",
+  "version": "1.1.388",
   "type": "module",
   "description": "Voice-to-text API using Whisper for Telegram and LINE integration",
   "main": "./dist/index.js",

package/packages/webmcp-tester/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/webmcp-tester",
-  "version": "1.1.387",
+  "version": "1.1.388",
   "description": "WebMCP-powered E2E testing for pi-harness - natural language test scenarios",
   "type": "module",
   "main": "./dist/index.js",

package/packages/wiki/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/wiki",
-  "version": "1.1.387",
+  "version": "1.1.388",
   "description": "LLM Wiki integration for pi-harness-runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/workflow-events/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/workflow-events",
-  "version": "1.1.387",
+  "version": "1.1.388",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/workspace-scanner/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/workspace-scanner",
-  "version": "1.1.387",
+  "version": "1.1.388",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/worktree/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/worktree",
-  "version": "1.1.387",
+  "version": "1.1.388",
   "description": "pi-harness-runtime — worktree",
   "type": "module",
   "main": "./dist/index.js",

package/packages/write-review/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moocoding/write-review",
-  "version": "1.1.387",
+  "version": "1.1.388",
   "description": "Two-agent write-review loop with blackboard coordination",
   "type": "module",
   "main": "src/index.ts",

package/scripts/relay-client.ts

@@ -8,20 +8,31 @@
  * - Typed message handling
  * 
  * Usage:
- *   RELAY_WS_URL=wss://webhook.bunchee.online:8444 \
- *   RELAY_AUTH_TOKEN=change-me-in-production \
  *   bun run scripts/relay-client.ts
+ *
+ * The endpoint and the token are resolved from the environment and the key
+ * files (see resolveRelayEndpoint); no URL or token has to be passed in.
  */
 
 import { readFileSync, writeFileSync, existsSync } from "fs";
 import { join } from "path";
 import { homedir } from "os";
 import { RelayClient } from "../packages/relay/src/client";
+import { describeRelayEndpoint, resolveRelayEndpoint } from "../packages/relay/src/relay-endpoint";
 import type { CallbackPayload, SnapshotMessage } from "../packages/relay/src/types";
 
 // Configuration
-const RELAY_WS_URL = process.env.RELAY_WS_URL || "wss://webhook.bunchee.online:8444";
-const RELAY_AUTH_TOKEN = process.env.RELAY_AUTH_TOKEN || "change-me-in-production";
+// The relay endpoint is resolved from the SAME sources the relay server uses
+// (env -> dedicated key file -> the telegram webhook url/secret), so the
+// client and the server always agree on the URL and the token.
+// The token value is never logged - only the source it came from.
+const KEYS_DIR = join(homedir(), ".pi-harness-runtime", "keys");
+const RELAY_ENDPOINT = resolveRelayEndpoint({ keysDir: KEYS_DIR });
+// The resolver already consulted the environment - a value it rejected must
+// NOT be re-used here, otherwise the client would connect to an endpoint the
+// resolver deliberately skipped.
+const RELAY_WS_URL = RELAY_ENDPOINT.url ?? "";
+const RELAY_AUTH_TOKEN = RELAY_ENDPOINT.token ?? "";
 const JOB_PIPE_FILE = join(homedir(), ".pi-harness-runtime", "job-commands.jsonl");
 
 // ============================================================================
@@ -96,10 +107,19 @@ async function processCallback(callback: CallbackPayload): Promise<void> {
 // ============================================================================
 
 async function main() {
+  // Validate BEFORE printing the banner - an unconfigured run must not print
+  // an empty "Server:" line.
+  if (!RELAY_WS_URL || !RELAY_AUTH_TOKEN) {
+    console.error("[Client] Relay endpoint not configured");
+    console.error(`[Client] ${RELAY_ENDPOINT.missing.join("; ")}`);
+    process.exit(1);
+  }
+
   console.log("===========================================");
   console.log("Real-time Callback Relay Client - Streaming v2");
   console.log("===========================================");
   console.log(`Server: ${RELAY_WS_URL}`);
+  console.log(`Endpoint: ${describeRelayEndpoint(RELAY_ENDPOINT)}`);
   console.log("===========================================");
 
   // Create client with typed callbacks

package/scripts/unified-webhook-server.ts

@@ -22,6 +22,7 @@ import { join } from "node:path";
 import { homedir } from "os";
 import { createServer, IncomingMessage, ServerResponse } from "node:http";
 import { createRelayServer } from "../packages/relay/src/server";
+import { resolveRelayEndpoint } from "../packages/relay/src/relay-endpoint";
 import { generateMessageId } from "../packages/relay/src/types";
 import type { CallbackPayload } from "../packages/relay/src/types";
 import type { RelayServerOptions } from "../packages/relay/src/server";
@@ -37,8 +38,8 @@ interface Config {
     accessToken: string;
     channelSecret: string;
   };
-  /** Relay auth token used by WebSocket clients. */
-  relayAuthToken: string;
+  /** Relay auth token used by WebSocket clients (null = relay stays off). */
+  relayAuthToken: string | null;
 }
 
 const PORT = parseInt(process.env.PORT || "8443", 10);
@@ -46,24 +47,17 @@ const WS_PORT = parseInt(process.env.WS_PORT || "8444", 10);
 /**
  * Resolve the relay auth token.
  *
- * Priority: RELAY_AUTH_TOKEN env -> keys/relay-auth-token.txt ->
- * keys/telegram-webhook-secret.txt -> placeholder.
+ * The chain lives in packages/relay/src/relay-endpoint.ts and is SHARED with
+ * the relay client, so the two sides can never disagree about the credential:
+ * RELAY_AUTH_TOKEN env -> keys/relay-auth-token.txt ->
+ * keys/telegram-webhook-secret.txt.
  *
- * Never hardcode a real token here; secrets live in key files.
+ * Never hardcode a real token here; secrets live in key files. When no token
+ * can be found the relay is NOT started at all - a placeholder token would
+ * let anyone who knows it connect to the relay.
  */
-function resolveAuthToken(keysDir: string): string {
-  const fromEnv = process.env.RELAY_AUTH_TOKEN?.trim();
-  if (fromEnv) return fromEnv;
-
-  for (const name of ["relay-auth-token.txt", "telegram-webhook-secret.txt"]) {
-    const path = join(keysDir, name);
-    if (existsSync(path)) {
-      const value = readFileSync(path, "utf-8").trim();
-      if (value) return value;
-    }
-  }
-
-  return "change-me-in-production";
+function resolveAuthToken(keysDir: string): string | null {
+  return resolveRelayEndpoint({ keysDir }).token;
 }
 const SERVER_VERSION = process.env.SERVER_VERSION || "1.0.0";
 
@@ -377,14 +371,19 @@ async function main() {
   if (config.telegram) console.log("  /telegram - Telegram webhook");
   if (config.line) console.log("  /line     - LINE webhook");
   console.log(`  HTTP:      http://0.0.0.0:${PORT}`);
-  console.log(`  WebSocket: ws://0.0.0.0:${WS_PORT}`);
+  console.log(
+    config.relayAuthToken
+      ? `  WebSocket: ws://0.0.0.0:${WS_PORT}`
+      : `  WebSocket: disabled (no relay auth token configured)`,
+  );
   console.log("===========================================");
 
   // Create relay server with typed streaming
   const relayOptions: RelayServerOptions = {
     port: WS_PORT,
     host: "0.0.0.0",
-    authToken: config.relayAuthToken,
+    // Without a configured token the relay is never started - see below.
+    authToken: config.relayAuthToken ?? "",
     serverVersion: SERVER_VERSION,
     onStateChange: (change: { previous: { state: string }; current: { state: string }; timestamp: string }) => {
       console.log(`[Relay] State: ${change.previous.state} → ${change.current.state}`);
@@ -394,8 +393,16 @@ async function main() {
   const relayServer = createRelayServer(relayOptions);
 
   // Start WebSocket relay
-  await relayServer.start();
-  console.log("[Relay] WebSocket server started on port", WS_PORT);
+  if (config.relayAuthToken) {
+    await relayServer.start();
+    console.log("[Relay] WebSocket server started on port", WS_PORT);
+  } else {
+    // Fail closed: without a secret no client may connect. The HTTP webhook
+    // keeps working and the callbacks are queued on disk instead.
+    console.error(
+      "[Relay] No relay auth token configured (RELAY_AUTH_TOKEN, keys/relay-auth-token.txt or keys/telegram-webhook-secret.txt) - the relay WebSocket server will NOT start; callbacks are queued on disk.",
+    );
+  }
 
   // HTTP webhook server
   const server = createServer(async (req, res) => {