pi-harness-runtime 1.1.413 → 1.1.415

package/packages/skills/dist/sanitize.js

@@ -0,0 +1,75 @@
+/**
+ * The sanitization of a skill for the shared collection.
+ *
+ * The collection is shared, so a client name must not travel into it. The
+ * rules lived in `scripts/sync-to-qdrant.ts` - the only writer that could
+ * reach them. The runtime registry writes into the same collection, so it
+ * needs them too: a writer that skipped the rules would leave the raw
+ * name and the raw body of a client skill in a shared cluster.
+ *
+ * Both writers therefore build their points with the same rules, and the
+ * name of a point is the sanitized name. One skill, one point.
+ */
+/**
+ * The patterns of the client specific names.
+ *
+ * The list is about the names of the clients and the projects of the
+ * users of the harness - not about the skills themselves.
+ */
+const SANITIZATION_RULES = [
+    // Client company names (case-insensitive)
+    { pattern: /\binpac\b/gi, replacement: "[Client A]" },
+    { pattern: /\bm-capital\b/gi, replacement: "[Client A]" },
+    { pattern: /\bmcapital\b/gi, replacement: "[Client A]" },
+    { pattern: /\bdigisoft\b/gi, replacement: "[Client B]" },
+    // Project/app specific names
+    { pattern: /\bgse-insurance\b/gi, replacement: "[Insurance Project]" },
+    { pattern: /\btbs-import\b/gi, replacement: "[Import Project]" },
+    { pattern: /\bdigisoft_erp\b/gi, replacement: "[Client B Erp]" },
+    { pattern: /\bm_capital\b/gi, replacement: "[Client A]" },
+    { pattern: /\binpac_\b/gi, replacement: "[Client A]_" },
+    { pattern: /\bpaperclip_\b/gi, replacement: "[Client D]_" },
+    { pattern: /\bopenclaw_\b/gi, replacement: "[Client F]_" },
+    // Generic replacements
+    { pattern: /Company Name/gi, replacement: "[Client Name]" },
+    { pattern: /your company/gi, replacement: "[Client]" },
+    { pattern: /our client/gi, replacement: "[Client]" },
+    { pattern: /client-specific/gi, replacement: "[Project-specific]" },
+];
+/**
+ * The names that are renamed as a whole.
+ *
+ * A name that would be unreadable after the pattern rules - a name that
+ * carries the client name in its middle - is renamed here.
+ */
+const SKILL_NAME_MAP = {
+    "gse-insurance-step5-slot-filter": "insurance-project-step-filter",
+    "inpac-pe-approval-workflow": "client-a-pe-approval-workflow",
+    "inpac-po-approval-workflow": "client-a-po-approval-workflow",
+    "inpac-pr-approval-workflow": "client-a-pr-approval-workflow",
+    "tbs-import-clearance-lcv": "import-project-clearance",
+    whispertool: "whisper-tool",
+};
+/**
+ * Replace the client specific names of a text.
+ *
+ * The text stays the same length, so a vector that was built from it
+ * keeps its shape.
+ */
+export function sanitizeText(text) {
+    let result = text;
+    for (const rule of SANITIZATION_RULES) {
+        result = result.replace(rule.pattern, rule.replacement);
+    }
+    return result;
+}
+/**
+ * The name of a skill in the shared collection.
+ *
+ * The name is the identity of the point, so it has to be the same for
+ * every writer: the map first, then the pattern rules.
+ */
+export function skillPointName(name) {
+    return SKILL_NAME_MAP[name] || sanitizeText(name);
+}
+//# sourceMappingURL=sanitize.js.map

package/packages/skills/dist/sanitize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.js","sourceRoot":"","sources":["../src/sanitize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAQH;;;;;GAKG;AACH,MAAM,kBAAkB,GAAuB;IAC7C,0CAA0C;IAC1C,EAAE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE;IACrD,EAAE,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,YAAY,EAAE;IACzD,EAAE,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,YAAY,EAAE;IACxD,EAAE,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,YAAY,EAAE;IAExD,6BAA6B;IAC7B,EAAE,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,qBAAqB,EAAE;IACtE,EAAE,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,kBAAkB,EAAE;IAChE,EAAE,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,gBAAgB,EAAE;IAChE,EAAE,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,YAAY,EAAE;IACzD,EAAE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,aAAa,EAAE;IACvD,EAAE,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,aAAa,EAAE;IAC3D,EAAE,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,aAAa,EAAE;IAE1D,uBAAuB;IACvB,EAAE,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,eAAe,EAAE;IAC3D,EAAE,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,UAAU,EAAE;IACtD,EAAE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,UAAU,EAAE;IACpD,EAAE,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,oBAAoB,EAAE;CACpE,CAAC;AAEF;;;;;GAKG;AACH,MAAM,cAAc,GAA2B;IAC9C,iCAAiC,EAAE,+BAA+B;IAClE,4BAA4B,EAAE,+BAA+B;IAC7D,4BAA4B,EAAE,+BAA+B;IAC7D,4BAA4B,EAAE,+BAA+B;IAC7D,0BAA0B,EAAE,0BAA0B;IACtD,WAAW,EAAE,cAAc;CAC3B,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACxC,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,IAAI,IAAI,kBAAkB,EAAE,CAAC;QACvC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IAC1C,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;AACnD,CAAC"}

package/packages/skills/dist/vector-schema.d.ts

@@ -45,12 +45,101 @@ export interface SkillVectorSchema {
     model?: string;
 }
 /**
- * Why the collection does not match the expected schema - or null when it
- * does.
+ * The payload of a skill point.
  *
- * The message names the numbers, so the reader can tell WHICH schema the
- * collection was built with.
+ * Both writers of the collection - the runtime registry and
+ * `scripts/sync-to-qdrant.ts` - store the SAME payload under the SAME
+ * point id. A point is addressed by its id, so a writer that used a
+ * different id for the same skill would leave two points behind, and a
+ * writer whose id happened to collide with a foreign one would overwrite
+ * an unrelated skill.
  */
+export type SkillPointPayload = {
+    /** The name of the skill. The point id is derived from it. */
+    name: string;
+    /** What the skill does. */
+    description: string;
+    /** The body of the skill. */
+    body: string;
+    /** The text the vector was built from. */
+    text: string;
+};
+/**
+ * The body of a payload is truncated.
+ *
+ * A payload is an index, not a file store - the complete skill comes from
+ * the skill service.
+ */
+export declare const SKILL_PAYLOAD_BODY_LIMIT = 2000;
+/** The text of a payload is truncated as well. */
+export declare const SKILL_PAYLOAD_TEXT_LIMIT = 1500;
+/**
+ * A stable hash of a string.
+ *
+ * The same string always produces the same number, in every process and
+ * on every machine - a point id has to survive a restart.
+ *
+ * Two uses:
+ * - the id of a point is the hash of the name its payload carries, so the
+ *   point id and the payload name always belong together. Two writers
+ *   that store the same name address the same point.
+ * - the hash of the text of a skill says whether its content changed.
+ */
+export declare function stableHash(value: string): number;
+/**
+ * The text a skill vector is built from.
+ *
+ * The title is added when it differs from the name: a skill whose
+ * directory is named differently from its title carries both.
+ */
+export declare function skillPointText(input: {
+    /** The name the payload carries - the identity of the skill. */
+    name: string;
+    /** The title of the skill, when it differs from the name. */
+    title?: string;
+    /** What the skill does. */
+    description: string;
+    /** The body of the skill. */
+    body: string;
+}): string;
+/**
+ * A point of the skill collection.
+ *
+ * The id is the hash of the name the payload carries, so the point id and
+ * the payload name always belong together: two writers that store the
+ * same name address the same point.
+ */
+export interface SkillQdrantPoint {
+    id: number;
+    payload: SkillPointPayload;
+}
+/**
+ * The point of a skill.
+ *
+ * The runtime registry and `scripts/sync-to-qdrant.ts` both build their
+ * points here, so they cannot drift apart. A writer that used its own id
+ * would leave a second point for every skill the other one indexes, and
+ * an id that happens to collide with a foreign one would overwrite an
+ * unrelated skill.
+ */
+export declare function skillQdrantPoint(payload: SkillPointPayload): SkillQdrantPoint;
+/**
+ * The payload of a skill point.
+ *
+ * The payload is sanitized: the collection is shared, so the client names
+ * of a user must not travel into it. Both writers use this function, so
+ * both write the same sanitized payload for the same skill.
+ */
+export declare function skillPointPayload(input: {
+    /** The name the payload carries - the identity of the skill. */
+    name: string;
+    /** The title of the skill, when it differs from the name. */
+    title?: string;
+    /** What the skill does. */
+    description: string;
+    /** The body of the skill. */
+    body: string;
+}): SkillPointPayload;
 export declare function describeSkillSchemaMismatch(actual: {
     dimensions?: number;
     distance?: string;

package/packages/skills/dist/vector-schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vector-schema.d.ts","sourceRoot":"","sources":["../src/vector-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,gCAAgC,CAAC;AAE9D;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,sBAAsB,CAAC;AAE3D,0CAA0C;AAC1C,eAAO,MAAM,6BAA6B,2CAA2C,CAAC;AAEtF,gDAAgD;AAChD,eAAO,MAAM,kCAAkC,MAAM,CAAC;AAEtD,yDAAyD;AACzD,MAAM,WAAW,iBAAiB;IACjC,uBAAuB;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,2BAA2B;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAC1C,MAAM,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,EAClD,QAAQ,EAAE,iBAAiB,GACzB,MAAM,GAAG,IAAI,CASf"}
+{"version":3,"file":"vector-schema.d.ts","sourceRoot":"","sources":["../src/vector-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,gCAAgC,CAAC;AAE9D;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,sBAAsB,CAAC;AAE3D,0CAA0C;AAC1C,eAAO,MAAM,6BAA6B,2CAA2C,CAAC;AAEtF,gDAAgD;AAChD,eAAO,MAAM,kCAAkC,MAAM,CAAC;AAEtD,yDAAyD;AACzD,MAAM,WAAW,iBAAiB;IACjC,uBAAuB;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,2BAA2B;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,2BAA2B;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,6BAA6B;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAE7C,kDAAkD;AAClD,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAE7C;;;;;;;;;;;GAWG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMhD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE;IACpC,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2BAA2B;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,6BAA6B;IAC7B,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,MAAM,CAMT;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,iBAAiB,CAAC;CAC5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,GAAG,gBAAgB,CAE7E;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2BAA2B;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,6BAA6B;IAC7B,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,iBAAiB,CAWpB;AACD,wBAAgB,2BAA2B,CAC1C,MAAM,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,EAClD,QAAQ,EAAE,iBAAiB,GACzB,MAAM,GAAG,IAAI,CASf"}

package/packages/skills/dist/vector-schema.js

@@ -15,6 +15,7 @@
  * module owns the collection - that is a decision of the skills domain, not
  * of the vector store.
  */
+import { sanitizeText, skillPointName } from "./sanitize.js";
 /**
  * The collection the runtime indexes into and searches.
  *
@@ -36,12 +37,78 @@ export const LEGACY_SKILL_COLLECTION_MODEL = "sentence-transformers/all-MiniLM-L
 /** The vector size of the legacy collection. */
 export const LEGACY_SKILL_COLLECTION_DIMENSIONS = 384;
 /**
- * Why the collection does not match the expected schema - or null when it
- * does.
+ * The body of a payload is truncated.
  *
- * The message names the numbers, so the reader can tell WHICH schema the
- * collection was built with.
+ * A payload is an index, not a file store - the complete skill comes from
+ * the skill service.
  */
+export const SKILL_PAYLOAD_BODY_LIMIT = 2000;
+/** The text of a payload is truncated as well. */
+export const SKILL_PAYLOAD_TEXT_LIMIT = 1500;
+/**
+ * A stable hash of a string.
+ *
+ * The same string always produces the same number, in every process and
+ * on every machine - a point id has to survive a restart.
+ *
+ * Two uses:
+ * - the id of a point is the hash of the name its payload carries, so the
+ *   point id and the payload name always belong together. Two writers
+ *   that store the same name address the same point.
+ * - the hash of the text of a skill says whether its content changed.
+ */
+export function stableHash(value) {
+    let hash = 0;
+    for (let i = 0; i < value.length; i++) {
+        hash = (Math.imul(31, hash) + value.charCodeAt(i)) | 0;
+    }
+    return Math.abs(hash);
+}
+/**
+ * The text a skill vector is built from.
+ *
+ * The title is added when it differs from the name: a skill whose
+ * directory is named differently from its title carries both.
+ */
+export function skillPointText(input) {
+    const parts = [input.name];
+    if (input.title && input.title !== input.name)
+        parts.push(input.title);
+    parts.push(input.description);
+    parts.push(input.body.slice(0, SKILL_PAYLOAD_TEXT_LIMIT));
+    return parts.join(" ");
+}
+/**
+ * The point of a skill.
+ *
+ * The runtime registry and `scripts/sync-to-qdrant.ts` both build their
+ * points here, so they cannot drift apart. A writer that used its own id
+ * would leave a second point for every skill the other one indexes, and
+ * an id that happens to collide with a foreign one would overwrite an
+ * unrelated skill.
+ */
+export function skillQdrantPoint(payload) {
+    return { id: stableHash(payload.name), payload };
+}
+/**
+ * The payload of a skill point.
+ *
+ * The payload is sanitized: the collection is shared, so the client names
+ * of a user must not travel into it. Both writers use this function, so
+ * both write the same sanitized payload for the same skill.
+ */
+export function skillPointPayload(input) {
+    const name = skillPointName(input.name);
+    const title = input.title ? skillPointName(input.title) : undefined;
+    const description = sanitizeText(input.description);
+    const body = sanitizeText(input.body).slice(0, SKILL_PAYLOAD_BODY_LIMIT);
+    return {
+        name,
+        description,
+        body,
+        text: skillPointText({ name, title, description, body }),
+    };
+}
 export function describeSkillSchemaMismatch(actual, expected) {
     if (actual.dimensions !== undefined && actual.dimensions !== expected.dimensions) {
         const model = expected.model ? ` (${expected.model})` : "";

package/packages/skills/dist/vector-schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"vector-schema.js","sourceRoot":"","sources":["../src/vector-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,6BAA6B,CAAC;AAE9D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,mBAAmB,CAAC;AAE3D,0CAA0C;AAC1C,MAAM,CAAC,MAAM,6BAA6B,GAAG,wCAAwC,CAAC;AAEtF,gDAAgD;AAChD,MAAM,CAAC,MAAM,kCAAkC,GAAG,GAAG,CAAC;AAYtD;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CAC1C,MAAkD,EAClD,QAA2B;IAE3B,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC;QAClF,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,OAAO,wBAAwB,MAAM,CAAC,UAAU,iDAAiD,QAAQ,CAAC,UAAU,GAAG,KAAK,EAAE,CAAC;IAChI,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC5E,OAAO,2BAA2B,MAAM,CAAC,QAAQ,kCAAkC,QAAQ,CAAC,QAAQ,EAAE,CAAC;IACxG,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC"}
+{"version":3,"file":"vector-schema.js","sourceRoot":"","sources":["../src/vector-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE7D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,6BAA6B,CAAC;AAE9D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,mBAAmB,CAAC;AAE3D,0CAA0C;AAC1C,MAAM,CAAC,MAAM,6BAA6B,GAAG,wCAAwC,CAAC;AAEtF,gDAAgD;AAChD,MAAM,CAAC,MAAM,kCAAkC,GAAG,GAAG,CAAC;AAiCtD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAE7C,kDAAkD;AAClD,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAE7C;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACxB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,KAS9B;IACC,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACvE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC9B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAC1D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAcD;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAA0B;IACzD,OAAO,EAAE,EAAE,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC;AACnD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,KASjC;IACC,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,MAAM,WAAW,GAAG,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC;IACzE,OAAO;QACL,IAAI;QACJ,WAAW;QACX,IAAI;QACJ,IAAI,EAAE,cAAc,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;KACzD,CAAC;AACJ,CAAC;AACD,MAAM,UAAU,2BAA2B,CAC1C,MAAkD,EAClD,QAA2B;IAE3B,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC;QAClF,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,OAAO,wBAAwB,MAAM,CAAC,UAAU,iDAAiD,QAAQ,CAAC,UAAU,GAAG,KAAK,EAAE,CAAC;IAChI,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC5E,OAAO,2BAA2B,MAAM,CAAC,QAAQ,kCAAkC,QAAQ,CAAC,QAAQ,EAAE,CAAC;IACxG,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC"}

package/packages/skills/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/skills",
-  "version": "1.1.413",
+  "version": "1.1.415",
   "description": "File-based skill system with pi.dev compatibility and Hermes self-improvement",
   "type": "module",
   "main": "src/index.ts",

package/packages/skills/src/index.ts

@@ -14,6 +14,7 @@ export * from "./parser.js";
 export * from "./scanner.js";
 export * from "./loader.js";
 export * from "./vector-schema.js";
+export * from "./sanitize.js";
 export * from "./remote-source.js";
 export * from "./skill-commands.js";
 export * from "./skill-tool.js";

package/packages/skills/src/loader.ts

@@ -22,8 +22,13 @@ import {
   LEGACY_SKILL_COLLECTION_MODEL,
   SKILL_COLLECTION,
   describeSkillSchemaMismatch,
+  skillPointPayload,
+  skillQdrantPoint,
+  stableHash,
+  type SkillPointPayload,
   type SkillVectorSchema,
 } from "./vector-schema.js";
+import { skillPointName } from "./sanitize.js";
 import {
   describeRemoteFailure,
   isStale,
@@ -39,11 +44,15 @@ import {
 // At runtime, packages/ is resolved from the monorepo root or node_modules.
 
 export interface QdrantSkillPoint {
+  /**
+   * The id of the point.
+   *
+   * It is the hash of the name in the payload, so the point id and the
+   * payload name always belong together.
+   */
   id: number;
-  name: string;
-  description: string;
-  body: string;
-  text: string;
+  /** The payload of the point. */
+  payload: SkillPointPayload;
 }
 
 export interface QdrantClientLike {
@@ -149,7 +158,7 @@ const RUNTIME_VECTOR_DISTANCE = "Cosine";
 export interface SkillVectorPoint {
   id: number;
   vector: number[];
-  payload: QdrantSkillPoint;
+  payload: SkillPointPayload;
 }
 
 /**
@@ -331,6 +340,15 @@ export class SkillRegistry {
    * disk and how many it can reach through the vector store.
    */
   private remoteSkills: Map<string, Skill> = new Map();
+  /**
+   * The local skills by their name in the shared collection.
+   *
+   * The name of a point is the SANITIZED name of the skill, because the
+   * collection is shared. A hit of the collection therefore carries a name
+   * that this machine does not use - the registry is keyed by the name on
+   * this machine. This map bridges the two.
+   */
+  private _skillsByPointName: Map<string, Skill> = new Map();
   /**
    * The remote skills whose content is COMPLETE.
    *
@@ -613,13 +631,17 @@ export class SkillRegistry {
 
   /** The point of a skill in the vector index. */
   private _toQdrantPoint(skill: Skill): QdrantSkillPoint {
-    return {
-      id: this._hashId(skill.id),
+    // The payload and the point id come from the shared schema, so the
+    // runtime and `scripts/sync-to-qdrant.ts` store the same point for the
+    // same skill. A writer that used its own id would leave two points
+    // behind - or overwrite an unrelated one.
+    const payload = skillPointPayload({
       name: skill.id,
+      title: skill.frontmatter.name,
       description: skill.frontmatter.description,
-      body: skill.body.slice(0, 2000),
-      text: [skill.id, skill.frontmatter.name, skill.frontmatter.description, skill.body.slice(0, 1500)].join(" "),
-    };
+      body: skill.body,
+    });
+    return skillQdrantPoint(payload);
   }
 
   /**
@@ -677,7 +699,7 @@ export class SkillRegistry {
    */
   private _scheduleIndex(skill: Skill): void {
     const point = this._toQdrantPoint(skill);
-    const hash = this._hashId(point.text);
+    const hash = stableHash(point.payload.text);
     if (this._indexedHashes.get(skill.id) === hash) return;
 
     this._indexedHashes.set(skill.id, hash);
@@ -729,12 +751,12 @@ export class SkillRegistry {
     while (this._indexQueue.length > 0) {
       const batch = this._indexQueue.splice(0, this._batchSize);
       try {
-        const vectors = await indexer.embed(batch.map((item) => item.point.text));
+        const vectors = await indexer.embed(batch.map((item) => item.point.payload.text));
         const points: SkillVectorPoint[] = [];
         batch.forEach((item, position) => {
           const vector = vectors[position];
           if (!vector || vector.length === 0) return;
-          points.push({ id: item.point.id, vector, payload: item.point });
+          points.push({ id: item.point.id, vector, payload: item.point.payload });
         });
         if (points.length > 0) await indexer.upsert(points);
       } catch {
@@ -749,20 +771,13 @@ export class SkillRegistry {
     }
   }
 
-  /** Simple deterministic ID for Qdrant (no bigints needed). */
-  private _hashId(id: string): number {
-    let h = 0;
-    for (let i = 0; i < id.length; i++) {
-      h = (Math.imul(31, h) + id.charCodeAt(i)) | 0;
-    }
-    return Math.abs(h);
-  }
-
   /**
    * Register a skill (auto-indexes to Qdrant if configured).
    */
   register(skill: Skill): void {
     this.skills.set(skill.id, skill);
+    // The shared collection knows the skill by its sanitized name.
+    this._skillsByPointName.set(skillPointName(skill.id), skill);
     this.updateIndex(skill);
     // Queue the skill for the vector index without blocking registration.
     this._scheduleIndex(skill);
@@ -775,6 +790,12 @@ export class SkillRegistry {
     const skill = this.skills.get(skillId);
     if (skill) {
       this.skills.delete(skillId);
+      // Only drop the shared name when it still points at this skill: two
+      // skills may share a sanitized name.
+      const pointName = skillPointName(skill.id);
+      if (this._skillsByPointName.get(pointName) === skill) {
+        this._skillsByPointName.delete(pointName);
+      }
       this.index.entries = this.index.entries.filter(
         (e) => e.id !== skillId
       );
@@ -788,8 +809,13 @@ export class SkillRegistry {
    */
   get(skillId: string): Skill | undefined {
     // A server skill is only known after a vector search found it, so it is
-    // looked up second - the local skill always wins.
-    return this.skills.get(skillId) ?? this.remoteSkills.get(skillId);
+    // looked up second - the local skill always wins. The shared name of a
+    // skill resolves to the local skill as well.
+    return (
+      this.skills.get(skillId) ??
+      this._skillsByPointName.get(skillId) ??
+      this.remoteSkills.get(skillId)
+    );
   }
 
   /**
@@ -1051,7 +1077,7 @@ export class SkillRegistry {
         const payload = pt.payload ?? {};
         const name = typeof payload.name === "string" ? payload.name : undefined;
         if (!name) continue;
-        const local = this.skills.get(name);
+        const local = this._skillsByPointName.get(name) ?? this.skills.get(name);
         if (local) {
           results.push({ skill: local, score: pt.score, source: "local" });
           continue;
@@ -1084,12 +1110,12 @@ export class SkillRegistry {
       const batch = skills.slice(i, i + this._batchSize);
       const points = batch.map((skill) => this._toQdrantPoint(skill));
       try {
-        const vectors = await indexer.embed(points.map((point) => point.text));
+        const vectors = await indexer.embed(points.map((point) => point.payload.text));
         const payload: SkillVectorPoint[] = [];
         points.forEach((point, position) => {
           const vector = vectors[position];
           if (!vector || vector.length === 0) return;
-          payload.push({ id: point.id, vector, payload: point });
+          payload.push({ id: point.id, vector, payload: point.payload });
         });
         if (payload.length > 0) await indexer.upsert(payload);
       } catch {

package/packages/skills/src/sanitize.ts

@@ -0,0 +1,86 @@
+/**
+ * The sanitization of a skill for the shared collection.
+ *
+ * The collection is shared, so a client name must not travel into it. The
+ * rules lived in `scripts/sync-to-qdrant.ts` - the only writer that could
+ * reach them. The runtime registry writes into the same collection, so it
+ * needs them too: a writer that skipped the rules would leave the raw
+ * name and the raw body of a client skill in a shared cluster.
+ *
+ * Both writers therefore build their points with the same rules, and the
+ * name of a point is the sanitized name. One skill, one point.
+ */
+
+/** A rule that replaces a client specific text. */
+interface SanitizationRule {
+  pattern: RegExp;
+  replacement: string;
+}
+
+/**
+ * The patterns of the client specific names.
+ *
+ * The list is about the names of the clients and the projects of the
+ * users of the harness - not about the skills themselves.
+ */
+const SANITIZATION_RULES: SanitizationRule[] = [
+  // Client company names (case-insensitive)
+  { pattern: /\binpac\b/gi, replacement: "[Client A]" },
+  { pattern: /\bm-capital\b/gi, replacement: "[Client A]" },
+  { pattern: /\bmcapital\b/gi, replacement: "[Client A]" },
+  { pattern: /\bdigisoft\b/gi, replacement: "[Client B]" },
+
+  // Project/app specific names
+  { pattern: /\bgse-insurance\b/gi, replacement: "[Insurance Project]" },
+  { pattern: /\btbs-import\b/gi, replacement: "[Import Project]" },
+  { pattern: /\bdigisoft_erp\b/gi, replacement: "[Client B Erp]" },
+  { pattern: /\bm_capital\b/gi, replacement: "[Client A]" },
+  { pattern: /\binpac_\b/gi, replacement: "[Client A]_" },
+  { pattern: /\bpaperclip_\b/gi, replacement: "[Client D]_" },
+  { pattern: /\bopenclaw_\b/gi, replacement: "[Client F]_" },
+
+  // Generic replacements
+  { pattern: /Company Name/gi, replacement: "[Client Name]" },
+  { pattern: /your company/gi, replacement: "[Client]" },
+  { pattern: /our client/gi, replacement: "[Client]" },
+  { pattern: /client-specific/gi, replacement: "[Project-specific]" },
+];
+
+/**
+ * The names that are renamed as a whole.
+ *
+ * A name that would be unreadable after the pattern rules - a name that
+ * carries the client name in its middle - is renamed here.
+ */
+const SKILL_NAME_MAP: Record<string, string> = {
+	"gse-insurance-step5-slot-filter": "insurance-project-step-filter",
+	"inpac-pe-approval-workflow": "client-a-pe-approval-workflow",
+	"inpac-po-approval-workflow": "client-a-po-approval-workflow",
+	"inpac-pr-approval-workflow": "client-a-pr-approval-workflow",
+	"tbs-import-clearance-lcv": "import-project-clearance",
+	whispertool: "whisper-tool",
+};
+
+/**
+ * Replace the client specific names of a text.
+ *
+ * The text stays the same length, so a vector that was built from it
+ * keeps its shape.
+ */
+export function sanitizeText(text: string): string {
+	let result = text;
+	for (const rule of SANITIZATION_RULES) {
+		result = result.replace(rule.pattern, rule.replacement);
+	}
+	return result;
+}
+
+/**
+ * The name of a skill in the shared collection.
+ *
+ * The name is the identity of the point, so it has to be the same for
+ * every writer: the map first, then the pattern rules.
+ */
+export function skillPointName(name: string): string {
+	return SKILL_NAME_MAP[name] || sanitizeText(name);
+}