pi-harness-runtime 1.1.414 → 1.1.416

package/packages/skills/dist/vector-schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vector-schema.d.ts","sourceRoot":"","sources":["../src/vector-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,gCAAgC,CAAC;AAE9D;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,sBAAsB,CAAC;AAE3D,0CAA0C;AAC1C,eAAO,MAAM,6BAA6B,2CAA2C,CAAC;AAEtF,gDAAgD;AAChD,eAAO,MAAM,kCAAkC,MAAM,CAAC;AAEtD,yDAAyD;AACzD,MAAM,WAAW,iBAAiB;IACjC,uBAAuB;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,2BAA2B;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,2BAA2B;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,6BAA6B;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAE7C,kDAAkD;AAClD,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAE7C;;;;;;;;;;;GAWG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMhD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE;IACpC,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2BAA2B;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,6BAA6B;IAC7B,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,MAAM,CAMT;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,iBAAiB,CAAC;CAC5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,GAAG,gBAAgB,CAE7E;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2BAA2B;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,6BAA6B;IAC7B,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,iBAAiB,CAOpB;AACD,wBAAgB,2BAA2B,CAC1C,MAAM,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,EAClD,QAAQ,EAAE,iBAAiB,GACzB,MAAM,GAAG,IAAI,CASf"}
+{"version":3,"file":"vector-schema.d.ts","sourceRoot":"","sources":["../src/vector-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,gCAAgC,CAAC;AAE9D;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,sBAAsB,CAAC;AAE3D,0CAA0C;AAC1C,eAAO,MAAM,6BAA6B,2CAA2C,CAAC;AAEtF,gDAAgD;AAChD,eAAO,MAAM,kCAAkC,MAAM,CAAC;AAEtD,yDAAyD;AACzD,MAAM,WAAW,iBAAiB;IACjC,uBAAuB;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,2BAA2B;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,2BAA2B;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,6BAA6B;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAE7C,kDAAkD;AAClD,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAE7C;;;;;;;;;;;GAWG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMhD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE;IACpC,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2BAA2B;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,6BAA6B;IAC7B,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,MAAM,CAMT;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,iBAAiB,CAAC;CAC5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,GAAG,gBAAgB,CAE7E;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2BAA2B;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,6BAA6B;IAC7B,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,iBAAiB,CAWpB;AACD,wBAAgB,2BAA2B,CAC1C,MAAM,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,EAClD,QAAQ,EAAE,iBAAiB,GACzB,MAAM,GAAG,IAAI,CASf"}

package/packages/skills/dist/vector-schema.js

@@ -15,6 +15,7 @@
  * module owns the collection - that is a decision of the skills domain, not
  * of the vector store.
  */
+import { sanitizeText, skillPointName } from "./sanitize.js";
 /**
  * The collection the runtime indexes into and searches.
  *
@@ -91,13 +92,21 @@ export function skillQdrantPoint(payload) {
 }
 /**
  * The payload of a skill point.
+ *
+ * The payload is sanitized: the collection is shared, so the client names
+ * of a user must not travel into it. Both writers use this function, so
+ * both write the same sanitized payload for the same skill.
  */
 export function skillPointPayload(input) {
+    const name = skillPointName(input.name);
+    const title = input.title ? skillPointName(input.title) : undefined;
+    const description = sanitizeText(input.description);
+    const body = sanitizeText(input.body).slice(0, SKILL_PAYLOAD_BODY_LIMIT);
     return {
-        name: input.name,
-        description: input.description,
-        body: input.body.slice(0, SKILL_PAYLOAD_BODY_LIMIT),
-        text: skillPointText(input),
+        name,
+        description,
+        body,
+        text: skillPointText({ name, title, description, body }),
     };
 }
 export function describeSkillSchemaMismatch(actual, expected) {

package/packages/skills/dist/vector-schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"vector-schema.js","sourceRoot":"","sources":["../src/vector-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,6BAA6B,CAAC;AAE9D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,mBAAmB,CAAC;AAE3D,0CAA0C;AAC1C,MAAM,CAAC,MAAM,6BAA6B,GAAG,wCAAwC,CAAC;AAEtF,gDAAgD;AAChD,MAAM,CAAC,MAAM,kCAAkC,GAAG,GAAG,CAAC;AAiCtD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAE7C,kDAAkD;AAClD,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAE7C;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACxB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,KAS9B;IACC,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACvE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC9B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAC1D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAcD;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAA0B;IACzD,OAAO,EAAE,EAAE,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC;AACnD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,KASjC;IACC,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,wBAAwB,CAAC;QACnD,IAAI,EAAE,cAAc,CAAC,KAAK,CAAC;KAC5B,CAAC;AACJ,CAAC;AACD,MAAM,UAAU,2BAA2B,CAC1C,MAAkD,EAClD,QAA2B;IAE3B,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC;QAClF,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,OAAO,wBAAwB,MAAM,CAAC,UAAU,iDAAiD,QAAQ,CAAC,UAAU,GAAG,KAAK,EAAE,CAAC;IAChI,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC5E,OAAO,2BAA2B,MAAM,CAAC,QAAQ,kCAAkC,QAAQ,CAAC,QAAQ,EAAE,CAAC;IACxG,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC"}
+{"version":3,"file":"vector-schema.js","sourceRoot":"","sources":["../src/vector-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE7D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,6BAA6B,CAAC;AAE9D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,mBAAmB,CAAC;AAE3D,0CAA0C;AAC1C,MAAM,CAAC,MAAM,6BAA6B,GAAG,wCAAwC,CAAC;AAEtF,gDAAgD;AAChD,MAAM,CAAC,MAAM,kCAAkC,GAAG,GAAG,CAAC;AAiCtD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAE7C,kDAAkD;AAClD,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAE7C;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACxB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,KAS9B;IACC,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACvE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC9B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAC1D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAcD;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAA0B;IACzD,OAAO,EAAE,EAAE,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC;AACnD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,KASjC;IACC,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,MAAM,WAAW,GAAG,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC;IACzE,OAAO;QACL,IAAI;QACJ,WAAW;QACX,IAAI;QACJ,IAAI,EAAE,cAAc,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;KACzD,CAAC;AACJ,CAAC;AACD,MAAM,UAAU,2BAA2B,CAC1C,MAAkD,EAClD,QAA2B;IAE3B,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC;QAClF,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,OAAO,wBAAwB,MAAM,CAAC,UAAU,iDAAiD,QAAQ,CAAC,UAAU,GAAG,KAAK,EAAE,CAAC;IAChI,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC5E,OAAO,2BAA2B,MAAM,CAAC,QAAQ,kCAAkC,QAAQ,CAAC,QAAQ,EAAE,CAAC;IACxG,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC"}

package/packages/skills/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/skills",
-  "version": "1.1.414",
+  "version": "1.1.416",
   "description": "File-based skill system with pi.dev compatibility and Hermes self-improvement",
   "type": "module",
   "main": "src/index.ts",

package/packages/skills/src/index.ts

@@ -14,6 +14,7 @@ export * from "./parser.js";
 export * from "./scanner.js";
 export * from "./loader.js";
 export * from "./vector-schema.js";
+export * from "./sanitize.js";
 export * from "./remote-source.js";
 export * from "./skill-commands.js";
 export * from "./skill-tool.js";

package/packages/skills/src/loader.ts

@@ -28,6 +28,7 @@ import {
   type SkillPointPayload,
   type SkillVectorSchema,
 } from "./vector-schema.js";
+import { skillPointName } from "./sanitize.js";
 import {
   describeRemoteFailure,
   isStale,
@@ -339,6 +340,15 @@ export class SkillRegistry {
    * disk and how many it can reach through the vector store.
    */
   private remoteSkills: Map<string, Skill> = new Map();
+  /**
+   * The local skills by their name in the shared collection.
+   *
+   * The name of a point is the SANITIZED name of the skill, because the
+   * collection is shared. A hit of the collection therefore carries a name
+   * that this machine does not use - the registry is keyed by the name on
+   * this machine. This map bridges the two.
+   */
+  private _skillsByPointName: Map<string, Skill> = new Map();
   /**
    * The remote skills whose content is COMPLETE.
    *
@@ -766,6 +776,8 @@ export class SkillRegistry {
    */
   register(skill: Skill): void {
     this.skills.set(skill.id, skill);
+    // The shared collection knows the skill by its sanitized name.
+    this._skillsByPointName.set(skillPointName(skill.id), skill);
     this.updateIndex(skill);
     // Queue the skill for the vector index without blocking registration.
     this._scheduleIndex(skill);
@@ -778,6 +790,12 @@ export class SkillRegistry {
     const skill = this.skills.get(skillId);
     if (skill) {
       this.skills.delete(skillId);
+      // Only drop the shared name when it still points at this skill: two
+      // skills may share a sanitized name.
+      const pointName = skillPointName(skill.id);
+      if (this._skillsByPointName.get(pointName) === skill) {
+        this._skillsByPointName.delete(pointName);
+      }
       this.index.entries = this.index.entries.filter(
         (e) => e.id !== skillId
       );
@@ -791,8 +809,13 @@ export class SkillRegistry {
    */
   get(skillId: string): Skill | undefined {
     // A server skill is only known after a vector search found it, so it is
-    // looked up second - the local skill always wins.
-    return this.skills.get(skillId) ?? this.remoteSkills.get(skillId);
+    // looked up second - the local skill always wins. The shared name of a
+    // skill resolves to the local skill as well.
+    return (
+      this.skills.get(skillId) ??
+      this._skillsByPointName.get(skillId) ??
+      this.remoteSkills.get(skillId)
+    );
   }
 
   /**
@@ -1054,7 +1077,7 @@ export class SkillRegistry {
         const payload = pt.payload ?? {};
         const name = typeof payload.name === "string" ? payload.name : undefined;
         if (!name) continue;
-        const local = this.skills.get(name);
+        const local = this._skillsByPointName.get(name) ?? this.skills.get(name);
         if (local) {
           results.push({ skill: local, score: pt.score, source: "local" });
           continue;

package/packages/skills/src/sanitize.ts

@@ -0,0 +1,111 @@
+/**
+ * The sanitization of a skill for the shared collection.
+ *
+ * The collection is shared, so a client name must not travel into it. The
+ * rules lived in `scripts/sync-to-qdrant.ts` - the only writer that could
+ * reach them. The runtime registry writes into the same collection, so it
+ * needs them too: a writer that skipped the rules would leave the raw
+ * name and the raw body of a client skill in a shared cluster.
+ *
+ * Both writers therefore build their points with the same rules, and the
+ * name of a point is the sanitized name. One skill, one point.
+ */
+
+/** A rule that replaces a client specific text. */
+interface SanitizationRule {
+  pattern: RegExp;
+  replacement: string;
+}
+
+/**
+ * The patterns of the client specific names.
+ *
+ * The list is about the names of the clients and the projects of the
+ * users of the harness - not about the skills themselves.
+ *
+ * The patterns match a plain fragment, without a word boundary. A client
+ * name rarely stands alone: it appears inside a directory name
+ * (`th_digisoft_erp_chart.json`), inside a Python module (`inpac_pharma`)
+ * or in a sentence ("integrated with Paperclip"). A word boundary would
+ * miss all of them - and `_` is a word character, so a boundary never
+ * follows an underscore.
+ */
+const SANITIZATION_RULES: SanitizationRule[] = [
+  // Client company names (case-insensitive)
+  { pattern: /inpac/gi, replacement: "[Client A]" },
+  { pattern: /m-capital/gi, replacement: "[Client A]" },
+  { pattern: /mcapital/gi, replacement: "[Client A]" },
+  { pattern: /digisoft/gi, replacement: "[Client B]" },
+
+  // Project/app specific names
+  { pattern: /gse-insurance/gi, replacement: "[Insurance Project]" },
+  { pattern: /tbs-import/gi, replacement: "[Import Project]" },
+  { pattern: /paperclip/gi, replacement: "[Client D]" },
+  { pattern: /openclaw/gi, replacement: "[Client F]" },
+
+  // Generic replacements
+  { pattern: /Company Name/gi, replacement: "[Client Name]" },
+  { pattern: /your company/gi, replacement: "[Client]" },
+  { pattern: /our client/gi, replacement: "[Client]" },
+  { pattern: /client-specific/gi, replacement: "[Project-specific]" },
+];
+
+/**
+ * The names that are renamed as a whole.
+ *
+ * A name that would be unreadable after the pattern rules - a name that
+ * carries the client name in its middle - is renamed here.
+ */
+const SKILL_NAME_MAP: Record<string, string> = {
+	"gse-insurance-step5-slot-filter": "insurance-project-step-filter",
+	"inpac-pe-approval-workflow": "client-a-pe-approval-workflow",
+	"inpac-po-approval-workflow": "client-a-po-approval-workflow",
+	"inpac-pr-approval-workflow": "client-a-pr-approval-workflow",
+	"tbs-import-clearance-lcv": "import-project-clearance",
+	whispertool: "whisper-tool",
+};
+
+/**
+ * Replace the client specific names of a text.
+ *
+ * The text stays the same length, so a vector that was built from it
+ * keeps its shape.
+ */
+export function sanitizeText(text: string): string {
+	let result = text;
+	for (const rule of SANITIZATION_RULES) {
+		result = result.replace(rule.pattern, rule.replacement);
+	}
+	return result;
+}
+
+/**
+ * The name of a skill in the shared collection.
+ *
+ * The name is the identity of the point, so it has to be the same for
+ * every writer: the map first, then the pattern rules.
+ *
+ * The result is a skill name - lower case, words separated by a dash -
+ * because the name of a point is also the id of the skill that a search
+ * returns. The replacements of the rules carry a space and brackets,
+ * which no skill name may hold.
+ */
+export function skillPointName(name: string): string {
+	const mapped = SKILL_NAME_MAP[name];
+	if (mapped) return mapped;
+	return kebabName(sanitizeText(name));
+}
+
+/**
+ * Bring a name into the shape of a skill name.
+ *
+ * The name of a skill is lower case and its words are separated by a
+ * dash: `^[a-z0-9]+(-[a-z0-9]+)*$`.
+ */
+function kebabName(name: string): string {
+	return name
+		.toLowerCase()
+		.replace(/[^a-z0-9]+/g, "-")
+		.replace(/-{2,}/g, "-")
+		.replace(/^-+|-+$/g, "");
+}

package/packages/skills/src/vector-schema.ts

@@ -16,6 +16,8 @@
  * of the vector store.
  */
 
+import { sanitizeText, skillPointName } from "./sanitize.js";
+
 /**
  * The collection the runtime indexes into and searches.
  *
@@ -152,6 +154,10 @@ export function skillQdrantPoint(payload: SkillPointPayload): SkillQdrantPoint {
 
 /**
  * The payload of a skill point.
+ *
+ * The payload is sanitized: the collection is shared, so the client names
+ * of a user must not travel into it. Both writers use this function, so
+ * both write the same sanitized payload for the same skill.
  */
 export function skillPointPayload(input: {
   /** The name the payload carries - the identity of the skill. */
@@ -163,11 +169,15 @@ export function skillPointPayload(input: {
   /** The body of the skill. */
   body: string;
 }): SkillPointPayload {
+  const name = skillPointName(input.name);
+  const title = input.title ? skillPointName(input.title) : undefined;
+  const description = sanitizeText(input.description);
+  const body = sanitizeText(input.body).slice(0, SKILL_PAYLOAD_BODY_LIMIT);
   return {
-    name: input.name,
-    description: input.description,
-    body: input.body.slice(0, SKILL_PAYLOAD_BODY_LIMIT),
-    text: skillPointText(input),
+    name,
+    description,
+    body,
+    text: skillPointText({ name, title, description, body }),
   };
 }
 export function describeSkillSchemaMismatch(

package/packages/skills/test/remote-skills.test.ts

@@ -169,6 +169,47 @@ describe("a skill that only exists in the vector store", () => {
 	});
 });
 
+describe("a hit that carries the shared name of a local skill", () => {
+	it("resolves to the local skill", async () => {
+		// The collection is shared, so the point carries the SANITIZED name.
+		const client = fakeClient([
+			{
+				id: 1,
+				score: 0.9,
+				payload: {
+					name: "client-a-pe-approval-workflow",
+					description: "the workflow",
+					body: "the body",
+				},
+			},
+		]);
+		const registry = createSkillRegistry({
+			qdrantClient: client,
+			embedder: fakeEmbedder,
+			collection: "pi-harness-skills-test",
+		});
+		registry.register(localSkill("inpac-pe-approval-workflow"));
+
+		const results = await registry.findVector("workflow");
+
+		expect(results).toHaveLength(1);
+		// The skill of this machine stays a local skill - with its own
+		// name and its own body, not the sanitized copy.
+		expect(results[0].source).toBe("local");
+		expect(results[0].skill.id).toBe("inpac-pe-approval-workflow");
+		expect(results[0].skill.body).toBe("the local body of inpac-pe-approval-workflow");
+	});
+
+	it("resolves the shared name of a local skill in a lookup", () => {
+		const registry = createSkillRegistry({ indexer: null });
+		registry.register(localSkill("inpac-pe-approval-workflow"));
+
+		expect(registry.get("client-a-pe-approval-workflow")?.id).toBe(
+			"inpac-pe-approval-workflow",
+		);
+	});
+});
+
 describe("the state of the vector store", () => {
 	it("reports the number of skills", async () => {
 		const client = fakeClient([], {

package/packages/skills/test/sanitize.test.ts

@@ -0,0 +1,131 @@
+/**
+ * Tests for the sanitization of a skill for the shared collection.
+ *
+ * The collection is shared, so the client names of a user must not travel
+ * into it. The rules used to live in `scripts/sync-to-qdrant.ts` - the
+ * only writer that could reach them. The runtime registry writes into the
+ * same collection, so it needs them too.
+ */
+
+import { describe, expect, test } from "bun:test";
+
+import { sanitizeText, skillPointName } from "../src/sanitize.js";
+import { skillPointPayload } from "../src/vector-schema.js";
+
+describe("the sanitization of a text", () => {
+	test("the name of a client is replaced", () => {
+		expect(sanitizeText("the inpac workflow")).toBe("the [Client A] workflow");
+		expect(sanitizeText("for digisoft")).toBe("for [Client B]");
+		expect(sanitizeText("gse-insurance step")).toBe("[Insurance Project] step");
+	});
+
+	test("the name of a client is replaced in any case", () => {
+		expect(sanitizeText("INPAC and Inpac")).toBe("[Client A] and [Client A]");
+	});
+
+	test("a text without a client name stays the same", () => {
+		expect(sanitizeText("a plain skill")).toBe("a plain skill");
+	});
+
+	test("the generic phrases are replaced", () => {
+		expect(sanitizeText("Company Name")).toBe("[Client Name]");
+		expect(sanitizeText("your company")).toBe("[Client]");
+		expect(sanitizeText("our client")).toBe("[Client]");
+	});
+
+	test("a client name inside an identifier is replaced", () => {
+		// The name of a client rarely stands alone. A word boundary would
+		// miss every one of these - and an underscore is a word character,
+		// so a boundary never follows one.
+		expect(sanitizeText("inpac_pharma")).toBe("[Client A]_pharma");
+		expect(sanitizeText("th_digisoft_erp_chart.json")).toBe(
+			"th_[Client B]_erp_chart.json",
+		);
+		expect(sanitizeText("apps/inpac_pharma/setup")).toBe(
+			"apps/[Client A]_pharma/setup",
+		);
+	});
+
+	test("a client name in a sentence is replaced", () => {
+		expect(sanitizeText("integrated with Paperclip")).toBe(
+			"integrated with [Client D]",
+		);
+		expect(sanitizeText("OpenClaw secrets")).toBe("[Client F] secrets");
+	});
+});
+
+describe("the name of a skill in the shared collection", () => {
+	test("a name of the map is renamed", () => {
+		expect(skillPointName("inpac-pe-approval-workflow")).toBe(
+			"client-a-pe-approval-workflow",
+		);
+		expect(skillPointName("tbs-import-clearance-lcv")).toBe(
+			"import-project-clearance",
+		);
+		expect(skillPointName("whispertool")).toBe("whisper-tool");
+	});
+
+	test("a name without a client name stays the same", () => {
+		expect(skillPointName("code-review")).toBe("code-review");
+	});
+
+	test("the name never carries a client name", () => {
+		for (const name of [
+			"inpac-pe-approval-workflow",
+			"gse-insurance-step5-slot-filter",
+			"tbs-import-clearance-lcv",
+			"whispertool",
+		]) {
+			expect(skillPointName(name)).not.toMatch(/inpac|gse-insurance|tbs-import/i);
+		}
+	});
+
+	test("the name is a valid skill name", () => {
+		// The name of a point is the id of the skill that a search returns,
+		// so it has to be a name that a skill may carry.
+		const NAME = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+		for (const name of [
+			"inpac-pe-approval-workflow",
+			"openclaw-channel",
+			"gse-insurance-step5-slot-filter",
+			"tbs-import-clearance-lcv",
+			"whispertool",
+			"code-review",
+		]) {
+			expect(skillPointName(name)).toMatch(NAME);
+		}
+	});
+
+	test("a name that needs no sanitization stays the same", () => {
+		expect(skillPointName("code-review")).toBe("code-review");
+		expect(skillPointName("frappe-doctype-field-order")).toBe(
+			"frappe-doctype-field-order",
+		);
+	});
+});
+
+describe("the payload of a point is sanitized", () => {
+	test("the client names of the body do not travel into the collection", () => {
+		const payload = skillPointPayload({
+			name: "inpac-pe-approval-workflow",
+			description: "the workflow of inpac",
+			body: "the approval of inpac for the client",
+		});
+
+		expect(payload.name).toBe("client-a-pe-approval-workflow");
+		expect(payload.description).not.toMatch(/inpac/i);
+		expect(payload.body).not.toMatch(/inpac/i);
+		expect(payload.text).not.toMatch(/inpac/i);
+	});
+
+	test("the text is built from the sanitized parts", () => {
+		const payload = skillPointPayload({
+			name: "inpac-pe-approval-workflow",
+			description: "the workflow",
+			body: "the body",
+		});
+
+		expect(payload.text).toContain("client-a-pe-approval-workflow");
+		expect(payload.text).not.toContain("inpac-pe-approval-workflow");
+	});
+});

package/packages/skills/test/vector-schema.test.ts

@@ -138,8 +138,21 @@ describe("the identity of a skill point", () => {
 			body: "b",
 		});
 
-		expect(withTitle.text).toContain("A Human Title");
-		expect(withoutTitle.text).not.toContain("A Human Title");
+		// The title is treated like the name: it is sanitized and it is
+		// brought into the shape of a skill name.
+		expect(withTitle.text).toContain("a-human-title");
+		expect(withoutTitle.text).not.toContain("a-human-title");
+	});
+
+	test("a title that is the name is not repeated in the text", () => {
+		const payload = skillPointPayload({
+			name: "a-skill",
+			title: "a-skill",
+			description: "d",
+			body: "b",
+		});
+
+		expect(payload.text.match(/a-skill/g)?.length).toBe(1);
 	});
 });
 

package/packages/sprint-planner/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/sprint-planner",
-  "version": "1.1.414",
+  "version": "1.1.416",
   "type": "module",
   "description": "Sprint planning engine for pi-harness",
   "main": "dist/index.js",

package/packages/subscription-engine/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/subscription-engine",
-  "version": "1.1.414",
+  "version": "1.1.416",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/task-compiler/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/task-compiler",
-  "version": "1.1.414",
+  "version": "1.1.416",
   "description": "Task Compiler for pi-harness-runtime — produces deterministic task DAG from CompiledRequirement",
   "type": "module",
   "main": "./dist/index.js",

package/packages/telegram/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/telegram",
-  "version": "1.1.414",
+  "version": "1.1.416",
   "description": "pi-harness-runtime — Telegram inbound/outbound",
   "type": "module",
   "main": "./src/index.js",

package/packages/tencentdb-memory/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moocoding/tencentdb-memory",
-  "version": "1.1.414",
+  "version": "1.1.416",
   "description": "TencentDB Agent Memory client - sync skills to centralized knowledge base",
   "type": "module",
   "main": "src/index.ts",

package/packages/tencentdb-sync/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/tencentdb-sync",
-  "version": "1.1.414",
+  "version": "1.1.416",
   "description": "Sync SKILL.md skills to TencentDB-Agent-Memory server (RFC-0105/0106)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/test-data-generator/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/test-data-generator",
-  "version": "1.1.414",
+  "version": "1.1.416",
   "description": "Test data generation for pi-harness-runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/test-generator/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/test-generator",
-  "version": "1.1.414",
+  "version": "1.1.416",
   "description": "Auto-Test Generator — generate unit and E2E tests from source code (RFC-0013)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/todo-bd-sync/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moocoding/todo-bd-sync",
-  "version": "1.1.414",
+  "version": "1.1.416",
   "description": "Two-way sync between rpiv-todo overlay and bd issue tracker",
   "type": "module",
   "main": "src/index.ts",

package/packages/token-estimation/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/token-estimation",
-  "version": "1.1.414",
+  "version": "1.1.416",
   "description": "pi-harness-runtime — token-estimation",
   "type": "module",
   "main": "./dist/index.js",

package/packages/token-optimizer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/token-optimizer",
-  "version": "1.1.414",
+  "version": "1.1.416",
   "description": "Token Budget Optimizer — maximize prompt value within token limits (RFC-0011)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/tooling-preference/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/tooling-preference",
-  "version": "1.1.414",
+  "version": "1.1.416",
   "description": "pi-harness-runtime — JS/TS tooling preference (Biome vs ESLint/Prettier) proposal",
   "type": "module",
   "main": "./dist/index.js",

package/packages/trajectory/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/trajectory",
-  "version": "1.1.414",
+  "version": "1.1.416",
   "description": "Trajectory capture for the write-review loop — persists cycle records for learning",
   "type": "module",
   "main": "./dist/src/index.js",

package/packages/tui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/tui",
-  "version": "1.1.414",
+  "version": "1.1.416",
   "description": "pi-harness-runtime — tui",
   "type": "module",
   "main": "./dist/index.js",

package/packages/two-phase-review/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/two-phase-review",
-  "version": "1.1.414",
+  "version": "1.1.416",
   "description": "pi-harness-runtime — two-phase implementation and review workflow (queue review signals, gate the phase, scope the diff)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/types/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/types",
-  "version": "1.1.414",
+  "version": "1.1.416",
   "description": "Shared TypeScript types for pi-harness-runtime packages",
   "type": "module",
   "main": "./dist/index.js",

package/packages/voice-api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/voice-api",
-  "version": "1.1.414",
+  "version": "1.1.416",
   "type": "module",
   "description": "Voice-to-text API using Whisper for Telegram and LINE integration",
   "main": "./dist/index.js",