pi-harness-runtime 1.1.421 → 1.1.423

package/index.ts

@@ -3459,7 +3459,7 @@ async function initHermesSkills(pi: ExtensionAPI): Promise<void> {
 	addHarnessMessage("Skills", "initializing", "wait");
 	try {
 		// Dynamically import to avoid circular deps
-		const { initSkills } =
+		const { initSkills, sanitizationStatus } =
 			await import("./packages/skills/dist/index.js");
 
 		// Scan skills from default locations
@@ -3471,6 +3471,37 @@ async function initHermesSkills(pi: ExtensionAPI): Promise<void> {
 		// shared skill, and a single "N discovered" hides that difference.
 		const local = localSkillsReport(localCount);
 		addHarnessMessage("Skills", local.text, local.status, local.details);
+		// The rules that keep a client name out of the shared collection
+		// live in a local file - they are not in the repository, it is
+		// public. Without them only the generic rules hold, and a client
+		// name travels into the collection. That is a visible state, not
+		// a silent one.
+		try {
+			const rules = sanitizationStatus();
+			if (!rules.configured) {
+				addHarnessMessage(
+					"Skill privacy",
+					"sanitization rules not configured",
+					"warn",
+					[
+						`How to fix: create ${rules.path} with the rules of your client names, or set PI_SKILL_SANITIZATION_FILE to a file that holds them.`,
+						"The rules are not in the repository - it is public, and a list of client names in it is a list of client names in the world.",
+						"A client name can travel into the shared collection until they are.",
+						...(rules.error ? [rules.error] : []),
+					],
+				);
+			}
+		} catch (err) {
+			addHarnessMessage(
+				"Skill privacy",
+				"the sanitization rules could not be read",
+				"warn",
+				[
+					"How to fix: check that ~/.pi-harness-runtime/skill-sanitization.json exists and holds valid JSON.",
+					err instanceof Error ? err.message : String(err),
+				],
+			);
+		}
 		// The server-held skills. The service holds the authoritative
 		// files, so a machine without a local copy can still use a skill.
 		// It is only used when it is configured - a client without a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-harness-runtime",
-  "version": "1.1.421",
+  "version": "1.1.423",
   "description": "[BETA] Codex-style /usage status + autonomous coding harness for pi. Not production ready — expect breaking changes.",
   "type": "module",
   "scripts": {
@@ -116,7 +116,7 @@
     "deepagents": "^1.10.5",
     "langchain": "^1.5.10",
     "ws": "^8.22.0",
-    "zod": "^4.5.4"
+    "zod": "^4.6.7"
   },
   "peerDependenciesMeta": {
     "pi-mcp-adapter": {

package/packages/a2a-adapter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/a2a-adapter",
-  "version": "1.1.421",
+  "version": "1.1.423",
   "type": "module",
   "description": "Google Agent-to-Agent (A2A) protocol adapter for pi-harness",
   "main": "dist/index.js",

package/packages/agent-policy/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/agent-policy",
-  "version": "1.1.421",
+  "version": "1.1.423",
   "description": "Agent policy runtime for pi-harness - enforces mandatory rule delivery and mutation gating",
   "type": "module",
   "main": "./dist/index.js",

package/packages/architecture-generator/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/architecture-generator",
-  "version": "1.1.421",
+  "version": "1.1.423",
   "description": "Generate ADR and Mermaid diagrams from project analysis",
   "type": "module",
   "main": "./dist/index.js",

package/packages/auth/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/auth",
-  "version": "1.1.421",
+  "version": "1.1.423",
   "description": "pi-harness-runtime — auth",
   "type": "module",
   "main": "./dist/index.js",

package/packages/autonomous-refactor/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/autonomous-refactor",
-  "version": "1.1.421",
+  "version": "1.1.423",
   "type": "module",
   "description": "Autonomous refactoring engine",
   "main": "dist/index.js",

package/packages/autonomous-runtime/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/autonomous-runtime",
-  "version": "1.1.421",
+  "version": "1.1.423",
   "description": "Autonomous Operations Runtime — task inbox, lease management, and worker lifecycle (RFC-0101)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/cache-strategy/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/cache-strategy",
-  "version": "1.1.421",
+  "version": "1.1.423",
   "type": "module",
   "description": "Smart caching with TTL and invalidation strategies (RFC-0022)",
   "main": "dist/index.js",

package/packages/capability-registry/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/capability-registry",
-  "version": "1.1.421",
+  "version": "1.1.423",
   "description": "Capability Registry for pi-harness-runtime — tracks model capabilities and enables capability-based routing",
   "type": "module",
   "main": "./dist/index.js",

package/packages/checkpoint/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/checkpoint",
-  "version": "1.1.421",
+  "version": "1.1.423",
   "description": "Enhanced checkpoint system with incremental snapshots, diff-based storage, and recovery strategies",
   "type": "module",
   "main": "./dist/index.js",

package/packages/cli-plugin-sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/cli-plugin-sdk",
-  "version": "1.1.421",
+  "version": "1.1.423",
   "type": "module",
   "description": "CLI Plugin SDK for pi-harness — install, list, remove, update, invoke plugins",
   "main": "dist/index.js",

package/packages/clipboard/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/clipboard",
-  "version": "1.1.421",
+  "version": "1.1.423",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/clipboard-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/clipboard-plugin",
-  "version": "1.1.421",
+  "version": "1.1.423",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/code-generation/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/code-generation",
-  "version": "1.1.421",
+  "version": "1.1.423",
   "description": "Code generation pipeline for pi-harness-runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/code-review/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/code-review",
-  "version": "1.1.421",
+  "version": "1.1.423",
   "description": "Automated code review engine for pi-harness-runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/codex-adapter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/codex-adapter",
-  "version": "1.1.421",
+  "version": "1.1.423",
   "type": "module",
   "description": "OpenAI Codex provider adapter for pi-harness",
   "main": "dist/index.js",

package/packages/codex-watcher/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/codex-watcher",
-  "version": "1.1.421",
+  "version": "1.1.423",
   "description": "Watches Codex CLI sessions and emits visible messages for PING-PONG monitoring",
   "type": "module",
   "main": "./dist/src/index.js",

package/packages/config-capture/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moocoding/config-capture",
-  "version": "1.1.421",
+  "version": "1.1.423",
   "description": "Auto-capture API-fetched configuration values to AGENTS.md",
   "type": "module",
   "main": "src/index.ts",

package/packages/connection-runtime/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/connection-runtime",
-  "version": "1.1.421",
+  "version": "1.1.423",
   "type": "module",
   "description": "Connection management with jittered exponential backoff for pi-harness",
   "main": "./dist/index.js",

package/packages/context-compiler/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/context-compiler",
-  "version": "1.1.421",
+  "version": "1.1.423",
   "description": "Bounded context selection engine for pi-harness-runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/context-discovery/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/context-discovery",
-  "version": "1.1.421",
+  "version": "1.1.423",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/context-manager/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/context-manager",
-  "version": "1.1.421",
+  "version": "1.1.423",
   "description": "Context Window Manager — prevents model context overflow via compaction and resume prompts (RFC-0010)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/contracts/dist/approvals.d.ts

@@ -5,20 +5,44 @@ import { z } from 'zod';
 /**
  * Approval status
  */
-export declare const ApprovalStatus: z.ZodEnum<["pending", "approved", "rejected", "expired"]>;
+export declare const ApprovalStatus: z.ZodEnum<{
+    approved: "approved";
+    expired: "expired";
+    pending: "pending";
+    rejected: "rejected";
+}>;
 export type ApprovalStatus = z.infer<typeof ApprovalStatus>;
 /**
  * Approval type
  */
-export declare const ApprovalType: z.ZodEnum<["tool_execution", "file_write", "file_delete", "command_execution", "network_request", "external_action"]>;
+export declare const ApprovalType: z.ZodEnum<{
+    command_execution: "command_execution";
+    external_action: "external_action";
+    file_delete: "file_delete";
+    file_write: "file_write";
+    network_request: "network_request";
+    tool_execution: "tool_execution";
+}>;
 export type ApprovalType = z.infer<typeof ApprovalType>;
 /**
  * Approval definition
  */
 export declare const Approval: z.ZodObject<{
     id: z.ZodString;
-    type: z.ZodEnum<["tool_execution", "file_write", "file_delete", "command_execution", "network_request", "external_action"]>;
-    status: z.ZodDefault<z.ZodEnum<["pending", "approved", "rejected", "expired"]>>;
+    type: z.ZodEnum<{
+        command_execution: "command_execution";
+        external_action: "external_action";
+        file_delete: "file_delete";
+        file_write: "file_write";
+        network_request: "network_request";
+        tool_execution: "tool_execution";
+    }>;
+    status: z.ZodDefault<z.ZodEnum<{
+        approved: "approved";
+        expired: "expired";
+        pending: "pending";
+        rejected: "rejected";
+    }>>;
     workspaceId: z.ZodString;
     sessionId: z.ZodString;
     jobId: z.ZodOptional<z.ZodString>;
@@ -33,49 +57,20 @@ export declare const Approval: z.ZodObject<{
     requestedBy: z.ZodString;
     approvedBy: z.ZodOptional<z.ZodString>;
     metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-}, "strip", z.ZodTypeAny, {
-    id: string;
-    type: "command_execution" | "external_action" | "file_delete" | "file_write" | "network_request" | "tool_execution";
-    status: "approved" | "expired" | "pending" | "rejected";
-    workspaceId: string;
-    sessionId: string;
-    jobId?: string | undefined;
-    tool?: string | undefined;
-    command?: string | undefined;
-    file?: string | undefined;
-    description: string;
-    reason?: string | undefined;
-    requestedAt: string;
-    respondedAt?: string | undefined;
-    expiresAt?: string | undefined;
-    requestedBy: string;
-    approvedBy?: string | undefined;
-    metadata?: Record<string, unknown> | undefined;
-}, {
-    id: string;
-    type: "command_execution" | "external_action" | "file_delete" | "file_write" | "network_request" | "tool_execution";
-    status?: "approved" | "expired" | "pending" | "rejected" | undefined;
-    workspaceId: string;
-    sessionId: string;
-    jobId?: string | undefined;
-    tool?: string | undefined;
-    command?: string | undefined;
-    file?: string | undefined;
-    description: string;
-    reason?: string | undefined;
-    requestedAt: string;
-    respondedAt?: string | undefined;
-    expiresAt?: string | undefined;
-    requestedBy: string;
-    approvedBy?: string | undefined;
-    metadata?: Record<string, unknown> | undefined;
-}>;
+}, z.core.$strip>;
 export type Approval = z.infer<typeof Approval>;
 /**
  * Approval request input
  */
 export declare const ApprovalRequest: z.ZodObject<{
-    type: z.ZodEnum<["tool_execution", "file_write", "file_delete", "command_execution", "network_request", "external_action"]>;
+    type: z.ZodEnum<{
+        command_execution: "command_execution";
+        external_action: "external_action";
+        file_delete: "file_delete";
+        file_write: "file_write";
+        network_request: "network_request";
+        tool_execution: "tool_execution";
+    }>;
     workspaceId: z.ZodString;
     sessionId: z.ZodString;
     jobId: z.ZodOptional<z.ZodString>;
@@ -86,31 +81,7 @@ export declare const ApprovalRequest: z.ZodObject<{
     reason: z.ZodOptional<z.ZodString>;
     expiresIn: z.ZodOptional<z.ZodNumber>;
     metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-}, "strip", z.ZodTypeAny, {
-    type: "command_execution" | "external_action" | "file_delete" | "file_write" | "network_request" | "tool_execution";
-    workspaceId: string;
-    sessionId: string;
-    jobId?: string | undefined;
-    tool?: string | undefined;
-    command?: string | undefined;
-    file?: string | undefined;
-    description: string;
-    reason?: string | undefined;
-    expiresIn?: number | undefined;
-    metadata?: Record<string, unknown> | undefined;
-}, {
-    type: "command_execution" | "external_action" | "file_delete" | "file_write" | "network_request" | "tool_execution";
-    workspaceId: string;
-    sessionId: string;
-    jobId?: string | undefined;
-    tool?: string | undefined;
-    command?: string | undefined;
-    file?: string | undefined;
-    description: string;
-    reason?: string | undefined;
-    expiresIn?: number | undefined;
-    metadata?: Record<string, unknown> | undefined;
-}>;
+}, z.core.$strip>;
 export type ApprovalRequest = z.infer<typeof ApprovalRequest>;
 /**
  * Approval response input
@@ -119,15 +90,7 @@ export declare const ApprovalResponse: z.ZodObject<{
     id: z.ZodString;
     approved: z.ZodBoolean;
     reason: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    id: string;
-    approved: boolean;
-    reason?: string | undefined;
-}, {
-    id: string;
-    approved: boolean;
-    reason?: string | undefined;
-}>;
+}, z.core.$strip>;
 export type ApprovalResponse = z.infer<typeof ApprovalResponse>;
 /**
  * Approval filter
@@ -136,33 +99,25 @@ export declare const ApprovalFilter: z.ZodObject<{
     workspaceId: z.ZodOptional<z.ZodString>;
     sessionId: z.ZodOptional<z.ZodString>;
     jobId: z.ZodOptional<z.ZodString>;
-    status: z.ZodOptional<z.ZodEnum<["pending", "approved", "rejected", "expired"]>>;
-    type: z.ZodOptional<z.ZodEnum<["tool_execution", "file_write", "file_delete", "command_execution", "network_request", "external_action"]>>;
+    status: z.ZodOptional<z.ZodEnum<{
+        approved: "approved";
+        expired: "expired";
+        pending: "pending";
+        rejected: "rejected";
+    }>>;
+    type: z.ZodOptional<z.ZodEnum<{
+        command_execution: "command_execution";
+        external_action: "external_action";
+        file_delete: "file_delete";
+        file_write: "file_write";
+        network_request: "network_request";
+        tool_execution: "tool_execution";
+    }>>;
     since: z.ZodOptional<z.ZodString>;
     until: z.ZodOptional<z.ZodString>;
     limit: z.ZodDefault<z.ZodNumber>;
     cursor: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    workspaceId?: string | undefined;
-    sessionId?: string | undefined;
-    jobId?: string | undefined;
-    status?: "approved" | "expired" | "pending" | "rejected" | undefined;
-    type?: "command_execution" | "external_action" | "file_delete" | "file_write" | "network_request" | "tool_execution" | undefined;
-    since?: string | undefined;
-    until?: string | undefined;
-    limit: number;
-    cursor?: string | undefined;
-}, {
-    workspaceId?: string | undefined;
-    sessionId?: string | undefined;
-    jobId?: string | undefined;
-    status?: "approved" | "expired" | "pending" | "rejected" | undefined;
-    type?: "command_execution" | "external_action" | "file_delete" | "file_write" | "network_request" | "tool_execution" | undefined;
-    since?: string | undefined;
-    until?: string | undefined;
-    limit?: number | undefined;
-    cursor?: string | undefined;
-}>;
+}, z.core.$strip>;
 export type ApprovalFilter = z.infer<typeof ApprovalFilter>;
 /**
  * Approval list response
@@ -170,8 +125,20 @@ export type ApprovalFilter = z.infer<typeof ApprovalFilter>;
 export declare const ApprovalList: z.ZodObject<{
     items: z.ZodArray<z.ZodObject<{
         id: z.ZodString;
-        type: z.ZodEnum<["tool_execution", "file_write", "file_delete", "command_execution", "network_request", "external_action"]>;
-        status: z.ZodDefault<z.ZodEnum<["pending", "approved", "rejected", "expired"]>>;
+        type: z.ZodEnum<{
+            command_execution: "command_execution";
+            external_action: "external_action";
+            file_delete: "file_delete";
+            file_write: "file_write";
+            network_request: "network_request";
+            tool_execution: "tool_execution";
+        }>;
+        status: z.ZodDefault<z.ZodEnum<{
+            approved: "approved";
+            expired: "expired";
+            pending: "pending";
+            rejected: "rejected";
+        }>>;
         workspaceId: z.ZodString;
         sessionId: z.ZodString;
         jobId: z.ZodOptional<z.ZodString>;
@@ -186,88 +153,8 @@ export declare const ApprovalList: z.ZodObject<{
         requestedBy: z.ZodString;
         approvedBy: z.ZodOptional<z.ZodString>;
         metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    }, "strip", z.ZodTypeAny, {
-        id: string;
-        type: "command_execution" | "external_action" | "file_delete" | "file_write" | "network_request" | "tool_execution";
-        status: "approved" | "expired" | "pending" | "rejected";
-        workspaceId: string;
-        sessionId: string;
-        jobId?: string | undefined;
-        tool?: string | undefined;
-        command?: string | undefined;
-        file?: string | undefined;
-        description: string;
-        reason?: string | undefined;
-        requestedAt: string;
-        respondedAt?: string | undefined;
-        expiresAt?: string | undefined;
-        requestedBy: string;
-        approvedBy?: string | undefined;
-        metadata?: Record<string, unknown> | undefined;
-    }, {
-        id: string;
-        type: "command_execution" | "external_action" | "file_delete" | "file_write" | "network_request" | "tool_execution";
-        status?: "approved" | "expired" | "pending" | "rejected" | undefined;
-        workspaceId: string;
-        sessionId: string;
-        jobId?: string | undefined;
-        tool?: string | undefined;
-        command?: string | undefined;
-        file?: string | undefined;
-        description: string;
-        reason?: string | undefined;
-        requestedAt: string;
-        respondedAt?: string | undefined;
-        expiresAt?: string | undefined;
-        requestedBy: string;
-        approvedBy?: string | undefined;
-        metadata?: Record<string, unknown> | undefined;
-    }>, "many">;
+    }, z.core.$strip>>;
     nextCursor: z.ZodOptional<z.ZodString>;
     total: z.ZodOptional<z.ZodNumber>;
-}, "strip", z.ZodTypeAny, {
-    items: {
-        id: string;
-        type: "command_execution" | "external_action" | "file_delete" | "file_write" | "network_request" | "tool_execution";
-        status: "approved" | "expired" | "pending" | "rejected";
-        workspaceId: string;
-        sessionId: string;
-        jobId?: string | undefined;
-        tool?: string | undefined;
-        command?: string | undefined;
-        file?: string | undefined;
-        description: string;
-        reason?: string | undefined;
-        requestedAt: string;
-        respondedAt?: string | undefined;
-        expiresAt?: string | undefined;
-        requestedBy: string;
-        approvedBy?: string | undefined;
-        metadata?: Record<string, unknown> | undefined;
-    }[];
-    nextCursor?: string | undefined;
-    total?: number | undefined;
-}, {
-    items: {
-        id: string;
-        type: "command_execution" | "external_action" | "file_delete" | "file_write" | "network_request" | "tool_execution";
-        status?: "approved" | "expired" | "pending" | "rejected" | undefined;
-        workspaceId: string;
-        sessionId: string;
-        jobId?: string | undefined;
-        tool?: string | undefined;
-        command?: string | undefined;
-        file?: string | undefined;
-        description: string;
-        reason?: string | undefined;
-        requestedAt: string;
-        respondedAt?: string | undefined;
-        expiresAt?: string | undefined;
-        requestedBy: string;
-        approvedBy?: string | undefined;
-        metadata?: Record<string, unknown> | undefined;
-    }[];
-    nextCursor?: string | undefined;
-    total?: number | undefined;
-}>;
+}, z.core.$strip>;
 export type ApprovalList = z.infer<typeof ApprovalList>;