pi-harness-runtime 1.1.422 → 1.1.423

package/packages/skills/test/remote-skills.test.ts

@@ -13,15 +13,40 @@
  * network nor replaces a process-global module.
  */
 
-import { describe, expect, it } from "bun:test";
+import { afterEach, beforeEach, describe, expect, it } from "bun:test";
+import { fileURLToPath } from "node:url";
 
 import {
 	createSkillRegistry,
 	type QdrantClientLike,
 	type QdrantEmbedderLike,
 } from "../src/loader.js";
+import { resetSanitizationRulesCache } from "../src/sanitize-rules.js";
 import type { Skill } from "../src/types.js";
 
+/**
+ * The rules of the test.
+ *
+ * The rules of a client live in a local file, outside the repository. The
+ * test uses a fixture with made up names, so that the result of the test
+ * does not depend on the machine it runs on.
+ */
+const FIXTURE = fileURLToPath(
+	new URL("./fixtures/sanitization.json", import.meta.url),
+);
+const originalEnv = process.env.PI_SKILL_SANITIZATION_FILE;
+
+beforeEach(() => {
+	process.env.PI_SKILL_SANITIZATION_FILE = FIXTURE;
+	resetSanitizationRulesCache();
+});
+
+afterEach(() => {
+	resetSanitizationRulesCache();
+	if (originalEnv === undefined) delete process.env.PI_SKILL_SANITIZATION_FILE;
+	else process.env.PI_SKILL_SANITIZATION_FILE = originalEnv;
+});
+
 /** A point of the vector store. */
 interface VectorPoint {
 	id: number;
@@ -188,7 +213,7 @@ describe("a hit that carries the shared name of a local skill", () => {
 			embedder: fakeEmbedder,
 			collection: "pi-harness-skills-test",
 		});
-		registry.register(localSkill("inpac-pe-approval-workflow"));
+		registry.register(localSkill("acmecorp-pe-approval-workflow"));
 
 		const results = await registry.findVector("workflow");
 
@@ -196,16 +221,18 @@ describe("a hit that carries the shared name of a local skill", () => {
 		// The skill of this machine stays a local skill - with its own
 		// name and its own body, not the sanitized copy.
 		expect(results[0].source).toBe("local");
-		expect(results[0].skill.id).toBe("inpac-pe-approval-workflow");
-		expect(results[0].skill.body).toBe("the local body of inpac-pe-approval-workflow");
+		expect(results[0].skill.id).toBe("acmecorp-pe-approval-workflow");
+		expect(results[0].skill.body).toBe(
+			"the local body of acmecorp-pe-approval-workflow",
+		);
 	});
 
 	it("resolves the shared name of a local skill in a lookup", () => {
 		const registry = createSkillRegistry({ indexer: null });
-		registry.register(localSkill("inpac-pe-approval-workflow"));
+		registry.register(localSkill("acmecorp-pe-approval-workflow"));
 
 		expect(registry.get("client-a-pe-approval-workflow")?.id).toBe(
-			"inpac-pe-approval-workflow",
+			"acmecorp-pe-approval-workflow",
 		);
 	});
 });

package/packages/skills/test/sanitize.test.ts

@@ -5,29 +5,81 @@
  * into it. The rules used to live in `scripts/sync-to-qdrant.ts` - the
  * only writer that could reach them. The runtime registry writes into the
  * same collection, so it needs them too.
+ *
+ * The rules of the clients are **not** in this repository: it is public,
+ * and a list of client names in it is a list of client names in the world.
+ * They live in a local file, so the tests use a fixture with made up
+ * names and pass the rules in. A test must never read the rules of the
+ * machine it runs on - that would make the result of the test depend on
+ * the machine.
  */
 
-import { describe, expect, test } from "bun:test";
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { mkdtempSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
 
 import { sanitizeText, skillPointName } from "../src/sanitize.js";
+import {
+  loadSanitizationRules,
+  resetSanitizationRulesCache,
+  sanitizationStatus,
+} from "../src/sanitize-rules.js";
 import { skillPointPayload } from "../src/vector-schema.js";
 
+const FIXTURE = fileURLToPath(new URL("./fixtures/sanitization.json", import.meta.url));
+const MISSING = join(tmpdir(), "pi-harness-no-such-sanitization-file.json");
+
+const originalEnv = process.env.PI_SKILL_SANITIZATION_FILE;
+
+/** The rules of the fixture, as the mechanism reads them. */
+function fixtureRules() {
+  resetSanitizationRulesCache();
+  process.env.PI_SKILL_SANITIZATION_FILE = FIXTURE;
+  const set = loadSanitizationRules();
+  resetSanitizationRulesCache();
+  return set;
+}
+
+beforeEach(() => {
+  resetSanitizationRulesCache();
+  process.env.PI_SKILL_SANITIZATION_FILE = FIXTURE;
+});
+
+afterEach(() => {
+  resetSanitizationRulesCache();
+  if (originalEnv === undefined) delete process.env.PI_SKILL_SANITIZATION_FILE;
+  else process.env.PI_SKILL_SANITIZATION_FILE = originalEnv;
+});
+
 describe("the sanitization of a text", () => {
 	test("the name of a client is replaced", () => {
-		expect(sanitizeText("the inpac workflow")).toBe("the [Client A] workflow");
-		expect(sanitizeText("for digisoft")).toBe("for [Client B]");
-		expect(sanitizeText("gse-insurance step")).toBe("[Insurance Project] step");
+		const rules = fixtureRules();
+		expect(sanitizeText("the acmecorp workflow", rules)).toBe(
+			"the [Client A] workflow",
+		);
+		expect(sanitizeText("for globex", rules)).toBe("for [Client B]");
+		expect(sanitizeText("initech step", rules)).toBe("[Insurance Project] step");
 	});
 
 	test("the name of a client is replaced in any case", () => {
-		expect(sanitizeText("INPAC and Inpac")).toBe("[Client A] and [Client A]");
+		const rules = fixtureRules();
+		expect(sanitizeText("ACMEcorp and Acmecorp", rules)).toBe(
+			"[Client A] and [Client A]",
+		);
 	});
 
 	test("a text without a client name stays the same", () => {
-		expect(sanitizeText("a plain skill")).toBe("a plain skill");
+		const rules = fixtureRules();
+		expect(sanitizeText("a plain skill", rules)).toBe("a plain skill");
 	});
 
 	test("the generic phrases are replaced", () => {
+		// The generic rules hold for every installation, so they work
+		// without a local file.
+		process.env.PI_SKILL_SANITIZATION_FILE = MISSING;
+		resetSanitizationRulesCache();
 		expect(sanitizeText("Company Name")).toBe("[Client Name]");
 		expect(sanitizeText("your company")).toBe("[Client]");
 		expect(sanitizeText("our client")).toBe("[Client]");
@@ -37,46 +89,53 @@ describe("the sanitization of a text", () => {
 		// The name of a client rarely stands alone. A word boundary would
 		// miss every one of these - and an underscore is a word character,
 		// so a boundary never follows one.
-		expect(sanitizeText("inpac_pharma")).toBe("[Client A]_pharma");
-		expect(sanitizeText("th_digisoft_erp_chart.json")).toBe(
+		const rules = fixtureRules();
+		expect(sanitizeText("acmecorp_pharma", rules)).toBe("[Client A]_pharma");
+		expect(sanitizeText("th_globex_erp_chart.json", rules)).toBe(
 			"th_[Client B]_erp_chart.json",
 		);
-		expect(sanitizeText("apps/inpac_pharma/setup")).toBe(
+		expect(sanitizeText("apps/acmecorp_pharma/setup", rules)).toBe(
 			"apps/[Client A]_pharma/setup",
 		);
 	});
 
 	test("a client name in a sentence is replaced", () => {
-		expect(sanitizeText("integrated with Paperclip")).toBe(
-			"integrated with [Client D]",
+		const rules = fixtureRules();
+		expect(sanitizeText("integrated with Globex", rules)).toBe(
+			"integrated with [Client B]",
+		);
+		expect(sanitizeText("Initech secrets", rules)).toBe(
+			"[Insurance Project] secrets",
 		);
-		expect(sanitizeText("OpenClaw secrets")).toBe("[Client F] secrets");
 	});
 });
 
 describe("the name of a skill in the shared collection", () => {
 	test("a name of the map is renamed", () => {
-		expect(skillPointName("inpac-pe-approval-workflow")).toBe(
+		const rules = fixtureRules();
+		expect(skillPointName("acmecorp-pe-approval-workflow", rules)).toBe(
 			"client-a-pe-approval-workflow",
 		);
-		expect(skillPointName("tbs-import-clearance-lcv")).toBe(
-			"import-project-clearance",
+		expect(skillPointName("initech-step5-slot-filter", rules)).toBe(
+			"insurance-project-step-filter",
 		);
-		expect(skillPointName("whispertool")).toBe("whisper-tool");
 	});
 
 	test("a name without a client name stays the same", () => {
-		expect(skillPointName("code-review")).toBe("code-review");
+		const rules = fixtureRules();
+		expect(skillPointName("code-review", rules)).toBe("code-review");
 	});
 
 	test("the name never carries a client name", () => {
+		const rules = fixtureRules();
 		for (const name of [
-			"inpac-pe-approval-workflow",
-			"gse-insurance-step5-slot-filter",
-			"tbs-import-clearance-lcv",
-			"whispertool",
+			"acmecorp-pe-approval-workflow",
+			"initech-step5-slot-filter",
+			"globex-channel",
 		]) {
-			expect(skillPointName(name)).not.toMatch(/inpac|gse-insurance|tbs-import/i);
+			expect(skillPointName(name, rules)).not.toMatch(
+				/acmecorp|initech|globex/i,
+			);
 		}
 	});
 
@@ -84,48 +143,108 @@ describe("the name of a skill in the shared collection", () => {
 		// The name of a point is the id of the skill that a search returns,
 		// so it has to be a name that a skill may carry.
 		const NAME = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+		const rules = fixtureRules();
 		for (const name of [
-			"inpac-pe-approval-workflow",
-			"openclaw-channel",
-			"gse-insurance-step5-slot-filter",
-			"tbs-import-clearance-lcv",
-			"whispertool",
+			"acmecorp-pe-approval-workflow",
+			"globex-channel",
+			"initech-step5-slot-filter",
 			"code-review",
 		]) {
-			expect(skillPointName(name)).toMatch(NAME);
+			expect(skillPointName(name, rules)).toMatch(NAME);
 		}
 	});
 
 	test("a name that needs no sanitization stays the same", () => {
-		expect(skillPointName("code-review")).toBe("code-review");
-		expect(skillPointName("frappe-doctype-field-order")).toBe(
+		const rules = fixtureRules();
+		expect(skillPointName("code-review", rules)).toBe("code-review");
+		expect(skillPointName("frappe-doctype-field-order", rules)).toBe(
 			"frappe-doctype-field-order",
 		);
 	});
 });
 
+describe("the rules of the installation", () => {
+	test("a missing file leaves the generic rules", () => {
+		process.env.PI_SKILL_SANITIZATION_FILE = MISSING;
+		resetSanitizationRulesCache();
+		const status = sanitizationStatus();
+		expect(status.configured).toBe(false);
+		expect(status.ruleCount).toBeGreaterThan(0);
+	});
+
+	test("a broken file is reported and does not take the rules down", () => {
+		const dir = mkdtempSync(join(tmpdir(), "pi-harness-sanitization-"));
+		const path = join(dir, "rules.json");
+		writeFileSync(path, "{ not json");
+		process.env.PI_SKILL_SANITIZATION_FILE = path;
+		resetSanitizationRulesCache();
+		const status = sanitizationStatus();
+		expect(status.configured).toBe(false);
+		expect(status.error).toContain("not valid JSON");
+		// The generic rules still hold.
+		expect(sanitizeText("Company Name")).toBe("[Client Name]");
+	});
+
+	test("a broken pattern does not take the other rules down", () => {
+		const dir = mkdtempSync(join(tmpdir(), "pi-harness-sanitization-"));
+		const path = join(dir, "rules.json");
+		writeFileSync(
+			path,
+			JSON.stringify({
+				rules: [
+					{ pattern: "acmecorp", replacement: "[Client A]" },
+					{ pattern: "([unclosed", replacement: "[Broken]" },
+					{ pattern: "globex", replacement: "[Client B]" },
+				],
+			}),
+		);
+		process.env.PI_SKILL_SANITIZATION_FILE = path;
+		resetSanitizationRulesCache();
+		const rules = loadSanitizationRules();
+		expect(sanitizeText("acmecorp and globex", rules)).toBe(
+			"[Client A] and [Client B]",
+		);
+	});
+
+	test("the local file is read once", () => {
+		process.env.PI_SKILL_SANITIZATION_FILE = FIXTURE;
+		resetSanitizationRulesCache();
+		const first = loadSanitizationRules();
+		const second = loadSanitizationRules();
+		expect(second).toBe(first);
+	});
+});
+
 describe("the payload of a point is sanitized", () => {
 	test("the client names of the body do not travel into the collection", () => {
-		const payload = skillPointPayload({
-			name: "inpac-pe-approval-workflow",
-			description: "the workflow of inpac",
-			body: "the approval of inpac for the client",
-		});
+		const rules = fixtureRules();
+		const payload = skillPointPayload(
+			{
+				name: "acmecorp-pe-approval-workflow",
+				description: "the workflow of acmecorp",
+				body: "the approval of acmecorp for the client",
+			},
+			rules,
+		);
 
 		expect(payload.name).toBe("client-a-pe-approval-workflow");
-		expect(payload.description).not.toMatch(/inpac/i);
-		expect(payload.body).not.toMatch(/inpac/i);
-		expect(payload.text).not.toMatch(/inpac/i);
+		expect(payload.description).not.toMatch(/acmecorp/i);
+		expect(payload.body).not.toMatch(/acmecorp/i);
+		expect(payload.text).not.toMatch(/acmecorp/i);
 	});
 
 	test("the text is built from the sanitized parts", () => {
-		const payload = skillPointPayload({
-			name: "inpac-pe-approval-workflow",
-			description: "the workflow",
-			body: "the body",
-		});
+		const rules = fixtureRules();
+		const payload = skillPointPayload(
+			{
+				name: "acmecorp-pe-approval-workflow",
+				description: "the workflow",
+				body: "the body",
+			},
+			rules,
+		);
 
 		expect(payload.text).toContain("client-a-pe-approval-workflow");
-		expect(payload.text).not.toContain("inpac-pe-approval-workflow");
+		expect(payload.text).not.toContain("acmecorp-pe-approval-workflow");
 	});
 });

package/packages/sprint-planner/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/sprint-planner",
-  "version": "1.1.422",
+  "version": "1.1.423",
   "type": "module",
   "description": "Sprint planning engine for pi-harness",
   "main": "dist/index.js",

package/packages/subscription-engine/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/subscription-engine",
-  "version": "1.1.422",
+  "version": "1.1.423",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/task-compiler/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/task-compiler",
-  "version": "1.1.422",
+  "version": "1.1.423",
   "description": "Task Compiler for pi-harness-runtime — produces deterministic task DAG from CompiledRequirement",
   "type": "module",
   "main": "./dist/index.js",

package/packages/telegram/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/telegram",
-  "version": "1.1.422",
+  "version": "1.1.423",
   "description": "pi-harness-runtime — Telegram inbound/outbound",
   "type": "module",
   "main": "./src/index.js",

package/packages/tencentdb-memory/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moocoding/tencentdb-memory",
-  "version": "1.1.422",
+  "version": "1.1.423",
   "description": "TencentDB Agent Memory client - sync skills to centralized knowledge base",
   "type": "module",
   "main": "src/index.ts",

package/packages/tencentdb-sync/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/tencentdb-sync",
-  "version": "1.1.422",
+  "version": "1.1.423",
   "description": "Sync SKILL.md skills to TencentDB-Agent-Memory server (RFC-0105/0106)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/test-data-generator/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/test-data-generator",
-  "version": "1.1.422",
+  "version": "1.1.423",
   "description": "Test data generation for pi-harness-runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/test-generator/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/test-generator",
-  "version": "1.1.422",
+  "version": "1.1.423",
   "description": "Auto-Test Generator — generate unit and E2E tests from source code (RFC-0013)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/todo-bd-sync/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moocoding/todo-bd-sync",
-  "version": "1.1.422",
+  "version": "1.1.423",
   "description": "Two-way sync between rpiv-todo overlay and bd issue tracker",
   "type": "module",
   "main": "src/index.ts",

package/packages/token-estimation/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/token-estimation",
-  "version": "1.1.422",
+  "version": "1.1.423",
   "description": "pi-harness-runtime — token-estimation",
   "type": "module",
   "main": "./dist/index.js",

package/packages/token-optimizer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/token-optimizer",
-  "version": "1.1.422",
+  "version": "1.1.423",
   "description": "Token Budget Optimizer — maximize prompt value within token limits (RFC-0011)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/tooling-preference/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/tooling-preference",
-  "version": "1.1.422",
+  "version": "1.1.423",
   "description": "pi-harness-runtime — JS/TS tooling preference (Biome vs ESLint/Prettier) proposal",
   "type": "module",
   "main": "./dist/index.js",

package/packages/trajectory/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/trajectory",
-  "version": "1.1.422",
+  "version": "1.1.423",
   "description": "Trajectory capture for the write-review loop — persists cycle records for learning",
   "type": "module",
   "main": "./dist/src/index.js",

package/packages/tui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/tui",
-  "version": "1.1.422",
+  "version": "1.1.423",
   "description": "pi-harness-runtime — tui",
   "type": "module",
   "main": "./dist/index.js",

package/packages/two-phase-review/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/two-phase-review",
-  "version": "1.1.422",
+  "version": "1.1.423",
   "description": "pi-harness-runtime — two-phase implementation and review workflow (queue review signals, gate the phase, scope the diff)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/types/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/types",
-  "version": "1.1.422",
+  "version": "1.1.423",
   "description": "Shared TypeScript types for pi-harness-runtime packages",
   "type": "module",
   "main": "./dist/index.js",

package/packages/voice-api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/voice-api",
-  "version": "1.1.422",
+  "version": "1.1.423",
   "type": "module",
   "description": "Voice-to-text API using Whisper for Telegram and LINE integration",
   "main": "./dist/index.js",

package/packages/webmcp-tester/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/webmcp-tester",
-  "version": "1.1.422",
+  "version": "1.1.423",
   "description": "WebMCP-powered E2E testing for pi-harness - natural language test scenarios",
   "type": "module",
   "main": "./dist/index.js",

package/packages/wiki/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/wiki",
-  "version": "1.1.422",
+  "version": "1.1.423",
   "description": "LLM Wiki integration for pi-harness-runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/workflow-events/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/workflow-events",
-  "version": "1.1.422",
+  "version": "1.1.423",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/workspace-scanner/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/workspace-scanner",
-  "version": "1.1.422",
+  "version": "1.1.423",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/worktree/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/worktree",
-  "version": "1.1.422",
+  "version": "1.1.423",
   "description": "pi-harness-runtime — worktree",
   "type": "module",
   "main": "./dist/index.js",

package/packages/write-review/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moocoding/write-review",
-  "version": "1.1.422",
+  "version": "1.1.423",
   "description": "Two-agent write-review loop with blackboard coordination",
   "type": "module",
   "main": "src/index.ts",

package/scripts/sync-to-qdrant.ts

@@ -352,15 +352,11 @@ Sync Skills to Qdrant (Sanitized)
 Upload skills to Qdrant for team sharing.
 Client-specific names are REPLACED with placeholders.
 
-Sanitization Rules:
-  inpac         → [Client A]
-  m-capital     → [Client A]
-  digisoft      → [Client B]
-  cloudshot     → [Client C]
-  paperclip     → [Client D]
-  teamw         → [Client E]
-  openclaw      → [Client F]
-  autoresearch  → [Internal Tool]
+The rules live in the local file of the installation:
+  ~/.pi-harness-runtime/skill-sanitization.json
+They are not in this repository - it is public, and a list of client names
+in it is a list of client names in the world. Set
+PI_SKILL_SANITIZATION_FILE to use another file.
 
 Usage:
   bun scripts/sync-to-qdrant.ts --from <dir>     Sync skills from directory