pi-harness-runtime 1.1.422 → 1.1.424

package/README.md

@@ -37,7 +37,7 @@ pi install npm:@juicesharp/rpiv-todo  # Task tracking with bd sync
 
 The `pi-subagents` extension enables delegation assessment and parallel task execution for large refactoring work (10+ files, 50+ call sites).
 
-The `reverse-engineer-anything` skill (via `rea-agents`) enables reverse engineering of binaries, packages, firmware, and browser targets. See `.agents/skills/reverse-engineer-anything/SKILL.md`.
+The `reverse-engineer-anything` skill (via `rea-agents`) enables reverse engineering of binaries, packages, firmware, and browser targets. Skills are not shipped with this package: they are loaded from your own skill store (`~/.pi-harness-runtime/skills`) and from your own Qdrant collection.
 
 Requires Pi v0.37.3+.
 

package/harness/skills-plan/2026-07-12-herdr-moo-skills-adaptation-plan.md

@@ -17,11 +17,14 @@ Study Herdr's reusable `SKILL.md` distribution model and adapt the idea to `pi-h
 
 ### Current runtime state
 
-- `pi-harness-runtime` already exposes bundled skills via:
-  - `package.json` -> `pi.skills = ["./skills"]`
-- Current bundled repo skill set is minimal:
-  - `skills/harness-runtime/SKILL.md`
-- `packages/skill-registry` is currently an in-memory registry, not a filesystem `SKILL.md` loader.
+- `pi-harness-runtime` ships **no** bundled skills:
+  - the package has no `pi.skills` field and no `skills/` directory
+  - skill payloads live in the user's own Qdrant collection and in the
+    installation-local skill store, never in the published package
+- `packages/skills` is the runtime implementation: it discovers, sanitizes,
+  embeds and queries skills.
+- The scanner still reads the `skills/` and `.agents/skills/` directories of
+  the *working* project, so a project may keep its own skills on disk.
 
 ---
 
@@ -192,7 +195,7 @@ Success criteria:
 
 Once a sanitized skill exists inside `pi-harness-runtime/skills/<name>/SKILL.md`:
 
-- expose it through the existing `pi.skills` package field
+- expose it through the skill runtime (Qdrant + the local store), not through a bundled `pi.skills` directory
 - document Herdr-style installation ergonomics for the public subset
 
 This gives the benefit of Herdr's distribution model without risking raw private content leakage.

package/index.ts

@@ -3459,7 +3459,7 @@ async function initHermesSkills(pi: ExtensionAPI): Promise<void> {
 	addHarnessMessage("Skills", "initializing", "wait");
 	try {
 		// Dynamically import to avoid circular deps
-		const { initSkills } =
+		const { initSkills, sanitizationStatus } =
 			await import("./packages/skills/dist/index.js");
 
 		// Scan skills from default locations
@@ -3471,6 +3471,37 @@ async function initHermesSkills(pi: ExtensionAPI): Promise<void> {
 		// shared skill, and a single "N discovered" hides that difference.
 		const local = localSkillsReport(localCount);
 		addHarnessMessage("Skills", local.text, local.status, local.details);
+		// The rules that keep a client name out of the shared collection
+		// live in a local file - they are not in the repository, it is
+		// public. Without them only the generic rules hold, and a client
+		// name travels into the collection. That is a visible state, not
+		// a silent one.
+		try {
+			const rules = sanitizationStatus();
+			if (!rules.configured) {
+				addHarnessMessage(
+					"Skill privacy",
+					"sanitization rules not configured",
+					"warn",
+					[
+						`How to fix: create ${rules.path} with the rules of your client names, or set PI_SKILL_SANITIZATION_FILE to a file that holds them.`,
+						"The rules are not in the repository - it is public, and a list of client names in it is a list of client names in the world.",
+						"A client name can travel into the shared collection until they are.",
+						...(rules.error ? [rules.error] : []),
+					],
+				);
+			}
+		} catch (err) {
+			addHarnessMessage(
+				"Skill privacy",
+				"the sanitization rules could not be read",
+				"warn",
+				[
+					"How to fix: check that ~/.pi-harness-runtime/skill-sanitization.json exists and holds valid JSON.",
+					err instanceof Error ? err.message : String(err),
+				],
+			);
+		}
 		// The server-held skills. The service holds the authoritative
 		// files, so a machine without a local copy can still use a skill.
 		// It is only used when it is configured - a client without a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-harness-runtime",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "description": "[BETA] Codex-style /usage status + autonomous coding harness for pi. Not production ready — expect breaking changes.",
   "type": "module",
   "scripts": {
@@ -38,10 +38,9 @@
     "harness/**/*.ts",
     "packages/**/src/**/*.{ts,js}",
     "packages/**/dist/**/*.{js,d.ts,js.map,d.ts.map}",
-    "skills/**/*",
     "prompts/**/*",
     "scripts/**/*",
-    ".pi/plugins/**/*",
+    "plugins/**/*",
     "package.json",
     "README.md",
     "AGENTS.md",
@@ -73,9 +72,6 @@
     "extensions": [
       "./index.ts"
     ],
-    "skills": [
-      "./skills"
-    ],
     "prompts": [
       "./prompts"
     ]

package/packages/a2a-adapter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/a2a-adapter",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "type": "module",
   "description": "Google Agent-to-Agent (A2A) protocol adapter for pi-harness",
   "main": "dist/index.js",

package/packages/agent-policy/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/agent-policy",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "description": "Agent policy runtime for pi-harness - enforces mandatory rule delivery and mutation gating",
   "type": "module",
   "main": "./dist/index.js",

package/packages/architecture-generator/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/architecture-generator",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "description": "Generate ADR and Mermaid diagrams from project analysis",
   "type": "module",
   "main": "./dist/index.js",

package/packages/auth/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/auth",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "description": "pi-harness-runtime — auth",
   "type": "module",
   "main": "./dist/index.js",

package/packages/autonomous-refactor/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/autonomous-refactor",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "type": "module",
   "description": "Autonomous refactoring engine",
   "main": "dist/index.js",

package/packages/autonomous-runtime/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/autonomous-runtime",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "description": "Autonomous Operations Runtime — task inbox, lease management, and worker lifecycle (RFC-0101)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/cache-strategy/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/cache-strategy",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "type": "module",
   "description": "Smart caching with TTL and invalidation strategies (RFC-0022)",
   "main": "dist/index.js",

package/packages/capability-registry/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/capability-registry",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "description": "Capability Registry for pi-harness-runtime — tracks model capabilities and enables capability-based routing",
   "type": "module",
   "main": "./dist/index.js",

package/packages/checkpoint/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/checkpoint",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "description": "Enhanced checkpoint system with incremental snapshots, diff-based storage, and recovery strategies",
   "type": "module",
   "main": "./dist/index.js",

package/packages/cli-plugin-sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/cli-plugin-sdk",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "type": "module",
   "description": "CLI Plugin SDK for pi-harness — install, list, remove, update, invoke plugins",
   "main": "dist/index.js",

package/packages/clipboard/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/clipboard",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/clipboard-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/clipboard-plugin",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/code-generation/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/code-generation",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "description": "Code generation pipeline for pi-harness-runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/code-review/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/code-review",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "description": "Automated code review engine for pi-harness-runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/codex-adapter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/codex-adapter",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "type": "module",
   "description": "OpenAI Codex provider adapter for pi-harness",
   "main": "dist/index.js",

package/packages/codex-watcher/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/codex-watcher",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "description": "Watches Codex CLI sessions and emits visible messages for PING-PONG monitoring",
   "type": "module",
   "main": "./dist/src/index.js",

package/packages/config-capture/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moocoding/config-capture",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "description": "Auto-capture API-fetched configuration values to AGENTS.md",
   "type": "module",
   "main": "src/index.ts",

package/packages/connection-runtime/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/connection-runtime",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "type": "module",
   "description": "Connection management with jittered exponential backoff for pi-harness",
   "main": "./dist/index.js",

package/packages/context-compiler/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/context-compiler",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "description": "Bounded context selection engine for pi-harness-runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/context-discovery/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/context-discovery",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/context-manager/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/context-manager",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "description": "Context Window Manager — prevents model context overflow via compaction and resume prompts (RFC-0010)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/contracts/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/contracts",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "type": "module",
   "description": "RPC schema definitions for pi-harness runtime",
   "main": "./dist/index.js",

package/packages/cookie-sanitizer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/cookie-sanitizer",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "description": "pi-harness-runtime — cookie sanitizer (provider-quota cookie file normaliser)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/cost-optimizer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/cost-optimizer",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "description": "Cost Optimizer for pi-harness-runtime — budget tracking, forecasting, and model selection optimization",
   "type": "module",
   "main": "./dist/index.js",

package/packages/dependency-analyzer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/dependency-analyzer",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/django-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/django-plugin",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "description": "Django framework analysis — models, management commands, settings",
   "type": "module",
   "main": "./dist/index.js",

package/packages/doc-generator/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/doc-generator",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "description": "Auto-Doc Generator — generate documentation from source code (RFC-0014)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/durable-review/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moocoding/durable-review",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "description": "SQLite-backed durable reviewer using @earendil-works/pi-durable",
   "type": "module",
   "main": "src/index.ts",

package/packages/e2e-tester/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/e2e-tester",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "description": "WebMCP-powered E2E testing for pi-harness - natural language test scenarios",
   "type": "module",
   "main": "./dist/index.js",

package/packages/evaluation-engine/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/evaluation-engine",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "description": "Evaluation engine for pi-harness runtime (RFC-0057)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/evaluation-runner/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/evaluation-runner",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "type": "module",
   "description": "Framework-agnostic evaluation framework for AI outputs (RFC-0020)",
   "main": "dist/index.js",

package/packages/event-bus/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/event-bus",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/event-sink/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/event-sink",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "type": "module",
   "description": "Atomic event sourcing with SQLite transactions for pi-harness",
   "main": "./dist/index.js",

package/packages/event-store/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/event-store",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/experience-replay/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/experience-replay",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "description": "Experience replay for debugging and reproducibility (RFC-0059)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/feedback-collector/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/feedback-collector",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "type": "module",
   "description": "Collect and aggregate human/automated feedback (RFC-0021)",
   "main": "dist/index.js",

package/packages/file-copy-helper/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moocoding/file-copy-helper",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "description": "Injects cp/sudo cp rule when user asks to mimic/copy files",
   "type": "module",
   "main": "dist/index.js",

package/packages/framework-detector/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/framework-detector",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "description": "Framework detection system for pi-harness-runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/framework-plugin-sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/framework-plugin-sdk",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "description": "Framework plugin SDK for pi-harness-runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/frappe-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/frappe-plugin",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "description": "Frappe/ERPNext framework analysis — DocTypes, hooks, bench sites, site config",
   "type": "module",
   "main": "./dist/index.js",

package/packages/generic-web-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/generic-web-plugin",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "description": "Generic web framework analysis — REST/GraphQL endpoints, OpenAPI, auth",
   "type": "module",
   "main": "./dist/index.js",

package/packages/health-monitor/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/health-monitor",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "type": "module",
   "description": "Health monitoring and auto-healing",
   "main": "dist/index.js",

package/packages/intent-analyzer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/intent-analyzer",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/jev-judge/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/jev-judge",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "description": "Jev Judge - Structured decision model for agent routing, E2E testing, and automated decisions",
   "type": "module",
   "main": "./dist/index.js",

package/packages/knowledge-graph/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/knowledge-graph",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "description": "Knowledge Graph extraction and provenance linking for SKILL.md files",
   "type": "module",
   "main": "./dist/index.js",

package/packages/knowledge-retrieval/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/knowledge-retrieval",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "description": "Knowledge retrieval via TencentDB-Agent-Memory MCP (RFC-0105)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/laravel-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/laravel-plugin",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "description": "Laravel framework analysis — artisan commands, Eloquent models, Blade",
   "type": "module",
   "main": "./dist/index.js",

package/packages/learning-engine/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/learning-engine",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "description": "Learning engine for extracting lessons from runtime execution (RFC-0058)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/logging/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/logging",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "type": "module",
   "description": "Centralized structured application logging with buffered Cloudflare R2 and webhook transports",
   "main": "./dist/index.js",

package/packages/mcp-adapter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/mcp-adapter",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "type": "module",
   "description": "MCP server adapter for pi-harness — exposes harness capabilities as MCP tools/resources/prompts (RFC-0068)",
   "main": "dist/index.js",

package/packages/memory-engine/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/memory-engine",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "description": "Memory engine with OKF integration for durable knowledge management (RFC-0060)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/milestone-manager/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/milestone-manager",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "description": "Track milestones and alerts when items are at risk",
   "type": "module",
   "main": "./dist/index.js",

package/packages/model-registry/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/model-registry",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "description": "Model Registry for pi-harness-runtime — centralized model metadata with pricing",
   "type": "module",
   "main": "./dist/index.js",

package/packages/nextjs-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/nextjs-plugin",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "description": "Next.js framework detection and analysis for pi-harness-runtime (RFC-0062)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/notification/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/notification",
-  "version": "1.1.422",
+  "version": "1.1.424",
   "description": "pi-harness-runtime — notification",
   "type": "module",
   "main": "./dist/index.js",