pi-harness-runtime 1.1.435 → 1.1.437

package/harness/key-file-audit.ts

@@ -15,7 +15,7 @@
  * state of a file (missing / empty).
  */
 
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 
@@ -303,6 +303,22 @@ function isDerivableWebhookUrl(value: string): boolean {
 	}
 }
 
+/**
+ * A key file that other users on this machine can read.
+ *
+ * A key file is a secret. A secret that the group or the others can read
+ * is not a secret - it is published to every account on the machine. The
+ * audit does not read the content of such a file; it looks at the mode.
+ */
+export interface ExposedKeyFile {
+	/** The name of the file, relative to the key directory. */
+	file: string;
+	/** The mode of the file, as an octal string ("644"). */
+	mode: string;
+	/** Who can read the file besides the owner. */
+	readableBy: "group" | "others" | "group and others";
+}
+
 export interface KeyFileAuditOptions {
 	/** The key directory to scan (e.g. ~/.pi-harness-runtime/keys). */
 	keysDir: string;
@@ -312,6 +328,10 @@ export interface KeyFileAuditOptions {
 	readFile?: (path: string) => string | undefined;
 	/** Existence check override (used by the tests). */
 	exists?: (path: string) => boolean;
+	/** Directory reader override (used by the tests). */
+	readdir?: (path: string) => string[];
+	/** File information override (used by the tests). */
+	stat?: (path: string) => { mode: number; isFile: boolean } | undefined;
 }
 
 export interface KeyFileAuditResult {
@@ -319,6 +339,61 @@ export interface KeyFileAuditResult {
 	missing: MissingCredential[];
 	/** The unresolved credentials grouped by their owning feature. */
 	byFeature: Map<string, MissingCredential[]>;
+	/** The key files that other users on this machine can read. */
+	exposed: ExposedKeyFile[];
+}
+
+/**
+ * The key files that other users on this machine can read.
+ *
+ * A key file with the mode 600 is a secret. Every other bit in the group
+ * or the others column publishes it to the accounts on the machine, and
+ * nothing in the harness notices - the file is read successfully by the
+ * owner, so nothing fails and nothing is reported.
+ *
+ * The whole directory is scanned, not only the files of the inventory: a
+ * key file that the inventory does not know yet is a secret too.
+ */
+export function scanExposedKeyFiles(options: KeyFileAuditOptions): ExposedKeyFile[] {
+	const readdir =
+		options.readdir ??
+		((path: string) => {
+			try {
+				return readdirSync(path);
+			} catch {
+				return [];
+			}
+		});
+	const stat =
+		options.stat ??
+		((path: string) => {
+			try {
+				const info = statSync(path);
+				return { mode: info.mode & 0o777, isFile: info.isFile() };
+			} catch {
+				return undefined;
+			}
+		});
+
+	const exposed: ExposedKeyFile[] = [];
+	for (const name of readdir(options.keysDir).sort()) {
+		const info = stat(join(options.keysDir, name));
+		if (!info || !info.isFile) continue;
+		const group = info.mode & 0o070;
+		const others = info.mode & 0o007;
+		if (group === 0 && others === 0) continue;
+		exposed.push({
+			file: name,
+			mode: info.mode.toString(8).padStart(3, "0"),
+			readableBy:
+				group !== 0 && others !== 0
+					? "group and others"
+					: group !== 0
+						? "group"
+						: "others",
+		});
+	}
+	return exposed;
 }
 
 /**
@@ -396,10 +471,35 @@ export function auditKeyFiles(options: KeyFileAuditOptions): KeyFileAuditResult
 		byFeature.set(entry.requirement.feature, list);
 	}
 
-	return { missing, byFeature };
+	return { missing, byFeature, exposed: scanExposedKeyFiles(options) };
+}
+
+/**
+ * The command that makes a key file private again.
+ *
+ * The file keeps its content - the command changes the mode, not the
+ * value.
+ */
+export function formatExposedKeyFileFix(
+	entry: ExposedKeyFile,
+	keysDir: string,
+): string {
+	return `chmod 600 ${join(displayKeysDir(keysDir), entry.file)}`;
 }
 
-/** The key directory as it is shown to the user (~ instead of the home path). */
+/**
+ * The fix commands for every key file that other users can read.
+ */
+export function formatExposedKeyFileFixes(
+	entries: ExposedKeyFile[] | undefined,
+	keysDir: string,
+): string[] {
+	if (!entries || entries.length === 0) return [];
+	return entries.map((entry) => formatExposedKeyFileFix(entry, keysDir));
+}
+
+/**
+ * The key directory as it is shown to the user (~ instead of the home path). */
 export function displayKeysDir(keysDir: string): string {
 	const home = homedir();
 	return keysDir.startsWith(home) ? join("~", keysDir.slice(home.length)) : keysDir;

package/harness/startup-report.ts

@@ -11,7 +11,7 @@
  * - LINE must not be reported as configured when the audit could not run.
  */
 
-import type { KeyFileAuditResult } from "./key-file-audit.ts";
+import type { ExposedKeyFile, KeyFileAuditResult } from "./key-file-audit.ts";
 
 export type StartupStatus = "wait" | "ok" | "info" | "warn" | "err";
 
@@ -141,6 +141,37 @@ export function relayEndpointReport(options: {
 	};
 }
 
+/**
+ * The line for key files that other users on this machine can read.
+ *
+ * A key file is a secret, and a secret that the group or the others can
+ * read is published to every account on the machine. Nothing else notices:
+ * the harness reads the file successfully, so no feature fails and no other
+ * line warns. This line is the only place where the fact can surface.
+ *
+ * The line names the count and the command. It never names a value.
+ */
+export function exposedKeyFilesReport(options: {
+	/** The key files that other users can read. */
+	exposed: ExposedKeyFile[];
+	/** The `chmod` command for each of them. */
+	fixes: string[];
+}): StartupReport | null {
+	if (options.exposed.length === 0) return null;
+	const count = options.exposed.length;
+	const text =
+		count === 1
+			? "1 key file can be read by other users on this machine"
+			: `${count} key files can be read by other users on this machine`;
+	const details = [...options.fixes];
+	if (details.length === 0) {
+		details.push(
+			"Make the key directory private: chmod 700 ~/.pi-harness-runtime/keys",
+		);
+	}
+	return { label: "Keys", text, status: "warn", details };
+}
+
 /**
  * The two steps that create a usable LINE channel.
  *

package/index.ts

@@ -23,6 +23,7 @@ import { HarnessStartupStatus, harnessStatusMarker, type HarnessStatus } from ".
 import {
 	auditKeyFiles,
 	fallbackKeyFileFixes,
+	formatExposedKeyFileFixes,
 	formatKeyFileFixes,
 	selectKeyFileFixes,
 	type KeyFileAuditResult,
@@ -32,6 +33,7 @@ import { describeInboundAccess, getAllowedUserIds } from "./harness/telegram-aut
 import { buildTelegramCallbackUpdate, buildTelegramMessageUpdate } from "./harness/telegram-update.ts";
 import { installConsoleGuard } from "./harness/console-guard.ts";
 import {
+	exposedKeyFilesReport,
 	jevMissingKeyReport,
 	lineConfigurationReport,
 	oneLineError,
@@ -200,6 +202,26 @@ function getKeyFileAudit(): KeyFileAuditResult | null {
 	return keyFileAudit;
 }
 
+/**
+ * Report the key files that other users on this machine can read.
+ *
+ * A key file is a secret. The harness reads its own key files, so a file
+ * that the group or the others can read works perfectly - and is published
+ * to every account on the machine. No other line notices, so this is the
+ * only place where the fact can surface.
+ */
+function reportExposedKeyFiles(): void {
+	const audit = getKeyFileAudit();
+	const exposed = audit?.exposed ?? [];
+	if (exposed.length === 0) return;
+	const report = exposedKeyFilesReport({
+		exposed,
+		fixes: formatExposedKeyFileFixes(exposed, harnessKeysDir()),
+	});
+	if (!report) return;
+	addHarnessMessage(report.label, report.text, report.status, report.details);
+}
+
 /**
  * The `echo` commands that create the missing key files of one feature.
  *
@@ -4240,6 +4262,11 @@ export default async function (pi: ExtensionAPI) {
 	// Telegram is not configured at all - that is the fresh-install case.
 	reportRelayConfiguration();
 
+	// The key files that other users can read. The audit is read by
+	// every other line, so this is the only place where a published
+	// secret can surface.
+	reportExposedKeyFiles();
+
 	// --- console-guard: keep the TUI prompt input field clean ----
 	// A library that writes to the console would put its text into the
 	// prompt input field. The guard sends it to the harness log instead.
@@ -6186,6 +6213,7 @@ Run \`bd ready\` to see current bd issues.
 		keyFileAuditDone = false;
 		reportRelayConfiguration();
 		reportLineConfiguration();
+		reportExposedKeyFiles();
 		// Service states survive session changes; initialization runs once per extension load.
 		harnessWidgetRegistered = false; // Reset for new session
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-harness-runtime",
-  "version": "1.1.435",
+  "version": "1.1.437",
   "description": "[BETA] Codex-style /usage status + autonomous coding harness for pi. Not production ready — expect breaking changes.",
   "type": "module",
   "scripts": {
@@ -21,6 +21,7 @@
     "build": "bun scripts/build-packages.ts",
     "build:verify": "bun scripts/verify-package-contents.ts",
     "build:verify:pack": "bun scripts/verify-package-contents.ts --pack",
+    "guard:scan": "bash scripts/guard-scan.sh",
     "prepublishOnly": "bun run build && bun run build:verify:pack",
     "test:harness": "node scripts/run-langchain-tests.mjs",
     "test:packages": "bun test packages/",

package/packages/a2a-adapter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/a2a-adapter",
-  "version": "1.1.435",
+  "version": "1.1.437",
   "type": "module",
   "description": "Google Agent-to-Agent (A2A) protocol adapter for pi-harness",
   "main": "dist/index.js",

package/packages/agent-policy/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/agent-policy",
-  "version": "1.1.435",
+  "version": "1.1.437",
   "description": "Agent policy runtime for pi-harness - enforces mandatory rule delivery and mutation gating",
   "type": "module",
   "main": "./dist/index.js",

package/packages/architecture-generator/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/architecture-generator",
-  "version": "1.1.435",
+  "version": "1.1.437",
   "description": "Generate ADR and Mermaid diagrams from project analysis",
   "type": "module",
   "main": "./dist/index.js",

package/packages/auth/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/auth",
-  "version": "1.1.435",
+  "version": "1.1.437",
   "description": "pi-harness-runtime — auth",
   "type": "module",
   "main": "./dist/index.js",

package/packages/autonomous-refactor/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/autonomous-refactor",
-  "version": "1.1.435",
+  "version": "1.1.437",
   "type": "module",
   "description": "Autonomous refactoring engine",
   "main": "dist/index.js",

package/packages/autonomous-runtime/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/autonomous-runtime",
-  "version": "1.1.435",
+  "version": "1.1.437",
   "description": "Autonomous Operations Runtime — task inbox, lease management, and worker lifecycle (RFC-0101)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/cache-strategy/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/cache-strategy",
-  "version": "1.1.435",
+  "version": "1.1.437",
   "type": "module",
   "description": "Smart caching with TTL and invalidation strategies (RFC-0022)",
   "main": "dist/index.js",

package/packages/capability-registry/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/capability-registry",
-  "version": "1.1.435",
+  "version": "1.1.437",
   "description": "Capability Registry for pi-harness-runtime — tracks model capabilities and enables capability-based routing",
   "type": "module",
   "main": "./dist/index.js",

package/packages/checkpoint/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/checkpoint",
-  "version": "1.1.435",
+  "version": "1.1.437",
   "description": "Enhanced checkpoint system with incremental snapshots, diff-based storage, and recovery strategies",
   "type": "module",
   "main": "./dist/index.js",

package/packages/cli-plugin-sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/cli-plugin-sdk",
-  "version": "1.1.435",
+  "version": "1.1.437",
   "type": "module",
   "description": "CLI Plugin SDK for pi-harness — install, list, remove, update, invoke plugins",
   "main": "dist/index.js",

package/packages/clipboard/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/clipboard",
-  "version": "1.1.435",
+  "version": "1.1.437",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/clipboard-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/clipboard-plugin",
-  "version": "1.1.435",
+  "version": "1.1.437",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/code-generation/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/code-generation",
-  "version": "1.1.435",
+  "version": "1.1.437",
   "description": "Code generation pipeline for pi-harness-runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/code-review/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/code-review",
-  "version": "1.1.435",
+  "version": "1.1.437",
   "description": "Automated code review engine for pi-harness-runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/codex-adapter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/codex-adapter",
-  "version": "1.1.435",
+  "version": "1.1.437",
   "type": "module",
   "description": "OpenAI Codex provider adapter for pi-harness",
   "main": "dist/index.js",

package/packages/codex-watcher/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/codex-watcher",
-  "version": "1.1.435",
+  "version": "1.1.437",
   "description": "Watches Codex CLI sessions and emits visible messages for PING-PONG monitoring",
   "type": "module",
   "main": "./dist/src/index.js",

package/packages/config-capture/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moocoding/config-capture",
-  "version": "1.1.435",
+  "version": "1.1.437",
   "description": "Auto-capture API-fetched configuration values to AGENTS.md",
   "type": "module",
   "main": "src/index.ts",

package/packages/connection-runtime/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/connection-runtime",
-  "version": "1.1.435",
+  "version": "1.1.437",
   "type": "module",
   "description": "Connection management with jittered exponential backoff for pi-harness",
   "main": "./dist/index.js",

package/packages/context-compiler/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/context-compiler",
-  "version": "1.1.435",
+  "version": "1.1.437",
   "description": "Bounded context selection engine for pi-harness-runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/context-discovery/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/context-discovery",
-  "version": "1.1.435",
+  "version": "1.1.437",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/context-manager/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/context-manager",
-  "version": "1.1.435",
+  "version": "1.1.437",
   "description": "Context Window Manager — prevents model context overflow via compaction and resume prompts (RFC-0010)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/contracts/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/contracts",
-  "version": "1.1.435",
+  "version": "1.1.437",
   "type": "module",
   "description": "RPC schema definitions for pi-harness runtime",
   "main": "./dist/index.js",

package/packages/cookie-sanitizer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/cookie-sanitizer",
-  "version": "1.1.435",
+  "version": "1.1.437",
   "description": "pi-harness-runtime — cookie sanitizer (provider-quota cookie file normaliser)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/cost-optimizer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/cost-optimizer",
-  "version": "1.1.435",
+  "version": "1.1.437",
   "description": "Cost Optimizer for pi-harness-runtime — budget tracking, forecasting, and model selection optimization",
   "type": "module",
   "main": "./dist/index.js",

package/packages/dependency-analyzer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/dependency-analyzer",
-  "version": "1.1.435",
+  "version": "1.1.437",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/django-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/django-plugin",
-  "version": "1.1.435",
+  "version": "1.1.437",
   "description": "Django framework analysis — models, management commands, settings",
   "type": "module",
   "main": "./dist/index.js",

package/packages/doc-generator/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/doc-generator",
-  "version": "1.1.435",
+  "version": "1.1.437",
   "description": "Auto-Doc Generator — generate documentation from source code (RFC-0014)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/durable-review/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moocoding/durable-review",
-  "version": "1.1.435",
+  "version": "1.1.437",
   "description": "SQLite-backed durable reviewer using @earendil-works/pi-durable",
   "type": "module",
   "main": "src/index.ts",

package/packages/e2e-tester/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/e2e-tester",
-  "version": "1.1.435",
+  "version": "1.1.437",
   "description": "WebMCP-powered E2E testing for pi-harness - natural language test scenarios",
   "type": "module",
   "main": "./dist/index.js",

package/packages/evaluation-engine/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/evaluation-engine",
-  "version": "1.1.435",
+  "version": "1.1.437",
   "description": "Evaluation engine for pi-harness runtime (RFC-0057)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/evaluation-runner/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/evaluation-runner",
-  "version": "1.1.435",
+  "version": "1.1.437",
   "type": "module",
   "description": "Framework-agnostic evaluation framework for AI outputs (RFC-0020)",
   "main": "dist/index.js",

package/packages/event-bus/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/event-bus",
-  "version": "1.1.435",
+  "version": "1.1.437",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/event-sink/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/event-sink",
-  "version": "1.1.435",
+  "version": "1.1.437",
   "type": "module",
   "description": "Atomic event sourcing with SQLite transactions for pi-harness",
   "main": "./dist/index.js",

package/packages/event-store/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/event-store",
-  "version": "1.1.435",
+  "version": "1.1.437",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/experience-replay/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/experience-replay",
-  "version": "1.1.435",
+  "version": "1.1.437",
   "description": "Experience replay for debugging and reproducibility (RFC-0059)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/feedback-collector/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/feedback-collector",
-  "version": "1.1.435",
+  "version": "1.1.437",
   "type": "module",
   "description": "Collect and aggregate human/automated feedback (RFC-0021)",
   "main": "dist/index.js",

package/packages/file-copy-helper/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moocoding/file-copy-helper",
-  "version": "1.1.435",
+  "version": "1.1.437",
   "description": "Injects cp/sudo cp rule when user asks to mimic/copy files",
   "type": "module",
   "main": "dist/index.js",

package/packages/framework-detector/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/framework-detector",
-  "version": "1.1.435",
+  "version": "1.1.437",
   "description": "Framework detection system for pi-harness-runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/framework-plugin-sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/framework-plugin-sdk",
-  "version": "1.1.435",
+  "version": "1.1.437",
   "description": "Framework plugin SDK for pi-harness-runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/frappe-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/frappe-plugin",
-  "version": "1.1.435",
+  "version": "1.1.437",
   "description": "Frappe/ERPNext framework analysis — DocTypes, hooks, bench sites, site config",
   "type": "module",
   "main": "./dist/index.js",

package/packages/generic-web-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/generic-web-plugin",
-  "version": "1.1.435",
+  "version": "1.1.437",
   "description": "Generic web framework analysis — REST/GraphQL endpoints, OpenAPI, auth",
   "type": "module",
   "main": "./dist/index.js",