pi-harness-runtime 1.1.437 → 1.1.439
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +1 -1
- package/packages/a2a-adapter/package.json +1 -1
- package/packages/agent-policy/package.json +1 -1
- package/packages/architecture-generator/package.json +1 -1
- package/packages/auth/package.json +1 -1
- package/packages/autonomous-refactor/package.json +1 -1
- package/packages/autonomous-runtime/package.json +1 -1
- package/packages/cache-strategy/package.json +1 -1
- package/packages/capability-registry/package.json +1 -1
- package/packages/checkpoint/package.json +1 -1
- package/packages/cli-plugin-sdk/package.json +1 -1
- package/packages/clipboard/package.json +1 -1
- package/packages/clipboard-plugin/package.json +1 -1
- package/packages/code-generation/package.json +1 -1
- package/packages/code-review/package.json +1 -1
- package/packages/codex-adapter/package.json +1 -1
- package/packages/codex-watcher/package.json +1 -1
- package/packages/config-capture/package.json +1 -1
- package/packages/connection-runtime/package.json +1 -1
- package/packages/context-compiler/package.json +1 -1
- package/packages/context-discovery/package.json +1 -1
- package/packages/context-manager/package.json +1 -1
- package/packages/contracts/package.json +1 -1
- package/packages/cookie-sanitizer/package.json +1 -1
- package/packages/cost-optimizer/package.json +1 -1
- package/packages/dependency-analyzer/package.json +1 -1
- package/packages/django-plugin/package.json +1 -1
- package/packages/doc-generator/package.json +1 -1
- package/packages/durable-review/package.json +1 -1
- package/packages/e2e-tester/package.json +1 -1
- package/packages/evaluation-engine/package.json +1 -1
- package/packages/evaluation-runner/package.json +1 -1
- package/packages/event-bus/package.json +1 -1
- package/packages/event-sink/package.json +1 -1
- package/packages/event-store/package.json +1 -1
- package/packages/experience-replay/package.json +1 -1
- package/packages/feedback-collector/package.json +1 -1
- package/packages/file-copy-helper/package.json +1 -1
- package/packages/framework-detector/package.json +1 -1
- package/packages/framework-plugin-sdk/package.json +1 -1
- package/packages/frappe-plugin/package.json +1 -1
- package/packages/generic-web-plugin/package.json +1 -1
- package/packages/health-monitor/package.json +1 -1
- package/packages/intent-analyzer/package.json +1 -1
- package/packages/jev-judge/package.json +1 -1
- package/packages/knowledge-graph/package.json +1 -1
- package/packages/knowledge-retrieval/package.json +1 -1
- package/packages/laravel-plugin/package.json +1 -1
- package/packages/learning-engine/package.json +1 -1
- package/packages/logging/package.json +1 -1
- package/packages/mcp-adapter/package.json +1 -1
- package/packages/memory-engine/package.json +1 -1
- package/packages/milestone-manager/package.json +1 -1
- package/packages/model-registry/package.json +1 -1
- package/packages/nextjs-plugin/package.json +1 -1
- package/packages/notification/package.json +1 -1
- package/packages/observability/package.json +1 -1
- package/packages/okf-indexer/package.json +1 -1
- package/packages/paperclip-integration/package.json +1 -1
- package/packages/performance-optimizer/package.json +1 -1
- package/packages/permission-mode/package.json +1 -1
- package/packages/privilege-broker/package.json +1 -1
- package/packages/project-analyzer/package.json +1 -1
- package/packages/project-bootstrap/package.json +1 -1
- package/packages/projection-engine/package.json +1 -1
- package/packages/prompt-compiler/package.json +1 -1
- package/packages/prompt-versioning/package.json +1 -1
- package/packages/provider-adapter-sdk/package.json +1 -1
- package/packages/provider-router/package.json +1 -1
- package/packages/provider-selector/package.json +1 -1
- package/packages/providers/package.json +1 -1
- package/packages/qdrant-skills/package.json +1 -1
- package/packages/quota-manager/package.json +1 -1
- package/packages/rate-limiter/package.json +1 -1
- package/packages/react-vite-plugin/package.json +1 -1
- package/packages/relay/package.json +1 -1
- package/packages/release-manager/package.json +1 -1
- package/packages/requirement-compiler/package.json +1 -1
- package/packages/runtime/package.json +1 -1
- package/packages/scheduler/package.json +1 -1
- package/packages/scheduler-adapter/package.json +1 -1
- package/packages/session/package.json +1 -1
- package/packages/session-api/package.json +1 -1
- package/packages/session-export/package.json +1 -1
- package/packages/shared-context/package.json +1 -1
- package/packages/skill-mcp-client/package.json +1 -1
- package/packages/skill-registry/package.json +1 -1
- package/packages/skills/package.json +1 -1
- package/packages/sprint-planner/package.json +1 -1
- package/packages/subscription-engine/package.json +1 -1
- package/packages/task-compiler/package.json +1 -1
- package/packages/tencentdb-memory/package.json +1 -1
- package/packages/tencentdb-sync/package.json +1 -1
- package/packages/test-data-generator/package.json +1 -1
- package/packages/test-generator/package.json +1 -1
- package/packages/todo-bd-sync/package.json +1 -1
- package/packages/token-estimation/package.json +1 -1
- package/packages/token-optimizer/package.json +1 -1
- package/packages/tooling-preference/package.json +1 -1
- package/packages/trajectory/package.json +1 -1
- package/packages/tui/package.json +1 -1
- package/packages/two-phase-review/package.json +1 -1
- package/packages/types/package.json +1 -1
- package/packages/voice-api/package.json +1 -1
- package/packages/webmcp-tester/package.json +1 -1
- package/packages/wiki/package.json +1 -1
- package/packages/workflow-events/package.json +1 -1
- package/packages/workspace-scanner/package.json +1 -1
- package/packages/worktree/package.json +1 -1
- package/packages/write-review/package.json +1 -1
- package/scripts/check-sensitive-terms.mjs +8 -0
- package/scripts/gist-auth.ts +3 -3
- package/scripts/sensitive-terms-selftest.sh +127 -0
- package/scripts/tsconfig.json +12 -0
- package/scripts/typecheck-packages.mjs +6 -8
- package/scripts/voice-api-example.ts +14 -12
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@pi-harness/provider-router",
|
|
3
|
-
"version": "1.1.
|
|
3
|
+
"version": "1.1.439",
|
|
4
4
|
"description": "Enhanced Provider Router for pi-harness-runtime — intelligent routing with capabilities, costs, and quotas",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "./dist/provider-router.js",
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@pi-harness/two-phase-review",
|
|
3
|
-
"version": "1.1.
|
|
3
|
+
"version": "1.1.439",
|
|
4
4
|
"description": "pi-harness-runtime — two-phase implementation and review workflow (queue review signals, gate the phase, scope the diff)",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "./dist/index.js",
|
|
@@ -725,6 +725,14 @@ async function main() {
|
|
|
725
725
|
result = { hits: scanText(args.text, "(text)", terms), scanned: 1, mode: "text" };
|
|
726
726
|
} else if (args.mode === "range") {
|
|
727
727
|
result = scanRange(args.range, terms);
|
|
728
|
+
// A range that holds nothing was written wrong. Scanning it
|
|
729
|
+
// would report a clean result for a check that never ran.
|
|
730
|
+
if (result.scanned === 0) {
|
|
731
|
+
console.error(
|
|
732
|
+
`the range ${args.range} holds nothing, so nothing could be checked.`,
|
|
733
|
+
);
|
|
734
|
+
return EXIT_UNAVAILABLE;
|
|
735
|
+
}
|
|
728
736
|
} else if (args.mode === "commits") {
|
|
729
737
|
result = scanCommitMessages(args.range, terms);
|
|
730
738
|
// A range that holds no commit is a range that was written
|
package/scripts/gist-auth.ts
CHANGED
|
@@ -7,7 +7,7 @@
|
|
|
7
7
|
* Prompts for GitHub PAT and creates a secret Gist for clipboard sync.
|
|
8
8
|
*/
|
|
9
9
|
|
|
10
|
-
import {
|
|
10
|
+
import { createInterface } from "node:readline/promises";
|
|
11
11
|
import {
|
|
12
12
|
createGist,
|
|
13
13
|
isConfigured,
|
|
@@ -19,7 +19,7 @@ async function main() {
|
|
|
19
19
|
if (isConfigured()) {
|
|
20
20
|
console.log("Gist clipboard sync is already configured.");
|
|
21
21
|
console.log("Run with --reset to reconfigure.\n");
|
|
22
|
-
const rl =
|
|
22
|
+
const rl = createInterface({ input: process.stdin, output: process.stdout });
|
|
23
23
|
const answer = await rl.question("Reset configuration? (y/N): ");
|
|
24
24
|
rl.close();
|
|
25
25
|
if (answer.toLowerCase() !== "y") {
|
|
@@ -34,7 +34,7 @@ async function main() {
|
|
|
34
34
|
console.log("3. Select scopes: 'gist' (read and write gists)");
|
|
35
35
|
console.log("4. Copy the token\n");
|
|
36
36
|
|
|
37
|
-
const rl =
|
|
37
|
+
const rl = createInterface({ input: process.stdin, output: process.stdout });
|
|
38
38
|
const token = await rl.question("GitHub Personal Access Token: ");
|
|
39
39
|
rl.close();
|
|
40
40
|
|
|
@@ -0,0 +1,127 @@
|
|
|
1
|
+
#!/usr/bin/env bash
|
|
2
|
+
#
|
|
3
|
+
# The failing path of the sensitive-term guard, proved on demand.
|
|
4
|
+
#
|
|
5
|
+
# The guard is only worth something when it really fails. A scanner that
|
|
6
|
+
# says "no term found" for a file that holds a term is worse than no
|
|
7
|
+
# scanner at all, because it is trusted. This script puts a term in
|
|
8
|
+
# front of the scanner and checks what the scanner does:
|
|
9
|
+
#
|
|
10
|
+
# - it fails (exit 1) on a file that holds the term,
|
|
11
|
+
# - it fails (exit 1) on a tree that holds the term,
|
|
12
|
+
# - it fails (exit 1) on a commit message that holds the term,
|
|
13
|
+
# - it passes (exit 0) on a file that holds no term, so the failures
|
|
14
|
+
# above are caused by the term and not by the scanner,
|
|
15
|
+
# - it fails closed (exit 2) when there is no term list,
|
|
16
|
+
# - and it never prints the term in any of those runs.
|
|
17
|
+
#
|
|
18
|
+
# The term is built while the script runs. A term that is written in the
|
|
19
|
+
# repository would be found by the guard that scans the repository, so
|
|
20
|
+
# the literal string never enters the tree.
|
|
21
|
+
#
|
|
22
|
+
# The script needs no secret and no network. It runs the same scanner
|
|
23
|
+
# that the workflow runs.
|
|
24
|
+
|
|
25
|
+
set -uo pipefail
|
|
26
|
+
|
|
27
|
+
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
|
|
28
|
+
SCANNER="$ROOT/scripts/check-sensitive-terms.mjs"
|
|
29
|
+
|
|
30
|
+
# The test term. The parts are kept apart so that the term itself is not
|
|
31
|
+
# a string in this repository.
|
|
32
|
+
TERM="zz"
|
|
33
|
+
TERM="${TERM}placeholder"
|
|
34
|
+
TERM="${TERM}name"
|
|
35
|
+
|
|
36
|
+
# The term list of the environment must not decide the outcome of the
|
|
37
|
+
# cases below: the case that proves the fail-closed behaviour needs a
|
|
38
|
+
# run without any list.
|
|
39
|
+
unset SENSITIVE_TERMS
|
|
40
|
+
unset PI_SENSITIVE_TERMS_FILE
|
|
41
|
+
|
|
42
|
+
WORK="$(mktemp -d)"
|
|
43
|
+
trap 'rm -rf "$WORK"' EXIT
|
|
44
|
+
|
|
45
|
+
fail() {
|
|
46
|
+
echo "self test failed: $1" >&2
|
|
47
|
+
exit 1
|
|
48
|
+
}
|
|
49
|
+
|
|
50
|
+
# Runs the scanner and checks what it did.
|
|
51
|
+
#
|
|
52
|
+
# $1 - the name of the case
|
|
53
|
+
# $2 - the exit code the scanner has to give
|
|
54
|
+
# $3 - the text the output has to hold
|
|
55
|
+
# $4 - the directory the scanner runs in
|
|
56
|
+
# $5... - the arguments of the scanner
|
|
57
|
+
run_case() {
|
|
58
|
+
local name="$1"
|
|
59
|
+
local expect_code="$2"
|
|
60
|
+
local expect_text="$3"
|
|
61
|
+
local dir="$4"
|
|
62
|
+
shift 4
|
|
63
|
+
local output
|
|
64
|
+
local code
|
|
65
|
+
output="$(cd "$dir" && node "$SCANNER" "$@" 2>&1)"
|
|
66
|
+
code=$?
|
|
67
|
+
if [ "$code" != "$expect_code" ]; then
|
|
68
|
+
echo "$name: expected exit $expect_code, got $code" >&2
|
|
69
|
+
echo "$output" >&2
|
|
70
|
+
fail "$name"
|
|
71
|
+
fi
|
|
72
|
+
if [ -n "$expect_text" ] && ! printf '%s' "$output" | grep -qF -- "$expect_text"; then
|
|
73
|
+
echo "$name: the output does not hold the expected text" >&2
|
|
74
|
+
echo "$output" >&2
|
|
75
|
+
fail "$name"
|
|
76
|
+
fi
|
|
77
|
+
if printf '%s' "$output" | grep -qF -- "$TERM"; then
|
|
78
|
+
fail "$name printed the term"
|
|
79
|
+
fi
|
|
80
|
+
echo "ok: $name (exit $code, no term in the output)"
|
|
81
|
+
}
|
|
82
|
+
|
|
83
|
+
if [ ! -f "$SCANNER" ]; then
|
|
84
|
+
fail "the scanner is not at $SCANNER"
|
|
85
|
+
fi
|
|
86
|
+
|
|
87
|
+
# The list of terms the cases use.
|
|
88
|
+
printf '%s\n' "$TERM" > "$WORK/terms.txt"
|
|
89
|
+
|
|
90
|
+
# A file that holds the term, and one that does not.
|
|
91
|
+
printf 'a line that holds %s\n' "$TERM" > "$WORK/sample.txt"
|
|
92
|
+
printf 'a line that holds nothing\n' > "$WORK/clean.txt"
|
|
93
|
+
|
|
94
|
+
run_case "a file that holds the term" 1 "sensitive list" "$WORK" \
|
|
95
|
+
--terms-file "$WORK/terms.txt" --file "$WORK/sample.txt"
|
|
96
|
+
|
|
97
|
+
run_case "a file that holds no term" 0 "no sensitive term was found" "$WORK" \
|
|
98
|
+
--terms-file "$WORK/terms.txt" --file "$WORK/clean.txt"
|
|
99
|
+
|
|
100
|
+
# A tree that holds the term. The push path of the workflow scans a
|
|
101
|
+
# tree, so the tree mode has to fail as well.
|
|
102
|
+
mkdir -p "$WORK/tree"
|
|
103
|
+
printf 'a line that holds %s\n' "$TERM" > "$WORK/tree/sample.txt"
|
|
104
|
+
run_case "a tree that holds the term" 1 "sensitive list" "$WORK" \
|
|
105
|
+
--terms-file "$WORK/terms.txt" --tree "$WORK/tree"
|
|
106
|
+
|
|
107
|
+
# A commit message that holds the term. The push path of the workflow
|
|
108
|
+
# scans the commit messages of the pushed commits.
|
|
109
|
+
mkdir -p "$WORK/repo"
|
|
110
|
+
git -C "$WORK/repo" init -q
|
|
111
|
+
git -C "$WORK/repo" config user.email "selftest@example.com"
|
|
112
|
+
git -C "$WORK/repo" config user.name "self test"
|
|
113
|
+
printf 'hello\n' > "$WORK/repo/file.txt"
|
|
114
|
+
git -C "$WORK/repo" add file.txt
|
|
115
|
+
git -C "$WORK/repo" commit -q -m "the first commit"
|
|
116
|
+
printf 'hello again\n' > "$WORK/repo/file.txt"
|
|
117
|
+
git -C "$WORK/repo" add file.txt
|
|
118
|
+
git -C "$WORK/repo" commit -q -m "a message that holds $TERM"
|
|
119
|
+
run_case "a commit message that holds the term" 1 "sensitive list" \
|
|
120
|
+
"$WORK/repo" --terms-file "$WORK/terms.txt" --commits "HEAD~1..HEAD"
|
|
121
|
+
|
|
122
|
+
# No term list at all. The check cannot run, so it says so instead of
|
|
123
|
+
# reporting a clean result.
|
|
124
|
+
run_case "no term list" 2 "no term list is configured" "$WORK" \
|
|
125
|
+
--file "$WORK/sample.txt"
|
|
126
|
+
|
|
127
|
+
echo "the failing path of the guard is proven"
|
|
@@ -0,0 +1,12 @@
|
|
|
1
|
+
{
|
|
2
|
+
"extends": "../tsconfig.base.json",
|
|
3
|
+
"compilerOptions": {
|
|
4
|
+
"module": "ESNext",
|
|
5
|
+
"moduleResolution": "bundler",
|
|
6
|
+
"types": ["node", "bun-types"],
|
|
7
|
+
"noEmit": true,
|
|
8
|
+
"allowImportingTsExtensions": true
|
|
9
|
+
},
|
|
10
|
+
"include": ["**/*.ts", "**/*.d.mts"],
|
|
11
|
+
"exclude": ["release/**"]
|
|
12
|
+
}
|
|
@@ -36,7 +36,11 @@ const BASELINES = new Map([
|
|
|
36
36
|
["voice-api", 16],
|
|
37
37
|
["worktree", 0],
|
|
38
38
|
["harness", 20],
|
|
39
|
-
|
|
39
|
+
// The scripts of the repository type check cleanly. The project
|
|
40
|
+
// lives in `scripts/tsconfig.json`, so the language server reads the
|
|
41
|
+
// same configuration as the compiler and no longer answers with a
|
|
42
|
+
// project that has no node types.
|
|
43
|
+
["scripts", 0],
|
|
40
44
|
["scripts/release", 0],
|
|
41
45
|
["root", 2],
|
|
42
46
|
["new-modules", 0],
|
|
@@ -68,16 +72,11 @@ for (const name of readdirSync(packagesDir).sort()) {
|
|
|
68
72
|
const project = join(packagesDir, name, "tsconfig.json");
|
|
69
73
|
if (existsSync(project)) projects.push(relative(root, project));
|
|
70
74
|
}
|
|
71
|
-
for (const extra of ["harness", "scripts/release"]) {
|
|
75
|
+
for (const extra of ["harness", "scripts", "scripts/release"]) {
|
|
72
76
|
if (existsSync(join(root, extra, "tsconfig.json"))) {
|
|
73
77
|
projects.push(join(extra, "tsconfig.json"));
|
|
74
78
|
}
|
|
75
79
|
}
|
|
76
|
-
// The scripts of the repository are their own project, with a config
|
|
77
|
-
// of their own at the root of the repository.
|
|
78
|
-
if (existsSync(join(root, "tsconfig.scripts.json"))) {
|
|
79
|
-
projects.push("tsconfig.scripts.json");
|
|
80
|
-
}
|
|
81
80
|
// The root extension (index.ts) has no project of its own - it is the entry
|
|
82
81
|
// point of the extension and was never type checked.
|
|
83
82
|
if (existsSync(join(root, "tsconfig.root.json"))) {
|
|
@@ -98,7 +97,6 @@ function ownerOf(projectPath) {
|
|
|
98
97
|
const normalized = projectPath.split("\\").join("/");
|
|
99
98
|
if (normalized === "tsconfig.root.json") return "root";
|
|
100
99
|
if (normalized === "tsconfig.new-modules.json") return "new-modules";
|
|
101
|
-
if (normalized === "tsconfig.scripts.json") return "scripts";
|
|
102
100
|
if (normalized.startsWith("packages/")) {
|
|
103
101
|
return normalized.split("/")[1];
|
|
104
102
|
}
|