pi-mono-sentinel 1.6.0 → 1.7.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +73 -0
- package/README.md +48 -0
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,78 @@
|
|
|
1
1
|
# pi-mono-sentinel
|
|
2
2
|
|
|
3
|
+
## 1.7.2
|
|
4
|
+
|
|
5
|
+
### Patch Changes
|
|
6
|
+
|
|
7
|
+
### Fixed: ask-user-question
|
|
8
|
+
|
|
9
|
+
- Remove unused `StringEnum` import from `@mariozechner/pi-ai`.
|
|
10
|
+
|
|
11
|
+
|
|
12
|
+
## 1.7.1
|
|
13
|
+
|
|
14
|
+
### Patch Changes
|
|
15
|
+
|
|
16
|
+
### Fixed: team-mode
|
|
17
|
+
|
|
18
|
+
- Widget no longer mislabels blocked or approval-pending teams as "running smoothly" — blockers and pending approvals are now detected via team summaries.
|
|
19
|
+
- Preserve in-flight work on re-emitted `session_start` events instead of tearing the runtime down and SIGTERM-ing live teammates.
|
|
20
|
+
- Auto-relaunch leaders for `running` teams after a session reset; surface failures as both a team signal and a UI notification.
|
|
21
|
+
- `createTeam` now defaults `repoRoots` to `[process.cwd()]` when the caller passes an empty array.
|
|
22
|
+
- Archive `process.json` into `history/` before a new task reuses the same role slot, so the prior task's final state is no longer silently clobbered.
|
|
23
|
+
|
|
24
|
+
### Enhanced: team-mode
|
|
25
|
+
|
|
26
|
+
- Durable intent queue for subprocess handoff: `team_spawn_teammate` calls made from a teammate subprocess are written to disk and executed by the main session's `LeaderRuntime` instead of spawning orphaned grand-children.
|
|
27
|
+
- New tool `team_task_create_batch` lets the leader emit the full initial task DAG in one call, removing per-task LLM round-trips during bootstrap.
|
|
28
|
+
- `team_create` / `launchLeader` accept an `awaitBootstrap` option so the user sees the task graph before the tool returns; leader launch retries up to 3 times on transient failures.
|
|
29
|
+
- Persist per-turn debug artifacts (prompt, invocation, stderr, raw event stream) for both leader and teammate subprocesses, exposed via `TeammateSummary.debugArtifacts`.
|
|
30
|
+
- Track `exitCode`, `exitSignal`, `terminationReason`, `stderrTail`, `toolExecutions`, `model` and `modelProvider` on every `TeammateProcess` record.
|
|
31
|
+
- Provider detection now consults pi's `settings.json` and `auth.json` in addition to env vars; default model IDs aligned with the provider/model scheme.
|
|
32
|
+
- `collectPiOutput` supports `AbortSignal` cancellation.
|
|
33
|
+
|
|
34
|
+
### Tests
|
|
35
|
+
|
|
36
|
+
- New `intent-queue` and `model-config` suites; expanded coverage across `leader-runtime`, `team-manager`, `team-query-tool` and `formatters`.
|
|
37
|
+
|
|
38
|
+
|
|
39
|
+
## 1.7.0
|
|
40
|
+
|
|
41
|
+
### Minor Changes
|
|
42
|
+
|
|
43
|
+
### Enhanced: status-line
|
|
44
|
+
|
|
45
|
+
- Improved progress rendering and colors in expert mode
|
|
46
|
+
|
|
47
|
+
### Enhanced: team-mode
|
|
48
|
+
|
|
49
|
+
- **LLM-driven leader** — replaced the hardcoded `research → synthesis → implementation → verification` state machine with a pi subprocess coordinator that authors the task graph via tool calls
|
|
50
|
+
- **New tool `team_task_create`** so the leader can author tasks at runtime
|
|
51
|
+
- **New tool `team_handoff`** for explicit teammate → teammate context handoffs (replaces regex-scraping of `Handoffs:` output sections)
|
|
52
|
+
- **File-based teammate specs** — drop `.claude/teammates/<role>.md` frontmatter files (`name`, `description`, `needsWorktree`, `hasMemory`, `modelTier`) to extend or override the seven built-in roles
|
|
53
|
+
- **Event-driven leader wakes** — mailbox messages addressed to the leader (or broadcast) trigger a debounced (~200ms) cycle instead of waiting for the 20s polling tick
|
|
54
|
+
- **Templates accept any string** — `fullstack` / `research` / `refactor` remain as built-ins, but unknown template keys are accepted and no-op gracefully
|
|
55
|
+
- **Provider config per team** — per-team model overrides via `/team models`
|
|
56
|
+
- Reduced leader overhead and parent-session token churn
|
|
57
|
+
- `spawnTeammate` now always appends the full runtime-built context (signals, mailbox, dependencies, team memory) so teammates get the richer snapshot even when the caller's `context` argument is brief
|
|
58
|
+
|
|
59
|
+
### Breaking changes: team-mode
|
|
60
|
+
|
|
61
|
+
- Removed `LeaderPhase` enum and `currentPhase` field from `TeamRecord` / `TeamSummary`
|
|
62
|
+
- Removed `parseExplicitHandoffs` export and the legacy `Handoffs:` output parser — peer handoffs must go through the `team_handoff` tool
|
|
63
|
+
- Removed the deterministic auto-spawn loop (`ensureBootstrapTasks`) — all task authoring and teammate spawning is now the LLM leader's responsibility
|
|
64
|
+
- Removed `StringEnum` gate on `team_create`'s `template` parameter (now plain string)
|
|
65
|
+
|
|
66
|
+
### Fixed: review
|
|
67
|
+
|
|
68
|
+
- Annotate diff lines so the model picks correct line numbers
|
|
69
|
+
- Fix slice chunk around lines for comments in the reviewer TUI
|
|
70
|
+
|
|
71
|
+
### Documentation
|
|
72
|
+
|
|
73
|
+
- Updated root README and sentinel extension README
|
|
74
|
+
- Documented the new file-based teammate spec format and event-driven leader wake in the team-mode README
|
|
75
|
+
|
|
3
76
|
## 1.6.0
|
|
4
77
|
|
|
5
78
|
### Minor Changes
|
package/README.md
ADDED
|
@@ -0,0 +1,48 @@
|
|
|
1
|
+
# sentinel
|
|
2
|
+
|
|
3
|
+
The `sentinel` extension adds content-aware security guards that intercept tool calls before they execute.
|
|
4
|
+
|
|
5
|
+
It addresses two cross-cutting security gaps that pure command-based guardrails miss:
|
|
6
|
+
|
|
7
|
+
- **Content-in-location** — a file the agent is about to read contains secrets
|
|
8
|
+
- **Indirect execution** — a file the agent wrote earlier in the session is later executed via `bash`
|
|
9
|
+
|
|
10
|
+
## Guards
|
|
11
|
+
|
|
12
|
+
### 1. output-scanner — secret detection on read
|
|
13
|
+
|
|
14
|
+
Pre-reads files before `read` tool calls execute and scans for credential patterns. If secrets are found, the user is asked before the read is allowed. The same guard also intercepts `bash` commands that read file content (`cat`, `head`, `tail`, `less`, `more`) and pre-scans their targets.
|
|
15
|
+
|
|
16
|
+
Detected patterns include:
|
|
17
|
+
|
|
18
|
+
- AWS access and secret keys
|
|
19
|
+
- GitHub personal access and OAuth tokens
|
|
20
|
+
- Anthropic, OpenAI, Slack, Stripe, Google OAuth keys
|
|
21
|
+
- PEM private keys
|
|
22
|
+
- Generic `secret/password/token/api_key = "..."` assignments
|
|
23
|
+
- High-entropy strings above a Shannon-entropy threshold
|
|
24
|
+
|
|
25
|
+
Scan results are cached per file by `mtime` and invalidated via `context-guard:file-modified` events.
|
|
26
|
+
|
|
27
|
+
### 2. execution-tracker — write/execute correlation
|
|
28
|
+
|
|
29
|
+
Two hooks working together:
|
|
30
|
+
|
|
31
|
+
- **Write-time tracking** — every `write` and `edit` tool call is recorded in a session write registry. The new content is scanned for dangerous patterns but the write is never blocked.
|
|
32
|
+
- **Execution-time correlation** — when `bash` runs a script, the path is extracted and checked against the registry. If the script was written in this session and contains dangerous patterns, execution is escalated to the user (or blocked when there is no UI).
|
|
33
|
+
|
|
34
|
+
Flagged patterns include `curl | bash`, `wget | bash`, `eval` against untrusted input, `curl -X POST` exfiltration, `rm -rf`, `chmod 777`, `sudo`, and persistence hooks (`crontab`, `systemctl enable`, `launchctl`).
|
|
35
|
+
|
|
36
|
+
If the target file was modified after the tracked write, it is re-read and re-scanned before the decision — avoiding false positives when the agent rewrote the dangerous content out.
|
|
37
|
+
|
|
38
|
+
## Behavior
|
|
39
|
+
|
|
40
|
+
- **No UI available** — both guards fail safe by blocking with a clear `reason`.
|
|
41
|
+
- **UI available** — the user sees a `confirm()` dialog with the matched labels, line numbers, and snippets, and can allow or deny.
|
|
42
|
+
- Session state (scan cache, write registry) is cleared on `session_start`.
|
|
43
|
+
|
|
44
|
+
## Install
|
|
45
|
+
|
|
46
|
+
```bash
|
|
47
|
+
pi install npm:pi-mono-sentinel
|
|
48
|
+
```
|