General Audit and Improvements

mehalter commented

2026-07-15 18:17:22 -04:00

Owner

This PR applies the findings from a full audit of the Pi harness configuration and brings the repository in line with Pi 0.80.7. The changes focus on security boundaries, extension correctness, reproducible tooling, and regression coverage.

Security and trust boundaries

Hardened the read-only advisor agents so their tool deny-lists cover direct writes, patching, batched mutation, parallel escalation, and other indirect write paths. This makes the documented "only Fixer writes" boundary enforceable rather than advisory.
Pinned Chrome DevTools MCP execution to the reviewed chrome-devtools-mcp@1.6.0 package and configured it to run offline from Pi-managed dependencies. This removes floating npx @latest execution from startup.
Added ignores for MCP OAuth/onboarding state, session data, caches, and both Pi package backends (npm/ and git/) so credentials and generated machine state cannot be committed accidentally.
Added a self-contained MCP cache bootstrap extension. It creates a private valid empty cache on first startup, preserving pi-mcp-adapter's intended lazy connection behavior without modifying the upstream package.

Rate-limit coordination

Reworked smart-rate-limit persistence so parent sessions, subagents, and sibling processes coordinate through serialized, fail-closed file updates instead of racing on shared JSON state.
Added conservative signal precision and merge behavior for exact, relative, and fallback reset times.
Attributed child rate limits to the child model reported by failed structured results instead of the parent's active model.
Preserved newer windows when an older wait finishes and retained active windows when a wait is cancelled.
Added coverage for concurrent writers, live-lock contention, cancellation, stale ownership, mixed models, false positives, and repeated reset windows.

Goal loop reliability

Kept goal_verdict inactive while no goal is running and removed only that tool when the loop ends, avoiding accidental changes to unrelated tools.
Cleaned up event listeners during shutdown and reload so repeated reloads do not duplicate goal handling.
Strictly validated attempt limits and versioned persisted state while preserving task text exactly.
Bounded missing-verdict reminders, safely paused interrupted or unresolved loops, and added explicit resume and clear operations.
Expanded reducer and adapter coverage for retries, exhaustion, no-progress detection, malformed state, reloads, and external goal:request integration.

Pantheon and Plannotator safety

Hardened plan review file handling with canonical containment checks, Markdown-only inputs, regular-file and size validation, symlink/device/FIFO rejection, and descriptor-based race protection.
Registered review listeners before opening a request, captured early decisions, recovered persisted decisions by review ID, and reported abort/timeout states without pretending an external browser review was cancelled.
Made descriptor handling portable when /dev/fd does not resolve to the underlying file path.
Added focused tests for traversal, symlink swaps, FIFO blocking, file growth races, early responses, timeout recovery, cancellation, and reload cleanup.

Extension behavior and UI fixes

Recomputed cache statistics from the active session branch on startup, reload, tree navigation, and compaction so abandoned branches cannot leak into totals.
Restricted statusline widget creation to interactive TUI mode and cleanly disposed/reloaded shared registry listeners. RPC, JSON, and print modes no longer receive terminal widget output.
Hardened the copy-code picker around filtered-preview caching, mode-specific copy/edit wording, key hints, narrow terminal layouts, and overflow visibility. Clipboard writes are restricted to TUI mode, native clipboard helpers have timeouts, and external edits use private temporary files with cancellation-safe cleanup.
Simplified statusline bridge calls to match their guaranteed non-optional contract.

Skill and helper hardening

Graphify: replaced shell interpolation with structured argument handling, pinned and validated the Graphify runtime, aligned watcher/update markers, preserved interpreter selection, kept credentials in the environment, and added injection/path/URL/shrink-guard tests.
Mealie: made organizer and ingredient resolution fail closed, encoded and validated URL path segments, prevented implicit metadata deletion, kept tokens out of process arguments, and added mock-server tests for safe mutations and destructive operations.
GitHub helper: fixed fork pull-request comment lookup to query the base repository and added upstream license/source provenance.
Jupyter Notebook: added Git worktree .git file support and regression coverage.
Gog: corrected stale command examples and added a non-mutating documentation validator for command/flag drift.
Parse Recipe: added a schema-backed success/failure output contract, fixtures, and validation tests.
Slides: fixed temporary image lifecycle issues, validated conversion metadata, cleaned stale outputs, pinned helper dependencies, and documented upstream source and license provenance.

Reproducible repository tooling

Moved repository-owned test, typecheck, lint, and integrity tooling to the root package.json and lockfile.
Pinned Node, npm, Bun, TypeScript, Biome, Pi development packages, and supporting types to reviewed versions compatible with Pi 0.80.7.
Added scripts/check-tooling.mjs to verify runtime versions, exact Pi package sources, Chrome MCP configuration, lockfile integrity coverage, and the absence of tracked files under Pi-managed npm/ or git/ backends.
Removed the tracked Pi-generated npm workspace and redundant extension package manifests. Custom extensions rely on Pi's documented extensions/*/index.ts auto-discovery.
Updated setup and walkthrough documentation to distinguish repository-owned development tooling from Pi-managed runtime packages.

Validation

Fresh npm ci --ignore-scripts
211 Bun tests
47 Python tests with 3 environment-dependent skips
TypeScript typecheck and Biome lint
npm audit with zero vulnerabilities
234 verified registry signatures and 44 attestations
Pi 0.80.7 RPC/startup, package installation, automatic extension discovery, and offline Chrome MCP execution checks
LSP/lens diagnostics, tracked-state checks, and final Oracle review

This PR applies the findings from a full audit of the Pi harness configuration and brings the repository in line with Pi 0.80.7. The changes focus on security boundaries, extension correctness, reproducible tooling, and regression coverage. **Security and trust boundaries** - Hardened the read-only advisor agents so their tool deny-lists cover direct writes, patching, batched mutation, parallel escalation, and other indirect write paths. This makes the documented "only Fixer writes" boundary enforceable rather than advisory. - Pinned Chrome DevTools MCP execution to the reviewed `chrome-devtools-mcp@1.6.0` package and configured it to run offline from Pi-managed dependencies. This removes floating `npx @latest` execution from startup. - Added ignores for MCP OAuth/onboarding state, session data, caches, and both Pi package backends (`npm/` and `git/`) so credentials and generated machine state cannot be committed accidentally. - Added a self-contained MCP cache bootstrap extension. It creates a private valid empty cache on first startup, preserving `pi-mcp-adapter`'s intended lazy connection behavior without modifying the upstream package. **Rate-limit coordination** - Reworked `smart-rate-limit` persistence so parent sessions, subagents, and sibling processes coordinate through serialized, fail-closed file updates instead of racing on shared JSON state. - Added conservative signal precision and merge behavior for exact, relative, and fallback reset times. - Attributed child rate limits to the child model reported by failed structured results instead of the parent's active model. - Preserved newer windows when an older wait finishes and retained active windows when a wait is cancelled. - Added coverage for concurrent writers, live-lock contention, cancellation, stale ownership, mixed models, false positives, and repeated reset windows. **Goal loop reliability** - Kept `goal_verdict` inactive while no goal is running and removed only that tool when the loop ends, avoiding accidental changes to unrelated tools. - Cleaned up event listeners during shutdown and reload so repeated reloads do not duplicate goal handling. - Strictly validated attempt limits and versioned persisted state while preserving task text exactly. - Bounded missing-verdict reminders, safely paused interrupted or unresolved loops, and added explicit resume and clear operations. - Expanded reducer and adapter coverage for retries, exhaustion, no-progress detection, malformed state, reloads, and external `goal:request` integration. **Pantheon and Plannotator safety** - Hardened plan review file handling with canonical containment checks, Markdown-only inputs, regular-file and size validation, symlink/device/FIFO rejection, and descriptor-based race protection. - Registered review listeners before opening a request, captured early decisions, recovered persisted decisions by review ID, and reported abort/timeout states without pretending an external browser review was cancelled. - Made descriptor handling portable when `/dev/fd` does not resolve to the underlying file path. - Added focused tests for traversal, symlink swaps, FIFO blocking, file growth races, early responses, timeout recovery, cancellation, and reload cleanup. **Extension behavior and UI fixes** - Recomputed cache statistics from the active session branch on startup, reload, tree navigation, and compaction so abandoned branches cannot leak into totals. - Restricted statusline widget creation to interactive TUI mode and cleanly disposed/reloaded shared registry listeners. RPC, JSON, and print modes no longer receive terminal widget output. - Hardened the copy-code picker around filtered-preview caching, mode-specific copy/edit wording, key hints, narrow terminal layouts, and overflow visibility. Clipboard writes are restricted to TUI mode, native clipboard helpers have timeouts, and external edits use private temporary files with cancellation-safe cleanup. - Simplified statusline bridge calls to match their guaranteed non-optional contract. **Skill and helper hardening** - Graphify: replaced shell interpolation with structured argument handling, pinned and validated the Graphify runtime, aligned watcher/update markers, preserved interpreter selection, kept credentials in the environment, and added injection/path/URL/shrink-guard tests. - Mealie: made organizer and ingredient resolution fail closed, encoded and validated URL path segments, prevented implicit metadata deletion, kept tokens out of process arguments, and added mock-server tests for safe mutations and destructive operations. - GitHub helper: fixed fork pull-request comment lookup to query the base repository and added upstream license/source provenance. - Jupyter Notebook: added Git worktree `.git` file support and regression coverage. - Gog: corrected stale command examples and added a non-mutating documentation validator for command/flag drift. - Parse Recipe: added a schema-backed success/failure output contract, fixtures, and validation tests. - Slides: fixed temporary image lifecycle issues, validated conversion metadata, cleaned stale outputs, pinned helper dependencies, and documented upstream source and license provenance. **Reproducible repository tooling** - Moved repository-owned test, typecheck, lint, and integrity tooling to the root `package.json` and lockfile. - Pinned Node, npm, Bun, TypeScript, Biome, Pi development packages, and supporting types to reviewed versions compatible with Pi 0.80.7. - Added `scripts/check-tooling.mjs` to verify runtime versions, exact Pi package sources, Chrome MCP configuration, lockfile integrity coverage, and the absence of tracked files under Pi-managed `npm/` or `git/` backends. - Removed the tracked Pi-generated npm workspace and redundant extension package manifests. Custom extensions rely on Pi's documented `extensions/*/index.ts` auto-discovery. - Updated setup and walkthrough documentation to distinguish repository-owned development tooling from Pi-managed runtime packages. **Validation** - Fresh `npm ci --ignore-scripts` - 211 Bun tests - 47 Python tests with 3 environment-dependent skips - TypeScript typecheck and Biome lint - `npm audit` with zero vulnerabilities - 234 verified registry signatures and 44 attestations - Pi 0.80.7 RPC/startup, package installation, automatic extension discovery, and offline Chrome MCP execution checks - LSP/lens diagnostics, tracked-state checks, and final Oracle review

mehalter added 12 commits

2026-07-15 18:17:22 -04:00