From 09ce100c929868e558a444b95f86baf310959704 Mon Sep 17 00:00:00 2001 From: Joakim Persson Date: Mon, 12 Oct 2026 16:28:28 +0200 Subject: [PATCH] changelog(unreleased): secret-guard (pi-extensions a88fa99) and pi-task model fallback (pi-toolkit 3760d90) Both arrive with the next build without a pin change, because CI resolves pi-extensions and pi-toolkit main at build time. The components table now names them: pi-extensions 143a214 -> a88fa99, and a new pi-toolkit row 9c87ee8 -> 3760d90. Both ids were checked against ls-remote, and the baked values against /etc/pi-devbox/build-manifest.json on a v1.10.2 device. --- CHANGELOG.md | 40 +++++++++++++++++++++++++++++++++++++++- 1 file changed, 39 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1c15aab..248219d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -17,7 +17,8 @@ Pre-v1.0.0 tags followed the pi npm version (`v{pi_version}[letter]`). | Component | Baked in v1.10.2 | Next build | Why | |---|---|---|---| -| pi-extensions | `143a214` | **`f885199`** (or later: CI resolves `main` at build time) | new `aws-sso.ts` extension: keeps the Bedrock SSO session alive (below) | +| pi-extensions | `143a214` | **`a88fa99`** (or later: CI resolves `main` at build time) | new `aws-sso.ts` (keeps the Bedrock SSO session alive) and `secret-guard.ts` (keeps secret env values out of model context); both below | +| pi-toolkit | `9c87ee8` | **`3760d90`** (or later: CI resolves `main` at build time) | `pi-task`: optional model fallback when the primary model fails auth before acting (below) | | pi-studio | `v0.9.61` (`641aa32`) | **`v0.9.63`** (`fae3ad3`) | upstream releases (v0.9.62, v0.9.63), picked up by CI's newest-tag resolution; `-studio` variant only; **not reviewed yet**: [compare](https://github.com/omaclaren/pi-studio/compare/641aa3288a6bfd4a7eb37a3a4847836de85e0593...fae3ad38d23c9666981bfc29f9a4e06d56f8de84) | ### Added @@ -51,6 +52,43 @@ Pre-v1.0.0 tags followed the pi npm version (`v{pi_version}[letter]`). so removing the mount later is harmless (measured with pi 1.0.0). README: "Custom model providers (`models.json`)". +- **secret-guard (pi-extensions `secret-guard.ts`): secret env values never reach + the model, the session file or the palace feed.** It replaces the exact value + of every env var whose name says secret (`…TOKEN`, `…API_KEY`, `…PASSWORD`, …) + with ``, the same rule and placeholder as mempalace-toolkit's + feed redactor. It applies to every tool result (MCP tools included), to the + context of each request (covering user `!` commands and older sessions), and it + blocks a `write`/`edit` that would write such a placeholder back over the real + value. `$NAME` still expands in commands; only the output coming back is + rewritten. + + Measured motivation, 2026-10-12: an agent's own `sed` failed to redact + `MEMPALACE_REMOTE_TOKEN=…` from `env | grep` output. The raw value had been in + local session files for two months, so each of those sessions had sent it to + its model provider. The palace stayed clean only because the feed redactor + works. + + Not covered: + - live streaming output while a tool runs; + - the stored entry of a user `!` command; + - secrets not in the environment; + - `pi-task` children, which run `--no-extensions`. + + `PI_SECRET_GUARD=off` disables it. + +- **`pi-task` model fallback (pi-toolkit `bin/pi-task`).** A + `pi-task.fallbackProfiles` block in `settings.json` (per effort tier: + provider/id/thinking) lets a task retry once on another model. The retry + happens only when the primary fails with an auth-class error (an expired SSO + token, an invalid key) **before** it has called a tool or changed a watched + file, and with at least 30 s of wall budget left. Both attempts are recorded in + `result.json` and the audit dir, and the result line is tagged `[FALLBACK]`. + Without the block, behaviour is unchanged. It was needed because pi reports + such a failure only inside its JSON stream: `stopReason=error`, rc 0. Before + this, an expired Bedrock session failed every task as "no fenced json + envelope". The `fork` tool does not read this key. Documented in pi-toolkit's + README. + - **Long Bedrock runs no longer die at "Token is expired" when the AWS SSO session ends: `/aws-sso` (pi-extensions `aws-sso.ts`) runs `aws sso login` for you just after the session ends.** Off until `/aws-sso on` (or