[3/6] Add protection to the Pi harness plugin

.github/workflows/ci.yml

@@ -62,6 +62,15 @@ jobs:
         with:
           persist-credentials: false
       - uses: ./.github/actions/setup
+      - name: Install pinned Pi test dependencies
+        run: |
+          source bin/activate-hermit
+          cd src/bundled/pi/deps
+          npm ci --ignore-scripts --no-audit --no-fund
+      - name: Real Pi tools and recovery
+        env:
+          PI_DEPS: ${{ github.workspace }}/src/bundled/pi/deps
+        run: ./bin/node scripts/ci-test-report.mjs kind=vitest report=test-results/protection/vitest.json evidence=test-results/protection/timing.json title="Protected Pi" -- ./bin/pnpm exec vitest run src/bundled/pi/protection.live.test.ts --reporter=default --reporter=json --outputFile=test-results/protection/vitest.json
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           key: agent-protection

src/bundled/pi/host.live.test.ts

@@ -110,6 +110,11 @@ try { out.cleanupFailure = await pi.rpc("wait", { agent, submission: b.submissio
 finally { openedHarness.commit = commit; }
 // What a transcript and usage read: the places, and the entries without schemas.
 out.places = (await pi.rpc("places", { agent })).places;
+// Another membership of the same identity has its own durable storage.
+const secondary = agent + "@secondary.example%3A7447";
+await pi.rpc("open", { agent: secondary, tools });
+out.secondaryPlaces = (await pi.rpc("places", { agent: secondary })).places;
+await pi.rpc("close", { agent: secondary });
 out.recorded = Object.keys((await pi.rpc("recorded", { agent, conversation: a.conversation })).models);
 out.entries = (await pi.rpc("entries", { agent, conversation: a.conversation })).entries.map((entry) => [entry.kind, ...(entry.model ?? []).map((message) => message.role + (message.usage ? "+usage" : ""))]);
 // A policy enabled after the process started blocks the same live tool path.
@@ -562,6 +567,14 @@ describe.skipIf(!DEPS)("the Pi host on Pi durable", () => {
       text: "Plain answer",
     });
     expect(out.recorded).toEqual(["faux/faux-1"]);
+    expect(out.secondaryPlaces).toEqual([]);
+    expect(
+      (
+        await stat(
+          join(agents, `${"b".repeat(64)}@secondary.example%3A7447.sqlite`),
+        )
+      ).isFile(),
+    ).toBe(true);
     expect(out.places).toEqual([
       { key: "chan/root", conversation: out.a.conversation, seen: 100 },
     ]);