@rosetears/aili-pi 0.1.6 → 0.1.7

package/README.md

@@ -62,18 +62,18 @@ Zentui enables its experimental fixed-bottom editor by default when the installe
 - `/ideate`, `/define`, `/build`, `/ship`: the four AILI delivery modes.
 - `/local-review`: a standalone local audit, not a fifth lifecycle mode.
 - `/aili-doctor` or `/aili-doctor --json`: human or machine-readable health evidence.
-- `/perm`: upstream `pi-permission-modes` control for `Default`, `Plan`, `Build`, and `YOLO`.
+- `/perm`: the revision-bound `pi-permission-modes@2.2.0` adaptation controls `Default`, `Plan`, `Build`, and `YOLO`.
 - `Alt+M`: upstream mode-cycle shortcut.
 - `/aili-install-global-resources`: explicit installation/update of marker-owned global ROSE and AILI-role resources.
 
-`pi-permission-modes` owns mode persistence, prompts, and sandbox behavior. A Linux disposable fixture verified its stock Build profile through installed Bubblewrap, while an incompatible Git-worktree fixture visibly fell back to confirmation. This is not an isolation guarantee. `YOLO` is an upstream unrestricted mode and must be treated accordingly.
+The `pi-permission-modes@2.2.0` baseline owns mode persistence, prompts, and sandbox behavior. AILI carries one hash-locked matcher adaptation so `*` and `?` also match line terminators; this prevents multiline Bash/heredoc text from falling through YOLO's `"*": "allow"` rule while retaining custom ask/deny and fail-closed fallback behavior across every pattern-map surface. A Linux disposable fixture verified the stock Build profile through installed Bubblewrap, while an incompatible Git-worktree fixture visibly fell back to confirmation. This is not an isolation guarantee. `YOLO` remains an unrestricted, unsandboxed mode and must be treated accordingly.
 
 ## Native integrations and side effects
 
 - `pi-web-access@0.13.0` provides its complete upstream web-search, content-fetch, curator, clone/PDF/video, and bundled-skill surface. Its provider fallback, network traffic, config/credential paths, clone cache, temporary curator service, downloads, and optional browser-cookie access are upstream behavior; inspect its tool requests and configuration before use.
 - `pi-quota-status@0.3.0` is enabled by default. It may maintain `~/.pi/agent/pi-quota-status/state.json`; `/quota config` creates its configuration template. Zentui displays exactly one weekly value as `codex <percent> <reset>`, preferring explicit `Wk` data and treating the dependency's current `5h`-labeled primary value only as a compatibility fallback when weekly is absent.
-- `pi-permission-modes@2.2.0` provides the permission UI and sandbox degradation behavior above. AILI does not retain `/aili-mode` or `Ctrl+Shift+Alt+A` as competing controls.
-- `@agwab/pi-subagent@0.4.8` owns the generic `subagent` tool, child spawn, cancellation, durable run/artifact lifecycle, bounded parallel fan-out, async actions, worktrees, external `cwd`, and sandbox options. The 19 `aili.<role>` profiles are optional named agents; generic or agentless runs do not use an AILI-only result schema. AILI adds a bounded requested `Agent:`/`Agents:` heading above upstream run-call rendering and injects an immutable credential-path guard; child Pi processes load the ambient AILI `pi-permission-modes` registration exactly once. The upstream runner excludes recursive `subagent` exposure inside workers.
+- `pi-permission-modes@2.2.0` provides the permission UI and sandbox degradation behavior above through AILI's exact-source adaptation. The only semantic source change is line-terminator-safe shared glob matching; `upstream/pi-permission-modes.lock.json` records the baseline and adapted hashes. AILI does not retain `/aili-mode` or `Ctrl+Shift+Alt+A` as competing controls.
+- `@agwab/pi-subagent@0.4.8` owns the generic `subagent` tool, child spawn, cancellation, durable run/artifact lifecycle, bounded parallel fan-out, async actions, worktrees, external `cwd`, and sandbox options. On Pi 0.81.1, AILI routes ordinary omitted/`auto` calls to `headless` because the pinned inline runner calls removed SDK factories; explicit `inline` stops before model startup with a compatibility diagnostic. Explicit `headless`/`tmux`, visible auto, sandbox auto, lifecycle actions, and caller options remain upstream paths. A mixed parallel auto call that combines visible tasks with ordinary uncontained tasks is rejected rather than silently sending one class through broken inline. The 19 `aili.<role>` profiles are optional named agents; generic or agentless runs do not use an AILI-only result schema. AILI also adds a bounded requested `Agent:`/`Agents:` heading and an immutable credential-path guard. The upstream runner excludes recursive `subagent` exposure inside workers.
 - `pi-cache-optimizer@2.6.18` provides `/cache-optimizer`, provider cache diagnostics, cache statistics, and prompt-cache optimization. It may maintain `~/.pi/agent/pi-cache-optimizer-stats.json`; `/cache-optimizer fix` is interactive and is the only command that may propose editing `models.json`.
 - `pi-markdown-preview@0.10.1` provides `/preview`, `/preview-browser`, `/preview-pdf`, `/preview-clear-cache`, and the `preview_export` tool. Terminal/browser previews require a Chromium executable; PDF export additionally requires Pandoc and a LaTeX engine.
 - `@narumitw/pi-lsp@0.25.0` provides language-agnostic `lsp_diagnostics`, `lsp_fix`, and `/lsp`. It supports routes for C/C++, Python, CSS/SCSS, JavaScript/TypeScript, Go, Rust, Java, Kotlin, Bash, YAML, Terraform, and other languages. It does not download language servers; install the required commands separately and configure project routes in `.pi/pi-lsp.json` or user routes in `~/.pi/agent/pi-lsp.json`.
@@ -93,7 +93,7 @@ When unavailable, runtime and doctor output use explicit `SKIP`/`WARN` results a
 
 ## Security boundary
 
-AILI injects a non-removable guard that denies standard Pi file-tool and parsed-bash access to credential, authentication, and private-key paths, including from an external `cwd`, a YOLO permission mode, or a caller-supplied child extension list. Child Pi processes load the ambient AILI `pi-permission-modes` registration exactly once, so vendor permission prompts and sandbox behavior remain active; headless confirmation requests fail closed. The guard does not make arbitrary third-party extension code safe: extensions remain trusted code and may have direct process authority. Neither AILI nor Pi provides a universal OS sandbox or containment: trusted extensions, user-authority processes, ambient network access, and filesystem races remain in the user trust domain. Inspect exact approval targets and do not put credentials in task text.
+AILI injects a non-removable guard that denies standard Pi file-tool and parsed-bash access to credential, authentication, and private-key paths, including from an external `cwd`, a YOLO permission mode, or a caller-supplied child extension list. Child Pi processes load the ambient AILI permission-mode registration exactly once, so adapted permission prompts and sandbox behavior remain active; headless confirmation requests fail closed. The guard does not make arbitrary third-party extension code safe: extensions remain trusted code and may have direct process authority. Neither AILI nor Pi provides a universal OS sandbox or containment: trusted extensions, user-authority processes, ambient network access, and filesystem races remain in the user trust domain. Inspect exact approval targets and do not put credentials in task text.
 
 Use `subagent` lifecycle actions (`status`, `logs`, `wait`, `interrupt`, `mark-background`, and `reconcile`) to inspect durable async work. Upstream fan-out is version-bounded rather than capped by AILI at two; background completion is not evidence until inspected. Subagents are a benefit-based way to improve execution efficiency and preserve the main agent's context: the main agent owns decisions, scope, integration, and final verification, while bounded discovery, implementation, testing, or other execution may be delegated when specialist, parallelism, or context-isolation benefits outweigh orchestration cost. Direct parent work remains valid when delegation has no clear net benefit; no subagent call is required to unlock file mutation. Provider/model behavior still depends on the configured Pi environment.
 
@@ -101,6 +101,7 @@ Use `subagent` lifecycle actions (`status`, `logs`, `wait`, `interrupt`, `mark-b
 
 - `upstream/aili-workflows.lock.json` pins the exact canonical 64-skill/471-file snapshot.
 - `upstream/opencode-global-agents.lock.json` pins the global AGENTS source revision/hash and documents its Pi-native derivation.
+- `upstream/pi-permission-modes.lock.json` pins the exact upstream and adapted permission runtime files and semantic diff.
 - `manifests/skill-compatibility.json` records one compatibility state per skill.
 - `manifests/roles.json` records the 19 generated Pi role profiles.
 - `manifests/provenance.json`, `manifests/sbom.json`, and `THIRD_PARTY_NOTICES.md` record adapted/reference sources and the exact npm lock inventory.
@@ -119,6 +120,9 @@ npm run validate:release
 - **Package install failure:** keep the reported Pi/AILI states distinct. Retry the printed `pi install` command after fixing the cause; do not automatically remove a pre-existing package.
 - **Doctor is non-pass:** inspect the exact `ERROR`, `WARN`, `SKIP`, or `UNVERIFIED` component. Missing optional packs are not core execution success.
 - **Permission shortcut does nothing:** use `/perm`; terminal multiplexers may consume `Alt+M`.
+- **YOLO still asks for multiline Bash:** confirm the loaded Package contains the adapted permission runtime with `npm run verify:permission-modes`; do not work around it by granting every distinct script for the session.
+- **Subagent reports the inline SDK `reading 'create'` failure:** omit `backend` or use `backend: "headless"`; explicit inline is unsupported for the pinned Pi 0.81.1 / subagent 0.4.8 pair.
+- **Sandboxed subagent cannot authenticate or reach its model:** `sandbox:true` is deny-all network, and model-backed sandbox calls must allow the exact provider endpoint while preserving credential protections. This is separate from default-backend compatibility.
 - **Global resources are non-pass:** run `/aili-install-global-resources` only after reviewing the exact `~/.pi/agent/` targets. A malformed marker or an unowned role collision intentionally leaves files unchanged.
 - **Offline use:** the installed Package embeds the pinned skills and does not fetch `aili-workflows` at runtime. Its Pi-managed npm lifecycle synchronizes only pre-existing same-name global skills from that embedded fixed snapshot. First-time Pi/package installation still requires the relevant package sources.
 

package/THIRD_PARTY_NOTICES.md

@@ -22,18 +22,18 @@ This distribution is MIT-licensed. The following adapted sources and locked deve
 - License: MIT
 - Source files: src/index.ts, src/api.ts, src/runners/headless-model.ts, src/artifacts/result.ts
 - Reused symbols/patterns: subagent tool renderCall, runSubagent API, headless lifecycle, artifact envelope
-- Local changes: AILI registers the full pinned upstream subagent tool schema, prepends a sanitized bounded requested-Agent heading to upstream run-call rendering, injects a non-removable credential guard, and relies on the ambient AILI pi-permission-modes registration exactly once in each child; no upstream source is copied
+- Local changes: AILI registers the full pinned upstream subagent tool schema, prepends a sanitized bounded requested-Agent heading, injects a non-removable credential guard, normalizes ordinary omitted/auto runs to headless for the Pi 0.81.1 compatibility window, and rejects explicit inline before model startup; no upstream source is copied
 
 ## pi-permission-modes
 
-- Status: dependency
+- Status: adapted
 - Source: https://github.com/wynainfo/pi-permission-modes.git
 - Revision: 23d65d10a53b67043cae42322acf9044d6edb196
 - Version: 2.2.0
 - License: MIT
-- Source files: src/index.ts, permission-mode.defaults.json
-- Reused symbols/patterns: Default/Plan/Build/YOLO, /perm, Alt+M, sandbox degradation
-- Local changes: AILI initializes the pinned upstream extension and does not retain a competing AILI mode command or shortcut
+- Source files: src/vendor/pi-permission-modes/index.ts, src/vendor/pi-permission-modes/resolve.ts, upstream/pi-permission-modes.lock.json, licenses/pi-permission-modes-MIT.txt
+- Reused symbols/patterns: Default/Plan/Build/YOLO, /perm, Alt+M, shared permission pattern matcher, sandbox degradation
+- Local changes: AILI's generated adapted entry redirects unchanged sibling modules to the exact 2.2.0 dependency; the owned resolve.ts compiles permission globs with RegExp dotAll so * and ? include ECMAScript line terminators; the exact upstream and adapted files are hash-locked and drift-checked
 
 ## pi-quota-status
 
@@ -105,4 +105,4 @@ This distribution is MIT-licensed. The following adapted sources and locked deve
 
 The exact 424-entry package-lock inventory, versions, integrity values, dependency scope, and declared licenses is recorded in `manifests/sbom.json`.
 
-Runtime dependencies are initialized through the single AILI Extension entry; no third-party source tree is copied into this package.
+Runtime dependencies are initialized through the single AILI Extension entry. Package-owned third-party adaptations are copied only where their provenance sourceFiles explicitly name repository paths.

package/licenses/pi-permission-modes-MIT.txt

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Nico Merz
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/manifests/adapter-evidence.json

@@ -11,7 +11,7 @@
         "vitest run tests/unit/runtime.test.ts"
       ],
       "artifacts": [
-        { "path": "package-lock.json", "sha256": "b1356fd5c37f5e69387fb7d4acaeb3777c8d117f3906e51def4d5f8918b7391e" },
+        { "path": "package-lock.json", "sha256": "a9e5a3e4d1076b3179dd8cca5ef89f9fddc838e0acf9abcc1f42daf2a90ddafb" },
         { "path": "tests/integration/extension-load.test.ts", "sha256": "f2fdceb965f55bc481acc6457eee5cac9499dac08e8c3d17ca60efd07f13e96c" },
         { "path": "tests/unit/runtime.test.ts", "sha256": "9e99920e7e16529f109771d659f611c9fa580941a5dbf924b2d9d117dd3adeee" }
       ]
@@ -24,21 +24,22 @@
       "verification": [
         "npm run verify:roles",
         "vitest run tests/unit/roles.test.ts tests/unit/subagents.test.ts",
-        "vitest run tests/integration/generic-permission.test.ts",
-        "AILI_LIVE_SUBAGENT_PROBE=static npx vitest run tests/integration/live-subagent.test.ts",
-        "AILI_LIVE_SUBAGENT_PROBE=1 npx vitest run tests/integration/live-subagent.test.ts"
+        "vitest run tests/integration/generic-subagent.test.ts tests/integration/generic-permission.test.ts",
+        "AILI_LIVE_GENERIC_SUBAGENT_PROBE=1 npx vitest run tests/integration/live-subagent.test.ts",
+        "AILI_LIVE_CREDENTIAL_GUARD_PROBE=1 npx vitest run tests/integration/live-subagent.test.ts"
       ],
       "artifacts": [
-        { "path": "src/runtime/subagents.ts", "sha256": "4fa3ca548e2d2038410f0c9a3a2e41c5137ebf2dff7987d3e0be6e62bb9f6412" },
+        { "path": "src/runtime/subagents.ts", "sha256": "9f09e0e8a380d026d82b0842f2c687da2f3529b43a7ef6d1a6aad47d71190d48" },
         { "path": "src/runtime/child-guard.ts", "sha256": "9da3c1d80805fd76bbf7a7fd253dff44f0756439fdee039bd7d7fd30766329e1" },
         { "path": "src/runtime/credential-guard.ts", "sha256": "01d76ff0a9a2a0a08a2d2e52b6ed050d925df5e5bea1e6194130e00bfe22cde3" },
-        { "path": "tests/unit/subagents.test.ts", "sha256": "93602a401e058d1870922b213f8f0a00dc35e869a704b0c551442d3d8454054a" },
+        { "path": "tests/unit/subagents.test.ts", "sha256": "16fc1fbd1759befeed03a2428294c28d662022622c61a6444e23b365dc7447aa" },
         { "path": "tests/unit/child-guard.test.ts", "sha256": "b187d6d84cd0829ae5474e133b4df911a80b75b9e89622b8543a1c5894be4974" },
-        { "path": "tests/integration/generic-permission.test.ts", "sha256": "1e113af5b5cce59f365bc12a1735e1aa269c0a739fe6fc7aa4c9131818869ce5" },
+        { "path": "tests/integration/generic-permission.test.ts", "sha256": "90cc4ee67098f671dddac495d5e2cd5dc2c50131297fd04f0d72a1ca44217f24" },
+        { "path": "tests/integration/generic-subagent.test.ts", "sha256": "a13f8564bdd1bd735f9313d2ad71511a47c939dd6351f2f460771cb48a7fc80b" },
         { "path": "tests/unit/roles.test.ts", "sha256": "72b61af16ff66506aaaceac28c92d8b3756741e3c4df0544686b3d4940215b57" },
         { "path": "scripts/sync-roles.ts", "sha256": "a4fd66c95d91ebd92f0b1c6164a84809c4b5a1bf1e185dbdd61af23688dd2d9c" },
-        { "path": "tests/integration/live-subagent.test.ts", "sha256": "46a907526890c4cd4a4e1d768fca51173c9a0c3db37ac83ba57db23d54d7f339" },
-        { "path": "manifests/live-verification.json", "sha256": "4080de48114ef5aea3a5cc201e3b704acf65833c5dee64c38cd9b41f44740c04" }
+        { "path": "tests/integration/live-subagent.test.ts", "sha256": "b88750f74b203cdbdb9d0e453e16f720ff4d8e4591ca140e0a3c7e1d8428868c" },
+        { "path": "manifests/live-verification.json", "sha256": "f5c80dfb2fb989b43af3b7460510b0a546cc05f8ff9e671c3e9284384c33d95b" }
       ]
     }
   ]

package/manifests/live-verification.json

@@ -1,32 +1,40 @@
 {
-  "schemaVersion": 1,
+  "schemaVersion": 2,
   "platform": "linux",
   "piVersion": "0.81.1",
+  "subagentVersion": "0.4.8",
   "status": "passed",
-  "approvedScope": "generic agentless headless children; one read-only repository package.json probe and one disposable external .env denial probe; no business-file mutation, bash, worktree, sandbox, or global-home access; only approved temporary run artifacts were created and removed",
+  "approvedScope": "On 2026-07-24, the user authorized two bounded live probes after repository-local compatibility verification: an omitted-backend, agentless child restricted to reading package.json, and an explicit-headless credential guard child restricted to a disposable .env sentinel. Both probes used only their declared temporary artifact roots and completed without business-file changes.",
   "probes": [
     {
       "id": "generic-subagent-fixtures",
       "command": "npx vitest run tests/unit/subagents.test.ts tests/integration/generic-subagent.test.ts",
-      "status": "passed"
+      "status": "passed",
+      "changedFiles": 0,
+      "backendRequest": "matrix",
+      "resolvedBackend": "headless"
     },
     {
-      "id": "generic-agentless-read-package",
+      "id": "generic-agentless-default-path",
       "command": "AILI_LIVE_GENERIC_SUBAGENT_PROBE=1 npx vitest run tests/integration/live-subagent.test.ts",
       "status": "passed",
-      "changedFiles": 0
+      "changedFiles": 0,
+      "backendRequest": "omitted",
+      "resolvedBackend": "headless"
     },
     {
-      "id": "generic-credential-guard",
+      "id": "generic-credential-guard-explicit-headless",
       "command": "AILI_LIVE_CREDENTIAL_GUARD_PROBE=1 npx vitest run tests/integration/live-subagent.test.ts",
       "status": "passed",
-      "changedFiles": 0
+      "changedFiles": 0,
+      "backendRequest": "explicit-headless",
+      "resolvedBackend": "headless"
     }
   ],
   "implementation": {
-    "src/runtime/subagents.ts": "4fa3ca548e2d2038410f0c9a3a2e41c5137ebf2dff7987d3e0be6e62bb9f6412",
-    "tests/unit/subagents.test.ts": "93602a401e058d1870922b213f8f0a00dc35e869a704b0c551442d3d8454054a",
-    "tests/integration/live-subagent.test.ts": "46a907526890c4cd4a4e1d768fca51173c9a0c3db37ac83ba57db23d54d7f339"
+    "src/runtime/subagents.ts": "9f09e0e8a380d026d82b0842f2c687da2f3529b43a7ef6d1a6aad47d71190d48",
+    "tests/unit/subagents.test.ts": "16fc1fbd1759befeed03a2428294c28d662022622c61a6444e23b365dc7447aa",
+    "tests/integration/live-subagent.test.ts": "b88750f74b203cdbdb9d0e453e16f720ff4d8e4591ca140e0a3c7e1d8428868c"
   },
-  "credentialHandling": "Existing Pi authentication was used by Pi; AILI did not copy, print, or modify authentication files."
+  "credentialHandling": "The explicit-headless credential guard probe used only a disposable .env sentinel. It completed with changedFiles=0; the sentinel was absent from the model-visible result and every temporary artifact before cleanup."
 }

package/manifests/provenance.json

@@ -30,8 +30,8 @@
       "status": "dependency",
       "sourceFiles": ["src/index.ts", "src/api.ts", "src/runners/headless-model.ts", "src/artifacts/result.ts"],
       "symbols": ["subagent tool renderCall", "runSubagent API", "headless lifecycle", "artifact envelope"],
-      "localChanges": ["AILI registers the full pinned upstream subagent tool schema, prepends a sanitized bounded requested-Agent heading to upstream run-call rendering, injects a non-removable credential guard, and relies on the ambient AILI pi-permission-modes registration exactly once in each child; no upstream source is copied"],
-      "verification": ["tests/unit/subagents.test.ts", "tests/integration/package-runtime.test.ts"]
+      "localChanges": ["AILI registers the full pinned upstream subagent tool schema, prepends a sanitized bounded requested-Agent heading, injects a non-removable credential guard, normalizes ordinary omitted/auto runs to headless for the Pi 0.81.1 compatibility window, and rejects explicit inline before model startup; no upstream source is copied"],
+      "verification": ["tests/unit/subagents.test.ts", "tests/integration/generic-subagent.test.ts", "tests/integration/live-subagent.test.ts", "tests/integration/package-runtime.test.ts"]
     },
     {
       "name": "pi-permission-modes",
@@ -39,11 +39,11 @@
       "revision": "23d65d10a53b67043cae42322acf9044d6edb196",
       "version": "2.2.0",
       "license": "MIT",
-      "status": "dependency",
-      "sourceFiles": ["src/index.ts", "permission-mode.defaults.json"],
-      "symbols": ["Default/Plan/Build/YOLO", "/perm", "Alt+M", "sandbox degradation"],
-      "localChanges": ["AILI initializes the pinned upstream extension and does not retain a competing AILI mode command or shortcut"],
-      "verification": ["tests/unit/runtime.test.ts", "tests/integration/extension-load.test.ts"]
+      "status": "adapted",
+      "sourceFiles": ["src/vendor/pi-permission-modes/index.ts", "src/vendor/pi-permission-modes/resolve.ts", "upstream/pi-permission-modes.lock.json", "licenses/pi-permission-modes-MIT.txt"],
+      "symbols": ["Default/Plan/Build/YOLO", "/perm", "Alt+M", "shared permission pattern matcher", "sandbox degradation"],
+      "localChanges": ["AILI's generated adapted entry redirects unchanged sibling modules to the exact 2.2.0 dependency", "the owned resolve.ts compiles permission globs with RegExp dotAll so * and ? include ECMAScript line terminators", "the exact upstream and adapted files are hash-locked and drift-checked"],
+      "verification": ["npm run verify:permission-modes", "tests/unit/permission-patterns.test.ts", "tests/integration/permission-modes.test.ts", "tests/integration/extension-load.test.ts"]
     },
     {
       "name": "pi-quota-status",

package/manifests/sbom.json

@@ -3,7 +3,7 @@
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
   "name": "@rosetears/aili-pi-0.0.0-development",
-  "documentNamespace": "https://github.com/Rosetears520/aili-pi/sbom/b1356fd5c37f5e69387fb7d4acaeb377",
+  "documentNamespace": "https://github.com/Rosetears520/aili-pi/sbom/a9e5a3e4d1076b3179dd8cca5ef89f9f",
   "creationInfo": {
     "creators": [
       "Tool: @rosetears/aili-pi scripts/generate-provenance.ts"
@@ -43,7 +43,7 @@
       "licenseDeclared": "MIT",
       "checksums": [],
       "primaryPackagePurpose": "SOURCE",
-      "comment": "revision=daa7b83819116a62008ad17aa65fcd50fefbafd0; files=src/index.ts, src/api.ts, src/runners/headless-model.ts, src/artifacts/result.ts; symbols=subagent tool renderCall, runSubagent API, headless lifecycle, artifact envelope; local changes=AILI registers the full pinned upstream subagent tool schema, prepends a sanitized bounded requested-Agent heading to upstream run-call rendering, injects a non-removable credential guard, and relies on the ambient AILI pi-permission-modes registration exactly once in each child; no upstream source is copied"
+      "comment": "revision=daa7b83819116a62008ad17aa65fcd50fefbafd0; files=src/index.ts, src/api.ts, src/runners/headless-model.ts, src/artifacts/result.ts; symbols=subagent tool renderCall, runSubagent API, headless lifecycle, artifact envelope; local changes=AILI registers the full pinned upstream subagent tool schema, prepends a sanitized bounded requested-Agent heading, injects a non-removable credential guard, normalizes ordinary omitted/auto runs to headless for the Pi 0.81.1 compatibility window, and rejects explicit inline before model startup; no upstream source is copied"
     },
     {
       "SPDXID": "SPDXRef-source-pi-permission-modes-9b38b384cd",
@@ -55,7 +55,7 @@
       "licenseDeclared": "MIT",
       "checksums": [],
       "primaryPackagePurpose": "SOURCE",
-      "comment": "revision=23d65d10a53b67043cae42322acf9044d6edb196; files=src/index.ts, permission-mode.defaults.json; symbols=Default/Plan/Build/YOLO, /perm, Alt+M, sandbox degradation; local changes=AILI initializes the pinned upstream extension and does not retain a competing AILI mode command or shortcut"
+      "comment": "revision=23d65d10a53b67043cae42322acf9044d6edb196; files=src/vendor/pi-permission-modes/index.ts, src/vendor/pi-permission-modes/resolve.ts, upstream/pi-permission-modes.lock.json, licenses/pi-permission-modes-MIT.txt; symbols=Default/Plan/Build/YOLO, /perm, Alt+M, shared permission pattern matcher, sandbox degradation; local changes=AILI's generated adapted entry redirects unchanged sibling modules to the exact 2.2.0 dependency | the owned resolve.ts compiles permission globs with RegExp dotAll so * and ? include ECMAScript line terminators | the exact upstream and adapted files are hash-locked and drift-checked"
     },
     {
       "SPDXID": "SPDXRef-source-pi-quota-status-63ccce8956",

package/manifests/skill-compatibility.json

@@ -801,9 +801,9 @@
         "snapshot-hash:verified",
         "npm run verify:roles",
         "vitest run tests/unit/roles.test.ts tests/unit/subagents.test.ts",
-        "vitest run tests/integration/generic-permission.test.ts",
-        "AILI_LIVE_SUBAGENT_PROBE=static npx vitest run tests/integration/live-subagent.test.ts",
-        "AILI_LIVE_SUBAGENT_PROBE=1 npx vitest run tests/integration/live-subagent.test.ts"
+        "vitest run tests/integration/generic-subagent.test.ts tests/integration/generic-permission.test.ts",
+        "AILI_LIVE_GENERIC_SUBAGENT_PROBE=1 npx vitest run tests/integration/live-subagent.test.ts",
+        "AILI_LIVE_CREDENTIAL_GUARD_PROBE=1 npx vitest run tests/integration/live-subagent.test.ts"
       ],
       "status": "adapted",
       "reason": "Required capabilities are covered by verified Pi adapter evidence: subagent.dispatch.",
@@ -4311,9 +4311,9 @@
         "snapshot-hash:verified",
         "npm run verify:roles",
         "vitest run tests/unit/roles.test.ts tests/unit/subagents.test.ts",
-        "vitest run tests/integration/generic-permission.test.ts",
-        "AILI_LIVE_SUBAGENT_PROBE=static npx vitest run tests/integration/live-subagent.test.ts",
-        "AILI_LIVE_SUBAGENT_PROBE=1 npx vitest run tests/integration/live-subagent.test.ts"
+        "vitest run tests/integration/generic-subagent.test.ts tests/integration/generic-permission.test.ts",
+        "AILI_LIVE_GENERIC_SUBAGENT_PROBE=1 npx vitest run tests/integration/live-subagent.test.ts",
+        "AILI_LIVE_CREDENTIAL_GUARD_PROBE=1 npx vitest run tests/integration/live-subagent.test.ts"
       ],
       "status": "adapted",
       "reason": "Required capabilities are covered by verified Pi adapter evidence: subagent.dispatch.",
@@ -5596,9 +5596,9 @@
         "snapshot-hash:verified",
         "npm run verify:roles",
         "vitest run tests/unit/roles.test.ts tests/unit/subagents.test.ts",
-        "vitest run tests/integration/generic-permission.test.ts",
-        "AILI_LIVE_SUBAGENT_PROBE=static npx vitest run tests/integration/live-subagent.test.ts",
-        "AILI_LIVE_SUBAGENT_PROBE=1 npx vitest run tests/integration/live-subagent.test.ts"
+        "vitest run tests/integration/generic-subagent.test.ts tests/integration/generic-permission.test.ts",
+        "AILI_LIVE_GENERIC_SUBAGENT_PROBE=1 npx vitest run tests/integration/live-subagent.test.ts",
+        "AILI_LIVE_CREDENTIAL_GUARD_PROBE=1 npx vitest run tests/integration/live-subagent.test.ts"
       ],
       "status": "adapted",
       "reason": "Required capabilities are covered by verified Pi adapter evidence: subagent.dispatch.",
@@ -6416,9 +6416,9 @@
         "snapshot-hash:verified",
         "npm run verify:roles",
         "vitest run tests/unit/roles.test.ts tests/unit/subagents.test.ts",
-        "vitest run tests/integration/generic-permission.test.ts",
-        "AILI_LIVE_SUBAGENT_PROBE=static npx vitest run tests/integration/live-subagent.test.ts",
-        "AILI_LIVE_SUBAGENT_PROBE=1 npx vitest run tests/integration/live-subagent.test.ts"
+        "vitest run tests/integration/generic-subagent.test.ts tests/integration/generic-permission.test.ts",
+        "AILI_LIVE_GENERIC_SUBAGENT_PROBE=1 npx vitest run tests/integration/live-subagent.test.ts",
+        "AILI_LIVE_CREDENTIAL_GUARD_PROBE=1 npx vitest run tests/integration/live-subagent.test.ts"
       ],
       "status": "adapted",
       "reason": "Required capabilities are covered by verified Pi adapter evidence: subagent.dispatch.",

package/manifests/subagent-provenance.json

@@ -27,11 +27,21 @@
     },
     {
       "name": "@agwab/pi-subagent",
+      "version": "0.4.8",
       "revision": "daa7b83819116a62008ad17aa65fcd50fefbafd0",
       "license": "MIT",
-      "status": "reference-only",
-      "reusedPatterns": [],
-      "reason": "No community source code is copied or depended on in P5; accepted design evidence is retained for the P8 notice/SBOM audit."
+      "status": "dependency",
+      "reusedPatterns": [
+        "generic subagent tool schema and rendering",
+        "headless/tmux/inline backend and lifecycle envelopes",
+        "bounded parallel fan-out, worktree, sandbox, async, interrupt, and reconcile behavior"
+      ],
+      "localAdaptation": [
+        "ordinary omitted/auto runs use headless for the Pi 0.81.1 compatibility window",
+        "explicit incompatible inline requests fail before model startup",
+        "AILI injects the immutable credential guard and a bounded requested-Agent heading"
+      ],
+      "reason": "AILI depends on the exact package and applies a wrapper-only compatibility adaptation; no upstream source is copied."
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rosetears/aili-pi",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "description": "AILI and ROSE distribution for official Pi",
   "type": "module",
   "license": "MIT",
@@ -68,8 +68,10 @@
     "validate:roles": "npm run verify:roles",
     "sync:adapters": "node --experimental-strip-types scripts/apply-adapter-evidence.ts",
     "validate:compatibility": "node --experimental-strip-types scripts/apply-adapter-evidence.ts --verify",
-    "generate:provenance": "node --experimental-strip-types scripts/generate-provenance.ts",
-    "validate:provenance": "node --experimental-strip-types scripts/generate-provenance.ts --verify",
+    "sync:permission-modes": "node --experimental-strip-types scripts/sync-permission-modes.ts",
+    "verify:permission-modes": "node --experimental-strip-types scripts/sync-permission-modes.ts --verify",
+    "generate:provenance": "node --experimental-strip-types scripts/sync-permission-modes.ts --verify && node --experimental-strip-types scripts/generate-provenance.ts",
+    "validate:provenance": "node --experimental-strip-types scripts/sync-permission-modes.ts --verify && node --experimental-strip-types scripts/generate-provenance.ts --verify",
     "validate:capabilities": "node --experimental-strip-types scripts/validate-runtime.ts",
     "validate:release": "node --experimental-strip-types scripts/validate-runtime.ts --release",
     "test:doctor": "vitest run tests/unit/doctor.test.ts",

package/scripts/generate-provenance.ts

@@ -115,7 +115,7 @@ async function generate(): Promise<{ notices: string; sbom: object }> {
     "",
     `The exact ${packages.length}-entry package-lock inventory, versions, integrity values, dependency scope, and declared licenses is recorded in \`manifests/sbom.json\`.`,
     "",
-    "Runtime dependencies are initialized through the single AILI Extension entry; no third-party source tree is copied into this package.",
+    "Runtime dependencies are initialized through the single AILI Extension entry. Package-owned third-party adaptations are copied only where their provenance sourceFiles explicitly name repository paths.",
     "",
   ].join("\n");
   return { notices, sbom };

package/scripts/sync-permission-modes.ts

@@ -0,0 +1,135 @@
+import { createHash } from "node:crypto";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { resolvePermissionModesPackageRoot } from "../src/runtime/package-resolution.ts";
+
+const ROOT = resolve(import.meta.dirname, "..");
+const SOURCE_ROOT = fileURLToPath(resolvePermissionModesPackageRoot());
+const VERIFY = process.argv.includes("--verify");
+const VERSION = "2.2.0";
+const REVISION = "23d65d10a53b67043cae42322acf9044d6edb196";
+
+const EXPECTED_UPSTREAM_HASHES: Record<string, string> = {
+  "src/index.ts": "fd4462a3b7ba986af734c2e17ba8ea7178df56c933e87ed444ba90ba24c2fd5b",
+  "src/resolve.ts": "13f52a4a9c08d7a55f5f9d03f97302d864768838fb3e9fca2051cb7d94a0ae82",
+  LICENSE: "d87cb99b43f6bf8771e57be83485db11b977b9dfa21b6bd201b8d3d370bdce43",
+};
+
+const ADAPTATION_HEADER = [
+  "/**",
+  " * Generated AILI adaptation of pi-permission-modes@2.2.0.",
+  " * Source revision: 23d65d10a53b67043cae42322acf9044d6edb196.",
+  " * Regenerate with scripts/sync-permission-modes.ts; do not edit manually.",
+  " */",
+  "",
+].join("\n");
+
+const sha256 = (value: string): string => createHash("sha256").update(value).digest("hex");
+
+function replaceExactlyOnce(source: string, before: string, after: string, label: string): string {
+  const first = source.indexOf(before);
+  if (first < 0 || source.indexOf(before, first + before.length) >= 0) {
+    throw new Error(`expected exactly one ${label} in pi-permission-modes@${VERSION}`);
+  }
+  return source.slice(0, first) + after + source.slice(first + before.length);
+}
+
+function adaptIndex(source: string): string {
+  let redirected = 0;
+  const body = source.replace(/from "\.\/([^"]+)";/g, (full, specifier: string) => {
+    if (specifier === "resolve.ts") return full;
+    redirected += 1;
+    return `from "pi-permission-modes/src/${specifier}";`;
+  });
+  if (redirected !== 12) {
+    throw new Error(`expected 12 redirected sibling imports in pi-permission-modes@${VERSION}, found ${redirected}`);
+  }
+  const documented = replaceExactlyOnce(
+    body,
+    "The logic lives in sibling\n * modules:",
+    "The adapted matcher lives locally; unchanged logic stays in pinned dependency\n * modules:",
+    "entry module ownership comment",
+  );
+  return ADAPTATION_HEADER + documented;
+}
+
+function adaptResolve(source: string): string {
+  const withSchemaRedirect = replaceExactlyOnce(
+    source,
+    'from "./schema.ts";',
+    'from "pi-permission-modes/src/schema.ts";',
+    "schema import",
+  );
+  const withDotAll = replaceExactlyOnce(
+    withSchemaRedirect,
+    "return new RegExp(re).test(t);",
+    'return new RegExp(re, "s").test(t);',
+    "glob RegExp compilation",
+  );
+  return ADAPTATION_HEADER + withDotAll;
+}
+
+async function expectedOutputs(): Promise<Record<string, string>> {
+  const packageJsonText = await readFile(resolve(SOURCE_ROOT, "package.json"), "utf8");
+  const packageJson = JSON.parse(packageJsonText) as { name?: string; version?: string; license?: string };
+  if (packageJson.name !== "pi-permission-modes" || packageJson.version !== VERSION || packageJson.license !== "MIT") {
+    throw new Error(`expected pi-permission-modes@${VERSION} MIT baseline`);
+  }
+
+  const upstream = Object.fromEntries(await Promise.all(
+    Object.keys(EXPECTED_UPSTREAM_HASHES).map(async (path) => [path, await readFile(resolve(SOURCE_ROOT, path), "utf8")]),
+  )) as Record<string, string>;
+  for (const [path, expected] of Object.entries(EXPECTED_UPSTREAM_HASHES)) {
+    const actual = sha256(upstream[path]!);
+    if (actual !== expected) throw new Error(`unexpected upstream drift for ${path}: ${actual}`);
+  }
+
+  const index = adaptIndex(upstream["src/index.ts"]!);
+  const matcher = adaptResolve(upstream["src/resolve.ts"]!);
+  const license = upstream.LICENSE!;
+  const adaptedFiles = {
+    "src/vendor/pi-permission-modes/index.ts": index,
+    "src/vendor/pi-permission-modes/resolve.ts": matcher,
+    "licenses/pi-permission-modes-MIT.txt": license,
+  };
+  const lock = {
+    schemaVersion: 1,
+    package: {
+      name: "pi-permission-modes",
+      version: VERSION,
+      revision: REVISION,
+      license: "MIT",
+    },
+    upstreamFiles: Object.entries(EXPECTED_UPSTREAM_HASHES).map(([path, hash]) => ({ path, sha256: hash })),
+    adaptedFiles: Object.entries(adaptedFiles).map(([path, content]) => ({ path, sha256: sha256(content) })),
+    localChanges: [
+      "Package-owned adapted entry redirects all unchanged sibling modules to the exact pi-permission-modes dependency while owning resolve.ts locally.",
+      "matchPattern compiles its anchored glob RegExp with dotAll so * and ? include ECMAScript line terminators.",
+    ],
+    generatedBy: "scripts/sync-permission-modes.ts",
+    verification: ["npm run verify:permission-modes", "tests/unit/permission-patterns.test.ts", "tests/integration/permission-modes.test.ts"],
+  };
+
+  return {
+    ...adaptedFiles,
+    "upstream/pi-permission-modes.lock.json": `${JSON.stringify(lock, null, 2)}\n`,
+  };
+}
+
+async function main(): Promise<void> {
+  const outputs = await expectedOutputs();
+  for (const [path, expected] of Object.entries(outputs)) {
+    const absolute = resolve(ROOT, path);
+    if (VERIFY) {
+      const actual = await readFile(absolute, "utf8").catch(() => "");
+      if (actual !== expected) throw new Error(`permission-mode adaptation drifted: ${path}`);
+    } else {
+      await mkdir(dirname(absolute), { recursive: true });
+      await writeFile(absolute, expected, "utf8");
+    }
+  }
+  console.log(`${VERIFY ? "PASS" : "SYNCED"}: pi-permission-modes@${VERSION} adapted matcher (${Object.keys(outputs).length} artifacts)`);
+}
+
+await main();

package/src/runtime/native-integrations.ts

@@ -3,7 +3,7 @@ import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 type NativeExtension = (pi: ExtensionAPI) => void | Promise<void>;
 
 export const NATIVE_INTEGRATIONS = [
-  "pi-permission-modes@2.2.0",
+  "pi-permission-modes@2.2.0 (AILI multiline-glob adaptation)",
   "pi-quota-status@0.3.0",
   "pi-web-access@0.13.0",
   "pi-cache-optimizer@2.6.18",
@@ -12,7 +12,7 @@ export const NATIVE_INTEGRATIONS = [
 ] as const;
 
 const INTEGRATION_MODULES = [
-  "pi-permission-modes/src/index.ts",
+  "../vendor/pi-permission-modes/index.ts",
   "pi-quota-status",
   "pi-web-access",
   "pi-cache-optimizer/index.ts",
@@ -21,9 +21,9 @@ const INTEGRATION_MODULES = [
 ] as const;
 
 /**
- * Initialise the pinned upstream extensions through AILI's single package entry.
- * They remain upstream-owned implementations; this module adds no substitute
- * command, tool, permission, or provider behavior.
+ * Initialise pinned native integrations through AILI's single package entry.
+ * Permission modes uses the revision-bound adapted entry that changes only
+ * shared multiline glob matching; the remaining integrations stay upstream-owned.
  */
 export async function registerNativeIntegrations(pi: ExtensionAPI): Promise<void> {
   for (const moduleName of INTEGRATION_MODULES) {

package/src/runtime/package-resolution.ts

@@ -0,0 +1,8 @@
+import { createRequire } from "node:module";
+import { pathToFileURL } from "node:url";
+
+/** Resolve the installed dependency from either a development tree or npm's hoisted scoped-package layout. */
+export function resolvePermissionModesPackageRoot(from: string | URL = import.meta.url): URL {
+  const packageJson = createRequire(from).resolve("pi-permission-modes/package.json");
+  return new URL("./", pathToFileURL(packageJson));
+}