mercury-agent 0.7.0-beta.0 → 0.7.0-beta.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mercury-agent",
-  "version": "0.7.0-beta.0",
+  "version": "0.7.0-beta.1",
   "description": "Personal AI assistant for chat platforms (WhatsApp, Slack, Discord, Telegram)",
   "license": "MIT",
   "author": "Avishai Tsabari",

package/resources/pi-extensions/subagent/index.ts

@@ -244,7 +244,9 @@ async function runSingleAgent(
 		};
 	}
 
-	const args: string[] = ["--mode", "json", "-p", "--no-session"];
+	// --no-approve: the trust store dir (~/.pi/agent) is mounted read-only in
+	// containers and any trust-store access acquires a lock there (EROFS crash).
+	const args: string[] = ["--mode", "json", "-p", "--no-session", "--no-approve"];
 	if (agent.model) args.push("--model", agent.model);
 	if (agent.tools && agent.tools.length > 0) args.push("--tools", agent.tools.join(","));
 

package/src/agent/container-entry.ts

@@ -835,6 +835,13 @@ function invokePiOnce(
       "--print",
       "--mode",
       "json",
+      // Skip pi's project-trust store entirely. The store lives in
+      // /home/mercury/.pi/agent (mounted :ro) and even a read locks it via
+      // proper-lockfile (mkdir trust.json.lock → EROFS). Workspaces with
+      // trust-requiring resources already resolved to "untrusted" in
+      // non-interactive mode, and without such resources nothing trust-gated
+      // loads — so --no-approve preserves behavior either way.
+      "--no-approve",
       ...sessionArgs,
       "--provider",
       provider,