pi-session-mcp 0.12.1 → 0.13.0

package/dist/setup-cli.js

@@ -1,3 +1,4 @@
+import { cpusSchema, cpuSharesSchema, memorySchema } from "./writer-limits.js";
 import { WRITER_NAME_PATTERN } from "./writer-state.js";
 export function parseSetupArgs(argv) {
     let operation;
@@ -11,6 +12,7 @@ export function parseSetupArgs(argv) {
     let discard = false, codex = false, isolationControl = false;
     const container = {};
     const modeFlags = new Set();
+    const clearLimits = [];
     for (let index = 0; index < argv.length; index += 1) {
         const argument = argv[index];
         if (["--collect", "--reset", "--recreate", "--finish"].includes(argument)) {
@@ -81,7 +83,7 @@ export function parseSetupArgs(argv) {
             customizeSkill = value;
             continue;
         }
-        if (["--repo", "--mode", "--accept-host-writes", "--writers", "--lifecycle", "--profiles", "--image", "--network", "--cache", "--tags"].includes(argument)) {
+        if (["--repo", "--mode", "--accept-host-writes", "--writers", "--lifecycle", "--profiles", "--image", "--network", "--cache", "--tags", "--clean", "--cpus", "--cpu-shares", "--memory"].includes(argument)) {
             if (modeFlags.has(argument))
                 throw new Error("repo_argument_repeated");
             modeFlags.add(argument);
@@ -89,8 +91,8 @@ export function parseSetupArgs(argv) {
                 acceptHostWrites = true;
                 continue;
             }
-            const value = argv[++index];
-            if (!value || value.startsWith("-"))
+            const value = argv[++index] ?? "";
+            if ((!value || value.startsWith("-")) && !["--cpus", "--cpu-shares", "--memory"].includes(argument))
                 throw new Error("repo_argument_invalid");
             switch (argument) {
                 case "--repo":
@@ -129,8 +131,40 @@ export function parseSetupArgs(argv) {
                         throw new Error("tags_invalid");
                     container.tags = value;
                     break;
+                case "--clean":
+                    if (value !== "untracked" && value !== "all")
+                        throw new Error("clean_invalid");
+                    container.clean = value;
+                    break;
+                case "--cpus":
+                    if (value === "none") {
+                        clearLimits.push("cpus");
+                        break;
+                    }
+                    if (!value || !/^[0-9]+(?:\.[0-9]{1,2})?$/.test(value) || !cpusSchema.safeParse(Number(value)).success)
+                        throw new Error("cpus_invalid");
+                    container.cpus = Number(value);
+                    break;
+                case "--cpu-shares":
+                    if (value === "none") {
+                        clearLimits.push("cpuShares");
+                        break;
+                    }
+                    if (!value || !/^[0-9]+$/.test(value) || !cpuSharesSchema.safeParse(Number(value)).success)
+                        throw new Error("cpu_shares_invalid");
+                    container.cpuShares = Number(value);
+                    break;
+                case "--memory":
+                    if (value === "none") {
+                        clearLimits.push("memory");
+                        break;
+                    }
+                    if (!memorySchema.safeParse(value).success)
+                        throw new Error("memory_invalid");
+                    container.memory = value;
+                    break;
                 case "--cache":
-                    if (value !== "none" && value !== "go" && value !== "uv")
+                    if (value !== "none" && value !== "go" && value !== "uv" && value !== "npm")
                         throw new Error("cache_invalid");
                     container.cache = value;
                     break;
@@ -163,9 +197,9 @@ export function parseSetupArgs(argv) {
     if (modeFlags.size > 0) {
         if (repo === undefined || targets.length > 0 || customizeSkill !== undefined || (operation !== undefined && operation !== "dry-run" && operation !== "apply"))
             throw new Error("repo_combination");
-        if ((mode === "host" || mode === "read-only") && Object.keys(container).length > 0)
+        if ((mode === "host" || mode === "read-only") && (Object.keys(container).length > 0 || clearLimits.length > 0))
             throw new Error("repo_combination");
-        const request = { alias: repo, acceptHostWrites, apply: operation === "apply", discard, codex, ...(baseRef ? { baseRef } : {}), ...(mode === undefined ? {} : { mode }), ...(Object.keys(container).length === 0 ? {} : { container }) };
+        const request = { alias: repo, acceptHostWrites, apply: operation === "apply", discard, codex, ...(baseRef ? { baseRef } : {}), ...(mode === undefined ? {} : { mode }), ...(Object.keys(container).length === 0 ? {} : { container }), ...(clearLimits.length === 0 ? {} : { clearLimits }) };
         return { ...(operation === undefined ? {} : { operation }), targets, json, repo: request };
     }
     if (customizeSkill !== undefined) {

package/dist/setup-modes.d.ts

@@ -9,9 +9,12 @@ export interface ModeRequest {
     readonly discard?: boolean;
     readonly baseRef?: string;
     readonly codex?: boolean;
+    /** Limits to remove (`--cpus none` and so on); an omitted limit keeps the recorded one (#166). */
+    readonly clearLimits?: readonly ("cpus" | "cpuShares" | "memory")[];
 }
 /** A dry run writes nothing; apply serializes the entire read/validate/replace transaction. */
 export declare function changeExecutionMode(configPath: string, request: ModeRequest, dependencies?: {
+    cgroupControllers?: () => Promise<readonly string[]>;
     containerRuntime?: () => Promise<boolean>;
     beforeWrite?: (entry: import("./execution-modes.js").WorkspaceModeEntry) => Promise<SetupResult | undefined>;
     afterChange?: (output: SetupResult) => Promise<SetupResult>;

package/dist/setup-modes.js

@@ -1,3 +1,6 @@
+import { podmanCgroupControllers } from "./writer-boundary.js";
+import { createProcessRunner } from "./setup-process.js";
+import { writerLimits } from "./writer-limits.js";
 import { randomUUID } from "node:crypto";
 import { lstat, mkdir, open, readFile, rename, unlink } from "node:fs/promises";
 import { dirname, join } from "node:path";
@@ -65,7 +68,14 @@ export async function changeExecutionMode(configPath, request, dependencies = {}
             const previousBase = existing?.mode === "container" ? existing.base : undefined;
             const requestedBase = request.baseRef?.replace(/^refs\/heads\//, "");
             const base = requestedBase ?? previousBase ?? request.container?.base;
-            return { ...request.container, mode, ...(base === undefined ? {} : { base }) };
+            // Limits are outside the settings drift check, so an omitted flag must not drop one silently (#166).
+            const limits = Object.fromEntries(["cpus", "cpuShares", "memory"].flatMap((key) => {
+                if (request.clearLimits?.includes(key))
+                    return [];
+                const value = request.container?.[key] ?? (existing?.mode === "container" ? existing[key] : undefined);
+                return value === undefined ? [] : [[key, value]];
+            }));
+            return { ...request.container, ...limits, mode, ...(base === undefined ? {} : { base }) };
         })() : { mode };
         let proposed;
         try {
@@ -76,6 +86,13 @@ export async function changeExecutionMode(configPath, request, dependencies = {}
             return done("failed", "modes_file_invalid");
         }
         const resolved = resolveExecutionModes(proposed, aliases, config.executionProfiles).get(request.alias);
+        const limits = resolved.container && writerLimits(resolved.container);
+        if (limits) {
+            const controllers = await (dependencies.cgroupControllers ?? (() => podmanCgroupControllers(createProcessRunner())))().catch(() => []);
+            if (((limits.cpus !== undefined || limits.cpuShares !== undefined) && !controllers.includes("cpu"))
+                || (limits.memory !== undefined && !controllers.includes("memory")))
+                return done("failed", "cgroup_controller_unavailable");
+        }
         const refused = await dependencies.beforeWrite?.(resolved);
         if (refused)
             return refused;

package/dist/setup-writers.js

@@ -15,7 +15,8 @@ import { localHookNeededByOthers, ownsWakeHook, runWakeHook } from "./setup-hook
 import { result } from "./setup-result.js";
 import { createWriterRegistrationAdapter, unregisterWriter } from "./client-adapters/writer-registration.js";
 import { verifyMcpCapabilities } from "./client-adapters/mcp-verifier.js";
-import { IMAGE_PULL_TIMEOUT_MS } from "./writer-boundary.js";
+import { sameWriterLimits, writerLimits } from "./writer-limits.js";
+import { IMAGE_PULL_TIMEOUT_MS, podmanCgroupControllers } from "./writer-boundary.js";
 import { acquireWriterLease, WriterLeaseError } from "./writer-lease.js";
 import { ensureWriterAbsent } from "./writer-fence.js";
 import * as lifecycle from "./writer-lifecycle.js";
@@ -209,6 +210,15 @@ async function reconcileUnlocked(configPath, alias, request, deps) {
                         add(name, drift);
                         return;
                     }
+                    const state = await readWriterState(ctx.home, name);
+                    if (!state)
+                        throw new Error("writer_state_invalid");
+                    const limits = writerLimits(entry.container);
+                    if (!sameWriterLimits(state.limits, limits)) {
+                        const { limits: _previous, ...rest } = state;
+                        await writeWriterState(ctx.home, name, { ...rest, ...(limits ? { limits } : {}) });
+                        add(name, { status: "ok", code: "writer_limits_updated" });
+                    }
                 }
                 // Decide for both clients before removing anything, so a divergent registration of one client never
                 // costs the writer its owned registration of the other. A client that is not installed has nothing to keep.
@@ -311,7 +321,7 @@ export async function changeWriterMode(configPath, request, deps) {
         return failed("alias_unknown");
     let runtimeProbe;
     const containerRuntime = () => runtimeProbe ??= (deps.containerRuntime ?? containerRuntimeUsable)().catch(() => false);
-    const modeDependencies = { containerRuntime };
+    const modeDependencies = { containerRuntime, cgroupControllers: () => podmanCgroupControllers(services(deps).runner) };
     try {
         let writerWork = request.mode === "container";
         if (!writerWork) {
@@ -399,6 +409,24 @@ export async function changeWriterMode(configPath, request, deps) {
                                 throw error;
                             }
                         }
+                        // Settings drift before the write, so a kept writer with changed settings refuses the mode
+                        // change itself and the modes file never records a mode no writer matches (#163). Read-only like
+                        // the dry run, which fences nothing; reconcile re-checks under its fence. Missing writers have
+                        // no settings yet.
+                        if (entry.mode === "container") {
+                            const { life } = services(deps);
+                            const rawConfig = JSON.parse(await readFile(configPath, "utf8")), overrideDirectory = skillOverrideDirectory(configPath);
+                            const drifted = [];
+                            for (const name of planned.keep) {
+                                if (planned.missing.includes(name))
+                                    continue;
+                                const drift = await life.writerSettingsDrift(ctx, { index: writerIndex(name), settings: entry.container, rawConfig, overrideDirectory });
+                                if (drift)
+                                    drifted.push({ target: targetFor(request.alias, name), ...drift });
+                            }
+                            if (drifted.length)
+                                return result(operation, drifted);
+                        }
                     }
                     else
                         await preflight(ctx, planned.surplus, request.discard ?? false, deps);
@@ -420,7 +448,9 @@ export async function changeWriterMode(configPath, request, deps) {
                         for (const name of planned.keep) {
                             // The same settings check as apply, so a drifted writer shows before anything is applied (#134).
                             const drift = await life.writerSettingsDrift(ctx, { index: writerIndex(name), settings: proposed.container, rawConfig, overrideDirectory });
-                            kept.push({ target: targetFor(request.alias, name), ...(drift ?? { status: "planned", code: "writer_planned" }) });
+                            const state = await readWriterState(ctx.home, name);
+                            const updatingLimits = state && state.phase !== "provisioning" && !sameWriterLimits(state.limits, writerLimits(proposed.container));
+                            kept.push({ target: targetFor(request.alias, name), ...(drift ?? { status: "planned", code: updatingLimits ? "writer_limits_update_planned" : "writer_planned" }) });
                         }
                         const refused = kept.some((finding) => finding.status === "failed" || finding.status === "divergent");
                         writers = result("dry-run", [...kept, ...planned.surplus.map((name) => ({ target: targetFor(request.alias, name), status: "planned", code: "writer_remove_planned" }))], refused ? "failed" : "planned");

package/dist/tool-schemas.d.ts

@@ -334,6 +334,10 @@ export declare const capabilitiesSchema: z.ZodObject<{
         }>;
         extensions: z.ZodArray<z.ZodString>;
         grantedExtensionTools: z.ZodArray<z.ZodString>;
+        shell: z.ZodEnum<{
+            none: "none";
+            sandboxed: "sandboxed";
+        }>;
         skills: z.ZodArray<z.ZodString>;
     }, z.core.$strict>>;
 }, z.core.$strict>;

package/dist/tool-schemas.js

@@ -44,6 +44,7 @@ export const capabilitiesSchema = z.object({
         thinkingLevel: thinkingLevelSchema,
         extensions: z.array(z.string()),
         grantedExtensionTools: z.array(z.string()),
+        shell: z.enum(["none", "sandboxed"]),
         skills: z.array(aliasSchema),
     }).strict()),
 }).strict();

package/dist/writer-boundary.d.ts

@@ -46,6 +46,8 @@ export declare function podmanInfo(runner: CommandRunner): Promise<{
     usable: boolean;
     version?: string;
 }>;
+/** A failed or malformed host probe provides no usable controllers. */
+export declare function podmanCgroupControllers(runner: CommandRunner): Promise<readonly string[]>;
 export declare function resolveImage(runner: CommandRunner, image: string, pull: boolean): Promise<string>;
 export declare function verifyCloneLayout(clone: string): Promise<void>;
 export declare function isSafeRefName(name: string): boolean;

package/dist/writer-boundary.js

@@ -35,6 +35,12 @@ export function serveArgs(paths, state, command, releaseRoot, eventsDir, options
         "-e", "PI_CODING_AGENT_DIR=/pi/agent",
         "-e", "PI_SESSION_MCP_WRITER_GUARD=/pi/config/writer-guard.json",
     ];
+    if (state.limits?.cpus !== undefined)
+        args.push(`--cpus=${state.limits.cpus}`);
+    if (state.limits?.cpuShares !== undefined)
+        args.push(`--cpu-shares=${state.limits.cpuShares}`);
+    if (state.limits?.memory !== undefined)
+        args.push(`--memory=${state.limits.memory}`);
     if (options?.name !== undefined)
         args.push("--name", writerContainerName(options.name));
     if (eventsDir !== undefined)
@@ -43,6 +49,8 @@ export function serveArgs(paths, state, command, releaseRoot, eventsDir, options
         args.push("-v", `${paths.go}:/pi/go:rw`, "-e", "GOPATH=/pi/go", "-e", "GOCACHE=/pi/go/cache", "-e", "GOTOOLCHAIN=local");
     if (state.cache === "uv")
         args.push("-v", `${paths.uv}:/pi/uv:rw`, "-e", "UV_CACHE_DIR=/pi/uv/cache", "-e", "npm_config_cache=/pi/uv/npm");
+    if (state.cache === "npm")
+        args.push("-v", `${paths.npm}:/pi/npm:rw`, "-e", "npm_config_cache=/pi/npm/cache");
     return [...args, state.imageId, ...command];
 }
 export class EventsDirectoryError extends Error {
@@ -261,6 +269,25 @@ export async function podmanInfo(runner) {
         return { usable: false };
     }
 }
+/** A failed or malformed host probe provides no usable controllers. */
+export async function podmanCgroupControllers(runner) {
+    try {
+        const output = await podman(runner, ["info", "--format", "json"]);
+        if (output.exitCode !== 0)
+            return [];
+        const info = JSON.parse(output.stdout);
+        if (!info || typeof info !== "object" || !("host" in info))
+            return [];
+        const host = info.host;
+        if (!host || typeof host !== "object" || !("cgroupControllers" in host))
+            return [];
+        const controllers = host.cgroupControllers;
+        return Array.isArray(controllers) && controllers.every((value) => typeof value === "string") ? controllers : [];
+    }
+    catch {
+        return [];
+    }
+}
 export async function resolveImage(runner, image, pull) {
     if (image !== "node" && !/^[0-9a-f]{64}$/.test(image))
         throw new BoundaryError("image_unavailable");

package/dist/writer-lifecycle.d.ts

@@ -35,6 +35,7 @@ export declare function renderContainedConfig(alias: string, clonePath: string,
         mcpServers?: Readonly<Record<string, import("./mcp-config.js").McpServerConfig>> | undefined;
         extensions?: string[] | undefined;
         grantedExtensionTools?: string[] | undefined;
+        shell?: "sandboxed" | undefined;
         skills?: string[] | undefined;
     }>;
 };

package/dist/writer-lifecycle.js

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import { constants } from "node:fs";
 import { chmod, mkdir, open, readdir, rm, writeFile } from "node:fs/promises";
 import { basename, join } from "node:path";
+import { writerLimits } from "./writer-limits.js";
 import { configSchema } from "./config.js";
 import { renderWrapper } from "./writer-wrapper.js";
 import { builtinSkillName } from "./skill-catalog.js";
@@ -220,7 +221,7 @@ async function storedConfig(paths) {
 async function sameSettings(paths, existing, settings, now) {
     const stored = await storedConfig(paths);
     return stored !== undefined && existing.imageId === now.imageId && existing.lifecycle === settings.lifecycle
-        && existing.network === settings.network && existing.cache === settings.cache && existing.tags === settings.tags
+        && existing.network === settings.network && existing.cache === settings.cache && existing.tags === settings.tags && existing.clean === settings.clean
         && JSON.stringify(existing.profiles) === JSON.stringify(settings.profiles)
         && JSON.stringify(existing.providers) === JSON.stringify(now.providers) && canonical(withoutDeliveryOff(stored)) === canonical(withoutDeliveryOff(now.config));
 }
@@ -295,12 +296,13 @@ export async function provisionWriter(ctx, input) {
         // With spool delivery the spool directory exists from provisioning on: launch would otherwise add it to the
         // writer root, a host directory the acceptance harness digests around its own first launch.
         const spool = config.events?.delivery === "spool" ? [paths.events] : [];
-        const cache = settings.cache === "go" ? [paths.go] : settings.cache === "uv" ? [paths.uv] : [];
+        const cache = settings.cache === "none" ? [] : [paths[settings.cache]];
         for (const path of [paths.root, paths.clone, paths.config, paths.agent, paths.bundles, ...spool, ...cache])
             await privateDirectory(path);
         const state = {
             schemaVersion: 1, alias: ctx.alias, index, phase: "provisioning", lifecycle: settings.lifecycle,
-            profiles: [...settings.profiles], providers, network: settings.network, cache: settings.cache, tags: settings.tags, imageId,
+            profiles: [...settings.profiles], providers, network: settings.network, cache: settings.cache, tags: settings.tags, clean: settings.clean, imageId,
+            ...(writerLimits(settings) ? { limits: writerLimits(settings) } : {}),
             base: { ref: `refs/heads/${short}`, commit },
         };
         await writeWriterState(ctx.home, name, state);
@@ -511,7 +513,7 @@ ${BOUNDARY_GIT} for-each-ref --format='%(refname)' refs/heads | while read -r re
   if [ "$ref" != "refs/heads/$2" ]; then ${BOUNDARY_GIT} update-ref -d "$ref"; fi
 done
 ${BOUNDARY_GIT} stash clear
-${BOUNDARY_GIT} clean -fd
+${BOUNDARY_GIT} clean ${state.clean === "all" ? "-ffdx" : "-fd"}
 ${identityScript(4, 5)}`;
         const result = await ctx.runner.run("podman", throwawayArgs(name, paths, state.imageId, { clone: "rw", bundles: true }, script, [base.ref, base.short, base.commit, ...await operatorIdentity(ctx)]), AbortSignal.timeout(IMAGE_PULL_TIMEOUT_MS));
         if (result.exitCode !== 0)

package/dist/writer-limits.d.ts

@@ -0,0 +1,13 @@
+import { z } from "zod";
+export declare const cpusSchema: z.ZodNumber;
+export declare const cpuSharesSchema: z.ZodNumber;
+export declare const memorySchema: z.ZodString;
+export declare const writerLimitsSchema: z.ZodObject<{
+    cpus: z.ZodOptional<z.ZodNumber>;
+    cpuShares: z.ZodOptional<z.ZodNumber>;
+    memory: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type WriterLimits = z.infer<typeof writerLimitsSchema>;
+/** Omitted settings remove previous limits; never persist an empty limits object. */
+export declare function writerLimits(settings: WriterLimits): WriterLimits | undefined;
+export declare function sameWriterLimits(left: WriterLimits | undefined, right: WriterLimits | undefined): boolean;

package/dist/writer-limits.js

@@ -0,0 +1,19 @@
+import { z } from "zod";
+export const cpusSchema = z.number().positive().max(1024).multipleOf(0.01);
+export const cpuSharesSchema = z.number().int().min(2).max(262144);
+export const memorySchema = z.string().regex(/^[1-9][0-9]{0,6}[mg]$/);
+export const writerLimitsSchema = z.object({
+    cpus: cpusSchema.optional(),
+    cpuShares: cpuSharesSchema.optional(),
+    memory: memorySchema.optional(),
+}).strict();
+/** Omitted settings remove previous limits; never persist an empty limits object. */
+export function writerLimits(settings) {
+    const { cpus, cpuShares, memory } = settings;
+    if (cpus === undefined && cpuShares === undefined && memory === undefined)
+        return undefined;
+    return { ...(cpus === undefined ? {} : { cpus }), ...(cpuShares === undefined ? {} : { cpuShares }), ...(memory === undefined ? {} : { memory }) };
+}
+export function sameWriterLimits(left, right) {
+    return left?.cpus === right?.cpus && left?.cpuShares === right?.cpuShares && left?.memory === right?.memory;
+}

package/dist/writer-relay.js

@@ -69,7 +69,7 @@ const creationCodes = new Set([
     "model_unavailable", "thinking_level_unavailable", "execution_selection_mismatch", "external_mcp_unavailable",
     "external_mcp_no_tools", "external_mcp_grant_tool_missing", "external_mcp_activation_mismatch",
     "extension_not_installed", "extension_version_mismatch", "extension_load_failed", "extension_tool_conflict",
-    "extension_tool_missing", "skill_load_failed", "pi_session_creation_failed",
+    "extension_tool_missing", "skill_load_failed", "sandbox_unavailable", "pi_session_creation_failed",
 ]);
 class InnerError extends Error {
     code;

package/dist/writer-state.d.ts

@@ -33,12 +33,22 @@ export declare const writerStateSchema: z.ZodObject<{
     cache: z.ZodEnum<{
         go: "go";
         none: "none";
+        npm: "npm";
         uv: "uv";
     }>;
     tags: z.ZodDefault<z.ZodEnum<{
         none: "none";
         reachable: "reachable";
     }>>;
+    clean: z.ZodDefault<z.ZodEnum<{
+        all: "all";
+        untracked: "untracked";
+    }>>;
+    limits: z.ZodOptional<z.ZodObject<{
+        cpus: z.ZodOptional<z.ZodNumber>;
+        cpuShares: z.ZodOptional<z.ZodNumber>;
+        memory: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
     imageId: z.ZodString;
     base: z.ZodObject<{
         ref: z.ZodString;
@@ -73,6 +83,7 @@ export declare function writerPaths(home: string, name: string): {
     events: string;
     go: string;
     uv: string;
+    npm: string;
     wrapper: string;
     state: string;
     acceptanceFailure: string;

package/dist/writer-state.js

@@ -5,6 +5,7 @@ import { lstat, mkdir, open, readFile, rename, unlink } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { z } from "zod";
 import { PACKAGE_VERSION } from "./package-metadata.js";
+import { writerLimitsSchema } from "./writer-limits.js";
 import { ALIAS_PATTERN } from "./execution-profile.js";
 export const WRITER_NAME_PATTERN = /^[a-z][a-z0-9_-]{0,63}-w([1-9]|1[0-6])$/;
 export class WriterStateError extends Error {
@@ -31,8 +32,10 @@ export const writerStateSchema = z.object({
         model: z.string().min(1).max(200),
     }).strict()).refine((providers) => new Set(providers.map(({ provider }) => provider)).size === providers.length).readonly(),
     network: z.enum(["pasta", "none"]),
-    cache: z.enum(["none", "go", "uv"]),
+    cache: z.enum(["none", "go", "uv", "npm"]),
     tags: z.enum(["none", "reachable"]).default("none"),
+    clean: z.enum(["untracked", "all"]).default("untracked"),
+    limits: writerLimitsSchema.optional(),
     imageId: hex64,
     base: z.object({ ref: z.string(), commit: z.string().regex(/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/) }).strict(),
     acceptance: z.object({
@@ -62,7 +65,7 @@ export function writerPaths(home, name) {
     const root = join(writersRoot(home), name);
     return {
         root, clone: join(root, "clone"), agent: join(root, "agent"), bundles: join(root, "bundles"),
-        config: join(root, "config"), events: join(root, "events"), go: join(root, "go"), uv: join(root, "uv"), wrapper: join(root, "wrapper.sh"), state: join(root, "state.json"),
+        config: join(root, "config"), events: join(root, "events"), go: join(root, "go"), uv: join(root, "uv"), npm: join(root, "npm"), wrapper: join(root, "wrapper.sh"), state: join(root, "state.json"),
         acceptanceFailure: join(root, "acceptance-failure.json"),
     };
 }

package/docs/acceptance.md

@@ -2457,6 +2457,147 @@ Not established for `0.11.6`:
   wrapper's periodic credential copy (#136);
 - the VS Code wake; macOS delivery.
 
+### v0.13.0 pre-release acceptance
+
+`v0.13.0` was accepted on 2026-10-28 from 19:30 to 19:36 UTC on its release
+candidate `f7442b3`, on Linux (`x64`) with Node.js `26.12.1`, npm `12.2.1`,
+Codex CLI `0.162.1` and Claude Code `2.1.312`. Level 2 passed in the working
+tree and for the packed tarball, each with delivery off and with delivery on.
+Level 1 passed except `npm audit`. Later commits on the release pull request
+change only this record.
+
+The minor release ships ADR 0013 (#169) and the writer settings changes #162,
+#163, #165 and #166. It changes the MCP contract (read-only confinement,
+profile field and capabilities field `shell`, start error
+`sandbox_unavailable`); the setup report schema is unchanged.
+
+- Level 1 in a clean worktree of the candidate after `npm ci`: every command
+  exited with `0`, except `npm audit`; `git status --short` printed nothing.
+  - The test run, with `NODE_OPTIONS=--unhandled-rejections=strict`, reported
+    125 files, 3936 passed and 14 skipped, and no unhandled error.
+  - `npm audit` and `npm audit --omit=dev` exited with `1` and name only the
+    known `undici` finding through `@earendil-works/pi-coding-agent` 1.4.0
+    ([#120](https://github.com/plagor44-ux/pi-session-mcp/issues/120)).
+  - `npm pack` listed 916 files (tarball shasum
+    `1259d57d2d59099ad72e796609ecab3d581e9b06`, identical in two packs). A scan
+    of the packed files for private names, hosts and paths found none; its only
+    matches for `/home/` are the already redacted
+    `<repo>/eval/results/.../home/.pi/...` paths of disposable evaluation homes
+    in six `docs/evaluation/extension-functions-2026-10-17/cursor/` evidence
+    files, which `0.12.1` shipped unchanged.
+  - Doctor reported `packageVersion` `0.13.0`. It exited with `2` because no
+    configuration was set (`config_missing`).
+- Level 2 in the working tree: 160 of 160 checks passed with delivery off and
+  228 of 228 with `--events spool`.
+- Packed-tarball Level 2 from a fresh prefix: 160 of 160 with delivery off and
+  228 of 228 with `--events spool`. The install smoke from another fresh prefix
+  reported `smoke_passed` with version `0.13.0`.
+- In every Level 2 run the real client registrations were unchanged, no process
+  remained, the leak check passed and the disposable directories were removed.
+- Podman-gated writer tests on the candidate: 7 of 7 passed.
+- Bubblewrap-gated sandbox tests (`test/sandbox-shell.bwrap.test.ts`, bubblewrap
+  `0.13.1`): 12 of 12 passed, none skipped.
+- Review: #169 had an independent review of its full diff (same model family as
+  the author) that found no confinement or sandbox escape; its follow-ups were
+  fixed before the merge of #170.
+
+Not established for `0.13.0`: a live session with `shell: "sandboxed"` against
+a real provider, client-target `--verify` through the installed package, which
+follows the upgrade; Level 3.
+
+### v0.12.1 post-release evidence
+
+Recorded on 2026-10-28 for the published release `0.12.1`.
+
+Tag binding: a fresh clone of the annotated tag `v0.12.1` (tag object
+`eecd6dbf0c220ded997c697f281f6b984d9ebf4e`) peels to the merge commit
+`91799f2e84b514110f77c24986d59e72c5ed98e5` of #161, and
+`git describe --tags --exact-match` reports `v0.12.1`. CI on the merge commit
+and on the tag passed on the first attempt.
+
+- Level 1 on the tag clone after `npm ci`, from 14:43 to 14:47 UTC with
+  Node.js `26.12.1` and npm `12.2.1`: typecheck, `build:cli`, the test run
+  (120 files, 3708 passed, 14 skipped, with
+  `NODE_OPTIONS=--unhandled-rejections=strict`), `build` and
+  `git diff --check` exited with `0`, and the status stayed clean.
+- `pi-session-mcp@0.12.1` on npm: 907 files, shasum
+  `58dc7235e0d54d4290d92934d877223e22eec03d`, `gitHead` `cc25693` (the head of
+  #161, whose tree equals the merge commit). `npm pack` of the tag clone gives
+  the same shasum and file count.
+- Published npm package, Level 2 from a fresh prefix: 160 of 160 with delivery
+  off and 228 of 228 with `--events spool`; real registrations and built files
+  unchanged, no process left, leak check passed. Clients: Codex CLI `0.162.1`
+  and Claude Code `2.1.312`. The install smoke on the published package
+  reported `smoke_passed` with version `0.12.1`.
+- The GitHub release `v0.12.1` was published the same day.
+
+Workstation, upgraded from `0.12.0` to `0.12.1` by the release session: Doctor
+reported no error, client-target `--verify` passed for `claude-code:user` and
+`codex:user` (`mcp_verified`, `skill_verified`, and `hook_verified` for the
+wake hook), the open point of the pre-release record, and
+`--writer <name> --verify` passed for all 18 writers (`mcp_verified`).
+
+Operator upgrade of the second machine (Linux) from `0.11.8` to `0.12.1` on
+2026-10-28 from 14:50 UTC, following
+[Installation](installation.md#container-writers), with Node.js `24.22.0`:
+
+- No pi-session-mcp server process and no writer container ran at the start.
+- Both client targets were removed with `0.11.8`, then
+  `npm install -g pi-session-mcp@0.12.1`. Doctor reported every writer
+  `writer_not_ready`, each container workspace `workspace_base_unset` and each
+  writer `writer_git_identity_missing`.
+- Four container repositories with 14 writers were migrated by repeating their
+  provisioning commands with unchanged settings, each first as a dry run
+  (`planned`), then with `--apply`: 2, 4, 4 (operator image, `--cache go`) and
+  4 (operator image) writers. Every writer reported `writer_accepted`.
+- `--finish --apply` of all 14 writers reported `writer_reset`; no work was
+  collected. Doctor then reported no writer or base finding.
+- `--apply` and `--verify` of both client targets passed (`mcp_verified`), and
+  `--writer <name> --verify` passed for all 14 writers. No writer registration
+  and no container remained.
+
+Live checks of #154 and #151 on the workstation, 15:02 to 15:04 UTC, with the
+coding profile `code-deepseek` through the one host registration and wake
+events from the host spool:
+
+- Settings change: a writer whose settings differ is refused with
+  `writer_settings_changed`. Both repositories' writers were collected
+  (`nothing_to_collect`), removed with `--writer <name> --remove` and
+  provisioned again with `--tags reachable` (2 writers) and `--cache uv`
+  (4 writers, operator image with uv `0.13.6`); every writer reported
+  `writer_accepted`.
+- Tags (#154): the writer with `--tags reachable` held 14 tags, the tags of
+  the operator checkout merged into `main`. In the session,
+  `git describe --tags` reported `v0.12.1` and
+  `git show v0.12.0:package.json` read the file at that tag. The writer without
+  the setting held no tags.
+- Identity (#154): an empty commit in the session, without `GIT_AUTHOR_*` or
+  `GIT_COMMITTER_*` and without `--author`, recorded the operator's name as
+  author and committer. `git config user.name` inside the writer failed with
+  exit `4` because `.git/config` is mounted read-only. The collected ref showed
+  the same identity. The test ref was removed afterwards.
+- uv cache (#151): three sessions on the same writer, with `--finish --apply`
+  between the second and the third. In the first, `UV_CACHE_DIR` was
+  `/pi/uv/cache` and empty; `uv sync --frozen` took 1.9 s and left 95,576 KiB
+  in 1,648 files. The second and third sessions found the same size and file
+  count before they ran anything, and `uv sync --frozen --offline` after
+  removing `.venv` took 0.07 s and 0.08 s.
+
+Findings from these checks:
+
+- Reset and finish keep Git-ignored files in the clone, as designed: `.venv`
+  from the first session was still present in the third, after the finish.
+  The opt-in `--clean all` removes them
+  ([#162](https://github.com/plagor44-ux/pi-session-mcp/issues/162)); it is
+  not part of the released `0.12.1`.
+- A provisioning command with changed settings reported `mode_applied` and
+  recorded the new mode although every writer failed with
+  `writer_settings_changed`; Doctor reported no mismatch
+  ([#163](https://github.com/plagor44-ux/pi-session-mcp/issues/163), open).
+
+Not established for `0.12.1`: a busy pool (`writer_unavailable`) and a `base`
+fix round in live use; Level 3; the macOS upgrade.
+
 ### v0.12.1 pre-release acceptance
 
 `v0.12.1` was accepted on 2026-10-28 from 13:12 to 13:17 UTC on its release