pi-session-mcp 0.14.0 → 0.14.1

package/.pi-session-mcp-cli/writer-boundary.js

@@ -6,7 +6,8 @@ import { CONTAINER_EVENTS_DIR, EVENTS_DIR_ENV, writerEventsDir } from "./turn-ev
 import { writerContainerName, writerLabel } from "./writer-fence.js";
 export const NODE_IMAGE_REF = "docker.io/library/node@sha256:c4d5523090a817b7aa86d2111241fdd4f66d1e27782b44160e6aa63b357ecb2d";
 export const IMAGE_PULL_TIMEOUT_MS = 900_000;
-export const BOUNDARY_GIT = "git -c safe.directory=* -c core.fsmonitor=false -c core.hooksPath=/dev/null";
+// Replace refs in a clone are worker-controlled: they could make unexported work look reachable or clean (#193).
+export const BOUNDARY_GIT = "git -c safe.directory=* -c core.fsmonitor=false -c core.hooksPath=/dev/null -c core.useReplaceRefs=false";
 export class BoundaryError extends Error {
     code;
     constructor(code) {

package/.pi-session-mcp-cli/writer-lifecycle.js

@@ -344,7 +344,7 @@ export async function inspectWork(ctx, name) {
     });
     return {
         baseline: head === state.base.commit && refs.length === 1 && refs[0].name === state.base.ref && refs[0].commit === state.base.commit && tree === baseTree,
-        dirty: tree !== headTree, branches: refs.filter(({ name }) => name.startsWith("refs/heads/")),
+        dirty: tree !== headTree, head: head, branches: refs.filter(({ name }) => name.startsWith("refs/heads/")),
         digest: `sha256:${createHash("sha256").update(result.stdout).digest("hex")}`,
     };
 }
@@ -412,10 +412,16 @@ if [ "$tree" != "$(${BOUNDARY_GIT} rev-parse 'HEAD^{tree}')" ]; then
   export GIT_COMMITTER_NAME=pi-writer GIT_COMMITTER_EMAIL=pi-writer@example.invalid
   commit=$(printf '%s\\n' 'WIP collected by pi-session-mcp' | ${BOUNDARY_GIT} commit-tree "$tree" -p HEAD)
   branch=$(${BOUNDARY_GIT} symbolic-ref --short HEAD || printf '%s' "$4")
-  if ${BOUNDARY_GIT} --git-dir=/tmp/scratch show-ref --verify --quiet "refs/heads/$branch-wip"; then
+  # A taken name, or one that conflicts with an exported branch path, is refused rather than aborting the export.
+  if ${BOUNDARY_GIT} --git-dir=/tmp/scratch show-ref --verify --quiet "refs/heads/$branch-wip" \\
+    || ! ${BOUNDARY_GIT} --git-dir=/tmp/scratch update-ref "refs/heads/$branch-wip" "$commit" 2>/dev/null; then
+    printf '%s\\n' ref_name_refused
+  fi
+elif ! ${BOUNDARY_GIT} symbolic-ref -q HEAD >/dev/null 2>&1 && [ -n "$(${BOUNDARY_GIT} rev-list -n 1 HEAD --not --branches)" ]; then
+  # Clean detached HEAD that no branch of the clone reaches: export its commit under a derived name (#193).
+  if ${BOUNDARY_GIT} --git-dir=/tmp/scratch show-ref --verify --quiet "refs/heads/$4-detached" \\
+    || ! ${BOUNDARY_GIT} --git-dir=/tmp/scratch update-ref "refs/heads/$4-detached" "$(${BOUNDARY_GIT} rev-parse --verify HEAD)" 2>/dev/null; then
     printf '%s\\n' ref_name_refused
-  else
-    ${BOUNDARY_GIT} --git-dir=/tmp/scratch update-ref "refs/heads/$branch-wip" "$commit"
   fi
 fi
 if [ -z "$(${BOUNDARY_GIT} --git-dir=/tmp/scratch for-each-ref --format='%(refname)')" ]; then
@@ -450,6 +456,14 @@ fi`;
                 return { status: "failed", code: "writer_collect_incomplete", refs, refused: findings.length, findings };
             }
             const work = await inspectWork(ctx, name);
+            // Defence in depth (#193): whatever the boundary script exported or reported as nothing to collect,
+            // every commit the clone's work refers to must exist as a commit object in the operator checkout
+            // before a digest is recorded.
+            for (const sha of [work.head, ...work.branches.map((branch) => branch.commit)]) {
+                if (sha === undefined || await git(ctx, ["cat-file", "-e", `${sha}^{commit}`], true) === undefined) {
+                    return { status: "failed", code: "writer_collect_incomplete", refs, refused: findings.length, findings };
+                }
+            }
             await writeWriterState(ctx.home, name, { ...state, collected: { digest: work.digest, at: new Date().toISOString() } });
             return { status: "ok", code: refs.length === 0 ? "nothing_to_collect" : "writer_collected", refs, refused: findings.length, findings };
         }

package/CHANGELOG.md

@@ -2,6 +2,45 @@
 
 ## Unreleased
 
+## 0.14.1 — 2026-10-30
+
+Patch release under ADR 0003 for Sprint 12. The MCP tool contract, result
+codes and configuration schema are unchanged. `npm audit` still reports
+`undici` 8.10.2, pinned by Pi SDK 1.4.0, the latest SDK release
+([#120](https://github.com/plagor44-ux/pi-session-mcp/issues/120)).
+
+Sprint 12 fixes three defects that an external audit of `9d9cf8c` reported and
+that were reproduced on that commit
+([Sprint 12](docs/sprints/2026-10-29-s12-audit-fixes.md)). The MCP tool
+contract, result codes and configuration schema are unchanged.
+
+- Read-only sessions no longer load Pi context files (`AGENTS.override.md`,
+  `AGENTS.md`, `AGENTS.MD`, `CLAUDE.md`, `CLAUDE.MD`) from outside the
+  workspace into the model context
+  ([#192](https://github.com/plagor44-ux/pi-session-mcp/issues/192)). Every
+  resource loader of a read-only profile keeps only files whose real path lies
+  inside the workspace's real path, on every reload and before the first
+  provider request, and reads them from that verified path. Behaviour change:
+  context files of directories above the workspace, including a main
+  repository above a linked worktree, are no longer loaded for read-only
+  profiles. Coding profiles are unchanged
+  ([ADR 0013 amendment](docs/adr/0013-hardened-read-only-profiles.md)).
+- Writer collection exports a clean detached `HEAD` whose commit no branch
+  reaches as `<base>-detached`, and records its release digest only when the
+  clone's `HEAD` and every branch commit exist in the operator checkout;
+  otherwise it reports `writer_collect_incomplete`. Before, such a commit was
+  reported as `nothing_to_collect` and finish, reset, recreate and remove
+  discarded it without `--discard`
+  ([#193](https://github.com/plagor44-ux/pi-session-mcp/issues/193)).
+  Clone-side Git, including the writer guard, now ignores replace refs, and a
+  derived `-wip` or `-detached` name that conflicts with an exported branch
+  path is refused instead of aborting the export.
+- The writer relay compares every public capability field of a writer's
+  profile with the host profile before it starts an inner session, including
+  skills, extensions, granted extension tools and shell; a mismatch counts as
+  `settingsChanged`. Before, a writer with a different skill selection was
+  admitted ([#194](https://github.com/plagor44-ux/pi-session-mcp/issues/194)).
+
 ## 0.14.0 — 2026-10-29
 
 Minor release under ADR 0003 for

package/README.md

@@ -30,7 +30,7 @@ It is not the right tool when:
 
 ## Status
 
-The package version is **0.14.0**.
+The package version is **0.14.1**.
 
 [Per-repository execution modes](docs/execution-modes.md) make host writes explicit and block coding on read-only aliases. On container workspaces, the one host `pi-session-mcp` registration leases a rootless-Podman writer per coding session on Linux; no per-writer registrations or tool prefixes are needed ([ADR 0012](docs/adr/0012-leased-writer-pool.md)). Setup provisions, accepts, collects and resets the pool. Starts normally use the workspace default base; fix rounds can pass a short branch `base`. Start/get report `writer` and `base` for collection, and capabilities report configured `writers` and `defaultBase`. Reset, finish and recreate need no reconnect; finish returns the writer to the default base. See the [container upgrade runbook](docs/installation.md#container-writers).
 

package/dist/capabilities.d.ts

@@ -1,6 +1,19 @@
 import type { ConfigurationMetadata } from "./config.js";
 import type { WorkspaceModeEntry } from "./execution-modes.js";
 import type { ConfiguredExecutionProfile } from "./execution-profile.js";
+/** The public capability shape of one profile, exactly as `pi_capabilities_get` publishes it. */
+export declare function projectExecutionProfile({ alias, default: isDefault, permissionProfile, provider, model, thinkingLevel, extensions, grantedExtensionTools, shell, skills }: ConfiguredExecutionProfile): {
+    alias: string;
+    default: boolean;
+    permissionProfile: import("./execution-profile.js").PermissionProfile;
+    provider: string;
+    model: string;
+    thinkingLevel: import("./execution-profile.js").ThinkingLevel;
+    extensions: string[];
+    grantedExtensionTools: string[];
+    shell: "none" | "sandboxed";
+    skills: string[];
+};
 /** Pure projection of the snapshot captured at load time; never reads the configuration file. */
 export declare function projectCapabilities(workspaces: ReadonlyMap<string, string>, executionProfiles: ReadonlyMap<string, ConfiguredExecutionProfile>, configuration: ConfigurationMetadata, workspaceModes?: ReadonlyMap<string, WorkspaceModeEntry>, eventDelivery?: "spool" | "off"): {
     ok: true;

package/dist/capabilities.js

@@ -1,5 +1,21 @@
 import packageMetadata from "../package.json" with { type: "json" };
 const compareAliases = (left, right) => left < right ? -1 : left > right ? 1 : 0;
+/** The public capability shape of one profile, exactly as `pi_capabilities_get` publishes it. */
+export function projectExecutionProfile({ alias, default: isDefault, permissionProfile, provider, model, thinkingLevel, extensions, grantedExtensionTools, shell, skills }) {
+    return {
+        alias,
+        default: isDefault,
+        permissionProfile,
+        provider,
+        model,
+        thinkingLevel,
+        extensions: (extensions ?? []).map((extension) => extension.spec),
+        grantedExtensionTools: [...(grantedExtensionTools ?? [])],
+        // Configured intent only: whether the server's probe succeeds is a start-time fact.
+        shell: shell ?? "none",
+        skills: (skills ?? []).map((skill) => skill.alias),
+    };
+}
 /** Pure projection of the snapshot captured at load time; never reads the configuration file. */
 export function projectCapabilities(workspaces, executionProfiles, configuration, workspaceModes = new Map(), eventDelivery = "off") {
     return {
@@ -18,18 +34,6 @@ export function projectCapabilities(workspaces, executionProfiles, configuration
         }),
         executionProfiles: [...executionProfiles.values()]
             .sort((left, right) => compareAliases(left.alias, right.alias))
-            .map(({ alias, default: isDefault, permissionProfile, provider, model, thinkingLevel, extensions, grantedExtensionTools, shell, skills }) => ({
-            alias,
-            default: isDefault,
-            permissionProfile,
-            provider,
-            model,
-            thinkingLevel,
-            extensions: (extensions ?? []).map((extension) => extension.spec),
-            grantedExtensionTools: [...(grantedExtensionTools ?? [])],
-            // Configured intent only: whether the server's probe succeeds is a start-time fact.
-            shell: shell ?? "none",
-            skills: (skills ?? []).map((skill) => skill.alias),
-        })),
+            .map(projectExecutionProfile),
     };
 }

package/dist/sdk-pi-adapter.d.ts

@@ -74,7 +74,7 @@ export type PromptDisposition = Parameters<NonNullable<PromptOptions["preflightR
  * typecheck (and therefore the Pi SDK canary) instead of being mapped silently.
  */
 export declare function admitsTurn(disposition: PromptDisposition): boolean;
-export declare function createPhase0ResourceLoader(cwd: string, skills?: readonly Skill[]): Promise<{
+export declare function createPhase0ResourceLoader(cwd: string, skills?: readonly Skill[], permissionProfile?: ResolvedExecutionProfile["permissionProfile"]): Promise<{
     resourceLoader: DefaultResourceLoader;
     settingsManager: SettingsManager;
 }>;

package/dist/sdk-pi-adapter.js

@@ -1,6 +1,7 @@
 import { createAgentSession, createAgentSessionFromServices, createAgentSessionRuntime, createAgentSessionServices, createBashToolDefinition, DefaultResourceLoader, getAgentDir, ModelRuntime, SessionManager, SettingsManager, } from "@earendil-works/pi-coding-agent";
+import { readFileSync, realpathSync } from "node:fs";
 import { homedir, userInfo } from "node:os";
-import { join } from "node:path";
+import { isAbsolute, join, relative, sep } from "node:path";
 import { allowedReadRoots, createConfinedReadOnlyTools } from "./confined-tools.js";
 import { PiExtensionError } from "./extension-spec.js";
 import { classifyMcpStartupError, connectSessionMcpTools, } from "./mcp-session-tools.js";
@@ -298,7 +299,7 @@ function isTextBlock(block) {
     return candidate.type === "text" && typeof candidate.text === "string";
 }
 /** Independently validated skills replace package and extension discovery on every reload. */
-function phase0ResourceLoaderOptions(skills) {
+function phase0ResourceLoaderOptions(skills, confinedCwd) {
     // Keep the closure's snapshot private: the SDK may annotate or mutate returned objects.
     const selected = skills.map((skill) => ({ ...skill, sourceInfo: { ...skill.sourceInfo } }));
     return {
@@ -307,6 +308,24 @@ function phase0ResourceLoaderOptions(skills) {
         noPromptTemplates: true,
         noThemes: true,
         noContextFiles: false,
+        ...(confinedCwd === undefined ? {} : {
+            agentsFilesOverride: (current) => ({
+                agentsFiles: current.agentsFiles.flatMap((file) => {
+                    try {
+                        const workspace = realpathSync(confinedCwd), real = realpathSync(file.path);
+                        const path = relative(workspace, real);
+                        if (path === ".." || path.startsWith(`..${sep}`) || isAbsolute(path))
+                            return [];
+                        // Re-read from the verified real path: the SDK read the link before this check.
+                        return [{ path: file.path, content: readFileSync(real, "utf-8").replace(/^\uFEFF/, "") }];
+                    }
+                    catch {
+                        // Unresolvable context files never enter a read-only session's model context.
+                        return [];
+                    }
+                }),
+            }),
+        }),
         systemPrompt: "phase-0-system-prompt-disabled",
         appendSystemPrompt: [],
         systemPromptOverride: () => undefined,
@@ -316,9 +335,9 @@ function phase0ResourceLoaderOptions(skills) {
         themesOverride: () => ({ themes: [], diagnostics: [] }),
     };
 }
-export async function createPhase0ResourceLoader(cwd, skills = []) {
+export async function createPhase0ResourceLoader(cwd, skills = [], permissionProfile) {
     const settingsManager = SettingsManager.inMemory(undefined, { projectTrusted: false });
-    const resourceLoader = new DefaultResourceLoader({ cwd, agentDir: cwd, settingsManager, ...phase0ResourceLoaderOptions(skills) });
+    const resourceLoader = new DefaultResourceLoader({ cwd, agentDir: cwd, settingsManager, ...phase0ResourceLoaderOptions(skills, permissionProfile === "read-only" ? cwd : undefined) });
     await resourceLoader.reload();
     return { resourceLoader, settingsManager };
 }
@@ -367,7 +386,7 @@ export class SdkPiSessionAdapter {
         let resourceLoader;
         let settingsManager;
         try {
-            ({ resourceLoader, settingsManager } = await createPhase0ResourceLoader(input.cwd, skills));
+            ({ resourceLoader, settingsManager } = await createPhase0ResourceLoader(input.cwd, skills, executionProfile.permissionProfile));
         }
         catch {
             throw this.failure(executionProfile, "resource_loader", "pi_session_creation_failed");
@@ -426,7 +445,7 @@ export class SdkPiSessionAdapter {
                 agentDir: cwd,
                 modelRuntime: runtime,
                 settingsManager: SettingsManager.inMemory(undefined, { projectTrusted: false }),
-                resourceLoaderOptions: { ...phase0ResourceLoaderOptions(skills), additionalExtensionPaths: directories },
+                resourceLoaderOptions: { ...phase0ResourceLoaderOptions(skills, executionProfile.permissionProfile === "read-only" ? cwd : undefined), additionalExtensionPaths: directories },
             }));
             this.checkResources(services.resourceLoader, skills, executionProfile, "extension_load");
             const loaded = services.resourceLoader.getExtensions();

package/dist/writer-boundary.d.ts

@@ -2,7 +2,7 @@ import type { CommandRunner } from "./client-adapters/types.js";
 import { writerPaths, type WriterState } from "./writer-state.js";
 export declare const NODE_IMAGE_REF = "docker.io/library/node@sha256:c4d5523090a817b7aa86d2111241fdd4f66d1e27782b44160e6aa63b357ecb2d";
 export declare const IMAGE_PULL_TIMEOUT_MS = 900000;
-export declare const BOUNDARY_GIT = "git -c safe.directory=* -c core.fsmonitor=false -c core.hooksPath=/dev/null";
+export declare const BOUNDARY_GIT = "git -c safe.directory=* -c core.fsmonitor=false -c core.hooksPath=/dev/null -c core.useReplaceRefs=false";
 type WriterPaths = ReturnType<typeof writerPaths>;
 export declare class BoundaryError extends Error {
     readonly code: "image_unavailable" | "clone_verification_failed" | "writer_fenced";

package/dist/writer-boundary.js

@@ -6,7 +6,8 @@ import { CONTAINER_EVENTS_DIR, EVENTS_DIR_ENV, writerEventsDir } from "./turn-ev
 import { writerContainerName, writerLabel } from "./writer-fence.js";
 export const NODE_IMAGE_REF = "docker.io/library/node@sha256:c4d5523090a817b7aa86d2111241fdd4f66d1e27782b44160e6aa63b357ecb2d";
 export const IMAGE_PULL_TIMEOUT_MS = 900_000;
-export const BOUNDARY_GIT = "git -c safe.directory=* -c core.fsmonitor=false -c core.hooksPath=/dev/null";
+// Replace refs in a clone are worker-controlled: they could make unexported work look reachable or clean (#193).
+export const BOUNDARY_GIT = "git -c safe.directory=* -c core.fsmonitor=false -c core.hooksPath=/dev/null -c core.useReplaceRefs=false";
 export class BoundaryError extends Error {
     code;
     constructor(code) {

package/dist/writer-guard.js

@@ -13,7 +13,7 @@ const guardSchema = z.object({
 }).strict();
 const run = promisify(execFile);
 const defaultGit = async (cwd) => {
-    const git = async (...args) => (await run("git", ["-c", "core.hooksPath=/dev/null", "-c", "core.fsmonitor=false", ...args], { cwd, timeout: 10_000, encoding: "utf8" })).stdout;
+    const git = async (...args) => (await run("git", ["-c", "core.hooksPath=/dev/null", "-c", "core.fsmonitor=false", "-c", "core.useReplaceRefs=false", ...args], { cwd, timeout: 10_000, encoding: "utf8" })).stdout;
     const [status, head, refs] = await Promise.all([
         git("status", "--porcelain=v1", "-uall"),
         git("rev-parse", "HEAD"),

package/dist/writer-lifecycle.d.ts

@@ -66,6 +66,7 @@ export declare function provisionWriter(ctx: WriterContext, input: {
 export declare function inspectWork(ctx: WriterContext, name: string): Promise<{
     baseline: boolean;
     digest: string;
+    head?: string;
     branches: readonly {
         name: string;
         commit: string;

package/dist/writer-lifecycle.js

@@ -344,7 +344,7 @@ export async function inspectWork(ctx, name) {
     });
     return {
         baseline: head === state.base.commit && refs.length === 1 && refs[0].name === state.base.ref && refs[0].commit === state.base.commit && tree === baseTree,
-        dirty: tree !== headTree, branches: refs.filter(({ name }) => name.startsWith("refs/heads/")),
+        dirty: tree !== headTree, head: head, branches: refs.filter(({ name }) => name.startsWith("refs/heads/")),
         digest: `sha256:${createHash("sha256").update(result.stdout).digest("hex")}`,
     };
 }
@@ -412,10 +412,16 @@ if [ "$tree" != "$(${BOUNDARY_GIT} rev-parse 'HEAD^{tree}')" ]; then
   export GIT_COMMITTER_NAME=pi-writer GIT_COMMITTER_EMAIL=pi-writer@example.invalid
   commit=$(printf '%s\\n' 'WIP collected by pi-session-mcp' | ${BOUNDARY_GIT} commit-tree "$tree" -p HEAD)
   branch=$(${BOUNDARY_GIT} symbolic-ref --short HEAD || printf '%s' "$4")
-  if ${BOUNDARY_GIT} --git-dir=/tmp/scratch show-ref --verify --quiet "refs/heads/$branch-wip"; then
+  # A taken name, or one that conflicts with an exported branch path, is refused rather than aborting the export.
+  if ${BOUNDARY_GIT} --git-dir=/tmp/scratch show-ref --verify --quiet "refs/heads/$branch-wip" \\
+    || ! ${BOUNDARY_GIT} --git-dir=/tmp/scratch update-ref "refs/heads/$branch-wip" "$commit" 2>/dev/null; then
+    printf '%s\\n' ref_name_refused
+  fi
+elif ! ${BOUNDARY_GIT} symbolic-ref -q HEAD >/dev/null 2>&1 && [ -n "$(${BOUNDARY_GIT} rev-list -n 1 HEAD --not --branches)" ]; then
+  # Clean detached HEAD that no branch of the clone reaches: export its commit under a derived name (#193).
+  if ${BOUNDARY_GIT} --git-dir=/tmp/scratch show-ref --verify --quiet "refs/heads/$4-detached" \\
+    || ! ${BOUNDARY_GIT} --git-dir=/tmp/scratch update-ref "refs/heads/$4-detached" "$(${BOUNDARY_GIT} rev-parse --verify HEAD)" 2>/dev/null; then
     printf '%s\\n' ref_name_refused
-  else
-    ${BOUNDARY_GIT} --git-dir=/tmp/scratch update-ref "refs/heads/$branch-wip" "$commit"
   fi
 fi
 if [ -z "$(${BOUNDARY_GIT} --git-dir=/tmp/scratch for-each-ref --format='%(refname)')" ]; then
@@ -450,6 +456,14 @@ fi`;
                 return { status: "failed", code: "writer_collect_incomplete", refs, refused: findings.length, findings };
             }
             const work = await inspectWork(ctx, name);
+            // Defence in depth (#193): whatever the boundary script exported or reported as nothing to collect,
+            // every commit the clone's work refers to must exist as a commit object in the operator checkout
+            // before a digest is recorded.
+            for (const sha of [work.head, ...work.branches.map((branch) => branch.commit)]) {
+                if (sha === undefined || await git(ctx, ["cat-file", "-e", `${sha}^{commit}`], true) === undefined) {
+                    return { status: "failed", code: "writer_collect_incomplete", refs, refused: findings.length, findings };
+                }
+            }
             await writeWriterState(ctx.home, name, { ...state, collected: { digest: work.digest, at: new Date().toISOString() } });
             return { status: "ok", code: refs.length === 0 ? "nothing_to_collect" : "writer_collected", refs, refused: findings.length, findings };
         }

package/dist/writer-relay.js

@@ -2,6 +2,7 @@ import { constants } from "node:fs";
 import { open } from "node:fs/promises";
 import { Client } from "@modelcontextprotocol/client";
 import { z } from "zod";
+import { projectExecutionProfile } from "./capabilities.js";
 import { ChildStdioTransport } from "./child-stdio-transport.js";
 import { PiSessionCreationError, WriterUnavailableError } from "./pi-adapter.js";
 import { RegistryError } from "./session-registry.js";
@@ -71,6 +72,16 @@ const creationCodes = new Set([
     "extension_not_installed", "extension_version_mismatch", "extension_load_failed", "extension_tool_conflict",
     "extension_tool_missing", "skill_load_failed", "sandbox_unavailable", "pi_session_creation_failed",
 ]);
+const exactFields = ["permissionProfile", "provider", "model", "thinkingLevel", "shell"];
+const setFields = ["skills", "extensions", "grantedExtensionTools"];
+const sameSet = (left, right) => {
+    const a = new Set(left), b = new Set(right);
+    return a.size === left.length && b.size === right.length && a.size === b.size && [...a].every(value => b.has(value));
+};
+/** Admission compares every public capability field; a duplicate on either side is a mismatch. */
+function samePublishedProfile(host, inner) {
+    return exactFields.every(key => host[key] === inner[key]) && setFields.every(key => sameSet(host[key], inner[key]));
+}
 class InnerError extends Error {
     code;
     constructor(code) {
@@ -306,7 +317,7 @@ export class WriterRelayAdapter {
                 const capabilities = await connection.call("pi_capabilities_get", {}, capabilitiesSchema, remaining(), input.signal);
                 const inner = capabilities.executionProfiles.find(profile => profile.alias === input.executionProfile.alias);
                 const host = this.options.executionProfiles.get(input.executionProfile.alias);
-                if (!host || !inner || ["permissionProfile", "provider", "model", "thinkingLevel"].some(key => inner[key] !== host[key])) {
+                if (!host || !inner || !samePublishedProfile(projectExecutionProfile(host), inner)) {
                     counts.settingsChanged++;
                     continue;
                 }

package/docs/acceptance.md

@@ -2598,6 +2598,195 @@ image) reported `writer_accepted` from 09:48 to 09:51 UTC. Client-target
 all 14 writers. Doctor reported no error, only `workspace_mode_unset` for one
 workspace without a mode.
 
+### v0.14.1 pre-release acceptance
+
+`v0.14.1` was accepted on 2026-10-30 from 06:04 to 06:15 UTC on its release
+candidate `a239610`, on Linux (`x64`) with Node.js `26.12.1`, npm `12.2.1`,
+Codex CLI `0.162.1` and Claude Code `2.1.314`. Level 2 passed in the working
+tree and for the packed tarball, each with delivery off and with delivery on.
+Level 1 passed except `npm audit`. Later commits on the release pull request
+change only this record.
+
+The patch release ships Sprint 12 (#192, #193, #194) from `main` at `d9a47f5`;
+the candidate adds only the version, the changelog heading and the roadmap
+line. The MCP tool contract, result codes and configuration schema are
+unchanged. The source changes were accepted on the branch before the merge, see
+[Sprint 12 candidate acceptance](#sprint-12-candidate-acceptance-2026-10-30),
+including Level 3.
+
+- Level 1 in the checkout of the candidate after `npm ci`: every command exited
+  with `0`, except `npm audit`; `git status --short` printed nothing.
+  - The test run, with `NODE_OPTIONS=--unhandled-rejections=strict`, reported
+    141 files, 4044 passed and 14 skipped, and no unhandled error.
+  - `npm audit` and `npm audit --omit=dev` exited with `1` and name only the
+    known `undici` 8.10.2 finding through `@earendil-works/pi-coding-agent`
+    1.4.0, the latest SDK release, with eight advisories
+    ([#120](https://github.com/plagor44-ux/pi-session-mcp/issues/120)).
+  - `npm pack` listed 933 files (tarball shasum
+    `47cf66a3856530112c11095d07cb05b7ab9892f4`, identical in three packs). A
+    scan of the unpacked files for private names, hosts and the maintainer's
+    home path found none.
+  - Doctor reported `packageVersion` `0.14.1`. It exited with `2` because no
+    configuration was set (`config_missing`).
+- Level 2 in the working tree: 160 of 160 checks passed with delivery off and
+  228 of 228 with `--events spool`.
+- Packed-tarball Level 2 from a fresh prefix: 160 of 160 with delivery off and
+  228 of 228 with `--events spool`. The install smoke from another fresh prefix
+  reported `smoke_passed` with version `0.14.1`.
+- In every Level 2 run the real client registrations were unchanged, no process
+  remained, the leak check passed and the disposable directories were removed.
+- Podman-gated writer tests on the candidate (Podman `6.1.4`): 8 of 8 passed
+  (7 lifecycle tests, including the detached-`HEAD` export of #193, and 1
+  boundary test).
+- Bubblewrap-gated sandbox tests (`test/sandbox-shell.bwrap.test.ts`, bubblewrap
+  `0.13.1`): 12 of 12 passed, none skipped.
+
+Not established for `0.14.1` beyond the Sprint 12 record: a Level 3 cycle on
+the release candidate itself, and the published-release Level 2 and upgrades,
+which follow after publishing.
+
+### Sprint 12 candidate acceptance (2026-10-30)
+
+Recorded on 2026-10-29 and 2026-10-30 for the unreleased branch
+`fix/s12-audit-findings` ([Sprint 12](sprints/2026-10-29-s12-audit-fixes.md),
+#192, #193, #194). No release, tag or npm publish.
+
+- Level 1 on the final source `9426682` in a separate detached worktree with
+  Node.js `26.12.1`: `npm ci`, typecheck, `build:cli`, the test run (530 files,
+  4044 passed, 14 skipped, 0 failed, no unhandled error, with
+  `NODE_OPTIONS=--unhandled-rejections=strict`), `build` and
+  `git diff --check 9d9cf8c..HEAD` exited with `0`. The same on the earlier
+  candidate `896e29d`: 4043 passed, 0 failed.
+- Real rootless Podman with the pinned Node image (git `2.39.5`):
+  `test/writer-lifecycle.podman.test.ts` 7 of 7, including the new clean
+  detached-HEAD case, which fails against the source of `9d9cf8c`. In the image,
+  `core.useReplaceRefs=false` makes a graft-hidden detached commit visible
+  again.
+- Level 2 on `npm pack` of `896e29d`, installed into a fresh prefix below the
+  home directory: 160 of 160 with delivery off and 228 of 228 with
+  `--events spool`; real registrations and built files unchanged, no process
+  left, path-leak scan 0 hits. Clients: Codex CLI `0.162.1` and Claude Code
+  `2.1.312`. The two later commits change the guard's Git arguments and a
+  regular-expression spelling; Level 2 was not repeated for them.
+- Live profile change (item D), on an expendable test configuration: a
+  candidate with the new read-only profile `review-sonnet`
+  (`anthropic/claude-sonnet-5-5`), Doctor without error, probe dry run, one
+  probe turn (`probe_passed`), timestamped backup and atomic replacement,
+  Doctor, then real use by a fresh server for the R1 and final reviews; rolled
+  back to the backup afterwards, Doctor without error. No production
+  configuration or writer was touched.
+- Live container writer (items B and C), with the packed candidate, an
+  expendable configuration and a synthetic repository: profile `s12-code`
+  (`deepseek/deepseek-flash`, coding, skill `pi-session-implementation`),
+  one probe turn (`probe_passed`); `--repo s12-probe --mode container
+  --profiles s12-code --writers 1 --apply` reported `writer_provisioned` and
+  `writer_accepted`, `--writer s12-probe-w1 --verify` `mcp_verified`. A real
+  relayed coding session completed its task; `--collect --apply` imported
+  `refs/remotes/writer-s12-probe-w1/s12-live-c`, whose commit passed the
+  oracle (4 of 4 tests), and `--finish --apply` reported `writer_reset`. With
+  the host profile's skills then changed, a start failed with
+  `writer_unavailable`, reason `none_admitted`, counts
+  `settingsChanged: 1`, and collection afterwards found `nothing_to_collect`.
+  After `--writer s12-probe-w1 --remove` and the provisioning request again,
+  the writer was accepted and verified and a start succeeded. Rolled back:
+  writer removed, configuration, repository and prefix deleted.
+- Level 3, ten-task cycle, on the final source `9426682` (`dist/main.js`
+  SHA-256 `ab93e3a932b1d5147dcbb48bbb85d9442c2214e486101f8d427360b99672cfdb`)
+  from a separate detached checkout, with a temporary credential-free
+  configuration (`l3-read` read-only and `l3-code` coding, both
+  `deepseek/deepseek-flash`), synthetic fixtures, events off, one probe turn
+  per profile as preflight. Claude Code `2.1.312` ran as `claude -p` with a
+  per-invocation `--mcp-config`, `--strict-mcp-config` and
+  `--model claude-sonnet-5-5`; Codex CLI `0.162.1` as `codex exec
+  --ignore-user-config` with `-c mcp_servers.*` overrides. Both clients could
+  wait with `sleep` between polls.
+  - Cycle 1 was not accepted: 5 of 10. The worker ignored a requested
+    ordering in both follow-ups (T2), refused the abort task's essay prompt
+    within about 1.5 seconds so that nothing was left to abort (T5), and the
+    Codex coding snapshot could not be written from the Codex sandbox (T3). A
+    path hit came from the worker's `assistantText`, not from server
+    metadata. No Pi Session MCP defect was found; the cycle is kept unchanged
+    with its own pre-registration.
+  - Cycle 2, with a new pre-registration before its first task (order-free
+    LOW oracle, a long deterministic listing as the abort prompt, snapshots
+    inside the controller directory, the leak scan separating server metadata
+    from `assistantText`): 10 of 10. Read-only fixture digests unchanged; both
+    coding snapshots pass their oracle and the fixture tests and show only the
+    allowed files; both abort tasks show running, abort, `aborted`, close, an
+    empty `pi_session_list` and a fresh `idle` session. Zero leak hits, also in
+    `assistantText`; no server or client process before or 10 seconds after any
+    invocation. Polls per turn: Claude Code 1 to 2, Codex 2 to 4. Deviation:
+    the Codex sandbox refused to spawn `git`, so the Codex snapshots' status
+    lists were derived from the barrier snapshot trees against `HEAD`.
+  The cycle-2 gate holds.
+
+Not established: a release of these fixes, the operator rollout on either
+machine, macOS, and #120.
+
+### v0.14.0 post-release evidence
+
+Recorded on 2026-10-29 for the published release `0.14.0`.
+
+Tag binding: a fresh clone of the annotated tag `v0.14.0` (tag object
+`f3a8b088a85fd5825c3256f4a7950ba051cbf388`) peels to the merge commit
+`fd4fdeacf9d02c04b6fd89314f7ec819b5506ed9` of #190, and
+`git describe --tags --exact-match` reports `v0.14.0`. CI on the merge commit
+(run 40928709705) and on the tag (run 40929602738) passed on the first attempt.
+The tag was created after the npm package had been published; the package
+records `gitHead` `d904fed`, the head of #190, whose tree (`3ae966b`) is
+identical to the merge commit's.
+
+- Level 1 on the tag clone after `npm ci`, from 18:18 to 18:20 UTC with
+  Node.js `26.12.1` and npm `12.2.1`: typecheck, `build:cli`, the test run
+  (139 files, 4005 passed, 14 skipped, with
+  `NODE_OPTIONS=--unhandled-rejections=strict`), `build` and
+  `git diff --check` exited with `0`, and the status stayed clean. Doctor
+  reported `packageVersion` `0.14.0` and exited with `2` because no
+  configuration was set (`config_missing`).
+- `pi-session-mcp@0.14.0` on npm: 932 files, shasum
+  `579cc111a7aa62987b5f35e79b34b69853c8a0e3`. It was published by the
+  maintainer; `npm pack` of the tag clone gives the same shasum and file count.
+- Published npm package, Level 2 from a fresh prefix, 18:19 to 18:21 UTC:
+  160 of 160 with delivery off and 228 of 228 with `--events spool`; real
+  registrations and built files unchanged, no process left, leak check passed.
+  Clients: Codex CLI `0.162.1` and Claude Code `2.1.312`. The install smoke on
+  the published package reported `smoke_passed` with version `0.14.0`.
+- The GitHub release `v0.14.0` was published the same day.
+
+Operator upgrade of the workstation from `0.13.1` to `0.14.0` on 2026-10-29
+from 18:33 UTC, following
+[Installation](installation.md#container-writers): no Pi session of this
+controller was open; other controller sessions without a coding session stayed
+open and need a reconnect. Both client targets were removed with `0.13.1`, then
+`npm install -g pi-session-mcp@0.14.0`. Doctor reported only
+`writer_not_ready` for the 18 writers. A dry run of the first provisioning
+command with unchanged settings reported `mode_unchanged` and
+`writer_planned`; with `--apply`, five container repositories with 18 writers
+(2 with `--tags reachable`, 4, 4 with `--cache go`, 4 with base `dev`, 4 with
+`--cache uv`, three of them with operator images) reported `writer_accepted`
+from 18:34 to 18:37 UTC. Client-target `--apply` and `--verify` passed for
+`claude-code:user` and `codex:user` (`mcp_verified`, `skill_verified` for both
+controller skills, and `hook_verified` for the wake hook); `--writer <name>
+--verify` passed for all 18 writers. Doctor reported no error, only the known
+`workspace_gitfile` and `workspace_mode_unset` warnings of the worktree
+aliases.
+
+Operator upgrade of the second machine (Linux) from `0.13.1` to `0.14.0` on
+2026-10-29 from 18:38 UTC, with Node.js `24.22.0` and the same steps; one
+controller session's server process stayed open and needs a reconnect. Both
+client targets were removed with `0.13.1`, then
+`npm install -g pi-session-mcp@0.14.0`; Doctor reported only
+`writer_not_ready` for the 14 writers. With `--apply`, four container
+repositories with 14 writers (4, 2, 4 with an operator image and `--cache go`,
+4 with an operator image) reported `writer_accepted` from 18:39 to 18:42 UTC.
+Client-target `--apply` and `--verify` passed for `claude-code:user` and
+`codex:user` (`mcp_verified`, `skill_verified` for both controller skills), and
+`--writer <name> --verify` passed for all 14 writers. Doctor reported no
+error, only `workspace_mode_unset` for one workspace without a mode.
+
+Not established for `0.14.0` after the upgrade: a coding session through a
+re-accepted writer, an agent-driven profile change end to end, and Level 3.
+
 ### v0.14.0 pre-release acceptance
 
 `v0.14.0` was accepted on 2026-10-29 from 17:56 to 18:01 UTC on its release

package/docs/adr/0012-leased-writer-pool.md

@@ -161,12 +161,16 @@ base.
   In both cases the host server closes that launcher and tries the next
   candidate. The inner writer guard stays the authority for baseline admission
   inside the boundary.
-- Before the inner start the relay compares the requested profile's entry in
-  the writer's validated `pi_capabilities_get` (permission profile, provider,
-  model, thinking level) with the host's configured profile and moves on with
-  `writer_settings_changed` on any difference, so a writer never runs an
-  outdated version of a host profile. The launcher cannot do this check: it
-  starts before the profile is known.
+- Before the inner start the relay compares every public capability field of
+  the requested profile's entry in the writer's validated `pi_capabilities_get`
+  with the host's configured profile: `permissionProfile`, `provider`, `model`,
+  `thinkingLevel` and `shell` exactly, and `skills`, `extensions` and
+  `grantedExtensionTools` as sets. A mismatch or a missing entry counts as
+  `settingsChanged`, starts no inner session and moves on to the next
+  candidate, so a writer never runs an outdated version of a host profile. The
+  launcher cannot do this check: it starts before the profile is known.
+  (Amended 2026-10-29, #194: the comparison covers every public capability
+  field, not only permission profile, provider, model and thinking level.)
 - If no candidate is admitted, the start fails with `writer_unavailable`, a
   content-free reason and content-free counts. `none_ready`: no writer of the
   workspace is ready, migrated and has a recorded acceptance (whether that

package/docs/adr/0013-hardened-read-only-profiles.md

@@ -145,6 +145,36 @@ directly after `grantedExtensionTools`. This is configured intent only.
   MCP tools and the granted extension tools. A profile with granted extension
   tools cannot have a sandboxed shell.
 
+### Amendment 2026-10-29: context files
+
+Issue #192. Previously every resource loader kept the SDK behaviour: Pi
+context files (`AGENTS.override.md`, `AGENTS.md`, `AGENTS.MD`, `CLAUDE.md`,
+`CLAUDE.MD`) were loaded from the session directory and every ancestor
+directory, and a context file reached through a symlink was followed to its
+target, so a read-only session also loaded context from outside the workspace.
+
+New rule: for **read-only profiles** every resource loader keeps only context
+files whose real path lies inside the workspace's real path, on every reload
+and before the first provider request. A symlinked context file that resolves
+outside the workspace, a dangling one, and the context files of ancestor
+directories above the workspace (including a main repository above a linked
+worktree) are not loaded for read-only profiles; the linked worktree's own file
+inside the workspace is. Coding profiles keep the SDK behaviour (the working
+directory and its ancestors).
+
+The filter runs on the SDK's result, after the SDK has picked the first
+existing name per directory. If that file is dropped, the directory contributes
+no context file: an `AGENTS.override.md` that resolves outside the workspace
+also hides an `AGENTS.md` beside it. This fails closed. A kept file's content
+is read again from its verified real path, so a link swapped after the SDK
+read cannot bring in outside content.
+
+Why: the read roots of this ADR. Section 1 confines the read tools of
+read-only profiles to the workspace and the skill directories; context files
+are model input rather than tool reads, and before this amendment they were the
+one channel through which content from outside those roots still reached a
+read-only session.
+
 ## Contract change and versioning
 
 The capabilities field `shell`, the start error `sandbox_unavailable` and the

package/docs/adr/0014-profile-probe-and-model-catalog.md

@@ -1,6 +1,6 @@
 # ADR 0014: Profile probe and offline model catalog
 
-**Status:** Accepted (2026-10-29); unreleased. Issue #139.
+**Status:** Accepted (2026-10-29); released in 0.14.0. Issue #139.
 
 ## Context
 

package/docs/execution-modes.md

@@ -182,10 +182,24 @@ pi-session-mcp-setup --writer my-project-w1 --finish --apply
 
 Collection exports changed branches via a bundle into the operator's checkout as
 `refs/remotes/writer-<name>/<branch>`. Uncommitted/untracked work is captured as a
-synthetic `<branch>-wip` commit. These refs are **untrusted until reviewed**;
+synthetic `<branch>-wip` commit. A clean detached HEAD whose commit no branch in
+the clone reaches is exported as `<base>-detached` (for example `main-detached`,
+imported as `refs/remotes/writer-<name>/main-detached`); a dirty detached HEAD
+keeps the `<base>-wip` export. A `<base>-detached` or `<branch>-wip` name that
+an exported branch already takes, or that conflicts with an exported branch's
+path (such as a branch `main-detached/topic`), is refused and makes collection
+incomplete (`writer_collect_incomplete`); the other branches are still
+exported. Clone-side Git ignores replace refs. These refs are **untrusted until reviewed**;
 setup does not merge or cherry-pick them. Collection does not change the clone.
-Only a complete export records a digest authorizing later destructive cleanup;
-new work invalidates that authorization. Stashes are not exported as branches:
+Only a complete export records a digest authorizing later destructive cleanup,
+and the digest is recorded only when the clone's HEAD commit and every branch
+commit exist in the operator checkout; otherwise collection is incomplete
+(`writer_collect_incomplete`) and no digest is recorded. This includes the base
+commit: if the operator checkout no longer has it (for example after a deleted
+base branch and garbage collection), collect and finish fail this way even on a
+pristine writer, without refused names; fetch the base again or resolve with
+`--reset --discard --apply`. New work invalidates
+that authorization. Stashes are not exported as branches:
 resolve any needed stash inside the boundary before collection.
 
 `--finish` collects, then resets a persistent writer or recreates an ephemeral
@@ -234,6 +248,14 @@ reset updates admission without a server restart. A missing/unusable runtime or
 stale/unready writer launches a refusal MCP server: all eight tools return the
 sanitized refusal, with no host fallback. See [Tool contracts](tool-contracts.md).
 
+Before the relay starts an inner session it compares every public capability
+field of the writer's profile with the host profile: `permissionProfile`,
+`provider`, `model`, `thinkingLevel` and `shell` exactly, and `skills`,
+`extensions` and `grantedExtensionTools` as sets. A mismatch or a missing
+entry counts as `settingsChanged`, starts no inner session and moves on to the
+next writer; if no writer is admitted, the start fails with
+`writer_unavailable` and reason `none_admitted`.
+
 ## Reports and finding codes
 
 Reports use sanitized targets `modes/workspace/<alias>` or `writer/<alias>/<name>`

package/docs/isolation-setup.md

@@ -225,12 +225,18 @@ Git metadata can redirect reads to worker-controlled configuration. Setup checks
 clone layout and runs clone-side Git only in throwaway no-network containers.
 Collect with `--writer <name> --collect --apply`, then review
 `refs/remotes/writer-<name>/<branch>` in your own checkout, with dirty work at
-`<branch>-wip`. Imported refs are untrusted until reviewed.
+`<branch>-wip` and a clean detached HEAD at `<base>-detached` (for example
+`main-detached`). Imported refs are untrusted until reviewed.
 
 After taking over the result and closing its coding session, run
 `pi-session-mcp-setup --writer <name> --finish --apply` before another task.
 It collects then resets (persistent) or recreates (ephemeral). If any branch name
-was refused, collection is incomplete and finish stops. Rename inside the writer
+was refused, collection is incomplete and finish stops; a `<base>-detached` or
+`<branch>-wip` name that an exported branch takes or whose path it conflicts
+with is refused the same way. The release digest is
+recorded only when the clone's HEAD commit and every branch commit exist in the
+operator checkout, otherwise collection is `writer_collect_incomplete` and no
+digest is recorded. Rename inside the writer
 or have the operator explicitly resolve loss with `--reset --discard --apply`.
 Finish returns persistent and ephemeral writers to the workspace default base.
 No reconnect is needed after finish, reset or recreate: each session starts a

package/docs/roadmap.md

@@ -41,6 +41,15 @@ mean they are implemented or that their gates passed.
   profile), and the shipped controller skill `pi-session-profiles`, with which a
   controlling agent creates, changes or retires profiles without a guided
   dialog. Recorded in [ADR 0014](adr/0014-profile-probe-and-model-catalog.md).
+- 2026-10-30: [Sprint 12](sprints/2026-10-29-s12-audit-fixes.md) fixes three
+  audit findings on `9d9cf8c` in one pull request, released in patch release
+  0.14.1: read-only context files confined to the workspace
+  ([#192](https://github.com/plagor44-ux/pi-session-mcp/issues/192)), detached
+  `HEAD` collection and the release-digest gate
+  ([#193](https://github.com/plagor44-ux/pi-session-mcp/issues/193)) and the
+  full writer profile comparison in the relay
+  ([#194](https://github.com/plagor44-ux/pi-session-mcp/issues/194)). Levels 1
+  to 3 passed for the candidate. #120 still waits for a Pi SDK release.
 
 The explicit 2026-10-17 user request adds a bounded development-only
 [token-footprint measurement](sprints/2026-10-17-token-footprint.md), following

package/docs/sprints/2026-10-24-s8-writer-migration.md

@@ -4,9 +4,11 @@ Planning basis: main `47b8d26` (Sprint 7 merged), installed release 0.11.2.
 Tracking: [#79](https://github.com/plagor44-ux/pi-session-mcp/issues/79),
 prerequisite [#121](https://github.com/plagor44-ux/pi-session-mcp/issues/121).
 
-Status: **planned**. The maintainer made the choices on 2026-10-25; see
-[Decisions](#decisions-2026-10-25). Nothing below has been changed on any
-machine yet.
+Status: **in progress** — steps 1–4 are done (pilot `pi-session-mcp`,
+`node-app`, the operator images, go-app) and steps 5–7 are open; see
+[Progress (2026-10-27)](#progress-2026-10-27) and the v0.11.6 and v0.11.8
+post-release evidence in [Acceptance](../acceptance.md). The maintainer made
+the choices on 2026-10-25; see [Decisions](#decisions-2026-10-25).
 
 ## Mandate
 

package/docs/sprints/2026-10-29-s12-audit-fixes.md

@@ -0,0 +1,172 @@
+# Sprint 12: audit findings F1–F3
+
+Planning basis: main `9d9cf8ca49e6e34dc16be6846b9324ad26ad92b9` (merge of PR
+#191), published 0.14.0, 2026-10-29. Entry: an external audit of that commit
+reported three defects with reproductions. This file plans the work and records
+it as it lands; it claims nothing that its progress log does not state with
+evidence.
+
+Branch: `fix/s12-audit-findings`, one pull request, no release.
+
+## Preflight (2026-10-29)
+
+- main and `origin/main` at `9d9cf8c`; open issues #79, #120, #144; no open
+  pull requests; clean operator checkout; no other worktree in use.
+- Doctor: no errors; only the known `workspace_gitfile` and
+  `workspace_mode_unset` warnings of the host worktree aliases.
+- Level 1 on `9d9cf8c` in a clean detached worktree on the workstation:
+  `npm ci`, `npm run typecheck`, `npm run build:cli`,
+  `NODE_OPTIONS=--unhandled-rejections=strict npm test` (527 files, 4005
+  passed, 14 skipped, 0 failed, no unhandled error) and `npm run build` all exit
+  0. The audit's cloud run of the same commit reported 70 failed tests and four
+  unhandled errors; they do not reproduce here, so they are not attributed to
+  the product. The audit environment is not available to separate them further.
+- Both `pi-session-mcp` writers were at `baseline` on an older main and were
+  reset without `--discard` to `9d9cf8c` (`writer_reset`).
+
+## Findings, re-checked on `9d9cf8c`
+
+| Id | Issue | Reproduction by the controller | Result |
+| --- | --- | --- | --- |
+| F1 | [#192](https://github.com/plagor44-ux/pi-session-mcp/issues/192) | Synthetic workspace whose `AGENTS.md` links to an outside marker file; `PI_CODING_AGENT_DIR` isolated; faux provider | Confined `read` refuses; `getAgentsFiles()` contains the marker; the real `SdkPiSessionAdapter` sends it as `project_instructions` to the faux provider. Confirmed. |
+| F2 | [#193](https://github.com/plagor44-ux/pi-session-mcp/issues/193) | Real Git; boundary scripts run by an injected runner | Detached `HEAD` commit, clean tree: remove before collect `writer_uncollected`; collect `nothing_to_collect`, 0 refs, digest stored; commit absent from the operator checkout; finish `writer_reset`; remove `writer_removed`. Feature-branch counterproof exports the commit. Confirmed; not yet a Podman result. |
+| F3 | [#194](https://github.com/plagor44-ux/pi-session-mcp/issues/194) | Real relay over stdio, fake writer server fixture | Identical profiles admitted; model drift refused with `settingsChanged`; host `skills: ["pi-session-implementation"]` against inner `skills: []` admitted. Confirmed. |
+
+## Decisions taken at planning
+
+- F1: for read-only profiles every resource loader keeps only context files
+  whose real path lies inside the workspace's real path. Context files of
+  ancestor directories above the workspace, including a main repository above a
+  linked worktree, are no longer loaded for read-only profiles: they are outside
+  the read roots of ADR 0013. Coding profiles keep the SDK's behaviour.
+- F2: smallest fix inside the existing collection contract; the export name for
+  a detached `HEAD` is a documented behaviour addition, no new public code.
+- F3: the relay compares every public capability field a writer reports, with
+  set semantics for skills, extensions and granted extension tools.
+- #120: still waiting for an SDK release (see below); no override, no
+  `npm audit fix --force`.
+- No release on this branch.
+
+## Roles and routing
+
+`pi_capabilities_get` and `--list-models` on 2026-10-29 settle which requested
+models exist as authenticated profiles:
+
+| Requested | Profile used | Status |
+| --- | --- | --- |
+| GPT 6.1 Sol | `code` (openai `gpt-6.1-sol`) | available |
+| GPT 6.1 Terra | none | unavailable: the catalog lists no `gpt-6.1-terra`; not substituted with another version |
+| DeepSeek | `code-deepseek` (`deepseek-flash`) | available |
+| GLM 5.3 | `review-glm`, `code-glm` (`zai-glm-5-3`) | available |
+| Mistral Large 4 | `code-mistral` (`mistral-large-4`) | available |
+| Sonnet 5.5 | no profile; provider `anthropic` authenticated | added only in an expendable test configuration (acceptance item D) |
+| Grok 4.7 | `review-grok` (xai `grok-4.7`) | available: the R2 turn completed |
+
+agy (Antigravity CLI, Gemini) plans the work packages, dependencies and review
+routing; Pi workers implement and review; the controller integrates, verifies
+and is the only editor of this file, the roadmap, `docs/acceptance.md` and the
+CHANGELOG.
+
+## Tasks
+
+| Id | Task | Route | Change area |
+| --- | --- | --- | --- |
+| P1 | Work packages, dependencies, review routing | agy | none |
+| P2 | Independent regression test plan | `review-glm` | none |
+| T1 | F1, #192 | `pi-session-mcp` writer, `code` | `src/sdk-pi-adapter.ts`, `src/confined-tools.ts`, tests |
+| T2 | F2, #193 | `pi-session-mcp` writer, `code-mistral` (agy's fallback for the unavailable Terra) | `src/writer-lifecycle.ts`, tests |
+| T3 | F3, #194 | `pi-session-mcp` writer, `code-deepseek` | `src/writer-relay.ts`, `src/capabilities.ts`, tests, relay fixture |
+| R1 | Security review of T1 and T3 | Sonnet 5.5, read-only | none |
+| R2 | Adversarial review of T2 and the Git lifecycle checks | `review-grok` | none |
+| D1 | Documentation and issue reconciliation (#120, ADR 0014 status, Sprint 8 status, #79, #144) | `pi-session-mcp` writer, `code-mistral`; controller as editor | `docs/`, `skills/pi-session-orchestration/SKILL.md` |
+| A | Live acceptance A–E | controller | evaluation record |
+
+## Progress log
+
+Recorded as work lands on the branch.
+
+- 2026-10-29: issues #192, #193 and #194 filed; this plan written before any
+  implementation.
+- P1: agy (`gemini-3.8-flash-high`, plan mode) proposed the packages,
+  `code-mistral` as the F2 author in place of Terra, Sonnet for R1 and Grok
+  with a fallback for R2, and at most three review rounds. Adopted.
+- P2: `review-glm` wrote the regression test plan; its edge cases (absent
+  against empty set fields, real-Git collection, a Podman case) went into the
+  task prompts.
+- T3 (`code-deepseek`, writer w2): collected as
+  `writer-pi-session-mcp-w2/fix/f3-relay-profile-drift`; the controller ran the
+  new tests against the old source (7 fail) and the fix (all pass); integrated
+  as `230e60e`, writer finished (`writer_reset`).
+- T1 (`code`, writer w1): collected as
+  `writer-pi-session-mcp-w1/fix/f1-context-files`; new tests against the old
+  source 9 of 12 fail, with the fix 148 of 148 pass; integrated as `a0a7d87`,
+  writer finished. The container-writer suite showed only the eight known
+  lock and hook timeouts (`override-lock`, `skill-customize-concurrency`,
+  `wake-hook`).
+- R1 (Sonnet 5.5, read-only, through the test configuration of item D):
+  `NON_BLOCKING_ONLY`. Fixed by the controller: kept context files are read
+  again from their verified real path (`79e8a7a`), the set comparison is
+  symmetric with a duplicated-entry test (`3e14279`); the shadowing case is
+  covered by a test and documented. Not changed: synchronous `realpathSync` in
+  the loader override (the SDK hook is synchronous) and the trust in the
+  writer's own capability report, which is the boundary the relay already
+  assumes.
+- T2 (`code-mistral`, writer w2): collected as
+  `writer-pi-session-mcp-w2/fix/f2-detached-collect`; the new real-Git tests
+  against the old source 3 of 8 fail, with the fix 8 of 8 pass, and the F2
+  reproduction now gets `writer_collected`; integrated as `236ca28`, writer
+  finished. The controller added the Podman case (`6ee7add`): with real
+  rootless Podman and the pinned Node image it passes, against the old source
+  it fails.
+- D1 (`code-mistral`, writer w1): collected as
+  `writer-pi-session-mcp-w1/docs/s12-reconcile`; split by issue into
+  `f5a9712`, `58e0e7b`, `17845ff` and `ebe3c52`. Controller edits: the
+  shadowing and re-read rule in the ADR 0013 amendment, and the relay wording
+  (a mismatch counts as `settingsChanged`; `writer_unavailable` with
+  `none_admitted` only when no writer is admitted). Writer finished.
+- R2 (`review-grok`, Grok 4.7, read-only): `NON_BLOCKING_ONLY`. Verified by
+  the controller and fixed in `1dfe4da`: a derived `-wip` or `-detached` name
+  that conflicts with an exported branch path aborted the export under
+  `set -eu` (reproduced with a branch `main-detached/topic`); a worker-made
+  `git replace --graft` made an unexported detached commit look reachable
+  (Grok's variant with a plain replacement did not reproduce, the graft did);
+  the reachability gate now also runs on `nothing_to_collect`. Recorded as
+  limits, not changed: an index-only staged change that the worktree reverted
+  (pre-existing), a base name of 192 to 200 characters (fails closed), and a
+  runner that reports a fetch it did not do (outside the threat model).
+- Final integration review (Sonnet 5.5, read-only, on `896e29d`):
+  `NON_BLOCKING_ONLY`. Fixed: the in-boundary guard probe now ignores replace
+  refs too (`9426682`, with a test that fails without it), the BOM pattern is an
+  escape (`5d9f15b`), and execution modes names the pruned-base case of the
+  digest gate. Not changed: `inspectWork.head` stays optional because required
+  would break type-checked mocks outside this change.
+- Acceptance: see
+  [Sprint 12 candidate acceptance](../acceptance.md#sprint-12-candidate-acceptance-2026-10-30).
+  Level 1 green on `9426682`; Level 2 green on the packed `896e29d`; live items
+  B, C and D passed on expendable configurations and were rolled back; the
+  Level 3 ten-task cycle 2 passed (10 of 10) after cycle 1 failed on fixture and
+  harness design (5 of 10, kept unchanged).
+
+## Results
+
+| Finding | Status | Commits | Evidence |
+| --- | --- | --- | --- |
+| F1 #192 | fixed | `a0a7d87`, `79e8a7a`, `5d9f15b`; docs `f5a9712` | `test/read-only-context-files.test.ts` (fails on `9d9cf8c`), faux-provider context check, R1 and final review |
+| F2 #193 | fixed | `236ca28`, `6ee7add`, `1dfe4da`, `9426682`; docs `58e0e7b`, `896e29d` | real-Git collect tests, Podman test, guard test (each fails on the source before), R2 and final review |
+| F3 #194 | fixed | `230e60e`, `3e14279`; docs `17845ff` | `test/writer-relay.test.ts` drift tests (fail on `9d9cf8c`), live refusal with `settingsChanged`, R1 and final review |
+
+Remaining risk: #120 is unchanged. `npm audit --omit=dev` on 2026-10-29 still
+reports `undici` 8.10.2 (high) through `@earendil-works/pi-coding-agent` 1.4.0
+(moderate), eight advisories fixed in `undici` >= 8.12.2; the only offered fix
+is a semver-major downgrade. No override and no `npm audit fix --force`.
+
+Kept open: #79 (Sprint 8 steps 5 to 7 are not done), #120 and #144 (no macOS
+claim). The sandbox resource limits of ADR 0013 are the follow-up issue
+[#195](https://github.com/plagor44-ux/pi-session-mcp/issues/195), not part of
+this sprint.
+
+Cleanup: all controller Pi sessions closed; both `pi-session-mcp` writers
+finished (`writer_reset`); the test writer `s12-probe-w1` removed; expendable
+configurations, the synthetic repository, the pack prefix and the
+controller's worktrees removed.
+

package/docs/threat-model.md

@@ -16,7 +16,16 @@ Pi Session MCP trusts the local process that launches and speaks MCP over inheri
   (arguments the SDK would rewrite, such as a leading `@` or `~`, a `file:`
   URL, Unicode spaces or NUL, are refused so both resolve the same path), and
   the `*Operations` hooks of `read`, `grep` and `ls` check the absolute path
-  again. `rg` and `fd` do not follow symlinks during traversal. A profile with
+  again. `rg` and `fd` do not follow symlinks during traversal. For read-only
+  profiles the resource loader likewise keeps only Pi context files
+  (`AGENTS.override.md`, `AGENTS.md`, `AGENTS.MD`, `CLAUDE.md`, `CLAUDE.MD`)
+  whose real path lies inside the workspace's real path, on every reload and
+  before the first provider request: a symlinked context file that resolves
+  outside the workspace, a dangling one and the context files of ancestor
+  directories above the workspace (including a main repository above a linked
+  worktree) are not loaded, while the linked worktree's own file inside the
+  workspace is. Coding profiles keep the SDK behaviour (the working directory
+  and its ancestors). A profile with
   `shell: "sandboxed"` also gets `bash`, run as `/usr/bin/bwrap` (fixed path,
   root-owned and not group- or world-writable, no `PATH` lookup) with
   `--unshare-all`, `--disable-userns`, a cleared environment, no network, `/usr`

package/docs/tool-contracts.md

@@ -40,7 +40,7 @@ records name the package version and the build they ran on, see
 ```json
 {
   "ok": true,
-  "server": { "name": "pi-session-mcp", "version": "0.14.0" },
+  "server": { "name": "pi-session-mcp", "version": "0.14.1" },
   "configuration": {
     "fingerprint": "sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
     "reloadPolicy": "restart-required"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-session-mcp",
-  "version": "0.14.0",
+  "version": "0.14.1",
   "description": "Local stdio MCP server for controlled Pi coding-agent sessions",
   "license": "MIT",
   "keywords": [

package/skills/pi-session-orchestration/SKILL.md

@@ -122,7 +122,7 @@ You integrate. Workers never integrate each other's changes. Resolve conflicts b
 
 After taking over the result and closing its coding session, before the next task:
 
-1. Run `pi-session-mcp-setup --writer <name> --collect --apply` from the operator environment. Review the collected refs in the operator's checkout: `refs/remotes/writer-<name>/<branch>`, with uncommitted work as `<branch>-wip`. They are untrusted until reviewed. Integrate only verified work yourself.
+1. Run `pi-session-mcp-setup --writer <name> --collect --apply` from the operator environment. Review the collected refs in the operator's checkout: `refs/remotes/writer-<name>/<branch>`, with uncommitted work as `<branch>-wip` and a clean detached HEAD as `<base>-detached`. They are untrusted until reviewed. Integrate only verified work yourself.
 2. Run `pi-session-mcp-setup --writer <name> --finish --apply`. It collects again, then resets a persistent writer or recreates an ephemeral writer. Do not reuse it until this succeeds. A refused branch name makes collection incomplete and finish stops: ask the operator to resolve it by renaming inside the boundary or explicitly discarding with `--reset --discard --apply`. Finish returns it to the workspace default base. No reconnect is needed after reset, finish or recreate. A setup operation on a writer held by a session fails with `writer_busy` after a short wait; close the session and allow launcher cleanup to finish.
 3. A coding start needs the writer's clone at its baseline, even after a complete collection; otherwise it fails with the controller-action code for uncollected work in [references/start-errors.md](references/start-errors.md). To let a fresh session continue from collected work, for example after a failed turn or for a review fix round, create a local branch at the collected ref and run `pi-session-mcp-setup --writer <name> --reset --base <branch> --apply`, then call `pi_session_start` on `pi-session-mcp` with the coding profile and `base: "<branch>"`. Read `writer` from that result for collection. Default starts cannot use a writer moved to the fix branch.
 4. Never run Git inside the writer's clone as the host user, including direct fetch from that clone. Use setup's bundle collection and inspect the imported refs in your own checkout. Never discard unreviewed work just to admit the next task.