pi-session-mcp 0.6.4 → 0.7.0

package/dist/setup-process.js

@@ -1,10 +1,24 @@
 import { spawn } from "node:child_process";
-import { lstatSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { lstatSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 const DEFAULT_TIMEOUT = 10_000;
 const DEFAULT_MAX = 65_536;
 const ABORT_GROUP_CLEANUP_TIMEOUT = 2_000;
 const GUARDIAN_START_TIMEOUT = 5_000;
+let platformModule;
+/**
+ * Source-mode harnesses import this file through Node type stripping, which
+ * cannot map a static `./setup-platform.js` import to its `.ts` source.
+ */
+function loadSetupPlatform() {
+    platformModule ??= import(import.meta.url.endsWith(".ts") ? "./setup-platform.ts" : "./setup-platform.js");
+    return platformModule;
+}
+async function currentProcessTable() {
+    const platform = await loadSetupPlatform();
+    const name = platform.currentSetupPlatform();
+    return name ? platform.createProcessTable(name) : undefined;
+}
 /** Kill a detached process and every descendant in its process group. */
 function terminateProcessGroup(child, signal) {
     if (child.pid === undefined)
@@ -21,51 +35,16 @@ function terminateProcessGroup(child, signal) {
     }
     catch { /* already exited */ }
 }
-function processGroupState(child) {
-    if (child.pid === undefined || process.platform !== "linux")
-        return "unknown";
-    const group = child.pid;
-    try {
-        for (const entry of readdirSync("/proc", { withFileTypes: true })) {
-            if (!entry.isDirectory() || !/^\d+$/.test(entry.name))
-                continue;
-            try {
-                const stat = readProcStat(Number(entry.name));
-                if (stat.pgrp === group && stat.state !== "Z")
-                    return "alive";
-            }
-            catch (error) {
-                if (error.code !== "ENOENT")
-                    return "unknown";
-            }
-        }
-    }
-    catch {
-        return "unknown";
-    }
-    return "gone";
-}
-function readProcStat(pid) {
-    const line = readFileSync(`/proc/${pid}/stat`, "utf8").trim();
-    const close = line.lastIndexOf(") ");
-    const state = line[close + 2];
-    if (close < 3 || !state || !/^[A-Za-z]$/.test(state) || line[close + 3] !== " ")
-        throw new Error("process_stat_invalid");
-    const fields = line.slice(close + 4).trim().split(/\s+/);
-    const pgrp = Number(fields[1]);
-    if (!Number.isSafeInteger(pgrp) || pgrp < 0)
-        throw new Error("process_group_invalid");
-    return { pgrp, state };
-}
 const delay = (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds));
 /** Runs only an explicit executable/argv pair, with bounded output and termination. */
 export function createProcessRunner(options = {}) {
     const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT;
     const maxOutputBytes = options.maxOutputBytes ?? DEFAULT_MAX;
-    return { run(command, args, signal) {
+    return { async run(command, args, signal) {
             const effectiveSignal = options.signal && signal ? AbortSignal.any([options.signal, signal]) : options.signal ?? signal;
-            if (process.platform !== "linux")
-                return Promise.resolve({ exitCode: 126, stdout: "", stderr: "" });
+            const table = await currentProcessTable();
+            if (!table)
+                return { exitCode: 126, stdout: "", stderr: "" };
             return new Promise((resolve) => {
                 const child = spawn(command, [...args], { stdio: ["ignore", "pipe", "pipe"], env: options.env, detached: process.platform !== "win32" });
                 let stdout = "";
@@ -92,18 +71,26 @@ export function createProcessRunner(options = {}) {
                     clearTimeout(killTimer); if (!timedOut && hardTimer)
                     clearTimeout(hardTimer); if (groupPoll)
                     clearTimeout(groupPoll); resolve({ exitCode, stdout: overflow ? Buffer.from(stdout).subarray(0, maxOutputBytes).toString("utf8") : stdout, stderr: overflow ? "output_limit" : stderr }); };
+                let groupCheck = false;
                 const finishAfterGroup = (successCode) => {
-                    if (done)
+                    if (done || groupCheck)
                         return;
-                    if (processGroupState(child) === "gone") {
-                        finish(successCode);
-                        return;
-                    }
-                    if (Date.now() >= groupDeadline) {
-                        finish(126);
-                        return;
-                    }
-                    groupPoll = setTimeout(() => finishAfterGroup(successCode), 10);
+                    groupCheck = true;
+                    const group = child.pid;
+                    void (group === undefined ? Promise.resolve("unknown") : table.groupState(group)).then((state) => {
+                        groupCheck = false;
+                        if (done)
+                            return;
+                        if (state === "gone") {
+                            finish(successCode);
+                            return;
+                        }
+                        if (Date.now() >= groupDeadline) {
+                            finish(126);
+                            return;
+                        }
+                        groupPoll = setTimeout(() => finishAfterGroup(successCode), table.pollMs);
+                    });
                 };
                 const abort = () => { if (done)
                     return; aborted = true; groupDeadline = Date.now() + ABORT_GROUP_CLEANUP_TIMEOUT; terminateProcessGroup(child, "SIGTERM"); killTimer = setTimeout(() => { terminateProcessGroup(child, "SIGKILL"); finishAfterGroup(125); }, 100); };
@@ -137,6 +124,7 @@ export function createProcessRunner(options = {}) {
 /** Starts the local MCP server with only the controlled configuration environment. */
 export function createMcpStdioLauncher(options) {
     return async (signal) => {
+        const table = await currentProcessTable();
         const child = spawn(options.nodePath, [options.entryPath], { stdio: ["pipe", "pipe", "pipe"], env: { PI_SESSION_MCP_CONFIG: options.configPath }, detached: process.platform !== "win32" });
         const max = options.maxFrameBytes ?? DEFAULT_MAX;
         let buffer = "";
@@ -194,33 +182,35 @@ export function createMcpStdioLauncher(options) {
                 await delay(100);
                 terminateProcessGroup(child, "SIGKILL");
                 const childClosed = await waitForClose(1_000);
+                const group = child.pid;
+                const groupState = async () => table && group !== undefined ? table.groupState(group) : "unknown";
                 const groupDeadline = Date.now() + 1_000;
-                while (processGroupState(child) === "alive" && Date.now() < groupDeadline)
-                    await delay(10);
-                if (!childClosed || processGroupState(child) !== "gone")
+                let state = await groupState();
+                while (state !== "gone" && Date.now() < groupDeadline) {
+                    await delay(table?.pollMs ?? 10);
+                    state = await groupState();
+                }
+                if (!childClosed || state !== "gone")
                     throw new Error("mcp_process_cleanup_failed");
             },
         };
     };
 }
 /**
- * Acquires the Linux kernel fence and starts the transaction guardian. The
- * guardian inherits the locked file description, so parent death cannot release
- * the fence while a client mutation or descendant is still live.
+ * Starts the transaction guardian with the kernel fence held. On Linux the
+ * trusted util-linux `flock` locks the caller's open file description first;
+ * on macOS the caller passes a descriptor from `openLockedDarwin`, which is
+ * locked at open time. The guardian inherits the locked file description, so
+ * parent death cannot release the fence while a client mutation or
+ * descendant is still live.
  */
 export async function acquireSetupGuardian(lockFd, timeoutMs, signal, validateFence) {
-    if (process.platform !== "linux")
+    const platform = await loadSetupPlatform();
+    const platformName = platform.currentSetupPlatform();
+    if (!platformName)
         throw new Error("platform_unsupported");
-    const flockPath = ["/usr/bin/flock", "/bin/flock"].find((candidate) => {
-        try {
-            const file = statSync(candidate);
-            return file.isFile() && file.uid === 0 && (file.mode & 0o022) === 0 && (file.mode & 0o111) !== 0;
-        }
-        catch {
-            return false;
-        }
-    });
-    if (!flockPath)
+    const flockPath = platformName === "linux" ? ["/usr/bin/flock", "/bin/flock"].find((candidate) => platform.isTrustedSystemBinary(candidate)) : undefined;
+    if (platformName === "linux" && !flockPath)
         throw new Error("ownership_lock_unavailable");
     const modulePath = fileURLToPath(import.meta.url);
     const guardianPath = fileURLToPath(new URL(modulePath.endsWith(".ts") ? "./setup-command-guardian.ts" : "./setup-command-guardian.js", import.meta.url));
@@ -231,34 +221,36 @@ export async function acquireSetupGuardian(lockFd, timeoutMs, signal, validateFe
     catch {
         throw new Error("ownership_lock_unavailable");
     }
-    const waitSeconds = String(Math.ceil(Math.max(1_000, Math.min(timeoutMs, 120_000)) / 1_000));
-    let locker;
-    try {
-        locker = spawn(flockPath, ["-E", "75", "-w", waitSeconds, "3"], {
-            stdio: ["ignore", "ignore", "ignore", lockFd],
-            detached: true,
-        });
-    }
-    catch {
-        throw new Error("ownership_lock_unavailable");
-    }
-    const stopAcquisition = () => { if (locker.pid !== undefined) {
+    if (flockPath) {
+        const waitSeconds = String(Math.ceil(Math.max(1_000, Math.min(timeoutMs, 120_000)) / 1_000));
+        let locker;
         try {
-            process.kill(-locker.pid, "SIGKILL");
+            locker = spawn(flockPath, ["-E", "75", "-w", waitSeconds, "3"], {
+                stdio: ["ignore", "ignore", "ignore", lockFd],
+                detached: true,
+            });
+        }
+        catch {
+            throw new Error("ownership_lock_unavailable");
+        }
+        const stopAcquisition = () => { if (locker.pid !== undefined) {
+            try {
+                process.kill(-locker.pid, "SIGKILL");
+            }
+            catch { /* already gone */ }
+        } };
+        if (signal?.aborted)
+            stopAcquisition();
+        signal?.addEventListener("abort", stopAcquisition, { once: true });
+        try {
+            await new Promise((resolve, reject) => {
+                locker.once("error", () => reject(new Error("ownership_lock_unavailable")));
+                locker.once("close", (code) => code === 0 ? resolve() : reject(new Error(code === 75 ? "ownership_lock_busy" : signal?.aborted ? "operation_aborted" : "ownership_lock_unavailable")));
+            });
+        }
+        finally {
+            signal?.removeEventListener("abort", stopAcquisition);
         }
-        catch { /* already gone */ }
-    } };
-    if (signal?.aborted)
-        stopAcquisition();
-    signal?.addEventListener("abort", stopAcquisition, { once: true });
-    try {
-        await new Promise((resolve, reject) => {
-            locker.once("error", () => reject(new Error("ownership_lock_unavailable")));
-            locker.once("close", (code) => code === 0 ? resolve() : reject(new Error(code === 75 ? "ownership_lock_busy" : signal?.aborted ? "operation_aborted" : "ownership_lock_unavailable")));
-        });
-    }
-    finally {
-        signal?.removeEventListener("abort", stopAcquisition);
     }
     if (signal?.aborted)
         throw new Error("operation_aborted");

package/dist/setup.js

@@ -254,7 +254,8 @@ export async function immutableReleaseBinding(packageRoot) {
         throw new Error("release_version_mismatch");
     const runtimeRoot = join(packageRoot, "dist");
     const runtimeFiles = await listRuntimeFiles(runtimeRoot);
-    for (const required of ["main.js", "setup-command-guardian.js"]) {
+    // The guardian loads setup-platform.js at runtime, so it is mandatory too.
+    for (const required of ["main.js", "setup-command-guardian.js", "setup-platform.js"]) {
         if (!runtimeFiles.includes(required))
             throw new Error("release_entry_missing");
         const entry = await lstat(join(runtimeRoot, required));

package/dist/stdout-guard-install.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Installed when this module is evaluated. `main.ts` imports it first, so the guard is
+ * in place before any other module, the Pi SDK or an extension, can write to stdout.
+ */
+export declare const stdoutGuard: import("./stdout-guard.js").StdoutGuard;

package/dist/stdout-guard-install.js

@@ -0,0 +1,6 @@
+import { installStdoutGuard } from "./stdout-guard.js";
+/**
+ * Installed when this module is evaluated. `main.ts` imports it first, so the guard is
+ * in place before any other module, the Pi SDK or an extension, can write to stdout.
+ */
+export const stdoutGuard = installStdoutGuard();

package/dist/stdout-guard.d.ts

@@ -0,0 +1,20 @@
+import { Writable } from "node:stream";
+export interface StdoutGuardOptions {
+    readonly stream?: NodeJS.WriteStream;
+    readonly console?: Pick<Console, "log" | "info" | "debug">;
+    readonly report?: (line: string) => void;
+    readonly intervalMs?: number;
+    readonly onExit?: (flush: () => void) => void;
+}
+export interface StdoutGuard {
+    /** The only writer that reaches the real stdout: hand it to the MCP transport. */
+    readonly transportStdout: Writable;
+    /** Writes the pending suppression counts to stderr. */
+    flush(): void;
+}
+/**
+ * Reserves stdout for MCP frames. Any other write, an extension's `console.log`
+ * included, is dropped; stderr gets only a byte and write count, never the content,
+ * because the content may hold prompts or secrets.
+ */
+export declare function installStdoutGuard(options?: StdoutGuardOptions): StdoutGuard;

package/dist/stdout-guard.js

@@ -0,0 +1,72 @@
+import { format } from "node:util";
+/**
+ * Reserves stdout for MCP frames. Any other write, an extension's `console.log`
+ * included, is dropped; stderr gets only a byte and write count, never the content,
+ * because the content may hold prompts or secrets.
+ */
+export function installStdoutGuard(options = {}) {
+    const stream = options.stream ?? process.stdout;
+    const target = options.console ?? console;
+    const report = options.report ?? ((line) => { process.stderr.write(line); });
+    const intervalMs = options.intervalMs ?? 1_000;
+    const realWrite = stream.write.bind(stream);
+    const realEnd = stream.end.bind(stream);
+    let bytes = 0;
+    let writes = 0;
+    let timer;
+    const flush = () => {
+        if (timer) {
+            clearTimeout(timer);
+            timer = undefined;
+        }
+        if (writes === 0)
+            return;
+        report(JSON.stringify({ level: "warning", event: "foreign_stdout_suppressed", bytes, writes }) + "\n");
+        bytes = 0;
+        writes = 0;
+    };
+    const suppress = (chunk, encoding) => {
+        bytes += typeof chunk === "string"
+            ? Buffer.byteLength(chunk, typeof encoding === "string" ? encoding : "utf8")
+            : chunk instanceof Uint8Array ? chunk.byteLength : 0;
+        writes += 1;
+        if (!timer) {
+            timer = setTimeout(flush, intervalMs);
+            timer.unref();
+        }
+    };
+    stream.write = ((chunk, encodingOrCallback, callback) => {
+        suppress(chunk, encodingOrCallback);
+        const done = typeof encodingOrCallback === "function" ? encodingOrCallback : callback;
+        if (typeof done === "function")
+            queueMicrotask(() => { done(); });
+        return true;
+    });
+    // A foreign `end` must neither leak content nor close the real stdout, which would break every later frame.
+    stream.end = ((...args) => {
+        const [first, second] = args;
+        if (typeof first === "string" || first instanceof Uint8Array)
+            suppress(first, second);
+        const done = args.find((arg) => typeof arg === "function");
+        if (typeof done === "function")
+            queueMicrotask(() => { done(); });
+        return stream;
+    });
+    for (const method of ["log", "info", "debug"]) {
+        target[method] = (...args) => { suppress(`${format(...args)}\n`); };
+    }
+    // Write-through, not a buffering wrapper: queued frames must reach stdout before `process.exit`,
+    // and a wrapper `Writable` would hold all but one of them until a later tick.
+    const transportStdout = new Proxy(stream, {
+        get(target, property) {
+            if (property === "write")
+                return realWrite;
+            if (property === "end")
+                return realEnd;
+            const value = Reflect.get(target, property, target);
+            return typeof value === "function" ? value.bind(target) : value;
+        },
+    });
+    (options.onExit ?? ((exitFlush) => { process.once("exit", exitFlush); }))(flush);
+    return { transportStdout, flush };
+}

package/docs/acceptance.md

@@ -124,6 +124,54 @@ that checkout with Doctor reporting the release version, and confirms that the
 manifests and built runtime files are byte-identical before and after the
 client cycles.
 
+### macOS
+
+macOS uses the same isolation, sequence and pass criteria, with the additions
+below. A run for Claude Code is recorded under [Status](#status). macOS is
+CI-tested, and it has not passed Level 2 for Codex.
+
+- **Environment.** Record:
+  - the macOS version and architecture (`sw_vers`, `uname -m`);
+  - the Node.js version;
+  - the Codex CLI and Claude Code versions.
+- **Disposable home.** It must be on the APFS volume type of `/`. A directory
+  below the user's home qualifies.
+  - For an ownership directory on another filesystem, `--apply`, `--verify`,
+    `--rollback` and `--remove` fail closed with `failed (operation_failed)`
+    and exit `1`.
+  - Keep the Codex home outside both `$TMPDIR` (normally below `/var/folders`)
+    and `/tmp`, for the reason given under [Isolation](#isolation).
+- **Before the sequence:** run `npm run --silent doctor`.
+- **Lock contention.** After step 9, start two `--apply` runs for
+  `claude-code:user:pi-session-mcp` at the same time.
+  - One run reports `ok (applied)`. The other waits for the lock, then
+    reports `unchanged (already_equivalent)`.
+  - Both exit with `0`.
+  - A following `--remove` reports `ok (removed)`.
+  - A waiting run that reports `failed (operation_failed)` with exit `1` did
+    not get the lock within the 30 s acquisition bound. That counts as a
+    failure of the run.
+- **Interruption.** Start `--apply` for one target and press Ctrl-C while it
+  runs.
+  - The run exits with `130` and reports `operation_interrupted`.
+  - Afterwards `ps -A -o pid=,command=` lists no `claude mcp` or `codex mcp`
+    command and no `setup-main.js` or `setup-command-guardian.js` process of
+    the build under test.
+  - A following `--apply` reports one of three outcomes, depending on where
+    the interrupt landed:
+    - it reconciles the pending record (`ok (pending_recovered)`);
+    - it applies again (`ok (applied)`);
+    - it finds the registration already owned
+      (`unchanged (already_equivalent)`).
+  - A following `--remove` reports `ok (removed)`.
+  - If the operation completes before the interrupt arrives, record that and
+    repeat. An interrupt that never lands is not a pass.
+- **Processes.** Check that no process remains with `ps` instead of `/proc`.
+
+The evidence record names the build (commit or tag), the environment above,
+every command with its exit status, and the sanitized JSON results. It
+contains no paths, environment values or secrets.
+
 ## Level 3: live two-client acceptance
 
 Live acceptance delegates real work from Codex and from Claude Code to Pi
@@ -213,6 +261,18 @@ external MCP grants, and client restart or resume.
 A narrower live check can cover a single path. It must state its scope and does
 not count as a ten-task cycle.
 
+## Pi extension live check
+
+Manual, on a machine with Pi, `pi-cursor-sdk@0.5.3` and a stored Cursor key. Run it from a working tree (`npm run build`, then `node dist/main.js`) with a temporary configuration, passed through `PI_SESSION_MCP_CONFIG`, whose profile names `"extensions": ["npm:pi-cursor-sdk@0.5.3"]` and a Cursor model from Pi's catalog.
+
+1. `pi_session_start`, a prompt answered with "PONG", `pi_turn_get` completed, `pi_session_close`.
+2. Two parallel sessions of that profile, each completing a prompt.
+3. After close, no Cursor child process of the server remains.
+4. stderr shows no `foreign_stdout_suppressed` storm and no stdout frame fails to parse.
+5. Record how the Cursor local runtime starts its child processes (inherited or piped stdio).
+
+Record date, source commit, versions and outcome under Status. No secret, path or prompt content goes into the record.
+
 ## Evidence rules
 
 - Record only sanitized evidence: statuses, booleans, counts, durations,
@@ -269,3 +329,159 @@ Before its release, `v0.6.4` passed Level 1 and the working-tree Level 2 on its
 release candidate, with Codex CLI `0.162.0` and Claude Code `2.1.296`. Its
 server entry point `dist/main.js` is byte-identical to that of `4d333da` and of
 `v0.6.3`.
+
+After its release, `v0.6.4` passed Level 1 on a fresh clone of its tag. It also
+passed Level 2 as published release and as published npm package, with Codex
+CLI `0.162.0` and Claude Code `2.1.296`, on 2026-10-10. The installed
+`pi-session-mcp-doctor` reported a healthy package when run from an unrelated
+working directory.
+
+macOS: `setup` supports macOS from the change that tracks #32. That change is
+tested in CI on macOS 15 and macOS 26 (Apple silicon) next to Linux.
+
+On 2026-10-11, the build of `d89740c`, the head of the pull request branch,
+passed the working-tree Level 2 on a real Mac with Claude Code as the only
+client:
+- Environment: macOS 26.7.1 (`25G241`) on `arm64`, Node.js `22.23.3` and Claude
+  Code `2.1.294`. The disposable home was on the APFS data volume that the
+  root volume belongs to.
+- Level 1 on that checkout: `npm ci`, `npm run typecheck`, `npm run build`,
+  `npm run build:cli` and `npm test` exited with `0`. The test run reported 531
+  passed and 23 skipped. The skipped tests are the 21 Linux `/proc` fixture
+  tests, the Linux-only lock-inode replacement test and the probe-only
+  controller output test. `npm audit` reported 0 vulnerabilities, and
+  `git diff --check` reported nothing. `git status --short` printed nothing
+  before the evidence was written.
+- Doctor with the acceptance configuration reported no error.
+- All three Claude Code targets (`user`, `project` and `local`) completed the
+  nine-step sequence. Every step reported the expected overall status, finding
+  and exit status.
+- After the sequences the `pi-session-mcp` registration was absent, the sentinel
+  was still present and the ownership record set was empty. The ownership
+  directory had mode `0700` and the ownership file mode `0600`. No server,
+  setup or guardian process of the build remained, and the digest of the real
+  Claude Code registrations was unchanged. No report contained a path, an
+  environment value or a secret.
+- Lock contention: two simultaneous `--apply` runs for
+  `claude-code:user:pi-session-mcp` finished within 5 s. One reported
+  `ok (applied)` and the other `unchanged (already_equivalent)`. Both exited
+  with `0`, and the following `--remove` reported `ok (removed)`.
+- Interruption: SIGINT was sent to the process group of a running `--apply`
+  after 0.2 s, 0.5 s and 0.9 s. Each run exited with `130` and reported
+  `operation_interrupted`. None left a `claude mcp` command or a setup or
+  guardian process behind. In each case the following `--apply` reported
+  `ok (applied)` and the following `--remove` reported `ok (removed)`.
+
+This run does not cover:
+- Codex, which was not installed on the machine, so macOS has not passed
+  setup acceptance for Codex.
+- A Ctrl-C keypress in an interactive terminal. A script sent the signal from a
+  shell without a terminal.
+- The `pending_recovered` and `already_equivalent` outcomes after an interrupt.
+  The following `--apply` reported `applied` in every case.
+- Intel Macs, the published-release and published-package variants, and
+  Level 3.
+
+On 2026-10-11 the same build also passed a narrower live check on that Mac:
+- Scope: Claude Code `2.1.294` as the only client, with Pi SDK `1.1.0` on a
+  local `qwen3.6-35b-a3b-splash` model served by LM Studio. The server was the
+  build of `d89740c`: the sources are identical to it, and `dist/main.js` has
+  the SHA-256 `a69bfec2f9f161b74a6d7b067fda9b76d94c294170bc59a771a79e3f29a7123c`.
+- Method: three sequential headless invocations, one per task group, with a
+  temporary per-invocation MCP configuration (`--strict-mcp-config`), a
+  credential-free configuration with one `read-only` and one `coding` profile,
+  and a disposable Pi agent directory. The client could run `sleep` between
+  polls. The plan, prompts, oracles and fixture digests were fixed before the
+  first invocation, and no task was repeated.
+- Preflight: one bounded request to the model returned HTTP `200` in about 1 s.
+  The loaded model was the same and idle before and after every invocation, and
+  nothing was loaded or unloaded.
+- Read-only analysis with a same-session follow-up: both turns ended
+  `completed`. The first answer contained the expected marker, and the second
+  answer was exactly the expected number. The fixture digest (path, mode and
+  content) was identical before and after.
+- Bounded coding change with a same-session follow-up: both turns ended
+  `completed`. The oracle passed on a snapshot taken between the turns and on
+  the final workspace, and that snapshot did not yet contain the second turn's
+  change. Only the one allowed file differed, with no added or removed file and
+  unchanged modes.
+- Abort and recovery: the turn was `running`, then `aborted` after
+  `pi_session_abort`. `pi_session_close` succeeded, `pi_session_list` returned
+  no session, and a fresh session started `idle` and closed.
+- Counts: `pi_turn_get` was called 3, 3 and 2 times in the three invocations,
+  and no Pi Session MCP tool returned an error.
+- A scan of every Pi Session MCP tool result in the three transcripts found no
+  absolute path, configuration file name, endpoint, key or token marker, or stack
+  frame. No server or client process remained after any invocation, each
+  client's standard error was empty, and the digest of the real Claude Code
+  registrations was unchanged.
+
+This check does not cover:
+- Codex, or any task from a second client. It is not a ten-task cycle and does
+  not satisfy the Level 3 gate.
+- The check that the first turn's terminal view stays unchanged after a second
+  turn started. The transcripts do not poll the first turn again.
+- A git-based check of the allowed diff. The coding fixture is not a Git
+  repository, so a path, mode and content digest stood in for it.
+- A coding turn that tries to change a file outside the allowed set.
+- Interactive approval dialogs, external MCP grants, and client restart or
+  resume.
+
+On 2026-10-11 the working-tree build of `eeaa597` on the `feat/pi-extensions`
+branch (#34) passed the Pi extension live check on Linux:
+- Environment: Node.js `26.11.1`, Pi SDK `1.1.0`, and `pi-cursor-sdk@0.5.3`
+  installed by Pi with a stored Cursor key. `dist/main.js` has the SHA-256
+  `47875d38886528ace6b242df2c6ad79d624c51e330e63c2f401576eadc449ed7`.
+- Method: a scripted JSON-RPC client drove `node dist/main.js` over stdio, with
+  a temporary configuration passed through `PI_SESSION_MCP_CONFIG`. The
+  configuration had a `coding` and a `read-only` profile, each with provider
+  `cursor`, model `auto`, thinking level `off` and
+  `"extensions": ["npm:pi-cursor-sdk@0.5.3"]`.
+- The `coding` profile started, its prompt completed with "PONG", and the
+  session closed.
+- Two sessions, one of each profile, started in parallel and both prompts
+  completed with "PONG".
+- After close, no descendant process of the server remained.
+- No stdout line failed to parse as an MCP frame. stderr carried two
+  `foreign_stdout_suppressed` reports for 21 suppressed writes and no other
+  event.
+- During turns the Cursor local runtime started `git`, `ssh`, `gh`, `node` and
+  the MCP servers configured for Cursor through `npm exec`, in the `read-only`
+  profile as well. None of them inherited the server's stdout: each had its own
+  pipe, a socket, `/dev/null` or a file as standard output.
+- The first run, on the earlier build of `6740484`, failed to start the
+  `coding` profile with `execution_selection_mismatch`: `pi-cursor-sdk`
+  deactivates its own `cursor_activate_skill` tool when the session starts.
+  `eeaa597` lets an extension narrow its active tools while still rejecting
+  any tool outside the allowlist.
+
+This check does not cover macOS, Codex or Claude Code as the client, the Cursor
+cloud runtime, or a session that uses Cursor's own tools.
+
+Before its release, `v0.7.0` passed Level 1 and the working-tree Level 2 on its
+release candidate on Linux, with Node.js `26.11.1`, Codex CLI `0.162.1` and
+Claude Code `2.1.296`, on 2026-10-11:
+- The first working-tree Level 2, on `2d05e55`, failed. On all four targets
+  `--verify` (steps 5 and 8) reported `failed (mcp_failed)` with exit `1`; every
+  other step passed. The verifier rejected the `extensions` field that
+  `pi_capabilities_get` lists since #34. This is #36.
+- After the fix, the working-tree Level 2 on `2c5ab3d` passed all nine steps on
+  all four targets, 96 of 96 checks.
+  - The real client registrations were unchanged, no process remained, and the
+    built files were byte-identical before and after the client cycles.
+  - The run placed one sentinel in each Claude Code scope instead of one per
+    client, so its check count differs from earlier records.
+- Level 1 on `09b32a8`: every command exited with `0`.
+  - The test run reported 37 files, 660 passed and 5 skipped.
+  - `npm audit` and `npm audit --omit=dev` reported 0 vulnerabilities.
+  - Doctor reported `packageVersion` `0.7.0` and no finding.
+  - The commits after `2c5ab3d` change only tests and documentation. The built
+    `dist/` and `.pi-session-mcp-cli/` are byte-identical to those of `2c5ab3d`,
+    and `dist/main.js` has the SHA-256
+    `47875d38886528ace6b242df2c6ad79d624c51e330e63c2f401576eadc449ed7`.
+- The Codex CLI `0.162.1` contract was recorded. It differs from `0.162.0` only
+  in the version line.
+
+The Pi extension live check above ran on `eeaa597`, before the final fixes to
+extension tool names and the `read-only` contract test. It has not been
+repeated on the release candidate.