pi-session-mcp 0.7.0 → 0.7.1

package/.pi-session-mcp-cli/extension-spec.js

@@ -1,7 +1,12 @@
 export const MAX_PROFILE_EXTENSIONS = 8;
 const MAX_SPEC_LENGTH = 256;
-/** `npm:<name>@<exact semver>`; the name may be scoped. Ranges, tags, git sources and paths never match. */
-const EXTENSION_SPEC_PATTERN = /^npm:((?:@[a-z0-9][a-z0-9._~-]*\/)?[a-z0-9][a-z0-9._~-]*)@(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)$/;
+/**
+ * `npm:<name>@<exact semver>` with an optional prerelease; the name may be scoped. Ranges, tags,
+ * git sources and paths never match. Build metadata (`+build`) never matches either: npm does not
+ * keep it in a published version, so such a pin could never equal the installed manifest. Rejecting
+ * it here fails the configuration instead of every session with `extension_version_mismatch`.
+ */
+const EXTENSION_SPEC_PATTERN = /^npm:((?:@[a-z0-9][a-z0-9._~-]*\/)?[a-z0-9][a-z0-9._~-]*)@(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)$/;
 export function parseExtensionSpec(spec) {
     if (spec.length > MAX_SPEC_LENGTH)
         return undefined;

package/CHANGELOG.md

@@ -2,6 +2,31 @@
 
 ## Unreleased
 
+## 0.7.1 — 2026-10-11
+
+The public MCP contract is unchanged.
+
+- Extension tool names are now limited to 1 to 64 letters, digits, `_` and
+  `-`, not starting with `-`, so `.` and `:` no longer pass and every name fits
+  the common provider function-name limit. Names that Pi SDK 1.1.0 treats as
+  MCP tools (the `mcp__` prefix, `list_mcp_resources`,
+  `list_mcp_resource_templates`, `read_mcp_resource`) are rejected too, because
+  the SDK would keep them outside the allowlist. Both cases fail with
+  `extension_tool_conflict`. Fixes #41.
+- Extension pins with build metadata, such as `npm:<name>@1.2.3+build.1`, are
+  now rejected when the configuration loads. npm does not keep build metadata
+  in a published version, so such a pin could never match the installed
+  manifest. Such a configuration is now invalid as a whole: the server does not
+  start and Doctor reports `config_invalid`, instead of every session of the
+  profile failing with `extension_version_mismatch`. Fixes #42.
+- Client prompts now reach Pi with `source: "rpc"`, the marker Pi's own RPC
+  mode uses for input from a program, instead of the SDK default
+  `interactive`. Extension `input` hooks that read the source now see that a
+  program, not a human at the terminal, sent the prompt. Fixes #43.
+- The npm package no longer ships the implementation plans under
+  `docs/superpowers/`; the operator documentation stays included. A test
+  checks the packed file list. Fixes #39.
+
 ## 0.7.0 — 2026-10-11
 
 This is a minor release because the public contract changes, as ADR 0003

package/README.md

@@ -29,7 +29,7 @@ It is not the right tool when:
 
 ## Status
 
-The package version is **0.7.0**.
+The package version is **0.7.1**.
 
 - **Pre-1.0.** The public tool contract is stable within a minor line: a change to tools, fields, states or error codes needs a new minor release.
 - **Linux and macOS**, Node.js 22.19.0 or newer. macOS is tested in CI on macOS 15 and 26 on Apple silicon; Intel Macs run the same code but are untested. Setup acceptance on a real Mac is recorded for Claude Code only; Codex is still pending. See [Acceptance](docs/acceptance.md#status). On other platforms `setup` refuses with `platform_unsupported`.

package/dist/extension-spec.js

@@ -1,7 +1,12 @@
 export const MAX_PROFILE_EXTENSIONS = 8;
 const MAX_SPEC_LENGTH = 256;
-/** `npm:<name>@<exact semver>`; the name may be scoped. Ranges, tags, git sources and paths never match. */
-const EXTENSION_SPEC_PATTERN = /^npm:((?:@[a-z0-9][a-z0-9._~-]*\/)?[a-z0-9][a-z0-9._~-]*)@(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)$/;
+/**
+ * `npm:<name>@<exact semver>` with an optional prerelease; the name may be scoped. Ranges, tags,
+ * git sources and paths never match. Build metadata (`+build`) never matches either: npm does not
+ * keep it in a published version, so such a pin could never equal the installed manifest. Rejecting
+ * it here fails the configuration instead of every session with `extension_version_mismatch`.
+ */
+const EXTENSION_SPEC_PATTERN = /^npm:((?:@[a-z0-9][a-z0-9._~-]*\/)?[a-z0-9][a-z0-9._~-]*)@(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)$/;
 export function parseExtensionSpec(spec) {
     if (spec.length > MAX_SPEC_LENGTH)
         return undefined;

package/dist/sdk-pi-adapter.js

@@ -223,6 +223,9 @@ class SdkHandle {
             promptResult = this.session.prompt(text, {
                 // Client text is content, never a command: no extension command, skill or template dispatch.
                 expandPromptTemplates: false,
+                // Pi's own RPC mode uses `rpc` for input from a program over stdio, which matches an MCP
+                // client. `interactive`, the SDK default, means a human at the terminal or the CLI's print mode.
+                source: "rpc",
                 preflightResult: (disposition) => signalPreflight(admitsTurn(disposition)),
             });
         }

package/dist/session-tools.d.ts

@@ -4,6 +4,6 @@ export declare const PROFILE_TOOLS: Readonly<Record<PermissionProfile, readonly
  * The tool allowlist of a session, or undefined when an extension tool name conflicts.
  * Extension tools are active only in coding profiles, but a conflict fails closed in both,
  * so an extension can never shadow a built-in or granted tool. A name outside the safe
- * character set also fails closed.
+ * character set, or one the SDK treats as an MCP tool, also fails closed.
  */
 export declare function composeSessionTools(permissionProfile: PermissionProfile, mcpToolNames: readonly string[], extensionToolNames: readonly (readonly string[])[]): string[] | undefined;

package/dist/session-tools.js

@@ -2,20 +2,36 @@ export const PROFILE_TOOLS = {
     "read-only": ["read", "grep", "find", "ls"],
     coding: ["read", "bash", "edit", "write", "grep", "find", "ls"],
 };
-/** The SDK reads `*` in an allowlist as a glob and a leading `+` or `-` as a modifier, so those names are rejected: the first character may not be `-`. */
-const EXTENSION_TOOL_NAME = /^[A-Za-z0-9_.:][A-Za-z0-9_.:-]*$/;
+/**
+ * Letters, digits, `_` and `-`, at most 64 characters, which fits the common provider
+ * function-name limit `^[a-zA-Z0-9_-]{1,64}$`. The SDK reads `*` in an allowlist as a glob
+ * and a leading `+` or `-` as a modifier, so the first character may not be `-`.
+ */
+const EXTENSION_TOOL_NAME = /^[A-Za-z0-9_][A-Za-z0-9_-]{0,63}$/;
+/**
+ * These mirror `isMcpToolName` of Pi SDK 1.1.0 (core/mcp-servers.js), which is not a root
+ * export. When the allowlist names no `mcp__` entry, the SDK's `_isAllowedTool` keeps such
+ * tools outside the allowlist for codemode and tool_search, so an extension tool with one
+ * of these names could be active without being granted. This server's own MCP bridge
+ * tools are named `mcp_<server>_<tool>` with a single underscore, so they never collide.
+ */
+const MCP_RESERVED_PREFIX = "mcp__";
+const MCP_RESERVED_NAMES = new Set(["list_mcp_resources", "list_mcp_resource_templates", "read_mcp_resource"]);
+function isAcceptableExtensionToolName(name) {
+    return EXTENSION_TOOL_NAME.test(name) && !name.startsWith(MCP_RESERVED_PREFIX) && !MCP_RESERVED_NAMES.has(name);
+}
 /**
  * The tool allowlist of a session, or undefined when an extension tool name conflicts.
  * Extension tools are active only in coding profiles, but a conflict fails closed in both,
  * so an extension can never shadow a built-in or granted tool. A name outside the safe
- * character set also fails closed.
+ * character set, or one the SDK treats as an MCP tool, also fails closed.
  */
 export function composeSessionTools(permissionProfile, mcpToolNames, extensionToolNames) {
     const reserved = new Set([...PROFILE_TOOLS.coding, ...PROFILE_TOOLS["read-only"], ...mcpToolNames]);
     const extensionTools = [];
     for (const names of extensionToolNames) {
         for (const name of names) {
-            if (!EXTENSION_TOOL_NAME.test(name) || reserved.has(name))
+            if (!isAcceptableExtensionToolName(name) || reserved.has(name))
                 return undefined;
             reserved.add(name);
             extensionTools.push(name);

package/docs/acceptance.md

@@ -124,6 +124,55 @@ that checkout with Doctor reporting the release version, and confirms that the
 manifests and built runtime files are byte-identical before and after the
 client cycles.
 
+### Tooling
+
+`scripts/setup-acceptance.mjs` runs the isolation, the sequence and the pass
+criteria above with the real clients. It uses disposable homes below its work
+directory (default `~/.cache/pi-session-mcp-acceptance`, never below `/tmp`,
+`/var/tmp`, `/dev/shm` or `$TMPDIR`), removes them afterwards (also after Ctrl-C
+or SIGTERM, with exit `130` or `143`) and writes a sanitized JSON result without
+paths or environment values. It exits with `0` when every check passed, `1` when
+a check failed and `2` on a usage, environment or harness error.
+
+`--setup` is split on whitespace, so paths in it must not contain spaces. Its
+first token must be an absolute path to an existing file or a command found on
+`PATH`; otherwise the script exits with `2`.
+
+The script only reads the real `~/.codex/config.toml` and `~/.claude.json` to
+prove that the MCP registrations in them did not change. A file that does not
+exist counts as the constant digest `absent`; one that exists but cannot be read
+fails the check. A real client session that changes its own MCP registrations
+during the run makes the digest check fail (a false fail), so close or idle real
+clients first.
+
+Working tree, after `npm run build` and `npm run build:cli`:
+
+```bash
+node scripts/setup-acceptance.mjs \
+  --setup "node $PWD/dist/setup-main.js" --build-dir "$PWD" \
+  --label working-tree --out level2-result.json
+```
+
+Published package: install it into a temporary prefix outside `/tmp`, then pass
+the installed executable and package directory.
+
+```bash
+npm install -g --prefix "$PREFIX" pi-session-mcp@<version>
+node scripts/setup-acceptance.mjs \
+  --setup "$PREFIX/bin/pi-session-mcp-setup" \
+  --build-dir "$PREFIX/lib/node_modules/pi-session-mcp" \
+  --label npm-<version> --out level2-result.json
+```
+
+Tag clone: build a fresh clone of the tag (`npm ci`, `npm run build`,
+`npm run build:cli`) and use it like the working tree, with `--setup` and
+`--build-dir` pointing at the clone.
+
+`--clients codex` or `--clients claude-code` limits a run to one client, for
+example on a macOS machine without Codex. The script does not cover the macOS
+lock-contention and interruption steps, Level 1, or the tag identity checks
+(tag object, peeled commit, `git describe`). Run those by hand.
+
 ### macOS
 
 macOS uses the same isolation, sequence and pass criteria, with the additions
@@ -154,7 +203,7 @@ CI-tested, and it has not passed Level 2 for Codex.
 - **Interruption.** Start `--apply` for one target and press Ctrl-C while it
   runs.
   - The run exits with `130` and reports `operation_interrupted`.
-  - Afterwards `ps -A -o pid=,command=` lists no `claude mcp` or `codex mcp`
+  - Afterwards `ps -ww -A -o pid=,command=` lists no `claude mcp` or `codex mcp`
     command and no `setup-main.js` or `setup-command-guardian.js` process of
     the build under test.
   - A following `--apply` reports one of three outcomes, depending on where
@@ -166,7 +215,8 @@ CI-tested, and it has not passed Level 2 for Codex.
   - A following `--remove` reports `ok (removed)`.
   - If the operation completes before the interrupt arrives, record that and
     repeat. An interrupt that never lands is not a pass.
-- **Processes.** Check that no process remains with `ps` instead of `/proc`.
+- **Processes.** Check that no process remains with `ps -ww` instead of `/proc`;
+  without `-ww`, `ps` truncates long commands when it has no terminal.
 
 The evidence record names the build (commit or tag), the environment above,
 every command with its exit status, and the sanitized JSON results. It
@@ -485,3 +535,80 @@ Claude Code `2.1.296`, on 2026-10-11:
 The Pi extension live check above ran on `eeaa597`, before the final fixes to
 extension tool names and the `read-only` contract test. It has not been
 repeated on the release candidate.
+
+After its release, `v0.7.0` passed Level 1 and Level 2 on a fresh clone of its
+tag, and Level 2 as published npm package, on 2026-10-11, on Linux with Node.js
+`26.11.1`, Codex CLI `0.162.1` and Claude Code `2.1.296`:
+- Tag clone: `git describe --tags --exact-match` reported `v0.7.0`. The tag
+  object is `a5516ce6e4e159ef1e20ee38aba06672379e9cb7` and the peeled commit
+  `6783631d2ae1813707cf798360a0a0f4c58ca66d`.
+- Level 1 on the tag clone:
+  - every command exited with `0`;
+  - the test run reported 37 files, 660 passed and 5 skipped;
+  - `npm audit` and `npm audit --omit=dev` reported 0 vulnerabilities;
+  - Doctor reported `packageVersion` `0.7.0` and no finding;
+  - `dist/main.js` has the SHA-256
+    `47875d38886528ace6b242df2c6ad79d624c51e330e63c2f401576eadc449ed7`.
+- Level 2 passed 96 of 96 checks on the tag clone, and 96 of 96 with the npm
+  package installed into a temporary prefix through
+  `pi-session-mcp-setup`. In both runs the real client registrations were
+  unchanged, no process remained, and the built files were byte-identical
+  before and after the client cycles.
+  - These runs, and the release candidate's runs above, used the harness that
+    #40 later checked in as `scripts/setup-acceptance.mjs`.
+  - The checked-in script, after its review fixes, also passed 96 of 96 on the
+    tag clone.
+- The npm package has the shasum `c8d73311dbde1bdebd78e58b1f01c7cf3bebf374`.
+  The tarball downloaded from the registry had the same SHA-1 and SHA-512
+  integrity.
+- Installed package:
+  - `pi-session-mcp-doctor` reported a healthy package `0.7.0` when run from an
+    unrelated working directory;
+  - with a configuration that pins `pi-cursor-sdk@0.5.3` on three profiles,
+    `setup --apply` and `--verify` for `claude-code:user:pi-session-mcp`
+    reported `applied` and `mcp_verified`.
+
+On 2026-10-11 the installed `v0.7.0` package also passed the Pi extension live
+check on Linux:
+- Method: the same scripted JSON-RPC client as above drove the installed
+  server. It used the operator's configuration with three `pi-cursor-sdk@0.5.3`
+  profiles: one `read-only` and one `coding` profile with
+  `claude-opus-5-5@1m` and `claude-opus-5-5@300k` at thinking level `high`, and
+  one `coding` profile with `composer-2.5` at thinking level `off`.
+- Each of the three profiles started, completed a prompt with the expected
+  one-word answer, and closed. One `coding` and one `read-only` Cursor session started in parallel
+  and both completed.
+- Profiles without extensions on three other providers (xAI, Mistral and
+  DeepSeek) each completed a prompt.
+- After close no descendant process of the server remained. No stdout line
+  failed to parse as an MCP frame; stderr carried four
+  `foreign_stdout_suppressed` reports for 12 suppressed writes and no other
+  event.
+- The two OpenAI profiles ended `failed` with `turn_failed`. A direct Pi CLI
+  call outside the server showed that the account had reached its usage limit,
+  so they are not evidence for or against the release.
+
+This check does not cover macOS, an MCP client in the loop, or a session that
+uses Cursor's own tools.
+
+Before its release, `v0.7.1` passed Level 1 and the working-tree Level 2 on its
+release candidate `82dff20` on Linux, with Node.js `26.11.1`, Codex CLI
+`0.162.1` and Claude Code `2.1.296`, on 2026-10-11:
+- Level 1: every command exited with `0`.
+  - The test run reported 38 files, 684 passed and 5 skipped.
+  - `npm audit` and `npm audit --omit=dev` reported 0 vulnerabilities.
+  - Doctor reported `packageVersion` `0.7.1` and no finding.
+- Level 2 ran through `scripts/setup-acceptance.mjs` on a fresh clone of the
+  candidate.
+  - All nine steps passed on all four targets, 96 of 96 checks.
+  - The real client registrations were unchanged, and no process remained.
+  - The built files were byte-identical before and after the client cycles.
+- `dist/main.js` is byte-identical to that of `v0.7.0`. The changed modules are
+  the extension tool-name rule, the pin format and the prompt source.
+
+The branch build of `8d5b069`, whose sources match this candidate, passed the
+Pi extension live check with the operator's configuration on 2026-10-11:
+- Three `pi-cursor-sdk@0.5.3` profiles and one xAI profile each completed a
+  prompt.
+- Two Cursor sessions completed in parallel.
+- No process remained, and no foreign line reached the MCP stdout.

package/docs/adr/0006-pi-extension-allowlist.md

@@ -40,8 +40,8 @@ model runtime per session:
 
 Profiles without extensions keep the previous path. Client prompts are plain
 text for every profile: they never dispatch extension commands, skills or
-templates. An always-on stdout guard gives the MCP transport the only real
-stdout writer.
+templates, and extension input hooks see them with `source: "rpc"`. An
+always-on stdout guard gives the MCP transport the only real stdout writer.
 
 ## Consequences
 

package/docs/architecture.md

@@ -79,4 +79,4 @@ Public errors are stable and sanitized. They omit caller values, complete prompt
 
 ## Scope
 
-The product boundary is local stdio and in-memory-only operation for one trusted local MCP peer. Allowlisted Pi extensions may persist state of their own outside this boundary; Pi Session MCP itself keeps no state beyond process memory. A controller keeps one immutable configuration/profile snapshot for its lifetime; file edits require a genuinely new controller process and do not hot-reload, mark stale, or mutate running sessions. Each new session performs external catalog discovery within the loaded grants, so catalog changes do not require a controller restart, but a running session's active tools remain fixed. Restarting the controller loses all sessions; reconnecting a client reloads configuration only when it actually starts a new controller process. Capability discovery reports captured metadata only and does not prove current-file freshness, server reachability, provider availability, or catalog state. It excludes HTTP, a web UI, persistence/resume, remote access, multi-user behavior, transcript export, streaming, live provider/model discovery, availability probes during capability discovery, and provider credential management. A coding execution profile is an application-level tool selection, not an OS sandbox.
+The product boundary is local stdio and in-memory-only operation for one trusted local MCP peer. Allowlisted Pi extensions may persist state of their own outside this boundary, and their input hooks see every client prompt as `rpc` input, never `interactive`; Pi Session MCP itself keeps no state beyond process memory. A controller keeps one immutable configuration/profile snapshot for its lifetime; file edits require a genuinely new controller process and do not hot-reload, mark stale, or mutate running sessions. Each new session performs external catalog discovery within the loaded grants, so catalog changes do not require a controller restart, but a running session's active tools remain fixed. Restarting the controller loses all sessions; reconnecting a client reloads configuration only when it actually starts a new controller process. Capability discovery reports captured metadata only and does not prove current-file freshness, server reachability, provider availability, or catalog state. It excludes HTTP, a web UI, persistence/resume, remote access, multi-user behavior, transcript export, streaming, live provider/model discovery, availability probes during capability discovery, and provider credential management. A coding execution profile is an application-level tool selection, not an OS sandbox.

package/docs/installation.md

@@ -155,7 +155,7 @@ Rules:
 - A profile may load Pi extensions that Pi has installed, through
   `extensions`: a list of at most 8 entries of the form
   `npm:<name>@<exact version>`, each package once. Ranges, tags, `git:`
-  sources and paths are rejected. See [Pi extensions](#pi-extensions).
+  sources, paths and build metadata (`+build`) are rejected. See [Pi extensions](#pi-extensions).
 - Never put keys, tokens, credential objects, headers, base URLs or
   authentication paths into this file.
 
@@ -374,13 +374,16 @@ pin the installed version in the profile:
   and system-prompt changes. In `read-only` profiles the model still gets only
   `read`, `grep`, `find` and `ls`; in `coding` profiles every extension tool
   may be active. Extension commands never run from client prompts, but
-  extension input hooks can still see, rewrite or consume a client prompt.
+  extension input hooks can still see, rewrite or consume a client prompt;
+  they receive it with `source: "rpc"`, never `interactive`.
 - **Fail-closed start.** A session start fails with `extension_load_failed` if
   an extension reports a hook error while binding. It fails the same way if an
   extension registers an MCP server while loading or starting, because Pi's
   built-in MCP extension is not loaded. An extension tool whose name collides
-  with another tool, or whose name is not a plain identifier, fails with
-  `extension_tool_conflict`.
+  with another tool, or whose name is not 1 to 64 letters, digits, `_` or `-`
+  (not starting with `-`), or whose name Pi treats as an MCP tool (starting
+  with `mcp__`, or `list_mcp_resources`, `list_mcp_resource_templates`,
+  `read_mcp_resource`), fails with `extension_tool_conflict`.
 - **Cursor runtime.** `pi-cursor-sdk` runs Cursor's local agent runtime. That
   runtime starts its own processes (for example git and the MCP servers
   configured for Cursor) and may act through Cursor's own tooling, so a

package/docs/pi-extensions-design.md

@@ -115,8 +115,12 @@ Rules, enforced by `configSchema`:
 
 - Each entry matches `npm:<name>@<version>`. `<name>` is an npm package name,
   optionally scoped (`@scope/name`), lowercase. `<version>` is an exact semver
-  version with optional prerelease and build metadata. Ranges, tags, `git:`,
-  paths and URLs are rejected.
+  version with an optional prerelease. Build metadata (`+build`) is rejected
+  because npm does not keep it in a published version, so such a pin could
+  never match the installed manifest; the configuration fails with
+  `config_invalid` instead of every session failing with
+  `extension_version_mismatch`. Ranges, tags, `git:`, paths and URLs are
+  rejected.
 - At most 8 entries per profile. A package name appears at most once per
   profile.
 - The field is allowed on `read-only` and `coding` profiles, including the
@@ -210,9 +214,17 @@ and step 6 leaves no session to dispose.
   granted MCP tool or a tool of another extension fails with
   `extension_tool_conflict`. This also stops an extension from replacing a
   built-in tool inside a `read-only` profile.
-  A name must also match `[A-Za-z0-9_.:][A-Za-z0-9_.:-]*`: the SDK reads `*`
-  in an allowlist as a glob and a leading `+` or `-` as a modifier, so any
-  other name fails the same way, in both profiles.
+  A name must also match `[A-Za-z0-9_][A-Za-z0-9_-]{0,63}`: the SDK reads `*`
+  in an allowlist as a glob and a leading `+` or `-` as a modifier, and 64
+  characters of letters, digits, `_` and `-` fit the common provider
+  function-name limit, so any other name fails the same way, in both
+  profiles. Names that Pi SDK 1.1.0 treats as MCP tools fail too: any name
+  starting with `mcp__`, and exactly `list_mcp_resources`,
+  `list_mcp_resource_templates` and `read_mcp_resource`. When the allowlist
+  names no `mcp__` entry, the SDK keeps such tools outside the allowlist for
+  codemode and tool_search, so they could otherwise be active without a grant.
+  This server's own MCP bridge tools use a single underscore (`mcp_<server>_<tool>`)
+  and never collide.
   The check runs after load and again after binding, because a `session_start`
   handler can register a tool during `bindExtensions`. If the registered tool
   set then differs from the one the session was created with, the start fails
@@ -230,7 +242,11 @@ and step 6 leaves no session to dispose.
   `before_provider_request`, `before_provider_headers` and `context`.
 - **Prompts.** Every `session.prompt()` call, for every profile, passes
   `expandPromptTemplates: false`. Client prompt text never dispatches an
-  extension command, a skill command or a prompt template.
+  extension command, a skill command or a prompt template. The call also
+  passes `source: "rpc"`, which is what Pi's own RPC mode uses for input from
+  a program over stdio and so matches an MCP client. The SDK default,
+  `interactive`, means a human at the terminal or the CLI's print mode, which
+  a client prompt is not. Extension `input` hooks therefore see `rpc`.
 - **UI and flags.** No UI context is bound; extension UI calls return the
   SDK's no-op results. `extensionFlagValues` is empty, so extension flags keep
   their defaults.
@@ -311,7 +327,7 @@ admitted:
 | `extension_not_installed` | Configured Pi extension is not installed | Pi has no user install of the package. |
 | `extension_version_mismatch` | Configured Pi extension version is not installed | The installed version differs from the pinned version. |
 | `extension_load_failed` | Configured Pi extension could not be loaded | Invalid manifest, entry outside the package, load or bind error, services diagnostic of type `error`. |
-| `extension_tool_conflict` | Configured Pi extension tools conflict | An extension tool name collides with a built-in, MCP or other extension tool. |
+| `extension_tool_conflict` | Configured Pi extension tools conflict | An extension tool name collides with a built-in, MCP or other extension tool, or is unsafe (see *Name conflicts*). |
 
 Existing codes keep their meaning. An extension provider that is unknown after
 loading is `unknown_provider`.
@@ -358,7 +374,7 @@ Automated tests use no credentials and no network.
   - `session_shutdown` on close, on a failure after services, and on a late
     start after the deadline;
   - tool lists for read-only and coding, and `extension_tool_conflict`;
-  - `expandPromptTemplates: false` on every prompt;
+  - `expandPromptTemplates: false` and `source: "rpc"` on every prompt;
   - profiles without extensions taking the unchanged path.
 - **stdout guard** (`test/stdout-guard.test.ts`): foreign `write` and
   `console.*` output does not reach stdout, transport writes do, and the

package/docs/releasing.md

@@ -20,7 +20,8 @@ error codes, as defined in the [tool contracts](tool-contracts.md).
 
 A release is distributed twice: as the GitHub release with its source archive,
 and as the npm package `pi-session-mcp`. The npm package contains the built
-files, the executables, the documentation and the example configuration, but
+files, the executables, the operator documentation and the example
+configuration. It contains no implementation plans (`docs/superpowers/`), and
 no lockfile, because npm does not ship lockfiles inside packages.
 
 ## Update the Pi SDK
@@ -47,7 +48,10 @@ update is possible. It is not an update and not an acceptance.
    ships in the package as
    `node_modules/@earendil-works/pi-coding-agent/CHANGELOG.md`. Look for changes
    to stop reasons, prompt acceptance, the tools declared to the model,
-   provider keys, MCP naming and packaging.
+   provider keys, MCP naming and packaging. For MCP naming, compare the SDK's
+   `isMcpToolName` (`dist/core/mcp-servers.js`) with the reserved names in
+   `src/session-tools.ts`. That function is not a root export, so no test
+   notices when the SDK reserves another name.
 
 3. Move the pin:
 
@@ -100,7 +104,8 @@ release, record the contract again:
 5. Update the versions named in [Installation](installation.md).
 6. Run the working-tree
    [Level 2 lifecycle](acceptance.md#level-2-setup-acceptance) with the real
-   client for every scope.
+   client for every scope (`scripts/setup-acceptance.mjs`, see
+   [Tooling](acceptance.md#tooling)).
 
 ## Patch audit advisories
 
@@ -151,7 +156,10 @@ Steps:
    `## Unreleased`, so that the unreleased entries become the release entries.
 4. Run the Level 1 checks. `npm run --silent doctor -- --json` must report the
    new `packageVersion`.
-5. Open one pull request named `chore: prepare v<x.y.z> release`.
+5. Run the working-tree
+   [Level 2 acceptance](acceptance.md#tooling) on the release candidate with
+   `scripts/setup-acceptance.mjs`, unless the release notes state its absence.
+6. Open one pull request named `chore: prepare v<x.y.z> release`.
 
 ## Publish a release
 
@@ -171,7 +179,7 @@ package contains exactly the tagged sources:
 git clone --branch v<x.y.z> --depth 1 https://github.com/plagor44-ux/pi-session-mcp.git /tmp/pi-session-mcp-release
 cd /tmp/pi-session-mcp-release
 npm ci
-npm publish --dry-run     # review the file list: dist/, .pi-session-mcp-cli/, scripts/doctor.mjs, docs/
+npm publish --dry-run     # review the file list: dist/, .pi-session-mcp-cli/, scripts/doctor.mjs, docs/ without docs/superpowers/
 npm stage publish         # the prepack script builds the server, setup and Doctor
 ```
 
@@ -210,7 +218,8 @@ After publishing:
 1. Run the published-release
    [Level 2 acceptance](acceptance.md#working-tree-and-published-release-variants)
    from a fresh clone of the tag and from the published npm package, and
-   record it.
+   record it. `scripts/setup-acceptance.mjs` runs both
+   ([Tooling](acceptance.md#tooling)).
 2. Upgrade the installation as described in
    [Installation](installation.md#upgrade).
 3. Update the status section in [Acceptance](acceptance.md).

package/docs/threat-model.md

@@ -78,7 +78,7 @@ Pi Session MCP trusts the local process that launches and speaks MCP over inheri
   - Only exact `npm:<name>@<version>` specs from the operator's configuration load; the MCP client cannot name an extension.
   - Resolution never installs, and a different installed version fails closed. Only Pi's own user install (`<Pi agent dir>/npm/node_modules/<name>`, normally below `~/.pi/agent`) counts; a package installed elsewhere, for example with `npm i -g`, is reported as not installed.
   - `read-only` profiles never activate extension tools. At session start, after load and again after binding, no extension tool may shadow a built-in or granted tool; later registrations are covered in the residual risks.
-  - Client prompts never dispatch extension commands, but extension input hooks can still see, rewrite or consume a prompt.
+  - Client prompts never dispatch extension commands, but extension input hooks can still see, rewrite or consume a prompt. They receive it with `source: "rpc"`, Pi's marker for input from a program, so a hook that reads the source sees that no human typed it. A hook that ignores the source treats it like any other input.
   - Each extension session gets its own model runtime, and close emits `session_shutdown`.
 - **stdout corruption:** every write through `process.stdout` or `console.log`, `console.info` and `console.debug` other than the MCP transport's is dropped. The stdout guard intercepts `process.stdout.write`, `process.stdout.end` and `console.log`, `console.info` and `console.debug`, which covers output from extensions and the SDK in the server process. stderr gets only `foreign_stdout_suppressed` with byte and write counts, never the content. Anything that writes file descriptor 1 directly is not covered; see the residual risks.
 - **Misleading annotations:** annotations are client hints only and never grant access.
@@ -119,7 +119,7 @@ behind `pi-cursor-sdk` starts processes of its own during turns (observed with
 Cursor, in a `read-only` profile too); none inherited the server's stdout in
 that run. Extensions may persist their own state outside Pi
 Session MCP's in-memory boundary. Extension tool names are checked for
-conflicts after loading and again after binding; a tool that an extension
+conflicts and for unsafe or MCP-reserved names after loading and again after binding; a tool that an extension
 registers later, during a turn, is not re-checked and may replace a built-in
 tool, `read` included, because allowlisted extensions are trusted code. An extension may deactivate built-in or granted
 tools for its own session.

package/docs/tool-contracts.md

@@ -22,7 +22,7 @@ There are exactly eight tools. No `pi_turn_wait` tool or live provider/model inv
 ```json
 {
   "ok": true,
-  "server": { "name": "pi-session-mcp", "version": "0.7.0" },
+  "server": { "name": "pi-session-mcp", "version": "0.7.1" },
   "configuration": {
     "fingerprint": "sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
     "reloadPolicy": "restart-required"
@@ -71,7 +71,7 @@ Public MCP errors are stable and sanitized. Their messages do not include inputs
 | `extension_not_installed` | Pi has no installed package for a configured extension. |
 | `extension_version_mismatch` | Pi's installed extension package has another version than the configured one. |
 | `extension_load_failed` | A configured extension has an invalid manifest, failed to load or failed to bind. |
-| `extension_tool_conflict` | An extension tool name collides with a built-in, MCP or other extension tool. |
+| `extension_tool_conflict` | An extension tool name collides with a built-in, MCP or other extension tool, or is unsafe: not 1 to 64 letters, digits, `_` or `-` (not starting with `-`), or reserved for MCP (`mcp__` prefix, `list_mcp_resources`, `list_mcp_resource_templates`, `read_mcp_resource`). |
 | `pi_session_creation_failed` | Pi session construction failed without a more specific safe classification. |
 | `server_stopping` | Shutdown has begun, so a new session cannot be admitted. |
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-session-mcp",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Local stdio MCP server for controlled Pi coding-agent sessions",
   "license": "MIT",
   "keywords": [
@@ -30,6 +30,7 @@
     "scripts/doctor.mjs",
     "pi-session-mcp.example.json",
     "docs/",
+    "!docs/superpowers/",
     "CHANGELOG.md",
     "SECURITY.md",
     "CONTRIBUTING.md"