pi-session-mcp 0.8.3 → 0.12.0

package/docs/evaluation/node24-followup-2026-10-17/integrity.json

@@ -0,0 +1,204 @@
+{
+  "kind": "node24-followup-dossier-integrity",
+  "created_at": "2026-10-17T09:31:20.689155+00:00",
+  "source_binding": {
+    "commit": "406dae7e6b99aa5715960490e869bd3fc668cca2",
+    "digest": "sha256:686887d57899c2e55593bb7dd98b78be08ea0fc6c471a6dd4eab3298f890d160"
+  },
+  "files": [
+    {
+      "path": "README.md",
+      "hash": "sha256:fc79e91eec36d98bc22d9337b63003cebccf7b98d9f0ff2f48fa33b882180e35"
+    },
+    {
+      "path": "client-migration-review.json",
+      "hash": "sha256:f4778e96b98b6eb1d7a53697efe42dd287a69b7ad7e6fbd37996cbf70934e1d8"
+    },
+    {
+      "path": "client-registration-migration.json",
+      "hash": "sha256:721277ebec650684fa8a9cb762ceb7bc1464cd190911600b82e97e54eb417378"
+    },
+    {
+      "path": "client-registration-verification.json",
+      "hash": "sha256:f60dfb478f1db7e03ad1fcb9618812a8c0bc2184cfcfa2baf88af82112ce7776"
+    },
+    {
+      "path": "closure-checks.json",
+      "hash": "sha256:d7e1f644d7c1de35eb58d0f1fd0df970dd05cc7f4cd33c25e59f9774603c746e"
+    },
+    {
+      "path": "cursor-headless-probe.mjs",
+      "hash": "sha256:c63ffe93c36877fdb40f136c1ef58e5432a9387210c75343eab473629c0b41e5"
+    },
+    {
+      "path": "cursor-headless-report.md",
+      "hash": "sha256:60f2c7cf6442bdbe0a77bfdcf6740697084df7f046a72196f667d074b82f5c82"
+    },
+    {
+      "path": "cursor-headless-result-attempt-2.json",
+      "hash": "sha256:ac17a07fd77bf35ddd4725206de1d65cb5cbe55b9bf5e50d77b8fd9f3e474441"
+    },
+    {
+      "path": "cursor-headless-result-attempt-3.json",
+      "hash": "sha256:ad13eb8a1b2819857d766857ca03669dc6c9159b82251f7e1270c70f8d3080cc"
+    },
+    {
+      "path": "cursor-headless-result-attempt-4.json",
+      "hash": "sha256:923ec7e0aa836cc5b27a824d70c821c3d8c493bb6e1f1ea6a05c81f7120b1c12"
+    },
+    {
+      "path": "cursor-headless-result.json",
+      "hash": "sha256:7ccef63a073502bc8d2b9cf210a853c96e4a03458174b36d1c837d63253225a3"
+    },
+    {
+      "path": "cursor-headless-run.mjs",
+      "hash": "sha256:bb94f8702be86f406f98a08be0d8e5bae7293a677953e560341202e36e14203a",
+      "original_hash": "sha256:5b35c97784a54fcd9a43114fc565fccd88c87e9b76dc9c188258619f23fd861f"
+    },
+    {
+      "path": "download.json",
+      "hash": "sha256:563bb1656071511efefc4f05d4b9ba6769693c1a4090dfd0e270e6a55aa4521d"
+    },
+    {
+      "path": "extension-summary.json",
+      "hash": "sha256:a7d92ef7cd69657f624f7fc637f876001732abe1477e4119d1dcefa92843b1b5"
+    },
+    {
+      "path": "final-review.json",
+      "hash": "sha256:d40aa13d9b2b01c54db1c57e3d8aeae37cbc01b1d9ae02e3054f28a115788aed"
+    },
+    {
+      "path": "install.json",
+      "hash": "sha256:b1bc57a22e11416834bd54e01105c1f99dbe383037d5d437b727f4862d0b19d8"
+    },
+    {
+      "path": "isolated-extensions-evidence.json",
+      "hash": "sha256:5e52da2158c9cde82711e26f68151aef1dc2816cac69fd432610431a6293c995"
+    },
+    {
+      "path": "isolated-extensions-probe.mjs",
+      "hash": "sha256:39c0000ab7713a85affb8002ff796949f4692b81f1e11f129b74872074056980"
+    },
+    {
+      "path": "isolated-extensions-report.md",
+      "hash": "sha256:6dfbd181a15af783f87f302025d5fea2d7a5d2778c4137e6e462ca60f428bda0"
+    },
+    {
+      "path": "isolated-extensions-results-2026-10-17T09-19-48-378Z-b378dc9f-9ab8-4349-8892-78af8184f78f.json",
+      "hash": "sha256:0552b261919acf9c4db1868d0a5d6b6a8ec5afae84e04144b7df1d18fe99fc7e"
+    },
+    {
+      "path": "isolated-extensions-results-2026-10-17T09-20-22-821Z-85cfcba4-c05e-4c5a-9658-d8d70f5c8d1a.json",
+      "hash": "sha256:06dfbb34308b5c3dcb563c0f1adb2e7ad82278a1961c027051b86415cbf44598"
+    },
+    {
+      "path": "isolated-extensions-results-2026-10-17T09-20-54-825Z-fd5d8373-6e29-4197-84bd-2e65251b4db8.json",
+      "hash": "sha256:91e0ada3d60a8db0263cd6b8aa80266cf18bcdc99ad9b7ca21ed91840a0e9f15"
+    },
+    {
+      "path": "isolated-extensions-results-2026-10-17T09-21-44-636Z-488698ad-f8bf-4d7e-b85a-615275c32e5d.json",
+      "hash": "sha256:fba85adbd6ded8558251c963d589fd7f8b452f6376a65fc1ee70686298bcef9b"
+    },
+    {
+      "path": "isolated-extensions-results-2026-10-17T09-22-05-375Z-16f5d77c-32a2-4d0a-905a-e080b392316f.json",
+      "hash": "sha256:f968512477e27c1a16866eb879de27a269b47cf3d4ba4b39126e05fa42f2f995"
+    },
+    {
+      "path": "isolated-extensions-results-2026-10-17T09-22-07-471Z-fcbe7c98-fed3-4120-a860-b2e3f9572836.json",
+      "hash": "sha256:463843aafaec8c85b9a6c847183239abed34ffb136ccc8eee848a019214758ca"
+    },
+    {
+      "path": "isolated-extensions-results-2026-10-17T09-22-17-638Z-45ec386d-3429-4a7c-a10e-8673c03861f0.json",
+      "hash": "sha256:f51d68c164e8f12ab4200398b2c2c4b4fc737b3d3d3b4650ea86dfca2a065e2d"
+    },
+    {
+      "path": "isolated-extensions-results-2026-10-17T09-22-22-485Z-1b08e134-667c-4416-8372-cb233939c48b.json",
+      "hash": "sha256:cef6e34007097c9741d377e081a078934a894190fd039363b1d08039ab35cb49"
+    },
+    {
+      "path": "isolated-extensions-results-2026-10-17T09-22-25-490Z-223fd05e-52f9-4996-88d7-3ec43a6ecdd9.json",
+      "hash": "sha256:f139734d7bf96730e20a77f6438d96f2f015681f2b87c8c9ff9e7943550bf1b2"
+    },
+    {
+      "path": "isolated-extensions-results-2026-10-17T09-23-42-291Z-f4af1e12-844e-4b2d-a090-9068e7626dd5.json",
+      "hash": "sha256:e14a0e901e17fe97d80e2dc399b6e778da1995e61f9a5cbd0e440f97df83a255"
+    },
+    {
+      "path": "isolated-extensions-results-2026-10-17T09-24-36-866Z-30770d13-c7ae-4309-921b-5c1b43050adb.json",
+      "hash": "sha256:00ea68401be8a93d1ddc217032dd172ebc4c963e4c1c3bedc34c6fc8e0f88d3c"
+    },
+    {
+      "path": "isolated-extensions-results-2026-10-17T09-25-05-378Z-2a5dffc1-3f3a-433a-823f-6e77964dcaee.json",
+      "hash": "sha256:ca67c90cd0dbf35a24654b0249887257dddb7f54b8598f076c6f58bd8151aaf3"
+    },
+    {
+      "path": "isolated-extensions-results-2026-10-17T09-25-15-842Z-798946f5-b9a5-4810-8a0c-35be6f40abb3.json",
+      "hash": "sha256:b5d99d87765528cd1af3558fa7121b5b2bf530fbc2c1cbf4c6c07af2e7febb03"
+    },
+    {
+      "path": "isolated-extensions-results-2026-10-17T09-25-19-099Z-89bd000d-bb51-4e3a-b713-51ff1ff4e38b.json",
+      "hash": "sha256:a310c804338b4d48c2236f42f70c2e476209e918bc6db9650280a1174e650a8a"
+    },
+    {
+      "path": "isolated-extensions-runner.mjs",
+      "hash": "sha256:694946fc1ed43c170bc73a243c45aaf16696568c21308a220087bc0a7489706a"
+    },
+    {
+      "path": "isolated-install.json",
+      "hash": "sha256:d551a96e57460a64490dc6d2dc5b93c6297033f566d7964fc874b69f8439b7c5"
+    },
+    {
+      "path": "isolated-package-lock.json",
+      "hash": "sha256:6408ff9b643649a2d5b89b5023382a8abd8cbeb38cc4f9710590a388bbe9c7ff"
+    },
+    {
+      "path": "isolated-package.json",
+      "hash": "sha256:9df45086bd58dae9084860590f4d6da4010bbb4d4c5e0aef5d201adf39f72a36"
+    },
+    {
+      "path": "launcher-review.json",
+      "hash": "sha256:d39cc06fe66029307c03bd8fe3b0057df6c1239130979458173b9d283a7f89d0"
+    },
+    {
+      "path": "launcher-switch.json",
+      "hash": "sha256:08f28fa4b9637190ec683bf8fce79da61a8c663d0c5253e5bf85fb9f64d48d07"
+    },
+    {
+      "path": "mcp-launcher-test.json",
+      "hash": "sha256:f502fa51af2d9a96c02995bf0c8dbb76b878532db4b2bcc779c9ace4e822494f"
+    },
+    {
+      "path": "migrate-client-node.mjs",
+      "hash": "sha256:b5d58038d774221de0fd335ae519095c7e6ce3d5884c539ca29062d05d4799d2"
+    },
+    {
+      "path": "node-runtime-report.md",
+      "hash": "sha256:acd017af37bb919a99151f8a3c0840141c1a7c30d81adfae853c6ae7195328c8"
+    },
+    {
+      "path": "node24-checks.json",
+      "hash": "sha256:697eedc90db73428ce662d66f6b2d8e6a7b521e4d154b225ad3273885909b572"
+    },
+    {
+      "path": "pi-launcher-test.json",
+      "hash": "sha256:99b62e5a9d80741ff7bacc2308bce3a2f970eb42d327dd0b1de5008a7292d2bd"
+    },
+    {
+      "path": "restore-launchers.mjs",
+      "hash": "sha256:bbbe6c38a3023348e0f554242264a6aa8a01757eeec1ec449229923b652f7302"
+    },
+    {
+      "path": "verify-client-node.mjs",
+      "hash": "sha256:96b696ba5cabff8de3587f9ab9d83559a77a6742a3d75df22ebbea25959080a4"
+    },
+    {
+      "path": "publication-export.json",
+      "hash": "sha256:0eb86163ce740a7f2e0c496aebea6dbe6a769ca37b07bdc0ed661aab470651e6"
+    }
+  ],
+  "publication_export": {
+    "record": "publication-export.json",
+    "original_integrity_index_sha256": "sha256:112a79eff3f7f8cdcb649d119076bc65f56c4126c55442e817fbc17505bb6fc5",
+    "exported_at": "2026-10-17T15:49:24.587910+00:00"
+  }
+}

package/docs/evaluation/node24-followup-2026-10-17/isolated-extensions-evidence.json

@@ -0,0 +1,39 @@
+{
+  "schema_version": "1.0.0",
+  "kind": "isolated-pi-extension-headless-evidence-index",
+  "date": "2026-10-17",
+  "runtime": {
+    "node": "24.22.0",
+    "pi_coding_agent": "1.2.0",
+    "pi_tui": "1.2.0",
+    "typebox": "1.3.27",
+    "install_evidence": "isolated-install.json",
+    "lifecycle_scripts_enabled": false
+  },
+  "results": [
+    { "package": "pi-lens@4.4.3", "read_only": "PASS", "coding": "PASS", "evidence": ["isolated-extensions-results-2026-10-17T09-23-42-291Z-f4af1e12-844e-4b2d-a090-9068e7626dd5.json", "isolated-extensions-results-2026-10-17T09-22-05-375Z-16f5d77c-32a2-4d0a-905a-e080b392316f.json"] },
+    { "package": "context-mode@1.0.169", "read_only": "PASS", "coding": "PASS", "reason": "Only the exact read-only Git rev-parse metadata query against the owned synthetic workspace was allowed via /usr/bin/git, with 1.5-second timeout and global/system config disabled. It returned nonzero because the fixture is not a Git repository; extension startup handled this. All other child-process and network attempts remained denied.", "evidence": ["isolated-extensions-results-2026-10-17T09-25-15-842Z-798946f5-b9a5-4810-8a0c-35be6f40abb3.json", "isolated-extensions-results-2026-10-17T09-25-19-099Z-89bd000d-bb51-4e3a-b713-51ff1ff4e38b.json"] },
+    { "package": "pi-cache-optimizer@2.9.3", "read_only": "PASS", "coding": "PASS", "evidence": "isolated-extensions-results-2026-10-17T09-22-22-485Z-1b08e134-667c-4416-8372-cb233939c48b.json" },
+    { "package": "@gotgenes/pi-permission-system@40.3.0", "read_only": "PASS", "coding": "PASS", "evidence": "isolated-extensions-results-2026-10-17T09-22-25-490Z-223fd05e-52f9-4996-88d7-3ec43a6ecdd9.json" }
+  ],
+  "global_limits": {
+    "provider_calls": 0,
+    "prompt_submissions": 0,
+    "candidate_tool_invocations": 0,
+    "network_attempts_observed": 0,
+    "cache_warming": "disabled",
+    "scope": "Headless extension loading, registration/discovery, adapter tool allowlist composition, and shutdown only."
+  },
+  "sha256": {
+    "isolated-extensions-results-2026-10-17T09-21-44-636Z-488698ad-f8bf-4d7e-b85a-615275c32e5d.json": "fba85adbd6ded8558251c963d589fd7f8b452f6376a65fc1ee70686298bcef9b",
+    "isolated-extensions-results-2026-10-17T09-23-42-291Z-f4af1e12-844e-4b2d-a090-9068e7626dd5.json": "e14a0e901e17fe97d80e2dc399b6e778da1995e61f9a5cbd0e440f97df83a255",
+    "isolated-extensions-results-2026-10-17T09-22-05-375Z-16f5d77c-32a2-4d0a-905a-e080b392316f.json": "f968512477e27c1a16866eb879de27a269b47cf3d4ba4b39126e05fa42f2f995",
+    "isolated-extensions-results-2026-10-17T09-22-17-638Z-45ec386d-3429-4a7c-a10e-8673c03861f0.json": "f51d68c164e8f12ab4200398b2c2c4b4fc737b3d3d3b4650ea86dfca2a065e2d",
+    "isolated-extensions-results-2026-10-17T09-22-22-485Z-1b08e134-667c-4416-8372-cb233939c48b.json": "cef6e34007097c9741d377e081a078934a894190fd039363b1d08039ab35cb49",
+    "isolated-extensions-results-2026-10-17T09-22-25-490Z-223fd05e-52f9-4996-88d7-3ec43a6ecdd9.json": "f139734d7bf96730e20a77f6438d96f2f015681f2b87c8c9ff9e7943550bf1b2",
+    "isolated-extensions-results-2026-10-17T09-25-15-842Z-798946f5-b9a5-4810-8a0c-35be6f40abb3.json": "b5d99d87765528cd1af3558fa7121b5b2bf530fbc2c1cbf4c6c07af2e7febb03",
+    "isolated-extensions-results-2026-10-17T09-25-19-099Z-89bd000d-bb51-4e3a-b713-51ff1ff4e38b.json": "a310c804338b4d48c2236f42f70c2e476209e918bc6db9650280a1174e650a8a",
+    "isolated-extensions-results-2026-10-17T09-24-36-866Z-30770d13-c7ae-4309-921b-5c1b43050adb.json": "00ea68401be8a93d1ddc217032dd172ebc4c963e4c1c3bedc34c6fc8e0f88d3c"
+  },
+  "report": "isolated-extensions-report.md"
+}

package/docs/evaluation/node24-followup-2026-10-17/isolated-extensions-probe.mjs

@@ -0,0 +1,277 @@
+// Run one exact installed extension through the repository's real SDK adapter.
+// No prompt is submitted and no extension tool is invoked.
+import { syncBuiltinESMExports } from 'node:module';
+import net from 'node:net';
+import tls from 'node:tls';
+import http from 'node:http';
+import https from 'node:https';
+import dns from 'node:dns';
+import dnsPromises from 'node:dns/promises';
+import dgram from 'node:dgram';
+import childProcess from 'node:child_process';
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { cp, mkdir, readFile } from 'node:fs/promises';
+import { createRequire } from 'node:module';
+import { dirname, join } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+const scope = process.env.PI_AUDIT_SCOPE;
+const extensionAgent = process.env.PI_AUDIT_AGENT_DIR;
+const npmAgent = process.env.PI_AUDIT_NPM_AGENT_DIR;
+const packageName = process.argv[2];
+const packageVersion = process.argv[3];
+const profileName = process.argv[4];
+if (!scope || !extensionAgent || !npmAgent || !packageName || !packageVersion || !['read-only', 'coding'].includes(profileName)) {
+  process.stdout.write(JSON.stringify({ status: 'BLOCKED', code: 'invalid_probe_parameters' }) + '\n');
+  process.exitCode = 2;
+} else {
+  let deniedNetwork = 0;
+  let deniedChildProcess = 0;
+  const childDiagnostics = [];
+  const allowedMetadataCommands = [];
+  const realExecFileSync = childProcess.execFileSync;
+  let safeOutput = process.stdout;
+  const blockNetwork = () => { deniedNetwork += 1; throw Object.assign(new Error('offline_network_denied'), { code: 'OFFLINE_NETWORK_DENIED' }); };
+  const blockChild = (method, ...args) => {
+    const executable = typeof args[0] === 'string' ? args[0] : '';
+    const argv = Array.isArray(args[1]) ? args[1] : [];
+    const options = args[2] && typeof args[2] === 'object' ? args[2] : {};
+    const fixtureWorkspace = join(scope, 'workspace');
+    const isOwnedGitMetadata = method === 'execFileSync'
+      && executable === 'git'
+      && argv.length === 4
+      && argv[0] === '-C'
+      && argv[1] === fixtureWorkspace
+      && argv[2] === 'rev-parse'
+      && argv[3] === '--show-toplevel'
+      && options.timeout === 2000;
+    if (isOwnedGitMetadata) {
+      // Permit only this fixed, read-only metadata query in the fresh fixture.
+      // No global/system Git config or optional locks; cap execution at 1.5s.
+      try {
+        const result = realExecFileSync('/usr/bin/git', ['-C', fixtureWorkspace, 'rev-parse', '--show-toplevel'], {
+          cwd: fixtureWorkspace,
+          encoding: 'utf-8',
+          timeout: 1500,
+          stdio: ['ignore', 'pipe', 'ignore'],
+          env: { ...process.env, GIT_OPTIONAL_LOCKS: '0', GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: '/dev/null' },
+        });
+        allowedMetadataCommands.push({ method, executable_basename: 'git', argv_pattern: ['-C', '<owned-fixture>', 'rev-parse', '--show-toplevel'], timeout_ms: 1500, cwd: 'owned_fixture', result: 'completed' });
+        return result;
+      } catch (error) {
+        allowedMetadataCommands.push({ method, executable_basename: 'git', argv_pattern: ['-C', '<owned-fixture>', 'rev-parse', '--show-toplevel'], timeout_ms: 1500, cwd: 'owned_fixture', result: error?.killed ? 'timed_out' : 'nonzero_exit' });
+        throw error;
+      }
+    }
+    deniedChildProcess += 1;
+    if (childDiagnostics.length < 4) {
+      const stack = new Error().stack ?? '';
+      const candidateRoot = join(npmAgent, 'npm', 'node_modules', packageName);
+      const frame = stack.split('\n').map((line) => {
+        const marker = line.indexOf(candidateRoot);
+        return marker >= 0 ? line.slice(marker + candidateRoot.length).replace(/^[/\\]/, '').split(':').slice(0, 2).join(':') : null;
+      }).find(Boolean) ?? null;
+      childDiagnostics.push({
+        method,
+        executable_basename: executable.split(/[\\/]/).at(-1) || 'unknown',
+        argv_pattern: argv.map((value) => typeof value === 'string' && (value.startsWith('/') || /^[A-Za-z]:[\\/]/.test(value)) ? '<path>' : typeof value === 'string' ? value : `<${typeof value}>`),
+        candidate_relative_stack_frame: frame,
+      });
+    }
+    throw Object.assign(new Error('offline_child_process_denied'), { code: 'OFFLINE_CHILD_PROCESS_DENIED' });
+  };
+
+  // Install the barriers before importing the SDK, resolver, adapter, or package.
+  globalThis.fetch = blockNetwork;
+  if ('WebSocket' in globalThis) globalThis.WebSocket = class { constructor() { blockNetwork(); } };
+  net.Socket.prototype.connect = blockNetwork;
+  net.connect = blockNetwork;
+  net.createConnection = blockNetwork;
+  tls.connect = blockNetwork;
+  http.request = blockNetwork;
+  http.get = blockNetwork;
+  https.request = blockNetwork;
+  https.get = blockNetwork;
+  dns.lookup = blockNetwork;
+  dns.resolve = blockNetwork;
+  dns.resolve4 = blockNetwork;
+  dns.resolve6 = blockNetwork;
+  dnsPromises.lookup = blockNetwork;
+  dnsPromises.resolve = blockNetwork;
+  dnsPromises.resolve4 = blockNetwork;
+  dnsPromises.resolve6 = blockNetwork;
+  dnsPromises.Resolver.prototype.resolve = blockNetwork;
+  dnsPromises.Resolver.prototype.resolve4 = blockNetwork;
+  dnsPromises.Resolver.prototype.resolve6 = blockNetwork;
+  dns.promises.lookup = blockNetwork;
+  dgram.createSocket = blockNetwork;
+  for (const method of ['spawn', 'spawnSync', 'exec', 'execSync', 'execFile', 'execFileSync', 'fork']) childProcess[method] = (...args) => blockChild(method, ...args);
+  syncBuiltinESMExports();
+
+  const cwd = join(scope, 'workspace');
+  const home = process.env.HOME;
+  const packageFixtureDir = join(extensionAgent, 'npm', 'node_modules', 'pi-extension-fixture');
+  const candidateSpec = `npm:${packageName}@${packageVersion}`;
+  let diagnostics = [];
+  const codeToStatus = (code) => {
+    const stage = diagnostics.at(-1)?.stage;
+    if (code === 'extension_not_installed' || code === 'extension_version_mismatch') return 'BLOCKED';
+    if (code === 'OFFLINE_CHILD_PROCESS_DENIED' || code === 'OFFLINE_NETWORK_DENIED') return 'BLOCKED';
+    // The adapter deliberately sanitizes SDK loader exceptions. Keep an opaque
+    // extension-load failure as NOT QUALIFIED instead of guessing SDK incompatibility.
+    if (code === 'extension_load_failed' && stage === 'extension_load') return 'BLOCKED';
+    if (code === 'pi_session_creation_failed' && ['runtime', 'provider', 'model', 'check_auth', 'get_auth', 'availability'].includes(stage)) return 'BLOCKED';
+    return 'FAIL';
+  };
+
+  function findPackageMetadata(start, expectedName) {
+    let dir = start;
+    for (;;) {
+      const candidate = join(dir, 'package.json');
+      try {
+        const data = JSON.parse(readFileSync(candidate, 'utf8'));
+        if (data.name === expectedName) return { version: data.version, resolved_from: candidate.startsWith(join(npmAgent, 'npm', 'node_modules') + '/') ? 'isolated_npm_prefix_or_ancestor' : 'host_sdk_or_ancestor' };
+      } catch { /* try the parent */ }
+      const parent = dirname(dir);
+      if (parent === dir) return null;
+      dir = parent;
+    }
+  }
+
+  function resolvedPeerVersions(extensionRoot) {
+    const requireFromExtension = createRequire(join(extensionRoot, 'package.json'));
+    const versions = {};
+    for (const name of ['@earendil-works/pi-coding-agent', '@earendil-works/pi-tui', 'typebox']) {
+      try {
+        const resolved = import.meta.resolve(name, pathToFileURL(join(extensionRoot, 'index.js')).href);
+        const entry = fileURLToPath(resolved);
+        versions[name] = findPackageMetadata(dirname(entry), name);
+      } catch { versions[name] = null; }
+    }
+    // Also record what a require-based resolver sees, without importing a candidate dependency.
+    try { requireFromExtension.resolve('@earendil-works/pi-coding-agent'); } catch { /* ESM-only exports are expected. */ }
+    return versions;
+  }
+
+  async function run() {
+    const repo = process.env.PI_AUDIT_REPO;
+    const build = join(repo, '.profile-eval', 'src');
+    const { SdkPiSessionAdapter, PROFILE_TOOLS } = await import(pathToFileURL(join(build, 'sdk-pi-adapter.js')).href);
+    const { parseExtensionSpec } = await import(pathToFileURL(join(build, 'extension-spec.js')).href);
+    const { resolvePiExtension } = await import(pathToFileURL(join(build, 'pi-extensions.js')).href);
+    const { installStdoutGuard } = await import(pathToFileURL(join(build, 'stdout-guard.js')).href);
+    const suppressed = [];
+    const guard = installStdoutGuard({ report: (line) => suppressed.push(JSON.parse(line)) });
+    safeOutput = guard.transportStdout;
+    process.stderr.write = () => true;
+
+    await mkdir(cwd, { recursive: true });
+    await cp(join(repo, 'test', 'fixtures', 'pi-extension-fixture'), packageFixtureDir, { recursive: true, errorOnExist: true });
+    const fixtureSpec = parseExtensionSpec('npm:pi-extension-fixture@1.0.0');
+    const candidate = parseExtensionSpec(candidateSpec);
+    assert.ok(fixtureSpec && candidate);
+
+    const specToRoot = async (spec) => resolvePiExtension(spec, {
+      agentDir: spec.name === 'pi-extension-fixture' ? extensionAgent : npmAgent,
+    });
+    diagnostics = [];
+    const adapter = new SdkPiSessionAdapter({
+      modelRuntimeFactory: () => import('@earendil-works/pi-coding-agent').then(({ ModelRuntime }) => ModelRuntime.create({
+        refreshOnCreate: false,
+        allowModelNetwork: false,
+        modelsPath: null,
+        authPath: join(scope, 'absent-auth.json'),
+        modelsStorePath: join(scope, 'absent-models.json'),
+      })),
+      resolveExtension: specToRoot,
+      diagnosticSink: (item) => diagnostics.push({ stage: item.stage, code: item.code, extension: item.extension ?? null }),
+    });
+    const profile = {
+      alias: 'node24-extension-headless-probe',
+      permissionProfile: profileName,
+      provider: 'fixture-ext',
+      model: 'fixture-ext-model',
+      thinkingLevel: 'off',
+      extensions: [fixtureSpec, candidate],
+      skills: [],
+    };
+
+    let handle;
+    try {
+      handle = await adapter.create({ cwd, executionProfile: profile });
+      const loaded = handle.session.resourceLoader.getExtensions();
+      assert.equal(loaded.errors.length, 0);
+      assert.equal(loaded.extensions.length, 2);
+      const allExtensionTools = loaded.extensions.flatMap((extension) => [...extension.tools.keys()]).sort();
+      assert.ok(allExtensionTools.includes('fixture_tool'));
+      const candidateTools = allExtensionTools.filter((name) => name !== 'fixture_tool');
+      const activeTools = handle.session.getActiveToolNames().sort();
+      const allowedTools = [...PROFILE_TOOLS[profileName], ...(profileName === 'coding' ? allExtensionTools : [])];
+      assert.ok(activeTools.every((name) => allowedTools.includes(name)));
+      if (profileName === 'read-only') assert.deepEqual(activeTools, [...PROFILE_TOOLS[profileName]].sort());
+
+      const extensions = globalThis.__piExtensionFixtureEvents ?? [];
+      assert.ok(extensions.includes('session_start'));
+      assert.ok(!extensions.includes('tool'));
+      if (deniedNetwork > 0) throw Object.assign(new Error('offline_network_denied'), { code: 'OFFLINE_NETWORK_DENIED' });
+      if (deniedChildProcess > 0) throw Object.assign(new Error('offline_child_process_denied'), { code: 'OFFLINE_CHILD_PROCESS_DENIED' });
+
+      const candidateRoot = await specToRoot(candidate);
+      const manifest = JSON.parse(await readFile(join(candidateRoot, 'package.json'), 'utf8'));
+      assert.equal(manifest.name, packageName);
+      assert.equal(manifest.version, packageVersion);
+      const peers = resolvedPeerVersions(candidateRoot);
+      await handle.dispose();
+      handle = undefined;
+      assert.ok(extensions.includes('session_shutdown'));
+
+      guard.flush();
+      guard.transportStdout.write(JSON.stringify({
+        kind: 'node24-isolated-extension-headless-probe',
+        status: 'PASS',
+        package: `${packageName}@${packageVersion}`,
+        permission_profile: profileName,
+        package_peer_versions_resolved: peers,
+        extensions_loaded: 2,
+        candidate_tools_registered: candidateTools,
+        active_tools: activeTools,
+        skills_selected: 0,
+        prompts_loaded: 0,
+        candidate_tools_invoked: 0,
+        provider_calls: 0,
+        lifecycle: { session_start: 'PASS', session_shutdown: 'PASS' },
+        cleanup: 'PASS',
+        network_attempts_denied: deniedNetwork,
+        child_process_attempts_denied: deniedChildProcess,
+        allowed_metadata_commands: allowedMetadataCommands,
+        raw_stdout_suppressed_writes: suppressed.reduce((sum, item) => sum + item.writes, 0),
+        diagnostic_codes: diagnostics.map((item) => item.code),
+        limitation: 'Headless load, registration, allowlist selection, and shutdown only. No candidate tools, prompt/provider calls, mutation commands, or quality claims.',
+      }) + '\n');
+    } finally {
+      if (handle) await handle.dispose().catch(() => undefined);
+    }
+  }
+
+  run().catch((error) => {
+    const code = typeof error?.code === 'string' ? error.code : typeof error?.name === 'string' ? error.name : 'probe_failed';
+    const status = codeToStatus(code);
+    safeOutput.write(JSON.stringify({
+      kind: 'node24-isolated-extension-headless-probe',
+      status,
+      package: `${packageName}@${packageVersion}`,
+      permission_profile: profileName,
+      failure_code: code,
+      failure_stage: diagnostics.at(-1)?.stage ?? null,
+      diagnostic_codes: diagnostics.map((item) => item.code),
+      provider_calls: 0,
+      network_attempts_denied: deniedNetwork,
+      child_process_attempts_denied: deniedChildProcess,
+      allowed_metadata_commands: allowedMetadataCommands,
+      child_process_diagnostics: childDiagnostics,
+      limitation: 'No candidate tool or model prompt was invoked; private error text and paths are omitted.',
+    }) + '\n');
+    process.exitCode = status === 'PASS' ? 0 : 1;
+  });
+}

package/docs/evaluation/node24-followup-2026-10-17/isolated-extensions-report.md

@@ -0,0 +1,35 @@
+# Isolated Pi extension headless follow-up
+
+Date: 2026-10-17. The four exact pins were installed by the parent run into a disposable prefix with lifecycle scripts disabled. The recorded install evidence identifies Node 24.22.0, Pi coding-agent 1.2.0, Pi TUI 1.2.0, TypeBox 1.3.27, and matching registry integrity values in [isolated-install.json](isolated-install.json). No global or production installation was made.
+
+The probe uses the repository's real `SdkPiSessionAdapter` with a local in-memory fixture provider, an empty skills selection, no prompts, no candidate tool calls, and cache warming disabled. Each run uses a fresh HOME, agent directory, data/cache/config directories, and synthetic workspace. Network APIs and child-process creation are denied at process start; the supervisor enforces a 35-second timeout, checks process-group cleanup, and removes each scope. Node syntax checks passed for the probe and supervisor.
+
+| Candidate | Read-only | Coding | Observed result |
+|---|---|---|---|
+| `pi-lens@4.4.3` | PASS | PASS | Loads and registers extension tools; read-only active tools remained the four built-ins. Coding profile's active tools stayed within the composed allowlist. No denied network or child-process attempts. |
+| `pi-cache-optimizer@2.9.3` | PASS | PASS | Loads and binds in both profiles. Read-only active tools remained the four built-ins; coding tools stayed within the composed allowlist. No denied network or child-process attempts. Cache warming was disabled, so no warming behavior was evaluated. |
+| `@gotgenes/pi-permission-system@40.3.0` | PASS | PASS | Loads and binds in both profiles. No candidate tools registered; active tool sets followed the adapter profile. This only verifies load/bind, not policy enforcement. |
+| `context-mode@1.0.169` | PASS | PASS | After a denied-only diagnostic identified `execFileSync("git", ["-C", projectDir, "rev-parse", "--show-toplevel"])` at `build/session/db.js:253`, the probe allowed only this exact read-only query via fixed `/usr/bin/git`, with cwd and `-C` bound to the fresh synthetic workspace, 1.5-second timeout, no system/global Git config, and optional locks disabled. It returned nonzero because the synthetic workspace is not a Git repository; context-mode handled that and completed load/bind/disposal. No other child-process or network attempts occurred. |
+
+The final runtime receipts resolve the Pi coding-agent/TUI/TypeBox peers to 1.2.0/1.2.0/1.3.27 from the host SDK dependency tree for the packages that completed peer diagnostics; the install evidence records the same peer resolution for all four candidates. Context-mode runtime startup completed with no tools registered. No provider calls, prompts, candidate tool invocations, or network attempts were observed. The only child process allowed was the bounded Git metadata query described above. All completed probe scopes passed process cleanup and removal.
+
+Earlier attempts are retained in the result directory and are not treated as candidate verdicts: one supervisor version lost its sanitized receipt, one resolver configuration pointed at the wrong isolated prefix, and one harness revision had a missing `readFile` import and an overly strict tool-set assertion. The context-mode denied-only diagnostic receipt is retained to show the exact child-process metadata and source frame; it is superseded by the two final component receipts with the single metadata-only command allowance. A separate `pi-lens` read-only diagnostic run used the repository root as cwd and is explicitly excluded from the verdict; the final read-only run below used a fresh synthetic workspace. Final pi-lens coding and all cache/permission/context-mode verdict runs also used the synthetic workspace. No candidate tool was invoked in any run.
+
+These checks establish only headless loading, extension tool discovery, active-tool allowlist composition, hook/lifecycle setup and disposal. They do not establish feature efficacy, permission-policy correctness, context-mode functionality, cache behavior, UI operation, or provider compatibility beyond adapter startup with the fixture provider.
+
+## Evidence files and SHA-256
+
+- `isolated-extensions-results-2026-10-17T09-23-42-291Z-f4af1e12-844e-4b2d-a090-9068e7626dd5.json` — final pi-lens read-only synthetic-workspace run; `e14a0e901e17fe97d80e2dc399b6e778da1995e61f9a5cbd0e440f97df83a255`.
+- `isolated-extensions-results-2026-10-17T09-21-44-636Z-488698ad-f8bf-4d7e-b85a-615275c32e5d.json` — superseded pi-lens read-only diagnostic run (repository-root cwd); `fba85adbd6ded8558251c963d589fd7f8b452f6376a65fc1ee70686298bcef9b`.
+- `isolated-extensions-results-2026-10-17T09-22-05-375Z-16f5d77c-32a2-4d0a-905a-e080b392316f.json` — pi-lens coding; `f968512477e27c1a16866eb879de27a269b47cf3d4ba4b39126e05fa42f2f995`.
+- `isolated-extensions-results-2026-10-17T09-22-17-638Z-45ec386d-3429-4a7c-a10e-8673c03861f0.json` — context-mode blocked child-process attempts; `f51d68c164e8f12ab4200398b2c2c4b4fc737b3d3d3b4650ea86dfca2a065e2d`.
+- `isolated-extensions-results-2026-10-17T09-22-22-485Z-1b08e134-667c-4416-8372-cb233939c48b.json` — pi-cache-optimizer; `cef6e34007097c9741d377e081a078934a894190fd039363b1d08039ab35cb49`.
+- `isolated-extensions-results-2026-10-17T09-22-25-490Z-223fd05e-52f9-4996-88d7-3ec43a6ecdd9.json` — pi-permission-system; `f139734d7bf96730e20a77f6438d96f2f015681f2b87c8c9ff9e7943550bf1b2`.
+- `isolated-extensions-results-2026-10-17T09-25-15-842Z-798946f5-b9a5-4810-8a0c-35be6f40abb3.json` — final context-mode read-only; `b5d99d87765528cd1af3558fa7121b5b2bf530fbc2c1cbf4c6c07af2e7febb03`.
+- `isolated-extensions-results-2026-10-17T09-25-19-099Z-89bd000d-bb51-4e3a-b713-51ff1ff4e38b.json` — final context-mode coding; `a310c804338b4d48c2236f42f70c2e476209e918bc6db9650280a1174e650a8a`.
+- `isolated-extensions-results-2026-10-17T09-24-36-866Z-30770d13-c7ae-4309-921b-5c1b43050adb.json` — denied-only context-mode diagnostic with method, sanitized argv pattern and candidate-relative stack frame; retained as diagnostic, not final verdict.
+- Probe source SHA-256: `989f83e9e3cf13981ce55806b536f5879159f7a6787b3a413dfc084f8dac6f22`.
+- Supervisor source SHA-256: `694946fc1ed43c170bc73a243c45aaf16696568c21308a220087bc0a7489706a`.
+- Denied-only context-mode diagnostic SHA-256: `00ea68401be8a93d1ddc217032dd172ebc4c963e4c1c3bedc34c6fc8e0f88d3c`.
+
+Package identity, license, package metadata, lifecycle scripts, peer declarations, and static security/data-flow observations are recorded in the prior static audit at `docs/evaluation/extension-audit-2026-10-17/permission-cache-report.md` and its JSON evidence. Registry/source links and package hashes are included there.