pi-session-mcp 0.8.3 → 0.12.0

package/docs/evaluation/permission-gates-2026-10-17/permission-gate-probe.mjs

@@ -0,0 +1,132 @@
+// Bounded supervisor: publishes evidence only after the worker closes and its
+// process group and temporary scope are observed clean.
+import { randomUUID } from 'node:crypto';
+import { spawn } from 'node:child_process';
+import { mkdir, readFile, readdir, writeFile, lstat } from 'node:fs/promises';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const repo = process.cwd();
+const node = process.execPath;
+if (!node.includes('node-v24.22.0')) throw new Error('approved_node_24_22_0_required');
+const dossier = dirname(fileURLToPath(import.meta.url));
+const worker = join(dossier, 'permission-gate-worker.mjs');
+const archivePath = process.argv[2] ? resolve(process.argv[2]) : join(dossier, 'permission-gates-result.json');
+try { await lstat(archivePath); throw new Error('fresh_archive_path_required'); }
+catch (error) { if (error?.code !== 'ENOENT') throw error; }
+const tempHome = `/tmp/pi-permission-gate-supervisor-${randomUUID()}`;
+const env = { HOME: tempHome, PATH: `${dirname(node)}:/usr/bin:/bin`, DO_NOT_TRACK: '1' };
+await mkdir(tempHome, { mode: 0o700 });
+const child = spawn(node, [worker], { cwd: repo, env, detached: true, stdio: ['ignore', 'pipe', 'ignore'] });
+let output = '';
+let outputOverflow = false;
+let spawnFailed = false;
+let terminal = null;
+const timeoutMs = 45_000;
+let escalation;
+let timedOut = false;
+const deadline = setTimeout(() => {
+  timedOut = true;
+  void signalGroup('SIGTERM');
+  escalation = setTimeout(() => { void signalGroup('SIGKILL'); }, 1_000);
+}, timeoutMs);
+child.stdout.on('data', (chunk) => {
+  if (outputOverflow) return;
+  if (Buffer.byteLength(output) + chunk.length > 65_536) {
+    outputOverflow = true;
+    void signalGroup('SIGKILL');
+  } else output += chunk;
+});
+terminal = await new Promise((resolvePromise) => {
+  child.once('error', () => { spawnFailed = true; resolvePromise({ code: null, signal: null }); });
+  child.once('exit', (code, signal) => resolvePromise({ code, signal }));
+});
+clearTimeout(deadline);
+if (escalation) clearTimeout(escalation);
+
+async function groupMembers(pgid) {
+  let entries;
+  try { entries = await readdir('/proc'); } catch { return null; }
+  const members = [];
+  for (const entry of entries) {
+    if (!/^\d+$/.test(entry)) continue;
+    try {
+      const stat = await readFile(`/proc/${entry}/stat`, 'utf8');
+      const close = stat.lastIndexOf(')');
+      if (close < 0) return null;
+      const fields = stat.slice(close + 2).trim().split(/\s+/);
+      if (Number(fields[2]) === pgid && fields[0] !== 'Z' && fields[0] !== 'X') members.push(Number(entry));
+    } catch { /* a process may exit while /proc is scanned */ }
+  }
+  return members;
+}
+
+async function signalGroup(signal) {
+  try { process.kill(-child.pid, signal); } catch (error) { if (error?.code !== 'ESRCH') throw error; }
+}
+
+async function waitForGroupEmpty(ms) {
+  const end = Date.now() + ms;
+  while (Date.now() < end) {
+    const members = await groupMembers(child.pid);
+    if (members && members.length === 0) return true;
+    await new Promise((resolvePromise) => setTimeout(resolvePromise, 40));
+  }
+  return false;
+}
+
+let processGroupClean = await waitForGroupEmpty(1_500);
+if (!processGroupClean) {
+  await signalGroup('SIGTERM');
+  processGroupClean = await waitForGroupEmpty(1_000);
+}
+if (!processGroupClean) {
+  await signalGroup('SIGKILL');
+  processGroupClean = await waitForGroupEmpty(1_500);
+}
+
+let workerReceipt;
+try {
+  const lines = output.trim().split('\n');
+  if (lines.length !== 1) throw new Error('receipt_line_count');
+  workerReceipt = JSON.parse(lines[0]);
+} catch { workerReceipt = null; }
+
+// Remove the supervisor-only HOME after the child has terminated.
+let supervisorHomeRemoved = false;
+try {
+  const { rm, stat } = await import('node:fs/promises');
+  await rm(tempHome, { recursive: true, force: false });
+  try { await stat(tempHome); } catch (error) { supervisorHomeRemoved = error?.code === 'ENOENT'; }
+} catch { supervisorHomeRemoved = false; }
+
+const processClean = !spawnFailed && !outputOverflow && !timedOut && terminal?.code === 0 && terminal?.signal === null && processGroupClean;
+const cleanupClean = workerReceipt?.cleanup?.dispose_promise_resolved === true
+  && workerReceipt?.cleanup?.fixture_session_shutdown_observed === true
+  && workerReceipt?.cleanup?.temporary_scope_removed === true
+  && supervisorHomeRemoved;
+const pass = processClean && cleanupClean && workerReceipt?.status === 'PASS';
+const receipt = {
+  ...workerReceipt,
+  schema_version: '1.0.0',
+  status: pass ? 'PASS' : 'FAIL',
+  process_supervision: {
+    worker_exit_observed: terminal !== null,
+    worker_exit_code: terminal?.code ?? null,
+    worker_signal: terminal?.signal ?? null,
+    spawn_failed: spawnFailed,
+    timeout_ms: timeoutMs,
+    timeout_triggered: timedOut,
+    output_limit_exceeded: outputOverflow,
+    process_group_empty_observed: processGroupClean,
+    supervisor_home_removed: supervisorHomeRemoved,
+  },
+};
+
+const outputDir = resolve(repo, 'eval/results');
+await mkdir(outputDir, { recursive: true });
+const fileName = `permission-gates-${randomUUID()}.json`;
+await writeFile(join(outputDir, fileName), JSON.stringify(receipt, null, 2) + '\n', { flag: 'wx', mode: 0o600 });
+await writeFile(archivePath, JSON.stringify(receipt, null, 2) + '\n', { flag: 'wx', mode: 0o600 });
+process.stdout.write(JSON.stringify({ status: receipt.status, evidence: `eval/results/${fileName}`, policy_checks: Object.keys(receipt.policy_checks ?? {}).length, in_memory_counter: receipt.synthetic_dispatch?.in_memory_counter ?? null, process_group_empty: processGroupClean, scope_removed: receipt.cleanup?.temporary_scope_removed ?? false }) + '\n');
+if (!pass) process.exitCode = 1;

package/docs/evaluation/permission-gates-2026-10-17/permission-gate-worker.mjs

@@ -0,0 +1,209 @@
+// Provider-free permission-policy and tool_call probe. The candidate package is
+// loaded by the real Pi SDK adapter; the SDK's public ExtensionRunner seam is
+// used to invoke its actual registered gate hook with synthetic events.
+import assert from 'node:assert/strict';
+import { randomUUID } from 'node:crypto';
+import { cp, mkdir, mkdtemp, readFile, rm, symlink, writeFile } from 'node:fs/promises';
+import { dirname, join, resolve } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import net from 'node:net';
+import tls from 'node:tls';
+import http from 'node:http';
+import https from 'node:https';
+import dns from 'node:dns';
+import dnsPromises from 'node:dns/promises';
+import dgram from 'node:dgram';
+import childProcess from 'node:child_process';
+import { syncBuiltinESMExports } from 'node:module';
+
+const repo = process.cwd();
+const scope = await mkdtemp('/tmp/pi-permission-gates-');
+const workspace = join(scope, 'workspace');
+const agent = workspace;
+const npmAgent = resolve(repo, 'eval/results/node24-extension-followup-04470d85-3a99-47e3-b356-ce96e77de0dd/extension-agent');
+const packageRoot = join(npmAgent, 'npm/node_modules/@gotgenes/pi-permission-system');
+const candidateMeta = JSON.parse(await readFile(join(packageRoot, 'package.json'), 'utf8'));
+assert.equal(candidateMeta.version, '40.3.0');
+process.env.HOME = scope;
+process.env.PI_CODING_AGENT_DIR = agent;
+process.env.PI_AUDIT_AGENT_DIR = agent;
+process.env.XDG_CONFIG_HOME = join(scope, 'config');
+process.env.XDG_CACHE_HOME = join(scope, 'cache');
+process.env.XDG_DATA_HOME = join(scope, 'data');
+process.env.DO_NOT_TRACK = '1';
+const fixtureRoot = join(agent, 'npm/node_modules/pi-extension-fixture');
+const companionRoot = join(agent, 'npm/node_modules/pi-permission-probe-companion');
+let deniedNetwork = 0;
+let deniedChildren = 0;
+const blockNetwork = () => { deniedNetwork++; throw Object.assign(new Error('offline_network_denied'), { code: 'OFFLINE_NETWORK_DENIED' }); };
+for (const [target, names] of [
+  [net, ['connect', 'createConnection']], [net.Socket.prototype, ['connect']], [tls, ['connect']],
+  [http, ['request', 'get']], [https, ['request', 'get']], [dns, ['lookup', 'resolve', 'resolve4', 'resolve6']],
+  [dnsPromises, ['lookup', 'resolve', 'resolve4', 'resolve6']],
+  [dnsPromises.Resolver.prototype, ['resolve', 'resolve4', 'resolve6']], [dgram, ['createSocket']],
+]) for (const name of names) target[name] = blockNetwork;
+globalThis.fetch = blockNetwork;
+if ('WebSocket' in globalThis) globalThis.WebSocket = class { constructor() { blockNetwork(); } };
+for (const name of ['spawn', 'spawnSync', 'exec', 'execSync', 'execFile', 'execFileSync', 'fork']) {
+  childProcess[name] = () => { deniedChildren++; throw Object.assign(new Error('offline_child_process_denied'), { code: 'OFFLINE_CHILD_PROCESS_DENIED' }); };
+}
+syncBuiltinESMExports();
+let handle;
+let guard;
+let capturedSession;
+let receipt;
+let disposePromiseResolved = false;
+let sessionShutdownObserved = false;
+let scopeRemoved = false;
+try {
+  await mkdir(join(scope, 'config'), { recursive: true, mode: 0o700 });
+  await mkdir(join(scope, 'cache'), { recursive: true, mode: 0o700 });
+  await mkdir(join(scope, 'data'), { recursive: true, mode: 0o700 });
+  await mkdir(join(workspace, 'extensions/pi-permission-system'), { recursive: true, mode: 0o700 });
+  await mkdir(join(companionRoot, 'node_modules/@gotgenes'), { recursive: true, mode: 0o700 });
+  await cp(join(repo, 'test/fixtures/pi-extension-fixture'), fixtureRoot, { recursive: true, errorOnExist: true });
+  await symlink(packageRoot, join(companionRoot, 'node_modules/@gotgenes/pi-permission-system'));
+  await writeFile(join(workspace, 'extensions/pi-permission-system/config.json'), JSON.stringify({ permission: {
+    '*': 'deny', read: 'allow', write: 'deny', bash: 'ask', fixture_tool: 'allow',
+    mcp: { '*': 'deny', 'fixture_server:fixture_read': 'allow' },
+    path: { '*': 'allow', '*.env': 'deny' }, external_directory: 'allow',
+  } }, null, 2) + '\n', { flag: 'wx', mode: 0o600 });
+  await writeFile(join(companionRoot, 'package.json'), JSON.stringify({ name: 'pi-permission-probe-companion', version: '1.0.0', type: 'module', pi: { extensions: ['./index.ts'] } }) + '\n', { flag: 'wx', mode: 0o600 });
+  await writeFile(join(companionRoot, 'index.ts'), `
+    import { getPermissionsService } from '@gotgenes/pi-permission-system';
+    export default function permissionProbe(pi) {
+      pi.on('session_start', (_event, ctx) => {
+        globalThis.__permissionProbeService = getPermissionsService(ctx.sessionManager.getSessionId());
+      });
+    }
+  `, { flag: 'wx', mode: 0o600 });
+
+  const build = join(repo, '.profile-eval/src');
+  const { installStdoutGuard } = await import(pathToFileURL(join(build, 'stdout-guard.js')));
+  const suppressed = [];
+  guard = installStdoutGuard({ report: (line) => suppressed.push(JSON.parse(line)) });
+  const { SdkPiSessionAdapter } = await import(pathToFileURL(join(build, 'sdk-pi-adapter.js')));
+  const { parseExtensionSpec } = await import(pathToFileURL(join(build, 'extension-spec.js')));
+  const { resolvePiExtension } = await import(pathToFileURL(join(build, 'pi-extensions.js')));
+  const fixtureSpec = parseExtensionSpec('npm:pi-extension-fixture@1.0.0');
+  const candidateSpec = parseExtensionSpec('npm:@gotgenes/pi-permission-system@40.3.0');
+  const companionSpec = parseExtensionSpec('npm:pi-permission-probe-companion@1.0.0');
+  assert.ok(fixtureSpec && candidateSpec && companionSpec);
+  const resolveExtension = (spec) => resolvePiExtension(spec, { agentDir: spec.name === '@gotgenes/pi-permission-system' ? npmAgent : agent });
+  const diagnostics = [];
+  const {
+    ModelRuntime,
+    createAgentSessionServices,
+    createAgentSessionFromServices,
+    createAgentSessionRuntime,
+  } = await import('@earendil-works/pi-coding-agent');
+  const adapter = new SdkPiSessionAdapter({
+    modelRuntimeFactory: () => ModelRuntime.create({ refreshOnCreate: false, allowModelNetwork: false, modelsPath: null, authPath: join(scope, 'absent-auth.json'), modelsStorePath: join(scope, 'absent-models.json') }),
+    resolveExtension,
+    extensionSdk: {
+      createServices: createAgentSessionServices,
+      createSessionFromServices: createAgentSessionFromServices,
+      createRuntime: async (factory, options) => {
+        const runtime = await createAgentSessionRuntime(factory, options);
+        // AgentSessionRuntime.session is a documented public getter. Capture
+        // the SDK result through the injected public adapter seam; never read
+        // private fields from the PiSessionAdapter handle.
+        capturedSession = runtime.session;
+        return runtime;
+      },
+    },
+    diagnosticSink: (item) => diagnostics.push({ stage: item.stage, code: item.code }),
+  });
+  const profile = {
+    alias: 'permission-gates-isolated', permissionProfile: 'coding', provider: 'fixture-ext', model: 'fixture-ext-model', thinkingLevel: 'off',
+    extensions: [fixtureSpec, candidateSpec, companionSpec], skills: [],
+  };
+  handle = await adapter.create({ cwd: workspace, executionProfile: profile });
+  assert.ok(capturedSession, 'public SDK runtime seam must expose its public session result');
+  const loaded = capturedSession.resourceLoader.getExtensions();
+  assert.equal(loaded.errors.length, 0);
+  assert.ok(capturedSession.getActiveToolNames().includes('fixture_tool'));
+  const service = globalThis.__permissionProbeService;
+  assert.ok(service, 'documented package root API must resolve the live node service');
+
+  const checks = {
+    general_allow: service.checkPermission('read').state,
+    general_deny: service.checkPermission('write').state,
+    path_allowed: service.checkPermission('path', join(workspace, 'notes.txt')).state,
+    path_denied: service.checkPermission('path', join(workspace, 'secrets.env')).state,
+    mcp_allowed: service.checkPermission('mcp', 'fixture_server:fixture_read').state,
+    mcp_unmatched: service.checkPermission('mcp', 'unknown_server:unknown_tool').state,
+    headless_ask: service.checkPermission('bash', 'echo synthetic').state,
+  };
+  assert.deepEqual(checks, { general_allow: 'allow', general_deny: 'deny', path_allowed: 'allow', path_denied: 'deny', mcp_allowed: 'allow', mcp_unmatched: 'deny', headless_ask: 'ask' });
+
+  const runner = capturedSession.extensionRunner;
+  const extensionContext = runner.createContext();
+  assert.equal(extensionContext.hasUI, false, 'print adapter must expose no dialog-capable UI');
+  let syntheticExecutorCounter = 0;
+  async function fakeDispatch(toolName, input, id) {
+    const decision = await runner.emitToolCall({ type: 'tool_call', toolName, input, toolCallId: id });
+    const reachedSyntheticExecutor = !decision?.block;
+    if (reachedSyntheticExecutor) syntheticExecutorCounter++;
+    return { decision: decision ?? {}, reachedSyntheticExecutor };
+  }
+  const allowed = await fakeDispatch('fixture_tool', {}, 'synthetic-allow');
+  const denied = await fakeDispatch('write', { path: join(workspace, 'out.txt'), content: 'synthetic' }, 'synthetic-deny');
+  const ask = await fakeDispatch('bash', { command: 'echo synthetic' }, 'synthetic-ask');
+  const unknown = await fakeDispatch('not_registered', {}, 'synthetic-unregistered');
+  assert.equal(allowed.reachedSyntheticExecutor, true);
+  assert.equal(denied.reachedSyntheticExecutor, false);
+  assert.equal(ask.reachedSyntheticExecutor, false, 'headless ask must fail closed');
+  assert.equal(unknown.reachedSyntheticExecutor, false, 'unregistered tool must fail closed');
+  assert.equal(syntheticExecutorCounter, 1, 'only the allowed call reaches the in-memory synthetic counter');
+  assert.equal(deniedNetwork, 0);
+  assert.equal(deniedChildren, 0);
+
+  receipt = {
+    schema_version: '1.0.0', kind: 'pi-permission-system-policy-hook-probe', status: 'PASS',
+    package: `${candidateMeta.name}@${candidateMeta.version}`, node: process.versions.node,
+    loading: 'real SDK adapter and actual candidate package entry',
+    hook: 'public AgentSession.extensionRunner.emitToolCall() invoked the registered actual tool_call handler',
+    policy_checks: checks,
+    synthetic_dispatch: {
+      allowed_tool_reached_counter: allowed.reachedSyntheticExecutor,
+      denied_write_blocked: Boolean(denied.decision.block),
+      headless_ask_blocked: Boolean(ask.decision.block),
+      unregistered_tool_blocked: Boolean(unknown.decision.block),
+      in_memory_counter: syntheticExecutorCounter,
+    },
+    harness_model_prompts_submitted: 0, provider_calls: 0,
+    ui_mode: 'print', has_dialog_capable_ui: extensionContext.hasUI,
+    denied_network_attempts: deniedNetwork, denied_child_process_attempts: deniedChildren,
+    stdout_suppressed_writes: suppressed.reduce((sum, row) => sum + row.writes, 0),
+    diagnostics: diagnostics.map((row) => row.code), evidence_id: randomUUID(),
+    limits: [
+      'An in-memory synthetic counter advances only after an unblocked hook result. No actual executor was attached or invoked; no operating-system command, file write, MCP connection, or external tool was executed.',
+      'These checks cover deterministic policy resolution and registered-hook mediation under a provider-free SDK harness. They do not prove operating-system sandboxing, collector or inner-method enforcement, live UI behavior, MCP transport enforcement, or interactive-client integration.',
+    ],
+  };
+} finally {
+  if (handle) {
+    try {
+      await handle.dispose();
+      disposePromiseResolved = true;
+    } catch { /* Cleanup status remains failed and prevents a PASS receipt. */ }
+    sessionShutdownObserved = globalThis.__piExtensionFixtureEvents?.includes('session_shutdown') ?? false;
+  }
+  delete globalThis.__permissionProbeService;
+  guard?.flush();
+  try {
+    await rm(scope, { recursive: true, force: false });
+    scopeRemoved = true;
+  } catch { scopeRemoved = false; }
+  if (receipt) {
+    receipt.cleanup = {
+      dispose_promise_resolved: disposePromiseResolved,
+      fixture_session_shutdown_observed: sessionShutdownObserved,
+      temporary_scope_removed: scopeRemoved,
+    };
+    receipt.status = disposePromiseResolved && sessionShutdownObserved && scopeRemoved ? 'PASS' : 'FAIL';
+    guard.transportStdout.write(JSON.stringify(receipt) + '\n');
+    if (receipt.status !== 'PASS') process.exitCode = 1;
+  }
+}

package/docs/evaluation/permission-gates-2026-10-17/permission-gates-result-final.json

@@ -0,0 +1,53 @@
+{
+  "schema_version": "1.0.0",
+  "kind": "pi-permission-system-policy-hook-probe",
+  "status": "PASS",
+  "package": "@gotgenes/pi-permission-system@40.3.0",
+  "node": "24.22.0",
+  "loading": "real SDK adapter and actual candidate package entry",
+  "hook": "public AgentSession.extensionRunner.emitToolCall() invoked the registered actual tool_call handler",
+  "policy_checks": {
+    "general_allow": "allow",
+    "general_deny": "deny",
+    "path_allowed": "allow",
+    "path_denied": "deny",
+    "mcp_allowed": "allow",
+    "mcp_unmatched": "deny",
+    "headless_ask": "ask"
+  },
+  "synthetic_dispatch": {
+    "allowed_tool_reached_counter": true,
+    "denied_write_blocked": true,
+    "headless_ask_blocked": true,
+    "unregistered_tool_blocked": true,
+    "in_memory_counter": 1
+  },
+  "harness_model_prompts_submitted": 0,
+  "provider_calls": 0,
+  "ui_mode": "print",
+  "has_dialog_capable_ui": false,
+  "denied_network_attempts": 0,
+  "denied_child_process_attempts": 0,
+  "stdout_suppressed_writes": 0,
+  "diagnostics": [],
+  "evidence_id": "ba5b1b0d-d6a0-4b90-b05a-a254fb7c1b9a",
+  "limits": [
+    "An in-memory synthetic counter advances only after an unblocked hook result. No actual executor was attached or invoked; no operating-system command, file write, MCP connection, or external tool was executed.",
+    "These checks cover deterministic policy resolution and registered-hook mediation under a provider-free SDK harness. They do not prove operating-system sandboxing, collector or inner-method enforcement, live UI behavior, MCP transport enforcement, or interactive-client integration."
+  ],
+  "cleanup": {
+    "dispose_promise_resolved": true,
+    "fixture_session_shutdown_observed": true,
+    "temporary_scope_removed": true
+  },
+  "process_supervision": {
+    "worker_exit_observed": true,
+    "worker_exit_code": 0,
+    "worker_signal": null,
+    "spawn_failed": false,
+    "timeout_ms": 45000,
+    "output_limit_exceeded": false,
+    "process_group_empty_observed": true,
+    "supervisor_home_removed": true
+  }
+}

package/docs/evaluation/permission-gates-2026-10-17/permission-gates-result-verified.json

@@ -0,0 +1,54 @@
+{
+  "schema_version": "1.0.0",
+  "kind": "pi-permission-system-policy-hook-probe",
+  "status": "PASS",
+  "package": "@gotgenes/pi-permission-system@40.3.0",
+  "node": "24.22.0",
+  "loading": "real SDK adapter and actual candidate package entry",
+  "hook": "public AgentSession.extensionRunner.emitToolCall() invoked the registered actual tool_call handler",
+  "policy_checks": {
+    "general_allow": "allow",
+    "general_deny": "deny",
+    "path_allowed": "allow",
+    "path_denied": "deny",
+    "mcp_allowed": "allow",
+    "mcp_unmatched": "deny",
+    "headless_ask": "ask"
+  },
+  "synthetic_dispatch": {
+    "allowed_tool_reached_counter": true,
+    "denied_write_blocked": true,
+    "headless_ask_blocked": true,
+    "unregistered_tool_blocked": true,
+    "in_memory_counter": 1
+  },
+  "harness_model_prompts_submitted": 0,
+  "provider_calls": 0,
+  "ui_mode": "print",
+  "has_dialog_capable_ui": false,
+  "denied_network_attempts": 0,
+  "denied_child_process_attempts": 0,
+  "stdout_suppressed_writes": 0,
+  "diagnostics": [],
+  "evidence_id": "38d814fd-395d-458c-8e92-ca134c3fc721",
+  "limits": [
+    "An in-memory synthetic counter advances only after an unblocked hook result. No actual executor was attached or invoked; no operating-system command, file write, MCP connection, or external tool was executed.",
+    "These checks cover deterministic policy resolution and registered-hook mediation under a provider-free SDK harness. They do not prove operating-system sandboxing, collector or inner-method enforcement, live UI behavior, MCP transport enforcement, or interactive-client integration."
+  ],
+  "cleanup": {
+    "dispose_promise_resolved": true,
+    "fixture_session_shutdown_observed": true,
+    "temporary_scope_removed": true
+  },
+  "process_supervision": {
+    "worker_exit_observed": true,
+    "worker_exit_code": 0,
+    "worker_signal": null,
+    "spawn_failed": false,
+    "timeout_ms": 45000,
+    "timeout_triggered": false,
+    "output_limit_exceeded": false,
+    "process_group_empty_observed": true,
+    "supervisor_home_removed": true
+  }
+}

package/docs/evaluation/permission-gates-2026-10-17/permission-gates-result.json

@@ -0,0 +1,53 @@
+{
+  "schema_version": "1.0.0",
+  "kind": "pi-permission-system-policy-hook-probe",
+  "status": "PASS",
+  "package": "@gotgenes/pi-permission-system@40.3.0",
+  "node": "24.22.0",
+  "loading": "real SDK adapter and actual candidate package entry",
+  "hook": "public AgentSession.extensionRunner.emitToolCall() invoked the registered actual tool_call handler",
+  "policy_checks": {
+    "general_allow": "allow",
+    "general_deny": "deny",
+    "path_allowed": "allow",
+    "path_denied": "deny",
+    "mcp_allowed": "allow",
+    "mcp_unmatched": "deny",
+    "headless_ask": "ask"
+  },
+  "synthetic_dispatch": {
+    "allowed_tool_reached_counter": true,
+    "denied_write_blocked": true,
+    "headless_ask_blocked": true,
+    "unregistered_tool_blocked": true,
+    "in_memory_counter": 1
+  },
+  "harness_model_prompts_submitted": 0,
+  "provider_calls": 0,
+  "ui_mode": "print",
+  "has_dialog_capable_ui": false,
+  "denied_network_attempts": 0,
+  "denied_child_process_attempts": 0,
+  "stdout_suppressed_writes": 0,
+  "diagnostics": [],
+  "evidence_id": "a522f14a-9b44-49dd-b738-d39c56571910",
+  "limits": [
+    "An in-memory synthetic counter advances only after an unblocked hook result. No actual executor was attached or invoked; no operating-system command, file write, MCP connection, or external tool was executed.",
+    "These checks cover deterministic policy resolution and registered-hook mediation under a provider-free SDK harness. They do not prove operating-system sandboxing, collector or inner-method enforcement, live UI behavior, MCP transport enforcement, or interactive-client integration."
+  ],
+  "cleanup": {
+    "dispose_promise_resolved": true,
+    "fixture_session_shutdown_observed": true,
+    "temporary_scope_removed": true
+  },
+  "process_supervision": {
+    "worker_exit_observed": true,
+    "worker_exit_code": 0,
+    "worker_signal": null,
+    "spawn_failed": false,
+    "timeout_ms": 45000,
+    "output_limit_exceeded": false,
+    "process_group_empty_observed": true,
+    "supervisor_home_removed": true
+  }
+}

package/docs/evaluation/permission-gates-2026-10-17/review.json

@@ -0,0 +1,19 @@
+{
+  "kind": "independent-read-only-permission-gate-review",
+  "status": "PASS",
+  "blocking_findings": [],
+  "reviewed_scope": [
+    "permission-gate-worker.mjs",
+    "permission-gate-probe.mjs",
+    "permission-gates-result-final.json"
+  ],
+  "conclusion": "Public SDK runtime/session and extension-runner APIs are used; the actual candidate hook is invoked with SDK context. Scoped temporary state, zero model turns and observed cleanup are supported. The synthetic counter is not a tool executor and does not prove executor enforcement.",
+  "earlier_findings_resolved": [
+    "Replaced private adapter-handle access with injected public runtime capture.",
+    "Clarified synthetic counter and harness-only zero-prompt claims.",
+    "Publication follows disposal, process exit/group and temporary-scope cleanup."
+  ],
+  "reviewer_mutations": 0,
+  "reviewer_provider_calls": 0,
+  "final_controller_check": "Explicit timeout flag was added and the final successful probe rerun after this read-only review."
+}

package/docs/evaluation/permission-gates-2026-10-17/superseded-initial-receipt.json

@@ -0,0 +1,40 @@
+{
+  "schema_version": "1.0.0",
+  "kind": "pi-permission-system-policy-hook-probe",
+  "status": "SUPERSEDED",
+  "package": "@gotgenes/pi-permission-system@40.3.0",
+  "node": "24.22.0",
+  "loading": "real SDK adapter and actual candidate package entry",
+  "hook": "public AgentSession.extensionRunner.emitToolCall() invoked the registered actual tool_call handler",
+  "policy_checks": {
+    "general_allow": "allow",
+    "general_deny": "deny",
+    "path_allowed": "allow",
+    "path_denied": "deny",
+    "mcp_allowed": "allow",
+    "mcp_unmatched": "deny",
+    "headless_ask": "ask"
+  },
+  "synthetic_dispatch": {
+    "allowed_tool_reached_counter": true,
+    "denied_write_blocked": true,
+    "headless_ask_blocked": true,
+    "unregistered_tool_blocked": true,
+    "in_memory_counter": 1
+  },
+  "harness_model_prompts_submitted": 0,
+  "provider_calls": 0,
+  "ui_mode": "print",
+  "has_dialog_capable_ui": false,
+  "denied_network_attempts": 0,
+  "denied_child_process_attempts": 0,
+  "stdout_suppressed_writes": 0,
+  "diagnostics": [],
+  "evidence_id": "71f99101-ebb7-467e-915f-c5d4779cbb95",
+  "limits": [
+    "An in-memory synthetic counter advances only after an unblocked hook result. No actual executor was attached or invoked; no operating-system command, file write, MCP connection, or external tool was executed.",
+    "These checks cover deterministic policy resolution and registered-hook mediation under a provider-free SDK harness. They do not prove operating-system sandboxing, collector or inner-method enforcement, live UI behavior, MCP transport enforcement, or interactive-client integration."
+  ],
+  "superseded_reason": "The initial run accessed handle.session even though that property is private on the evaluation adapter handle. Results are retained as historical diagnostic evidence and replaced by the public extensionSdk capture run.",
+  "superseded_by": "permission-gates-result.json"
+}

package/docs/evaluation/pi-lens-registration-2026-10-19/README.md

@@ -0,0 +1,90 @@
+# pi-lens registration gate — 2026-10-19
+
+## Result: PASS
+
+With `pi-lens@4.4.3` and `@earendil-works/pi-coding-agent@1.3.0`, both
+`symbol_search` and `project_report` are registered **during extension load,
+before `bindExtensions`**. Both remain registered and are active after bind in
+the coding tool profile. The registered set does not change across bind. The
+lazy-registration stop condition is not hit; this gate permits the remaining
+implementation work.
+
+The exact one-line output is in [`result.json`](result.json). Its arrays are
+sorted, flattened tool names from the two loaded extensions:
+
+| Extension | Tools after load | Tools after bind |
+| --- | --- | --- |
+| `pi-extension-fixture@1.0.0` | `fixture_tool` | `fixture_tool` |
+| `pi-lens@4.4.3` | `ast_grep_outline`, `ast_grep_replace`, `ast_grep_search`, `effective_config`, `lens_diagnostic_mark`, `lens_diagnostics`, `lsp_navigation`, `module_report`, `pi_lens_activate_tools`, `project_report`, `read_enclosing`, `read_symbol`, `symbol_search` | Identical to load |
+
+`activeCoding` records the actual post-bind active tool names, not merely the
+requested set. Some pi-lens tools are registered but inactive after bind;
+`symbol_search` and `project_report` are both active.
+
+## Method and safety
+
+- Starting repository commit: `d7897fae470379536d895cf2850a305cc07de373`, branch
+  `feat/read-only-extension-tools`. Runtime: Node.js `v26.11.1`.
+- Installed the exact pi-lens version into a throwaway agent directory's
+  `npm/node_modules/pi-lens`, with lifecycle scripts, audit and funding checks
+  disabled. Transitive versions were resolved by npm, not pinned by this record.
+  This install was the only permitted network operation.
+- Used only SDK package-root imports: `ModelRuntime`, `SettingsManager`,
+  `SessionManager`, `createAgentSessionServices`,
+  `createAgentSessionFromServices`, and `createAgentSessionRuntime`.
+  This follows the adapter's load → create → bind sequence without changing the
+  adapter. The coding set starts with all seven built-ins plus the loaded tools.
+- Copied the repository fixture to the throwaway agent's npm layout. Its offline
+  provider (`fixture-ext` / `fixture-ext-model`) supplies model metadata only.
+  No prompt, tool execution, command dispatch, or provider turn was started.
+- Before extension loading, replaced the public runtime model-call methods with
+  counting throwers. The fixture's stream event is also checked. Success requires
+  zero provider and child-process attempts.
+- Before SDK import, denied `fetch`, WebSocket, net, TLS, HTTP(S), and DNS entry
+  points as in the earlier cursor evaluation probe; counted **0 network
+  attempts**. Denied child-process entry points as well to prevent subprocess
+  network bypass. These are in-process guards, not a general OS sandbox or a
+  claim about every possible native networking API.
+- Cleared inherited environment variables before SDK import. Redirected HOME,
+  XDG state, temporary files, credentials storage and Pi's agent directory to the
+  throwaway tree; disabled catalog refresh and model networking. No personal Pi,
+  Claude or Codex directories were used. Workspace was an empty throwaway
+  directory, `projectTrusted: false`, matching production trust policy.
+  In-memory settings/session history and disabled resource discovery avoid
+  personal/project configuration, skills, prompts, themes and context files.
+- Suppressed third-party stdout/stderr (the fixture intentionally emits stdout)
+  so the probe emits only its JSON result and records no incidental paths.
+  Disposed the session runtime, including shutdown hooks. Removed the throwaway
+  tree after recording and checking the result.
+
+## Reproduction
+
+Run from this clone with its installed SDK 1.3.0 and Node.js 22.19.0 or newer:
+
+```bash
+agentDir=$(mktemp -d "$HOME/.cache/pi-lens-probe.XXXXXX")
+mkdir -p "$agentDir/home" "$agentDir/tmp"
+touch "$agentDir/user.npmrc" "$agentDir/global.npmrc"
+env -i PATH="$PATH" HOME="$agentDir/home" TMPDIR="$agentDir/tmp" \
+  npm_config_cache="$agentDir/npm-cache" \
+  npm_config_userconfig="$agentDir/user.npmrc" \
+  npm_config_globalconfig="$agentDir/global.npmrc" \
+  npm install --ignore-scripts --no-audit --no-fund \
+  --prefix "$agentDir/npm" pi-lens@4.4.3
+node --check docs/evaluation/pi-lens-registration-2026-10-19/probe.mjs
+node docs/evaluation/pi-lens-registration-2026-10-19/probe.mjs "$agentDir" \
+  > docs/evaluation/pi-lens-registration-2026-10-19/result.json
+rm -rf -- "$agentDir"
+```
+
+Observed checks: syntax check exit 0; probe exit 0 with one JSON line. The probe
+was run twice (the second run included the strengthened pre-load model-call
+guards), with identical tool arrays and network count. Result assertions passed:
+load and bound sets equal; both required names present at both stages and active;
+network attempts zero. No general test suite or live/provider acceptance was run:
+this is a provider-free registration gate only.
+
+An initial installation command used `/dev/null` for both npm config paths and
+failed before configuration resolution (`double-loading config`). Retrying with
+two distinct empty config files succeeded (15 packages installed). No lifecycle
+scripts ran in either attempt.