pi-session-mcp 0.8.3 → 0.12.0

package/docs/sprints/2026-10-26-s11-orchestration-gaps.md

@@ -0,0 +1,173 @@
+# Sprint 11: orchestration gaps
+
+Planning basis: main `d93a6d6` (merge of PR #140), published 0.11.6,
+2026-10-26. Entry: the Sprint 10 results and decision D1 in the
+[Sprint 10 file](2026-10-26-s10-orchestration-reliability.md). This file plans
+work and records it as it lands; it claims nothing that its progress log does
+not state with evidence.
+
+## Decisions taken at planning (2026-10-26)
+
+- Scope: Sprint 11 as planned (K3, K9, K8, K7, K5 into the skill), plus the
+  Doctor gap of #139 as its own issue, migration step 2 and one L4 live pair.
+- D3 (worker result channel, K11): no ADR yet. The status contract (K2) is
+  observed live on this sprint's worker tasks first.
+- #120 (`undici` in Pi SDK 1.4.0): option 1, wait for an SDK release that lifts
+  the pin. 1.4.0 is still the newest SDK version on 2026-10-26.
+- No release on this branch.
+- L4 budget: at most two live turns, provider OpenAI, profile `code`.
+
+## Tasks
+
+| Id | Task | Route | Change area |
+| --- | --- | --- | --- |
+| T1 | [#141](https://github.com/plagor44-ux/pi-session-mcp/issues/141): Doctor reports coding profiles a container writer would refuse, with one rule set shared with `renderContainedConfig` | `pi-session-mcp-w1`, `code` | `src/doctor.ts`, `src/writer-lifecycle.ts`, tests, docs |
+| T2 | K8: wake after `PostToolUseFailure` | controller analysis | this file |
+| T3 | Records: v0.11.6 post-release state, S10-4 writer rollout, roadmap | controller | `docs/` |
+| T4 | K3 and K9: compaction context hook and verification `Stop` gate on the evaluation ledger, outside the package (D1) | `pi-session-mcp-w2`, `code` | `eval/bridge/`, tests, evaluation README |
+| T5 | K7: provider-free probe whether a subagent's sessions and wakes reach the right context | after T1, `pi-session-mcp-w1` | `eval/bridge/` |
+| T6 | K5 written into the controller skill with this sprint's review numbers | controller | `skills/pi-session-orchestration/` |
+| T7 | [#142](https://github.com/plagor44-ux/pi-session-mcp/issues/142): container writers fail OAuth turns in the five minutes before the token expires; warm up the host login before the SDK's window | after T1 or T4, a writer with `code` | `src/writer-credentials.ts`, `src/writer-launch.ts`, tests, docs |
+| M2 | Migration step 2: `node-app`, four writers, retire `node-app-w1`–`node-app-w4` | controller and operator | operator configuration |
+| L4 | One live pair with a turn of several minutes and the wake | controller | evaluation record |
+
+K5 runs on every code task: review by `review-glm` for code by `code`, rounds
+1–3 as follow-ups in the same session.
+
+## T2: no wake after `PostToolUseFailure`
+
+Claude Code fires `PostToolUseFailure` when a tool that started fails,
+including an MCP tool that returns an error result, and it matches on the tool
+name like `PostToolUse`. The hooks reference sets no event restriction on
+`asyncRewake`, and it does not confirm one either. The question is
+whether a failed call can leave a running turn without a waiter:
+
+- `pi_turn_get` fails only with `unknown_session`, `unknown_turn` or an input
+  error. None of them names a turn that is still running.
+- `pi_session_prompt` fails with `prompt_timeout` or `prompt_rejected` and
+  creates no public turn, or with `session_running`, where the running turn
+  already has the waiter armed by its own prompt.
+- A transport failure means the server is gone, and with it every in-memory
+  session.
+
+A hook on `PostToolUseFailure` would therefore only ever arm a wait for a turn
+that does not run, and wake the controller after the full budget for nothing.
+Its input carries only the controller's own `tool_input`, not a turn the server
+confirmed. Decision: no product change. The other half of K8, a hook timeout
+that covers the wait budget, already holds: `buildWakeEntry` sets the timeout
+to the budget plus 60 s (`src/setup-hooks.ts`).
+
+## Progress log
+
+Recorded as work lands on the branch.
+
+- Preflight 2026-10-26: both pilot writers were reset to `main` (`d93a6d6`)
+  and reported `writer_reset` and `writer_reconnect_required`; after the
+  reconnect, `pi_capabilities_get` on both reported 0.11.6 and delivery
+  `spool`, and `--verify` reported `mcp_verified` and `hook_verified`. Three
+  collected refs from Sprint 9 and 10 were deleted from the operator checkout
+  after a file-by-file comparison showed their content on `main`.
+- First attempts of T1 and T4 (profile `code`, provider `openai`) both ended
+  `failed` at 18:19:09 and 18:19:19 UTC, 4 and 3 minutes after their start;
+  the host's `auth.json` was rewritten at 18:19 UTC. Reading the code found the
+  cause candidate, filed as #142 and fixed as T7. The uncommitted work was
+  collected as `-wip` refs; a coding start then refused the changed clone, so
+  each writer was reset onto a local branch at its WIP ref and a fresh session
+  finished from there. Both second attempts reported `DONE_WITH_CONCERNS` with
+  a valid status line.
+- T1 (#141): `review-glm` verdict `NON_BLOCKING_ONLY`, two low findings (setup's
+  Doctor gate did not pass its configuration path; an optional parameter
+  defaulting to an empty set). Both fixed by the controller. One review round.
+- T4 (K3, K9): `review-glm` verdict `NON_BLOCKING_ONLY`, two medium and two low
+  findings. The Stop gate blocked failed or aborted tasks with no reachable
+  remedy (also reported by the worker and found by the controller), and
+  `process.exit` after `stdout.write` could drop the hook output (found only by
+  the review). One fix round by `code-deepseek` on `pi-session-mcp-w2`, read by
+  the controller.
+- Full suite on the host for both branches: 114 and 115 files, 3455 passed,
+  13 skipped, none failed. The eight lock and hook tests that time out inside
+  the writer containers passed on the host again.
+- T7 (#142): implemented by `code-glm` on `pi-session-mcp-w1`. The controller
+  checked that importing the SDK, `ModelRuntime.create` and `getAuth` against
+  an empty auth file write nothing to stdout and leave the file unchanged.
+- T7 review by `review` (another family than `code-glm`): verdict
+  `NON_BLOCKING_ONLY`. Two low findings: a provider with tokens shorter than
+  ten minutes would refresh on every tick, and `ModelRuntime` is used outside
+  `PiSessionAdapter`. The second is a narrow, credential-only exception that
+  touches no session and needs the maintainer's confirmation; the first is
+  recorded, as the OpenAI tokens on the workstation live one hour.
+- L4 live pair, also meant as a live check of #142: one turn with profile
+  `code` on `pi-session-mcp-w2`, three shell sleeps of 100 s, 5 min 22 s long,
+  completed and woke the controller without polling. Its model requests fell
+  at 19:11:07 and 19:12:47 UTC. Another host process refreshed the host token at
+  19:11:15 and the wrapper copied it into the writer at 19:12:21, so the
+  failure window ran only from 19:11:12 to 19:12:21 and neither request fell
+  into it. The check is inconclusive for #142 and consistent with it: the
+  window's length depends on when some host process refreshes. A first live
+  turn with a worse timing was aborted after 22 s, so the budget of two live
+  turns was used up by one aborted and one completed turn.
+- T5 (K7): probe scenario `K7` in `eval/bridge/product-probe.ts`, written by
+  `code-glm` on `pi-session-mcp-w1` and run once by the controller on the host
+  (Claude Code 2.1.310, provider-free). The main conversation lists a session
+  that a subagent started (shared server), and the wake for the subagent's
+  turn reached the main conversation, not the subagent; the hook input inside
+  the subagent carried `agent_id` and `agent_type`
+  ([results](../evaluation/subagent-probe-2026-10-26/README.md)). In this run
+  the subagent had returned before its turn ended; whether a still-running
+  subagent receives the wake was not tested. The answer to "does the wake
+  reach the subagent" is no for this case, so K7 stops here as planned ("stop
+  if either answer is no"). The `review` verdict was `BLOCKING` on robustness:
+  the main conversation's list races the subagent, which can only produce a
+  false "no" for Q1, and the subagent classifier has an untested gap. The
+  controller kept the recorded answers, corrected two README overstatements
+  and recorded both limits instead of a second fix round.
+- T6 (K5): the review stage with at most three fix rounds is written into
+  section 8 of the controller skill, and section 11 explains how a fresh
+  session continues from collected work. Every code task of this sprint had
+  one cross-family review.
+- Final independent review of the whole branch (Claude `reviewer`): verdict
+  `BLOCKING` on one medium finding, fixed on the branch: the setup Doctor gate
+  treated `container_profile_refused` for the repository's own profile
+  (`<alias>:<profile>`) as a foreign error, which would block collect, finish
+  and the very profile change that fixes it. The gate now counts that check as
+  the repository's own; tests cover both directions. Low findings fixed: the
+  wrapper refreshes several OAuth providers in parallel under one 20 s bound
+  instead of one after another; a test runs the real SDK refresh path on an
+  auth file without OAuth entries and asserts no stdout write and unchanged
+  bytes; the changelog no longer claims a live confirmation; the review count
+  in the skill was corrected. Recorded as limits: an OAuth provider defined
+  only in Pi's `models.json` is probably unknown to the refresh runtime
+  (`modelsPath: null`), unverified; the evaluation hooks read under the
+  ledger lock, so a hook killed at its timeout can leave a stale lock.
+- Maintainer decision (2026-10-26, after the merge of #146): #142's use of
+  `ModelRuntime` from the package root outside `PiSessionAdapter`, for the
+  credential refresh only and without a session, is confirmed as a narrow
+  exception and recorded in AGENTS.md. Released as 0.11.7.
+- #136 hypothesis (a running writer server recovers after a reset without a
+  reconnect): a start 47 s after a reset succeeded without a reconnect; a start
+  about 30 s after another reset failed with `local_authentication_missing`.
+  This fits the wrapper's 60 s credential copy but is two observations, not a
+  proof; the skill keeps the reconnect.
+- Migration step 2 (M2): host isolation control passed; four
+  `node-app` writers provisioned and accepted on the first
+  `--apply`, registered for Claude Code and Codex with the wake hook; the host
+  aliases `node-app-w1`–`node-app-w4` were removed from the configuration (Doctor then
+  reported no warning for the repository) and their worktrees set clean and
+  detached on `main`. A real coding turn per writer is open: it needs a
+  controller started in that repository's checkout.
+- Both read-only review sessions reported reading files outside their
+  workspace (a writer clone, and a temporary worktree under `~/.cache` that a
+  gate run had created); the controller did not verify which files they read. That matches the documented
+  limit: a read-only profile restricts Pi's tools, not the filesystem.
+
+## After the merge (2026-10-26)
+
+- 0.11.7 was released with #141, #142 and the review stage. The workstation
+  upgrade from 0.11.6 failed on #148 (the repository step's Doctor gate
+  blocked on the other container repository's unready writers) and was rolled
+  back to 0.11.6 without loss: the writers' acceptance was still current for
+  0.11.6.
+- 0.11.8 fixed #148 (one cross-family review, `NON_BLOCKING_ONLY`) and was
+  released the same day. The workstation was upgraded straight from 0.11.6 to
+  0.11.8; all six writers were accepted again and both client targets
+  verified. Records: `docs/acceptance.md`.

package/docs/threat-model.md

@@ -48,8 +48,10 @@ Pi Session MCP trusts the local process that launches and speaks MCP over inheri
   There is no clock-based stale recovery. A transaction guardian inherits that
   locked file description, launches each mutating client command in its own
   process group, and retains the fence across parent death until a determinate
-  process-table scan confirms that no non-zombie group member remains. The
-  scan reads `/proc` on Linux and the trusted system `/bin/ps` on macOS; a
+  process-table scan confirms that no live group member remains. A single-threaded
+  zombie has terminated and holds no descriptors; on Linux a zombie thread-group
+  leader whose group still counts other threads counts as alive. The scan reads `/proc`
+  on Linux and the trusted system `/bin/ps` on macOS; a
   `ps` sample that fails, has an unexpected line or does not list the scanning
   process is indeterminate. On macOS the proof rests on `/bin/ps` on the
   sealed, SIP-protected system volume, together with the uid and mode check
@@ -75,7 +77,7 @@ Pi Session MCP trusts the local process that launches and speaks MCP over inheri
 - **Missing/auth-refresh failure:** a catalog entry alone does not prove authentication. `checkAuth()`, `getAuth(model)`, and local availability are checked with a deadline before creation. Auth values and raw refresh failures never leave the adapter.
 - **Thinking-level clamping:** SDK capability handling can alter a requested level. The adapter compares the effective `session.thinkingLevel` after creation and disposes on a mismatch.
 - **Orphaned SDK session:** a post-creation mismatch or later registry failure could otherwise leave a live Pi handle. The adapter holds it locally until all postconditions pass, best-effort disposes on each later failure, and the registry admits only verified handles.
-- **Excess capability:** the execution profile selects a permission-derived tool allowlist. Read-only permits only `read`, `grep`, `find`, and `ls`; coding remains high impact.
+- **Excess capability:** the execution profile selects a permission-derived tool allowlist. Read-only permits `read`, `grep`, `find`, `ls`, granted MCP tools and exactly the individually granted extension tools; coding remains high impact.
 - **Project resource code execution:** Pi resource loading disables extension discovery, default skill directories, prompts, and themes; only a profile's allowlisted extensions and its explicitly selected catalog skills load (see below). A skill, prompt template or theme that an extension package ships is not made available by the allowlist. Non-executable `AGENTS.md` context remains untrusted instruction content, never authorization.
 - **Concurrent state corruption:** a per-session queue serializes prompt admission and close; concurrent abort callers share one attempt for the active turn. Closing is terminal, settles an active turn, and disposes once.
 - **Secret/prompt disclosure:** stdout is protocol-only. Stderr diagnostics use stable code and safe context only. Public metadata is whitelisted and omits auth objects/sources, credential paths, headers, base URLs, complete model objects, SDK IDs, raw provider errors, prompts, transcripts, and tool data. Completed `assistantText` can still repeat model-visible data and is potentially sensitive.
@@ -85,7 +87,20 @@ Pi Session MCP trusts the local process that launches and speaks MCP over inheri
 - **Allowlisted Pi extensions:** a profile's `extensions` load operator-trusted code into the server process with the user's full rights; it may start processes, use the network and write files (for example `pi-cursor-sdk` below `~/.pi/agent`, `~/.cursor/projects/` and `<workspace>/.pi/`). Mitigations:
   - Only exact `npm:<name>@<version>` specs from the operator's configuration load; the MCP client cannot name an extension.
   - Resolution never installs, and a different installed version fails closed. Only Pi's own user install (`<Pi agent dir>/npm/node_modules/<name>`, normally below `~/.pi/agent`) counts; a package installed elsewhere, for example with `npm i -g`, is reported as not installed.
-  - `read-only` profiles never activate extension tools. At session start, after load and again after binding, no extension tool may shadow a built-in or granted tool; later registrations are covered in the residual risks.
+  - `read-only` profiles activate only extension tools individually named in
+    `grantedExtensionTools`; without grants they remain inactive. The grant is
+    the operator's trust decision, not a read-only classification: granted tools
+    are third-party code and may write. Workspace modes `container` and
+    `read-only` do not restrict them. See
+    [ADR 0010](adr/0010-read-only-extension-tools.md).
+  - Grants must be registered at extension load and active and declared to the
+    model at admission, or start fails closed with `extension_tool_missing`
+    (class `needs_operator`). The SDK activates only declarable tools;
+    registration alone is insufficient. Lazy registration in `session_start`
+    or later is unsupported. An extension's `setActiveTools` cannot add
+    ungranted tools. After load and again after binding, no extension tool may
+    shadow a built-in or granted tool; later registrations are covered in the
+    residual risks.
   - Client prompts never dispatch extension commands, but extension input hooks can still see, rewrite or consume a prompt. They receive it with `source: "rpc"`, Pi's marker for input from a program, so a hook that reads the source sees that no human typed it. A hook that ignores the source treats it like any other input.
   - Each extension session gets its own model runtime, and close emits `session_shutdown`.
 - **Skills as prompt content:** a profile's `skills` select files from the operator's `skillCatalog`. The MCP client cannot name a skill, a path or a catalog entry; `pi_session_start` and `pi_session_prompt` take no skill input. Mitigations:
@@ -100,6 +115,19 @@ Pi Session MCP trusts the local process that launches and speaks MCP over inheri
 - **stdout corruption:** every write through `process.stdout` or `console.log`, `console.info` and `console.debug` other than the MCP transport's is dropped. The stdout guard intercepts `process.stdout.write`, `process.stdout.end` and `console.log`, `console.info` and `console.debug`, which covers output from extensions and the SDK in the server process. stderr gets only `foreign_stdout_suppressed` with byte and write counts, never the content. Anything that writes file descriptor 1 directly is not covered; see the residual risks.
 - **Misleading annotations:** annotations are client hints only and never grant access.
 - **Shutdown orphaning:** `SIGINT`, `SIGTERM`, and stdin EOF invoke the same bounded registry cleanup and transport close, so a client that only closes stdin does not leave sessions or their MCP children running. Handles are disposed at most once; late promises are ignored after removal. Explicit process exit prevents local shutdown from hanging indefinitely, but SDK limitations can leave external work unconfirmed or abruptly cut off.
+- **Turn-event spool (opt-in, [ADR 0011](adr/0011-turn-events-and-controller-wake.md)):** with `events.delivery: "spool"` the server writes one content-free file per terminal turn below `$XDG_RUNTIME_DIR/pi-session-mcp/events/`, and a Claude Code hook on the host reads them to wake the controller. New assets: the host runtime spool, the hook entry in a Claude Code settings file and the claims directory. Relayed turns use the host registry and spool; there is no per-session writer spool mount or writer hook entry, and the wake hook matches only `mcp__pi-session-mcp__*`. Mitigations:
+  - Events carry identifiers, a state and a time only: no prompt, answer, path or error text. Files are mode 0600 in directories of mode 0700, and the server refuses a root that is not a real directory of the current user without group or other access (`event_spool_unavailable`). Doctor reports an unusable or unsafe runtime directory without creating anything (`event_spool_root`).
+  - An event is a wake trigger, never state. The controller reads `pi_turn_get` and acts on that, so no event can change a result, a session or a decision of the registry. The server never reads the spool back.
+  - A container worker has no spool mount and cannot forge, delete or flood host events through one. The host relay validates inner replies and owns public terminal transitions; inner state remains untrusted. The operator's runtime directory and claims remain outside every writer mount.
+  - The hook parses strictly (exact keys, UUID identifiers, at most 1,024 bytes) and bounds its reads: at most 4,096 entries per directory, the 64 newest instance directories, a cache of 4,096 files, and a minimum gap between scans. It opens every directory with `O_NOFOLLOW`, checks the handle and reads through it, opens files with `O_NOFOLLOW`, accepts only regular files, and ignores an event whose instance does not match its directory. It follows no link.
+  - Claims live in `claims/` next to, not inside, the events root (a hook whose claims directory lies inside the events root stays silent), which no writer mount contains. A claim is a content-free empty file created exclusively; a hook that is killed releases an undelivered claim.
+  - At most one waiter runs per turn (an exclusive lock in `claims/`), a turn ended by `close` does not wake, and a waiter whose namespace shows no spool directory within 2 seconds exits quietly. If the runtime directory is full (`ENOSPC`, `EDQUOT`), claims and locks cannot be written and the waiter falls back to the budget wake, which needs neither.
+  - The hook never prints more than event identifiers and a state, never a stack trace, and exits 0 silently on any unexpected input. It exits when its parent goes away. Its stdin is capped at 1 MiB and 10 seconds.
+  - The hook runs on the host as the operator and makes no model call and no network access. What it prints becomes a system message for the controller, so the line is fixed text plus validated identifiers and a validated state.
+  - Setup edits a Claude Code settings file, which is operator configuration. It writes one `PostToolUse` entry under the same dry-run, ownership and divergence rules as a registration: a read-modify-write with a compare-and-swap on the file bytes (a changed file is read again once, a second change fails with `settings_changed`), an atomic rename that keeps the file mode, a pending-before-write ownership record and no replacement or deletion of an entry it does not own. In a project scope it never follows a link below the project root. The entry holds absolute paths of the Node executable and the package, which must be free of shell metacharacters (`hook_path_unsafe`). Ownership records hold a fingerprint, never a path or a command.
+
+- **Concurrent writer use and orphaned containers ([ADR 0012](adr/0012-leased-writer-pool.md)):** new assets are the host-only lease directory/files, stable wrappers, relay subprocess/transport and recorded workspace default base. The launcher holds `~/.local/state/pi-session-mcp/leases/<name>.lock`, not the host server. Files are never deleted, opened without following links and checked for type, owner and mode (0700 directory, 0600 file). Every mutating setup operation takes the same lease with a bounded wait (`writer_busy`), including collect and acceptance. Mutating host children inherit its descriptor; nested launchers validate/adopt it. Neither container nor Podman's monitor receives it, so worker code cannot unlock it. Fixed session name `pi-writer-<name>` and label `pi-session-mcp.writer=<name>` supplement the lock. Under the lease the holder confirms absence by label and clone mount, removes orphaned containers and fails closed if absence is uncertain, before any credential or clone change. Stdin end, SIGTERM and SIGHUP trigger refresh join and container cleanup while the launcher still holds the fence; a killed holder's leftovers are removed by the next holder. The trusted same-UID operator must not replace lease files or mutate writers outside setup.
+- **Untrusted relay replies and wrong-base work:** inner replies are schema-validated and size-bounded, never raw-frame passthrough. Host IDs, turn state and spool remain authoritative. Allocation matches the requested/default branch from host writer state, compares profile selection and rechecks placement after inner start; the inner guard still decides baseline admission. Transport loss fails the turn and makes further prompts refuse with `writer_session_lost`; get and close remain available. Branch matching is not commit freshness: results expose the selected base commit for review. Migration requires closed sessions/controllers, removes only owned registrations, rebinds wrappers and re-accepts provider-free; a divergent registration keeps the writer legacy rather than entering the pool.
 
 ## Residual risks
 
@@ -121,7 +149,7 @@ sanitizing catch. A foreign transport exception with identical text remains
 generic. This does not raise the limit, permit additional remote error codes or
 change public terminal errors; cancellation and close still take precedence.
 
-Aliases, profile definitions, skill catalog entries and the skill override directory are trusted administrator configuration, not a filesystem or provider-security sandbox. A locally available model may later be unreachable; no live provider request is made during selection. Symlinks and Pi tools can reach resources permitted to the OS identity. `AGENTS.md` can influence model behavior. The number of active sessions and the duration of an already accepted turn remain unbounded. Stdio peer authentication, quotas, persistent recovery, provider hard-kill capability, dependency integrity policy, and OS/filesystem isolation remain outside the verified boundary. Coding-profile acceptance checks behavior in a selected fixture; it does not prove OS-level isolation.
+Aliases, profile definitions, skill catalog entries and the skill override directory are trusted administrator configuration, not a filesystem or provider-security sandbox. A locally available model may later be unreachable; no live provider request is made during selection. Symlinks and Pi tools can reach resources permitted to the OS identity. `AGENTS.md` can influence model behavior. The number of active sessions and the duration of an already accepted turn remain unbounded. Stdio peer authentication, quotas, persistent recovery, provider hard-kill capability and dependency integrity policy remain outside the verified boundary. OS/filesystem isolation is not provided by the server; ADR 0012 leases a coding-only server in a rootless Podman boundary per writer/session, retaining the writer boundary historically accepted on Linux for one writer on 2026-10-18 ([isolation setup](isolation-setup.md)). Inside that boundary the residual risks stay: network egress to the provider, the credentials the boundary holds, trusted extension code and the container runtime itself. Coding-profile acceptance checks behavior in a selected fixture; it does not prove OS-level isolation.
 The trusted same-UID operator can unlink or replace the setup lock path between
 checks and must not mutate the ownership directory during a transaction.
 
@@ -139,4 +167,7 @@ Session MCP's in-memory boundary. Extension tool names are checked for
 conflicts and for unsafe or MCP-reserved names after loading and again after binding; a tool that an extension
 registers later, during a turn, is not re-checked and may replace a built-in
 tool, `read` included, because allowlisted extensions are trusted code. An extension may deactivate built-in or granted
-tools for its own session.
+tools for its own session, but deactivating a granted extension tool before
+admission fails the start with `extension_tool_missing`.
+
+A hook entry is a command that Claude Code runs as the operator. Whoever can edit that settings file, or the package directory that the entry names, can run code, as with any hook; setup does not change this and never installs a hook into a scope the operator did not name. Claude Code's managed settings can disable hooks or restrict them to managed entries, in which case the wake silently does not happen and the controller must poll. Claude Code may need a restart, or a review of the new hook in `/hooks`, before it loads an entry that was added while it ran; setup reads and writes the file but cannot observe what the running client loads, so a verified entry is not proof that a wake fires. A one-shot `claude -p` run holds its next model request until the hook ends, so it is not a supported wake client. A server that crashes leaves a stale instance directory of content-free files on the host runtime tmpfs, which a logout clears on systemd hosts. Relayed writers have no spool mount. Provider-free acceptance is not evidence of a live controller wake or a live leased-pool rollout.

package/docs/tool-contracts.md

@@ -1,11 +1,11 @@
 # Tool contracts
 
-Every response includes text JSON for broad client compatibility and the same object as `structuredContent`. Success is `{ok:true,...}`. Domain failures are `{ok:false,error:{code,message}}` with `isError: true`. Complete prompts, credentials, and raw provider errors are never returned.
+Every response includes text JSON for broad client compatibility and the same object as `structuredContent`. Success is `{ok:true,...}`. Domain failures are `{ok:false,error:{code,message}}` with `isError: true`; `writer_unavailable` also carries `reason` and, for `none_admitted`, `counts`. Complete prompts, credentials, and raw provider errors are never returned.
 
 | Tool | Input | Effect | readOnlyHint |
 | --- | --- | --- | --- |
 | `pi_capabilities_get` | strict empty object | Lists configured aliases and execution intent without runtime probes | true |
-| `pi_session_start` | `workspace`, optional `executionProfile` | Creates a verified in-memory Pi session | false |
+| `pi_session_start` | `workspace`, optional `executionProfile`, optional `base` | Creates a verified in-memory Pi session | false |
 | `pi_session_list` | none | Lists safe session metadata | true |
 | `pi_session_get` | `sessionId` | Reads safe session metadata | true |
 | `pi_session_prompt` | `sessionId`, `prompt` | After accepted preflight, publishes `{session,turn}` and starts a background turn | false |
@@ -40,12 +40,13 @@ records name the package version and the build they ran on, see
 ```json
 {
   "ok": true,
-  "server": { "name": "pi-session-mcp", "version": "0.8.3" },
+  "server": { "name": "pi-session-mcp", "version": "0.12.0" },
   "configuration": {
     "fingerprint": "sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
     "reloadPolicy": "restart-required"
   },
-  "workspaces": [{ "alias": "my-project" }],
+  "events": { "delivery": "off" },
+  "workspaces": [{ "alias": "my-project", "mode": "unset" }],
   "executionProfiles": [{
     "alias": "safe-readonly",
     "default": true,
@@ -54,12 +55,22 @@ records name the package version and the build they ran on, see
     "model": "configured-model",
     "thinkingLevel": "medium",
     "extensions": [],
+    "grantedExtensionTools": [],
     "skills": []
   }]
 }
 ```
 
-The server sorts both arrays by alias with a deterministic code-point comparison. It copies only loaded configuration fingerprint/reload policy, configured aliases, and the eight documented profile fields. `extensions` lists the configured extension specs (`npm:<name>@<version>`), empty when a profile loads none; it makes no claim that the package is installed. `skills` lists the skill-catalog aliases that the profile selects, in configured order, `[]` when it selects none. It contains no paths, file names, contents or SDK diagnostics, and it is configuration intent only: it makes no claim that a skill file exists, loads, or will be read by the model. See [Pi skills](skills.md). It never copies the configuration path or contents, workspace paths, authentication state, SDK data, session/turn data, prompts, transcripts, or tool arguments/results. The handler reads the in-memory loaded snapshot only and does not call the registry, Pi adapter, provider, filesystem, or network. The fingerprint identifies the exact loaded bytes, not current-file freshness; provider/model fields describe configured intent and make no availability claim.
+`events.delivery` is `spool` when the loaded configuration enables turn-event delivery (`"events": { "delivery": "spool" }`) and `off` otherwise. It reports configured intent, except that it is `off` when the server found no spool location at startup (no `PI_SESSION_MCP_EVENTS_DIR` and no absolute `XDG_RUNTIME_DIR`, as under Codex); it makes no claim that the spool directory is writable, and it carries no path.
+
+The server sorts both arrays by alias with a deterministic code-point comparison. It copies only loaded configuration fingerprint/reload policy, the event delivery setting, configured aliases and workspace modes, and the nine documented profile fields. Each workspace has a required `mode`: `unset`, `host`, `container`, or `read-only`; a missing modes entry is reported as `unset`. Container entries also carry `writers` (configured count, not free capacity) and `defaultBase` (short branch name, or `null` if not yet recorded), not writer names or other writers' branches. `extensions` lists the configured extension specs (`npm:<name>@<version>`), empty when a profile loads none; it makes no claim that the package is installed. `grantedExtensionTools`, directly after `extensions`, lists the configured extension tool grants in configured order, `[]` when absent. It is configuration intent only, not proof of registration, activation or declaration to the model. `skills` lists the skill-catalog aliases that the profile selects, in configured order, `[]` when it selects none. It contains no paths, file names, contents or SDK diagnostics, and it is configuration intent only: it makes no claim that a skill file exists, loads, or will be read by the model. See [Pi skills](skills.md). It never copies the configuration path or contents, workspace paths, authentication state, SDK data, session/turn data, prompts, transcripts, or tool arguments/results. The handler reads the in-memory loaded snapshot only and does not call the registry, Pi adapter, provider, filesystem, or network. The fingerprint identifies the exact loaded bytes, not current-file freshness; provider/model fields describe configured intent and make no availability claim.
+
+Setup verify accepts and validates `grantedExtensionTools` in its bounded direct
+MCP capabilities check, without starting a session or using a provider.
+**Verifier limit:** at maximum field sizes (8 extension specs of 256 characters,
+32 grants of 64 characters, provider and model of 256 characters each), at most
+6 such profiles fit the verifier's 65,536-byte frame bound. Real configurations
+with short values fit far more.
 
 Annotations are `readOnlyHint: true`, `destructiveHint: false`, `idempotentHint: true`, and `openWorldHint: false`. Clients may use them for presentation, but the strict input schema and server-owned projection enforce the contract.
 
@@ -67,12 +78,71 @@ Annotations are `readOnlyHint: true`, `destructiveHint: false`, `idempotentHint:
 
 `pi_session_start` accepts a strict object containing a configured `workspace` alias and optional configured `executionProfile` alias. If omitted, the sole configured default profile is used. Unknown aliases fail before registry admission or SDK session creation.
 
+Coding on `container` workspaces uses the one host registration `pi-session-mcp`, which leases a writer and relays the session. Coding on `read-only` workspaces is refused with `workspace_mode_forbids_coding` before registry admission or adapter session creation. Read-only profiles remain allowed on every mode and use the host adapter; `unset` and `host` preserve existing coding behavior.
+
+Optional `base` selects a short branch name, not a writer: no `refs/` prefix, `HEAD`, commit ID or path syntax. It is accepted only for coding profiles on `container` workspaces; elsewhere it fails with `base_not_applicable` before creating a session. Omission uses the workspace's recorded default base. Allocation tries ready, accepted relay writers in index order on that branch, compares the inner profile's permission/provider/model/thinking settings, and lets the inner guard decide baseline admission. There is no caller-selectable writer or per-writer tool prefix.
+
+Inside a writer boundary only, `PI_SESSION_MCP_WRITER_GUARD` names the read-only, server-owned baseline guard file. Coding admission re-reads it on every check: the guarded workspace must have no open coding session, HEAD and its sole local branch must match the baseline commit/ref, no stash may exist, and `status --porcelain=v1 -uall` must be clean. Missing or invalid guards and failed Git probes fail closed. Other configured workspaces and read-only profiles are unaffected. Without this boundary-only variable, admission is unchanged. The controller must collect and reset uncollected writers, or wait for or close an open coding session; clients must not bypass refusals by switching profiles.
+
 The former `profile` input is rejected; it is not reinterpreted as an execution-profile alias. Raw `provider`, `model`, `thinkingLevel`, credential-like fields, and every other unknown field are rejected. MCP annotations are hints only; authorization and selection come from schema validation, alias lookup, and the server-owned profile.
 
-Successful session metadata is a whitelist: `id`, `workspace`, `executionProfile`, `profile`, `provider`, `model`, `thinkingLevel`, `state`, `createdAt`, and `updatedAt`. `profile` remains derived permission metadata (`read-only` or `coding`) for compatibility; it is not client-selectable. Provider, model, and thinking level are projected only after SDK post-verification.
+Successful session metadata is a whitelist: `id`, `workspace`, `executionProfile`, `profile`, `provider`, `model`, `thinkingLevel`, `state`, `createdAt`, and `updatedAt`. Container coding sessions also carry `writer` (the leased name, for collection) and `base: { ref, commit }` (branch ref and base commit) in start and get results. `profile` remains derived permission metadata (`read-only` or `coding`) for compatibility; it is not client-selectable. Provider, model, and thinking level are projected only after SDK post-verification.
 
 The selected skills of an execution profile are never an input. A session loads exactly the skills that the profile selects from the operator's skill catalog, validated at start; a failure is `skill_load_failed`. A catalog value is the path of one `SKILL.md` or `builtin:<name>`, which names a skill of the skill library: the operator's override next to the configuration file if it exists, else the skill shipped in the package. It is resolved when the server loads the configuration, and the value never appears in tool output. See [Pi skills](skills.md).
 
+A read-only profile may configure `grantedExtensionTools` only if it lists at
+least one extension. The array has at most 32 unique extension tool names:
+1–64 characters of `[A-Za-z0-9_-]`, not starting with `-`, not MCP-reserved
+(`mcp__` prefix, `list_mcp_resources`, `list_mcp_resource_templates`,
+`read_mcp_resource`) and not a built-in name (`read`, `bash`, `edit`, `write`,
+`grep`, `find`, `ls`). Violations prevent startup with
+`invalid_execution_profile_config`.
+
+With grants, active tools are `read`, `grep`, `find`, `ls`, the granted MCP
+tools and exactly the granted extension tools; an extension's `setActiveTools`
+cannot add others. Each grant must be registered when extensions load. After
+bind, the existing registered-set re-check applies; each grant must also be
+active and declared to the model at admission. Otherwise start fails with
+`extension_tool_missing`. Resolution errors `extension_not_installed` and
+`extension_version_mismatch` take precedence, and conflict checks run first,
+still failing with `extension_tool_conflict`. The SDK activates only declarable
+tools: registered-but-inactive tools fail closed too. Lazy registration in
+`session_start` or later is unsupported. A grant is the operator's trust
+decision: third-party tools may write, and workspace modes `container` and
+`read-only` do not restrict them. See [ADR 0010](adr/0010-read-only-extension-tools.md).
+
+## Automated writer boundary (Plan B)
+
+The host routes container coding through its relay adapter under
+[ADR 0012](adr/0012-leased-writer-pool.md). There are no per-writer client
+registrations or tool sets. Name an explicit coding profile on `pi-session-mcp`;
+the contained server's synthetic default is `boundary-read-only`. A refusal server exposes the same eight tool names
+but returns a sanitized domain error for every call, including capabilities.
+No session is created by a refusal.
+
+The guard rejects extra branches, stash, uncommitted/untracked changes and a
+HEAD different from the recorded baseline, as well as another open coding
+session. It re-reads its baseline file on every coding check so reset takes
+effect without restarting that server. After review and session close, the
+controller runs `pi-session-mcp-setup --writer <name> --finish --apply`: collect,
+then reset persistent or recreate ephemeral. Incomplete collection stops finish;
+never bypass admission by switching profiles. Host Git must never run inside
+the clone. See [Execution modes](execution-modes.md) for lifecycle findings,
+readiness, credential refresh, verification and migration. These are operator
+CLI operations, not extra MCP tools or tool arguments.
+
+Finish returns a writer to the workspace default base. Reset with
+`--base <branch>` explicitly moves it for a fix round: create a local branch at
+the collected ref, run `--writer <name> --reset --base <branch> --apply`, then
+start with `base: "<branch>"` and read `writer` from the result for collection.
+No reconnect is needed after reset, finish or recreate.
+
+Relayed start has a 60-second budget; relayed prompt preflight and abort allow
+15 seconds each, and close cleanup 10 seconds. Inner replies are validated and
+size-bounded. Abort observes the actual inner terminal state: completion racing
+abort stays completed. Relayed activity advances only when inner `updatedAt`
+changes, and preserves inner `truncated`. Terminal events use the host spool.
+
 ## Deterministic MCP errors
 
 Public MCP errors are stable and sanitized. Their messages do not include inputs, auth details, provider responses, filesystem paths, or secrets.
@@ -80,6 +150,7 @@ Public MCP errors are stable and sanitized. Their messages do not include inputs
 | Code | Meaning |
 | --- | --- |
 | `unknown_execution_profile` | The requested alias is not configured. |
+| `workspace_mode_forbids_coding` | The workspace's execution mode does not allow coding sessions on this server. Operator needed: do not retry or switch profiles on this server. |
 | `unknown_provider` / `unknown_model` | The exact configured item is absent from the local Pi catalog. |
 | `local_authentication_missing` / `local_authentication_unavailable` | Existing local Pi authentication is absent or cannot be resolved within its deadline. |
 | `model_unavailable` | The exact model is not locally available for the configured provider. |
@@ -93,8 +164,16 @@ Public MCP errors are stable and sanitized. Their messages do not include inputs
 | `extension_version_mismatch` | Pi's installed extension package has another version than the configured one. |
 | `extension_load_failed` | A configured extension has an invalid manifest, failed to load or failed to bind. |
 | `extension_tool_conflict` | An extension tool name collides with a built-in, MCP or other extension tool, or is unsafe: not 1 to 64 letters, digits, `_` or `-` (not starting with `-`), or reserved for MCP (`mcp__` prefix, `list_mcp_resources`, `list_mcp_resource_templates`, `read_mcp_resource`). |
+| `extension_tool_missing` | A granted extension tool is not registered at load or is not active and declared to the model at admission. Fixed message: `Granted Pi extension tool is not available`; class `needs_operator` (operator needed; do not retry or switch profiles). |
 | `skill_load_failed` | A skill that the profile selects could not be loaded: a missing (also a `builtin:` name that matches no override and no shipped skill), unreadable or oversized (over 256 KiB) file, an invalid skill, two selected files with the same Pi skill name, two aliases on the same canonical file, or a skill with `disable-model-invocation: true`. The message is the fixed `Configured Pi skill could not be loaded`; it never contains a path, skill name or SDK text. |
 | `pi_session_creation_failed` | Pi session construction failed without a more specific safe classification. |
+| `writer_uncollected` | The writer is not at its collected baseline, or its guard/Git state could not be verified; controller must collect and reset it. |
+| `writer_busy` | Controller action: a session or another operation holds the writer; wait for or close it. Setup waits briefly (10 seconds) for the lease, then fails with this code. |
+| `writer_unavailable` | Controller action, not a profile-selection failure: no writer admitted. `reason` is `none_ready` (no ready, currently accepted writer), `none_at_base` (ready writers exist but none matches the requested/default base), or `none_admitted` (candidates refused). The last includes content-free `counts: { busy, notAtBaseline, settingsChanged }`. Wait for capacity, collect/finish writers, or ask the operator to reconcile readiness/settings; never switch profiles to bypass it. |
+| `writer_session_lost` | Controller action: the child or transport was lost, or inner state cannot be determined. A running turn fails; further prompts refuse, including after idle loss. Get and close still work. Close and inspect/collect the work before starting a fresh session; do not blindly repeat a prompt. |
+| `base_not_applicable` | Controller action: remove `base` unless starting a coding profile on a container workspace. No session was created; do not switch profiles to bypass policy. |
+| `writer_not_ready` | The writer launcher cannot establish current readiness; operator must run repository setup/acceptance. All refusal-server tools return this error. |
+| `container_runtime_unavailable` | The writer launcher found no usable rootless Podman; all refusal-server tools refuse work, with no host fallback. |
 | `server_stopping` | Shutdown has begun, so a new session cannot be admitted. |
 
 Lifecycle errors include `unknown_workspace`, `unknown_session`, `session_running`, `prompt_rejected`, `prompt_timeout`, `abort_failed`, `abort_timeout`, and `turn_failed`. Timeout messages are stable: `Pi prompt preflight timed out` and `Pi abort timed out`.
@@ -103,10 +182,13 @@ Invalid execution-profile configuration prevents startup, so it cannot be an MCP
 
 | Startup diagnostic code | Meaning |
 | --- | --- |
-| `invalid_execution_profile_config` | The execution-profile configuration violates its invariants or strict shape, including an unknown or duplicate selected skill alias, two selected skill aliases with the same path, or an invalid `skillCatalog` entry (including a malformed `builtin:` name). |
+| `invalid_execution_profile_config` | The execution-profile configuration violates its invariants or strict shape, including `grantedExtensionTools` on a coding profile or a profile without extensions, more than 32 grants, duplicate, unsafe, MCP-reserved or built-in grant names, an unknown or duplicate selected skill alias, two selected skill aliases with the same path, or an invalid `skillCatalog` entry (including a malformed `builtin:` name). |
 | `invalid_thinking_level` | A configured thinking level is outside the supported enum. |
+| `invalid_execution_modes` | The execution modes file is invalid or unreadable, including an unknown alias, an unrecognized shape, or an invalid container profile selection. |
+| `invalid_event_delivery` | The optional `events` field is not exactly `{ "delivery": "spool" }` or `{ "delivery": "off" }`. |
+| `event_spool_unavailable` | `events.delivery` is `spool`, but the spool directory cannot be used: `PI_SESSION_MCP_EVENTS_DIR` is set but not absolute, or the directory cannot be created, is a symlink or not a directory, belongs to another user, or is accessible to group or others. Without either a `PI_SESSION_MCP_EVENTS_DIR` or an absolute `$XDG_RUNTIME_DIR` the server does not fail: delivery stays inactive and stderr carries one `{"level":"warn","event":"event_delivery_inactive","stage":"startup","code":"event_runtime_dir_missing"}` line. |
 
-`pi_session_prompt` returns `{session,turn}` only after successful Pi preflight. Preflight is bounded at 5,000 ms; a missing callback, hanging prompt acceptance, or timeout returns `prompt_timeout` / `Pi prompt preflight timed out` and creates no public turn. Late settlement may only release the unpublished operation's quarantine; it cannot publish a turn. `pi_session_abort` waits at most 5,000 ms per caller for one shared SDK abort attempt and returns `abort_timeout` / `Pi abort timed out` without claiming the turn was aborted. Rejection/failure remain `prompt_rejected`/`abort_failed`. Close allows at most 5,000 ms for abort cleanup, then performs best-effort disposal and removes the public registry entry; it remains idempotent through the retained tombstone. Registry shutdown rejects new starts, allows 12,000 ms, and disposes a handle from a late-resolving start instead of admitting it. Process shutdown, started by `SIGINT`, `SIGTERM`, or stdin EOF, allows 15,000 ms, attempts transport cleanup even after registry failure/timeout, then explicitly exits the process. These boundaries do not guarantee graceful cancellation of a provider request. `pi_turn_get` returns a `TurnView` with `turnId`, `sessionId`, state, timestamps, and `completedAt` for terminal turns. Completed views add normalized final `assistantText` and `truncated`; failed views contain only `{code:"turn_failed",message:"Pi turn failed"}`. Final assistant text is capped at 64 KiB UTF-8 bytes, each active session retains at most 20 turns, and close removes its turn data.
+`pi_session_prompt` returns `{session,turn}` only after successful Pi preflight. Embedded preflight is bounded at 5,000 ms (relayed: 15,000 ms); a missing callback, hanging prompt acceptance, or timeout returns `prompt_timeout` / `Pi prompt preflight timed out` and creates no public turn. Late settlement may only release the unpublished operation's quarantine; it cannot publish a turn. `pi_session_abort` waits at most 5,000 ms (relayed: 15,000 ms) per caller for one shared abort attempt and returns `abort_timeout` / `Pi abort timed out` without claiming the turn was aborted. Rejection/failure remain `prompt_rejected`/`abort_failed`. Close allows at most 5,000 ms (relayed: 10,000 ms) for abort cleanup, then performs best-effort disposal and removes the public registry entry; it remains idempotent through the retained tombstone. Registry shutdown rejects new starts, allows 12,000 ms, and disposes a handle from a late-resolving start instead of admitting it. Process shutdown, started by `SIGINT`, `SIGTERM`, or stdin EOF, allows 15,000 ms, attempts transport cleanup even after registry failure/timeout, then explicitly exits the process. These boundaries do not guarantee graceful cancellation of a provider request. `pi_turn_get` returns a `TurnView` with `turnId`, `sessionId`, state, timestamps, and `completedAt` for terminal turns. Completed views add normalized final `assistantText` and `truncated`; failed views contain only `{code:"turn_failed",message:"Pi turn failed"}`. Final assistant text is capped at 64 KiB UTF-8 bytes, each active session retains at most 20 turns, and close removes its turn data.
 
 While a turn runs, `updatedAt` is the time of the last observed public SDK activity of that turn: assistant message start, streaming updates and end, and tool execution start, update and end. It freezes at the terminal transition. The `updatedAt` of the session does not follow this activity: it moves when a turn starts and at its terminal transition. It is a liveness lower bound only. Streaming is activity, not evidence of finished or useful work. Work without a public event, such as the internal steps of an extension's own agent loop or a long tool call without updates, stays invisible, so a stamp that has not moved can still be a working turn (a long model response, thinking, a first token, or a long tool call) and never justifies a claim that a turn is hung. The stamp is a wall-clock ISO-8601 millisecond value for ordering, not a progress count, duration, or step total, and activity within one millisecond simply reuses the stamp. Only the type of an event and the role of its message are inspected: no delta, thinking block, tool argument, or partial result is stored or projected, and the answer still comes only from the final assistant message.
 
@@ -126,7 +208,7 @@ none of the eight public tools or their fields, states and error codes; see the
 bounded projection policy in [session-mcp.md](session-mcp.md). If the turn itself
 fails, the public result still contains only `turn_failed` / `Pi turn failed`.
 
-`turn_failed` remains the only terminal failure projection. The characterization was made against `@earendil-works/pi-coding-agent` 0.84.4, which exposes no closed, structured terminal cause discriminator; its provider-free tests keep their assertions on the pinned 1.2.0, whose public `AssistantMessage` type still carries only the stop reason plus free-form `errorMessage`, `rawStopReason`, and open-typed `diagnostics`, and Pi Session MCP uses no such discriminator: it normalizes the final assistant outcome by its stop reason (`src/sdk-pi-adapter.ts:106-130`, see *Final stop reasons* below) and the registry projects `turn_failed` for every outcome that is neither `completed` nor `aborted` (`src/session-registry.ts:242-243`). Retry and compaction events can describe an interim error that later recovers. Assistant `errorMessage`, `rawStopReason`, and `diagnostics` are free-form and may contain sensitive provider text; they cannot reliably identify the underlying terminal cause.
+`turn_failed` remains the only terminal failure projection. The characterization was made against `@earendil-works/pi-coding-agent` 0.84.4, which exposes no closed, structured terminal cause discriminator; its provider-free tests keep their assertions on the pinned 1.4.0, whose public `AssistantMessage` type still carries only the stop reason plus free-form `errorMessage`, `rawStopReason`, and open-typed `diagnostics`, and Pi Session MCP uses no such discriminator: it normalizes the final assistant outcome by its stop reason (`src/sdk-pi-adapter.ts:106-130`, see *Final stop reasons* below) and the registry projects `turn_failed` for every outcome that is neither `completed` nor `aborted` (`src/session-registry.ts:242-243`). Retry and compaction events can describe an interim error that later recovers. Assistant `errorMessage`, `rawStopReason`, and `diagnostics` are free-form and may contain sensitive provider text; they cannot reliably identify the underlying terminal cause.
 
 This change therefore adds no runtime classification: no code is derived from `errorMessage`, `rawStopReason`, diagnostics, context size, or event order, and no provider text, diagnostics, or context figure is projected. In particular `turn_context_exceeded` is not added; an observed pattern (a long same-session turn fails, a fresh narrow session succeeds) stays a hypothesis that the public surface cannot confirm.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-session-mcp",
-  "version": "0.8.3",
+  "version": "0.12.0",
   "description": "Local stdio MCP server for controlled Pi coding-agent sessions",
   "license": "MIT",
   "keywords": [
@@ -22,12 +22,15 @@
   "bin": {
     "pi-session-mcp": "dist/main.js",
     "pi-session-mcp-setup": "dist/setup-main.js",
+    "pi-session-mcp-wake": "dist/wake-main.js",
     "pi-session-mcp-doctor": "scripts/doctor.mjs"
   },
   "files": [
     "dist/",
     ".pi-session-mcp-cli/",
     "scripts/doctor.mjs",
+    "scripts/isolation-acceptance.mjs",
+    "scripts/isolation-probe.cjs",
     "pi-session-mcp.example.json",
     "skills/",
     "docs/",
@@ -51,22 +54,25 @@
     "setup": "node dist/setup-main.js",
     "start": "node dist/main.js",
     "inspect": "mcp-inspector node dist/main.js",
-    "prepack": "npm run build && npm run build:cli"
+    "prepack": "npm run build && npm run build:cli",
+    "eval:profiles": "node scripts/profile-evaluation.mjs",
+    "eval:extensions": "node scripts/extension-ablation.mjs",
+    "eval:schemas": "tsc -p tsconfig.eval.json && node scripts/profile-evaluation-schemas.mjs"
   },
   "dependencies": {
-    "@earendil-works/pi-agent-core": "1.2.0",
-    "@earendil-works/pi-ai": "1.2.0",
-    "@earendil-works/pi-codemode": "1.2.0",
-    "@earendil-works/pi-coding-agent": "1.2.0",
-    "@earendil-works/pi-mcp": "1.2.0",
-    "@earendil-works/pi-telemetry": "1.2.0",
-    "@earendil-works/pi-tui": "1.2.0",
+    "@earendil-works/pi-agent-core": "1.4.0",
+    "@earendil-works/pi-ai": "1.4.0",
+    "@earendil-works/pi-codemode": "1.4.0",
+    "@earendil-works/pi-coding-agent": "1.4.0",
+    "@earendil-works/pi-mcp": "1.4.0",
+    "@earendil-works/pi-telemetry": "1.4.0",
+    "@earendil-works/pi-tui": "1.4.0",
     "@modelcontextprotocol/client": "2.3.1",
     "@modelcontextprotocol/server": "2.3.1",
-    "zod": "4.6.5"
+    "zod": "4.6.7"
   },
   "devDependencies": {
-    "@modelcontextprotocol/inspector": "2.10.1",
+    "@modelcontextprotocol/inspector": "2.11.0",
     "@types/node": "22.20.5",
     "typescript": "7.0.2",
     "vitest": "5.0.3"