pi-session-mcp 0.8.3 → 0.12.0

package/docs/evaluation/extension-audit-2026-10-17/navigation-static-evidence.json

@@ -0,0 +1,185 @@
+{
+  "kind": "verified-tarball-static-audit",
+  "audited_at": "2026-10-17T09:04:19.555Z",
+  "source_binding": {
+    "commit": "406dae7e6b99aa5715960490e869bd3fc668cca2",
+    "digest": "sha256:686887d57899c2e55593bb7dd98b78be08ea0fc6c471a6dd4eab3298f890d160"
+  },
+  "tarball_metadata": "navigation-cursor-registry.json",
+  "candidate_imports": 0,
+  "installs": 0,
+  "provider_calls": 0,
+  "packages": [
+    {
+      "identity": "pi-lens@4.4.3",
+      "license": "MIT",
+      "engines": {
+        "node": ">=22.19.0"
+      },
+      "peer_dependencies": {
+        "@earendil-works/pi-coding-agent": "*",
+        "@earendil-works/pi-tui": "*",
+        "typebox": "^1.0.0"
+      },
+      "package_entry": {
+        "extensions": [
+          "./dist/index.js"
+        ],
+        "skills": [
+          "./skills"
+        ]
+      },
+      "reviewed_files": [
+        {
+          "file": "package.json",
+          "hash": "sha256:33799b50c97f9afe24972e327a20fd4b95963f0768d3a96a6122f3980c1bee9d"
+        },
+        {
+          "file": "LICENSE",
+          "hash": "sha256:acea1344d185329e12fe999df92fc11676af644f98a068b7f67de9f0f6e046a2"
+        },
+        {
+          "file": "dist/index.js",
+          "hash": "sha256:192098c6d5297f633206a01adfa60bafe2e73aa4f2ec1cae0faa097a9bfa5e67"
+        }
+      ],
+      "findings": [
+        {
+          "id": "runtime-and-peers",
+          "assessment": "declared-compatible-only",
+          "detail": "Node >=22.19.0 is satisfied; Pi/TUI peer wildcard includes SDK1.2.0, but no runtime qualification exists because the package is not installed."
+        },
+        {
+          "id": "package-entry",
+          "assessment": "static-file-present",
+          "detail": "Published artifact declares dist/index.js and skills directory; the main entry is a regular file in the downloaded tarball."
+        },
+        {
+          "id": "lifecycle",
+          "assessment": "requires-explicit-install-review",
+          "detail": "prepare builds dist, downloads core grammars, sets Git hooks and warms loader caches; native AST-grep dependencies can have their own lifecycle/platform setup. No scripts were executed."
+        },
+        {
+          "id": "execution-and-network",
+          "assessment": "expanded-capability",
+          "detail": "Source contains LSP/tool child-process management, formatter/autofix operations, managed tool installation and GitHub/unpkg grammar/tool downloads. These paths must be disabled or locally stubbed for provider-free checks."
+        },
+        {
+          "id": "project-trust",
+          "assessment": "static-guard-found",
+          "detail": "Entry session_start adopts host project trust and declares that untrusted projects disable tool auto-install and LSP spawn. Actual SDK1.2.0 trust-port propagation was not executed."
+        },
+        {
+          "id": "headless",
+          "assessment": "NOT_RUN",
+          "detail": "Tool/lifecycle registrations are present; TUI affordances and late/lazy tool activation need an actual SDK test and must not be assumed to work through this MCP host."
+        },
+        {
+          "id": "data",
+          "assessment": "local-and-tool-mediated",
+          "detail": "Source tracks diagnostics and session/model-related telemetry and can read/write code and extension-owned caches. Known remote download paths are present; no complete absence of optional outbound telemetry is established."
+        },
+        {
+          "id": "decision",
+          "assessment": "BLOCKED",
+          "detail": "Real production resolver reports extension_not_installed. Do not silently substitute a scoped fork or install it into global/user Pi state."
+        }
+      ],
+      "source_urls": [
+        "https://registry.npmjs.org/pi-lens/4.4.3",
+        "https://github.com/apmantza/pi-lens"
+      ],
+      "runtime_status": "NOT_RUN"
+    },
+    {
+      "identity": "context-mode@1.0.169",
+      "license": "Elastic-2.0",
+      "engines": {
+        "node": ">=22.5.0"
+      },
+      "peer_dependencies": {},
+      "package_entry": {
+        "extensions": [
+          "./build/adapters/pi/extension.js"
+        ],
+        "skills": [
+          "./skills"
+        ]
+      },
+      "reviewed_files": [
+        {
+          "file": "package.json",
+          "hash": "sha256:f0a96c5affd66f5334f2f4cd5a1270e65018a0b83317b4e752cd6f60cdba8680"
+        },
+        {
+          "file": "LICENSE",
+          "hash": "sha256:92f11a867c41c9e575ccb978ff205ae2011c244a14aa3c576e914e537105caa0"
+        },
+        {
+          "file": "build/adapters/pi/extension.js",
+          "hash": "sha256:1e6e88988e927bb0c744254b71cd497eaf919e910bea1f0a23f43a3b25ee32c7"
+        },
+        {
+          "file": "build/adapters/pi/mcp-bridge.js",
+          "hash": "sha256:4a6e89f0bca2674f75076ac009190957ca67cbd4f823926a219adf2c876afd06"
+        },
+        {
+          "file": "scripts/postinstall.mjs",
+          "hash": "sha256:d8eef5cea7979beb8db68fe5de10ec3ed086e2c3fbbfb745a23e43574d9dfba4"
+        }
+      ],
+      "findings": [
+        {
+          "id": "runtime-and-peers",
+          "assessment": "not-qualified",
+          "detail": "Declared Node >=22.5.0 is satisfied; package declares no Pi peer range, so SDK1.2.0 compatibility remains unqualified."
+        },
+        {
+          "id": "license",
+          "assessment": "Elastic-2.0",
+          "detail": "Source-available Elastic-2.0 license, distinct from MIT. No legal compatibility decision is inferred."
+        },
+        {
+          "id": "entry-and-state",
+          "assessment": "static-file-present",
+          "detail": "Declared build/adapters/pi/extension.js exists. Extension opens a session SQLite database and records prompt/tool-derived events and compaction snapshots in adapter-owned home state."
+        },
+        {
+          "id": "bridge",
+          "assessment": "headless-test-required",
+          "detail": "before_agent_start lazily starts a local MCP server and registers discovered ctx tools. Bootstrap is best effort and failure can degrade to no tools; production admission freezes a composed allowlist earlier, so late registration and activation need explicit compatibility testing."
+        },
+        {
+          "id": "capabilities",
+          "assessment": "expanded-capability",
+          "detail": "ctx execution/fetch/index/search tools are more powerful than read-only navigation; package also advertises upgrade and purge. Shell HTTP regex routing is not an OS sandbox or general network authorization layer."
+        },
+        {
+          "id": "headless",
+          "assessment": "static-support-only",
+          "detail": "Source distinguishes hasUI false and uses an idle reaper for noninteractive bridge children. No actual SDK/headless run occurred."
+        },
+        {
+          "id": "lifecycle",
+          "assessment": "global-side-effects-require-review",
+          "detail": "postinstall contains a global-install-only repair path for other client plugin registries/settings and cache metadata. No lifecycle script or client registration was executed."
+        },
+        {
+          "id": "telemetry",
+          "assessment": "not-established",
+          "detail": "Session usage/event telemetry and persistent local content are present; known fetch and upgrade network paths exist. No package-wide outbound-telemetry absence is claimed."
+        },
+        {
+          "id": "decision",
+          "assessment": "BLOCKED",
+          "detail": "Real production resolver reports extension_not_installed; no output-volume bottleneck was demonstrated by the current screening, so no quality ablation is selected."
+        }
+      ],
+      "source_urls": [
+        "https://registry.npmjs.org/context-mode/1.0.169",
+        "https://github.com/mksglu/context-mode"
+      ],
+      "runtime_status": "NOT_RUN"
+    }
+  ]
+}

package/docs/evaluation/extension-audit-2026-10-17/openwiki-headless-bindings.json

@@ -0,0 +1,25 @@
+{
+  "kind": "headless-probe-source-and-input-binding",
+  "source_binding": {
+    "commit": "406dae7e6b99aa5715960490e869bd3fc668cca2",
+    "digest": "sha256:686887d57899c2e55593bb7dd98b78be08ea0fc6c471a6dd4eab3298f890d160"
+  },
+  "sdk_version": "1.2.0",
+  "candidate": "npm:openwiki@0.7.2",
+  "support_fixture": "npm:pi-extension-fixture@1.0.0",
+  "probe_hash": "sha256:14f7c859f347a85fef34b587f21dea508339e3f318153a9720a9e2b2f1cd96b7",
+  "result_hash": "sha256:43098de8b7795ec9d120a4441f5f9be8eeb7d105a9efc029846671a92c8a3132",
+  "scope": "Actual production adapter and installed SDK; local in-memory fixture provider. Import/register, read-only vs coding tool selection, synthetic turn and shutdown. No candidate tool executed.",
+  "runtime_environment": {
+    "home": "owned temporary scope",
+    "agent_state": "owned temporary scope",
+    "auth": "fresh missing fixture-auth path; no real credentials",
+    "telemetry_opt_out": [
+      "OPENWIKI_TELEMETRY_DISABLED=1",
+      "DO_NOT_TRACK=1"
+    ],
+    "guards": "Instrumented fetch, HTTP(S), net/TLS and child-process entrypoints; not OS containment."
+  },
+  "paid_candidate_starts": 0,
+  "quality_ablation": false
+}

package/docs/evaluation/extension-audit-2026-10-17/openwiki-headless-cleanup.json

@@ -0,0 +1,12 @@
+{
+  "kind": "owned-successful-probe-scope-cleanup",
+  "cleaned_at": "2026-10-17T09:06:38.138Z",
+  "initial_scope": "runtime-home child of owned extension-audit artifact scope",
+  "ownership_marker_verified": true,
+  "initial_child_exit_observed": true,
+  "initial_home_removed": true,
+  "reproduction_scope": "removed by ownedTemporary cleanup after PASS",
+  "candidate_tool_calls": 0,
+  "external_provider_calls": 0,
+  "artifacts_retained": "Verified package tarballs, static copies and probe scripts only; no real credentials or production data."
+}

package/docs/evaluation/extension-audit-2026-10-17/openwiki-headless-probe.mjs

@@ -0,0 +1,63 @@
+import { mkdir, cp, writeFile, readFile } from 'node:fs/promises';
+import { join, resolve } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { syncBuiltinESMExports } from 'node:module';
+import net from 'node:net';
+import tls from 'node:tls';
+import http from 'node:http';
+import https from 'node:https';
+import childProcess from 'node:child_process';
+import assert from 'node:assert/strict';
+import { ModelRuntime, createAgentSessionServices, createAgentSessionFromServices, createAgentSessionRuntime } from '@earendil-works/pi-coding-agent';
+const root=process.cwd(),home=process.env.HOME;
+const {SdkPiSessionAdapter,PROFILE_TOOLS}=await import(pathToFileURL(join(root,'.profile-eval/src/sdk-pi-adapter.js')).href);
+const {parseExtensionSpec}=await import(pathToFileURL(join(root,'.profile-eval/src/extension-spec.js')).href);
+const {resolvePiExtension}=await import(pathToFileURL(join(root,'.profile-eval/src/pi-extensions.js')).href);
+const {installStdoutGuard}=await import(pathToFileURL(join(root,'.profile-eval/src/stdout-guard.js')).href);
+const suppressed=[];const guard=installStdoutGuard({report:line=>suppressed.push(JSON.parse(line))});
+process.stderr.write=()=>true;
+let networkAttempts=0,childAttempts=0;
+const denyNetwork=()=>{networkAttempts++;throw new Error('offline_network_denied');};
+const denyChild=()=>{childAttempts++;throw new Error('offline_child_denied');};
+globalThis.fetch=denyNetwork;
+net.Socket.prototype.connect=denyNetwork;net.connect=denyNetwork;net.createConnection=denyNetwork;
+tls.connect=denyNetwork;http.request=denyNetwork;http.get=denyNetwork;https.request=denyNetwork;https.get=denyNetwork;
+for(const key of ['spawn','spawnSync','exec','execSync','execFile','execFileSync','fork'])childProcess[key]=denyChild;
+syncBuiltinESMExports();
+const rows=[],diagnostics=[];
+let activeHandle;
+try{
+ const fixtureAgent=join(home,'fixture-agent');
+ await mkdir(join(fixtureAgent,'npm/node_modules'),{recursive:true});
+ await cp(join(root,'test/fixtures/pi-extension-fixture'),join(fixtureAgent,'npm/node_modules/pi-extension-fixture'),{recursive:true,errorOnExist:true});
+ for(const permissionProfile of ['read-only','coding']){
+  globalThis.__piExtensionFixtureEvents??=[];globalThis.__piExtensionFixtureEvents.length=0;
+  const cwd=join(home,'workspace-'+permissionProfile);await mkdir(cwd);await writeFile(join(cwd,'README.md'),'Synthetic offline OpenWiki registration test.\n');
+  let session;
+  const adapter=new SdkPiSessionAdapter({
+   modelRuntimeFactory:()=>ModelRuntime.create({refreshOnCreate:false,allowModelNetwork:false,modelsPath:null,authPath:join(home,'absent-auth.json'),modelsStorePath:join(home,'absent-models.json')}),
+   resolveExtension:spec=>resolvePiExtension(spec,{agentDir:spec.name==='pi-extension-fixture'?fixtureAgent:process.env.PI_AUDIT_AGENT_DIR}),
+   extensionSdk:{createServices:createAgentSessionServices,createSessionFromServices:async options=>{const result=await createAgentSessionFromServices(options);session=result.session;return result;},createRuntime:createAgentSessionRuntime},
+   diagnosticSink:d=>diagnostics.push({stage:d.stage,code:d.code,extension:d.extension??null}),
+  });
+  activeHandle=await adapter.create({cwd,executionProfile:{alias:'offline-openwiki',permissionProfile,provider:'fixture-ext',model:'fixture-ext-model',thinkingLevel:'off',extensions:[parseExtensionSpec('npm:pi-extension-fixture@1.0.0'),parseExtensionSpec('npm:openwiki@0.7.2')],skills:[]}});
+  const expected=['openwiki_begin','openwiki_submit_plan','openwiki_next_page','openwiki_inspect_page_claims','openwiki_submit_page','openwiki_finish'].sort();
+  const loaded=session.resourceLoader.getExtensions();
+  assert.equal(loaded.errors.length,0);assert.equal(loaded.extensions.length,2);
+  const registered=loaded.extensions.flatMap(e=>[...e.tools.keys()]).filter(n=>n.startsWith('openwiki_')).sort();assert.deepEqual(registered,expected);
+  assert.deepEqual(session.resourceLoader.getSkills().skills,[]);
+  assert.deepEqual(session.resourceLoader.getPrompts().prompts,[]);
+  const before=session.getActiveToolNames().sort();
+  const allowed=[...PROFILE_TOOLS[permissionProfile],...(permissionProfile==='coding'?['fixture_tool',...expected]:[])].sort();assert.deepEqual(before,allowed);
+  let accepted=false;const turn=await activeHandle.prompt('Offline fixture provider registration probe only; do not execute extension tools.',a=>{accepted=a;});
+  assert.equal(accepted,true);assert.equal(turn.status,'completed');assert.equal(turn.assistantText,'FIXTURE-PONG');
+  assert.deepEqual(session.getActiveToolNames().sort(),allowed);
+  const events=globalThis.__piExtensionFixtureEvents;
+  assert.ok(events.includes('session_start'));assert.ok(events.includes('stream'));assert.ok(!events.includes('tool'));
+  await activeHandle.dispose();activeHandle=undefined;assert.ok(events.includes('session_shutdown'));
+  rows.push({permission_profile:permissionProfile,status:'PASS',sdk_model:'fixture-ext/fixture-ext-model',candidate:'openwiki@0.7.2',support_fixture:'pi-extension-fixture@1.0.0',registered_tools:registered,active_tools:before,skills_selected:0,prompts_loaded:0,local_scripted_turn:'completed',candidate_tools_invoked:0,shutdown:'PASS'});
+ }
+ assert.equal(networkAttempts,0);assert.equal(childAttempts,0);
+ guard.flush();
+ guard.transportStdout.write(JSON.stringify({kind:'offline-headless-adapter-component-test',status:'PASS',node:process.versions.node,rows,network_attempts:networkAttempts,child_process_attempts:childAttempts,external_provider_calls:0,paid_candidate_runs:0,diagnostics,foreign_stdout_suppressed:suppressed.reduce((n,x)=>n+x.writes,0),limitation:'Registration, tool selection and shutdown only. No OpenWiki lifecycle tool, MCP child, writer mutation, retrieval or quality ablation was executed.'})+'\n');
+}catch(e){if(activeHandle)await activeHandle.dispose().catch(()=>undefined);guard.flush();guard.transportStdout.write(JSON.stringify({kind:'offline-headless-adapter-component-test',status:'FAIL',rows,code:e?.code??e?.name??'probe_failed',diagnostics,network_attempts:networkAttempts,child_process_attempts:childAttempts,external_provider_calls:0,paid_candidate_runs:0})+'\n');process.exitCode=1;}

package/docs/evaluation/extension-audit-2026-10-17/openwiki-headless-reproduction.json

@@ -0,0 +1,91 @@
+{
+  "kind": "offline-headless-adapter-component-test",
+  "status": "PASS",
+  "node": "22.23.2",
+  "rows": [
+    {
+      "permission_profile": "read-only",
+      "status": "PASS",
+      "sdk_model": "fixture-ext/fixture-ext-model",
+      "candidate": "openwiki@0.7.2",
+      "support_fixture": "pi-extension-fixture@1.0.0",
+      "registered_tools": [
+        "openwiki_begin",
+        "openwiki_finish",
+        "openwiki_inspect_page_claims",
+        "openwiki_next_page",
+        "openwiki_submit_page",
+        "openwiki_submit_plan"
+      ],
+      "active_tools": [
+        "find",
+        "grep",
+        "ls",
+        "read"
+      ],
+      "skills_selected": 0,
+      "prompts_loaded": 0,
+      "local_scripted_turn": "completed",
+      "candidate_tools_invoked": 0,
+      "shutdown": "PASS"
+    },
+    {
+      "permission_profile": "coding",
+      "status": "PASS",
+      "sdk_model": "fixture-ext/fixture-ext-model",
+      "candidate": "openwiki@0.7.2",
+      "support_fixture": "pi-extension-fixture@1.0.0",
+      "registered_tools": [
+        "openwiki_begin",
+        "openwiki_finish",
+        "openwiki_inspect_page_claims",
+        "openwiki_next_page",
+        "openwiki_submit_page",
+        "openwiki_submit_plan"
+      ],
+      "active_tools": [
+        "bash",
+        "edit",
+        "find",
+        "fixture_tool",
+        "grep",
+        "ls",
+        "openwiki_begin",
+        "openwiki_finish",
+        "openwiki_inspect_page_claims",
+        "openwiki_next_page",
+        "openwiki_submit_page",
+        "openwiki_submit_plan",
+        "read",
+        "write"
+      ],
+      "skills_selected": 0,
+      "prompts_loaded": 0,
+      "local_scripted_turn": "completed",
+      "candidate_tools_invoked": 0,
+      "shutdown": "PASS"
+    }
+  ],
+  "network_attempts": 0,
+  "child_process_attempts": 0,
+  "external_provider_calls": 0,
+  "paid_candidate_runs": 0,
+  "diagnostics": [],
+  "foreign_stdout_suppressed": 6,
+  "limitation": "Registration, tool selection and shutdown only. No OpenWiki lifecycle tool, MCP child, writer mutation, retrieval or quality ablation was executed.",
+  "source_binding": {
+    "commit": "406dae7e6b99aa5715960490e869bd3fc668cca2",
+    "digest": "sha256:686887d57899c2e55593bb7dd98b78be08ea0fc6c471a6dd4eab3298f890d160"
+  },
+  "source_unchanged": true,
+  "scope_id": "pi-profile-eval-miIKXb",
+  "process_exit": {
+    "code": 0,
+    "signal": null,
+    "spawn_error": false
+  },
+  "duration_ms": 933,
+  "stderr_bytes_discarded": 0,
+  "child_exit_observed": true,
+  "additional_paid_candidate_runs": 0
+}

package/docs/evaluation/extension-audit-2026-10-17/openwiki-headless-result.json

@@ -0,0 +1,83 @@
+{
+  "kind": "offline-headless-adapter-component-test",
+  "status": "PASS",
+  "node": "22.23.2",
+  "rows": [
+    {
+      "permission_profile": "read-only",
+      "status": "PASS",
+      "sdk_model": "fixture-ext/fixture-ext-model",
+      "candidate": "openwiki@0.7.2",
+      "support_fixture": "pi-extension-fixture@1.0.0",
+      "registered_tools": [
+        "openwiki_begin",
+        "openwiki_finish",
+        "openwiki_inspect_page_claims",
+        "openwiki_next_page",
+        "openwiki_submit_page",
+        "openwiki_submit_plan"
+      ],
+      "active_tools": [
+        "find",
+        "grep",
+        "ls",
+        "read"
+      ],
+      "skills_selected": 0,
+      "prompts_loaded": 0,
+      "local_scripted_turn": "completed",
+      "candidate_tools_invoked": 0,
+      "shutdown": "PASS"
+    },
+    {
+      "permission_profile": "coding",
+      "status": "PASS",
+      "sdk_model": "fixture-ext/fixture-ext-model",
+      "candidate": "openwiki@0.7.2",
+      "support_fixture": "pi-extension-fixture@1.0.0",
+      "registered_tools": [
+        "openwiki_begin",
+        "openwiki_finish",
+        "openwiki_inspect_page_claims",
+        "openwiki_next_page",
+        "openwiki_submit_page",
+        "openwiki_submit_plan"
+      ],
+      "active_tools": [
+        "bash",
+        "edit",
+        "find",
+        "fixture_tool",
+        "grep",
+        "ls",
+        "openwiki_begin",
+        "openwiki_finish",
+        "openwiki_inspect_page_claims",
+        "openwiki_next_page",
+        "openwiki_submit_page",
+        "openwiki_submit_plan",
+        "read",
+        "write"
+      ],
+      "skills_selected": 0,
+      "prompts_loaded": 0,
+      "local_scripted_turn": "completed",
+      "candidate_tools_invoked": 0,
+      "shutdown": "PASS"
+    }
+  ],
+  "network_attempts": 0,
+  "child_process_attempts": 0,
+  "external_provider_calls": 0,
+  "paid_candidate_runs": 0,
+  "diagnostics": [],
+  "foreign_stdout_suppressed": 6,
+  "limitation": "Registration, tool selection and shutdown only. No OpenWiki lifecycle tool, MCP child, writer mutation, retrieval or quality ablation was executed.",
+  "process_exit": {
+    "code": 0,
+    "signal": null
+  },
+  "duration_ms": 1077,
+  "stderr_bytes_discarded": 0,
+  "child_exit_observed": true
+}

package/docs/evaluation/extension-audit-2026-10-17/permission-cache-artifact-verification.json

@@ -0,0 +1,24 @@
+{
+  "kind": "independent-artifact-integrity-verification",
+  "verified_at": "2026-10-17T09:05:22.235Z",
+  "results": [
+    {
+      "identity": "@gotgenes/pi-permission-system@40.3.0",
+      "artifact_scope": "extension-audit-20261017-51c18bf7-245f-427b-91e2-4dc7820d7227",
+      "artifact": "gotgenes-pi-permission-system-40.3.0.tgz",
+      "sha256": "sha256:19a718d2a62f03be7eaffd62bc693371b466cda31d66992ef437fcbdee5f8c47",
+      "integrity": "sha512-B3iAs1YOnyUdeh66P40+YEJ0G3WBFsEpJAtXv/pY0CyhpIoErCoLBNKN2Sx9+Cg3VXmGMC1h/3T7r+b0d97oVg==",
+      "sri_status": "PASS",
+      "matches_independent_audit_hash": true
+    },
+    {
+      "identity": "pi-cache-optimizer@2.9.3",
+      "artifact_scope": "extension-audit-20261017-51c18bf7-245f-427b-91e2-4dc7820d7227",
+      "artifact": "pi-cache-optimizer-2.9.3.tgz",
+      "sha256": "sha256:fb04b2e382eb06e1ebb2eb54a7e1272b06cdf6b81f65aedb2235f74ca6911e81",
+      "integrity": "sha512-FdkhoM05E6JLTTgiIu+QSTuahcV1GeB1beVBaqGQRz4VZXMGoHgjlnUBLJt43WTXfe3TULG7r/xUKx3JIxVjUw==",
+      "sri_status": "PASS",
+      "matches_independent_audit_hash": true
+    }
+  ]
+}

package/docs/evaluation/extension-audit-2026-10-17/permission-cache-evidence.json

@@ -0,0 +1,133 @@
+{
+  "schema_version": "1.0.0",
+  "audit_date": "2026-10-17",
+  "method": {
+    "registry_checked_at_utc": "2026-10-17",
+    "package_handling": "Downloaded exact registry tarballs into a fresh temporary directory; hashed and unpacked for static reading only.",
+    "npm_install": false,
+    "lifecycle_scripts_run": false,
+    "extension_imported_or_executed": false,
+    "provider_or_model_calls": false,
+    "credentials_read": false,
+    "production_configuration_changed": false,
+    "runtime_status": "NOT_RUN"
+  },
+  "host_sdk": {
+    "project": "pi-session-mcp",
+    "installed_pi_coding_agent": "@earendil-works/pi-coding-agent@1.2.0",
+    "installed_pi_tui": "@earendil-works/pi-tui@1.2.0",
+    "sdk_source_checked": "node_modules/@earendil-works/pi-coding-agent/dist/core/extensions/types.d.ts",
+    "sdk_symbols_present": [
+      "cache_warming_decision",
+      "before_provider_request",
+      "before_provider_headers",
+      "after_provider_response",
+      "tool_execution_end",
+      "getAgentDir"
+    ],
+    "local_extension_install_status": "NOT_INSTALLED; parent session checked exact Pi extension install paths and observed ENOENT for both package manifests."
+  },
+  "packages": [
+    {
+      "name": "@gotgenes/pi-permission-system",
+      "version": "40.3.0",
+      "identity_status": "EXACT_REGISTRY_PACKAGE_EXISTS",
+      "registry_published_at_utc": "2026-10-17T02:29:10.027Z",
+      "source_urls": {
+        "registry": "https://registry.npmjs.org/%40gotgenes%2Fpi-permission-system",
+        "npm": "https://www.npmjs.com/package/%40gotgenes/pi-permission-system",
+        "repository": "https://github.com/gotgenes/pi-packages/tree/main/packages/pi-permission-system"
+      },
+      "repository_directory": "packages/pi-permission-system",
+      "license": "MIT",
+      "engines": {
+        "node": ">=22"
+      },
+      "peer_dependencies": {
+        "@earendil-works/pi-coding-agent": ">=1.0.0",
+        "@earendil-works/pi-tui": ">=1.0.0"
+      },
+      "peer_range_includes_host": true,
+      "dev_dependencies_sdk_versions": {
+        "@earendil-works/pi-coding-agent": "1.0.0",
+        "@earendil-works/pi-tui": "1.0.0"
+      },
+      "direct_dependencies": {
+        "zod": "^4.4.3",
+        "web-tree-sitter": "^0.26.9",
+        "tree-sitter-bash": "^0.25.1"
+      },
+      "package_install_lifecycle_scripts": [],
+      "pi_extension_entry": "./src/index.ts",
+      "tarball_url": "https://registry.npmjs.org/@gotgenes/pi-permission-system/-/pi-permission-system-40.3.0.tgz",
+      "tarball_sha256": "19a718d2a62f03be7eaffd62bc693371b466cda31d66992ef437fcbdee5f8c47",
+      "registry_integrity": "sha512-B3iAs1YOnyUdeh66P40+YEJ0G3WBFsEpJAtXv/pY0CyhpIoErCoLBNKN2Sx9+Cg3VXmGMC1h/3T7r+b0d97oVg==",
+      "registry_shasum": "fabcc2772f7f4357fd6cad0ca0241171bf95934b",
+      "reviewed_artifact_files": {
+        "package/package.json_sha256": "24edab00f169e3a050768ddac9ece6241eba45f86f527c72f784b1e566a64394",
+        "package/src/index.ts_sha256": "d016ca32ac1e1c8fe899f5cddfdb846ca14134adb9c9d3f01ca53fa2e40a649c",
+        "package/LICENSE_sha256": "220a81ab89687aa207c1b9257a7f3636c8c78b5c1092b7563ad662950d21dd00"
+      },
+      "static_findings": {
+        "direct_network_or_telemetry_client_found": false,
+        "model_calls_in_core_package": false,
+        "local_persistence": ["extension config", "debug/review JSONL logs", "child-session permission forwarding files"],
+        "log_content_risk": "Review logs can contain bash command text and tool-input previews. The package uses width caps, name-based redaction, and owner-only modes; its README says secret detection is not predictive.",
+        "is_os_sandbox": false,
+        "headless_policy": "README describes child ask forwarding in non-UI contexts. Source exposes a headless-deny/unavailable-authority fallback; generic local MCP host cannot itself display human confirmation.",
+        "transitive_install_lifecycle": "Not evaluated; no lifecycle scripts run."
+      },
+      "runtime_status": "NOT_RUN"
+    },
+    {
+      "name": "pi-cache-optimizer",
+      "version": "2.9.3",
+      "identity_status": "EXACT_REGISTRY_PACKAGE_EXISTS",
+      "registry_published_at_utc": "2026-10-17T00:03:54.246Z",
+      "source_urls": {
+        "registry": "https://registry.npmjs.org/pi-cache-optimizer",
+        "npm": "https://www.npmjs.com/package/pi-cache-optimizer",
+        "repository": "https://github.com/jiangge/pi-cache-optimizer"
+      },
+      "license": "MIT",
+      "peer_dependencies": {
+        "@earendil-works/pi-coding-agent": ">=0.82.0"
+      },
+      "peer_range_includes_host": true,
+      "readme_validation_claim": "Pi 1.3.0",
+      "direct_dependencies": {},
+      "package_install_lifecycle_scripts": [],
+      "pi_extension_entry": "./index.ts",
+      "tarball_url": "https://registry.npmjs.org/pi-cache-optimizer/-/pi-cache-optimizer-2.9.3.tgz",
+      "tarball_sha256": "fb04b2e382eb06e1ebb2eb54a7e1272b06cdf6b81f65aedb2235f74ca6911e81",
+      "registry_integrity": "sha512-FdkhoM05E6JLTTgiIu+QSTuahcV1GeB1beVBaqGQRz4VZXMGoHgjlnUBLJt43WTXfe3TULG7r/xUKx3JIxVjUw==",
+      "registry_shasum": "88decea79e6b5a0d7fa1ebabb770c914a7533b5c",
+      "reviewed_artifact_files": {
+        "package/package.json_sha256": "6f14f4dc74a20138befbd2b9907e1be7cad3a6c693aea531a00e8375c44fd123",
+        "package/index.ts_sha256": "80aaa1db69e7797722515514b6178a89644acfc4e21e85c37f57388a5fb699ce",
+        "package/LICENSE_sha256": "65e16267e5ed416dd727f70a7d2dcdcb6aee073d2de15349189124adf67e701b"
+      },
+      "static_findings": {
+        "direct_network_or_telemetry_client_found": false,
+        "provider_data_path": "Pi core sends the provider request. The extension may edit prompt/request/header fields before Pi sends it.",
+        "provider_call_side_effect": "cache_warming_decision can request that Pi perform a real cache refresh request; the request may be billable even when local model pricing is zero or unknown.",
+        "local_persistence": ["per-instance cache-stat shards and archives", "extension configuration and fix receipts under the Pi agent directory", "optional explicitly-confirmed models.json fixes"],
+        "interactive_write_gate": "README says fix/rollback writes require preview and UI confirmation and refuse when no interactive UI is available.",
+        "headless_policy": "Read-only hooks and diagnostics can run headlessly; mutation commands are not suitable for unattended execution.",
+        "transitive_install_lifecycle": "No package dependencies; no package lifecycle scripts."
+      },
+      "runtime_status": "NOT_RUN"
+    }
+  ],
+  "provider_free_tests": {
+    "executed": [],
+    "recommended": [
+      "Permission: fake Pi hook context for allow/deny, bash and path parsing, MCP server/tool matching, fail-closed errors, headless ask denial, and child-to-parent forwarding.",
+      "Permission: temporary agent directory for redaction, file modes, review logs, forwarding files, and cleanup using synthetic data.",
+      "Cache optimizer: synthetic before_provider_request/headers/response events to check payload transforms and bypass cases without transport.",
+      "Cache optimizer: temporary agent directory for stats shards, archives, malformed state, concurrency, and data minimization.",
+      "Cache optimizer: zero-price/unknown-price cache_warming_decision returns no warm request under evaluation policy; assert headless fixes do not modify models.json.",
+      "Project integration: fake extension loader and collector authorization tests; MCP outer tool grants must not be reported as enforcement of inner collector methods."
+    ]
+  }
+}