pi-session-mcp 0.8.3 → 0.12.0

package/docs/evaluation/extension-audit-2026-10-17/permission-cache-report.md

@@ -0,0 +1,64 @@
+# Pi Extension Static Audit: Permission System and Cache Optimizer
+
+Audit date: 2026-10-17 (UTC registry snapshot observed during this audit)
+
+This is a static review of the exact npm artifacts named below. The local Pi installation was checked by the controlling session and neither package was present. Tarballs were downloaded to a fresh `/tmp` directory, hashed, and unpacked for reading. No `npm install`, lifecycle script, extension import, extension execution, credential read, provider/model call, or production configuration change occurred. Runtime status for both packages is therefore **NOT RUN**.
+
+## Findings
+
+| Package | Exact npm identity at audit time | SDK 1.2.0 compatibility | Headless use | Decision |
+|---|---|---|---|---|
+| Permission policy | `@gotgenes/pi-permission-system@40.3.0` | Declared peers `@earendil-works/pi-coding-agent >=1.0.0` and `@earendil-works/pi-tui >=1.0.0`; the installed project versions are both `1.2.0`. The version ranges include the installed SDK. The artifact's dev dependencies use SDK/TUI `1.0.0`; there is no runtime qualification against this host. | Policy gates can run without a UI. `ask` can be forwarded from a child session to a serving parent, while a headless session without a usable authority must fail closed; it cannot obtain a human confirmation from this local MCP host by itself. | Candidate for a controlled provider-free integration test after isolated installation. Do not call it an OS sandbox or assume it enforces arbitrary collector-internal methods. |
+| Cache optimizer | `pi-cache-optimizer@2.9.3` | Declared peer `@earendil-works/pi-coding-agent >=0.82.0`, which includes `1.2.0`. Its README says it is validated against Pi `1.3.0`; current host `1.2.0` is inside the peer range, but that is not runtime evidence. The source uses extension hooks and `getAgentDir()` that are present in installed SDK 1.2.0 declarations. | Its hooks and read-only diagnosis can operate without interactive UI. Commands that write config or model files require interactive confirmation and are documented to refuse writes in non-interactive mode. | Candidate only with all write fixes disabled and cache warming explicitly off. It can make Pi perform extra billable provider refresh requests through the host's cache-warming hook. |
+
+### Identity and provenance
+
+The registry identity `@gotgenes/pi-permission-system` is valid and distinct from forks such as `@xzzpig/pi-permission-system`. The current npm package points to the `packages/pi-permission-system` directory of `gotgenes/pi-packages`; this audit did not substitute the separate `epheien/pi-permission-system` repository for the npm artifact. The current cache package identity is `pi-cache-optimizer`, repository `jiangge/pi-cache-optimizer`; it documents a rename from `pi-deepseek-cache-optimizer`.
+
+The registry's `latest` tag resolved to permission-system `40.3.0` (published 2026-10-17 02:29:10 UTC) and cache-optimizer `2.9.3` (published 2026-10-17 00:03:54 UTC). Pin these exact versions and verify tarball integrity again at installation time; `latest` is mutable.
+
+## Static behavior and data paths
+
+### `@gotgenes/pi-permission-system`
+
+The package registers Pi lifecycle/input/tool-call hooks and applies deterministic allow/ask/deny policy to the tool surface. Its README describes gates for bash, file paths, skills, MCP servers/tools and special operations. It has no built-in model call or model configuration; model-assisted authorization is a separately installed authorizer link and requires explicit opt-in configuration.
+
+The reviewed shipped source contains no direct HTTP client, `fetch`, WebSocket, analytics or telemetry client reference. Local data paths include its extension configuration, debug/review JSONL logs, and forwarding request/response files for child sessions. Review logs can contain bash command text and tool-input previews. The source applies width caps, name-based redaction and owner-only file modes, but its README explicitly says it cannot infer every secret from a value; logs still need local handling as potentially sensitive. The package has no `preinstall`, `install`, `postinstall`, or other install lifecycle hook in its published `package.json`. Its declared dependencies (`web-tree-sitter`, `tree-sitter-bash`, `zod`) may have their own lifecycle behavior; that transitive install behavior was not executed or independently qualified here.
+
+The README explicitly defines this package as a decision layer, not an isolation mechanism or sandbox. Its policy only controls actions Pi routes through the extension's registered hooks. It does not prove OS-level file confinement, stop unmediated code paths, or establish policy over unexposed internal methods of this project's MCP collectors. Treat those as separate enforcement boundaries.
+
+### `pi-cache-optimizer`
+
+The extension hooks can rewrite parts of prompts, add a conservative OpenAI-compatible cache key, adapt provider request payload/headers, collect local cache usage counters, and present diagnostics. Source imports use Pi's public package root and Node built-ins; this static source scan found no direct HTTP client, `fetch`, WebSocket, analytics or telemetry client. The provider request that Pi normally makes remains an outbound data path to the selected provider; the extension's payload edits are part of that request. Local persistence includes cache-stat shards/archives and extension-owned configuration/receipts under Pi's agent directory. Stats are keyed with provider/model and opaque session identifiers according to the README and source.
+
+The extension handles Pi's `cache_warming_decision` hook. When enabled under its zero-price policy, it can tell Pi to replay a provider request with a one-token output cap. That is a real provider request and may be billable even if local catalog prices are zero or unknown; turn off Pi cache warming and the extension's zero-price-warming option for an evaluation intended to make exactly one model request per turn. The extension itself does not run a separate keepalive timer.
+
+Several slash commands (`fix`, `rollback`, persistent feature config) can change `models.json` or extension-owned files after preview and UI confirmation. The package documents refusing such writes when interactive confirmation is unavailable. Those mutation paths must stay out of a headless evaluation profile. The README's `doctor`/`compat` paths are diagnostic and read-only.
+
+The published package has no dependencies and no install lifecycle scripts. Its `pi` manifest exposes `./index.ts` as its extension entry point.
+
+## Provider-free qualification plan
+
+No new tests were executed as part of this static audit. After an isolated, exact-version install into a disposable evaluation fixture, the following tests can qualify extension behavior without provider access:
+
+1. **Permission policy:** invoke the real local Pi hook contract with a fake in-memory provider; test explicit deny and allow, a representative file-path deny, bash wrapper/unparseable cases, MCP server/tool matching, and fail-closed hook errors. For `ask`, test TUI, RPC/print headless fallback, and child-to-parent forwarding separately. Assert that a headless ask never becomes an implicit allow and that no MCP-provider method outside the mediated hook surface is claimed as protected.
+2. **Permission data handling:** direct logs and forwarding files to a temporary fake agent directory; test redaction and owner-only creation modes with synthetic secret-like values, then assert cleanup. Do not use real home/agent state.
+3. **Cache payload logic:** use synthetic model and provider request events; assert the exact request fields changed/preserved for each supported API, that OpenAI Responses/Codex bypasses are honored where documented, and that no test sends a request.
+4. **Cache stats and persistence:** use temporary agent dirs and synthetic response usage events to test shard creation/aggregation, malformed file handling, concurrent writers, session partitioning, retention/cleanup and absence of prompt text, response payloads, headers or credentials in persisted JSON.
+5. **Billable-call gate:** provide zero and unknown pricing fixtures and verify `cache_warming_decision` returns no warming decision when evaluation policy disables it. Verify fix/rollback commands refuse in headless mode and no project/global `models.json` is changed.
+6. **MCP/server boundary:** run the project server with a fake extension loader and fake Pi SDK seams, verify stdout remains protocol-only and that the extension allowlist is exact. Separately test any internal collector method grant enforcement; outer MCP exposure does not establish inner-method authorization.
+
+These tests can check contract behavior without network/provider credentials. They do not by themselves establish OS sandboxing or evaluate model quality.
+
+## Evidence
+
+The companion [evidence JSON](permission-cache-evidence.json) records registry versions, metadata, source URLs, local SDK versions, install status, tarball hashes and test status. Registry package metadata is primary evidence for the published identity and artifact integrity; the unpacked files are the reviewed artifact. No test/result in this report should be read as runtime qualification.
+
+Primary sources:
+
+- [npm registry metadata: `@gotgenes/pi-permission-system`](https://registry.npmjs.org/%40gotgenes%2Fpi-permission-system)
+- [Published permission-system package](https://www.npmjs.com/package/%40gotgenes/pi-permission-system)
+- [Permission-system source repository](https://github.com/gotgenes/pi-packages/tree/main/packages/pi-permission-system)
+- [npm registry metadata: `pi-cache-optimizer`](https://registry.npmjs.org/pi-cache-optimizer)
+- [Published cache-optimizer package](https://www.npmjs.com/package/pi-cache-optimizer)
+- [Cache-optimizer source repository](https://github.com/jiangge/pi-cache-optimizer)

package/docs/evaluation/extension-audit-2026-10-17/publication-export.json

@@ -0,0 +1,10 @@
+{
+  "kind": "derived-publication-format-export",
+  "source_artifact": "web-openwiki-report.md",
+  "original_artifact_sha256": "45f256880a3cf466d92f9dbe23b801f322dee46392458bccdad5429739f1154d",
+  "public_artifact_sha256": "1ab296eea8357684491ced997e51a7ca7de7c2c9ad29ee45c75c875ae80f9d35",
+  "original_integrity_index_sha256": "e7fee562680eca6224420939fd6faeb1b6dd8112076f516dc5de3c428a32d71c",
+  "transformation": "Remove one redundant blank line at end of the archived Markdown report so the staged patch passes whitespace validation. No prose, result, code or run receipt changed.",
+  "original_preservation": "Original report and index retained in the owned ignored publication scope.",
+  "exported_at": "2026-10-17T15:49:24.588367+00:00"
+}

package/docs/evaluation/extension-audit-2026-10-17/resolver-gates.json

@@ -0,0 +1,51 @@
+{
+  "kind": "real-production-extension-resolver-check",
+  "executed_at": "2026-10-17T09:03:44.751Z",
+  "imports_of_candidate_code": 0,
+  "installs": 0,
+  "provider_calls": 0,
+  "results": [
+    {
+      "identity": "npm:pi-lens@4.4.3",
+      "resolver_status": "BLOCKED",
+      "code": "extension_not_installed",
+      "current_node": "22.23.2"
+    },
+    {
+      "identity": "npm:context-mode@1.0.169",
+      "resolver_status": "BLOCKED",
+      "code": "extension_not_installed",
+      "current_node": "22.23.2"
+    },
+    {
+      "identity": "npm:pi-cache-optimizer@2.9.3",
+      "resolver_status": "BLOCKED",
+      "code": "extension_not_installed",
+      "current_node": "22.23.2"
+    },
+    {
+      "identity": "npm:@gotgenes/pi-permission-system@40.3.0",
+      "resolver_status": "BLOCKED",
+      "code": "extension_not_installed",
+      "current_node": "22.23.2"
+    },
+    {
+      "identity": "npm:pi-web-access@0.41.0",
+      "resolver_status": "BLOCKED",
+      "code": "extension_load_failed",
+      "current_node": "22.23.2"
+    },
+    {
+      "identity": "npm:openwiki@0.7.2",
+      "resolver_status": "PASS",
+      "required_node": ">=22.22.0",
+      "current_node": "22.23.2"
+    },
+    {
+      "identity": "npm:pi-cursor-sdk@0.5.3",
+      "resolver_status": "PASS",
+      "required_node": ">=24",
+      "current_node": "22.23.2"
+    }
+  ]
+}

package/docs/evaluation/extension-audit-2026-10-17/review.json

@@ -0,0 +1,28 @@
+{
+  "kind": "independent-read-only-review",
+  "reviewed_at": "2026-10-17T09:07:30.354Z",
+  "subjects": [
+    {
+      "file": "README.md",
+      "hash": "sha256:18f6b4a76f4cddb426d6554b4a2fce76f14114a125b46b099a1ebf7e2d5a59ea"
+    },
+    {
+      "file": "summary.json",
+      "hash": "sha256:5833fcc28ca711e43ae9a086d3d8870a5b08ab5878b5731f34b4af15c258c014"
+    },
+    {
+      "file": "run-openwiki-headless-probe.mjs",
+      "hash": "sha256:f11602228306ce6556b87ac9a437d8d4e31638461c96b87f7e84df0e04ab1d4c"
+    },
+    {
+      "file": "openwiki-headless-probe.mjs",
+      "hash": "sha256:14f7c859f347a85fef34b587f21dea508339e3f318153a9720a9e2b2f1cd96b7"
+    }
+  ],
+  "status": "PASS",
+  "findings": [],
+  "conclusion": "Resolver, runtime and quality statuses are separated correctly. OpenWiki PASS is restricted to registration, tool selection, scripted turn and shutdown. Its writer tools and internal MCP child are not qualified. Supervisor bounds execution, observes child exit and checks ownership before cleanup. Instrumentation limits are explicit.",
+  "changes": 0,
+  "test_executions": 0,
+  "external_provider_calls": 0
+}

package/docs/evaluation/extension-audit-2026-10-17/run-openwiki-headless-probe.mjs

@@ -0,0 +1,29 @@
+// Run from the repository root after: ./node_modules/.bin/tsc -p tsconfig.eval.json
+// Provider-free component check only. Never invokes an OpenWiki tool.
+import { spawn } from 'node:child_process';
+import { mkdir, writeFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { randomUUID } from 'node:crypto';
+import { getAgentDir } from '@earendil-works/pi-coding-agent';
+const root=process.cwd();
+const {ownedTemporary,sourceBinding,hash}=await import(pathToFileURL(join(root,'.profile-eval/eval/profiles/files.js')).href);
+const source=await sourceBinding(root),scope=await ownedTemporary();
+const output=join(root,'eval/results','openwiki-headless-'+randomUUID());
+await mkdir(output,{mode:0o700});
+const script=join(dirname(fileURLToPath(import.meta.url)),'openwiki-headless-probe.mjs');
+const started=Date.now();
+const child=spawn(process.execPath,[script],{cwd:root,env:{PATH:process.env.PATH,HOME:scope.root,XDG_CONFIG_HOME:join(scope.root,'config'),XDG_CACHE_HOME:join(scope.root,'cache'),XDG_DATA_HOME:join(scope.root,'data'),PI_CODING_AGENT_DIR:join(scope.root,'agent'),PI_AUDIT_AGENT_DIR:getAgentDir(),OPENWIKI_TELEMETRY_DISABLED:'1',DO_NOT_TRACK:'1',NODE_OPTIONS:'--unhandled-rejections=strict'},stdio:['ignore','pipe','pipe']});
+let outputText='',stderrBytes=0,killer;
+child.stdout.on('data',b=>{outputText+=b;if(outputText.length>65536)child.kill('SIGKILL');});
+child.stderr.on('data',b=>{stderrBytes+=b.length;});
+const timer=setTimeout(()=>{child.kill('SIGTERM');killer=setTimeout(()=>child.kill('SIGKILL'),1000);},45000);
+const terminal=await new Promise(resolve=>{child.once('error',()=>resolve({code:null,signal:null,spawn_error:true}));child.once('exit',(code,signal)=>resolve({code,signal,spawn_error:false}));});
+clearTimeout(timer);if(killer)clearTimeout(killer);
+let receipt;try{receipt=JSON.parse(outputText);}catch{receipt={status:'INCONCLUSIVE',reason:'missing_sanitized_receipt'};}
+const after=await sourceBinding(root);
+const result={...receipt,source_binding:source,source_unchanged:source.commit===after.commit&&source.digest===after.digest,scope_id:scope.scope_id,process_exit:terminal,duration_ms:Date.now()-started,stderr_bytes_discarded:stderrBytes,child_exit_observed:!terminal.spawn_error,additional_paid_candidate_runs:0};
+if(result.status==='PASS'&&terminal.code===0&&result.source_unchanged)await scope.remove();
+else{result.status='INCONCLUSIVE';process.exitCode=1;}
+await writeFile(join(output,'result.json'),JSON.stringify(result,null,2)+'\n',{flag:'wx',mode:0o600});
+console.log(JSON.stringify({artifact_scope:output.slice(root.length+1),status:result.status,rows:result.rows?.length??0,network_attempts:result.network_attempts??null,child_process_attempts:result.child_process_attempts??null,external_provider_calls:result.external_provider_calls??null,source_unchanged:result.source_unchanged,result_hash:hash(JSON.stringify(result,null,2)+'\n')}));

package/docs/evaluation/extension-audit-2026-10-17/summary.json

@@ -0,0 +1,123 @@
+{
+  "schema_version": "1.0.0",
+  "kind": "extension-evaluation-follow-on",
+  "completed_at": "2026-10-17T09:06:38.139Z",
+  "source_binding": {
+    "commit": "406dae7e6b99aa5715960490e869bd3fc668cca2",
+    "digest": "sha256:686887d57899c2e55593bb7dd98b78be08ea0fc6c471a6dd4eab3298f890d160"
+  },
+  "scope": "Six named AP6 candidates plus configured Cursor, without unknown historical package-list expansion.",
+  "overall_status": "PARTIAL_RUNTIME_QUALIFICATION",
+  "static_candidates": 7,
+  "resolver_candidates": 7,
+  "installed_candidates": 3,
+  "not_installed_candidates": 4,
+  "runtime_component_qualified_candidates": 1,
+  "runtime_blocked_candidates": 6,
+  "candidates": [
+    {
+      "identity": "npm:pi-lens@4.4.3",
+      "resolver_status": "BLOCKED",
+      "code": "extension_not_installed",
+      "current_node": "22.23.2",
+      "static_audit": "COMPLETE",
+      "runtime_status": "BLOCKED",
+      "runtime_blocker": "extension_not_installed",
+      "quality_status": "NOT_RUN"
+    },
+    {
+      "identity": "npm:context-mode@1.0.169",
+      "resolver_status": "BLOCKED",
+      "code": "extension_not_installed",
+      "current_node": "22.23.2",
+      "static_audit": "COMPLETE",
+      "runtime_status": "BLOCKED",
+      "runtime_blocker": "extension_not_installed",
+      "quality_status": "NOT_RUN"
+    },
+    {
+      "identity": "npm:pi-cache-optimizer@2.9.3",
+      "resolver_status": "BLOCKED",
+      "code": "extension_not_installed",
+      "current_node": "22.23.2",
+      "static_audit": "COMPLETE",
+      "runtime_status": "BLOCKED",
+      "runtime_blocker": "extension_not_installed",
+      "quality_status": "NOT_RUN"
+    },
+    {
+      "identity": "npm:@gotgenes/pi-permission-system@40.3.0",
+      "resolver_status": "BLOCKED",
+      "code": "extension_not_installed",
+      "current_node": "22.23.2",
+      "static_audit": "COMPLETE",
+      "runtime_status": "BLOCKED",
+      "runtime_blocker": "extension_not_installed",
+      "quality_status": "NOT_RUN"
+    },
+    {
+      "identity": "npm:pi-web-access@0.41.0",
+      "resolver_status": "BLOCKED",
+      "code": "extension_load_failed",
+      "current_node": "22.23.2",
+      "static_audit": "COMPLETE",
+      "runtime_status": "BLOCKED",
+      "runtime_blocker": "extension_load_failed",
+      "quality_status": "NOT_RUN"
+    },
+    {
+      "identity": "npm:openwiki@0.7.2",
+      "resolver_status": "PASS",
+      "required_node": ">=22.22.0",
+      "current_node": "22.23.2",
+      "static_audit": "COMPLETE",
+      "runtime_status": "PASS_COMPONENT_ONLY",
+      "runtime_blocker": null,
+      "quality_status": "NOT_RUN"
+    },
+    {
+      "identity": "npm:pi-cursor-sdk@0.5.3",
+      "resolver_status": "PASS",
+      "required_node": ">=24",
+      "current_node": "22.23.2",
+      "static_audit": "COMPLETE",
+      "runtime_status": "BLOCKED",
+      "runtime_blocker": "node_engine_unsupported",
+      "quality_status": "NOT_RUN"
+    }
+  ],
+  "component_test": {
+    "candidate": "npm:openwiki@0.7.2",
+    "sdk_version": "1.2.0",
+    "first_execution": {
+      "read_only": "PASS",
+      "coding": "PASS"
+    },
+    "fresh_scope_reproduction": {
+      "read_only": "PASS",
+      "coding": "PASS"
+    },
+    "support_fixture": "npm:pi-extension-fixture@1.0.0",
+    "candidate_tools_invoked": 0,
+    "external_provider_calls": 0,
+    "network_attempts": 0,
+    "child_process_attempts": 0
+  },
+  "additional_paid_candidate_runs": 0,
+  "installs": 0,
+  "production_changes": 0,
+  "live_quality_ablation": "NOT_RUN",
+  "prior_screening_cost_usd": null,
+  "prior_screening_cost_reason": "not-exposed-by-mcp; preserved unchanged",
+  "rules_applied": [
+    "Only installed exact allowlist pins can be loaded.",
+    "No automatic global installs or production pin/runtime changes.",
+    "No live quality run without concrete paired matrix and budget."
+  ],
+  "limitations": [
+    "Static review is not runtime qualification or transitive dependency assurance.",
+    "OpenWiki registration/selection/shutdown does not qualify writer/retrieval tools or its internal MCP child.",
+    "Instrumented JavaScript network/process guards are not an OS sandbox.",
+    "No LSP, large-output or cache bottleneck was measured, so no quality ablation was selected."
+  ]
+}

package/docs/evaluation/extension-audit-2026-10-17/web-openwiki-artifacts.json

@@ -0,0 +1,29 @@
+{
+  "kind": "published-pinned-artifact-download-and-integrity",
+  "retrieved_at": "2026-10-17T09:04:52.656Z",
+  "artifact_scope": "extension-audit-20261017-51c18bf7-245f-427b-91e2-4dc7820d7227",
+  "artifacts": [
+    {
+      "name": "pi-web-access",
+      "version": "0.41.0",
+      "metadata_url": "https://registry.npmjs.org/pi-web-access/0.41.0",
+      "tarball_url": "https://registry.npmjs.org/pi-web-access/-/pi-web-access-0.41.0.tgz",
+      "integrity": "sha512-8+UoNENGHKlYBxrtwh7Hwoh2twVfs+tcdR1Ciq7sRUtTur0mOXP8N/o7/y72JbdYij3NuSyCNjShbWBPPJ8JPA==",
+      "sha256": "sha256:68c4eb20216fe77fe69b0fcdb24e03c0cc6e0c7cc7bad8e88b47373da1c91aec",
+      "bytes": 7102345,
+      "artifact": "pi-web-access-0.41.0.tgz"
+    },
+    {
+      "name": "openwiki",
+      "version": "0.7.2",
+      "metadata_url": "https://registry.npmjs.org/openwiki/0.7.2",
+      "tarball_url": "https://registry.npmjs.org/openwiki/-/openwiki-0.7.2.tgz",
+      "integrity": "sha512-+DJd/g2knw92fhem+QXzuVFU3A8tYjTPTQ5LPNXMFzDyVhruvxcKxrweDXUN9lKWJhhFetvYsKTz4Ac/hGUVOA==",
+      "sha256": "sha256:17f0061fbb60c9b1410b30de1c47fbcc1b639bb9519a9798e4415ca8ffbe7155",
+      "bytes": 586095,
+      "artifact": "openwiki-0.7.2.tgz"
+    }
+  ],
+  "installs": 0,
+  "code_execution": 0
+}

package/docs/evaluation/extension-audit-2026-10-17/web-openwiki-evidence.json

@@ -0,0 +1,116 @@
+{
+  "schema_version": "1.0.0",
+  "audited_at": "2026-10-17",
+  "method": "read-only installed package metadata, selected compiled files, package lock integrity, npm registry metadata, official upstream README/package metadata",
+  "actions_not_taken": [
+    "install packages",
+    "import or execute extension code",
+    "call model providers",
+    "invoke external web searches through the extension",
+    "read or configure credentials",
+    "modify production profiles or settings"
+  ],
+  "runtime": {
+    "node": "22.23.2",
+    "pi_launcher_version": "1.1.0",
+    "pi_1_2_0_compatibility": "not runtime-tested"
+  },
+  "packages": [
+    {
+      "spec": "npm:pi-web-access@0.41.0",
+      "identity": "Nico Bailon Pi Web Access",
+      "repository": "https://github.com/nicobailon/pi-web-access",
+      "registry": "https://www.npmjs.com/package/pi-web-access",
+      "registry_metadata_query": "npm view pi-web-access@0.41.0 name version license repository.url engines node peerDependencies pi --json",
+      "version": "0.41.0",
+      "license": "MIT",
+      "node_engine": ">=22.19.0",
+      "pi_extension_entries": ["./dist"],
+      "entry_target_is_regular_file": false,
+      "resolver_result": "extension_load_failed: exact installed entry resolves to a directory while repository resolver requires a regular file",
+      "peer_dependencies": {
+        "@earendil-works/pi-ai": "*",
+        "@earendil-works/pi-coding-agent": "*",
+        "@earendil-works/pi-tui": "*",
+        "typebox": "*"
+      },
+      "current_upstream_main_note": "At audit time current upstream main package metadata reports 0.42.0 and ./index.ts; it is not the installed 0.41.0 package and was not substituted.",
+      "features_and_data_paths": [
+        "search and fetch tools may send queries, URLs or page content to external configured/default providers",
+        "provider/model selection may reuse host Pi authentication depending on routing",
+        "summary workflows can make a separate model call; workflow none omits summarizer call but not external search-provider use",
+        "optional browser-cookie Gemini access is documented",
+        "curator and local config/result state may be written"
+      ],
+      "telemetry_assessment": "No package-wide telemetry was established from inspected source/docs; optional provider paths were not exhaustively audited.",
+      "lockfile": {
+        "resolved": "https://registry.npmjs.org/pi-web-access/-/pi-web-access-0.41.0.tgz",
+        "integrity": "sha512-8+UoNENGHKlYBxrtwh7Hwoh2twVfs+tcdR1Ciq7sRUtTur0mOXP8N/o7/y72JbdYij3NuSyCNjShbWBPPJ8JPA=="
+      },
+      "installed_files_sha256": {
+        "package.json": "c5ccc33fe7241a28d1a32f6a633dae06b6a23e4fb3b841b0527e148d66d21ee7",
+        "dist/index.js": "28844389c2abc6b2d39b9f0e537182611fcb8f35d898e26b699a0ab8632922c2",
+        "dist/mcp-cli.js": "2eae8d7b75b02f9df03b9334c5c0b4df5b53ef08536c69f8baea8757b829bd71"
+      },
+      "behavioral_test": "not run"
+    },
+    {
+      "spec": "npm:openwiki@0.7.2",
+      "identity": "LangChain OpenWiki CLI and Pi integration",
+      "repository": "https://github.com/langchain-ai/openwiki",
+      "registry": "https://www.npmjs.com/package/openwiki",
+      "registry_metadata_query": "npm view openwiki@0.7.2 name version license repository.url engines node peerDependencies pi --json",
+      "not_same_as": {
+        "name": "pi-openwiki",
+        "repository": "https://github.com/barvhaim/pi-openwiki"
+      },
+      "version": "0.7.2",
+      "license": "MIT",
+      "node_engine": ">=22.22.0",
+      "pi_extension_entries": ["./dist/integrations/pi/openwiki.js"],
+      "entry_target_is_regular_file": true,
+      "peer_dependencies": {
+        "jsdom": "^29.1.1 || ^30.0.0",
+        "mermaid": "^11.16.0"
+      },
+      "integration_contract": {
+        "tools": [
+          "openwiki_begin",
+          "openwiki_submit_plan",
+          "openwiki_next_page",
+          "openwiki_inspect_page_claims",
+          "openwiki_submit_page",
+          "openwiki_finish"
+        ],
+        "execution_mode": "sequential annotation",
+        "transport": "local child process running package CLI with mcp --host pi over stdio",
+        "shutdown": "Pi session_shutdown closes child bridge",
+        "writes": "repository wiki lifecycle may write pages, indexes, provenance and setup metadata; personal/connectors mode writes under OpenWiki home"
+      },
+      "telemetry_assessment": "Official README documents default-on aggregate openwiki_run telemetry for standalone init/update; documented opt-outs are OPENWIKI_TELEMETRY_DISABLED=1 and DO_NOT_TRACK=1. Integration itself delegates to mcp --host pi and does not call the telemetry sender directly in inspected file. Exact installed-build host-driven egress remains unverified.",
+      "lockfile": {
+        "resolved": "https://registry.npmjs.org/openwiki/-/openwiki-0.7.2.tgz",
+        "integrity": "sha512-+DJd/g2knw92fhem+QXzuVFU3A8tYjTPTQ5LPNXMFzDyVhruvxcKxrweDXUN9lKWJhhFetvYsKTz4Ac/hGUVOA=="
+      },
+      "installed_files_sha256": {
+        "package.json": "715cf49690cad358394d3f603d1a167bbc8ec3d8bfb8c3df9801e15abed4ab33",
+        "dist/integrations/pi/openwiki.js": "bd1bdd26a8a920c9f9dec9d56273e62f77abeddcc46df30b65ab07d7a5f6e531"
+      },
+      "behavioral_test": "not run; suitable only for provider-free API smoke test followed by isolated synthetic writer test"
+    }
+  ],
+  "official_sources": [
+    "https://www.npmjs.com/package/pi-web-access",
+    "https://www.npmjs.com/package/openwiki",
+    "https://github.com/nicobailon/pi-web-access/blob/main/package.json",
+    "https://github.com/langchain-ai/openwiki/blob/main/package.json",
+    "https://github.com/langchain-ai/openwiki/blob/main/README.md",
+    "https://github.com/barvhaim/pi-openwiki"
+  ],
+  "limitations": [
+    "Installed file hashes record the current local files; the npm lock SRI records expected archive integrity, but this audit did not download and re-hash registry tarballs.",
+    "No provider or network behavior was exercised.",
+    "Wildcard Pi SDK peers and matching method names are not runtime compatibility proof.",
+    "No claim of sandboxing or complete transitive dependency audit is made."
+  ]
+}

package/docs/evaluation/extension-audit-2026-10-17/web-openwiki-report.md

@@ -0,0 +1,113 @@
+# Static audit: Pi Web Access and OpenWiki
+
+Date: 2026-10-17. Scope: installed `npm:pi-web-access@0.41.0` and
+`npm:openwiki@0.7.2`, their package metadata, documentation and selected
+compiled entrypoints. No package was installed, imported, initialized or run;
+no provider, network search or extension tool was invoked. The registry metadata
+was queried read-only with `npm view`, and official npm pages / upstream
+repositories were checked. Hashes and the lockfile integrity values are in
+[`web-openwiki-evidence.json`](./web-openwiki-evidence.json).
+
+## Findings
+
+### `pi-web-access@0.41.0`
+
+The installed package is the intended Nico Bailon project at
+[`nicobailon/pi-web-access`](https://github.com/nicobailon/pi-web-access),
+published on npm under the same name, MIT licensed, and pinned to 0.41.0 in
+Pi's package lock. The version's official npm metadata declares Node.js
+`>=22.19.0`, which the current Node 22.23.2 runtime satisfies. It declares
+wildcard peers for Pi AI, coding-agent, TUI and TypeBox, so its manifest does
+not establish compatibility with any particular Pi SDK release.
+
+There is a concrete local loader blocker for this exact installed release:
+its manifest declares `pi.extensions: ["./dist"]`, but this repository's
+resolver requires every declared entry to resolve to a regular file. The local
+`dist` target is a directory, so resolving this pin fails with
+`extension_load_failed` before extension code can load. The current upstream
+`main` package manifest has already changed to `./index.ts` (and reports
+0.42.0), which is a different package state; that does not repair or authorize
+silently substituting the installed 0.41.0 pin. A controlled test requires an
+explicit decision to update the pin and align package entrypoint policy, or a
+resolver change followed by review. The static audit did not alter either.
+
+The package exposes web search, URL fetch/content extraction, GitHub fetching,
+PDF and video tools; it also ships a standalone stdio MCP executable. Calls can
+send queries, URLs and retrieved content to selected external search/fetch or
+model providers. Provider routing is configurable; documented default search
+uses automatic provider selection, and the package can reuse Pi's OpenAI/Codex
+auth. Its README distinguishes `workflow: "none"` (no summarizer model call)
+from summary workflows, while search providers themselves may be model-backed.
+This makes even a nominal search test a real external web request with data
+disclosure. It should be tested only against a synthetic, explicitly selected
+provider/endpoint or a local stub, with no real research query and no existing
+credential use. The static audit did not inspect or read any credential file.
+
+README configures the extension via its own `web-search.json`, can read provider
+credentials through Pi auth or environment/configuration, and can optionally
+use browser cookies for Gemini Web. It documents a curator/browser workflow and
+local activity/results state. This is not a read-only capability overall:
+fetching is network read, but local curator/history/config state may be written.
+No package-wide outbound telemetry was established from the inspected source;
+that is not a proof that every optional provider path is telemetry-free.
+
+### `openwiki@0.7.2`
+
+The installed package is LangChain's
+[`langchain-ai/openwiki`](https://github.com/langchain-ai/openwiki), not the
+unrelated [`pi-openwiki`](https://github.com/barvhaim/pi-openwiki) project.
+The npm identity, repository URL, version, MIT license and Pi integration path
+agree across installed metadata and the npm registry. It pins
+`pi.extensions: ["./dist/integrations/pi/openwiki.js"]`; that local path exists
+as a regular file and passes this repository's static path/type check. The
+integration registers six sequential lifecycle tools and starts the package's
+own CLI as a local stdio MCP child when a tool is first called. It closes that
+child on Pi session shutdown. It does not register itself as a provider-backed
+agent; the documented host-driven mode uses the host agent's own model and
+repository tools.
+
+OpenWiki has an explicit minimum Node version of 22.22.0, so the current
+22.23.2 runtime qualifies. The package has no Pi SDK peer dependency; its
+manifest declares optional peers for Mermaid and jsdom only. Its integration
+uses `pi.registerTool`, `pi.on("session_shutdown", ...)`, tool schemas and
+`executionMode: "sequential"`. That is evidence of the expected host API shape,
+not proof that the installed Pi version accepts the integration at runtime.
+The local Pi launcher reports version 1.1.0; compatibility with Pi 1.2.0 has
+not been runtime-tested.
+
+OpenWiki's lifecycle can create and update a repository wiki, including
+Markdown pages, indexes, provenance and setup metadata; its personal/connectors
+mode can persist source data and a personal wiki. The six Pi tools are a
+stateful writer workflow, even though the package advertises local read-only
+discovery tools elsewhere. The tool `executionMode: "sequential"` annotation
+expresses the single-writer sequence but is a host hint, not an independent
+authorization or concurrency boundary. The integration's bridge itself is
+shared within the Pi process. Test first on a fresh synthetic repository and
+temporary OpenWiki home, with a single caller, host model calls disabled or
+stubbed, and inspect all writes. Do not point it at an existing wiki or
+connected source during compatibility testing.
+
+OpenWiki's own docs say anonymous aggregate telemetry is on by default for
+standalone `init`/`update` runs. The inspected payload fields include command,
+outcome, coarse error classification, setup mode/provider/connector names,
+build metadata and a random install ID; docs say it excludes file contents,
+repository names/data, credentials, prompts, outputs, paths, URLs and model
+IDs. Opt-out is documented through `OPENWIKI_TELEMETRY_DISABLED=1` or
+`DO_NOT_TRACK=1`. The Pi bridge launches `openwiki mcp --host pi`; the inspected
+integration itself does not invoke telemetry directly, and documented
+host-driven lifecycle tools are separate from standalone generation. A runtime
+network trace would be needed to prove the exact telemetry behavior of this
+installed build and path. For testing, set both opt-outs in the child
+environment and block egress except to a local stub.
+
+## Test decision
+
+Neither extension has been behaviorally tested in this audit. OpenWiki is
+statically loadable by the current resolver and is the better candidate for a
+provider-free API compatibility smoke test; its mutating lifecycle still needs
+a synthetic repository and temporary state/home before exercising writer
+tools. `pi-web-access@0.41.0` is blocked at extension resolution under the
+current resolver because its declared entry is a directory. Its standalone
+MCP executable is a different integration path and should not be treated as a
+successful Pi-extension test. Both projects are distinct and verified by
+repository identity; no similarly named package was substituted.

package/docs/evaluation/extension-functions-2026-10-17/README.md

@@ -0,0 +1,33 @@
+# Pi extension functional evidence — 2026-10-17
+
+The initial model screens used baseline A without selected third-party extensions. Subsequent SDK load/registration checks established package compatibility in that bounded path, but did not establish useful extension behavior. This dossier adds actual provider-free function checks of the seven selected candidates and preserves the distinction between Pi integration, standalone MCP execution and fixture-host component tests.
+
+No external model turn, paid provider call, subscription, global package installation, production profile change or production repository write was performed for this follow-up. Node 24.22.0 was used. The evaluation source remains bound to commit `406dae7e6b99aa5715960490e869bd3fc668cca2` and digest `sha256:a4524626851448908b8d21ecbd7248c9956ce830406e81c45fda46c8eb6fffc5`.
+
+## What is actually qualified
+
+| Exact package | Actual execution | Result and remaining limit |
+|---|---|---|
+| `pi-lens@4.4.3` | Public SDK tool definitions against a synthetic source repository | [Seven tool calls](navigation/README.md) PASS for cold-cache/retry responses (six searches and one project report). Warm-index retrieval remains **INCONCLUSIVE**; no expected fixture hit was observed. |
+| `context-mode@1.0.169` | Actual SDK `tool_result` hook receives a synthetic AGENTS read result; independent inspection of its owned database checks persistence | [Hook persistence](navigation/README.md) PASS. The inner MCP server started with its own guard; the restricted overall probe is **BLOCKED** and MCP tool retrieval remains **INCONCLUSIVE**. No compression or original-output retrieval was executed. Project tagging does not prove a search authorization boundary. |
+| `pi-cache-optimizer@2.9.3` | Actual hooks and registered command callbacks from the published entrypoint, driven by a synthetic host | [Six cases](cache/README.md) PASS: payload mutation/preservation, Codex bypass, disabled zero/unknown-price warming, headless fix/rollback refusal and synthetic usage persistence. No measured cache savings or live scheduler qualification. |
+| `@gotgenes/pi-permission-system@40.3.0` | Seven public policy queries and four actual SDK hook decisions, already completed | [Policy and hook checks](../permission-gates-2026-10-17/README.md) PASS. The hook counter is synthetic; no tool executor or OS containment is established. |
+| `openwiki@0.7.2` | All six registered Pi lifecycle tools invoke the real stdio MCP child; one owned repository and one writer | [14 checks](bridges/README.md) PASS, including plan, claims, written-page submission, completion and invalid-state rejection. Source preserved and cleanup observed. Retrieval/model quality remains untested. |
+| `pi-web-access@0.41.0` | Production Pi resolver plus separately published standalone MCP CLI | [Six checks](bridges/README.md) PASS for discovery, owned-loopback raw fetch, stored-content lookup and invalid requests. **Pi extension loading remains BLOCKED** by the directory-valued manifest entry; `web_search` and `source_check` were discovered but not called. |
+| `pi-cursor-sdk@0.5.3` | Local activation component is reported separately from model execution | [Two component cases](cursor/README.md) PASS: activation, resource listing, unknown/disabled skill rejection, symlink omission and disabled bridge. Cursor local-agent/cloud/provider sessions remain NOT_RUN. |
+
+These rows do not qualify entire packages or production deployment. The package/peer/license/telemetry audits and isolated installations remain in the earlier [extension audit](../extension-audit-2026-10-17/README.md) and [Node 24 follow-up](../node24-followup-2026-10-17/README.md); those records are not rewritten.
+
+## MCP and data paths
+
+OpenWiki exercised the Pi extension's genuine stdio child and six lifecycle methods. Web Access exercised its genuine standalone stdio child and two content tools against one controller-owned HTTP fixture. Context-mode's event persistence check does not establish its separate MCP compressor. Cursor's local activation component does not establish Cursor-owned MCP servers. The prior synthetic MCP and permission tests remain separately scoped in the [coverage register](../2026-10-17-test-coverage.md).
+
+The probes use fresh owned homes/workspaces, no credential environment and narrowly instrumented network/child paths. OpenWiki's one observed outgoing fetch attempt was blocked, despite explicit telemetry opt-outs; its purpose was not attributed. Context-mode's guarded MCP child attempted one network request and 20 child processes, all intercepted; this restricted bridge experiment is inconclusive. Web Access allowed only the local fixture port with temporary package SSRF configuration. These JavaScript guards and process-group observations are bounded instrumentation, not a sandbox or general filesystem boundary.
+
+## Remaining work and scope
+
+A live quality/cache/context benefit over baseline A is **NOT_RUN**: no B/C ablation was selected and this follow-up consumes no new model slots. Such a comparison needs matched tasks and an explicitly approved route/start/budget matrix. Existing screening approval does not authorize additional model calls.
+
+The other inventoried workflow packages, including `pi-subagents`, `@juicesharp/rpiv-todo`, `pi-goal-x` and `pi-advisor-flow`, are not part of this seven-candidate functional result. No default inner agents, goal loops or workflow framework were enabled. The original assignment explicitly excluded installing all previously catalogued packages.
+
+Runnable scripts, individual receipts, unsuccessful harness attempts, observed cleanup and exact limitations are preserved in each component dossier. The [machine-readable summary](summary.json), [independent review](review.json) and integrity index bind the final report to those files. Core source was unchanged, so the already completed 1,459-test full suite and 308-test offline subset were not needlessly repeated; they remain historical source-bound checks, not counts of the new extension function probes.