fix(e2e): admit streamed Pi write paths before control

Calibrate partial native arguments against the retained permission boundary, retaining strict conflicting-path rejection. Extend public npm consumer verification through the CLI Pi setup and credential-free packaged startup.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

scripts/pi-public-install-probe.mjs

@@ -0,0 +1,70 @@
+#!/usr/bin/env node
+// Run in a credential-free public npm consumer after `paperclipai runtime setup pi`.
+// Use the server's normal packaged daemon resolver; never submit a prompt.
+import assert from 'node:assert/strict';
+import { mkdir, mkdtemp, readFile, realpath, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { pathToFileURL } from 'node:url';
+
+const [serverDirectory, ...extra] = process.argv.slice(2);
+assert.ok(serverDirectory && extra.length === 0, 'Usage: pi-public-install-probe.mjs INSTALLED_SERVER_ROOT');
+for (const key of Object.keys(process.env)) {
+  assert.ok(!/(?:API_KEY|TOKEN|SECRET|PASSWORD)$/.test(key), `Unexpected credential variable: ${key}`);
+}
+assert.equal(process.env.PAPERCLIP_RUNNER_BINARY, undefined);
+assert.equal(process.env.NODE_OPTIONS, undefined);
+assert.equal(process.env.NODE_PATH, undefined);
+const server = await realpath(serverDirectory);
+assert.equal(JSON.parse(await readFile(join(server, 'package.json'), 'utf8')).name, '@paperclipai/server');
+const { resolvePaperclipRunnerBinary } = await import(pathToFileURL(join(server, 'dist/services/native-runtime/native-codex-runner.js')));
+const { createCapabilityRunnerdCodexTransport } = await import(pathToFileURL(join(server, 'dist/vendor/paperclip-runner/live/runnerd-codex-transport.js')));
+const { QUALIFIED_ACPX_PROFILES } = await import(pathToFileURL(join(server, 'dist/vendor/paperclip-runner/drivers/acpx/qualified-profiles.js')));
+assert.equal(QUALIFIED_ACPX_PROFILES.pi.agentProfileVersion, 13);
+assert.equal(QUALIFIED_ACPX_PROFILES.pi.commandDigest, 'sha256:fe1e6da01b2a9e4c691ca27cf689d2d6de846a93be6b23fc1e103c9addd7b177');
+assert.equal(QUALIFIED_ACPX_PROFILES.pi.qualificationModel, 'openrouter/deepseek/deepseek-v4-flash-0731');
+const daemon = resolvePaperclipRunnerBinary();
+assert.equal(await realpath(daemon), join(server, 'dist/vendor/paperclip-runner/bin/paperclip-runnerd'));
+const root = await mkdtemp(join(tmpdir(), 'pi-public-install-probe-'));
+const evidence = [];
+const started = performance.now();
+const watchdog = setTimeout(() => { console.error('Pi public-install probe exceeded its cleanup deadline'); process.exit(1); }, 85_000);
+let bundle;
+let failure;
+let settledMs;
+try {
+  const workspace = join(root, 'workspace'); await mkdir(workspace);
+  bundle = createCapabilityRunnerdCodexTransport({
+    provider: 'acpx', acpxAgent: 'pi', piThinkingLevel: 'low', acpxPermissionMode: 'deny-all',
+    runnerBinary: daemon, stateDirectory: join(root, 'state'),
+    environment: { PATH: '/usr/bin:/bin', LANG: 'C.UTF-8' },
+    onEvidence: value => evidence.push(value),
+  });
+  try {
+    await bundle.transport.request('initialize', { clientInfo: { name: 'pi-public-install-verification', version: '1' } });
+    await bundle.transport.request('thread/start', {
+      cwd: workspace, model: 'openrouter/deepseek/deepseek-v4-flash-0731',
+      baseInstructions: 'Credential-free admission probe. No prompt is submitted.',
+      permissions: 'paperclip-runner-workspace-read-only', dynamicTools: [],
+    });
+  } catch (error) { failure = String(error); }
+  settledMs = Math.round(performance.now() - started);
+  await bundle.transport.close();
+  assert.match(failure ?? '', /session\.open failed/);
+  assert.match(failure, /retryable=false, classification=session_ensure_failed/);
+  assert.doesNotMatch(failure, /timed out/);
+  assert.ok(settledMs < 60_000, `Pi admission took ${settledMs} ms`);
+  assert.ok(evidence.some(item => item.runnerExited === true && item.runnerExitCode === 0));
+  for (const item of evidence) assert.deepEqual(item.childEnvironmentKeys, ['LANG', 'PATH']);
+  const state = JSON.parse(await readFile(join(root, 'state/runner/acpx-provider-state.json'), 'utf8'));
+  assert.equal(state.descriptor.agent, 'pi');
+  assert.equal(state.descriptor.agentRuntimeVersion, '1.0.0');
+  assert.equal(state.descriptor.piThinkingLevel, 'low');
+  assert.equal(state.activeTurnId, null);
+  assert.equal(state.identity, null);
+  assert.equal(state.providerExitUnconfirmed, false);
+  console.log(JSON.stringify({ schema: 'paperclip.pi.public-npm-install.v1', target: `${process.platform}-${process.arch}`, normalPackagedDaemon: true, exactPiProfile: 13, runtime: '1.0.0', credentials: 'none', promptCalls: 0, settledMs, cleanRunnerExit: true }));
+} finally {
+  try { await bundle?.transport.close(); }
+  finally { clearTimeout(watchdog); await rm(root, { recursive: true, force: true }); }
+}

scripts/verify-grok-npm-install.mjs

@@ -30,6 +30,7 @@ try {
     }
   }
   visit('@paperclipai/server');
+  visit('paperclipai');
   // Match release.sh's unified versioning in temporary staging directories.
   // Source manifests remain untouched, including independently versioned SDKs.
   run(process.execPath, [join(repo, 'scripts/build-standalone-public-packages.mjs')], repo);
@@ -115,6 +116,17 @@ try {
   run(process.execPath, [join(repo, 'packages/paperclip-runner/scripts/provision-grok.mjs'), prerequisite]);
   isolated(['node', '/packages/probe.mjs', 'present'], { prerequisite });
   console.log(JSON.stringify({ schema: 'paperclip.grok.public-npm-install.v1', sourceRevision, releaseVersion, lifecycleScriptsEnabled: true, lifecycleSentinelVerified: true, lifecycleNetwork: 'none', consumerImage: GROK_PUBLIC_INSTALL_IMAGE, consumerUid, consumerLockPreserved: true, cleanNpmInstall: true, packageCount: needed.size, builtinLauncherPresent: true, separateGrokPackage: false, npmProvisionedBinary: false, missingPrerequisiteRejected: true, provisionedBinaryVerified: true, commandLeaseVerified: true, providerCalls: 0 }));
+  // Exercise Pi's public CLI and installed server, never a private workspace
+  // package or binary override. Public dependency downloads are explicit and
+  // isolated; the actual admission probe runs without a network or credentials.
+  const piProbe = join(assets, 'pi-public-install-probe.mjs');
+  cpSync(join(repo, 'scripts/pi-public-install-probe.mjs'), piProbe); chmodSync(piProbe, 0o644);
+  const setup = isolated(['node', '/consumer/node_modules/paperclipai/dist/index.js', 'runtime', 'setup', 'pi'], { download: true }).toString();
+  const receipt = JSON.parse(setup.trim());
+  assert.equal(receipt.status, 'installed_verified');
+  assert.equal(receipt.target, 'linux-x64');
+  assert.equal(readFileSync(join(consumer, 'package-lock.json'), 'utf8'), consumerLock, 'Pi setup must preserve the consumer dependency graph');
+  console.log(isolated(['node', '/packages/pi-public-install-probe.mjs', '/consumer/node_modules/@paperclipai/server']).toString().trim());
 } finally {
   rmSync(root, { recursive: true, force: true });
 }