feat(tui): offer only the permission modes the agent honours (plan 1.P3 (a), plan r10) - #12

…ates (plan r9) (#10)

## Summary

**Stacked on #9** (base `codex/linux-wsl-r8`). It adds sixteen commits on top of `d84d98a`: the three phase 0 gates of `docs/PLAN/PLAN-RUST-AGENT-RUNTIME-REMOVAL.md` that were still open after r8 (0.3 on the Rust side, 0.7, 0.8), and the parts of phase 1 that need no decision. Section 10.11 and appendix A of the plan have the full record.

**No behaviour-changing decision is made here.** Where a decision is needed (the permission-mode mapping, the `--session-id` contract, what happens to `zypi export`, ...) the plan writes a proposal and says what it would cost. Section 10.11 ends with twelve of them, each with my preference; none is implemented.

What the branch does:

- **0.3, e2e against the real agent.** `python_agent_e2e.rs`: 10 tests drive the pager's ACP client against the real Python agent, and `tui-ci.yml` installs the agent first and sets `PI_E2E_REQUIRED=1` so a missing Python fails instead of passing silently. Its first run found two product bugs, both fixed here: the reason an agent failed to start was swallowed into `channel closed`, and `connect()` hung when the agent exited at once.
- **0.7, can the pager lose its own disk reads (ADR1)?** Measured: with 1,000 sessions on Windows the first page of `session/list` went from 2.0 s to 0.11 s and `session/load` from 2.0 s to 0.12 s (a header is read without reading the file, and the repo lists a page at a time). ADR1's override condition did not trigger. The plan inventories the pager's 13 disk-read call sites in 8 files, adds a 13-case PTY matrix of the resume flags (`scripts/tui_pty/resume_matrix.py`: 9 PASS / 4 GAP, the GAPs are the work ADR1 would do) and a landing design with the sandbox ordering problem and a PR slicing.
- **0.8, capability matrix and ACP version pairing** (appendix A): every row marked decided / proposed / open, the upgrade rules, and a per-method table of what each end supports.
- **1.P1:** `session/list` is paged with an opaque cursor, the pager's picker follows `nextCursor`, and a session is looked up by id without reading every file.
- **1.P4:** the pager sends no `mcp_servers`; the agent says which ones a client passed and that it ignored them.
- **1.P7:** the permission round trip and `session/cancel` are covered over real stdio.
- **Agent exits on its own:** the pager says so and why, instead of a bare `channel closed`.
- **1.P3 input, not a change:** `scripts/tui_pty/mode_probe.py` records which permission modes the Python agent honours (12 scenarios on WSL2). Plan mode restricts nothing, Auto is always-approve in the agent, the settings "Default" is dropped, and of the six `--permission-mode` values only `bypassPermissions` does anything.

## Decisions that were open

Plan section 10.11, last list. The three that unblock the most, and what became of them:

1. Start ADR1 with PR 1: the Python side only (`_meta.sessionId` honoured by `session/new`, the session's cwd in the `session/load` response). No TUI change, least risk. **Done in #11.**
2. 1.P3: hide Plan, Auto and Default (Shift+Tab becomes Normal <-> Always-Approve) and accept only the `--permission-mode` values that do something. Today Plan gives users a false sense of safety. **Done in #12.**
3. The sandbox ordering (the first of the plan's three options): drop "restore the sandbox profile a session saved", which never applies to a Python session. **Still open.**

## Not verified

- The Rust e2e tests and the PTY scripts ran on Linux (WSL2) only; the latency numbers on Windows measure the Python side only. Cold disk, network file systems and more than 1,000 sessions were not measured.
- Cross-directory `--resume <id>` (which directory the TUI uses for `@` search, diffs and git info), the settings "Default" path under a pty, and the `-m` / `--model` flag.
- The landing design is on paper; everything uses the mock LLM.

## Review guide

| Commit | What |
|---|---|
| `28fed94` | 1.P7: permission round trip and cancel over real stdio |
| `54a38fe`, `1b9fb47` | harness: read a header without the file; list a page at a time; find by id |
| `e944ed5` | `scripts/session_list_bench.py` |
| `c1f02c8`, `9f7bc35` | 1.P1: Python pages `session/list`; the pager follows `nextCursor` |
| `935e4b8`, `7becb49`, `9798e1d` | 1.P4: the agent names the ignored MCP servers; the pager sends none; docs |
| `affda9e` | the pager notices an agent that exits, and says why a start failed |
| `3fc182b` | 0.3: `python_agent_e2e.rs`, `tui-ci.yml`, manifest |
| `babd75f` | 0.7: `resume_matrix.py` |
| `bee3a36` | manifest: `pi-pager` `reference_passed` 5,602 |
| `679cccb`, `d426253` | 1.P3 input: `mode_probe.py` |
| `eef675b` | docs: plan 10.11, appendix A, B.4, `docs/baselines/tui.md`, CHANGELOG, AGENTS files |

#9 was squash-merged first and this PR's base then moved to `main`. The PR still lists #9's commits, and GitHub could not merge it because files that both sides changed near each other conflict. `b0d001b` merges `main` into the branch with the `ours` strategy: the tree of `main` is the tree of #9's last commit, the base of this branch, so `main` holds nothing the branch lacks, and the branch's tree is unchanged.

## Verification

- **CI.** The run on `eef675b` is green (TUI CI [run 38061734062](https://github.com/zy1233/pi-python/actions/runs/38061734062)). The new install step in `tui-ci.yml` ran for the first time, `python_agent_e2e`'s 10 tests really ran (a missing Python would fail them), and the 10 suites add up to **8,659 passed / 0 failed / 22 ignored** with `pi-pager` at 5,602: the numbers measured locally. `cargo test` took 23 m 19 s (32 m 40 s on #9), `Gates + cargo check` 7 m 9 s, Ruff 9 s, pytest on 3.11 / 3.12 / 3.13 about 2 minutes each. `tui-ci.yml` now also runs when `pi_agent_cli/**` changes. After #9 was squash-merged, `main` was merged into this branch (`b0d001b`, keeping the branch's tree, which is the tree of `eef675b`) and CI ran again: green too ([run 38074449935](https://github.com/zy1233/pi-python/actions/runs/38074449935); `cargo test` 21 m 48 s, 8,659 passed again).
- Whole manifest on WSL2 (`python scripts/tui_baseline.py test`, scrubbed environment, `PI_E2E_PYTHON` and `PI_E2E_REQUIRED=1`): exit 0, 10 suites, **8,659 passed, 0 failed, 22 ignored** = #9's CI result (8,634) + 25 new `pi-pager` tests (10 e2e, 8 agent-exit, 6 paging, 1 for `mcp_servers`). `pi-pager`: 5,602.
- pytest: 2,352 passed / 35 skipped on Linux (WSL2, Python 3.12.3), 2,351 passed / 36 skipped on Windows (Python 3.12.7); `scripts/tests/test_tui_pty.py` with `pyte`: 19 passed.
- `ruff check .` and `ruff format --check .`: clean (226 files) with the project's Ruff 0.16.10 and with CI's pinned 0.16.0.
- `resume_matrix.py`: 9 PASS / 4 GAP / 0 FAIL. `mode_probe.py`: 12 scenarios.

…L2 (plan r12, part 3)

#15, #17 and #14 are squash-merged (59545c1, d57fd9b, 0efd400). The plan and the
execution log say so, and main is now 0efd400 in the current-state text.

WSL2 works again. On 0efd400: Linux pytest 2,539 passed / 16 skipped / 31
deselected; `zypi --version` prints `zypi 0.5.0 (0efd400)` (a debug build
on ext4, not the CI release-dist artifact); the PTY scripts pass, except one
check of smoke.py, which is out of date since #12 (22/23). Section 10.15 gets a
part 3 with these results and the leftovers; the "not verified" lines that said
"WSL does not start" are brought up to date.

Only documents change.

…(plan r12) (#16)

## Summary

This PR records the V0.5 release in the plan: what the release is, what must be true before the tag, and what is known to be wrong. It is revision r12 of the plan for the removal of the Rust agent runtime. Only documents change.

The milestone is on GitHub: [v0.5.0](https://github.com/zy1233/pi-python/milestone/1). Nothing is attached to it, because the conditions are written in one place (the plan).

The three PRs that do the work of the conditions are merged before this one: #15 (`59545c1`), #17 (`d57fd9b`) and #14 (`0efd400`), in that order, each as one squash commit. This branch is rebased onto `0efd400`.

- `docs/PLAN/PLAN-RUST-AGENT-RUNTIME-REMOVAL.md`: a new section "发布里程碑 V0.5" (what the release is, six exit conditions, known issues, what is not in it). The status, the next steps and the "not verified" list start from `main` at `0efd400`. Decision 16 is new, and #17 did it.
- `docs/PLAN/archive/PLAN-RUST-AGENT-RUNTIME-REMOVAL-EXECUTION-LOG.md`: section 10.15, with the reasons, the figures, the follow-up work, your three answers (part "续 2"), and the merges and the WSL2 checks (part "续 3").
- `docs/baselines/tui.md`: the numbers of the new release measurement.

## The six exit conditions

| # | Condition | State |
|---|---|---|
| 1 | CI is green on the commit that gets the tag | Green: `CI` on `0efd400`, `TUI CI` on `d57fd9b` (`0efd400` differs from it only in `release.yml`). Look again on the commit that gets the tag. |
| 2 | The Linux release binary is not larger than v0.4.0 | **Done.** 420,767,096 B (v0.4.0: 470,461,776 B, 10.6 % smaller). Run [38221952524](https://github.com/zy1233/pi-python/actions/runs/38221952524). |
| 3 | A dry run of the release build on Linux and macOS arm64 | **Done.** Run [38223353755](https://github.com/zy1233/pi-python/actions/runs/38223353755) built both and published nothing (27 min). The manual trigger is in #14, merged. |
| 4 | The PTY scripts on the v0.4.0 binary and on the new binary | **Skipped by you.** V0.5 does not wait for it. Which known issues come from v0.4.0 stays a guess. |
| 5 | The release notes | **Done** in #15, merged. They list the macOS binary and say that CI built it and nobody has started it. #17 added one entry and removed one known issue. |
| 6 | The tag `v0.5.0` | Yours. |

## After the merges, with WSL2 working again

You fixed WSL. These runs are on `0efd400` (details: section 10.15, part "续 3").

- Linux `pytest`: 2,539 passed / 16 skipped / 31 deselected.
- `zypi --version` prints `zypi 0.5.0 (0efd400)`, exit 0. That is a debug build on ext4. It is not the `release-dist` file that CI builds.
- `agentInfo.version` is `0.5.0` in a venv installed from the merged tree. An older editable install keeps the version it had when it was installed (the old `/tmp/wsl-venv`: 0.2.0).
- PTY scripts: `exit_matrix.py` 12/12, `print_exit.py` 4/4, `resume_matrix.py` 10 PASS / 3 GAP (the known gaps), `mode_probe.py` as in #12, `status_line_probe.py` 4/4, `net_audit.py --mock` 13/13 and with `--no-network` 13/13.
- **`smoke.py` is 22/23.** The failing check, "status line follows the switch", waits for the text `Second model` followed by a `·`. The screen shows the right label, `Second model`, the session file has the `model_change`, and the next turn answers. The check is out of date since #12. My inference, not tested on an old build: the `·` came from the `auto` flag, which #12 no longer shows in the normal mode. It is a script problem, not a TUI problem. It is not fixed here. The fix is one regular expression.

## Decisions for you

- The plan decisions 6, 8, 14 and 15 should be made before the tag. If they are not, they go in the release as known issues.
- The date of `[0.5.0]` in the changelog is 2026-10-12. Change it on the day of the tag. The known issues become public release text.

## Not verified

- Nobody ran the `release-dist` binary that CI builds; only a debug build of `main` ran. Nobody ran the macOS binary. The changelog, the README and the TUI guide say so.
- The two changed `if` lines of `release.yml` have run only on their false side. A tag push runs the true side.
- This round did not run the Landlock layer (kernel 5.10 has none), `smoke.py --sandbox`, or the whole Rust test manifest on WSL2. CI ran the manifest on `d57fd9b`: 8,665 passed / 0 failed / 22 ignored.
- The plan says that the version overrides of `pi-config` could stop working for a user config that needs a version above `0.5.0`. I found no default config that does, and I cannot see user configs.

## Verification

- Link check of the plan and of the execution log: plan 149 local and 81 external links, 47 reference definitions; log 43 local and 58 external links; 0 unused, 0 problems.
- `ruff check .` and `ruff format --check .`: clean (nothing in Python changes).
- The test counts, run ids and times come from the job logs (`gh run view`) and from the output of the runs on WSL2.
- The three merges used `--match-head-commit`. #15 and #17 merged with the tree that CI had tested (#17 was rebased onto `main` after #15, and `git diff` against its tested tip was empty). #14 merged onto a newer `main`, so `CI` ran again on the result, `0efd400`, and passed.

The check "status line follows the switch" waited for `Second model\s+·`. The dot
came from the `auto` flag. Since #12 the normal mode shows no flag, so the label is
`Second model` and the check failed (22/23) on a TUI that works.

The check now waits for the name on the border of the input box, with or without a
flag after it: `Second model(?: · [^─╯]*)? ─╯`. The picker row has nothing after
the name, so it cannot match. The example in the docstring of status_line() is
updated.

Checked on WSL2 with a debug build of main (b23e14e): smoke.py 23/23 and
`--sandbox workspace` 26/26. Before the change, the same build gave 22/23. The
pattern was also checked offline against the saved screens of the failing run.

The execution log (section 10.15, part 4) and the revision log of the plan say so.
They also record the update of the v0.5.0 milestone text.