Release v1.6.0

[porcelaincode]

Each commit is scoped to one change. Full gate passes on the tip: typecheck + lint clean, 958 tests, 0 failures (bun test, the command CI runs).

What's in it

Commit	Change
96b8116	style: fix lint findings (useConst, formatting) surfaced by the sync commit
6303f42	Cross-device session sync, sharing hardening, and mid-turn steering
472ae32	feat(cowork): add the cowork surface, tool allowlists, and capability control protocol
492cd45	feat(engine): allow reconnecting MCP and re-scanning skills between turns
b0e62b9	feat(threads): emit todo_update and persist task lists and surface on the thread
c0bdd84	feat(subagents): stream Task progress, cap concurrency, and forbid nesting
bc12886	feat(mcp): OAuth for remote servers, per-server status, disabled flag
4bcdd8f	feat(permissions): bare mcp__<server> rules cover a whole server
89b2bac	feat(skills): bundled office skills + when: glob auto-activation
89d18e5	feat(plugins): installable plugin system for commands, agents, skills, MCP
6d5e8d6	chore(models): drop deprecated sarvam-30b, regenerate the catalog

Landed since that table was written:

Commit	Change
94ebc3b	fix(test): reset the memoized auth cache in autoTurn's classifier stub (CI fix, part 2 — see below)
37e4c62	fix(test): stop autoTurn's classifier mock leaking into the classify suites (CI fix, part 1 — see below)
584ca33	feat(siblings): let pier sessions on one machine discover and message each other
8c4adf3	feat(memory): reasoning bank — distilled strategy lessons across sessions
79cf9c7	fix(test): wait for the bg shell to reach completed instead of racing it
85c2bed	fix(test): reset the memoized thread-sync latch in the discovery test
2ea24fc	fix(test): stop outputFormat's models mock leaking into every later test
70027cc	fix(auto): share repeat detection, fix the Auto-mode block escape hatch
f862f0b	style: biome-format the repeat-detection changes

Notes for review

Cross-device sync (6303f42) is the big new piece since the last description update. Thread sync becomes a real two-way mirror instead of local-wins:

• Guarded pushes with an expected_count cursor so two devices can't interleave history (bridge 409s → reconcile by item-id prefix).
• reconcileThread merges local vs server history: remote-extension adopts server, local-extension keeps local, divergence keeps the longer side and preserves the loser as a conflict copy.
• Outbox: failed pushes stamp pendingPush, retried at boot.
• Per-thread /sync off opt-out; /share, /unshare, /sessions un-gated.

Session sharing gets a reconnect supervisor + takeover: HostShare.rebind re-announces and re-offers outstanding approvals on a transport drop, UUID request ids, /unshare vs transport-drop split. Repl gets a reconnect loop with backoff; serve --share auto-mirrors via a TeeIO; work_diff streams to remote Changes panels.

New controls/commands: serve-protocol rewind (truncate history + durable bridge copy), pier adopt <id> (cloud→laptop handoff), pier devices, set_model / end_session host controls.

Mid-turn steering: queued messages are handed to the running turn at the next tool-loop boundary (steering_injected retires the chip by text), instead of waiting for the whole turn to resolve.

sarvam-30b is gone upstream. It was Sarvam's only cheap tier, so a few assumptions had to move: the BYOK shortlist and validation probe, cheapCompletion (Sarvam BYOK now pays full freight for throwaway completions — callers already swallow failures to ''), and the fallback map, which now points sarvam-105b at pier-hybrid so a Sarvam-side outage lands on a different upstream rather than a dead sibling. compact.test no longer depends on sarvam-30b's auto_compact_token_limit (no catalog model sets one now) and exercises the context_window * 0.9 fallback instead.

The empty tool allowlist is load-bearing. tools: [] means no tools (the desktop's folderless chat mode); omitting the field means the full set for the mode. serve uses ??, never ||, so [] survives. test/chatModeAllowlist.test.ts pins both that and the fact that every chat-allowlisted tool still resolves, so a registry rename can't silently empty chat mode's toolset.

MCP prefix rules match on the rule, not by splitting the tool name. Server names may contain underscores, so mcp__gmail must not shadow mcp__gmail_backup__send — covered by test.

reloadCapabilities() is only safe between turns. Dynamic tools are process-global under the one-session-per-process invariant; the serve handlers reject with busy while a turn is running.

All new control subtypes are additive and feature-detected via InitializeResponse.capabilities. Older servers answer unsupported subtype, which clients read as absence. CLIENT_SUBTYPES is kept in lockstep with the schema and asserted by a parity test.

CI fix (37e4c62, 94ebc3b)

CI was red on 7 tests — 6 in autoClassify.test.ts, 1 in localClassify.test.ts — while the same commit passed locally.

Root cause. bun test runs all 129 files in ONE process and mock.module is process-global with no unwind. autoTurn.test.ts (file #11 in CI order) mocked ../src/safety/autoClassify.js to swap the classifier verdict per test, which replaced the real module for every file after it. classifyAction became async () => verdict, returning whatever the last autoTurn test left behind — block / "network command". Every downstream test that calls the real classifyAction got that canned block and never reached its own fetch stub, which is why the transcript assertions saw a null lastBody. Tests calling classifyActionLocal directly kept passing, which localised the leak to the mocked module.

Why CI only. The leak depends on whether a victim file resolves its autoClassify import before or after file #11 installs the mock. A static top-level import can win that race; a dynamic await import() inside a test body never does. Confirmed directly rather than by inference: with the mock in place, classifyAction.toString() in a later file is "async classifyAction() { return verdict; }"; with the fix it is the real implementation.

Fix. The mock was never needed. classifyAction reaches the network only through globalThis.fetch, and the session model there is sarvam-105b (a pier model, not BYOK), so stubbing fetch drives the real function down the bridge path — the technique autoClassify.test.ts already uses. An afterAll restores fetch and the two env vars, so the file leaks nothing itself. Same class of bug, and same remedy, as 2ea24fc.

Part 2 (94ebc3b) — the follow-on failure. Removing the mock fixed the 7 downstream tests but broke the two verdict tests in autoTurn.test.ts itself, again only on CI. loadAuth() memoizes into a module-level cache; this file writes a pier_auth.json into a temp PIER_HOME at module scope, but ten files run before it in CI order and any of them that resolves auth first caches null from its own empty home. requireToken() then throws on that stale null, classifyAction fail-safes to prompt, and both tests saw the user being prompted instead of the classifier deciding. resetAuthCache() after setting PIER_HOME fixes it — the same thing autoClassify.test.ts already does — with a second reset in afterAll so the temp home's token does not linger.

Verification. Both fixes were checked in a linux/amd64 oven/bun:1.3.13 container — CI's platform and Bun version — not just on macOS, since every failure in this pair was ordering- and platform-dependent and passed locally throughout: 956 pass, 2 skip, 0 fail, tsc clean. Both CI checks on the PR are green.

Reasoning bank (8c4adf3)

An opt-in memory of generalized strategy lessons ("when the suite hangs, check the stack-size env first"), distinct from CLAUDE.md/AGENTS.md project memory, which holds codebase facts and stays always-on. Off by default behind the reasoningBank config key while the retrieval loop is validated.

• Lessons are one markdown file each under $PIER_HOME/memory, capped at 50 and evicted by net usefulness (hits - misses) — files stay the source of truth so a user can read and rm a bad lesson by hand.
• The system prompt carries an index (id/title/description), never bodies; the model is the retriever (no embeddings) and pulls a body on demand via MemoryRecall, which doubles as the relevance signal.
• Outcome labelling is local-only — tool errors, a user correction, /undo, test exit — with no LLM judge, and biased to unknown, since a mislabelled lesson is worse than none.
• Distillation is one constrained model call at teardown (max 3 lessons/session) over a compacted transcript; the no-literal-strings rule is enforced in code, because a global bank injects repo-A lessons into repo B.
• Consolidation supersedes near-duplicates and prunes lessons the model keeps declining, so the bank does not depend on the distiller being right every time.
• The main session, exec, and subagents all read the bank but never write to it — only the main session sees the outcome signals that label a lesson. /memory list|show|forget|clear manages it; bare /memory keeps its AGENTS.md meaning.

Sibling sessions (584ca33)

ListAgents / SendMessage let pier sessions in different terminals on the same machine discover and message each other — e.g. ask which files a peer owns before working in the same repo.

• Discovery is a PID registry ($PIER_HOME/sessions/<pid>.json), valid because one-session-per-process is already an invariant; stale entries are reaped via process.kill(pid, 0) behind a strict /^\d+\.json$/ filename guard.
• Each session listens on $PIER_HOME/socks/<pid>.sock; a send is one NDJSON line plus a one-line ack — fire-and-forget, no correlation id, and a "reply" is just an independent send back.
• An inbound message enters the conversation at the next safe boundary (steered into a running turn, or a fresh turn when idle). The REPL renders it as an attributed peer cell, skips @-mention resolution so a peer's paths cannot inject local files, and keeps it out of prompt history.
• Identity comes from the thread title, with --name overriding; TodoWrite/UpdatePlan publish the in-progress item as "working on: …". A <sibling-sessions> roster is rebuilt into <env> on every model call.
• ListAgents is read-only; SendMessage is allowlisted for auto-approval — a same-machine send stays inside the machine's trust boundary and keeps message text out of the bridge classifier. Unix sockets only: every entry point no-ops on win32.

Commit splitting

session.ts, turn.ts and store.ts were split at the hunk level so the fallback-map change, skill-hint injection, subagent emit plumbing, and todo_update event each landed separately.

Cowork, the tool allowlist and the capability subtypes stayed in one commit (472ae32) — their changes interleave inside the same hunks (SessionController.create, InitializeRequestSchema, the initialize handler), so separating them would mean intermediate commits referencing opts.tools before it is declared, i.e. commits that don't compile.

Version

Title says v1.6.0, but nothing in the tree encodes it — package.json is the 0.0.0-dev sentinel and versions come from release tags. No version bump is included here; tag after merge.