# Tasks: fix pi container repo mount and npm update permissions

- [x] Investigate root cause (manifest target, missing variables, npm prefix)
- [x] Create Alembic data migration to update pi-agent manifest
- [x] Update manifest_compiler.py: {{WORKSPACE_NAME}} substitution, env var, entrypoint runtime var, npm prefix
- [x] Update instance_service.py to pass REPO_NAME/WORKSPACE_NAME
- [x] Remove explicit repo mount from pi-agent manifest; synthesize mount in compile_compose
- [x] Add _get_repository_mount_name() helper to derive workspace name from remote URL
- [x] Switch workspace storage layout to /data/working-copies/{workspace_id}/{repo_name}/
- [x] Update unit tests for workspace/home-directory migration
- [x] Run quality gates for workspace/home-directory migration
- [x] Remove compose-level `user: 0:0` override so entrypoint can drop privileges
- [x] Pass manifest-declared container user to terminal sessions via `docker exec --user`
- [x] Update unit tests for container user/terminal changes
- [x] Stage profile bind mounts per instance so writable sources are owned by the container user
- [x] Composite overlapping profile and Git mounts into one per-instance bind source
- [x] Add regression tests for mount composition, ownership staging, and mount order
- [ ] Run quality gates for container user/terminal changes
- [ ] Commit and push