@chainingintention/pi-web-cn 1.202609.8 → 1.202609.9

package/dist/server/sessions/managementSandbox.js

@@ -31,21 +31,7 @@ export function createManagedSandboxEnvironment(options) {
 }
 export function createBubblewrapPythonInvocation(options) {
     const args = [
-        "--unshare-net",
-        "--unshare-ipc",
-        "--unshare-pid",
-        "--die-with-parent",
-        "--clearenv",
-        ...Object.entries(options.env ?? {}).flatMap(([key, value]) => ["--setenv", key, value ?? ""]),
-        "--tmpfs",
-        "/tmp",
-        "--dir",
-        SANDBOX_HOME,
-        "--proc",
-        "/proc",
-        "--dev",
-        "/dev",
-        ...[...new Set(options.readOnlyPaths ?? DEFAULT_BUBBLEWRAP_PATHS)].flatMap((path) => ["--ro-bind-try", path, path]),
+        ...bubblewrapBaseArgs(options.env, options.readOnlyPaths, options.network),
         "--bind",
         options.workspaceRoot,
         MANAGED_SANDBOX_WORKSPACE,
@@ -58,11 +44,14 @@ export function createBubblewrapPythonInvocation(options) {
     return { command: options.bubblewrapExecutable, args };
 }
 export function createBubblewrapShellInvocation(options) {
+    const hostFilesystem = options.hostFilesystem === true;
     const args = [
-        ...bubblewrapBaseArgs(options.env, options.readOnlyPaths),
+        ...bubblewrapBaseArgs(options.env, hostFilesystem ? [] : options.readOnlyPaths, options.network),
+        ...(hostFilesystem ? ["--ro-bind-try", "/", "/"] : []),
         "--bind",
         options.workspaceRoot,
         MANAGED_SANDBOX_WORKSPACE,
+        ...(hostFilesystem ? ["--bind", options.workspaceRoot, options.workspaceRoot] : []),
         "--chdir",
         MANAGED_SANDBOX_WORKSPACE,
         options.shellExecutable,
@@ -71,9 +60,9 @@ export function createBubblewrapShellInvocation(options) {
     ];
     return { command: options.bubblewrapExecutable, args };
 }
-function bubblewrapBaseArgs(env, readOnlyPaths) {
+function bubblewrapBaseArgs(env, readOnlyPaths, network = false) {
     return [
-        "--unshare-net",
+        ...(network ? [] : ["--unshare-net"]),
         "--unshare-ipc",
         "--unshare-pid",
         "--die-with-parent",

package/dist/server/sessions/managementSandbox.js.map

@@ -1 +1 @@
-{"version":3,"file":"managementSandbox.js","sourceRoot":"","sources":["../../../src/server/sessions/managementSandbox.ts"],"names":[],"mappings":"AAEA,MAAM,YAAY,GAAG,8BAA8B,CAAC;AACpD,MAAM,kBAAkB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAU,CAAC;AAC3E,MAAM,sBAAsB,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,SAAS,CAAU,CAAC;AAClG,MAAM,CAAC,MAAM,yBAAyB,GAAG,YAAY,CAAC;AACtD,MAAM,YAAY,GAAG,kBAAkB,CAAC;AAExC,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,MAAM;IACN,MAAM;IACN,MAAM;IACN,QAAQ;IACR,mBAAmB;IACnB,kBAAkB;IAClB,UAAU;IACV,sBAAsB;CACd,CAAC;AAkCX,MAAM,UAAU,+BAA+B,CAAC,OAAyC;IACvF,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,kBAAkB,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC5D,CAAC;IACD,GAAG,CAAC,MAAM,CAAC,KAAK,YAAY,CAAC;IAE7B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9E,+BAA+B,CAAC,GAAG,CAAC,CAAC;QACrC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IAED,GAAG,CAAC,MAAM,CAAC,GAAG,YAAY,CAAC;IAC3B,GAAG,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC;IACvB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,OAA0C;IACzF,MAAM,IAAI,GAAG;QACX,eAAe;QACf,eAAe;QACf,eAAe;QACf,mBAAmB;QACnB,YAAY;QACZ,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC9F,SAAS;QACT,MAAM;QACN,OAAO;QACP,YAAY;QACZ,QAAQ;QACR,OAAO;QACP,OAAO;QACP,MAAM;QACN,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,wBAAwB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACnH,QAAQ;QACR,OAAO,CAAC,aAAa;QACrB,yBAAyB;QACzB,SAAS;QACT,yBAAyB;QACzB,OAAO,CAAC,gBAAgB;QACxB,IAAI;QACJ,GAAG;KACJ,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,oBAAoB,EAAE,IAAI,EAAE,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,OAAyC;IACvF,MAAM,IAAI,GAAG;QACX,GAAG,kBAAkB,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,aAAa,CAAC;QACzD,QAAQ;QACR,OAAO,CAAC,aAAa;QACrB,yBAAyB;QACzB,SAAS;QACT,yBAAyB;QACzB,OAAO,CAAC,eAAe;QACvB,KAAK;QACL,OAAO,CAAC,MAAM;KACf,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,oBAAoB,EAAE,IAAI,EAAE,CAAC;AACzD,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAkC,EAAE,aAA4C;IAC1G,OAAO;QACL,eAAe;QACf,eAAe;QACf,eAAe;QACf,mBAAmB;QACnB,YAAY;QACZ,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QACtF,SAAS;QACT,MAAM;QACN,OAAO;QACP,YAAY;QACZ,QAAQ;QACR,OAAO;QACP,OAAO;QACP,MAAM;QACN,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,aAAa,IAAI,wBAAwB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;KAC5G,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,MAAc;IACxD,IAAI,MAAM,CAAC,QAAQ,CAAC,uCAAuC,CAAC;QAAE,OAAO,uCAAuC,CAAC;IAC7G,IAAI,MAAM,CAAC,QAAQ,CAAC,6CAA6C,CAAC;QAAE,OAAO,6CAA6C,CAAC;IACzH,IAAI,MAAM,CAAC,QAAQ,CAAC,0CAA0C,CAAC;QAAE,OAAO,0CAA0C,CAAC;IACnH,IAAI,MAAM,CAAC,QAAQ,CAAC,+BAA+B,CAAC;QAAE,OAAO,+BAA+B,CAAC;IAC7F,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,kCAAkC,CAAC,IAAY;IAC7D,OAAO;;;;;;;iBAOQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqEpC,CAAC;AACF,CAAC;AAED,SAAS,+BAA+B,CAAC,GAAW;IAClD,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAChC,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,0DAA0D,GAAG,EAAE,CAAC,CAAC;IACnF,CAAC;AACH,CAAC"}
+{"version":3,"file":"managementSandbox.js","sourceRoot":"","sources":["../../../src/server/sessions/managementSandbox.ts"],"names":[],"mappings":"AAEA,MAAM,YAAY,GAAG,8BAA8B,CAAC;AACpD,MAAM,kBAAkB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAU,CAAC;AAC3E,MAAM,sBAAsB,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,SAAS,CAAU,CAAC;AAClG,MAAM,CAAC,MAAM,yBAAyB,GAAG,YAAY,CAAC;AACtD,MAAM,YAAY,GAAG,kBAAkB,CAAC;AAExC,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,MAAM;IACN,MAAM;IACN,MAAM;IACN,QAAQ;IACR,mBAAmB;IACnB,kBAAkB;IAClB,UAAU;IACV,sBAAsB;CACd,CAAC;AAsCX,MAAM,UAAU,+BAA+B,CAAC,OAAyC;IACvF,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,kBAAkB,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC5D,CAAC;IACD,GAAG,CAAC,MAAM,CAAC,KAAK,YAAY,CAAC;IAE7B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9E,+BAA+B,CAAC,GAAG,CAAC,CAAC;QACrC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IAED,GAAG,CAAC,MAAM,CAAC,GAAG,YAAY,CAAC;IAC3B,GAAG,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC;IACvB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,OAA0C;IACzF,MAAM,IAAI,GAAG;QACX,GAAG,kBAAkB,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC;QAC1E,QAAQ;QACR,OAAO,CAAC,aAAa;QACrB,yBAAyB;QACzB,SAAS;QACT,yBAAyB;QACzB,OAAO,CAAC,gBAAgB;QACxB,IAAI;QACJ,GAAG;KACJ,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,oBAAoB,EAAE,IAAI,EAAE,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,OAAyC;IACvF,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,KAAK,IAAI,CAAC;IACvD,MAAM,IAAI,GAAG;QACX,GAAG,kBAAkB,CAAC,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC;QAChG,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,QAAQ;QACR,OAAO,CAAC,aAAa;QACrB,yBAAyB;QACzB,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,SAAS;QACT,yBAAyB;QACzB,OAAO,CAAC,eAAe;QACvB,KAAK;QACL,OAAO,CAAC,MAAM;KACf,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,oBAAoB,EAAE,IAAI,EAAE,CAAC;AACzD,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAkC,EAAE,aAA4C,EAAE,OAAO,GAAG,KAAK;IAC3H,OAAO;QACL,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;QACrC,eAAe;QACf,eAAe;QACf,mBAAmB;QACnB,YAAY;QACZ,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QACtF,SAAS;QACT,MAAM;QACN,OAAO;QACP,YAAY;QACZ,QAAQ;QACR,OAAO;QACP,OAAO;QACP,MAAM;QACN,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,aAAa,IAAI,wBAAwB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;KAC5G,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,MAAc;IACxD,IAAI,MAAM,CAAC,QAAQ,CAAC,uCAAuC,CAAC;QAAE,OAAO,uCAAuC,CAAC;IAC7G,IAAI,MAAM,CAAC,QAAQ,CAAC,6CAA6C,CAAC;QAAE,OAAO,6CAA6C,CAAC;IACzH,IAAI,MAAM,CAAC,QAAQ,CAAC,0CAA0C,CAAC;QAAE,OAAO,0CAA0C,CAAC;IACnH,IAAI,MAAM,CAAC,QAAQ,CAAC,+BAA+B,CAAC;QAAE,OAAO,+BAA+B,CAAC;IAC7F,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,kCAAkC,CAAC,IAAY;IAC7D,OAAO;;;;;;;iBAOQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqEpC,CAAC;AACF,CAAC;AAED,SAAS,+BAA+B,CAAC,GAAW;IAClD,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAChC,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,0DAA0D,GAAG,EAAE,CAAC,CAAC;IACnF,CAAC;AACH,CAAC"}

package/dist/server/sessions/piSessionService.js

@@ -24,6 +24,7 @@ import { createLocalOnlyModelRuntime } from "./authService.js";
 import { canonicalizeStoredCwd, cwdPathsEqual } from "../workingDirectory.js";
 import { clearSessionFileParent, readSessionHeaderSummary } from "./sessionFileHeader.js";
 import { workbenchAccessHandle } from "../managementEmbed.js";
+import { managementPrivilegeRequested, managementPrivileges } from "../managementPrivileges.js";
 import { DEFAULT_EXTENSION_DIALOGS_TIMEOUT_MS, piWebDataDir } from "../../config.js";
 import { createScopedSettingsManager, resolveSettingsScopeDirectory } from "./projectSettingsScope.js";
 import { createAskUserToolDefinition } from "./askUserTool.js";
@@ -34,8 +35,8 @@ import { createSpawnSessionToolDefinition } from "./spawnSessionTool.js";
 import { createSubsessionToolDefinitions } from "./spawnSubsessionTool.js";
 import { buildTranscriptView } from "./subsessionTranscript.js";
 import { planSessionCleanup, summarizeSessionCleanupExecution } from "./sessionCleanup.js";
-import { createManagedAgentToolOptions, createManagedPythonToolDefinition } from "./managementAgentTools.js";
-import { PI_PERMISSION_SYSTEM_POLICY_AGENT_DIR, managementAgentToolNames, withRuntimeCreationEnvironment, writeManagementPermissionSystemPolicy } from "./managementPermissionSystem.js";
+import { createManagedAgentToolOptions, createManagedBashToolDefinition, createManagedPythonToolDefinition } from "./managementAgentTools.js";
+import { PI_PERMISSION_SYSTEM_POLICY_AGENT_DIR, managementAgentToolNames, privilegedManagementToolNames, withRuntimeCreationEnvironment, writeManagementPermissionSystemPolicy } from "./managementPermissionSystem.js";
 import { SessionNotificationStore } from "./sessionNotificationStore.js";
 import { plainTextTheme } from "./plainTextTheme.js";
 import { deduplicateBundledRelaySkills, ensureManagedRelaySkills, MANAGED_RELAY_SKILL_NAMES } from "./relaySkill.js";
@@ -370,11 +371,11 @@ export function piWebResourceLoaderOptions(appendSystemPromptSections) {
         return undefined;
     return { appendSystemPromptOverride: (base) => [...base, ...appendSystemPromptSections] };
 }
-function createDefaultRuntimeFactory(normalModelRuntimeForCwd, managementModelRuntime, resolveSettingsScope, spawn, subsessions, askUser, workbench, logger = noopLogger, managementAudit, managementProjectIdForCwd, appendSystemPromptSections = []) {
+function createDefaultRuntimeFactory(normalModelRuntimeForCwd, managementModelRuntime, resolveSettingsScope, spawn, subsessions, askUser, workbench, logger = noopLogger, managementAudit, managementProjectIdForCwd, appendSystemPromptSections = [], managementAllowPrivileged = false) {
     return async ({ cwd, agentDir, sessionManager, sessionStartEvent, managementContext, initialModel, initialThinkingLevel, delegationToolsEnabled = true }) => {
         const scopedModelRuntime = managementContext === undefined ? await normalModelRuntimeForCwd(cwd) : await managementModelRuntime();
         if (managementContext !== undefined) {
-            return createManagementRuntimeFactory(scopedModelRuntime, resolveSettingsScope, spawn, subsessions, askUser, managementContext, workbench, logger, managementAudit, managementProjectIdForCwd)({
+            return createManagementRuntimeFactory(scopedModelRuntime, resolveSettingsScope, spawn, subsessions, askUser, managementContext, workbench, logger, managementAudit, managementProjectIdForCwd, managementAllowPrivileged)({
                 cwd,
                 agentDir,
                 sessionManager,
@@ -421,7 +422,7 @@ function createDefaultRuntimeFactory(normalModelRuntimeForCwd, managementModelRu
         return { ...result, services, diagnostics: services.diagnostics };
     };
 }
-function createManagementRuntimeFactory(modelRuntime, resolveSettingsScope, spawn, subsessions, askUser, managementContext, workbench, logger, managementAudit, managementProjectIdForCwd) {
+function createManagementRuntimeFactory(modelRuntime, resolveSettingsScope, spawn, subsessions, askUser, managementContext, workbench, logger, managementAudit, managementProjectIdForCwd, managementAllowPrivileged = false) {
     return async ({ cwd, agentDir, sessionManager, sessionStartEvent, initialModel, initialThinkingLevel, delegationToolsEnabled = true }) => {
         await ensureManagedRelaySkills(cwd);
         const auditIdentity = await resolveManagementAuditIdentity(cwd, managementContext, managementProjectIdForCwd, logger);
@@ -463,7 +464,16 @@ function createManagementRuntimeFactory(modelRuntime, resolveSettingsScope, spaw
             ...workbenchTools,
         ];
         const controlledManagementToolNames = controlledManagementTools.map((tool) => tool.name);
-        const policyAgentDir = await writeManagementPermissionSystemPolicy(agentDir, cwd, managementContext, controlledManagementToolNames);
+        const privileges = managementPrivileges(managementContext, { allowPrivileged: managementAllowPrivileged });
+        if (!managementAllowPrivileged && managementPrivilegeRequested(managementContext)) {
+            logger.info({
+                userId: managementContext.user.id,
+                requestedBash: managementContext.privileged?.bash === true,
+                requestedNetwork: managementContext.privileged?.network === true,
+            }, "management privileged grant ignored because managementEmbed.allowPrivileged is disabled");
+        }
+        const extraToolNames = [...controlledManagementToolNames, ...privilegedManagementToolNames(privileges)];
+        const policyAgentDir = await writeManagementPermissionSystemPolicy(agentDir, cwd, managementContext, extraToolNames, privileges);
         return withRuntimeCreationEnvironment({ [PI_PERMISSION_SYSTEM_POLICY_AGENT_DIR]: policyAgentDir }, async () => {
             const settingsManager = await createScopedSettingsManager({
                 cwd,
@@ -491,7 +501,8 @@ function createManagementRuntimeFactory(modelRuntime, resolveSettingsScope, spaw
             const managedToolOptions = createManagedAgentToolOptions(cwd);
             const customTools = [
                 ...managedAgentToolDefinitions(cwd, managedToolOptions),
-                createManagedPythonToolDefinition(cwd, managementContext),
+                createManagedPythonToolDefinition(cwd, managementContext, { network: privileges.network }),
+                ...(privileges.bash ? [createManagedBashToolDefinition(cwd, managementContext, { network: privileges.network })] : []),
                 ...controlledManagementTools,
             ];
             const options = {
@@ -499,7 +510,7 @@ function createManagementRuntimeFactory(modelRuntime, resolveSettingsScope, spaw
                 sessionManager,
                 ...(sessionStartEvent === undefined ? {} : { sessionStartEvent }),
                 customTools,
-                tools: managementAgentToolNames(managementContext, controlledManagementToolNames),
+                tools: managementAgentToolNames(managementContext, extraToolNames, privileges),
                 ...(modelOptions.model === undefined ? {} : { model: modelOptions.model }),
                 ...(modelOptions.thinkingLevel === undefined ? {} : { thinkingLevel: modelOptions.thinkingLevel }),
                 ...(modelOptions.scopedModels.length === 0 ? {} : { scopedModels: modelOptions.scopedModels }),
@@ -647,7 +658,7 @@ export class PiSessionService {
             list: (parentSessionId, parentSessionFile) => this.listSubsessions(parentSessionId, parentSessionFile),
             check: (parentSessionId, sessionId, parentSessionFile) => this.checkSubsession(parentSessionId, sessionId, parentSessionFile),
             read: (parentSessionId, sessionId, query, parentSessionFile) => this.readSubsession(parentSessionId, sessionId, query, parentSessionFile),
-        }, deps.askUserEnabled === true ? { open: (input) => this.openAsk(input) } : undefined, deps.workbench, this.logger, this.managementAudit, this.managementProjectIdForCwd, deps.appendSystemPromptSections ?? []);
+        }, deps.askUserEnabled === true ? { open: (input) => this.openAsk(input) } : undefined, deps.workbench, this.logger, this.managementAudit, this.managementProjectIdForCwd, deps.appendSystemPromptSections ?? [], deps.managementAllowPrivileged === true);
         this.createAgentRuntime = deps.createAgentRuntime ?? defaultCreateAgentRuntime;
         this.workspaceActivity = deps.workspaceActivity;
         this.heartbeat = setInterval(() => { this.publishHeartbeats(); }, deps.heartbeatIntervalMs ?? 2000);