@piagent/platform 1.1.3 → 1.1.5

package/CHANGELOG.md

@@ -2,6 +2,27 @@
 
 This file records release-facing changes for Pi Agent Platform. Copy the relevant version block into GitHub Releases when publishing a tag.
 
+## v1.1.5 - 2026-07-27
+
+### Added
+
+- `piagent-update` moves a machine from one release to the next in one command. A release is three independently versioned things — the Pi host, the npm-global terminal helper, and the Pi package — and they have to move in that order, because `piagent-install` refuses to run against a host that does not match the version its own package.json pins and does not install one itself. Doing it by hand is three commands and one ordering rule that fails late when it is got wrong.
+
+  Every version the run needs is resolved from the registry before anything is installed, including the host version taken from the *target* helper's published metadata rather than the running one, so `--check` and `--dry-run` describe exactly what a real run would do. After the helper replaces itself the run confirms that the version on disk is the one it asked for, and stops before touching the Pi package if it is not. Running it from a git checkout is refused rather than replacing that checkout's commands with a published build.
+
+  `--check`, `--dry-run`, `--version X.Y.Z`, `--force`, `--project <path>`, `--no-host`, `--no-package`, and pass-through to `piagent-install` after `--`.
+
+### Fixed
+
+- `docs/release-install-policy.md`, `docs/team-onboarding.md` and `docs/command-reference-vietnamese.md` described the manual update sequence without saying why its order is mandatory. `piagent-install` fails on a host mismatch; the auto-install of a matching host lives in `setup.sh` and does not apply to that flow.
+
+## v1.1.4 - 2026-07-27
+
+### Fixed
+
+- A credential passed as a command-line option is recognised as one. `--token=abc123`, `--token abc123`, `--password`, `--api-key`, `--client-secret` and the rest went unrecognised because the assignment patterns require a key that starts with a letter, and `-` is not one. v1.1.3 made the redactor's verdict the gate that decides whether a command may serve as verify evidence, so anything it missed was stored in the clear *and* accepted as proof — the same invariant v1.1.3 was written to enforce, defeated by the syntax most command-line tools actually use. Env-style assignments were the only shape covered.
+- An `Authorization` header is redacted wherever it sits among the arguments. The value ran to the end of the line, so the same credential survived or not depending on how much text happened to follow it: `curl URL -H "Authorization: Token abc123"` left the header value one character under the length bar, while moving the header ahead of the URL swept the URL into the value and pushed it over. The value is now the single whitespace-free token that follows the scheme, and under a known authentication scheme its length is not consulted at all. Prose such as `Authorization: not required for local runs` is still left alone.
+
 ## v1.1.3 - 2026-07-27
 
 Fixes for defects found reviewing v1.1.2 after it shipped, including two introduced by v1.1.2 itself. Every fix was reproduced first.

package/README.md

@@ -283,7 +283,7 @@ This repository intentionally excludes:
 
 ## Maturity
 
-The current package version is read from package metadata and release tags. Personal machines may follow the unpinned package source when accepting ongoing updates; production/team quickstarts and committed project settings should pin an explicit tag such as `v1.1.3` or a reviewed commit.
+The current package version is read from package metadata and release tags. Personal machines may follow the unpinned package source when accepting ongoing updates; production/team quickstarts and committed project settings should pin an explicit tag such as `v1.1.5` or a reviewed commit.
 
 Ready for:
 

package/docs/command-reference-vietnamese.md

@@ -419,10 +419,13 @@ Các lệnh này chạy ngoài Pi.
 | Command | Dùng khi nào |
 |---|---|
 | `npm install -g --ignore-scripts @earendil-works/pi-coding-agent@0.82.0` | Cài Pi CLI tương thích với release hiện tại. |
-| `npm install -g --ignore-scripts @piagent/platform@1.1.3` | Cài terminal helper `piagent-*` từ release tag hiện tại. |
-| `pi install git:github.com/Vt-mmm/piagent@v1.1.3` | Cài pinned release khi cần reproducible team setup. |
+| `npm install -g --ignore-scripts @piagent/platform@1.1.5` | Cài terminal helper `piagent-*` từ release tag hiện tại. |
+| `pi install git:github.com/Vt-mmm/piagent@v1.1.5` | Cài pinned release khi cần reproducible team setup. |
 | `pi install git:github.com/Vt-mmm/piagent` | Cài latest package platform cho máy cá nhân/sandbox. |
-| Cài exact Pi host của release, rồi `npm install -g --ignore-scripts @piagent/platform@X.Y.Z` và `piagent-install --stable` | Full update: đồng bộ host, npm-global helper và Pi package. Mỗi release pin một Pi host chính xác; lấy đúng version của release đang cài trong [release/install policy](release-install-policy.md). |
+| `piagent-update --check` | Báo version hiện tại vs version sẽ lên cho cả ba thành phần; không cài gì. |
+| `piagent-update` | Full update một lệnh: Pi host → npm-global helper → Pi package, đúng thứ tự release yêu cầu. Thêm `--project <path>` để chạy doctor sau. |
+| `piagent-update --version X.Y.Z` | Update tới đúng một release thay vì latest; dùng cho rollout theo lô hoặc rollback. |
+| Cài exact Pi host của release, rồi `npm install -g --ignore-scripts @piagent/platform@X.Y.Z` và `piagent-install --stable` | Sequence thủ công tương đương. Thứ tự bắt buộc: `piagent-install` fail nếu Pi host lệch bản pin và không tự cài host. Version pin của từng release nằm trong [release/install policy](release-install-policy.md). |
 | Cài exact Pi host ghi trong release cũ, rồi helper `vPREVIOUS` và `piagent-install --stable` | Full rollback; đánh giá dependency risk của host cũ trước khi hạ version. |
 | `piagent-install --stable --dry-run` | Preview Pi package matching với helper hiện tại; stable resolve tag → commit SHA. |
 | `piagent-install --stable` | Cài Pi package matching với helper hiện tại bằng resolved commit SHA. |

package/docs/distribution-standard.md

@@ -14,9 +14,9 @@ Repo này phải chạy được cho nhiều project/domain khác nhau. Vì vậ
 
 | Use case | Package source |
 |---|---|
-| Team pinned release | `git:github.com/Vt-mmm/piagent@v1.1.3` |
+| Team pinned release | `git:github.com/Vt-mmm/piagent@v1.1.5` |
 | Personal/sandbox dev | `git:github.com/Vt-mmm/piagent` |
-| Registry distribution | `npm:@piagent/platform@1.1.3` |
+| Registry distribution | `npm:@piagent/platform@1.1.5` |
 | Enterprise npm (fork under another scope) | `npm:@your-scope/platform@x.y.z` |
 | Local platform dev | `/path/to/piagent` |
 
@@ -26,7 +26,7 @@ Latest tiện cho máy cá nhân muốn nhận cập nhật nhanh. Pin tag/commi
 
 | Channel | Command | Target | Policy |
 |---|---|---|---|
-| `stable` | `bash scripts/install-global.sh --stable` | Helper release tag resolved to commit SHA, currently `v1.1.3` | Install the Pi package matching the helper. |
+| `stable` | `bash scripts/install-global.sh --stable` | Helper release tag resolved to commit SHA, currently `v1.1.5` | Install the Pi package matching the helper. |
 | `exact` | `bash scripts/install-global.sh --version vX.Y.Z --resolve-tag` | Requested tag resolved to commit SHA | Pi-package-only rollout, rollback, and incident recovery. |
 | `dev` | `bash scripts/install-global.sh --dev` | Moving Git source | Personal/sandbox only; do not commit into project settings. |
 | `local` | `bash scripts/install-global.sh --local` | Current checkout path | Platform development only. |
@@ -53,7 +53,7 @@ Root `package.json` có `pi` manifest trỏ tới:
 Do đó team có thể:
 
 ```bash
-pi install git:github.com/Vt-mmm/piagent@v1.1.3
+pi install git:github.com/Vt-mmm/piagent@v1.1.5
 ```
 
 Không cần biết internal folder `packages/piagent-core`. Source không pin chỉ dành cho personal/sandbox như bảng channel ở trên.
@@ -65,12 +65,12 @@ Team nên install global package một lần:
 ```bash
 node --version  # >= 22.19.0
 npm install -g --ignore-scripts @earendil-works/pi-coding-agent@0.82.0
-npm install -g --ignore-scripts @piagent/platform@1.1.3
+npm install -g --ignore-scripts @piagent/platform@1.1.5
 piagent-install --stable --dry-run
 piagent-install --stable
 ```
 
-`pi install git:github.com/Vt-mmm/piagent@v1.1.3` vẫn hợp lệ nếu chỉ cần cài Pi package. Lệnh đó không tự tạo các binary terminal `piagent-*`; muốn có helper global thì dùng `npm install -g --ignore-scripts @piagent/platform@1.1.3`.
+`pi install git:github.com/Vt-mmm/piagent@v1.1.5` vẫn hợp lệ nếu chỉ cần cài Pi package. Lệnh đó không tự tạo các binary terminal `piagent-*`; muốn có helper global thì dùng `npm install -g --ignore-scripts @piagent/platform@1.1.5`.
 
 Support matrix hiện tại: macOS Apple Silicon + Bash và Linux x64 + Bash đã được verify; macOS Intel + Bash và Linux ARM64 + Bash là supported target cần chạy smoke trước rollout; native Windows chưa phải target rollout team; WSL2 experimental. Chi tiết và version runtime nằm trong [release/install policy](release-install-policy.md).
 
@@ -103,7 +103,7 @@ Nếu muốn commit sẵn `.pi/piagent-profile.json` vào repo hoặc bootstrap
 ```bash
 bash scripts/setup.sh /path/to/project \
   --profile be-readonly-fe \
-  --package-source git:github.com/Vt-mmm/piagent@v1.1.3 \
+  --package-source git:github.com/Vt-mmm/piagent@v1.1.5 \
   --mcp-preset core \
   --subagents-preset safe
 ```

package/docs/operator-manual-vietnamese.md

@@ -18,12 +18,12 @@ Support matrix release hiện tại: macOS Apple Silicon + Bash và Linux x64 +
 ```bash
 node --version  # >= 22.19.0
 npm install -g --ignore-scripts @earendil-works/pi-coding-agent@0.82.0
-npm install -g --ignore-scripts @piagent/platform@1.1.3
+npm install -g --ignore-scripts @piagent/platform@1.1.5
 piagent-install --stable --dry-run
 piagent-install --stable
 ```
 
-Khi seed `.pi/settings.json` cho team/repo cần audit lặp lại, giữ package source dạng pinned tag như `git:github.com/Vt-mmm/piagent@v1.1.3`. Máy cá nhân có thể dùng `git:github.com/Vt-mmm/piagent` để theo latest.
+Khi seed `.pi/settings.json` cho team/repo cần audit lặp lại, giữ package source dạng pinned tag như `git:github.com/Vt-mmm/piagent@v1.1.5`. Máy cá nhân có thể dùng `git:github.com/Vt-mmm/piagent` để theo latest.
 
 Nếu đang ở source checkout của platform, dùng helper theo channel để preview trước khi đổi:
 
@@ -99,7 +99,7 @@ install package once
 
 ```bash
 npm install -g --ignore-scripts @earendil-works/pi-coding-agent@0.82.0
-npm install -g --ignore-scripts @piagent/platform@1.1.3
+npm install -g --ignore-scripts @piagent/platform@1.1.5
 piagent-install --stable --dry-run
 piagent-install --stable
 ```
@@ -156,6 +156,18 @@ Trong Pi:
 
 Chọn provider/account như OpenAI/Codex hoặc Anthropic/Claude. Credential nằm trong Pi user dir, không nằm trong repo và không được commit.
 
+Browser login của OpenAI có hai chỗ trông như treo. Cả hai là lỗi Pi host, không phải platform, và còn nguyên ở `0.82.0` lẫn `0.82.1`.
+
+Paste xong callback URL mà màn hình đứng im: **bấm Enter**. Ô nhập callback chỉ hiện hint `to cancel`, không hiện `to submit`, nên nó đang chờ submit chứ không đơ.
+
+Đã Enter rồi mà terminal khoá luôn, Esc không thoát được: Pi lưu credential xong mới refresh model catalog từ `pi.dev`, và request đó không có timeout. Firewall hoặc proxy giữ connection im lặng thì `/login` chờ mãi. Credential thực tế đã lưu rồi, nên mở tab mới vẫn dùng được. Login bằng đường này để tránh hẳn:
+
+```bash
+pi --offline
+```
+
+Rồi `/login` → browser → paste → Enter. `--offline` chỉ chặn bước refresh catalog gây treo, OAuth vẫn chạy. Xong thì thoát và mở `pi` bình thường.
+
 ### Chọn model và thinking
 
 Trong Pi:
@@ -269,7 +281,7 @@ Không phải daily default. Dùng khi muốn tạo sẵn `.pi` files cho projec
 bash /path/to/piagent/scripts/setup.sh /path/to/project \
   --project-only \
   --profile auto \
-  --package-source git:github.com/Vt-mmm/piagent@v1.1.3 \
+  --package-source git:github.com/Vt-mmm/piagent@v1.1.5 \
   --mcp-preset core \
   --subagents-preset safe
 ```
@@ -842,8 +854,8 @@ Watchdog là optional adversarial reviewer ở cuối turn, không bật mặc
 
 | Command | Dùng để |
 |---|---|
-| `npm install -g --ignore-scripts @piagent/platform@1.1.3` | Cài terminal helper `piagent-*` từ release tag hiện tại. |
-| `pi install git:github.com/Vt-mmm/piagent@v1.1.3` | Install pinned release cho reproducible team setup. |
+| `npm install -g --ignore-scripts @piagent/platform@1.1.5` | Cài terminal helper `piagent-*` từ release tag hiện tại. |
+| `pi install git:github.com/Vt-mmm/piagent@v1.1.5` | Install pinned release cho reproducible team setup. |
 | `pi install git:github.com/Vt-mmm/piagent` | Install latest platform package cho máy cá nhân/sandbox. |
 | Cài exact Pi host của release, rồi `npm install -g --ignore-scripts @piagent/platform@X.Y.Z` và `piagent-install --stable` | Full update: đồng bộ host, terminal helper và Pi package. Mỗi release pin một Pi host chính xác; lấy đúng version của release đang cài trong [release/install policy](release-install-policy.md). |
 | Cài exact Pi host ghi trong release cũ, rồi helper `vPREVIOUS` và `piagent-install --stable` | Full rollback; đánh giá lại dependency findings của host cũ trước khi hạ version. |
@@ -940,7 +952,7 @@ Mở lại Pi session sau khi install.
 Cài lại terminal helper đúng release rồi kiểm tra `PATH`:
 
 ```bash
-npm install -g --ignore-scripts @piagent/platform@1.1.3
+npm install -g --ignore-scripts @piagent/platform@1.1.5
 command -v piagent-install
 ```
 

package/docs/publishing-for-teams.md

@@ -46,6 +46,8 @@ pi install /path/to/piagent
 - `1.1.0`: đọc document ngoài project qua `additionalReadRoots`, MCP baseline bật mặc định ở cả hai lệnh install, pin Pi host `0.82.0`.
 - `1.1.2`: đóng TOCTOU của document reader, hash evidence tính trên text đã redact, publish chờ đủ verify matrix.
 - `1.1.3`: command mang secret không còn được dùng làm verify evidence, document reader từ chối FIFO thay vì treo, redact secret ngắn, redirect phải về đúng trang được kiểm.
+- `1.1.4`: nhận diện secret dạng CLI option (`--token`, `--password`, `--api-key`) và Authorization header ở mọi vị trí argument.
+- `1.1.5`: thêm `piagent-update` — một lệnh update cả Pi host, terminal helper và Pi package đúng thứ tự.
 
 ## Không publish
 

package/docs/release-install-policy.md

@@ -10,7 +10,7 @@ This file is the canonical install, update, rollback, and release checklist. Oth
 
 All supported environments require Node.js `>=22.19.0` and Pi Coding Agent `0.82.0`. The Pi host is installed as a Node CLI; Pi Agent Platform still defines its own release matrix because the terminal helpers and shell policy rely on Bash/POSIX behavior.
 
-| Surface | Status for v1.1.3 | Rollout guidance |
+| Surface | Status for v1.1.5 | Rollout guidance |
 |---|---|---|
 | macOS Apple Silicon (`darwin/arm64`) + Bash | Verified for this release. | Safe default for team rollout after normal project smoke tests. |
 | Linux x64 + Bash | Verified in GitHub Actions. | Safe default for CI/server usage after normal project smoke tests. |
@@ -33,7 +33,7 @@ These three components are versioned independently. A full install, update, or r
 
 | Channel | Source shape | Mutability | Use when |
 |---|---|---:|---|
-| `stable` | `git:github.com/Vt-mmm/piagent@<resolved-commit-sha>` from `v1.1.3` | Fixed after resolution | Default for team rollout. |
+| `stable` | `git:github.com/Vt-mmm/piagent@<resolved-commit-sha>` from `v1.1.5` | Fixed after resolution | Default for team rollout. |
 | `exact` | Tag, reviewed commit, or a tag resolved with `--resolve-tag` | Fixed when using a commit SHA | Pi-package-only roll forward, rollback, or reproduction. |
 | `dev` | `git:github.com/Vt-mmm/piagent` | Moving | Personal machine or sandbox only. |
 | `local` | `/path/to/piagent` | Local workspace | Platform development and dry-run validation. |
@@ -53,7 +53,7 @@ Use this flow when the team needs both terminal commands and the Pi package:
 ```bash
 node --version  # >= 22.19.0
 npm install -g --ignore-scripts @earendil-works/pi-coding-agent@0.82.0
-npm install -g --ignore-scripts @piagent/platform@1.1.3
+npm install -g --ignore-scripts @piagent/platform@1.1.5
 piagent-install --stable --dry-run
 piagent-install --stable
 ```
@@ -61,8 +61,8 @@ piagent-install --stable
 The stable preview and apply output includes:
 
 ```text
-currentRelease: v1.1.3 (helper package version)
-tag: v1.1.3
+currentRelease: v1.1.5 (helper package version)
+tag: v1.1.5
 resolvedCommit: <40-char-sha>
 source: git:github.com/Vt-mmm/piagent@<40-char-sha>
 ```
@@ -79,14 +79,26 @@ bash scripts/install-global.sh --stable
 Use this only when terminal commands are not needed:
 
 ```bash
-pi install git:github.com/Vt-mmm/piagent@v1.1.3
+pi install git:github.com/Vt-mmm/piagent@v1.1.5
 ```
 
 Direct `pi install` does not create `piagent-*` commands on `PATH`.
 
 ## Full platform update
 
-Update the exact supported Pi host first, then the npm-global helper, then let that target helper resolve and install its matching stable Pi package:
+`piagent-update` does the whole sequence in one command:
+
+```bash
+piagent-update --check
+piagent-update --dry-run
+piagent-update --project /path/to/project
+```
+
+It resolves the target helper version and, from that version's published metadata, the exact Pi host that version pins — both before installing anything, so `--check` and `--dry-run` describe a real run. It then installs the host, replaces the helper, verifies that the version now on disk is the one it asked for, and only then runs the new helper's installer for the Pi package. `--version X.Y.Z` targets an exact release instead of latest, `--no-host` and `--no-package` narrow the run, and anything after `--` is passed to `piagent-install`.
+
+Running it from a git checkout is refused rather than replacing that checkout's commands with a published build; update a checkout with `git pull` and `install-global.sh --local`.
+
+The same sequence by hand, which must keep this order because `piagent-install` fails against a host that does not match the version it pins and does not install one itself:
 
 ```bash
 npm install -g --ignore-scripts @earendil-works/pi-coding-agent@0.82.0

package/docs/security-threat-model.md

@@ -21,7 +21,7 @@ This document covers the packaged guard, project profiles, capability locks, ins
 - The operator, operating-system account, Pi host, and explicitly trusted project repository are trusted to execute code.
 - Project-local Pi resources are loaded only after Pi project trust or an explicit operator override.
 - A human remains available to approve destructive and external-provider actions.
-- Supported release verification covers macOS Apple Silicon + Bash, Linux x64 + Bash, Node.js `>=22.19.0`, and the exact Pi host version declared by the release. macOS Intel + Bash and Linux ARM64 + Bash are supported targets that need local smoke verification before broad rollout. Native Windows is not a team-rollout target for v1.1.3, and WSL2 is experimental/unverified.
+- Supported release verification covers macOS Apple Silicon + Bash, Linux x64 + Bash, Node.js `>=22.19.0`, and the exact Pi host version declared by the release. macOS Intel + Bash and Linux ARM64 + Bash are supported targets that need local smoke verification before broad rollout. Native Windows is not a team-rollout target for v1.1.5, and WSL2 is experimental/unverified.
 - Registry, GitHub, model-provider, MCP-provider, and Vercel controls are external dependencies. Their account security and platform guarantees are not replaced by this repository.
 
 ## Threat actors and failure modes

package/docs/team-onboarding.md

@@ -9,7 +9,7 @@ Một thành viên mới không cần biết local path của maintainer. Luồn
 ```bash
 node --version  # >= 22.19.0
 npm install -g --ignore-scripts @earendil-works/pi-coding-agent@0.82.0
-npm install -g --ignore-scripts @piagent/platform@1.1.3
+npm install -g --ignore-scripts @piagent/platform@1.1.5
 piagent-install --stable
 cd /path/to/project
 pi
@@ -42,7 +42,7 @@ Mặc định team dùng stable helper:
 ```bash
 node --version  # >= 22.19.0
 npm install -g --ignore-scripts @earendil-works/pi-coding-agent@0.82.0
-npm install -g --ignore-scripts @piagent/platform@1.1.3
+npm install -g --ignore-scripts @piagent/platform@1.1.5
 piagent-install --stable --dry-run
 piagent-install --stable
 ```
@@ -63,7 +63,16 @@ pi install git:github.com/Vt-mmm/piagent
 
 ## Update và rollback cho team
 
-Full update phải đồng bộ exact Pi host trước, sau đó terminal helper và Pi package matching:
+Một lệnh, đúng thứ tự, cho cả ba thành phần:
+
+```bash
+piagent-update --check
+piagent-update --project /path/to/project
+```
+
+`--check` chỉ báo version, không đụng gì. Lên đúng một bản cụ thể thì `piagent-update --version 1.1.5`.
+
+Sequence thủ công vẫn dùng được, và bắt buộc theo thứ tự này — `piagent-install` **fail** nếu Pi host lệch bản pin, nó không tự nâng host:
 
 ```bash
 npm install -g --ignore-scripts @earendil-works/pi-coding-agent@0.82.0
@@ -108,6 +117,8 @@ pi
 
 Credential nằm trong user Pi dir, không commit.
 
+Nếu browser login của OpenAI trông như treo, xem [login provider](operator-manual-vietnamese.md#login-provider). Tóm tắt: paste callback URL xong phải bấm **Enter** (màn hình không nhắc), và nếu sau Enter terminal khoá luôn thì login bằng `pi --offline` một lần. Cả hai là lỗi Pi host `0.82.0`/`0.82.1`, không phải platform.
+
 ## Bước 3 — chọn model và onboard project
 
 Sau login, chọn provider/model intended cho project understanding bằng native Pi selector. OpenAI Codex và Claude/Anthropic đều là supported option.

package/docs-site/index.html

@@ -798,7 +798,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.1.3 docs</span>
+        <span class="pill"><span class="pill-dot"></span>v1.1.5 docs</span>
         <a class="button social" href="https://github.com/Vt-mmm/piagent" target="_blank" rel="noopener noreferrer" aria-label="Mở GitHub repository">
           <svg viewBox="0 0 24 24" fill="none" aria-hidden="true">
             <path d="M7 17 17 7M9 7h8v8" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" />
@@ -934,7 +934,7 @@
               <article class="step">
                 <div>
                   <h3>Cài — hai lệnh</h3>
-                  <p>Cần Node.js 22.19.0 trở lên. Không cần cài Pi Coding Agent trước: <span class="inline-code">piagent-setup</span> tự cài đúng bản <span class="inline-code">0.82.0</span> mà release <span class="inline-code">v1.1.3</span> đang pin. Chạy nó ngay trong thư mục project — nó cài Pi package, khởi tạo <span class="inline-code">.pi/</span>, cài MCP baseline cùng subagents, rồi chạy doctor. Thêm <span class="inline-code">--no-mcp</span>, <span class="inline-code">--no-subagents</span>, <span class="inline-code">--no-herdr</span> hoặc <span class="inline-code">--global-only</span> để bỏ bớt.</p>
+                  <p>Cần Node.js 22.19.0 trở lên. Không cần cài Pi Coding Agent trước: <span class="inline-code">piagent-setup</span> tự cài đúng bản <span class="inline-code">0.82.0</span> mà release <span class="inline-code">v1.1.5</span> đang pin. Chạy nó ngay trong thư mục project — nó cài Pi package, khởi tạo <span class="inline-code">.pi/</span>, cài MCP baseline cùng subagents, rồi chạy doctor. Thêm <span class="inline-code">--no-mcp</span>, <span class="inline-code">--no-subagents</span>, <span class="inline-code">--no-herdr</span> hoặc <span class="inline-code">--global-only</span> để bỏ bớt.</p>
                   <div class="table-wrap compact-table">
                     <table>
                       <thead>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@piagent/platform",
-  "version": "1.1.3",
+  "version": "1.1.5",
   "license": "MIT",
   "publishConfig": {
     "access": "public",
@@ -47,6 +47,7 @@
   "bin": {
     "piagent-setup": "scripts/piagent-cli.mjs",
     "piagent-install": "scripts/piagent-cli.mjs",
+    "piagent-update": "scripts/piagent-cli.mjs",
     "piagent-uninstall": "scripts/piagent-cli.mjs",
     "piagent-init": "scripts/piagent-cli.mjs",
     "piagent-doctor": "scripts/piagent-cli.mjs",

package/packages/piagent-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@piagent/core",
-  "version": "1.1.3",
+  "version": "1.1.5",
   "type": "module",
   "private": true,
   "license": "MIT",

package/packages/piagent-core/security/sensitive-data.js

@@ -15,7 +15,27 @@ const TOKEN_PATTERNS = [
 const CONNECTION_URL_PATTERN = /\b((?:https?|ftp|postgres(?:ql)?|mysql|mariadb|mongodb(?:\+srv)?|redis):\/\/[^:\s/"']+:)([^@\s/"']+)(@[^\s"'<>]+)/gi;
 const BEARER_PATTERN = /\b(Bearer\s+)([A-Za-z0-9._~+/=-]{20,})\b/gi;
 const BASIC_AUTH_PATTERN = /\b(Basic\s+)([A-Za-z0-9+/]{12,}={0,2})(?=$|[\s,;}])/gi;
-const AUTHORIZATION_HEADER_PATTERN = /\b(Authorization\s*:\s*)([A-Za-z][A-Za-z0-9_-]{0,31})(\s+)([^\r\n]+)/gi;
+// The value is one whitespace-free token, not the rest of the line. Taking the
+// rest of the line made the result depend on where the header sat among the
+// arguments: `curl URL -H "Authorization: Token abc123"` yielded `abc123"`, short
+// enough to keep, while moving the header before the URL swept the URL into the
+// value and pushed it past the length bar. Same header, same credential, opposite
+// outcome. Credentials carry no spaces, so stopping at the first one also keeps
+// prose like "Authorization: not required for local runs" intact.
+const AUTHORIZATION_HEADER_PATTERN = /\b(Authorization\s*:\s*)([A-Za-z][A-Za-z0-9_-]{0,31})(\s+)([^\s\r\n"'`]+)/gi;
+
+// A credential passed as a command-line option, which is how most CLIs take one.
+// The assignment patterns below require a key starting with a letter, so every
+// `--token=...` and `--token ...` walked straight past them.
+const CLI_OPTION_SECRET_PATTERN = /(^|[\s({[])(--[A-Za-z][A-Za-z0-9_.-]{0,80})(=|\s+)("[^"\r\n]*"|'[^'\r\n]*'|[^\s"'`;,)}]+)/g;
+
+// Under one of these schemes the header carries an opaque credential, so its
+// length says nothing. Anything else after `Authorization:` is more likely prose
+// — "Authorization: not required" — and keeps the ambiguous-syntax length bar.
+const AUTHORIZATION_SCHEMES = new Set([
+  "bearer", "basic", "token", "digest", "negotiate", "ntlm",
+  "oauth", "hawk", "signature", "apikey", "jwt", "aws4-hmac-sha256"
+]);
 const QUERY_SECRET_PATTERN = /([?&])([A-Za-z][A-Za-z0-9_.-]{0,80})(=)([^&#\s]+)/gi;
 const DOUBLE_QUOTED_SECRET_ASSIGNMENT_PATTERN = /(^|[\s{[,(;])((?:"|')?[A-Za-z][A-Za-z0-9_.-]{0,80}(?:"|')?\s*)(:|=(?!=))\s*"((?:\\.|[^"\\\r\n])*)"/gim;
 const SINGLE_QUOTED_SECRET_ASSIGNMENT_PATTERN = /(^|[\s{[,(;])((?:"|')?[A-Za-z][A-Za-z0-9_.-]{0,80}(?:"|')?\s*)(:|=(?!=))\s*'((?:\\.|[^'\\\r\n])*)'/gim;
@@ -144,10 +164,22 @@ export function redactSensitiveText(input) {
   text = text.replace(BEARER_PATTERN, (_match, prefix) => `${prefix}${REDACTION}`);
   text = text.replace(BASIC_AUTH_PATTERN, (_match, prefix) => `${prefix}${REDACTION}`);
   text = text.replace(AUTHORIZATION_HEADER_PATTERN, (match, prefix, scheme, spacing, value) => {
-    if (!valueLooksSensitive("authorization", value)) return match;
+    const syntax = AUTHORIZATION_SCHEMES.has(scheme.toLowerCase()) ? "assignment" : "unquoted-colon";
+    if (!valueLooksSensitive("authorization", value, syntax)) return match;
     return `${prefix}${scheme}${spacing}${REDACTION}`;
   });
 
+  // Over-redaction is the safe direction here: a flag whose name says "secret"
+  // and whose argument is a plain name — `docker service create --secret build` —
+  // loses that name from the record and cannot serve as verify evidence. Reading
+  // the name as the credential it is called is the cheaper mistake.
+  text = text.replace(CLI_OPTION_SECRET_PATTERN, (match, prefix, flag, separator, value) => {
+    // A following option is the next flag, not this flag's argument.
+    if (separator !== "=" && value.startsWith("-")) return match;
+    if (!keyLooksSensitive(flag) || !valueLooksSensitive(flag, value, "assignment")) return match;
+    return `${prefix}${flag}${separator === "=" ? "= " : " "}${REDACTION}`;
+  });
+
   for (const pattern of TOKEN_PATTERNS) text = text.replace(pattern, REDACTION);
 
   text = text.replace(QUERY_SECRET_PATTERN, (match, prefix, key, separator, value) => {

package/scripts/install-global.sh

@@ -15,7 +15,7 @@ Package source examples:
   # Installs the stable tag after resolving it to a commit SHA.
 
   # Pin a specific release:
-  scripts/install-global.sh --version v1.1.3 --resolve-tag
+  scripts/install-global.sh --version v1.1.5 --resolve-tag
 
   # Preview the planned install/update without changing user config:
   scripts/install-global.sh --stable --dry-run
@@ -127,7 +127,7 @@ detect_runtime_surface() {
       printf 'native-windows/%s (not release-gated; terminal helpers require Bash semantics)' "$arch_name"
       ;;
     *)
-      printf '%s/%s (outside v1.1.3 release matrix)' "$os_name" "$arch_name"
+      printf '%s/%s (outside v1.1.5 release matrix)' "$os_name" "$arch_name"
       ;;
   esac
 }
@@ -135,7 +135,7 @@ detect_runtime_surface() {
 warn_runtime_surface_if_needed() {
   local surface="$1"
   case "$surface" in
-    *"supported target"*|*"experimental"*|*"not release-gated"*|*"outside v1.1.3 release matrix"*)
+    *"supported target"*|*"experimental"*|*"not release-gated"*|*"outside v1.1.5 release matrix"*)
       echo "WARN: runtime surface is $surface." >&2
       echo "WARN: For team rollout, run piagent-doctor plus the project smoke/verify suite on this machine before relying on it." >&2
       ;;

package/scripts/piagent-cli.mjs

@@ -6,6 +6,7 @@ import { fileURLToPath } from "node:url";
 const scriptByCommand = {
   "piagent-setup": "scripts/setup.sh",
   "piagent-install": "scripts/install-global.sh",
+  "piagent-update": "scripts/update-global.mjs",
   "piagent-uninstall": "scripts/uninstall-global.sh",
   "piagent-init": "scripts/init-project.sh",
   "piagent-doctor": "scripts/team-doctor.sh",

package/scripts/team-doctor.sh

@@ -137,7 +137,7 @@ function runtimeMatrixStatus() {
     surface: `${platform}/${arch}`,
     status: "outside-release-matrix",
     teamRolloutReady: false,
-    note: "This runtime is outside the documented v1.1.3 support matrix."
+    note: "This runtime is outside the documented v1.1.5 support matrix."
   };
 }
 

package/scripts/update-global.mjs

@@ -0,0 +1,265 @@
+#!/usr/bin/env node
+// One command that moves a machine from one release to the next.
+//
+// A release is three independently versioned things: the Pi host, this npm-global
+// terminal helper, and the Pi package the helper installs. They have to move in
+// that order, because `piagent-install` refuses to run against a host that does
+// not match the version its own package.json pins. Doing it by hand means three
+// commands and one ordering rule, and getting the order wrong fails late.
+//
+// The awkward part is that the helper is the program running this file, so it has
+// to replace itself. Rather than re-exec a half-replaced process, every version
+// this run needs is resolved from the registry *before* anything is installed:
+// the target helper version and, from that version's metadata, the host version it
+// will demand. The plan is therefore complete and printable before the first
+// mutation, `--dry-run` shows exactly what a real run would do, and after the
+// helper is replaced the run only has to confirm that what landed on disk is what
+// it asked for.
+
+import fs from "node:fs";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+
+const HELPER_PACKAGE = "@piagent/platform";
+const HOST_PACKAGE = "@earendil-works/pi-coding-agent";
+const EXIT_USAGE = 2;
+
+const platformRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+
+function usage() {
+  return `Usage:
+  piagent-update [options]
+
+Updates the Pi host, this terminal helper, and the Pi package together, in the
+order a release requires.
+
+Options:
+  --check                 Report current and available versions, change nothing
+  --dry-run               Print every command that would run, change nothing
+  --version <x.y.z>       Update to an exact helper version instead of latest
+  --force                 Reinstall even when already on the target version
+  --project <path>        Run the team doctor against this project afterwards
+  --no-host               Do not touch the Pi host
+  --no-package            Do not reinstall the Pi package
+  -h, --help              Show this help
+
+Anything after -- is passed through to piagent-install, for example:
+  piagent-update -- --no-mcp
+`;
+}
+
+function fail(message, code = 1) {
+  console.error(`FAIL: ${message}`);
+  process.exit(code);
+}
+
+function readJson(file) {
+  try {
+    return JSON.parse(fs.readFileSync(file, "utf8"));
+  } catch {
+    return undefined;
+  }
+}
+
+function isReleaseVersion(value) {
+  return typeof value === "string" && /^[0-9]+\.[0-9]+\.[0-9]+([+-][0-9A-Za-z.-]+)?$/.test(value);
+}
+
+// "v1.2.3" and "1.2.3" both name the same release everywhere else in this
+// repository, so accept either and normalise once.
+function normalizeVersion(value) {
+  return typeof value === "string" && value.startsWith("v") ? value.slice(1) : value;
+}
+
+function parseArguments(argv) {
+  const options = {
+    check: false,
+    dryRun: false,
+    force: false,
+    version: undefined,
+    project: undefined,
+    host: true,
+    package: true,
+    passthrough: []
+  };
+
+  for (let index = 0; index < argv.length; index += 1) {
+    const argument = argv[index];
+    if (argument === "--") {
+      options.passthrough = argv.slice(index + 1);
+      break;
+    }
+    switch (argument) {
+      case "-h":
+      case "--help":
+        process.stdout.write(usage());
+        process.exit(0);
+        break;
+      case "--check":
+        options.check = true;
+        break;
+      case "--dry-run":
+        options.dryRun = true;
+        break;
+      case "--force":
+        options.force = true;
+        break;
+      case "--no-host":
+        options.host = false;
+        break;
+      case "--no-package":
+        options.package = false;
+        break;
+      case "--version": {
+        const value = normalizeVersion(argv[index += 1]);
+        if (!isReleaseVersion(value)) fail(`--version needs an exact release such as 1.1.4, got ${argv[index] ?? "nothing"}`, EXIT_USAGE);
+        options.version = value;
+        break;
+      }
+      case "--project": {
+        const value = argv[index += 1];
+        if (!value) fail("--project needs a path", EXIT_USAGE);
+        options.project = value;
+        break;
+      }
+      default:
+        fail(`unknown option: ${argument}\n\n${usage()}`, EXIT_USAGE);
+    }
+  }
+
+  return options;
+}
+
+function run(command, args, { capture = false } = {}) {
+  const result = spawnSync(command, args, {
+    encoding: "utf8",
+    stdio: capture ? ["ignore", "pipe", "pipe"] : "inherit"
+  });
+  if (result.error) return { ok: false, stdout: "", stderr: String(result.error.message ?? result.error) };
+  return { ok: result.status === 0, stdout: result.stdout ?? "", stderr: result.stderr ?? "" };
+}
+
+function npmView(specifier, field) {
+  const result = run("npm", ["view", specifier, field, "--json"], { capture: true });
+  if (!result.ok) return undefined;
+  try {
+    return JSON.parse(result.stdout.trim());
+  } catch {
+    return undefined;
+  }
+}
+
+function installedHostVersion() {
+  const result = run("pi", ["--version"], { capture: true });
+  if (!result.ok) return undefined;
+  const match = /([0-9]+\.[0-9]+\.[0-9]+([+-][0-9A-Za-z.-]+)?)/.exec(result.stdout);
+  return match ? match[1] : undefined;
+}
+
+// The helper installs itself from the registry, so a run started from a git
+// checkout would replace the checkout's own commands with a published build and
+// leave the operator somewhere they did not ask to be.
+function runningFromGlobalInstall() {
+  return platformRoot.split(path.sep).includes("node_modules");
+}
+
+function describeStep(dryRun, command, args) {
+  console.log(`${dryRun ? "DRY RUN:" : "run:"} ${command} ${args.join(" ")}`);
+}
+
+function main() {
+  const options = parseArguments(process.argv.slice(2));
+
+  const manifest = readJson(path.join(platformRoot, "package.json"));
+  if (!manifest?.version) fail(`cannot read the helper package at ${platformRoot}`);
+  const currentHelper = manifest.version;
+  const currentHost = installedHostVersion();
+
+  const targetHelper = options.version ?? npmView(HELPER_PACKAGE, "version");
+  if (!isReleaseVersion(targetHelper)) {
+    fail(`cannot resolve a release for ${HELPER_PACKAGE}. Check network access to the npm registry, or pass --version.`);
+  }
+
+  // The host requirement belongs to the version being installed, not the one
+  // running, so it is read from the target's published metadata.
+  const targetPeers = npmView(`${HELPER_PACKAGE}@${targetHelper}`, "peerDependencies");
+  const targetHost = targetPeers?.[HOST_PACKAGE];
+  if (!isReleaseVersion(targetHost)) {
+    fail(`${HELPER_PACKAGE}@${targetHelper} does not pin an exact ${HOST_PACKAGE} version, so the host cannot be updated safely.`);
+  }
+
+  const helperNeedsChange = options.force || currentHelper !== targetHelper;
+  const hostNeedsChange = options.host && (options.force || currentHost !== targetHost);
+
+  console.log("Pi Agent Platform update");
+  console.log(`  helper:  ${currentHelper} -> ${targetHelper}${helperNeedsChange ? "" : " (already current)"}`);
+  console.log(`  host:    ${currentHost ?? "not installed"} -> ${targetHost}${hostNeedsChange ? "" : " (already current)"}`);
+  console.log(`  package: reinstalled from v${targetHelper} as a resolved commit${options.package ? "" : " (skipped)"}`);
+
+  if (options.check) {
+    const pending = [helperNeedsChange && "helper", hostNeedsChange && "host"].filter(Boolean);
+    console.log(pending.length ? `\nUpdate available: ${pending.join(", ")}.` : "\nEverything is on the target release.");
+    return;
+  }
+
+  if (!helperNeedsChange && !hostNeedsChange && !options.package) {
+    console.log("\nNothing to do.");
+    return;
+  }
+
+  if (!options.dryRun && !runningFromGlobalInstall()) {
+    fail(`this command updates the npm-global helper, but it is running from ${platformRoot}.\n`
+      + "From a checkout, update with git and install from it:\n"
+      + `  git -C ${platformRoot} pull\n`
+      + `  bash ${path.join(platformRoot, "scripts/install-global.sh")} --local`);
+  }
+
+  // Host first: piagent-install refuses to run against a host that does not match
+  // the version its package.json pins, so a helper installed ahead of the host
+  // would fail on its very next step.
+  if (hostNeedsChange) {
+    const args = ["install", "-g", "--ignore-scripts", `${HOST_PACKAGE}@${targetHost}`];
+    describeStep(options.dryRun, "npm", args);
+    if (!options.dryRun && !run("npm", args).ok) fail(`could not install ${HOST_PACKAGE}@${targetHost}`);
+  }
+
+  if (helperNeedsChange) {
+    const args = ["install", "-g", "--ignore-scripts", `${HELPER_PACKAGE}@${targetHelper}`];
+    describeStep(options.dryRun, "npm", args);
+    if (!options.dryRun) {
+      if (!run("npm", args).ok) fail(`could not install ${HELPER_PACKAGE}@${targetHelper}`);
+      // The helper has just replaced itself on disk. Everything after this point
+      // runs the newly installed scripts, so confirm they are the ones asked for
+      // rather than trusting that npm did what it said.
+      const landed = readJson(path.join(platformRoot, "package.json"))?.version;
+      if (landed !== targetHelper) {
+        fail(`installed ${HELPER_PACKAGE}@${targetHelper} but ${platformRoot} reports ${landed ?? "nothing"}. `
+          + "The Pi package was left untouched; rerun once the helper is correct.");
+      }
+    }
+  }
+
+  if (options.package) {
+    const installer = path.join(platformRoot, "scripts/install-global.sh");
+    if (!options.dryRun && !fs.existsSync(installer)) {
+      fail(`the updated helper has no installer at ${installer}`);
+    }
+    const args = [installer, "--stable", ...options.passthrough];
+    describeStep(options.dryRun, "bash", args);
+    if (!options.dryRun && !run("bash", args).ok) fail("the Pi package install did not complete");
+  }
+
+  if (options.project) {
+    const doctor = path.join(platformRoot, "scripts/team-doctor.sh");
+    const args = [doctor, options.project, "--strict-share"];
+    describeStep(options.dryRun, "bash", args);
+    if (!options.dryRun && !run("bash", args).ok) fail("the team doctor reported a problem");
+  }
+
+  console.log(options.dryRun
+    ? `\nDRY RUN: nothing was installed. Rerun without --dry-run to apply v${targetHelper}.`
+    : `\nPASS: updated to v${targetHelper}.`);
+}
+
+main();