@piagent/platform 1.1.8 → 1.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (71) hide show
  1. package/CHANGELOG.md +51 -1
  2. package/README.md +2 -2
  3. package/docs/command-reference-vietnamese.md +13 -4
  4. package/docs/distribution-standard.md +7 -7
  5. package/docs/mcp-and-tools.md +108 -2
  6. package/docs/model-options.md +10 -8
  7. package/docs/operator-manual-vietnamese.md +12 -12
  8. package/docs/publishing-for-teams.md +2 -0
  9. package/docs/quickstart-vietnamese.md +2 -2
  10. package/docs/release-install-policy.md +6 -6
  11. package/docs/security-threat-model.md +1 -1
  12. package/docs/team-onboarding.md +4 -4
  13. package/docs/vercel-docs-site.md +34 -4
  14. package/docs-site/architecture.html +152 -0
  15. package/docs-site/assets/docs.css +1001 -0
  16. package/docs-site/assets/docs.js +84 -0
  17. package/docs-site/commands.html +203 -0
  18. package/docs-site/content/architecture.html +29 -0
  19. package/docs-site/content/commands.html +80 -0
  20. package/docs-site/content/index.html +80 -0
  21. package/docs-site/content/mcp-approval.html +81 -0
  22. package/docs-site/content/mcp-auth.html +76 -0
  23. package/docs-site/content/mcp-servers.html +111 -0
  24. package/docs-site/content/mcp.html +120 -0
  25. package/docs-site/content/permissions.html +54 -0
  26. package/docs-site/content/profiles.html +68 -0
  27. package/docs-site/content/quickstart.html +144 -0
  28. package/docs-site/content/runtime.html +45 -0
  29. package/docs-site/content/scope.html +71 -0
  30. package/docs-site/content/security.html +51 -0
  31. package/docs-site/content/team.html +23 -0
  32. package/docs-site/content/workflows.html +47 -0
  33. package/docs-site/index.html +131 -1534
  34. package/docs-site/mcp-approval.html +204 -0
  35. package/docs-site/mcp-auth.html +199 -0
  36. package/docs-site/mcp-servers.html +234 -0
  37. package/docs-site/mcp.html +243 -0
  38. package/docs-site/permissions.html +177 -0
  39. package/docs-site/profiles.html +191 -0
  40. package/docs-site/quickstart.html +267 -0
  41. package/docs-site/runtime.html +168 -0
  42. package/docs-site/scope.html +194 -0
  43. package/docs-site/security.html +174 -0
  44. package/docs-site/team.html +142 -0
  45. package/docs-site/workflows.html +170 -0
  46. package/package.json +4 -2
  47. package/packages/piagent-core/capabilities/capability-core.js +17 -1
  48. package/packages/piagent-core/extensions/document-intake.ts +5 -5
  49. package/packages/piagent-core/extensions/piagent-guard.ts +319 -4
  50. package/packages/piagent-core/extensions/update-check.js +41 -0
  51. package/packages/piagent-core/mcp/mcp-approval-store.js +175 -0
  52. package/packages/piagent-core/mcp/mcp-auth-readiness.js +197 -0
  53. package/packages/piagent-core/mcp/mcp-command-actions.js +291 -0
  54. package/packages/piagent-core/mcp/mcp-config-layers.js +133 -0
  55. package/packages/piagent-core/mcp/mcp-server-catalog.js +150 -0
  56. package/packages/piagent-core/mcp/mcp-server-entry.js +242 -0
  57. package/packages/piagent-core/mcp/mcp-session-view.js +185 -0
  58. package/packages/piagent-core/package.json +7 -3
  59. package/packages/piagent-core/prompts/model-options.md +8 -8
  60. package/scripts/build-docs-site.mjs +421 -0
  61. package/scripts/configure-model-scope.sh +2 -2
  62. package/scripts/configure-subagents.sh +1 -1
  63. package/scripts/install-global.sh +5 -5
  64. package/scripts/mcp-manage.mjs +567 -0
  65. package/scripts/piagent-cli.mjs +1 -1
  66. package/scripts/preview-docs-site.mjs +88 -0
  67. package/scripts/setup.sh +2 -2
  68. package/scripts/team-doctor.sh +18 -2
  69. package/scripts/verify-local.sh +46 -19
  70. package/scripts/verify-release-identity.mjs +8 -2
  71. package/scripts/configure-mcp.sh +0 -349
package/docs-site/team.html ADDED
@@ -0,0 +1,142 @@
1
+ <!doctype html>
2
+ <html lang="vi">
3
+ <head>
4
+ <meta charset="utf-8" />
5
+ <meta name="viewport" content="width=device-width, initial-scale=1" />
6
+ <title>Team nên dùng như một chuẩn vận hành · Pi Agent Platform Docs</title>
7
+ <meta name="description" content="Mỗi repo chỉ cần link package, chọn profile đúng và giữ tài liệu project-specific ở repo của dự án đó." />
8
+ <meta name="theme-color" content="#050505" />
9
+ <link rel="canonical" href="https://piagent.io.vn/team" />
10
+ <link rel="icon" href="/favicon.svg" type="image/svg+xml" />
11
+ <meta property="og:title" content="Team nên dùng như một chuẩn vận hành · Pi Agent Platform Docs" />
12
+ <meta property="og:description" content="Mỗi repo chỉ cần link package, chọn profile đúng và giữ tài liệu project-specific ở repo của dự án đó." />
13
+ <meta property="og:url" content="https://piagent.io.vn/team" />
14
+ <link rel="preconnect" href="https://fonts.googleapis.com" />
15
+ <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
16
+ <link
17
+ href="https://fonts.googleapis.com/css2?family=Be+Vietnam+Pro:wght@400;500;600;700;800&family=JetBrains+Mono:wght@400;500;600&display=swap"
18
+ rel="stylesheet"
19
+ />
20
+ <link rel="stylesheet" href="/assets/docs.css" />
21
+ <script src="/assets/docs.js" defer></script>
22
+ </head>
23
+ <body>
24
+ <header class="topbar">
25
+ <a class="brand" href="/" aria-label="Pi Agent Platform">
26
+ <span class="brand-mark"><img src="/assets/piagent-logo.svg" alt="" /></span>
27
+ <span>Pi Agent Platform</span>
28
+ </a>
29
+ <div class="top-actions">
30
+ <span class="pill"><span class="pill-dot"></span>v1.2.0 docs</span>
31
+ <a class="button social" href="https://github.com/Vt-mmm/piagent" target="_blank" rel="noopener noreferrer" aria-label="Mở GitHub repository">
32
+ <svg viewBox="0 0 24 24" fill="none" aria-hidden="true">
33
+ <path d="M7 17 17 7M9 7h8v8" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" />
34
+ </svg>
35
+ GitHub
36
+ </a>
37
+ <button class="button mobile-menu" type="button" data-menu>Lộ trình</button>
38
+ <a class="button" href="/commands">Commands</a>
39
+ </div>
40
+ </header>
41
+
42
+ <div class="layout with-toc">
43
+ <aside class="sidebar" data-sidebar>
44
+ <div class="sidebar-search" aria-label="Tìm trong tài liệu">
45
+ <svg viewBox="0 0 24 24" fill="none" aria-hidden="true">
46
+ <path d="M10.8 18.1a7.3 7.3 0 1 1 0-14.6 7.3 7.3 0 0 1 0 14.6Zm5.3-1.7 4.4 4.4" stroke="currentColor" stroke-width="2" stroke-linecap="round" />
47
+ </svg>
48
+ <input type="search" placeholder="Tìm trang" data-filter />
49
+ </div>
50
+
51
+ <nav aria-label="Tài liệu">
52
+ <div class="nav-group">
53
+ <p class="nav-title">Get started</p>
54
+ <a class="nav-link" href="/">Overview</a>
55
+ <a class="nav-link" href="/quickstart">Quickstart</a>
56
+ <a class="nav-link" href="/scope">Phạm vi platform</a>
57
+ </div>
58
+ <div class="nav-group">
59
+ <p class="nav-title">Build</p>
60
+ <a class="nav-link" href="/profiles">Project profile</a>
61
+ <a class="nav-link" href="/permissions">Permission modes</a>
62
+ <a class="nav-link" href="/commands">Command catalog</a>
63
+ <a class="nav-link" href="/workflows">Workflows</a>
64
+ </div>
65
+ <div class="nav-group">
66
+ <p class="nav-title">MCP</p>
67
+ <a class="nav-link" href="/mcp">MCP overview</a>
68
+ <a class="nav-link" href="/mcp-servers">Quản lý server</a>
69
+ <a class="nav-link" href="/mcp-auth">Auth và readiness</a>
70
+ <a class="nav-link" href="/mcp-approval">Approval gate</a>
71
+ </div>
72
+ <div class="nav-group">
73
+ <p class="nav-title">Operate</p>
74
+ <a class="nav-link" href="/security">Security model</a>
75
+ <a class="nav-link" href="/architecture">Architecture</a>
76
+ <a class="nav-link" href="/runtime">Runtime tools</a>
77
+ <a class="nav-link current" href="/team" aria-current="page">Team usage</a>
78
+ </div>
79
+ </nav>
80
+ </aside>
81
+
82
+ <main>
83
+ <div class="content-shell" data-article>
84
+ <nav class="breadcrumb" aria-label="Breadcrumb">
85
+ <a href="/">Docs</a>
86
+ <span aria-hidden="true">/</span>
87
+ <span>Operate</span>
88
+ <span aria-hidden="true">/</span>
89
+ <span>Team usage</span>
90
+ </nav>
91
+ <div class="page-head">
92
+ <h1>Team nên dùng như một chuẩn vận hành</h1>
93
+ <p>Mỗi repo chỉ cần link package, chọn profile đúng và giữ tài liệu project-specific ở repo của dự án đó.</p>
94
+ </div>
95
+ <section class="section">
96
+
97
+ <div class="split">
98
+ <article class="card">
99
+ <h3 id="viec-nen-lam">Việc nên làm</h3>
100
+ <p>Chạy <span class="inline-code">/onboard-project</span>, áp <span class="inline-code">/profile auto</span>, dùng workflow command, verify thật và ghi blockers rõ ràng.</p>
101
+ </article>
102
+ <article class="card">
103
+ <h3 id="viec-nen-tranh">Việc nên tránh</h3>
104
+ <p>Đưa token, auth file, cache, session, private examples hoặc business logic riêng vào core package public.</p>
105
+ </article>
106
+ </div>
107
+
108
+ <div class="callout ok-callout">
109
+ <strong>Chuẩn handoff</strong>
110
+ <p>Final response nên nói ngắn: đã đổi gì, verify nào đã chạy, có dùng subagent không, và còn rủi ro hoặc next step nào cần người review.</p>
111
+ </div>
112
+
113
+ <div class="callout">
114
+ <strong>Release docs gate</strong>
115
+ <p>Version docs mới chỉ được promote lên Vercel sau khi tag-triggered CI pass và stable dry-run resolve đúng commit SHA. Phải promote đúng tagged commit, không chèn merge commit hay docs-only edit khác. Domain canonical là <span class="inline-code">piagent.io.vn</span>; apex phải là Vercel primary và <span class="inline-code">www</span> redirect về apex.</p>
116
+ </div>
117
+ </section>
118
+ <nav class="pager" aria-label="Trang kế tiếp">
119
+ <a class="pager-prev" href="/runtime">
120
+ <span class="pager-label">Trước</span>
121
+ <span class="pager-title">Runtime tools</span>
122
+ </a>
123
+ </nav>
124
+
125
+ <footer class="footer">
126
+ <p>Pi Agent Platform docs · static HTML · governed agent workflow</p>
127
+ <div class="footer-links" aria-label="External links">
128
+ <a href="https://piagent.io.vn" target="_blank" rel="noopener noreferrer">piagent.io.vn</a>
129
+ <a href="https://github.com/Vt-mmm/piagent" target="_blank" rel="noopener noreferrer">GitHub repository</a>
130
+ <a href="https://www.facebook.com/vinhtam0544/" target="_blank" rel="noopener noreferrer">Facebook profile</a>
131
+ </div>
132
+ </footer>
133
+ </div>
134
+ </main>
135
+
136
+ <aside class="toc" aria-label="Mục lục trang">
137
+ <p class="toc-title">Trên trang này</p>
138
+ <nav data-toc></nav>
139
+ </aside>
140
+ </div>
141
+ </body>
142
+ </html>
package/docs-site/workflows.html ADDED
@@ -0,0 +1,170 @@
1
+ <!doctype html>
2
+ <html lang="vi">
3
+ <head>
4
+ <meta charset="utf-8" />
5
+ <meta name="viewport" content="width=device-width, initial-scale=1" />
6
+ <title>Các luồng chính · Pi Agent Platform Docs</title>
7
+ <meta name="description" content="Chọn workflow theo intent thay vì mô tả lại policy trong prompt. Cách này giảm context lãng phí và giữ hành vi nhất quán." />
8
+ <meta name="theme-color" content="#050505" />
9
+ <link rel="canonical" href="https://piagent.io.vn/workflows" />
10
+ <link rel="icon" href="/favicon.svg" type="image/svg+xml" />
11
+ <meta property="og:title" content="Các luồng chính · Pi Agent Platform Docs" />
12
+ <meta property="og:description" content="Chọn workflow theo intent thay vì mô tả lại policy trong prompt. Cách này giảm context lãng phí và giữ hành vi nhất quán." />
13
+ <meta property="og:url" content="https://piagent.io.vn/workflows" />
14
+ <link rel="preconnect" href="https://fonts.googleapis.com" />
15
+ <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
16
+ <link
17
+ href="https://fonts.googleapis.com/css2?family=Be+Vietnam+Pro:wght@400;500;600;700;800&family=JetBrains+Mono:wght@400;500;600&display=swap"
18
+ rel="stylesheet"
19
+ />
20
+ <link rel="stylesheet" href="/assets/docs.css" />
21
+ <script src="/assets/docs.js" defer></script>
22
+ </head>
23
+ <body>
24
+ <header class="topbar">
25
+ <a class="brand" href="/" aria-label="Pi Agent Platform">
26
+ <span class="brand-mark"><img src="/assets/piagent-logo.svg" alt="" /></span>
27
+ <span>Pi Agent Platform</span>
28
+ </a>
29
+ <div class="top-actions">
30
+ <span class="pill"><span class="pill-dot"></span>v1.2.0 docs</span>
31
+ <a class="button social" href="https://github.com/Vt-mmm/piagent" target="_blank" rel="noopener noreferrer" aria-label="Mở GitHub repository">
32
+ <svg viewBox="0 0 24 24" fill="none" aria-hidden="true">
33
+ <path d="M7 17 17 7M9 7h8v8" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" />
34
+ </svg>
35
+ GitHub
36
+ </a>
37
+ <button class="button mobile-menu" type="button" data-menu>Lộ trình</button>
38
+ <a class="button" href="/commands">Commands</a>
39
+ </div>
40
+ </header>
41
+
42
+ <div class="layout with-toc">
43
+ <aside class="sidebar" data-sidebar>
44
+ <div class="sidebar-search" aria-label="Tìm trong tài liệu">
45
+ <svg viewBox="0 0 24 24" fill="none" aria-hidden="true">
46
+ <path d="M10.8 18.1a7.3 7.3 0 1 1 0-14.6 7.3 7.3 0 0 1 0 14.6Zm5.3-1.7 4.4 4.4" stroke="currentColor" stroke-width="2" stroke-linecap="round" />
47
+ </svg>
48
+ <input type="search" placeholder="Tìm trang" data-filter />
49
+ </div>
50
+
51
+ <nav aria-label="Tài liệu">
52
+ <div class="nav-group">
53
+ <p class="nav-title">Get started</p>
54
+ <a class="nav-link" href="/">Overview</a>
55
+ <a class="nav-link" href="/quickstart">Quickstart</a>
56
+ <a class="nav-link" href="/scope">Phạm vi platform</a>
57
+ </div>
58
+ <div class="nav-group">
59
+ <p class="nav-title">Build</p>
60
+ <a class="nav-link" href="/profiles">Project profile</a>
61
+ <a class="nav-link" href="/permissions">Permission modes</a>
62
+ <a class="nav-link" href="/commands">Command catalog</a>
63
+ <a class="nav-link current" href="/workflows" aria-current="page">Workflows</a>
64
+ </div>
65
+ <div class="nav-group">
66
+ <p class="nav-title">MCP</p>
67
+ <a class="nav-link" href="/mcp">MCP overview</a>
68
+ <a class="nav-link" href="/mcp-servers">Quản lý server</a>
69
+ <a class="nav-link" href="/mcp-auth">Auth và readiness</a>
70
+ <a class="nav-link" href="/mcp-approval">Approval gate</a>
71
+ </div>
72
+ <div class="nav-group">
73
+ <p class="nav-title">Operate</p>
74
+ <a class="nav-link" href="/security">Security model</a>
75
+ <a class="nav-link" href="/architecture">Architecture</a>
76
+ <a class="nav-link" href="/runtime">Runtime tools</a>
77
+ <a class="nav-link" href="/team">Team usage</a>
78
+ </div>
79
+ </nav>
80
+ </aside>
81
+
82
+ <main>
83
+ <div class="content-shell" data-article>
84
+ <nav class="breadcrumb" aria-label="Breadcrumb">
85
+ <a href="/">Docs</a>
86
+ <span aria-hidden="true">/</span>
87
+ <span>Build</span>
88
+ <span aria-hidden="true">/</span>
89
+ <span>Workflows</span>
90
+ </nav>
91
+ <div class="page-head">
92
+ <h1>Các luồng chính</h1>
93
+ <p>Chọn workflow theo intent thay vì mô tả lại policy trong prompt. Cách này giảm context lãng phí và giữ hành vi nhất quán.</p>
94
+ </div>
95
+ <section class="section">
96
+ <div class="callout ok-callout">
97
+ <strong>Git trong Pi Agent</strong>
98
+ <p>Không có namespace <span class="inline-code">/git</span> riêng. Dùng <span class="inline-code">/commit</span> để commit local đã review, dùng <span class="inline-code">/pr</span> để chuẩn bị PR. Các hành động như <span class="inline-code">git push</span> hoặc stage rộng <span class="inline-code">git add -A</span> vẫn cần operator xác nhận.</p>
99
+ </div>
100
+
101
+ <div class="callout">
102
+ <strong>Solo-first orchestration</strong>
103
+ <p>Dùng <span class="inline-code">/piagent-orchestration</span> để xem mode, max subagents, review lenses, Field Guide và writer policy. Mặc định parent agent tự làm chính; subagents chỉ dùng khi scout, planning hoặc review có lane độc lập đáng token.</p>
104
+ </div>
105
+
106
+ <div class="command-grid">
107
+ <article class="command-card">
108
+ <header><span>Implementation bounded</span><button class="clip-btn" data-clip="/task Fix the failing checkout test and verify.">Lấy lệnh</button></header>
109
+ <pre><code>/task Fix the failing checkout test and verify.</code></pre>
110
+ </article>
111
+ <article class="command-card">
112
+ <header><span>Read-only scout</span><button class="clip-btn" data-clip="/scout Map the auth flow and risk areas.">Lấy lệnh</button></header>
113
+ <pre><code>/scout Map the auth flow and risk areas.</code></pre>
114
+ </article>
115
+ <article class="command-card">
116
+ <header><span>Plan trước khi code</span><button class="clip-btn" data-clip="/plan Add multi-tenant billing support.">Lấy lệnh</button></header>
117
+ <pre><code>/plan Add multi-tenant billing support.</code></pre>
118
+ </article>
119
+ <article class="command-card">
120
+ <header><span>Review diff</span><button class="clip-btn" data-clip="/review">Lấy lệnh</button></header>
121
+ <pre><code>/review</code></pre>
122
+ </article>
123
+ <article class="command-card">
124
+ <header><span>Commit local có guard</span><button class="clip-btn" data-clip="/commit &quot;feat: add guarded git workflow&quot;">Lấy lệnh</button></header>
125
+ <pre><code>/commit "feat: add guarded git workflow"</code></pre>
126
+ </article>
127
+ <article class="command-card">
128
+ <header><span>Chuẩn bị pull request</span><button class="clip-btn" data-clip="/pr &quot;Prepare PR for guarded git workflow&quot;">Lấy lệnh</button></header>
129
+ <pre><code>/pr "Prepare PR for guarded git workflow"</code></pre>
130
+ </article>
131
+ <article class="command-card">
132
+ <header><span>Backend spec sang frontend</span><button class="clip-btn" data-clip="/be-to-fe Implement frontend support for the new user status endpoint.">Lấy lệnh</button></header>
133
+ <pre><code>/profile be-readonly-fe
134
+ /be-to-fe Implement frontend support for the new user status endpoint.</code></pre>
135
+ </article>
136
+ <article class="command-card">
137
+ <header><span>Cải thiện platform</span><button class="clip-btn" data-clip="/platform-improve Harden command docs and run verification.">Lấy lệnh</button></header>
138
+ <pre><code>/platform-improve Harden command docs and run verification.</code></pre>
139
+ </article>
140
+ </div>
141
+ </section>
142
+ <nav class="pager" aria-label="Trang kế tiếp">
143
+ <a class="pager-prev" href="/commands">
144
+ <span class="pager-label">Trước</span>
145
+ <span class="pager-title">Command catalog</span>
146
+ </a>
147
+ <a class="pager-next" href="/mcp">
148
+ <span class="pager-label">Tiếp</span>
149
+ <span class="pager-title">MCP overview</span>
150
+ </a>
151
+ </nav>
152
+
153
+ <footer class="footer">
154
+ <p>Pi Agent Platform docs · static HTML · governed agent workflow</p>
155
+ <div class="footer-links" aria-label="External links">
156
+ <a href="https://piagent.io.vn" target="_blank" rel="noopener noreferrer">piagent.io.vn</a>
157
+ <a href="https://github.com/Vt-mmm/piagent" target="_blank" rel="noopener noreferrer">GitHub repository</a>
158
+ <a href="https://www.facebook.com/vinhtam0544/" target="_blank" rel="noopener noreferrer">Facebook profile</a>
159
+ </div>
160
+ </footer>
161
+ </div>
162
+ </main>
163
+
164
+ <aside class="toc" aria-label="Mục lục trang">
165
+ <p class="toc-title">Trên trang này</p>
166
+ <nav data-toc></nav>
167
+ </aside>
168
+ </div>
169
+ </body>
170
+ </html>
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@piagent/platform",
3
- "version": "1.1.8",
3
+ "version": "1.2.0",
4
4
  "license": "MIT",
5
5
  "publishConfig": {
6
6
  "access": "public",
@@ -117,13 +117,15 @@
117
117
  "audit:runtime": "bash scripts/audit-runtime-host.sh",
118
118
  "release:identity": "node scripts/verify-release-identity.mjs",
119
119
  "vercel:preflight": "node scripts/verify-vercel-link.mjs",
120
+ "site:build": "node scripts/build-docs-site.mjs",
121
+ "site:preview": "node scripts/preview-docs-site.mjs",
120
122
  "site:check": "node scripts/check-published-site.mjs",
121
123
  "smoke": "bash scripts/runtime-policy-smoke.sh",
122
124
  "usage": "bash scripts/pi-session-stats.sh",
123
125
  "auto": "bash scripts/pi-auto.sh",
124
126
  "models": "bash scripts/pi-model-catalog.sh",
125
127
  "model-scope": "bash scripts/configure-model-scope.sh",
126
- "mcp": "bash scripts/configure-mcp.sh",
128
+ "mcp": "node scripts/mcp-manage.mjs",
127
129
  "subagents": "bash scripts/configure-subagents.sh",
128
130
  "capabilities:check": "node scripts/capability-catalog.mjs catalog --check",
129
131
  "capabilities:catalog": "node scripts/capability-catalog.mjs catalog --write",
package/packages/piagent-core/capabilities/capability-core.js CHANGED
@@ -808,7 +808,23 @@ function buildCoreIntegrity(root) {
808
808
  // for a different reason: it starts a process on session start and puts a
809
809
  // line in the operator's terminal, so tampering with it buys code execution
810
810
  // and a message the operator has been trained to trust.
811
- "packages/piagent-core/extensions/update-check.js"
811
+ "packages/piagent-core/extensions/update-check.js",
812
+ // The MCP files decide which servers a session may call. mcp-approval-store.js
813
+ // holds the decision itself, mcp-auth-readiness.js turns it into the verdict
814
+ // the guard acts on, and mcp-config-layers.js says which layers a repository
815
+ // can reach and therefore which servers the gate covers at all. Editing any of
816
+ // the three turns off the gate that stops a cloned repository from running its
817
+ // own MCP server here.
818
+ "packages/piagent-core/mcp/mcp-approval-store.js",
819
+ "packages/piagent-core/mcp/mcp-auth-readiness.js",
820
+ "packages/piagent-core/mcp/mcp-config-layers.js",
821
+ // mcp-session-view.js reports which servers are approved and which are not,
822
+ // and mcp-command-actions.js is what `/piagent-mcp approve` runs. An
823
+ // operator decides based on the definition these two put in front of them,
824
+ // so a file that can lie about what a server runs is a way to collect a
825
+ // decision that was never really made.
826
+ "packages/piagent-core/mcp/mcp-session-view.js",
827
+ "packages/piagent-core/mcp/mcp-command-actions.js"
812
828
  ];
813
829
  return files.map((relativePath) => {
814
830
  const resolved = resolveRegularFile(root, relativePath, MAX_ARTIFACT_BYTES);
package/packages/piagent-core/extensions/document-intake.ts CHANGED
@@ -13,11 +13,11 @@ import zlib from "node:zlib";
13
13
  // operator has to copy files into the repository just to be read, which is how
14
14
  // vendor PDFs end up committed.
15
15
  //
16
- // Both reference CLIs treat read as the permissive axis and write as the scoped
17
- // one: Claude Code grants extra directories through `additionalDirectories` and
18
- // `--add-dir` and then reads them without prompting, and Codex scopes
19
- // `writable_roots` while leaving reads broad. This follows that shape with one
20
- // extra restriction — inside a granted root only document extensions open, so
16
+ // The established shape for agent CLIs is to treat read as the permissive axis
17
+ // and write as the scoped one: extra directories are granted and then read
18
+ // without prompting, while the set of writable roots stays narrow. This follows
19
+ // that shape with one extra restriction — inside a granted root only document
20
+ // extensions open, so
21
21
  // granting ~/Downloads does not also hand over an installer or a key file that
22
22
  // happens to be sitting there.
23
23
  //