@piagent/platform 1.11.1 → 1.12.0

package/docs-site/en/whats-new.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.11.1 docs · EN</span>
+        <span class="pill"><span class="pill-dot"></span>v1.12.0 docs · EN</span>
         <nav class="language-switch" aria-label="Language">
           <a class="language-option" href="/whats-new" hreflang="vi" lang="vi">VI</a>
           <a class="language-option current" href="/en/whats-new" hreflang="en" lang="en" aria-current="true">EN</a>
@@ -103,6 +103,18 @@
               <h1>1.9.0: ask in plain language, the team's Harness checks</h1>
               <p>The task contract and workflow commands are gone. Company mode asks for checks and a review on its own; Stop, network commands on approval and clearer approval cards.</p>
             </div>
+<section class="section">
+  <p class="section-kicker">v1.12.0 · 2026-10-06</p>
+  <h2 id="v1-12-0">@ any folder, skills from /, and tests in the company sandbox</h2>
+  <p class="section-lead">Point the agent at exactly the file or folder to read, reuse the skills and commands you already keep, and let the agent run the project's unit and integration tests.</p>
+  <div class="grid cols-2">
+    <article class="card"><h3 id="at-mentions">@ files and folders</h3><p>Type <code>@</code> in the composer to pick the project's files and folders; type <code>~/</code> or <code>/</code> for any other folder on the Mac. The agent reads folders outside the project for reference, read-only; hidden home files, <code>~/Library</code> and credential files stay closed.</p></article>
+    <article class="card"><h3 id="kept-drafts">Unsent messages are kept</h3><p>A message typed in a conversation or in the new chat is still there after opening another conversation or reloading the page, with its attached files.</p></article>
+    <article class="card"><h3 id="skills-commands">Skills and commands</h3><p>Skills and commands in the project's and your <code>.claude</code>, <code>.codex</code>, <code>.agents</code> and <code>.pi</code> folders work as they are: the model sees the skills, and a <code>/</code> at the start of a message offers <code>/command</code> and <code>/skill:name</code>.</p></article>
+    <article class="card"><h3 id="tests-in-sandbox">Tests in the company sandbox</h3><p>Package caches kept per project (npm, pnpm, pip, uv, Go, Cargo, Gradle, Maven, NuGet…), servers and databases on localhost, the selected Xcode, JDKs, .NET. Run <code>piagent studio --doctor</code> to see which languages are ready. Docker and the iOS Simulator are not available in the sandbox yet.</p></article>
+  </div>
+</section>
+
 <section class="section">
   <p class="section-kicker">v1.11.1 · 2026-10-05</p>
   <h2 id="v1-11-1">An update ends on the new release's dashboard</h2>

package/docs-site/en/workflows.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.11.1 docs · EN</span>
+        <span class="pill"><span class="pill-dot"></span>v1.12.0 docs · EN</span>
         <nav class="language-switch" aria-label="Language">
           <a class="language-option" href="/workflows" hreflang="vi" lang="vi">VI</a>
           <a class="language-option current" href="/en/workflows" hreflang="en" lang="en" aria-current="true">EN</a>

package/docs-site/index.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.11.1 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.12.0 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/" hreflang="en" lang="en">EN</a>
@@ -93,7 +93,7 @@
       <main>
         <div class="content-shell" data-article>
 <section class="hero">
-  <p class="eyebrow">Piagent 1.11.1</p>
+  <p class="eyebrow">Piagent 1.12.0</p>
   <h1>Coding agent cho cả team, kiểm tra từng bước.</h1>
   <p>
     Một dashboard cho Terminal và trình duyệt. Dùng model bằng tài khoản của bạn, hoặc model của công ty qua Agent Watch và Agent Studio. Guard kiểm tra từng tool call; ở chế độ công ty, Harness của team tự yêu cầu chạy check, cho subagent review và báo kết quả ngay dưới câu trả lời.
@@ -107,7 +107,7 @@
   <div class="hero-actions">
     <a class="button primary" href="/quickstart">Bắt đầu</a>
     <a class="button" href="/ecosystem">Hệ sinh thái</a>
-    <a class="button" href="/whats-new">Có gì mới trong 1.11.1</a>
+    <a class="button" href="/whats-new">Có gì mới trong 1.12.0</a>
     <a class="button" href="/commands">Xem command</a>
   </div>
 </section>
@@ -183,9 +183,9 @@ piagent-setup</code></pre>
   <h2 id="bat-dau-tu-dau">Bắt đầu từ đâu</h2>
   <div class="card-grid">
     <a class="doc-card" href="/whats-new">
-      <span class="card-kicker">Bản 1.11.1</span>
+      <span class="card-kicker">Bản 1.12.0</span>
       <h3>Có gì mới</h3>
-      <p>Cập nhật xong là dashboard chạy bản mới; ở 1.11.0: cập nhật Pi và Piagent bằng một nút, bảng lệnh ⌘K và Cài đặt tìm được.</p>
+      <p>@ chọn file và folder trên máy, giữ tin nhắn đang soạn, skill và command dùng bằng /, sandbox công ty chạy được test của nhiều ngôn ngữ.</p>
     </a>
     <a class="doc-card" href="/ecosystem">
       <span class="card-kicker">Get started</span>

package/docs-site/mcp-approval.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.11.1 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.12.0 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/mcp-approval" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/mcp-approval" hreflang="en" lang="en">EN</a>

package/docs-site/mcp-auth.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.11.1 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.12.0 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/mcp-auth" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/mcp-auth" hreflang="en" lang="en">EN</a>

package/docs-site/mcp-servers.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.11.1 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.12.0 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/mcp-servers" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/mcp-servers" hreflang="en" lang="en">EN</a>

package/docs-site/mcp.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.11.1 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.12.0 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/mcp" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/mcp" hreflang="en" lang="en">EN</a>

package/docs-site/permissions.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.11.1 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.12.0 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/permissions" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/permissions" hreflang="en" lang="en">EN</a>

package/docs-site/profiles.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.11.1 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.12.0 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/profiles" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/profiles" hreflang="en" lang="en">EN</a>

package/docs-site/quickstart.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.11.1 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.12.0 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/quickstart" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/quickstart" hreflang="en" lang="en">EN</a>

package/docs-site/runtime.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.11.1 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.12.0 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/runtime" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/runtime" hreflang="en" lang="en">EN</a>

package/docs-site/scope.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.11.1 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.12.0 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/scope" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/scope" hreflang="en" lang="en">EN</a>

package/docs-site/security.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.11.1 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.12.0 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/security" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/security" hreflang="en" lang="en">EN</a>

package/docs-site/team.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.11.1 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.12.0 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/team" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/team" hreflang="en" lang="en">EN</a>

package/docs-site/whats-new.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.11.1 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.12.0 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/whats-new" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/whats-new" hreflang="en" lang="en">EN</a>
@@ -103,6 +103,18 @@
               <h1>Bản 1.9.0: nói việc bằng lời, Harness của team kiểm tra</h1>
               <p>Bỏ task contract và lệnh workflow. Chế độ công ty tự yêu cầu check và review; nút Dừng, lệnh có mạng theo lần duyệt và thẻ duyệt dễ đọc hơn.</p>
             </div>
+<section class="section">
+  <p class="section-kicker">v1.12.0 · 2026-10-06</p>
+  <h2 id="v1-12-0">@ tới mọi folder, skill dùng bằng /, và test chạy được trong sandbox công ty</h2>
+  <p class="section-lead">Chỉ cho agent đúng file hay folder cần đọc, dùng lại skill và command đã có, và để agent tự chạy unit test lẫn integration test của project.</p>
+  <div class="grid cols-2">
+    <article class="card"><h3 id="at-mentions">@ file và folder</h3><p>Gõ <code>@</code> trong khung chat để chọn file, folder của project; gõ <code>~/</code> hoặc <code>/</code> để chọn folder khác trên máy. Agent đọc được folder ngoài project, chỉ đọc; file ẩn trong home, <code>~/Library</code> và file chứa credential vẫn bị chặn.</p></article>
+    <article class="card"><h3 id="kept-drafts">Giữ tin nhắn đang soạn</h3><p>Tin nhắn gõ dở ở mỗi cuộc trò chuyện và ở khung chat mới vẫn còn khi chuyển sang cuộc trò chuyện khác hay tải lại trang, cùng file đã đính kèm.</p></article>
+    <article class="card"><h3 id="skills-commands">Skill và command</h3><p>Skill và command trong <code>.claude</code>, <code>.codex</code>, <code>.agents</code> và <code>.pi</code> của project và trên máy dùng được ngay: model thấy danh sách skill, gõ <code>/</code> ở đầu tin nhắn để chọn <code>/command</code> hoặc <code>/skill:tên</code>.</p></article>
+    <article class="card"><h3 id="tests-in-sandbox">Test trong sandbox công ty</h3><p>Cache package giữ theo project (npm, pnpm, pip, uv, Go, Cargo, Gradle, Maven, NuGet…), server và database trên localhost, Xcode đã chọn, JDK, .NET. Chạy <code>piagent studio --doctor</code> để xem ngôn ngữ nào sẵn sàng. Docker và iOS Simulator chưa dùng được trong sandbox.</p></article>
+  </div>
+</section>
+
 <section class="section">
   <p class="section-kicker">v1.11.1 · 2026-10-05</p>
   <h2 id="v1-11-1">Cập nhật xong là dashboard chạy bản mới</h2>

package/docs-site/workflows.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.11.1 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.12.0 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/workflows" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/workflows" hreflang="en" lang="en">EN</a>

package/evals/private-holdout-v1/public-exposure.v2.json

@@ -256,8 +256,8 @@
     },
     {
       "path": "tests",
-      "fileCount": 518,
-      "sha256": "92327b355aae9153c31a8dcf39be2b15b9ef2d0e9036e83b048c98ec5872f17a"
+      "fileCount": 521,
+      "sha256": "a070df51c583ffb57a918ece6e2afa9347e9f5a2fe895882232e9da6623be8d1"
     }
   ],
   "custodianComparisonRules": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@piagent/platform",
-  "version": "1.11.1",
+  "version": "1.12.0",
   "license": "MIT",
   "publishConfig": {
     "access": "public",

package/packages/piagent-core/extensions/piagent-guard.ts

@@ -18,7 +18,7 @@ import {
   resolveRepositoryPathCandidate, shellGlobTargetsProtectedPath,
   unresolvedExpansionReason
 } from "./shell-reach.ts";
-import { grantedSourceCheckoutRootForPath, shellTouchesGrantedSourceCheckout } from "./source-checkout-paths.ts";
+import { grantedSourceCheckoutRootForPath, piToolPathInput, referenceReadRootForPath, shellTouchesGrantedSourceCheckout } from "./source-checkout-paths.ts";
 import { experimentLoopDecision } from "./experiment-loop-policy.ts";
 import { extractShellWritePathCandidates } from "./shell-write-targets.js";
 import { isProjectMutatingShellCommand } from "./readonly-inline-inspection.ts";
@@ -163,6 +163,8 @@ import { finalGateConfig } from "./acceptance-diagnostic-policy.ts";
 import { fallbackBasePolicy } from "./fallback-base-policy.ts";
 import { prefixCompletions, registerPiagentTool as registerToolDefinition, registerRuntimeCommand, registerRuntimeTool } from "../runtime/registration/extension-registration.ts";
 import { registerTaskEvidenceTools } from "../runtime/registration/task-evidence-tools.ts";
+import { registerAgentResources } from "../runtime/registration/agent-resources.ts";
+import { userSkillFolders } from "../runtime/resources/agent-resources.mjs";
 import { FRESH_COMMAND_ACTIONS, FRESH_COMMAND_HELP, ONBOARDING_COMMAND_ACTIONS, WORKFLOW_COMMAND_EXCLUSIONS } from "../runtime/registration/operator-catalogs.ts";
 import { registerPiagentStatusCommand } from "../runtime/registration/runtime-model-status.ts";
 import { registerTaskPreflightCommand } from "../runtime/registration/task-preflight.ts";
@@ -348,9 +350,10 @@ const DEFAULT_POLICY = fallbackBasePolicy(CONTEXT_INDEX_FILE, DEFAULT_ORCHESTRAT
 // so it is resolved once here rather than threaded through every profile load.
 const PLATFORM_ROOT = findPlatformRoot(path.dirname(fileURLToPath(import.meta.url)));
 // The skills Pi lists for the model are read where they are installed: this
-// package's and the user's. Reading them is allowed; writes stay in the project.
+// package's and the user's (also those kept for other coding agents, such as
+// ~/.claude/skills). Reading them is allowed; writes stay in the project.
 const SKILL_READ_ROOTS = [path.join(PLATFORM_ROOT, "packages", "piagent-core", "skills"),
-  path.join(process.env.PI_CODING_AGENT_DIR || path.join(os.homedir(), ".pi", "agent"), "skills")]
+  path.join(process.env.PI_CODING_AGENT_DIR || path.join(os.homedir(), ".pi", "agent"), "skills"), ...userSkillFolders()]
   .flatMap((root) => { try { return [fs.realpathSync.native(root)]; } catch { return []; } });
 const UPDATE_CHECK_MODULE = fileURLToPath(new URL("./update-check.js", import.meta.url));
 // The installed version, read from the package this file ships in. A maintainer
@@ -924,11 +927,12 @@ function evaluatePathLikeToolAccess(
     sourceCheckoutReadRoots?: string[];
   } = {}
 ): { block: boolean; reason?: string } {
-  const scopeAwareTool = options.forceScopeAware === true || ["read", "write", "edit", "grep", "find", "ls"].includes(toolName)
+  const piFileTool = ["read", "write", "edit", "grep", "find", "ls"].includes(toolName);
+  const scopeAwareTool = options.forceScopeAware === true || piFileTool
     || /(?:^|[_-])(?:fs|filesystem)(?:[_-]|$)/i.test(toolName);
   const inspection = inspectPathInputsFromInput(
     cwd,
-    input,
+    piFileTool ? piToolPathInput(input) : input,
     usesFilesystemContentFields(toolName, options.allowAmbiguousFilesystemContentFields !== false)
   );
   if (inspection.maxDepthExceeded) {
@@ -966,6 +970,7 @@ function evaluatePathLikeToolAccess(
     const fieldAccessMode = filesystemFieldAccessMode(toolName, item.field, writesFilesystem);
     const sourceCheckoutReadRoot = fieldAccessMode === "read"
       ? grantedSourceCheckoutRootForPath(cwd, item.path, options.sourceCheckoutReadRoots ?? [])
+        ?? (piFileTool && !writesFilesystem ? referenceReadRootForPath(cwd, item.path) : undefined)
       : undefined;
     if (scopeAwareTool && isFilesystemScopeField(item.field)) {
       const boundary = inspectRepositoryPathBoundary(cwd, item.path);
@@ -4144,5 +4149,6 @@ export default function piagentGuard(pi: ExtensionAPI) {
   // registers. The completion module holds only task-bound tools (memory
   // citations need a task id), so it is no longer registered at all.
   registerTaskEvidenceTools(pi, registrationDeps);
+  registerAgentResources(pi);
   registerSessionCommands(pi, { ...registrationDeps, ...contextCommandApi });
 }

package/packages/piagent-core/extensions/source-checkout-paths.ts

@@ -1,4 +1,5 @@
 import fs from "node:fs";
+import os from "node:os";
 import path from "node:path";
 
 import { extractShellPathCandidates, normalizePathCandidate } from "./policy-core.js";
@@ -24,6 +25,36 @@ export function grantedSourceCheckoutRootForPath(cwd: string, candidate: string,
   return roots.find((root) => inside(root, canonical));
 }
 
+// Folders a member points the agent to for reference (an @ mention, "read
+// ~/Documents/old-shop"): their own files, external drives and the shared
+// folder, read with read, grep, find or ls. Hidden entries of the home folder
+// (shell files, histories, tool configs) and ~/Library (app data, mail,
+// browser profiles) stay closed; a link is judged by where it leads.
+export function referenceReadRootForPath(cwd: string, candidate: string): string | undefined {
+  let target: string, home: string;
+  try {
+    target = fs.realpathSync.native(path.resolve(cwd, normalizePathCandidate(candidate)));
+    home = fs.realpathSync.native(os.homedir());
+  } catch {
+    return undefined;
+  }
+  if (inside(home, target)) {
+    const first = path.relative(home, target).split(path.sep)[0];
+    return first.startsWith(".") || first === "Library" ? undefined : home;
+  }
+  return ["/Volumes", "/Users/Shared", "/private/tmp"].find((root) => inside(root, target));
+}
+
+// Pi's own file tools drop a leading @ (an @path mention) and expand ~ to the
+// home folder before they open a path: check the path they will open.
+export function piToolPathInput(input: Record<string, unknown>): Record<string, unknown> {
+  const value = input.path;
+  if (typeof value !== "string") return input;
+  const bare = value.startsWith("@") ? value.slice(1) : value;
+  const opened = bare === "~" ? os.homedir() : bare.startsWith("~/") ? path.join(os.homedir(), bare.slice(2)) : bare;
+  return opened === value ? input : { ...input, path: opened };
+}
+
 // A shell command can name a file it is about to create. realpath fails for that
 // file, so resolve its nearest existing parent instead; otherwise a new file in
 // the cache, spelled through an alias such as /var for /private/var, escapes

package/packages/piagent-core/managed/agent-skills.mjs

@@ -0,0 +1,44 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { agentResourcePaths } from '../runtime/resources/agent-resources.mjs';
+
+// The skills and commands of the project and of the member (see
+// agent-resources.mjs), loaded with Pi's own loaders: skills are listed to
+// the model by name and description, commands become /name. Also the folders
+// the sandbox opens for reading: a skill's SKILL.md and the files it bundles,
+// where the skill is installed.
+export async function loadAgentResources(api, sdk, cwd, home) {
+  // A folder that cannot be read never keeps the conversation from opening.
+  try { return await load(api, sdk, cwd, home); }
+  catch { return { skills: [], prompts: [], readable: [], expand: (text) => text }; }
+}
+
+async function load(api, sdk, cwd, home) {
+  const { skillPaths, promptPaths } = agentResourcePaths({ cwd, ...(home ? { home } : {}) });
+  // Defaults off: no personal Pi folder is consulted, only these paths.
+  const skills = skillPaths.length ? api.loadSkills({ cwd, agentDir: cwd, skillPaths, includeDefaults: false }).skills : [];
+  const templates = await import(pathToFileURL(path.join(sdk, 'dist/core/prompt-templates.js')));
+  const prompts = promptPaths.length ? templates.loadPromptTemplates({ cwd, agentDir: cwd, promptPaths, includeDefaults: false }).templates : [];
+  const real = (dir) => { try { return fs.realpathSync(dir); } catch { return null; } };
+  const readable = [...new Set([...skillPaths, ...skills.map((skill) => real(skill.baseDir))].filter(Boolean))];
+  return { skills, prompts, readable, expand: (text) => expandCommand(text, skills, prompts, api.stripFrontmatter, templates.expandPromptTemplate) };
+}
+
+// A member's /skill:name, /command or /skill-name (as other agents call a
+// skill), expanded as Pi does: a command's prompt with its arguments, or the
+// skill's instructions followed by what the member asked. Anything else, a
+// path such as /tmp/x included, is left as typed.
+export function expandCommand(text, skills, prompts, stripFrontmatter, expandPromptTemplate) {
+  if (typeof text !== 'string' || !text.startsWith('/')) return text;
+  const space = text.search(/\s/), head = space < 0 ? text.slice(1) : text.slice(1, space);
+  const args = space < 0 ? '' : text.slice(space + 1).trim();
+  const explicit = head.startsWith('skill:'), name = explicit ? head.slice(6) : head;
+  if (!explicit && prompts.some((prompt) => prompt.name === name)) return expandPromptTemplate(text, prompts);
+  const skill = skills.find((item) => item.name === name);
+  if (!skill) return text;
+  let body;
+  try { body = stripFrontmatter(fs.readFileSync(skill.filePath, 'utf8')).trim(); } catch { return text; }
+  const block = `<skill name="${skill.name}" location="${skill.filePath}">\nReferences are relative to ${skill.baseDir}.\n\n${body}\n</skill>`;
+  return args ? `${block}\n\n${args}` : block;
+}

package/packages/piagent-core/managed/doctor.mjs

@@ -15,6 +15,12 @@ import { fetchPublicPage } from './web-fetch.mjs';
 const text = result => (result?.content ?? []).filter(part => part.type === 'text').map(part => part.text).join('\n').trim();
 const first = value => String(value ?? '').split('\n')[0].slice(0, 160);
 
+const LANGUAGES = [['pnpm', 'pnpm --version'], ['yarn', 'yarn --version'], ['bun', 'bun --version'], ['deno', 'deno --version'], ['uv', 'uv --version'],
+  ['poetry', 'poetry --version'], ['go', 'go version'], ['rust (cargo)', 'cargo --version'], ['java', 'javac -version', 'test -n "$JAVA_HOME"'], ['maven', 'mvn -v'],
+  ['gradle', 'gradle --version --offline'], ['kotlin', 'kotlinc -version'], ['.NET', 'dotnet --version'], ['php', 'php --version'], ['composer', 'composer --version'],
+  ['ruby', 'ruby --version'], ['bundler', 'bundle --version'], ['swift', 'swift --version'], ['dart', 'dart --version'], ['flutter', 'flutter --version --suppress-analytics'],
+  ['elixir', 'elixir --version']];
+
 export async function runDoctor({ sdkRoot, origin, broker, network = true }) {
   const results = [];
   const check = async (label, required, run) => {
@@ -47,10 +53,12 @@ export async function runDoctor({ sdkRoot, origin, broker, network = true }) {
       await boundary.invoke('write', { path: 'Dự án mới/ghi chú.md', content: 'ổn\n' });
       if (await bash("cat 'Dự án mới/ghi chú.md'") !== 'ổn') throw Error('content changed'); return 'ok';
     });
-    await check('files outside the project stay out of reach', true, async () => {
+    await check('folders outside the project are read-only', true, async () => {
       let refused = false; try { await boundary.invoke('write', { path: '../piagent-doctor-outside.txt', content: 'x' }); } catch { refused = true; }
       if (!refused) { fs.rmSync(path.join(path.dirname(project), 'piagent-doctor-outside.txt'), { force: true }); throw Error('a write outside the project was allowed'); }
-      return 'refused';
+      // A folder the member points to for reference (@~/…) is readable.
+      await boundary.invoke('ls', { path: '~' });
+      return 'read, write refused';
     });
     await check('commands have no network unless approved', true, async () => {
       let refused = false; try { await bash('curl -sS -m 5 https://example.com/ >/dev/null'); } catch { refused = true; }
@@ -70,6 +78,19 @@ export async function runDoctor({ sdkRoot, origin, broker, network = true }) {
       await bash('cc main.c -o main && ./main'); return first(await bash('cc --version'));
     });
     await check('make', false, () => bash('make --version'));
+    // Tests that start a server or use a local database (tool-boundary.mjs).
+    await check('tests reach servers on this Mac (localhost)', false, async () => {
+      await boundary.invoke('write', { path: 'loopback.mjs', content: "import http from 'node:http'; const s = http.createServer((q, r) => r.end('ok')); s.listen(0, '127.0.0.1', async () => { console.log(await (await fetch(`http://127.0.0.1:${s.address().port}/`)).text()); s.close(); });\n" });
+      try { return await bash('node loopback.mjs'); }
+      catch (error) { throw Error(/loopback-blocked/.test(String(error?.message)) ? 'a local proxy listens on this Mac: tests that use localhost need run_with_network' : first(String(error?.message))); }
+    });
+    await check('package caches kept for the project', false, async () => { await bash('mkdir -p "$npm_config_cache" && touch "$npm_config_cache/.piagent-doctor"'); return boundary.packageCache; });
+    // The languages installed on this Mac, each started once in the sandbox.
+    // (macOS ships stubs for some, such as javac without a JDK: a probe decides.)
+    for (const [label, command, probe = `command -v ${command.split(' ')[0]} >/dev/null`] of LANGUAGES) {
+      if (await bash(`${probe} && echo yes || true`) !== 'yes') continue;
+      await check(label, false, async () => first(await bash(`${command} 2>&1`)));
+    }
     if (network) await check('web_fetch reads a public page', false, async () => `status ${(await fetchPublicPage('https://example.com/', { maxChars: 1000 })).status}`);
   } finally { await boundary?.dispose(); fs.rmSync(project, { recursive: true, force: true }); }
   if (broker) {

package/packages/piagent-core/managed/language-environment.mjs

@@ -0,0 +1,118 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { execFileSync } from 'node:child_process';
+
+// What test runners and package managers of the common languages need in the
+// company sandbox beyond the toolchains themselves (toolchain.mjs):
+// - package caches that persist for the project between conversations,
+//   outside the project and private to it: the first install asks for
+//   network (run_with_network), later runs work offline;
+// - the member's own dependency caches as read-only seeds, where the tool can
+//   layer one (Go, Gradle, Maven), so what is already downloaded is reused;
+// - runtimes installed in places the sandbox otherwise keeps closed (JDKs
+//   under ~/Library/Java, the Android SDK, the system gem folder, MacPorts);
+// - SwiftPM and xcodebuild, which cannot start their own sandbox inside this
+//   one: their manifest sandbox is off; this sandbox confines the same
+//   processes.
+const KEEP_DAYS = 30;
+const existing = dir => { try { const real = fs.realpathSync(dir); return fs.statSync(real).isDirectory() ? real : null; } catch { return null; } };
+
+// Unused project caches are removed after a month.
+function prune(root, keep) {
+  let entries = [];
+  try { entries = fs.readdirSync(root, { withFileTypes: true }); } catch { return; }
+  const limit = Date.now() - KEEP_DAYS * 24 * 60 * 60 * 1000;
+  for (const entry of entries) {
+    const dir = path.join(root, entry.name);
+    try { if (entry.isDirectory() && dir !== keep && fs.statSync(dir).mtimeMs < limit) fs.rmSync(dir, { recursive: true, force: true }); } catch { /* in use or gone */ }
+  }
+}
+
+function javaHome(userHome) {
+  try {
+    const home = execFileSync('/usr/libexec/java_home', [], { encoding: 'utf8', timeout: 5000, stdio: ['ignore', 'pipe', 'ignore'], env: { HOME: userHome, PATH: '/usr/bin:/bin' } }).trim();
+    return existing(home);
+  } catch { return null; }
+}
+
+// SwiftPM and xcodebuild start sandbox-exec for package manifests and
+// plugins; inside this sandbox that fails ("sandbox_apply: Operation not
+// permitted"). These wrappers, first on PATH, pass the switch that turns it
+// off, then run the member's own swift/xcodebuild found further on PATH.
+const SWIFT_WRAPPER = `#!/bin/sh
+self=$(cd "$(dirname "$0")" && pwd -P)
+real=; IFS=:; for dir in $PATH; do [ "$dir" = "$self" ] && continue; [ -x "$dir/$(basename "$0")" ] && { real="$dir/$(basename "$0")"; break; }; done; unset IFS
+[ -n "$real" ] || { echo "$(basename "$0"): not installed" >&2; exit 127; }
+case "$(basename "$0"):$1" in
+  swift:build|swift:test|swift:run) sub=$1; shift; exec "$real" "$sub" --disable-sandbox "$@" ;;
+  swift:package) shift; exec "$real" package --disable-sandbox "$@" ;;
+  xcodebuild:*)
+    # Build products go to the project's cache (~/Library/Developer is closed).
+    derived=; case " $* " in *" -derivedDataPath "*) ;; *" -scheme "*|*" -xctestrun "*|*" -testProductsPath "*) derived="-derivedDataPath $PIAGENT_DERIVED_DATA" ;; esac
+    exec "$real" -IDEPackageSupportDisableManifestSandbox=YES -IDEPackageSupportDisablePluginExecutionSandbox=YES $derived "$@" ;;
+  *) exec "$real" "$@" ;;
+esac
+`;
+
+export function languageEnvironment({ userHome, repositoryTop, home }) {
+  const root = path.join(userHome, 'Library/Caches/Piagent/sandbox');
+  const cache = path.join(root, createHash('sha256').update(repositoryTop).digest('hex').slice(0, 24));
+  fs.mkdirSync(cache, { recursive: true, mode: 0o700 });
+  fs.chmodSync(cache, 0o700);
+  const now = new Date(); try { fs.utimesSync(cache, now, now); } catch { /* best effort */ }
+  prune(root, cache);
+  const at = name => path.join(cache, name);
+
+  // Read-only: runtimes and the member's caches used as seeds.
+  const seeds = {
+    gradle: existing(path.join(userHome, '.gradle/caches')),
+    maven: existing(path.join(userHome, '.m2/repository')),
+    go: existing(path.join(process.env.GOMODCACHE || path.join(userHome, 'go/pkg/mod'), 'cache/download')),
+    // .NET restores over TLS through the macOS Security framework, closed
+    // here: packages the member restored are read from their own folder.
+    nuget: existing(path.join(userHome, '.nuget/packages')),
+  };
+  const java = javaHome(userHome), android = existing(path.join(userHome, 'Library/Android/sdk'));
+  const readRoots = [...new Set([...Object.values(seeds), java, android, existing(path.join(userHome, 'Library/Java/JavaVirtualMachines')),
+    existing('/Library/Ruby'), existing('/opt/local')].filter(Boolean))];
+
+  const bin = path.join(home, '.piagent/bin');
+  fs.mkdirSync(bin, { recursive: true, mode: 0o700 });
+  for (const name of ['swift', 'xcodebuild']) fs.writeFileSync(path.join(bin, name), SWIFT_WRAPPER, { mode: 0o755 });
+  // pnpm's store: its own settings file, which npm does not read (an npm_config_
+  // variable would make every npm command warn about an unknown setting).
+  const pnpm = path.join(home, 'Library/Preferences/pnpm');
+  fs.mkdirSync(pnpm, { recursive: true, mode: 0o700 });
+  fs.writeFileSync(path.join(pnpm, 'rc'), `store-dir=${at('pnpm-store')}\n`, { mode: 0o600 });
+
+  const common = {
+    npm_config_cache: at('npm'), YARN_CACHE_FOLDER: at('yarn'), BUN_INSTALL_CACHE_DIR: at('bun'), DENO_DIR: at('deno'),
+    PIP_CACHE_DIR: at('pip'), UV_CACHE_DIR: at('uv'), POETRY_CACHE_DIR: at('poetry'), XDG_CACHE_HOME: at('xdg'),
+    GOPATH: at('go'), GOMODCACHE: at('go/pkg/mod'), GOCACHE: at('go/build'), GOFLAGS: '-modcacherw',
+    CARGO_HOME: at('cargo'), GRADLE_USER_HOME: at('gradle'), NUGET_PACKAGES: at('nuget'), COMPOSER_CACHE_DIR: at('composer'),
+    PUB_CACHE: at('pub'), GEM_HOME: at('gem'), BUNDLE_PATH: at('bundle'), CP_HOME_DIR: at('cocoapods'), PIAGENT_DERIVED_DATA: at('DerivedData'),
+    DOTNET_CLI_TELEMETRY_OPTOUT: '1', DOTNET_NOLOGO: '1', DOTNET_SKIP_FIRST_TIME_EXPERIENCE: '1',
+    MAVEN_OPTS: [`-Dmaven.repo.local=${at('m2/repository')}`, ...(seeds.maven ? [`-Dmaven.repo.local.tail=${seeds.maven}`] : [])].join(' '),
+    ...(seeds.gradle ? { GRADLE_RO_DEP_CACHE: seeds.gradle } : {}),
+    ...(seeds.nuget ? { NUGET_FALLBACK_PACKAGES: seeds.nuget } : {}),
+    ...(java ? { JAVA_HOME: java } : {}),
+    ...(android ? { ANDROID_HOME: android, ANDROID_SDK_ROOT: android } : {}),
+  };
+  // Go reads modules the member already has from their own cache first; an
+  // approved command then goes on to the usual proxies.
+  const seed = seeds.go ? `file://${seeds.go},` : '';
+  // .NET keeps its named mutexes (NuGet's among them) as files in
+  // /tmp/.dotnet, whatever TMPDIR says.
+  const dotnet = [path.join(userHome, '.dotnet/dotnet'), '/usr/local/share/dotnet/dotnet', '/opt/homebrew/bin/dotnet'].some(file => fs.existsSync(file));
+  if (dotnet) try { fs.mkdirSync('/private/tmp/.dotnet', { recursive: true, mode: 0o777 }); } catch { /* another user's */ }
+  return {
+    cache, readRoots, writeRoots: [cache, ...(dotnet && existing('/private/tmp/.dotnet') ? ['/private/tmp/.dotnet'] : [])], bin,
+    env: {
+      // .NET's dual-stack sockets reach 127.0.0.1 as ::ffff:127.0.0.1, which
+      // the loopback rule does not name (the test host would not connect).
+      offline: { ...common, GOPROXY: `${seed}off`, npm_config_prefer_offline: 'true', DOTNET_SYSTEM_NET_DISABLEIPV6: '1' },
+      network: { ...common, GOPROXY: `${seed}${process.env.GOPROXY || 'https://proxy.golang.org,direct'}` },
+    },
+  };
+}

package/packages/piagent-core/managed/resource-loader.mjs

@@ -22,14 +22,15 @@ export function projectInstructions(cwd, top = cwd) {
 }
 
 // Managed sessions never consult the personal trust store or execute resources
-// discovered in a project.
-export function managedResourceLoader(api, { systemPrompt, extensions = [], agentsFiles = [] } = {}) {
+// discovered in a project. Skills and commands are text (agent-skills.mjs):
+// what they ask for runs with the session's own tools.
+export function managedResourceLoader(api, { systemPrompt, extensions = [], agentsFiles = [], skills = [], prompts = [] } = {}) {
   const runtime = api.createExtensionRuntime();
   const empty = Object.freeze([]);
   return Object.freeze({
     getExtensions: () => ({ extensions, errors: empty, runtime }),
-    getSkills: () => ({ skills: empty, diagnostics: empty }),
-    getPrompts: () => ({ prompts: empty, diagnostics: empty }),
+    getSkills: () => ({ skills: [...skills], diagnostics: empty }),
+    getPrompts: () => ({ prompts: [...prompts], diagnostics: empty }),
     getThemes: () => ({ themes: empty, diagnostics: empty }),
     getAgentsFiles: () => ({ agentsFiles: agentsFiles.map((file) => ({ ...file })) }),
     getSystemPrompt: () => typeof systemPrompt === 'function' ? systemPrompt() : systemPrompt,