@piagent/platform 1.15.2 → 1.16.1

package/docs-site/en/security.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.15.2 docs · EN</span>
+        <span class="pill"><span class="pill-dot"></span>v1.16.1 docs · EN</span>
         <nav class="language-switch" aria-label="Language">
           <a class="language-option" href="/security" hreflang="vi" lang="vi">VI</a>
           <a class="language-option current" href="/en/security" hreflang="en" lang="en" aria-current="true">EN</a>

package/docs-site/en/team.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.15.2 docs · EN</span>
+        <span class="pill"><span class="pill-dot"></span>v1.16.1 docs · EN</span>
         <nav class="language-switch" aria-label="Language">
           <a class="language-option" href="/team" hreflang="vi" lang="vi">VI</a>
           <a class="language-option current" href="/en/team" hreflang="en" lang="en" aria-current="true">EN</a>

package/docs-site/en/whats-new.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.15.2 docs · EN</span>
+        <span class="pill"><span class="pill-dot"></span>v1.16.1 docs · EN</span>
         <nav class="language-switch" aria-label="Language">
           <a class="language-option" href="/whats-new" hreflang="vi" lang="vi">VI</a>
           <a class="language-option current" href="/en/whats-new" hreflang="en" lang="en" aria-current="true">EN</a>
@@ -104,6 +104,28 @@
               <h1>1.9.0: ask in plain language, the team's Harness checks</h1>
               <p>The task contract and workflow commands are gone. Company mode asks for checks and a review on its own; Stop, network commands on approval and clearer approval cards.</p>
             </div>
+<section class="section">
+  <p class="section-kicker">v1.16.1 · 2026-10-07</p>
+  <h2 id="v1-16-1">New releases are announced, checked every hour</h2>
+  <p class="section-lead">When a new Piagent is out, the dashboard opens a dialog with what will change and <strong>Update now</strong>; <strong>Later</strong> asks again after an hour. After the update, the restarted dashboard says it worked. The dashboard and the Terminal check for a new release every hour.</p>
+  <ul>
+    <li>A dashboard tab no longer loses its sign-in when another Piagent server on the machine (the company runtime, another launch) signs in.</li>
+    <li>A tab whose sign-in is gone (Piagent restarted, older than 8 hours) no longer retries with 401 errors; it says how to open Piagent again: <span class="inline-code">piagent dashboard</span> or Agent Watch.</li>
+  </ul>
+  <p>Updating from 1.16.0 needs no re-import in Agent Watch.</p>
+</section>
+
+<section class="section">
+  <p class="section-kicker">v1.16.0 · 2026-10-07</p>
+  <h2 id="v1-16-0">Bypass for company conversations</h2>
+  <p class="section-lead">Choose <strong>Bypass</strong> in the new-chat options or the conversation header ("Ask first" stays the default). Commands that need the internet (package installs, downloads, git pull, tests with a server or browser) run without asking. You are still asked before anything that pushes or sends data out (git push, publish, deploy, uploads, ssh), database migrations, deletes with an unknown target, and sudo.</p>
+  <ul>
+    <li>A helper the company Harness adds while you work is available from your next message, without a new conversation. With Studio 0.20.1 a running turn is not stopped when the Harness is saved.</li>
+    <li>Personal sessions with full access no longer ask before a broad <span class="inline-code">git add</span>; deletes, migrations and external actions are still asked.</li>
+  </ul>
+  <p>Updating from 1.15.x needs no re-import in Agent Watch.</p>
+</section>
+
 <section class="section">
   <p class="section-kicker">v1.15.2 · 2026-10-07</p>
   <h2 id="v1-15-2">Long company conversations shrink again, earlier</h2>

package/docs-site/en/windows.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.15.2 docs · EN</span>
+        <span class="pill"><span class="pill-dot"></span>v1.16.1 docs · EN</span>
         <nav class="language-switch" aria-label="Language">
           <a class="language-option" href="/windows" hreflang="vi" lang="vi">VI</a>
           <a class="language-option current" href="/en/windows" hreflang="en" lang="en" aria-current="true">EN</a>

package/docs-site/en/workflows.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.15.2 docs · EN</span>
+        <span class="pill"><span class="pill-dot"></span>v1.16.1 docs · EN</span>
         <nav class="language-switch" aria-label="Language">
           <a class="language-option" href="/workflows" hreflang="vi" lang="vi">VI</a>
           <a class="language-option current" href="/en/workflows" hreflang="en" lang="en" aria-current="true">EN</a>

package/docs-site/index.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.15.2 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.16.1 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/" hreflang="en" lang="en">EN</a>
@@ -94,7 +94,7 @@
       <main>
         <div class="content-shell" data-article>
 <section class="hero">
-  <p class="eyebrow">Piagent 1.15.2</p>
+  <p class="eyebrow">Piagent 1.16.1</p>
   <h1>Coding agent cho cả team, kiểm tra từng bước.</h1>
   <p>
     Một dashboard cho Terminal và trình duyệt. Dùng model bằng tài khoản của bạn, hoặc model của công ty qua Agent Watch và Agent Studio. Guard kiểm tra từng tool call; ở chế độ công ty, Harness của team tự yêu cầu chạy check, cho subagent review và báo kết quả ngay dưới câu trả lời.
@@ -108,7 +108,7 @@
   <div class="hero-actions">
     <a class="button primary" href="/quickstart">Bắt đầu</a>
     <a class="button" href="/ecosystem">Hệ sinh thái</a>
-    <a class="button" href="/whats-new">Có gì mới trong 1.15.2</a>
+    <a class="button" href="/whats-new">Có gì mới trong 1.16.1</a>
     <a class="button" href="/commands">Xem command</a>
   </div>
 </section>
@@ -184,9 +184,9 @@ piagent-setup</code></pre>
   <h2 id="bat-dau-tu-dau">Bắt đầu từ đâu</h2>
   <div class="card-grid">
     <a class="doc-card" href="/whats-new">
-      <span class="card-kicker">Bản 1.15.2</span>
+      <span class="card-kicker">Bản 1.16.1</span>
       <h3>Có gì mới</h3>
-      <p>Cuộc trò chuyện công ty dài tự thu gọn trở lại, sớm hơn (90% cửa sổ, muộn nhất 300k token); ở 1.15.1: Studio thấy mỗi call của model dùng để làm gì, nhiều cuộc trò chuyện trong một folder không nhận nhầm thay đổi của nhau; ở 1.15.0: subagent bị từ chối nói đúng lý do; ở 1.14: cập nhật giữ model bạn đã chọn; ở 1.13: cuộc trò chuyện giữ chỗ đang đọc, chữ của agent có định dạng, Piagent trên Windows qua WSL2: sandbox công ty bằng bubblewrap và Agent Watch cho Windows; ở 1.12: @ chọn file và folder trên máy, skill và command dùng bằng /, nhánh cuộc trò chuyện công ty gửi được tin nhắn.</p>
+      <p>Bản mới được báo bằng dialog và kiểm tra mỗi giờ, tab dashboard không còn mất đăng nhập; ở 1.16.0: Bypass cho cuộc trò chuyện công ty, đổi Harness không làm gián đoạn; ở 1.15.2: cuộc trò chuyện dài tự thu gọn trở lại; ở 1.15.1: Studio thấy mỗi call của model dùng để làm gì, nhiều cuộc trò chuyện trong một folder không nhận nhầm thay đổi của nhau; ở 1.15.0: subagent bị từ chối nói đúng lý do; ở 1.14: cập nhật giữ model bạn đã chọn; ở 1.13: cuộc trò chuyện giữ chỗ đang đọc, chữ của agent có định dạng, Piagent trên Windows qua WSL2: sandbox công ty bằng bubblewrap và Agent Watch cho Windows; ở 1.12: @ chọn file và folder trên máy, skill và command dùng bằng /, nhánh cuộc trò chuyện công ty gửi được tin nhắn.</p>
     </a>
     <a class="doc-card" href="/ecosystem">
       <span class="card-kicker">Get started</span>

package/docs-site/mcp-approval.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.15.2 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.16.1 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/mcp-approval" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/mcp-approval" hreflang="en" lang="en">EN</a>

package/docs-site/mcp-auth.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.15.2 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.16.1 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/mcp-auth" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/mcp-auth" hreflang="en" lang="en">EN</a>

package/docs-site/mcp-servers.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.15.2 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.16.1 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/mcp-servers" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/mcp-servers" hreflang="en" lang="en">EN</a>

package/docs-site/mcp.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.15.2 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.16.1 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/mcp" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/mcp" hreflang="en" lang="en">EN</a>

package/docs-site/permissions.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.15.2 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.16.1 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/permissions" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/permissions" hreflang="en" lang="en">EN</a>

package/docs-site/profiles.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.15.2 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.16.1 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/profiles" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/profiles" hreflang="en" lang="en">EN</a>

package/docs-site/quickstart.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.15.2 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.16.1 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/quickstart" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/quickstart" hreflang="en" lang="en">EN</a>

package/docs-site/runtime.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.15.2 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.16.1 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/runtime" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/runtime" hreflang="en" lang="en">EN</a>

package/docs-site/scope.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.15.2 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.16.1 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/scope" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/scope" hreflang="en" lang="en">EN</a>

package/docs-site/security.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.15.2 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.16.1 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/security" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/security" hreflang="en" lang="en">EN</a>

package/docs-site/team.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.15.2 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.16.1 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/team" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/team" hreflang="en" lang="en">EN</a>

package/docs-site/whats-new.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.15.2 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.16.1 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/whats-new" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/whats-new" hreflang="en" lang="en">EN</a>
@@ -104,6 +104,28 @@
               <h1>Bản 1.9.0: nói việc bằng lời, Harness của team kiểm tra</h1>
               <p>Bỏ task contract và lệnh workflow. Chế độ công ty tự yêu cầu check và review; nút Dừng, lệnh có mạng theo lần duyệt và thẻ duyệt dễ đọc hơn.</p>
             </div>
+<section class="section">
+  <p class="section-kicker">v1.16.1 · 2026-10-07</p>
+  <h2 id="v1-16-1">Báo bản mới rõ ràng, kiểm tra mỗi giờ</h2>
+  <p class="section-lead">Khi có bản Piagent mới, dashboard mở một dialog ghi rõ sẽ đổi gì và nút <strong>Cập nhật ngay</strong>; chọn <strong>Để sau</strong> thì 1 giờ sau nhắc lại. Cập nhật xong, dashboard mở lại báo đã thành công. Dashboard và Terminal tự kiểm tra bản mới mỗi giờ.</p>
+  <ul>
+    <li>Tab dashboard không còn bị mất đăng nhập khi một server Piagent khác trên máy (runtime công ty, lần mở khác) đăng nhập.</li>
+    <li>Tab đã hết phiên (Piagent khởi động lại, quá 8 giờ) không còn gọi lại liên tục với lỗi 401 mà nói rõ cách mở lại: <span class="inline-code">piagent dashboard</span> hoặc Agent Watch.</li>
+  </ul>
+  <p>Cập nhật từ 1.16.0 không cần nhập lại cấu hình trong Agent Watch.</p>
+</section>
+
+<section class="section">
+  <p class="section-kicker">v1.16.0 · 2026-10-07</p>
+  <h2 id="v1-16-0">Bypass cho cuộc trò chuyện công ty</h2>
+  <p class="section-lead">Chọn <strong>Bypass</strong> trong tùy chọn cuộc trò chuyện mới hoặc trên thanh đầu cuộc trò chuyện ("Hỏi trước" vẫn là mặc định). Lệnh cần internet (cài package, tải file, git pull, test có server hay browser) chạy luôn, không hỏi. Vẫn hỏi trước khi đẩy hoặc gửi dữ liệu ra ngoài (git push, publish, deploy, upload, ssh), chạy migration database, xóa mà không rõ đích hoặc dùng sudo.</p>
+  <ul>
+    <li>Harness công ty thêm subagent trong lúc bạn đang làm: dùng được ngay từ tin nhắn kế tiếp, không cần mở cuộc trò chuyện mới. Với Studio 0.20.1, lượt đang chạy không bị dừng khi Harness được lưu.</li>
+    <li>Phiên cá nhân "Toàn quyền" không còn hỏi trước <span class="inline-code">git add</span> toàn bộ; xóa, migration và thao tác ra ngoài vẫn hỏi.</li>
+  </ul>
+  <p>Cập nhật từ 1.15.x không cần nhập lại cấu hình trong Agent Watch.</p>
+</section>
+
 <section class="section">
   <p class="section-kicker">v1.15.2 · 2026-10-07</p>
   <h2 id="v1-15-2">Cuộc trò chuyện công ty dài tự thu gọn trở lại, và sớm hơn</h2>

package/docs-site/windows.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.15.2 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.16.1 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/windows" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/windows" hreflang="en" lang="en">EN</a>

package/docs-site/workflows.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.15.2 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.16.1 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/workflows" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/workflows" hreflang="en" lang="en">EN</a>

package/evals/private-holdout-v1/public-exposure.v2.json

@@ -256,8 +256,8 @@
     },
     {
       "path": "tests",
-      "fileCount": 524,
-      "sha256": "d35f964fb3f4cc90d79f2f65ada154f81f255fc44c3861e473bffab813189afd"
+      "fileCount": 525,
+      "sha256": "c9ef8c449f71514ed8f32161be6d5280ea4ccd702341cc5ca645c9e51f70fb7f"
     }
   ],
   "custodianComparisonRules": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@piagent/platform",
-  "version": "1.15.2",
+  "version": "1.16.1",
   "license": "MIT",
   "publishConfig": {
     "access": "public",

package/packages/piagent-core/extensions/piagent-guard.ts

@@ -547,6 +547,9 @@ function verifyProjectCapabilityState(
   }
 }
 
+// Exec-policy prompts a full-access session does not show: local, reversible.
+const FULL_ACCESS_SKIPPED_PROMPTS = ["prompt-git-add-broad"];
+
 function evaluateExecPolicy(command: string, profile: ProjectProfile, policy: BasePolicy): {
   mode: RuntimePolicySettings["execPolicy"];
   decision: "allow" | "prompt" | "forbid";
@@ -3953,7 +3956,11 @@ export default function piagentGuard(pi: ExtensionAPI) {
         return { block: true, reason: unresolvedExpansionReason("Command", unresolvedExpansions) };
       }
 
-      const confirmationReasons = execDecision.mode !== "off" && execDecision.decision === "prompt" ? [...execDecision.reasons] : [];
+      // Full access skips the prompts for local, reversible steps; deletes,
+      // migrations and anything sent outside this machine are still asked.
+      const confirmationReasons = (execDecision.mode !== "off" && execDecision.decision === "prompt" ? [...execDecision.reasons] : [])
+        .filter((reason) => permissionProfile.mode !== "trusted-full-access"
+          || !FULL_ACCESS_SKIPPED_PROMPTS.some((id) => reason.startsWith(`Prompt required by exec policy ${id}:`)));
       const externalReason = findShellExternalConfirmationReason(execDecision.segments, externalActionPolicyConfig(policy));
       if (externalReason) confirmationReasons.push(externalReason);
       if (confirmationReasons.length > 0) {

package/packages/piagent-core/extensions/update-check.js

@@ -6,7 +6,7 @@ import { fileURLToPath } from "node:url";
 
 // Telling someone a new release exists is only useful if it costs them nothing.
 // A session start that waits on the registry pays a network round trip every
-// time Pi opens, for information that changes a few times a month, so the check
+// time Pi opens, for information that can change several times a day, so the check
 // never runs in the session's path: the session reads a cache file and, when
 // that cache is old, leaves a detached process behind to refresh it. The notice
 // lands on this session if the cache already knew, and on the next one if it did
@@ -20,7 +20,7 @@ import { fileURLToPath } from "node:url";
 
 const HELPER_PACKAGE = "@piagent/platform";
 const CACHE_FILE = "piagent-update-check.json";
-const CACHE_TTL_MS = 24 * 60 * 60 * 1000;
+const CACHE_TTL_MS = 60 * 60 * 1000;
 const PROBE_TIMEOUT_MS = 10_000;
 const MAX_CACHE_BYTES = 4096;
 const RELEASE_VERSION = /^(0|[1-9]\d{0,8})\.(0|[1-9]\d{0,8})\.(0|[1-9]\d{0,8})$/;

package/packages/piagent-core/managed/permission.mjs

@@ -0,0 +1,22 @@
+// A company conversation's access, chosen by the member and kept with the
+// conversation: "workspace-write" asks before every command that needs the
+// internet; "trusted-full-access" (Bypass) asks only for what must be
+// confirmed (runtime/policy/bypass-policy.mjs).
+import { mustConfirm } from '../runtime/policy/bypass-policy.mjs';
+
+export const PERMISSIONS = ['workspace-write', 'trusted-full-access'];
+const ENTRY = 'agent-watch-permission';
+
+export function restorePermission(manager) {
+  const chosen = manager.getEntries().filter(e => e.type === 'custom' && e.customType === ENTRY).at(-1)?.data?.mode;
+  return PERMISSIONS.includes(chosen) ? chosen : 'workspace-write';
+}
+export function permissionSetter(owner, manager) {
+  return mode => {
+    if (!PERMISSIONS.includes(mode)) throw Error('managed-permission-unavailable');
+    manager.appendCustomEntry(ENTRY, { mode, at: new Date().toISOString() }); owner.permission = mode;
+  };
+}
+// Why a network command must still be asked about: null runs it in Bypass,
+// 'ask' when the member asks first.
+export const networkConfirmation = (owner, command) => owner.permission === 'trusted-full-access' ? mustConfirm(command) : 'ask';

package/packages/piagent-core/managed/session.mjs

@@ -23,6 +23,7 @@ import { workflowPolicy, repositoryChecks, planTool, currentPlan, PLAN_ENTRY, wo
 import { beforeDelegate } from './objections.mjs';
 import { HELPER_CALLS, HELPER_ROLES, helperRoles, helperPrompt, webPrompt, delegateDescription } from './helper-roles.mjs';
 import { loadAgentResources } from './agent-skills.mjs';
+import { restorePermission, permissionSetter, networkConfirmation } from './permission.mjs';
 
 const PROVIDER = 'agent_watch_managed';
 // Who the agent is: the model account may put another product's name in an
@@ -109,6 +110,7 @@ export class ManagedSession {
       parameters:{type:'object',properties:{},additionalProperties:false},
       execute:async(id,_args,signal,_update,ctx)=>{
         const plan=await repositoryFetchPlan(self.boundary);
+        if(self.permission==='trusted-full-access'&&!signal?.aborted)return executeRepositoryFetch(self.boundary,plan,signal);
         const {piApprovalBroker}=await import('../runtime/inspection/approval-broker.ts');
         const decision=await piApprovalBroker.request({cwd:self.cwd,rawSessionId:self.session.sessionManager.getSessionId(),toolCallId:id,
           action:{kind:'external-provider-action',preconditionClass:'runtime-only',toolName:'fetch_origin',rawAction:plan,
@@ -125,10 +127,11 @@ export class ManagedSession {
     customTools.push({name:'run_with_network',label:'Run with network',description:'Run one shell command that needs the internet (package install, download, git pull of a public repository), or that starts a local server or a browser (end-to-end tests with Playwright\'s Chromium against a server on 127.0.0.1), after the user approves that exact command. Normal bash has no network and cannot listen on a port. Credentials (.npmrc, SSH keys, Keychain) stay unavailable, so private registries and git push are not possible here.',
       parameters:{type:'object',properties:{command:{type:'string',minLength:1,maxLength:4000},reason:{type:'string',minLength:1,maxLength:300},timeout:{type:'number',minimum:1,maximum:1800}},required:['command','reason'],additionalProperties:false},
       execute:async(id,args,signal,onUpdate,ctx)=>{
-        const {piApprovalBroker}=await import('../runtime/inspection/approval-broker.ts');
-        const decision=await piApprovalBroker.request({cwd:self.cwd,rawSessionId:self.session.sessionManager.getSessionId(),toolCallId:id,
+        // Bypass runs it without asking, unless it is one the member must confirm.
+        const confirm=await networkConfirmation(self,args.command);
+        const decision=confirm===null?{allowed:true,consume:()=>true}:await (await import('../runtime/inspection/approval-broker.ts')).piApprovalBroker.request({cwd:self.cwd,rawSessionId:self.session.sessionManager.getSessionId(),toolCallId:id,
           action:{kind:'external-provider-action',preconditionClass:'runtime-only',toolName:'run_with_network',rawAction:{command:args.command},commandPreview:String(args.command),
-            targetPaths:[self.cwd],provider:'network',urlOrigin:null,requestedScope:'network-command-once',reason:String(args.reason).slice(0,300),riskClass:'medium',
+            targetPaths:[self.cwd],provider:'network',urlOrigin:null,requestedScope:'network-command-once',reason:(confirm==='ask'?String(args.reason):`Bypass still asks: ${confirm}. ${args.reason}`).slice(0,300),riskClass:'medium',
             allowConsequence:'Run this exact command once, with internet access; a server it starts accepts connections while it runs.',denyConsequence:'The command does not run; the agent is told you declined.'},
           terminalConfirm:()=>ctx?.ui?.confirm?.('Run with network',`Allow internet access for: ${args.command}`)??Promise.resolve(false),
           unavailableFallback:'terminal-confirm',recheck:()=>!signal?.aborted&&Boolean(self.grant)});
@@ -138,11 +141,14 @@ export class ManagedSession {
         try { const result=await self.boundary.invoke('bash',{command:args.command,...(args.timeout?{timeout:args.timeout}:{})},signal,onUpdate,ctx?.model,{network:true}); ok=!result?.isError; return result; }
         finally { await self.claimChanges(before); await self.run?.afterTool('bash',args,ok,()=>self.digest()); await self.refreshReview(); }
       }});
-    // The helpers of the Harness this conversation enrolled with. A later
-    // enrollment that drops one is refused at the call (delegate).
+    // Every helper role passes the tool's schema: Pi fixes a tool's schema
+    // and description when the conversation opens, so a helper a Harness
+    // saved later adds must already pass it. The system prompt, rebuilt each
+    // turn, names the Harness's current helpers; delegate refuses one the
+    // Harness does not have.
     const roles = helperRoles(manifest);
     if (roles.length) customTools.push({ name: 'delegate', label: 'Subagent', description: delegateDescription(roles),
-      parameters: { type: 'object', properties: { role: { type: 'string', enum: roles }, title: { type: 'string', maxLength: 120, description: 'One line naming the job, for the company logs (for example "Find where login tokens are stored").' }, task: { type: 'string', minLength: 1, maxLength: 12000 } }, required: ['role', 'task'], additionalProperties: false },
+      parameters: { type: 'object', properties: { role: { type: 'string', enum: HELPER_ROLES }, title: { type: 'string', maxLength: 120, description: 'One line naming the job, for the company logs (for example "Find where login tokens are stored").' }, task: { type: 'string', minLength: 1, maxLength: 12000 } }, required: ['role', 'task'], additionalProperties: false },
       execute: (_id, args, signal) => self.delegate(args, signal) });
     customTools.push(planTool(async plan => {
       self.session.sessionManager.appendCustomEntry(PLAN_ENTRY, { ...plan, at: new Date().toISOString() });
@@ -185,6 +191,8 @@ export class ManagedSession {
     self.extensionsResult = result.extensionsResult;
     self.session = result.session;
     self.session.managedExecution = true;
+    // The member's access for this conversation: ask first, or Bypass (permission.mjs).
+    self.permission = restorePermission(manager); self.session.managedSetPermission = permissionSetter(self, manager);
     // A helper's receipt (its tokens, the patch it read) is for the member's
     // eyes: the agent has the helper's answer as the tool result, and a
     // receipt in its context reads as a message from the member.
@@ -353,7 +361,7 @@ export class ManagedSession {
     this.blocked = this.scope && sameMember(this.scope, scope) ? null : 'managed-session-scope-changed';
     if (this.blocked) throw Error(this.blocked);
     if (!sameKey(this.scope, scope)) { this.session.sessionManager.appendCustomEntry('agent-watch-scope', scope); this.scope = scope; }
-    this.session?.setActiveToolsByName(this.session.getActiveToolNames()); // the new Harness workflow reaches the prompt
+    this.session?.setActiveToolsByName(this.session.getActiveToolNames()); // the new Harness workflow and helpers reach the prompt
   }
   async digest() { try { return await this.changeDigest(); } catch { return null; } }
   refusedAsTooLong() {

package/packages/piagent-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@piagent/core",
-  "version": "1.15.2",
+  "version": "1.16.1",
   "type": "module",
   "private": true,
   "license": "MIT",

package/packages/piagent-core/runtime/policy/bypass-policy.mjs

@@ -0,0 +1,42 @@
+// What a company conversation in "Bypass" mode still asks the member about
+// (owner, 2026-10-07: a member who chose bypass is not asked again, except for
+// what must be confirmed). Everything else runs without asking.
+// Always asked: anything that changes or sends data outside this machine
+// (git push, publish, deploy, a request that uploads or writes, remote
+// shells, cloud and cluster tools), database migrations, deletes whose
+// target is only known at run time, removing Docker volumes, and sudo.
+import fs from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { evaluateExecPolicyCore } from '../../extensions/policy-core.js';
+
+const POLICY = JSON.parse(fs.readFileSync(fileURLToPath(new URL('../../policies/base-policy.json', import.meta.url)), 'utf8'));
+// Exec-policy prompts a member in bypass may skip: local, reversible.
+const BYPASSABLE_RULES = new Set(['prompt-git-add-broad']);
+// Tools that reach other machines or accounts; none runs without asking.
+const REMOTE = new Set(['ssh', 'scp', 'sftp', 'sudo', 'doas', 'vercel', 'netlify', 'fly', 'flyctl', 'heroku', 'firebase', 'aws', 'gcloud', 'gsutil', 'az',
+  'kubectl', 'helm', 'terraform', 'tofu', 'pulumi', 'eas', 'wrangler', 'supabase', 'railway', 'render', 'doctl']);
+const basename = word => String(word ?? '').split('/').pop();
+const WRAPPERS = new Set(['env', 'command', 'exec', 'time', 'nohup', 'npx', 'bunx', 'pnpx']);
+function executable(words) {
+  let i = 0;
+  while (i < words.length && (/^[A-Za-z_][A-Za-z0-9_]*=/.test(words[i]) || WRAPPERS.has(basename(words[i])) || words[i].startsWith('-'))) i += 1;
+  return { name: basename(words[i]), args: words.slice(i + 1) };
+}
+
+// Why this command must still be confirmed, or null when bypass may run it.
+export async function mustConfirm(command) {
+  const result = evaluateExecPolicyCore(String(command), { policy: POLICY, mode: 'enforce' });
+  const kept = result.reasons.filter(reason => ![...BYPASSABLE_RULES].some(id => reason.startsWith(`Prompt required by exec policy ${id}:`)));
+  if (result.decision !== 'allow' && kept.length) return kept[0];
+  const { findShellExternalConfirmationReason } = await import('../../extensions/guard-shell-analysis.ts');
+  const external = findShellExternalConfirmationReason(result.segments, { defaultMode: 'enforce', ...POLICY.externalActionPolicy });
+  if (external) return external;
+  for (const segment of result.segments) {
+    const { name, args } = executable(segment.words);
+    if (REMOTE.has(name)) return `${name} reaches another machine or account`;
+    if (name === 'rsync' && args.some(arg => /^[^/\s]*:/.test(arg) && !arg.startsWith('-'))) return 'rsync to another machine';
+    if (name === 'docker' && ['push', 'login'].includes(args.find(arg => !arg.startsWith('-')))) return `docker ${args.find(arg => !arg.startsWith('-'))} sends to a registry`;
+    if (name === 'git' && args.some(arg => ['push', 'send-email', 'request-pull'].includes(arg))) return 'git sends to a remote';
+  }
+  return null;
+}