@piagent/platform 1.16.1 → 1.16.2

package/docs-site/en/whats-new.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.16.1 docs · EN</span>
+        <span class="pill"><span class="pill-dot"></span>v1.16.2 docs · EN</span>
         <nav class="language-switch" aria-label="Language">
           <a class="language-option" href="/whats-new" hreflang="vi" lang="vi">VI</a>
           <a class="language-option current" href="/en/whats-new" hreflang="en" lang="en" aria-current="true">EN</a>
@@ -104,6 +104,19 @@
               <h1>1.9.0: ask in plain language, the team's Harness checks</h1>
               <p>The task contract and workflow commands are gone. Company mode asks for checks and a review on its own; Stop, network commands on approval and clearer approval cards.</p>
             </div>
+<section class="section">
+  <p class="section-kicker">v1.16.2 · 2026-10-08</p>
+  <h2 id="v1-16-2">The Terminal says what the dashboard says</h2>
+  <p class="section-lead">When a new Piagent is out, the Terminal (<span class="inline-code">pi</span> and <span class="inline-code">piagent studio</span>) asks <strong>Update now</strong> or <strong>Later</strong> (asked again after an hour), only between turns, with a footer line; <span class="inline-code">/piagent-update</span> checks at once.</p>
+  <ul>
+    <li><span class="inline-code">/bypass</span> in <span class="inline-code">piagent studio</span> switches Bypass for the conversation, like the dashboard's switch; the footer shows "Bypass" while it is on.</li>
+    <li>A network command is confirmed with its reason, why Bypass still asks, and what allowing or declining does.</li>
+    <li>Failed requests, a company runtime that cannot start and the Harness's notes (checks, review, a subagent's objection, "your call") read in Vietnamese as on the dashboard.</li>
+    <li>With Agent Watch 0.15.2: when a Watch update needs Keychain access again, Watch asks in a dialog and refreshes Piagent's setup at once.</li>
+  </ul>
+  <p>This release changes the company launcher: Agent Watch refreshes the setup on its next sync (minutes). If <span class="inline-code">piagent studio</span> says the setup changed, open Agent Watch → Studio and import it for Piagent.</p>
+</section>
+
 <section class="section">
   <p class="section-kicker">v1.16.1 · 2026-10-07</p>
   <h2 id="v1-16-1">New releases are announced, checked every hour</h2>

package/docs-site/en/windows.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.16.1 docs · EN</span>
+        <span class="pill"><span class="pill-dot"></span>v1.16.2 docs · EN</span>
         <nav class="language-switch" aria-label="Language">
           <a class="language-option" href="/windows" hreflang="vi" lang="vi">VI</a>
           <a class="language-option current" href="/en/windows" hreflang="en" lang="en" aria-current="true">EN</a>

package/docs-site/en/workflows.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.16.1 docs · EN</span>
+        <span class="pill"><span class="pill-dot"></span>v1.16.2 docs · EN</span>
         <nav class="language-switch" aria-label="Language">
           <a class="language-option" href="/workflows" hreflang="vi" lang="vi">VI</a>
           <a class="language-option current" href="/en/workflows" hreflang="en" lang="en" aria-current="true">EN</a>

package/docs-site/index.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.16.1 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.16.2 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/" hreflang="en" lang="en">EN</a>
@@ -94,7 +94,7 @@
       <main>
         <div class="content-shell" data-article>
 <section class="hero">
-  <p class="eyebrow">Piagent 1.16.1</p>
+  <p class="eyebrow">Piagent 1.16.2</p>
   <h1>Coding agent cho cả team, kiểm tra từng bước.</h1>
   <p>
     Một dashboard cho Terminal và trình duyệt. Dùng model bằng tài khoản của bạn, hoặc model của công ty qua Agent Watch và Agent Studio. Guard kiểm tra từng tool call; ở chế độ công ty, Harness của team tự yêu cầu chạy check, cho subagent review và báo kết quả ngay dưới câu trả lời.
@@ -108,7 +108,7 @@
   <div class="hero-actions">
     <a class="button primary" href="/quickstart">Bắt đầu</a>
     <a class="button" href="/ecosystem">Hệ sinh thái</a>
-    <a class="button" href="/whats-new">Có gì mới trong 1.16.1</a>
+    <a class="button" href="/whats-new">Có gì mới trong 1.16.2</a>
     <a class="button" href="/commands">Xem command</a>
   </div>
 </section>
@@ -184,9 +184,9 @@ piagent-setup</code></pre>
   <h2 id="bat-dau-tu-dau">Bắt đầu từ đâu</h2>
   <div class="card-grid">
     <a class="doc-card" href="/whats-new">
-      <span class="card-kicker">Bản 1.16.1</span>
+      <span class="card-kicker">Bản 1.16.2</span>
       <h3>Có gì mới</h3>
-      <p>Bản mới được báo bằng dialog và kiểm tra mỗi giờ, tab dashboard không còn mất đăng nhập; ở 1.16.0: Bypass cho cuộc trò chuyện công ty, đổi Harness không làm gián đoạn; ở 1.15.2: cuộc trò chuyện dài tự thu gọn trở lại; ở 1.15.1: Studio thấy mỗi call của model dùng để làm gì, nhiều cuộc trò chuyện trong một folder không nhận nhầm thay đổi của nhau; ở 1.15.0: subagent bị từ chối nói đúng lý do; ở 1.14: cập nhật giữ model bạn đã chọn; ở 1.13: cuộc trò chuyện giữ chỗ đang đọc, chữ của agent có định dạng, Piagent trên Windows qua WSL2: sandbox công ty bằng bubblewrap và Agent Watch cho Windows; ở 1.12: @ chọn file và folder trên máy, skill và command dùng bằng /, nhánh cuộc trò chuyện công ty gửi được tin nhắn.</p>
+      <p>Terminal nói giống dashboard: hỏi cập nhật, /bypass, lỗi và ghi chú Harness bằng tiếng Việt; ở 1.16.1: bản mới được báo bằng dialog và kiểm tra mỗi giờ, tab dashboard không còn mất đăng nhập; ở 1.16.0: Bypass cho cuộc trò chuyện công ty, đổi Harness không làm gián đoạn; ở 1.15.2: cuộc trò chuyện dài tự thu gọn trở lại; ở 1.15.1: Studio thấy mỗi call của model dùng để làm gì, nhiều cuộc trò chuyện trong một folder không nhận nhầm thay đổi của nhau; ở 1.15.0: subagent bị từ chối nói đúng lý do; ở 1.14: cập nhật giữ model bạn đã chọn; ở 1.13: cuộc trò chuyện giữ chỗ đang đọc, chữ của agent có định dạng, Piagent trên Windows qua WSL2: sandbox công ty bằng bubblewrap và Agent Watch cho Windows; ở 1.12: @ chọn file và folder trên máy, skill và command dùng bằng /, nhánh cuộc trò chuyện công ty gửi được tin nhắn.</p>
     </a>
     <a class="doc-card" href="/ecosystem">
       <span class="card-kicker">Get started</span>

package/docs-site/mcp-approval.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.16.1 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.16.2 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/mcp-approval" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/mcp-approval" hreflang="en" lang="en">EN</a>

package/docs-site/mcp-auth.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.16.1 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.16.2 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/mcp-auth" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/mcp-auth" hreflang="en" lang="en">EN</a>

package/docs-site/mcp-servers.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.16.1 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.16.2 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/mcp-servers" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/mcp-servers" hreflang="en" lang="en">EN</a>

package/docs-site/mcp.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.16.1 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.16.2 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/mcp" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/mcp" hreflang="en" lang="en">EN</a>

package/docs-site/permissions.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.16.1 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.16.2 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/permissions" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/permissions" hreflang="en" lang="en">EN</a>

package/docs-site/profiles.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.16.1 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.16.2 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/profiles" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/profiles" hreflang="en" lang="en">EN</a>

package/docs-site/quickstart.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.16.1 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.16.2 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/quickstart" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/quickstart" hreflang="en" lang="en">EN</a>

package/docs-site/runtime.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.16.1 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.16.2 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/runtime" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/runtime" hreflang="en" lang="en">EN</a>

package/docs-site/scope.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.16.1 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.16.2 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/scope" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/scope" hreflang="en" lang="en">EN</a>

package/docs-site/security.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.16.1 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.16.2 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/security" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/security" hreflang="en" lang="en">EN</a>

package/docs-site/team.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.16.1 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.16.2 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/team" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/team" hreflang="en" lang="en">EN</a>

package/docs-site/whats-new.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.16.1 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.16.2 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/whats-new" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/whats-new" hreflang="en" lang="en">EN</a>
@@ -104,6 +104,19 @@
               <h1>Bản 1.9.0: nói việc bằng lời, Harness của team kiểm tra</h1>
               <p>Bỏ task contract và lệnh workflow. Chế độ công ty tự yêu cầu check và review; nút Dừng, lệnh có mạng theo lần duyệt và thẻ duyệt dễ đọc hơn.</p>
             </div>
+<section class="section">
+  <p class="section-kicker">v1.16.2 · 2026-10-08</p>
+  <h2 id="v1-16-2">Terminal nói giống dashboard</h2>
+  <p class="section-lead">Có bản Piagent mới thì Terminal (<span class="inline-code">pi</span> và <span class="inline-code">piagent studio</span>) hỏi <strong>Cập nhật ngay</strong> hoặc <strong>Để sau</strong> (nhắc lại sau 1 giờ), chỉ giữa các lượt, kèm một dòng dưới footer; <span class="inline-code">/piagent-update</span> kiểm tra ngay.</p>
+  <ul>
+    <li><span class="inline-code">/bypass</span> trong <span class="inline-code">piagent studio</span> bật/tắt Bypass cho cuộc trò chuyện, giống công tắc trên dashboard; footer hiện "Bypass" khi đang bật.</li>
+    <li>Lệnh cần internet được hỏi kèm lý do, lý do Bypass vẫn hỏi và hậu quả khi đồng ý hay từ chối.</li>
+    <li>Lỗi khi gửi, lỗi khi mở phiên công ty và ghi chú của Harness (check, review, phản biện của subagent, "bạn quyết định") hiện bằng tiếng Việt như trên dashboard.</li>
+    <li>Với Agent Watch 0.15.2: sau khi Watch cập nhật mà cần cấp lại quyền Keychain, Watch hỏi bằng dialog và cập nhật lại cấu hình Piagent ngay.</li>
+  </ul>
+  <p>Bản này đổi trình khởi chạy công ty: Agent Watch tự cập nhật cấu hình ở lần đồng bộ kế tiếp (vài phút). Nếu <span class="inline-code">piagent studio</span> báo cấu hình đã đổi, mở Agent Watch → Studio và nhập lại cấu hình cho Piagent.</p>
+</section>
+
 <section class="section">
   <p class="section-kicker">v1.16.1 · 2026-10-07</p>
   <h2 id="v1-16-1">Báo bản mới rõ ràng, kiểm tra mỗi giờ</h2>

package/docs-site/windows.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.16.1 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.16.2 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/windows" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/windows" hreflang="en" lang="en">EN</a>

package/docs-site/workflows.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.16.1 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.16.2 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/workflows" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/workflows" hreflang="en" lang="en">EN</a>

package/evals/private-holdout-v1/public-exposure.v2.json

@@ -256,8 +256,8 @@
     },
     {
       "path": "tests",
-      "fileCount": 525,
-      "sha256": "c9ef8c449f71514ed8f32161be6d5280ea4ccd702341cc5ca645c9e51f70fb7f"
+      "fileCount": 526,
+      "sha256": "01827d63b0b67a55437e498d6eb0a5ffa43806c88c02eb687b6bba945d37aa59"
     }
   ],
   "custodianComparisonRules": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@piagent/platform",
-  "version": "1.16.1",
+  "version": "1.16.2",
   "license": "MIT",
   "publishConfig": {
     "access": "public",

package/packages/piagent-core/extensions/piagent-guard.ts

@@ -164,6 +164,7 @@ import { fallbackBasePolicy } from "./fallback-base-policy.ts";
 import { prefixCompletions, registerPiagentTool as registerToolDefinition, registerRuntimeCommand, registerRuntimeTool } from "../runtime/registration/extension-registration.ts";
 import { registerTaskEvidenceTools } from "../runtime/registration/task-evidence-tools.ts";
 import { registerAgentResources } from "../runtime/registration/agent-resources.ts";
+import { registerTerminalUpdateOffer } from "../runtime/update/terminal-update-offer.mjs";
 import { userSkillFolders } from "../runtime/resources/agent-resources.mjs";
 import { FRESH_COMMAND_ACTIONS, FRESH_COMMAND_HELP, ONBOARDING_COMMAND_ACTIONS, WORKFLOW_COMMAND_EXCLUSIONS } from "../runtime/registration/operator-catalogs.ts";
 import { registerPiagentStatusCommand } from "../runtime/registration/runtime-model-status.ts";
@@ -4159,5 +4160,7 @@ export default function piagentGuard(pi: ExtensionAPI) {
   // citations need a task id), so it is no longer registered at all.
   registerTaskEvidenceTools(pi, registrationDeps);
   registerAgentResources(pi);
+  // A new release is asked about in the Terminal, as the dashboard does.
+  registerTerminalUpdateOffer(pi, { installed: installedPlatformVersion(), packageRoot: PLATFORM_ROOT, restart: "pi" });
   registerSessionCommands(pi, { ...registrationDeps, ...contextCommandApi });
 }

package/packages/piagent-core/managed/resource-loader.mjs

@@ -1,5 +1,6 @@
 import fs from 'node:fs';
 import path from 'node:path';
+import { pathToFileURL } from 'node:url';
 
 const INSTRUCTION_FILES = ['AGENTS.override.md', 'AGENTS.md', 'AGENTS.MD', 'CLAUDE.md', 'CLAUDE.MD'];
 // Project instructions from the project folder up to its repository root, as
@@ -24,8 +25,7 @@ export function projectInstructions(cwd, top = cwd) {
 // Managed sessions never consult the personal trust store or execute resources
 // discovered in a project. Skills and commands are text (agent-skills.mjs):
 // what they ask for runs with the session's own tools.
-export function managedResourceLoader(api, { systemPrompt, extensions = [], agentsFiles = [], skills = [], prompts = [] } = {}) {
-  const runtime = api.createExtensionRuntime();
+export function managedResourceLoader(api, { systemPrompt, extensions = [], runtime = api.createExtensionRuntime(), agentsFiles = [], skills = [], prompts = [] } = {}) {
   const empty = Object.freeze([]);
   return Object.freeze({
     getExtensions: () => ({ extensions, errors: empty, runtime }),
@@ -41,3 +41,15 @@ export function managedResourceLoader(api, { systemPrompt, extensions = [], agen
     reload: async () => {},
   });
 }
+
+// Extensions the company Terminal adds itself (its commands and how Harness
+// notes read), built the way Pi builds an inline extension. Never project code.
+export async function inlineExtensions(api, sdkRoot, cwd, factories = []) {
+  const runtime = api.createExtensionRuntime();
+  if (!factories.length) return { extensions: [], runtime };
+  const load = (file) => import(pathToFileURL(path.join(sdkRoot, 'dist', ...file.split('/'))).href);
+  const [{ loadExtensionFromFactory }, { createEventBus }] = await Promise.all([load('core/extensions/loader.js'), load('core/event-bus.js')]);
+  const bus = createEventBus(), extensions = [];
+  for (const [index, factory] of factories.entries()) extensions.push(await loadExtensionFromFactory(factory, cwd, bus, runtime, `<inline:company-terminal-${index + 1}>`));
+  return { extensions, runtime };
+}

package/packages/piagent-core/managed/session.mjs

@@ -5,7 +5,7 @@ import { randomUUID, createHash } from 'node:crypto';
 import { pathToFileURL, fileURLToPath } from 'node:url';
 import { ManagedToolBoundary } from './tool-boundary.mjs';
 import { ensureSearchTools, trustSystemCertificates } from './toolchain.mjs';
-import { managedResourceLoader, projectInstructions } from './resource-loader.mjs';
+import { inlineExtensions, managedResourceLoader, projectInstructions } from './resource-loader.mjs';
 import { fetchPublicPage, fetchLimits } from './web-fetch.mjs';
 import { searchForRole } from './web-search.mjs';
 import { shareGrant, releaseGrant } from './grant-share.mjs';
@@ -84,7 +84,7 @@ export class ManagedSession {
   // renewBroker/bindingRevision (optional) let a long-lived conversation follow
   // a key or harness change: Agent Watch rewrites the binding's revision, and
   // the conversation enrolls again before its next run.
-  static async create({ sdkRoot, cwd, origin, broker, protectedRoots = [], agentDir, sessionManager, renewBroker = null, bindingRevision = null }) {
+  static async create({ sdkRoot, cwd, origin, broker, protectedRoots = [], agentDir, sessionManager, renewBroker = null, bindingRevision = null, terminalExtensions = [] }) {
     const sdk = fs.realpathSync(sdkRoot);
     if (JSON.parse(fs.readFileSync(path.join(sdk, 'package.json'))).version !== '0.87.1') throw Error('managed-sdk-version-unqualified');
     await trustSystemCertificates();
@@ -116,7 +116,7 @@ export class ManagedSession {
           action:{kind:'external-provider-action',preconditionClass:'runtime-only',toolName:'fetch_origin',rawAction:plan,
             targetPaths:[self.cwd],provider:'github',urlOrigin:'https://github.com',requestedScope:'fetch-origin-once',
             reason:`Fetch origin branches from ${plan.repository}`,riskClass:'low',allowConsequence:'Download origin branches once; keep the current branch and working files unchanged.',denyConsequence:'No network request or credential read.'},
-          terminalConfirm:()=>ctx?.ui?.confirm?.('Fetch origin',`Fetch ${plan.repository} into ${self.cwd}? No working files will be changed.`)??Promise.resolve(false),
+          terminalConfirm:()=>ctx?.ui?.confirm?.('Tải nhánh từ origin',`Tải các nhánh của ${plan.repository} về ${self.cwd} một lần.\n\nĐồng ý: chỉ tải nhánh; nhánh hiện tại và file đang làm không đổi.\nTừ chối: không gửi request mạng, không đọc thông tin đăng nhập.`)??Promise.resolve(false),
           unavailableFallback:'terminal-confirm',recheck:()=>!signal?.aborted&&Boolean(self.grant)});
         if(!decision.allowed||!decision.consume()||signal?.aborted)throw Error('managed-operation-denied');
         return executeRepositoryFetch(self.boundary,plan,signal);
@@ -133,7 +133,7 @@ export class ManagedSession {
           action:{kind:'external-provider-action',preconditionClass:'runtime-only',toolName:'run_with_network',rawAction:{command:args.command},commandPreview:String(args.command),
             targetPaths:[self.cwd],provider:'network',urlOrigin:null,requestedScope:'network-command-once',reason:(confirm==='ask'?String(args.reason):`Bypass still asks: ${confirm}. ${args.reason}`).slice(0,300),riskClass:'medium',
             allowConsequence:'Run this exact command once, with internet access; a server it starts accepts connections while it runs.',denyConsequence:'The command does not run; the agent is told you declined.'},
-          terminalConfirm:()=>ctx?.ui?.confirm?.('Run with network',`Allow internet access for: ${args.command}`)??Promise.resolve(false),
+          terminalConfirm:()=>ctx?.ui?.confirm?.('Chạy lệnh có internet',`${args.command}\n\nLý do: ${args.reason}${confirm==='ask'?'':`\nBypass vẫn hỏi: ${confirm}`}\n\nĐồng ý: chạy đúng lệnh này một lần, có internet; server nó mở nhận kết nối trong lúc chạy.\nTừ chối: lệnh không chạy, agent được báo bạn đã từ chối.`)??Promise.resolve(false),
           unavailableFallback:'terminal-confirm',recheck:()=>!signal?.aborted&&Boolean(self.grant)});
         if(!decision.allowed||!decision.consume()||signal?.aborted)throw Error('managed-operation-denied');
         let ok=false;
@@ -161,7 +161,7 @@ export class ManagedSession {
     self.checks = repositoryChecks(agentsFiles, self.cwd, self.boundary.repositoryTop);
     // The Harness workflow (possibly changed on a later enrollment) adds its process to the prompt.
     const loader = managedResourceLoader(api, { systemPrompt: () => BASE_PROMPT + referencePrompt(self.boundary.userHome) + TEST_PROMPT + webPrompt(helperRoles(manifest)) + helperPrompt(helperRoles(self.manifest)) + workflowPrompt(workflowPolicy(self.manifest), self.checks), agentsFiles,
-      skills: self.resources.skills, prompts: self.resources.prompts });
+      skills: self.resources.skills, prompts: self.resources.prompts, ...await inlineExtensions(api, sdk, self.cwd, terminalExtensions) });
     const settings = api.SettingsManager.inMemory({ retry: { enabled: false, provider: { maxRetries: 0 } }, cacheWarming: 'off', enableInstallTelemetry: false, enableAnalytics: false, enableSkillCommands: true });
     const manager = sessionManager ?? api.SessionManager.inMemory(self.cwd);
     const scope = scopeOf(self.origin, manifest);
@@ -229,6 +229,8 @@ export class ManagedSession {
     };
     const prompt = self.session.prompt.bind(self.session);
     self.session.prompt = async (text, options) => {
+      // An extension command (/bypass, /piagent-update) runs here, never as a turn.
+      if (/^\/\S/.test(text) && self.session.extensionRunner?.getCommand(text.slice(1).split(/\s/)[0])) return prompt(text, options);
       // /skill:name, /command: the run sees what the member asked for in full.
       text = self.resources.expand(text);
       if (self.starting) await self.starting;

package/packages/piagent-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@piagent/core",
-  "version": "1.16.1",
+  "version": "1.16.2",
   "type": "module",
   "private": true,
   "license": "MIT",

package/packages/piagent-core/runtime/update/terminal-update-offer.d.mts

@@ -0,0 +1,7 @@
+export const SNOOZE_MS: number;
+export function readSnooze(home?: string): { version: string | undefined; until: number };
+export function snoozeUpdate(version: string, options?: { home?: string; now?: number }): void;
+export function pendingUpdate(options: { installed: string | undefined; home?: string; now?: number }): string | null;
+export function probeRegistry(options?: { wait?: boolean; spawnImpl?: unknown }): Promise<boolean>;
+export function runPiagentUpdate(options: { packageRoot: string; version: string; home?: string; spawnImpl?: unknown }): Promise<{ ok: boolean; log: string }>;
+export function registerTerminalUpdateOffer(pi: unknown, options: { installed: string | undefined; packageRoot: string; restart: string; home?: string; afterUpdate?: () => string | null; runUpdate?: (options: { packageRoot: string; version: string; home?: string }) => Promise<{ ok: boolean; log: string }>; probe?: (options?: { wait?: boolean }) => Promise<boolean> }): void;

package/packages/piagent-core/runtime/update/terminal-update-offer.mjs

@@ -0,0 +1,114 @@
+// A new Piagent release, said in the Terminal the way the dashboard says it:
+// a question with "Update now" and "Later", asked when the Terminal is idle,
+// and a footer line until the machine is updated. "Later" asks again after an
+// hour, per release. The registry is asked in the background every hour
+// (update-check.js keeps the cache); nothing here waits on the network.
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawn } from "node:child_process";
+import { fileURLToPath } from "node:url";
+
+import { compareReleaseVersions, evaluateUpdateCheck, readUpdateCache, releaseVersion } from "../../extensions/update-check.js";
+
+const PROBE_MODULE = fileURLToPath(new URL("../../extensions/update-check.js", import.meta.url));
+
+export const SNOOZE_MS = 60 * 60 * 1000;
+const CHECK_EVERY_MS = 10 * 60 * 1000;
+const SNOOZE_FILE = "piagent-update-snooze.json", LOG_FILE = "piagent-update-terminal.log";
+const STATUS_KEY = "piagent-update";
+// The dashboard's own runtime UI: the dashboard asks with its dialog instead.
+const GATEWAY_UI = Symbol.for("piagent.webui.gateway-runtime-ui.v1");
+const UPDATE_NOW = "Cập nhật ngay", LATER = "Để sau (nhắc lại sau 1 giờ)";
+
+const stateFile = (home, name) => path.join(home ?? os.homedir(), ".pi", name);
+
+export function readSnooze(home) {
+  try { const value = JSON.parse(fs.readFileSync(stateFile(home, SNOOZE_FILE), "utf8"));
+    return { version: releaseVersion(value?.version), until: Number.isFinite(value?.until) ? value.until : 0 }; }
+  catch { return { version: undefined, until: 0 }; }
+}
+export function snoozeUpdate(version, { home, now = Date.now() } = {}) {
+  const file = stateFile(home, SNOOZE_FILE);
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.writeFileSync(file, `${JSON.stringify({ version, until: now + SNOOZE_MS })}\n`, { mode: 0o600 });
+}
+
+// The release to offer now: newer than the installed one and not put off.
+export function pendingUpdate({ installed, home, now = Date.now() }) {
+  const latest = releaseVersion(readUpdateCache(home).latest), current = releaseVersion(installed);
+  if (!latest || !current || compareReleaseVersions(latest, current) <= 0) return null;
+  const snooze = readSnooze(home);
+  return snooze.version === latest && now < snooze.until ? null : latest;
+}
+
+// The company Terminal runs with a bare PATH: npm sits next to this Node.
+const npmPath = () => [path.dirname(process.execPath), "/usr/local/bin", "/opt/homebrew/bin", process.env.PATH ?? "/usr/bin:/bin"].join(path.delimiter);
+
+// Asks the registry (`npm view`) and refreshes the cache; `wait` for an answer
+// the member asked for, otherwise detached so nothing waits on the network.
+export function probeRegistry({ wait = false, spawnImpl = spawn } = {}) {
+  return new Promise((resolve) => {
+    let child;
+    try { child = spawnImpl(process.execPath, [PROBE_MODULE, "--probe"], { detached: !wait, stdio: "ignore", windowsHide: true, env: { ...process.env, PATH: npmPath() } }); }
+    catch { resolve(false); return; }
+    if (!wait) { child.unref?.(); resolve(true); return; }
+    const timer = setTimeout(() => { child.kill?.(); resolve(false); }, 20_000);
+    child.once("error", () => { clearTimeout(timer); resolve(false); });
+    child.once("exit", (code) => { clearTimeout(timer); resolve(code === 0); });
+  });
+}
+
+// `piagent-update --version X`, as the dashboard's update runs it.
+export function runPiagentUpdate({ packageRoot, version, home, spawnImpl = spawn }) {
+  const log = stateFile(home, LOG_FILE);
+  fs.mkdirSync(path.dirname(log), { recursive: true });
+  const out = fs.openSync(log, "w", 0o600);
+  const PATH = npmPath();
+  return new Promise((resolve) => {
+    let child;
+    try {
+      child = spawnImpl(process.execPath, [path.join(packageRoot, "scripts", "update-global.mjs"), "--version", version],
+        { stdio: ["ignore", out, out], env: { ...process.env, PATH, PIAGENT_NO_UPDATE_CHECK: "1" }, windowsHide: true });
+    } catch { fs.closeSync(out); resolve({ ok: false, log }); return; }
+    child.once("error", () => { fs.closeSync(out); resolve({ ok: false, log }); });
+    child.once("exit", (code) => { fs.closeSync(out); resolve({ ok: code === 0, log }); });
+  });
+}
+
+// `restart`: what the member runs to use the new release (`pi`, `piagent studio`).
+export function registerTerminalUpdateOffer(pi, { installed, packageRoot, restart, home, afterUpdate = () => null, runUpdate = runPiagentUpdate, probe: askRegistry = probeRegistry }) {
+  if (!releaseVersion(installed) || process.env.PIAGENT_NO_UPDATE_CHECK?.trim()) return;
+  let asking = false, ui = null, updated = null;
+  const probe = () => { if (evaluateUpdateCheck({ installed, cache: readUpdateCache(home), now: Date.now() }).probe) void askRegistry(); };
+  const status = (version) => ui?.setStatus?.(STATUS_KEY, version ? `⬆ Piagent ${version} · /piagent-update` : undefined);
+  const update = async (ctx, version) => {
+    ctx.ui.notify(`Đang cập nhật Piagent ${installed} → ${version}…`, "info");
+    const result = await runUpdate({ packageRoot, version, home });
+    if (!result.ok) { ctx.ui.notify(`Chưa cập nhật được Piagent. Chi tiết trong ${result.log}. Có thể chạy \`piagent-update\` trong terminal.`, "error"); return; }
+    updated = version; status(undefined);
+    const extra = afterUpdate();
+    ctx.ui.notify(`Đã cập nhật Piagent ${installed} → ${version}. Thoát rồi mở lại \`${restart}\` để dùng bản mới.${extra ? ` ${extra}` : ""}`, "info");
+  };
+  const offer = async (ctx, { force = false } = {}) => {
+    if (asking || updated || !ctx?.hasUI || ctx.ui?.[GATEWAY_UI] || !ctx.ui?.select) return;
+    ui = ctx.ui;
+    const version = force ? releaseVersion(readUpdateCache(home).latest) : pendingUpdate({ installed, home });
+    const newer = version && compareReleaseVersions(version, installed) > 0;
+    status(newer ? version : undefined);
+    if (!newer) { if (force) ctx.ui.notify(`Piagent ${installed} là bản mới nhất.`, "info"); return; }
+    asking = true;
+    try {
+      const choice = await ctx.ui.select(`Có bản Piagent mới: ${version} (đang dùng ${installed})`, [UPDATE_NOW, LATER]);
+      if (choice === UPDATE_NOW) await update(ctx, version);
+      else snoozeUpdate(version, { home });
+    } finally { asking = false; }
+  };
+  pi.on("session_start", async (_event, ctx) => { probe(); await offer(ctx); });
+  // Only between turns: a question never interrupts the agent.
+  pi.on("agent_end", async (_event, ctx) => { probe(); await offer(ctx); });
+  const timer = setInterval(probe, CHECK_EVERY_MS); timer.unref?.();
+  pi.on("session_shutdown", () => clearInterval(timer));
+  pi.registerCommand("piagent-update", { description: "Kiểm tra và cập nhật Piagent lên bản mới nhất",
+    handler: async (_args, ctx) => { ctx.ui.notify("Đang kiểm tra bản Piagent mới…", "info"); await askRegistry({ wait: true }); await offer(ctx, { force: true }); } });
+}