@piagent/platform 1.17.0 → 1.19.0

package/packages/piagent-core/managed/continuation.mjs

@@ -0,0 +1,131 @@
+import { unfinished, planText, currentPlan, workflowPolicy } from './workflow.mjs';
+import { failureCode } from '../runtime/managed-failure.mjs';
+
+// A main agent often ends its turn between the steps of its own checklist
+// ("STEP06 done, STEP07 next"), though the member asked for all of them.
+// Under plan "require" the harness sends it back to the next open step, as a
+// new run (as if the member had sent "continue": each round gets its own
+// helpers, checks and review), until the checklist is done, the member stops
+// it, a round fails, or IDLE_ROUNDS rounds in a row change nothing.
+export const IDLE_ROUNDS = 2;
+// A checklist holds at most 30 steps: one round per step at most.
+export const MAX_ROUNDS = 30;
+// How the member's message ended, shown under the last answer.
+export const TURN_END_ENTRY = 'agent-watch-turn-end';
+export const TURN_END_STATES = ['done', 'midway', 'failed', 'cancelled'];
+
+const completed = plan => plan?.plan?.filter(p => p.status === 'completed').length ?? 0;
+const deferred = plan => plan?.plan?.filter(p => p.status === 'deferred').length ?? 0;
+
+export class Continuation {
+  constructor(policy) {
+    Object.assign(this, { policy, rounds: 0, idle: 0, touched: false, reason: null, startDone: 0 });
+  }
+  // A round is about to start: what its progress is measured from.
+  begin(plan) { this.startDone = completed(plan); }
+  // A round ended (its run closed). The message that starts the next round,
+  // or null: then `reason` says why the harness stopped sending it back.
+  next({ plan, planUpdated, changed, stopped, failed }) {
+    if (planUpdated) this.touched = true;
+    if (stopped) { this.reason = 'stopped'; return null; }
+    if (failed) { this.reason = 'failed'; return null; }
+    if (!this.touched || !unfinished(plan)) { this.reason = null; return null; }
+    if (this.policy.plan !== 'require') { this.reason = 'policy'; return null; }
+    // The member's own round always gets one round back; a harness round
+    // that neither completed a step nor changed code counts as idle.
+    if (this.rounds > 0) this.idle = completed(plan) > this.startDone || changed ? 0 : this.idle + 1;
+    if (this.idle >= IDLE_ROUNDS) { this.reason = 'idle'; return null; }
+    if (this.rounds >= MAX_ROUNDS) { this.reason = 'limit'; return null; }
+    this.rounds += 1;
+    const steps = plan.plan.length, done = completed(plan), open = steps - done - deferred(plan);
+    return { customType: 'agent-watch-process', display: true,
+      content: `Harness: your checklist still has ${open} open step(s) (${done}/${steps} completed):\n${planText(plan)}\nThe member asked for all of it, unless they told you to stop at this point. Continue with the next open step now and keep going until every step is completed; update the checklist with update_plan as you go. Do not stop to report progress between steps. If the member asked you to stop here (to review a plan before any change, for example) or you cannot go on without them (a decision, access, a service that is not running), ask with ask_user instead of going on. If a step is no longer needed, take it out of the checklist and say why in your final answer.`,
+      details: { phase: 'continue', round: this.rounds, maxRounds: MAX_ROUNDS, planOpen: open, planDone: done, planSteps: steps, ...(this.idle ? { idle: this.idle } : {}) } };
+  }
+}
+
+// How a member's message ended: every step done (or answered without a
+// checklist), stopped with steps open (and why the harness did not go on),
+// failed (which role, which kind) or stopped by the member.
+export function turnEnd(continuation, plan, { stopped, failure }) {
+  const steps = continuation.touched ? plan?.plan?.length ?? 0 : 0, done = continuation.touched ? completed(plan) : 0;
+  const state = stopped ? 'cancelled' : failure ? 'failed' : continuation.touched && unfinished(plan) ? 'midway' : 'done';
+  const later = continuation.touched ? deferred(plan) : 0;
+  return { state, planSteps: steps, planDone: done, ...(later ? { planDeferred: later } : {}), rounds: continuation.rounds,
+    ...(state === 'midway' && continuation.reason ? { reason: continuation.reason } : {}),
+    ...(state === 'failed' ? { role: failure.role ?? 'main', code: String(failure.code || 'unknown').toLowerCase().replace(/[^a-z0-9_]+/g, '_').slice(0, 64) } : {}),
+    at: new Date().toISOString() };
+}
+
+// One member message: its round, then the rounds the harness adds while the
+// checklist has open steps. `runRound(text, deliver)` runs one Studio run and
+// returns { result, preflight, planUpdated, changed, closeFailed }. A message the member
+// sends while a round closes (no model runs then) becomes the next round;
+// Stop ends the turn. Listeners hear "settled" once, after the last round.
+// "tiếp tục", "continue", the dashboard's Continue button: the member asks
+// for the open checklist, so it is this message's work even before the agent
+// touches it again.
+const CONTINUE = /^(tiep tuc|lam tiep|lam not|continue|go on|keep going|resume)\b/;
+export function asksToContinue(text) {
+  const normal = String(text ?? '').normalize('NFD').replace(/\p{M}/gu, '').replace(/[đĐ]/g, 'd').toLowerCase().trim();
+  return normal.length <= 60 && CONTINUE.test(normal);
+}
+const fresh = (self, manager, text) => {
+  const continuation = new Continuation(workflowPolicy(self.manifest));
+  if (asksToContinue(text) && unfinished(currentPlan(manager))) continuation.touched = true;
+  return continuation;
+};
+
+export async function memberTurn(self, { manager, prompt, runRound }, text, deliver) {
+  let continuation = fresh(self, manager, text), result, waiting = null, ended = null;
+  self.stopRequested = false; self.queued = [];
+  try {
+    for (let first = true; ; first = false) {
+      continuation.begin(currentPlan(manager));
+      self.between = false;
+      let round;
+      try { round = await runRound(text, deliver); }
+      catch (error) { waiting?.reject(error); waiting = null; throw error; }
+      if (first) result = round.result; else waiting?.resolve(round.result);
+      waiting = null;
+      const last = self.session.messages.findLast(m => m.role === 'assistant');
+      const stopped = self.stopRequested || last?.stopReason === 'aborted';
+      const failure = round.preflight || last?.stopReason === 'error' ? { role: 'main', code: failureCode(last?.errorMessage ?? '') }
+        : round.closeFailed ? { role: 'main', code: round.closeFailed } : null;
+      const plan = currentPlan(manager), message = continuation.next({ plan, planUpdated: round.planUpdated, changed: round.changed, stopped, failed: !!failure });
+      if (self.queued.length) {
+        // The member wrote while the round closed: theirs is the next round,
+        // a new request (Stop before it applied to the round before).
+        waiting = self.queued.shift(); self.stopRequested = false;
+        const next = waiting; text = next.text;
+        deliver = () => prompt(next.text, { ...next.options, expandPromptTemplates: false });
+        continuation = fresh(self, manager, next.text);
+      } else if (message) {
+        text = message.content;
+        deliver = () => { self.nextPurpose = 'continue'; return self.session.sendCustomMessage(message, { triggerTurn: true }); };
+      } else { ended = turnEnd(continuation, plan, { stopped, failure }); break; }
+    }
+  } finally {
+    self.between = false;
+    for (const queued of self.queued.splice(0)) queued.reject(Error('managed-turn-stopped'));
+    // How the member's message ended: an entry of the conversation (not a
+    // message: the model never reads it), shown under the last answer, and
+    // told to listeners (the company Terminal).
+    if (ended) {
+      try { manager.appendCustomEntry(TURN_END_ENTRY, ended); } catch { /* the answer stands */ }
+      self.notify({ type: 'managed_turn_end', end: ended, text: turnEndText(ended) });
+    }
+    self.activePrompt = false;
+    self.notify({ type: 'agent_settled' });
+  }
+  return result;
+}
+
+// The plain text of a turn's end (the Terminal shows it; the WebUI reads details).
+export function turnEndText(end) {
+  if (end.state === 'cancelled') return 'Turn stopped by the member.';
+  if (end.state === 'failed') return `Turn failed: ${end.role} agent, ${end.code}. Send "continue" to go on.`;
+  if (end.state === 'midway') return `Turn ended with ${end.planSteps - end.planDone - (end.planDeferred ?? 0)} of ${end.planSteps} checklist step(s) open${end.reason === 'idle' ? `: the agent stopped ${IDLE_ROUNDS} times in a row without progress` : end.reason === 'limit' ? `: ${MAX_ROUNDS} rounds reached` : ''}. Send "continue" to go on.`;
+  if (end.planDeferred) return `Done: ${end.planDone} of ${end.planSteps} checklist steps completed, ${end.planDeferred} left for later.`;
+  return end.planSteps ? `Done: all ${end.planSteps} checklist steps completed.` : 'Done.';
+}

package/packages/piagent-core/managed/doctor.mjs

@@ -86,6 +86,13 @@ export async function runDoctor({ sdkRoot, origin, broker, network = true }) {
       try { return await bash('node loopback.mjs'); }
       catch (error) { throw Error(/loopback-blocked/.test(String(error?.message)) ? 'a local proxy listens on this Mac: tests that use localhost need run_with_network' : first(String(error?.message))); }
     });
+    // run_with_docker: the engine answers through its socket, and only there.
+    await check('Docker for approved commands (run_with_docker)', false, async () => {
+      if (!boundary.engine) throw Error('no Docker engine running (Docker Desktop, Colima, OrbStack…): start it, then open a new conversation');
+      let refused = false; try { await bash('docker version --format "{{.Server.Version}}"'); } catch { refused = true; }
+      if (!refused) throw Error('a plain command reached the Docker engine');
+      return `engine ${await bash('docker version --format "{{.Server.Version}}"', { docker: true })}`;
+    });
     await check('package caches kept for the project', false, async () => { await bash('mkdir -p "$npm_config_cache" && touch "$npm_config_cache/.piagent-doctor"'); return boundary.packageCache; });
     // The languages installed on this Mac, each started once in the sandbox.
     // (macOS ships stubs for some, such as javac without a JDK: a probe decides.)

package/packages/piagent-core/managed/language-environment.mjs

@@ -10,6 +10,10 @@ import { execFileSync } from 'node:child_process';
 //   network (run_with_network), later runs work offline;
 // - the member's own dependency caches as read-only seeds, where the tool can
 //   layer one (Go, Gradle, Maven), so what is already downloaded is reused;
+// - the distributions the Maven Wrapper (./mvnw) and the Gradle Wrapper
+//   (./gradlew) already unpacked on this Mac, linked read-only into the
+//   project's cache, so they run without asking for network; one they have
+//   to download stays in the cache;
 // - runtimes installed in places the sandbox otherwise keeps closed (JDKs
 //   under ~/Library/Java, the Android SDK, the system gem folder, MacPorts);
 // - SwiftPM and xcodebuild, which cannot start their own sandbox inside this
@@ -62,6 +66,50 @@ case "$(basename "$0"):$1" in
 esac
 `;
 
+// Each <name>/<hash> distribution folder of the member's Maven Wrapper as a
+// link in the project's cache; one already there (linked, or downloaded by an
+// approved command) is kept.
+function linkDistributions(source, target) {
+  let names = [];
+  try { names = fs.readdirSync(source, { withFileTypes: true }).filter(entry => entry.isDirectory()); } catch { return; }
+  for (const name of names) {
+    let hashes = [];
+    try { hashes = fs.readdirSync(path.join(source, name.name), { withFileTypes: true }).filter(entry => entry.isDirectory()); } catch { continue; }
+    for (const hash of hashes) {
+      const link = path.join(target, name.name, hash.name);
+      try { fs.lstatSync(link); continue; } catch { /* not there yet */ }
+      try { fs.mkdirSync(path.dirname(link), { recursive: true, mode: 0o700 }); fs.symlinkSync(path.join(source, name.name, hash.name), link); } catch { /* best effort */ }
+    }
+  }
+}
+
+// The Gradle Wrapper locks <hash>/<zip>.lck and checks <zip>.ok before it
+// uses a distribution, so each <name>/<hash> is a folder of the cache with
+// the marker copied and the unpacked distribution linked.
+function linkGradleDistributions(source, target) {
+  let names = [];
+  try { names = fs.readdirSync(source, { withFileTypes: true }).filter(entry => entry.isDirectory()); } catch { return; }
+  for (const name of names) {
+    let hashes = [];
+    try { hashes = fs.readdirSync(path.join(source, name.name), { withFileTypes: true }).filter(entry => entry.isDirectory()); } catch { continue; }
+    for (const hash of hashes) {
+      const from = path.join(source, name.name, hash.name), to = path.join(target, name.name, hash.name);
+      let entries = [];
+      try { entries = fs.readdirSync(from, { withFileTypes: true }); } catch { continue; }
+      if (!entries.some(entry => entry.name.endsWith('.ok'))) continue; // not fully unpacked
+      try { fs.mkdirSync(to, { recursive: true, mode: 0o700 }); } catch { continue; }
+      for (const entry of entries) {
+        const link = path.join(to, entry.name);
+        try { fs.lstatSync(link); continue; } catch { /* not there yet */ }
+        try {
+          if (entry.isDirectory()) fs.symlinkSync(path.join(from, entry.name), link);
+          else if (entry.name.endsWith('.ok')) fs.writeFileSync(link, '', { mode: 0o600 });
+        } catch { /* best effort */ }
+      }
+    }
+  }
+}
+
 export function languageEnvironment({ userHome, repositoryTop, home }) {
   const linux = process.platform === 'linux';
   const root = linux ? path.join(process.env.XDG_CACHE_HOME || path.join(userHome, '.cache'), 'piagent/sandbox') : path.join(userHome, 'Library/Caches/Piagent/sandbox');
@@ -80,11 +128,19 @@ export function languageEnvironment({ userHome, repositoryTop, home }) {
     // .NET restores over TLS through the macOS Security framework, closed
     // here: packages the member restored are read from their own folder.
     nuget: existing(path.join(userHome, '.nuget/packages')),
+    mavenWrapper: existing(path.join(userHome, '.m2/wrapper/dists')),
+    gradleWrapper: existing(path.join(userHome, '.gradle/wrapper/dists')),
   };
   const java = javaHome(userHome), android = existing(path.join(userHome, linux ? 'Android/Sdk' : 'Library/Android/sdk'));
   const readRoots = [...new Set([...Object.values(seeds), java, android, existing(path.join(userHome, 'Library/Java/JavaVirtualMachines')),
     existing('/Library/Ruby'), existing('/opt/local')].filter(Boolean))];
 
+  // ./mvnw looks for its distribution in MAVEN_USER_HOME/wrapper/dists/<name>/<hash>
+  // (the sandbox's HOME is an empty folder per conversation).
+  if (seeds.mavenWrapper) linkDistributions(seeds.mavenWrapper, at('m2/wrapper/dists'));
+  // ./gradlew: GRADLE_USER_HOME/wrapper/dists/<name>/<hash>.
+  if (seeds.gradleWrapper) linkGradleDistributions(seeds.gradleWrapper, at('gradle/wrapper/dists'));
+
   const bin = path.join(home, '.piagent/bin');
   fs.mkdirSync(bin, { recursive: true, mode: 0o700 });
   // (Only macOS: SwiftPM on Linux starts no sandbox of its own.)
@@ -102,6 +158,7 @@ export function languageEnvironment({ userHome, repositoryTop, home }) {
     CARGO_HOME: at('cargo'), GRADLE_USER_HOME: at('gradle'), NUGET_PACKAGES: at('nuget'), COMPOSER_CACHE_DIR: at('composer'),
     PUB_CACHE: at('pub'), GEM_HOME: at('gem'), BUNDLE_PATH: at('bundle'), CP_HOME_DIR: at('cocoapods'), PIAGENT_DERIVED_DATA: at('DerivedData'),
     DOTNET_CLI_TELEMETRY_OPTOUT: '1', DOTNET_NOLOGO: '1', DOTNET_SKIP_FIRST_TIME_EXPERIENCE: '1',
+    MAVEN_USER_HOME: at('m2'),
     MAVEN_OPTS: [`-Dmaven.repo.local=${at('m2/repository')}`, ...(seeds.maven ? [`-Dmaven.repo.local.tail=${seeds.maven}`] : [])].join(' '),
     ...(seeds.gradle ? { GRADLE_RO_DEP_CACHE: seeds.gradle } : {}),
     ...(seeds.nuget ? { NUGET_FALLBACK_PACKAGES: seeds.nuget } : {}),

package/packages/piagent-core/managed/linux-sandbox.mjs

@@ -52,7 +52,7 @@ export function credentialFiles(roots, { limit = SCAN_ENTRIES } = {}) {
 }
 
 const depth = file => file.split('/').length;
-export function bubblewrapArgs({ cwd, sdkRoot, runtimeRoot, temporary, empty, node, readOnly = false, repository = [], gitDirs = [], toolchains = [], skills = [], caches = [], references = [], network = false, credentials = [] }) {
+export function bubblewrapArgs({ cwd, sdkRoot, runtimeRoot, temporary, empty, node, readOnly = false, repository = [], gitDirs = [], toolchains = [], skills = [], caches = [], references = [], network = false, credentials = [], docker = null }) {
   const exists = file => { try { fs.statSync(file); return true; } catch { return false; } };
   const readable = [...new Set([sdkRoot, runtimeRoot, path.dirname(node), ...repository, ...toolchains, ...skills, ...references, ...(readOnly ? [cwd, ...gitDirs] : [])])].filter(exists);
   const writable = [...new Set([...caches, ...(readOnly ? [] : [cwd, ...gitDirs])])].filter(exists);
@@ -66,6 +66,8 @@ export function bubblewrapArgs({ cwd, sdkRoot, runtimeRoot, temporary, empty, no
     '--proc', '/proc', '--dev', '/dev', '--tmpfs', '/tmp', '--bind', temporary, temporary,
     ...mounts.flatMap(([kind, dir]) => [kind, dir, dir]),
     ...credentials.filter(item => exists(item.path)).flatMap(item => item.directory ? ['--tmpfs', item.path] : ['--ro-bind', empty, item.path]),
+    // An approved Docker command reaches the engine's socket (run_with_docker).
+    ...(docker && exists(docker) ? ['--bind', docker, docker] : []),
     '--remount-ro', '/', '--chdir', cwd,
   ];
 }

package/packages/piagent-core/managed/native-catalog.mjs

@@ -12,6 +12,19 @@ const sonnet55 = {
   compat: { forceAdaptiveThinking: true, supportsTemperature: false, supportsStrictTools: true, supportsMidConvoEffort: true },
   promptCache: { short: 300, long: 3600 },
 };
+// Claude Haiku 5.5, released 2026-10-07, checked 2026-10-08: 1M context,
+// 128k output, adaptive thinking with effort; $0.10/$0.50 per 1M, cache read
+// $0.01, 5m cache write $0.125, all five times above 100k input tokens.
+// https://platform.claude.com/docs/en/models/haiku-5-5/overview
+const haiku55 = {
+  id: 'claude-haiku-5-5', provider: 'anthropic', api: 'anthropic-messages',
+  name: 'Claude Haiku 5.5', reasoning: true, input: ['text', 'image'],
+  contextWindow: 1000000, maxTokens: 128000,
+  cost: { input: 0.1, output: 0.5, cacheRead: 0.01, cacheWrite: 0.125, tiers: [{ inputTokensAbove: 100000, input: 0.5, output: 2.5, cacheRead: 0.05, cacheWrite: 0.625 }] },
+  thinkingLevelMap: { off: null, minimal: null, low: 'low', medium: 'medium', high: 'high', xhigh: 'xhigh', max: 'max' },
+  compat: { forceAdaptiveThinking: true, supportsTemperature: false, supportsStrictTools: true, supportsMidConvoEffort: true },
+  promptCache: { short: 300, long: 3600 },
+};
 // GPT-6.1 Sol through Codex, checked 2026-10-01: Codex keeps the 272k window
 // of its pricing tier (the API model has 1.05M); 128k output; efforts low to
 // max, no none/minimal; $2/$10 per 1M, cached $0.10, doubled above 272k.
@@ -27,7 +40,7 @@ const sol61 = {
   compat: { supportsOpenAIGrammarTools: true, supportsAdditionalTools: true, supportsToolSearch: true, supportsMidConvoSystemMessages: true },
   inputLimits: { images: { resize: { maxWidth: 2000, maxHeight: 2000, maxBytes: 4718592, jpegQuality: 80 } } },
 };
-const GAPS = { anthropic: [sonnet55], 'openai-codex': [sol61] };
+const GAPS = { anthropic: [sonnet55, haiku55], 'openai-codex': [sol61] };
 // Studio's providers: the Claude and Codex subscriptions, or an API-key
 // vendor (DeepSeek, Kimi, GLM, MiMo, Qwen, OpenCode, Grok) whose id is Pi's
 // own provider id; Studio runs vendors as OpenAI Chat Completions.

package/packages/piagent-core/managed/patch-snapshot.mjs

@@ -10,14 +10,18 @@ const MAX_SNAPSHOT = 16 * 1024 * 1024;
 
 // The worker runs inside the tool boundary; what it prints is one short line.
 // `scope`: only these paths (relative to the project) make the patch.
-async function worker(boundary, mode, scope = null) {
+// `base`: the commit the patch starts from (the turn's starting HEAD), so a
+// commit made during the turn stays part of its change; none: HEAD.
+const BASE = /^[0-9a-f]{40}([0-9a-f]{24})?$/;
+async function worker(boundary, mode, scope = null, base = null) {
   let scopeName = null;
   if (scope) {
     scopeName = `scope-${randomUUID()}.json`;
     fs.writeFileSync(path.join(boundary.temporary, scopeName), JSON.stringify([...scope]), { mode: 0o600, flag: 'wx' });
   }
   let result;
-  try { result = await boundary.invoke('bash', { command: `${quote(process.execPath)} ${quote(WORKER)} ${mode}${scopeName ? ' ' + scopeName : ''}`, timeout: 60 }); }
+  const from = typeof base === 'string' && BASE.test(base) ? ' ' + base : '';
+  try { result = await boundary.invoke('bash', { command: `${quote(process.execPath)} ${quote(WORKER)} ${mode}${scopeName ? ' ' + scopeName : ''}${from}`, timeout: 60 }); }
   finally { if (scopeName) fs.rmSync(path.join(boundary.temporary, scopeName), { force: true }); }
   const text = textContent(result).trim();
   if (result.details?.truncation?.truncated || text.includes('\n')) throw Error(/review-(patch|file|untracked)-limit/.exec(text)?.[0] ?? 'managed-review-patch-unreadable');
@@ -28,14 +32,23 @@ async function worker(boundary, mode, scope = null) {
 
 // The digest of the patch a reviewer would see (diff against HEAD plus
 // untracked files): whether a review is still current. Nothing else moves.
-export async function readPatchDigest(boundary, scope = null) { return (await worker(boundary, 'digest', scope)).digest; }
+export async function readPatchDigest(boundary, scope = null, base = null) { return (await worker(boundary, 'digest', scope, base)).digest; }
+
+// The commit HEAD names now, or null (no repository, no commit yet).
+export async function readHead(boundary) {
+  try {
+    const result = await boundary.invoke('bash', { command: `${quote(process.execPath)} ${quote(WORKER)} head`, timeout: 60 });
+    const text = textContent(result).trim();
+    return BASE.test(text) ? text : null;
+  } catch { return null; }
+}
 
 // The patch a reviewer sees, read inside the tool boundary. The worker writes
 // it to the boundary's temporary directory and names it, with its digest, on
 // its output; the file is read once, must match that digest (a file changed
 // meanwhile never passes) and is removed.
-export async function readPatchSnapshot(boundary, scope = null) {
-  const { digest, bytes, name } = await worker(boundary, 'file', scope);
+export async function readPatchSnapshot(boundary, scope = null, base = null) {
+  const { digest, bytes, name } = await worker(boundary, 'file', scope, base);
   if (!/^review-[0-9a-f-]{36}\.json$/.test(name ?? '')) throw Error('managed-review-patch-unreadable');
   return { patch: readOnce(boundary, name, bytes, digest).toString('utf8'), digest };
 }
@@ -44,8 +57,8 @@ export async function readPatchSnapshot(boundary, scope = null) {
 // Compared before and after a command, it names the files that command
 // changed, so a conversation answers for its own changes, not for another
 // conversation's in the same folder.
-export async function readChangedFiles(boundary) {
-  const { digest, bytes, name } = await worker(boundary, 'files');
+export async function readChangedFiles(boundary, base = null) {
+  const { digest, bytes, name } = await worker(boundary, 'files', null, base);
   if (!/^files-[0-9a-f-]{36}\.json$/.test(name ?? '')) throw Error('managed-review-patch-unreadable');
   return new Map(Object.entries(JSON.parse(readOnce(boundary, name, bytes, digest).toString('utf8'))));
 }
@@ -74,6 +87,9 @@ export function reviewUnavailableReason(message) {
   return 'failed';
 }
 
+// What the diff is taken against: HEAD, or the commit the turn started from
+// (commits made during the turn are part of the change).
+const against = value => value?.base ? `diff against the commit the turn started from (${String(value.base).slice(0, 12)}), commits made since included` : 'diff against HEAD';
 // The patch as a reviewer reads it: the diff, then each new file in full.
 export function reviewText(snapshot) {
   let value;
@@ -82,7 +98,7 @@ export function reviewText(snapshot) {
     : f.mode === 'directory' ? `=== new folder ${f.path} (a repository of its own, not reviewed)`
     : f.encoding === 'omitted' ? `=== new file ${f.path} (${f.bytes} bytes, too large to review)`
     : f.encoding === 'utf8' ? `=== new file ${f.path}\n${f.contents}` : `=== new binary file ${f.path} (${Math.round(f.contents.length * 0.75)} bytes)`);
-  return `Patch snapshot ${snapshot.digest}:\n--- diff against HEAD ---\n${value.patch || '(no changes to tracked files)'}\n${files.length ? `--- new files ---\n${files.join('\n\n')}` : ''}`;
+  return `Patch snapshot ${snapshot.digest}:\n--- ${against(value)} ---\n${value.patch || '(no changes to tracked files)'}\n${files.length ? `--- new files ---\n${files.join('\n\n')}` : ''}`;
 }
 
 // A patch larger than one reviewer reads at once (REVIEW_PART_BYTES, about
@@ -125,7 +141,7 @@ export function reviewParts(snapshot, size = REVIEW_PART_BYTES) {
   const parts = groups.map((group, i) => {
     const files = group.sections.map(s => s.file), diff = group.sections.filter(s => s.kind === 'diff').map(s => s.text).join(''), news = group.sections.filter(s => s.kind === 'new').map(s => s.text);
     const head = groups.length === 1 ? `Patch snapshot ${snapshot.digest}.` : `Patch snapshot ${snapshot.digest}, part ${i + 1} of ${groups.length}. This part's files: ${files.join(', ')}. The other parts are reviewed separately: judge this part, and read other files only for context.`;
-    return { files, text: `${head}${skipped}\n--- diff against HEAD ---\n${diff || '(no changes to tracked files in this part)'}\n${news.length ? `--- new files ---\n${news.join('\n\n')}` : ''}` };
+    return { files, text: `${head}${skipped}\n--- ${against(value)} ---\n${diff || '(no changes to tracked files in this part)'}\n${news.length ? `--- new files ---\n${news.join('\n\n')}` : ''}` };
   });
   return { parts: parts.length ? parts : [{ files: [], text: `Patch snapshot ${snapshot.digest}: every changed file is too large to review.${skipped}` }], omitted };
 }

package/packages/piagent-core/managed/repository-operation.mjs

@@ -82,3 +82,23 @@ export async function executeRepositoryFetch(boundary,plan,signal,{transport=fet
     return {content:[{type:'text',text:`Fetched origin branches for ${plan.repository}. Working files and current branch were not changed.`}],details:{operation:'git.fetch',repository:plan.repository}};
   } finally {fs.rmSync(staging,{recursive:true,force:true});}
 }
+
+// The fetch_origin tool of a company conversation: one approved fetch of the
+// GitHub origin (Bypass fetches without asking).
+export function fetchOriginTool(self) {
+  return {name:'fetch_origin',label:'Fetch origin',description:'Request one approved GitHub origin fetch. Refreshes origin branches without changing working files. Does not expose credentials or allow arbitrary network commands.',
+    parameters:{type:'object',properties:{},additionalProperties:false},
+    execute:async(id,_args,signal,_update,ctx)=>{
+      const plan=await repositoryFetchPlan(self.boundary);
+      if(self.permission==='trusted-full-access'&&!signal?.aborted)return executeRepositoryFetch(self.boundary,plan,signal);
+      const {piApprovalBroker}=await import('../runtime/inspection/approval-broker.ts');
+      const decision=await piApprovalBroker.request({cwd:self.cwd,rawSessionId:self.session.sessionManager.getSessionId(),toolCallId:id,
+        action:{kind:'external-provider-action',preconditionClass:'runtime-only',toolName:'fetch_origin',rawAction:plan,
+          targetPaths:[self.cwd],provider:'github',urlOrigin:'https://github.com',requestedScope:'fetch-origin-once',
+          reason:`Fetch origin branches from ${plan.repository}`,riskClass:'low',allowConsequence:'Download origin branches once; keep the current branch and working files unchanged.',denyConsequence:'No network request or credential read.'},
+        terminalConfirm:()=>ctx?.ui?.confirm?.('Tải nhánh từ origin',`Tải các nhánh của ${plan.repository} về ${self.cwd} một lần.\n\nĐồng ý: chỉ tải nhánh; nhánh hiện tại và file đang làm không đổi.\nTừ chối: không gửi request mạng, không đọc thông tin đăng nhập.`)??Promise.resolve(false),
+        unavailableFallback:'terminal-confirm',recheck:()=>!signal?.aborted&&Boolean(self.grant)});
+      if(!decision.allowed||!decision.consume()||signal?.aborted)throw Error('managed-operation-denied');
+      return executeRepositoryFetch(self.boundary,plan,signal);
+    }};
+}

package/packages/piagent-core/managed/request-stream.mjs

@@ -186,3 +186,31 @@ function capacityStatus(owner) {
   try { owner.session?.extensionRunner?.getUIContext?.()?.setWorkingMessage?.(wait ? `Agent Watch ${who}: waiting for a free company model account (${failureReason(wait.code)}). Esc stops.` : undefined); }
   catch { /* no Terminal */ }
 }
+
+// A company answer that failed for a passing reason after Studio admitted it
+// (the model's stream was cut or came back empty, the model or Studio's
+// gateway did not answer, Studio could not be reached) is asked again by Pi's
+// own turn retry: up to twice, 2 then 4 s apart, with the failed attempt left
+// out of what the model sees. Tools run only after a whole answer, so nothing
+// the agent did is repeated; the price is the request's input, billed again.
+// Refusals before admission are asked again earlier, in wrapRoleStreams;
+// everything else (quota, key, policy, a rejected or refused request, a closed
+// run) fails at once, as before. Pi decides by the words of an error, which
+// for a company failure would match "rate limited" or "timeout" in sentences
+// that must not be retried; here it decides by Studio's code only.
+export const TURN_RETRY_CODES = new Set(['upstream_interrupted', 'upstream_incomplete', 'upstream_timeout', 'upstream_unavailable',
+  'connector_unavailable', 'connector_execution_failed', 'inference_unavailable', 'studio-unreachable']);
+export const TURN_RETRY = { maxRetries: 2, baseDelayMs: 2_000 };
+
+export function companyTurnRetryable(message) {
+  return message?.stopReason === 'error' && TURN_RETRY_CODES.has(failureCode(message.errorMessage));
+}
+
+// True when the session retries company failures by code. A Pi whose session
+// no longer has the hook keeps retry off rather than retrying by words.
+export function enableCompanyTurnRetry(session, settings) {
+  if (typeof session?._isRetryableError !== 'function') return false;
+  session._isRetryableError = companyTurnRetryable;
+  settings.applyOverrides({ retry: { enabled: true, ...TURN_RETRY } });
+  return true;
+}

package/packages/piagent-core/managed/review-snapshot-worker.mjs

@@ -13,10 +13,17 @@ const MAX_SNAPSHOT = 16 * 1024 * 1024, MAX_UNTRACKED = 2000, READ_FILE = 400_000
 const git = args => execFileSync(managedGit(), ['--no-pager', ...args], { encoding: 'utf8', maxBuffer: MAX_SNAPSHOT + 1, env: { ...process.env, GIT_TERMINAL_PROMPT: '0', GIT_CONFIG_NOSYSTEM: '1' } });
 const sha256 = data => createHash('sha256').update(data).digest('hex');
 const mode = process.argv[2];
+// The arguments after the mode: a scope file, then the commit the patch starts
+// from (the turn's starting HEAD; commits made since are part of the change).
+// While HEAD has not moved, the patch is the plain one against HEAD.
+const head = () => { try { return git(['rev-parse', '--verify', '-q', 'HEAD^{commit}']).trim(); } catch { return ''; } };
+if (mode === 'head') { process.stdout.write(head() || 'none'); process.exit(0); }
+const extra = process.argv.slice(3), given = extra.find(a => /^[0-9a-f]{40}([0-9a-f]{24})?$/.test(a));
+const base = given && given !== head() ? given : 'HEAD';
 // "files": what each changed or new file holds now (a hash, "deleted"), so
 // the runtime can tell which files one conversation's command changed.
 if (mode === 'files') {
-  const changed = git(['diff', '--name-only', '--no-renames', '--relative', '-z', 'HEAD', '--', '.']).split('\0').filter(Boolean);
+  const changed = git(['diff', '--name-only', '--no-renames', '--relative', '-z', base, '--', '.']).split('\0').filter(Boolean);
   const fresh = git(['ls-files', '--others', '--exclude-standard', '-z']).split('\0').filter(Boolean);
   if (changed.length + fresh.length > MAX_UNTRACKED * 4) throw Error('review-untracked-limit');
   const print = name => {
@@ -33,11 +40,11 @@ if (mode === 'files') {
 }
 // A scope (a file the runtime wrote in this boundary's temporary directory):
 // only these paths, the ones this conversation changed, make the patch.
-const scopeName = process.argv[3];
+const scopeName = extra.find(a => a !== given);
 if (scopeName !== undefined && !/^scope-[0-9a-f-]{36}\.json$/.test(scopeName)) throw Error('review-scope-invalid');
 const scope = scopeName ? new Set(JSON.parse(fs.readFileSync(path.join(os.tmpdir(), scopeName), 'utf8'))) : null;
 if (scope && [...scope].some(p => typeof p !== 'string' || !p || path.isAbsolute(p) || p.split('/').includes('..'))) throw Error('review-scope-invalid');
-const patch = scope && !scope.size ? '' : git(['diff', '--binary', '--no-ext-diff', '--no-textconv', '--no-renames', 'HEAD', '--', ...(scope ? [...scope].sort().map(p => ':(literal)' + p) : ['.'])]);
+const patch = scope && !scope.size ? '' : git(['diff', '--binary', '--no-ext-diff', '--no-textconv', '--no-renames', base, '--', ...(scope ? [...scope].sort().map(p => ':(literal)' + p) : ['.'])]);
 const paths = git(['ls-files', '--others', '--exclude-standard', '-z']).split('\0').filter(Boolean).filter(p => !scope || scope.has(p)).sort();
 if (paths.length > MAX_UNTRACKED) throw Error('review-untracked-limit');
 const untracked = paths.map(name => {
@@ -55,7 +62,7 @@ const untracked = paths.map(name => {
   if (text !== null) return { path: name, mode, contents: text, encoding: 'utf8' };
   return stat.size > BINARY_INLINE ? { path: name, mode, encoding: 'omitted', bytes: stat.size, sha256: sha256(data) } : { path: name, mode, contents: data.toString('base64'), encoding: 'base64' };
 });
-const snapshot = Buffer.from(JSON.stringify({ patch, untracked }));
+const snapshot = Buffer.from(JSON.stringify(base === 'HEAD' ? { patch, untracked } : { base, patch, untracked }));
 if (snapshot.length > MAX_SNAPSHOT) throw Error('review-patch-limit');
 // "digest": the digest and size only (is a review still current?). "file":
 // the snapshot goes to a new file in this boundary's temporary directory,

package/packages/piagent-core/managed/sandbox-diagnostic.mjs

@@ -7,8 +7,13 @@ const OFFLINE = /ENOTFOUND|EAI_AGAIN|Could not resolve host|getaddrinfo|npm erro
 // name that does not resolve is the machine's network, not the sandbox.
 // `isolated`: a proxy listens on this Mac, so without approval a command does
 // not reach this Mac's own servers either (tool-boundary.mjs).
-export function sandboxDiagnostic(message, { network = false, isolated = false } = {}) {
+// `docker`: the command ran with the Docker engine (run_with_docker);
+// `engine`: one is there for run_with_docker, but this command ran without it.
+const DOCKER_DAEMON = /Cannot connect to the Docker daemon|connect to the docker API|docker\.sock|Is the docker daemon running|Could not find a valid Docker environment/i;
+export function sandboxDiagnostic(message, { network = false, isolated = false, docker = false, engine = false } = {}) {
   const text=String(message);
+  if(docker&&DOCKER_DAEMON.test(text))return 'managed-docker-unreachable: Lệnh chạy với Docker nhưng Docker engine không trả lời (Docker Desktop/Colima chưa chạy hoặc đang khởi động). Không xin duyệt lại cùng lệnh; báo người dùng mở Docker rồi thử lại.\n'+text;
+  if(!docker&&DOCKER_DAEMON.test(text))return (engine?'managed-docker-blocked: Lệnh bash thường không dùng được Docker trong chế độ công ty. Lệnh docker, docker compose, hoặc test cần Docker (Testcontainers) chạy qua run_with_docker để người dùng duyệt đúng lệnh đó.\n':'managed-docker-unavailable: Máy chưa có Docker engine đang chạy (Docker Desktop, Colima, OrbStack…). Báo người dùng mở Docker; sau đó cuộc trò chuyện mới có run_with_docker.\n')+text;
   if(isolated&&/ECONNREFUSED|EPERM|connect|Connection refused|could not connect/i.test(text))return 'managed-loopback-blocked: Máy đang chạy một proxy cục bộ, nên lệnh không có mạng cũng không được kết nối tới server trên localhost (proxy có thể đưa lệnh ra internet). Test cần server hoặc database trên localhost: dùng run_with_network để người dùng duyệt đúng lệnh đó.\n'+text;
   if(network&&!DENIAL.test(text)&&OFFLINE.test(text))return 'managed-network-unreachable: Lệnh đã được duyệt và chạy có mạng nhưng không tới được host (máy đang offline, cần VPN/proxy công ty, hoặc sai tên host). Không xin duyệt lại cùng lệnh; báo người dùng lỗi mạng này.\n'+text;
   if(!DENIAL.test(text)&&OFFLINE.test(text))return 'managed-network-blocked: Lệnh bash thường không có mạng trong chế độ công ty. Nếu lệnh thật sự cần mạng (cài package, tải dữ liệu), dùng run_with_network để người dùng duyệt đúng lệnh đó.\n'+text;