@piagent/platform 1.18.0 → 1.19.0

package/docs-site/en/whats-new.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.18.0 docs · EN</span>
+        <span class="pill"><span class="pill-dot"></span>v1.19.0 docs · EN</span>
         <nav class="language-switch" aria-label="Language">
           <a class="language-option" href="/whats-new" hreflang="vi" lang="vi">VI</a>
           <a class="language-option current" href="/en/whats-new" hreflang="en" lang="en" aria-current="true">EN</a>
@@ -104,6 +104,13 @@
               <h1>1.9.0: ask in plain language, the team's Harness checks</h1>
               <p>The task contract and workflow commands are gone. Company mode asks for checks and a review on its own; Stop, network commands on approval and clearer approval cards.</p>
             </div>
+<section class="section">
+  <p class="section-kicker">v1.19.0 · 2026-10-08</p>
+  <h2 id="v1-19-0">Tasks with a checklist are carried to the end, and each turn says whether it finished</h2>
+  <p class="section-lead">In a company conversation, when the main agent stops while its checklist still has open steps (say, after STEP06 of the STEP22 you asked for) and the team's Harness requires a plan, the harness sends it on to the next open step, as if you had sent “continue”. It stops when the checklist is done, when you press Stop or write, when a round fails, or after 2 rounds in a row that finish no step. Every turn ends with one line: Done, Stopped midway with x of y steps open (and why), Turn stopped by a failure, or You stopped this turn, with Continue when the task is not finished; the conversation list shows it too. Steps you leave for later are marked deferred, never completed; “continue” takes up the open checklist. A turn whose change the agent committed is still checked and reviewed.</p>
+  <p class="section-lead">Docker in the company sandbox: when Docker runs on the machine (Docker Desktop, Colima, OrbStack…), the agent has <span class="inline-code">run_with_docker</span> to run one command you approve with internet and Docker, such as a test database with <span class="inline-code">docker compose up -d</span>, <span class="inline-code">docker build</span> or Testcontainers tests. Docker gets no registry credentials; Bypass still asks when a command or compose file mounts a folder outside the project. <span class="inline-code">./gradlew</span> and <span class="inline-code">./mvnw</span> reuse the Gradle and Maven already on the machine, without asking for network. A folder that holds several repositories (front end, back end…, each its own Git) shows “N repo”: click it to see each repository, its branch and changed files, and switch branches there; a full folder list makes room instead of failing to add a folder.</p>
+</section>
+
 <section class="section">
   <p class="section-kicker">v1.18.0 · 2026-10-08</p>
   <h2 id="v1-18-0">Switch the Git branch from the dashboard, retries for passing failures, Claude Haiku 5.5</h2>

package/docs-site/en/windows.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.18.0 docs · EN</span>
+        <span class="pill"><span class="pill-dot"></span>v1.19.0 docs · EN</span>
         <nav class="language-switch" aria-label="Language">
           <a class="language-option" href="/windows" hreflang="vi" lang="vi">VI</a>
           <a class="language-option current" href="/en/windows" hreflang="en" lang="en" aria-current="true">EN</a>

package/docs-site/en/workflows.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.18.0 docs · EN</span>
+        <span class="pill"><span class="pill-dot"></span>v1.19.0 docs · EN</span>
         <nav class="language-switch" aria-label="Language">
           <a class="language-option" href="/workflows" hreflang="vi" lang="vi">VI</a>
           <a class="language-option current" href="/en/workflows" hreflang="en" lang="en" aria-current="true">EN</a>

package/docs-site/index.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.18.0 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.19.0 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/" hreflang="en" lang="en">EN</a>
@@ -94,7 +94,7 @@
       <main>
         <div class="content-shell" data-article>
 <section class="hero">
-  <p class="eyebrow">Piagent 1.18.0</p>
+  <p class="eyebrow">Piagent 1.19.0</p>
   <h1>Coding agent cho cả team, kiểm tra từng bước.</h1>
   <p>
     Một dashboard cho Terminal và trình duyệt. Dùng model bằng tài khoản của bạn, hoặc model của công ty qua Agent Watch và Agent Studio. Guard kiểm tra từng tool call; ở chế độ công ty, Harness của team tự yêu cầu chạy check, cho subagent review và báo kết quả ngay dưới câu trả lời.
@@ -108,7 +108,7 @@
   <div class="hero-actions">
     <a class="button primary" href="/quickstart">Bắt đầu</a>
     <a class="button" href="/ecosystem">Hệ sinh thái</a>
-    <a class="button" href="/whats-new">Có gì mới trong 1.18.0</a>
+    <a class="button" href="/whats-new">Có gì mới trong 1.19.0</a>
     <a class="button" href="/commands">Xem command</a>
   </div>
 </section>
@@ -184,9 +184,9 @@ piagent-setup</code></pre>
   <h2 id="bat-dau-tu-dau">Bắt đầu từ đâu</h2>
   <div class="card-grid">
     <a class="doc-card" href="/whats-new">
-      <span class="card-kicker">Bản 1.18.0</span>
+      <span class="card-kicker">Bản 1.19.0</span>
       <h3>Có gì mới</h3>
-      <p>Đổi nhánh Git trên dashboard, tự thử lại khi lỗi tạm thời, Claude Haiku 5.5; ở 1.17.0: dashboard hiện nhánh Git của project; ở 1.16.3: dashboard cập nhật xong vẫn tự kiểm tra bản mới; ở 1.16.2: Terminal nói giống dashboard: hỏi cập nhật, /bypass, lỗi và ghi chú Harness bằng tiếng Việt; ở 1.16.1: bản mới được báo bằng dialog và kiểm tra mỗi giờ, tab dashboard không còn mất đăng nhập; ở 1.16.0: Bypass cho cuộc trò chuyện công ty, đổi Harness không làm gián đoạn; ở 1.15.2: cuộc trò chuyện dài tự thu gọn trở lại; ở 1.15.1: Studio thấy mỗi call của model dùng để làm gì, nhiều cuộc trò chuyện trong một folder không nhận nhầm thay đổi của nhau; ở 1.15.0: subagent bị từ chối nói đúng lý do; ở 1.14: cập nhật giữ model bạn đã chọn; ở 1.13: cuộc trò chuyện giữ chỗ đang đọc, chữ của agent có định dạng, Piagent trên Windows qua WSL2: sandbox công ty bằng bubblewrap và Agent Watch cho Windows; ở 1.12: @ chọn file và folder trên máy, skill và command dùng bằng /, nhánh cuộc trò chuyện công ty gửi được tin nhắn.</p>
+      <p>Task công ty có checklist được làm đến hết, cuối mỗi lượt báo rõ xong, dừng giữa chừng hay lỗi, Docker trong sandbox công ty, folder chứa nhiều repo; ở 1.18.0: đổi nhánh Git trên dashboard, tự thử lại khi lỗi tạm thời, Claude Haiku 5.5; ở 1.17.0: dashboard hiện nhánh Git của project; ở 1.16.3: dashboard cập nhật xong vẫn tự kiểm tra bản mới; ở 1.16.2: Terminal nói giống dashboard: hỏi cập nhật, /bypass, lỗi và ghi chú Harness bằng tiếng Việt; ở 1.16.1: bản mới được báo bằng dialog và kiểm tra mỗi giờ, tab dashboard không còn mất đăng nhập; ở 1.16.0: Bypass cho cuộc trò chuyện công ty, đổi Harness không làm gián đoạn; ở 1.15.2: cuộc trò chuyện dài tự thu gọn trở lại; ở 1.15.1: Studio thấy mỗi call của model dùng để làm gì, nhiều cuộc trò chuyện trong một folder không nhận nhầm thay đổi của nhau; ở 1.15.0: subagent bị từ chối nói đúng lý do; ở 1.14: cập nhật giữ model bạn đã chọn; ở 1.13: cuộc trò chuyện giữ chỗ đang đọc, chữ của agent có định dạng, Piagent trên Windows qua WSL2: sandbox công ty bằng bubblewrap và Agent Watch cho Windows; ở 1.12: @ chọn file và folder trên máy, skill và command dùng bằng /, nhánh cuộc trò chuyện công ty gửi được tin nhắn.</p>
     </a>
     <a class="doc-card" href="/ecosystem">
       <span class="card-kicker">Get started</span>

package/docs-site/mcp-approval.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.18.0 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.19.0 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/mcp-approval" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/mcp-approval" hreflang="en" lang="en">EN</a>

package/docs-site/mcp-auth.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.18.0 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.19.0 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/mcp-auth" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/mcp-auth" hreflang="en" lang="en">EN</a>

package/docs-site/mcp-servers.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.18.0 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.19.0 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/mcp-servers" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/mcp-servers" hreflang="en" lang="en">EN</a>

package/docs-site/mcp.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.18.0 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.19.0 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/mcp" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/mcp" hreflang="en" lang="en">EN</a>

package/docs-site/permissions.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.18.0 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.19.0 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/permissions" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/permissions" hreflang="en" lang="en">EN</a>

package/docs-site/profiles.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.18.0 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.19.0 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/profiles" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/profiles" hreflang="en" lang="en">EN</a>

package/docs-site/quickstart.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.18.0 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.19.0 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/quickstart" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/quickstart" hreflang="en" lang="en">EN</a>

package/docs-site/runtime.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.18.0 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.19.0 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/runtime" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/runtime" hreflang="en" lang="en">EN</a>

package/docs-site/scope.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.18.0 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.19.0 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/scope" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/scope" hreflang="en" lang="en">EN</a>

package/docs-site/security.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.18.0 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.19.0 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/security" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/security" hreflang="en" lang="en">EN</a>

package/docs-site/team.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.18.0 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.19.0 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/team" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/team" hreflang="en" lang="en">EN</a>

package/docs-site/whats-new.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.18.0 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.19.0 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/whats-new" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/whats-new" hreflang="en" lang="en">EN</a>
@@ -104,6 +104,13 @@
               <h1>Bản 1.9.0: nói việc bằng lời, Harness của team kiểm tra</h1>
               <p>Bỏ task contract và lệnh workflow. Chế độ công ty tự yêu cầu check và review; nút Dừng, lệnh có mạng theo lần duyệt và thẻ duyệt dễ đọc hơn.</p>
             </div>
+<section class="section">
+  <p class="section-kicker">v1.19.0 · 2026-10-08</p>
+  <h2 id="v1-19-0">Task có checklist được làm đến hết, và mỗi lượt báo rõ đã xong hay chưa</h2>
+  <p class="section-lead">Trong cuộc trò chuyện công ty, khi main agent tự dừng lúc checklist còn bước (ví dụ làm xong STEP06 rồi dừng, dù bạn giao đến STEP22) và Harness của team bắt buộc plan, Harness tự cho agent làm tiếp bước kế tiếp, như bạn gửi “tiếp tục”. Nó dừng khi checklist xong, khi bạn bấm Stop hoặc nhắn tin, khi gặp lỗi, hoặc sau 2 vòng liên tiếp không xong thêm bước nào. Cuối mỗi lượt có một dòng: Hoàn thành, Dừng giữa chừng còn x/y bước (kèm lý do), Lượt dừng vì lỗi, hoặc Bạn đã dừng lượt này, với nút Tiếp tục khi task chưa xong; danh sách cuộc trò chuyện cũng hiện trạng thái này. Bước bạn bảo để sau được đánh dấu “để sau”, không bao giờ bị ghi là xong; gửi “tiếp tục” là agent nhận lại checklist đang dở. Lượt mà agent đã commit vẫn được chạy check và review.</p>
+  <p class="section-lead">Sandbox công ty dùng được Docker: khi máy đang chạy Docker (Docker Desktop, Colima, OrbStack…), agent có <span class="inline-code">run_with_docker</span> để chạy một lệnh bạn duyệt với internet và Docker, ví dụ bật database cho test bằng <span class="inline-code">docker compose up -d</span>, <span class="inline-code">docker build</span> hay test Testcontainers. Docker không mang theo thông tin đăng nhập registry; Bypass vẫn hỏi khi lệnh hoặc file compose mount thư mục ngoài project. <span class="inline-code">./gradlew</span> và <span class="inline-code">./mvnw</span> dùng lại bản Gradle/Maven đã có trên máy nên không phải xin mạng. Folder chứa nhiều repo (FE, BE… mỗi folder một git) hiện “N repo”: bấm vào để xem từng repo, nhánh và số file thay đổi, rồi đổi nhánh trong repo đó; danh sách folder đầy thì tự bỏ folder đã mất hoặc lâu nhất, không còn báo “Không thể thêm thư mục”.</p>
+</section>
+
 <section class="section">
   <p class="section-kicker">v1.18.0 · 2026-10-08</p>
   <h2 id="v1-18-0">Đổi nhánh Git trên dashboard, tự thử lại khi lỗi tạm thời, Claude Haiku 5.5</h2>

package/docs-site/windows.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.18.0 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.19.0 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/windows" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/windows" hreflang="en" lang="en">EN</a>

package/docs-site/workflows.html

@@ -30,7 +30,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.18.0 docs · VI</span>
+        <span class="pill"><span class="pill-dot"></span>v1.19.0 docs · VI</span>
         <nav class="language-switch" aria-label="Ngôn ngữ">
           <a class="language-option current" href="/workflows" hreflang="vi" lang="vi" aria-current="true">VI</a>
           <a class="language-option" href="/en/workflows" hreflang="en" lang="en">EN</a>

package/evals/private-holdout-v1/public-exposure.v2.json

@@ -256,8 +256,8 @@
     },
     {
       "path": "tests",
-      "fileCount": 527,
-      "sha256": "0af093aea0e49917dc63c09c71888c178bccfe842069d34d681ef7d04a61fba3"
+      "fileCount": 529,
+      "sha256": "bf1347157d8de533df6eca703df76ab279f60abd03535ff8ab798f6bb8f2c2a8"
     }
   ],
   "custodianComparisonRules": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@piagent/platform",
-  "version": "1.18.0",
+  "version": "1.19.0",
   "license": "MIT",
   "publishConfig": {
     "access": "public",

package/packages/piagent-core/managed/call-purpose.mjs

@@ -25,14 +25,15 @@ export function jobTitle(task, title) {
 }
 
 // The headers of one call. `owner.nextPurpose` is set by the harness when it
-// sends the main agent back (checks, review findings, a missing plan).
+// sends the main agent back (checks, review findings: "harness"; a checklist
+// with open steps: "continue").
 export function purposeHeaders(owner, runtime, role, context) {
   const messages = context?.messages ?? [], last = messages.at(-1);
   let purpose, after = '';
   if (systemText(context).startsWith(SUMMARY_PROMPT)) purpose = 'summary';
   else if (last?.role === 'toolResult') { purpose = 'tool_step'; after = afterTools(messages.findLast(m => m.role === 'assistant')); }
   else if (role !== 'main') purpose = 'brief';
-  else if (owner.nextPurpose === 'harness') { purpose = 'harness'; owner.nextPurpose = null; }
+  else if (['harness', 'continue'].includes(owner.nextPurpose)) { purpose = owner.nextPurpose; owner.nextPurpose = null; }
   else purpose = 'answer';
   const title = purpose === 'brief' ? owner.jobTitles?.get(runtime) : '';
   return { 'X-Agent-Purpose': purpose, ...(after ? { 'X-Agent-After': after } : {}), ...(title ? { 'X-Agent-Task': encodeURIComponent(title) } : {}) };

package/packages/piagent-core/managed/command-tools.mjs

@@ -0,0 +1,59 @@
+import { mustConfirm } from '../runtime/policy/bypass-policy.mjs';
+import { dockerConfirmation } from './container-engine.mjs';
+import { networkConfirmation } from './permission.mjs';
+
+// Commands that leave the plain sandbox, each after the member approves that
+// exact command: run_with_network (internet, a local server or browser) and,
+// when this machine has a Docker engine, run_with_docker (the same plus the
+// engine's socket). Bypass runs them without asking, except what must be
+// confirmed: for Docker also a container given host folders outside the
+// project, the engine's socket, or the host's processes or network.
+const PARAMETERS = { type: 'object', properties: { command: { type: 'string', minLength: 1, maxLength: 4000 }, reason: { type: 'string', minLength: 1, maxLength: 300 }, timeout: { type: 'number', minimum: 1, maximum: 1800 } }, required: ['command', 'reason'], additionalProperties: false };
+
+const KINDS = {
+  network: {
+    name: 'run_with_network', label: 'Run with network', scope: 'network-command-once', provider: 'network', riskClass: 'medium',
+    description: 'Run one shell command that needs the internet (package install, download, git pull of a public repository), or that starts a local server or a browser (end-to-end tests with Playwright\'s Chromium against a server on 127.0.0.1), after the user approves that exact command. Normal bash has no network and cannot listen on a port. Credentials (.npmrc, SSH keys, Keychain) stay unavailable, so private registries and git push are not possible here.',
+    allow: 'Run this exact command once, with internet access; a server it starts accepts connections while it runs.',
+    title: 'Chạy lệnh có internet', allowText: 'chạy đúng lệnh này một lần, có internet; server nó mở nhận kết nối trong lúc chạy.',
+    confirm: (self, command) => networkConfirmation(self, command),
+  },
+  docker: {
+    name: 'run_with_docker', label: 'Run with Docker', scope: 'docker-command-once', provider: 'docker', riskClass: 'high',
+    description: 'Run one shell command that needs the Docker engine of this machine: docker, docker compose (a database or service for tests), docker build, or tests that start containers themselves (Testcontainers), after the user approves that exact command. It has internet access too. Normal bash and run_with_network cannot reach Docker. Mount only folders inside the project. Registry credentials are unavailable: public images pull, private registries and docker push do not. Containers started in the background (-d, compose up -d) keep running after the command: stop them (docker compose down) when the work is done unless the member wants them kept.',
+    allow: 'Run this exact command once, with internet access and the Docker engine; a container it starts can read folders Docker shares from this machine and may keep running.',
+    title: 'Chạy lệnh dùng Docker', allowText: 'chạy đúng lệnh này một lần, có internet và Docker; container nó tạo có thể đọc thư mục Docker được chia sẻ trên máy và có thể tiếp tục chạy.',
+    confirm: async (self, command) => self.permission !== 'trusted-full-access' ? 'ask'
+      : await mustConfirm(command) ?? dockerConfirmation(command, { cwd: self.cwd, home: self.boundary.userHome }),
+  },
+};
+
+function commandTool(self, kind) {
+  const spec = KINDS[kind];
+  return { name: spec.name, label: spec.label, description: spec.description, parameters: PARAMETERS,
+    execute: async (id, args, signal, onUpdate, ctx) => {
+      const confirm = await spec.confirm(self, args.command);
+      const decision = confirm === null ? { allowed: true, consume: () => true } : await (await import('../runtime/inspection/approval-broker.ts')).piApprovalBroker.request({ cwd: self.cwd, rawSessionId: self.session.sessionManager.getSessionId(), toolCallId: id,
+        action: { kind: 'external-provider-action', preconditionClass: 'runtime-only', toolName: spec.name, rawAction: { command: args.command }, commandPreview: String(args.command),
+          targetPaths: [self.cwd], provider: spec.provider, urlOrigin: null, requestedScope: spec.scope, reason: (confirm === 'ask' ? String(args.reason) : `Bypass still asks: ${confirm}. ${args.reason}`).slice(0, 300), riskClass: spec.riskClass,
+          allowConsequence: spec.allow, denyConsequence: 'The command does not run; the agent is told you declined.' },
+        terminalConfirm: () => ctx?.ui?.confirm?.(spec.title, `${args.command}\n\nLý do: ${args.reason}${confirm === 'ask' ? '' : `\nBypass vẫn hỏi: ${confirm}`}\n\nĐồng ý: ${spec.allowText}\nTừ chối: lệnh không chạy, agent được báo bạn đã từ chối.`) ?? Promise.resolve(false),
+        unavailableFallback: 'terminal-confirm', recheck: () => !signal?.aborted && Boolean(self.grant) });
+      if (!decision.allowed || !decision.consume() || signal?.aborted) throw Error('managed-operation-denied');
+      let ok = false;
+      const before = await self.changedFiles();
+      try { const result = await self.boundary.invoke('bash', { command: args.command, ...(args.timeout ? { timeout: args.timeout } : {}) }, signal, onUpdate, ctx?.model, kind === 'docker' ? { docker: true } : { network: true }); ok = !result?.isError; return result; }
+      finally { await self.claimChanges(before); await self.run?.afterTool('bash', args, ok, () => self.digest()); await self.refreshReview(); }
+    } };
+}
+
+export function commandTools(self) {
+  return [commandTool(self, 'network'), ...(self.boundary.engine ? [commandTool(self, 'docker')] : [])];
+}
+
+// What the system prompt says about services: Docker when the machine has an
+// engine (run_with_docker), else the member starts them.
+export function servicesPrompt(boundary) {
+  if (boundary.engine) return ' Docker is available through run_with_docker (the member approves each command): a database or service for tests (docker compose up -d, then the tests through bash or run_with_network), docker build, or Testcontainers tests. Stop what you started when done unless the member wants it kept. The iOS Simulator is not available in the sandbox: ask the member to run those tests.';
+  return ' Docker is not running on this machine and the iOS Simulator is not available in the sandbox: ask the member to start those services (or Docker, after which a new conversation has run_with_docker) or run those tests.';
+}

package/packages/piagent-core/managed/container-engine.mjs

@@ -0,0 +1,102 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+// The Docker engine a company command may use once the member approves it
+// (run_with_docker): its socket, the CLI and its plugins (compose, buildx).
+// The socket is the only thing opened beyond an approved network command:
+// containers run in the engine (Docker Desktop's VM, Colima, OrbStack, the
+// Linux daemon, Podman's compatible socket), not in this sandbox.
+// The CLI gets a configuration folder of its own in the sandbox's home: no
+// registry credentials (credsStore, auths), so public images are pulled and
+// private registries are not, as with .npmrc.
+const isSocket = file => { try { return fs.statSync(file).isSocket(); } catch { return false; } };
+const real = file => { try { return fs.realpathSync(file); } catch { return null; } };
+
+function socketCandidates(userHome, env, system) {
+  const host = /^unix:\/\/(\/.+)$/.exec(env.DOCKER_HOST ?? '')?.[1];
+  const runtime = env.XDG_RUNTIME_DIR;
+  return [host, path.join(userHome, '.docker/run/docker.sock'), ...(system ? ['/var/run/docker.sock'] : []), path.join(userHome, '.colima/default/docker.sock'),
+    path.join(userHome, '.orbstack/run/docker.sock'), ...(runtime ? [path.join(runtime, 'docker.sock'), path.join(runtime, 'podman/podman.sock')] : [])].filter(Boolean);
+}
+
+// The member's CLI plugins (links into the app bundle on macOS).
+function cliPlugins(userHome, system) {
+  const dirs = [path.join(userHome, '.docker/cli-plugins'), ...!system ? [] : ['/usr/local/lib/docker/cli-plugins', '/usr/libexec/docker/cli-plugins', '/usr/lib/docker/cli-plugins',
+    '/Applications/Docker.app/Contents/Resources/cli-plugins', '/opt/homebrew/lib/docker/cli-plugins']];
+  const plugins = new Map();
+  for (const dir of dirs) {
+    let names = [];
+    try { names = fs.readdirSync(dir); } catch { continue; }
+    for (const name of names) {
+      if (!/^docker-[a-z0-9-]+$/.test(name) || plugins.has(name)) continue;
+      const file = real(path.join(dir, name));
+      try { if (file && fs.statSync(file).isFile()) plugins.set(name, file); } catch { /* broken link */ }
+    }
+  }
+  return plugins;
+}
+
+// `system`: also the machine-wide socket and plugin folders (tests leave them out).
+export function containerEngine({ userHome, env = process.env, paths = ['/usr/local/bin', '/opt/homebrew/bin', '/usr/bin', '/Applications/Docker.app/Contents/Resources/bin'], system = true } = {}) {
+  const socket = socketCandidates(userHome, env, system).map(real).find(file => file && isSocket(file));
+  const cli = paths.map(dir => real(path.join(dir, 'docker'))).find(Boolean);
+  if (!socket || !cli) return null;
+  const plugins = cliPlugins(userHome, system);
+  // Read roots: the folders the CLI and plugins live in (/usr is open already).
+  const readRoots = [...new Set([cli, ...plugins.values()].map(file => {
+    const bundle = /^(\/Applications\/[^/]+\.app)\//.exec(file)?.[1];
+    return bundle ?? path.dirname(file);
+  }))].filter(dir => !/^\/(usr|bin|sbin|opt\/homebrew)(\/|$)/.test(dir));
+  return { socket, cli, plugins, readRoots };
+}
+
+// The CLI's configuration in the sandbox's home, and the environment that
+// points it (and Testcontainers) at the engine.
+export function engineEnvironment(engine, home) {
+  const config = path.join(home, '.docker');
+  fs.mkdirSync(path.join(config, 'cli-plugins'), { recursive: true, mode: 0o700 });
+  fs.writeFileSync(path.join(config, 'config.json'), '{}\n', { mode: 0o600 });
+  for (const [name, file] of engine.plugins) {
+    try { fs.symlinkSync(file, path.join(config, 'cli-plugins', name)); } catch { /* already there */ }
+  }
+  return {
+    DOCKER_HOST: `unix://${engine.socket}`, DOCKER_CONFIG: config, DOCKER_CLI_HINTS: 'false',
+    // Testcontainers' reaper mounts the engine's socket inside its VM, where
+    // Docker Desktop and Colima name it /var/run/docker.sock.
+    ...(process.platform === 'darwin' ? { TESTCONTAINERS_DOCKER_SOCKET_OVERRIDE: '/var/run/docker.sock' } : {}),
+  };
+}
+
+// Why an approved-in-Bypass Docker command must still be asked about: host
+// folders outside the project mounted into a container, the engine's own
+// socket, or a container given the host's processes or network. The
+// project's compose files are read for the same (a volume naming ~ or an
+// absolute path outside the project). null when none applies.
+const COMPOSE_FILES = ['compose.yaml', 'compose.yml', 'docker-compose.yaml', 'docker-compose.yml', 'compose.override.yaml', 'compose.override.yml', 'docker-compose.override.yaml', 'docker-compose.override.yml'];
+function outside(source, cwd, home) {
+  if (!source || /^[A-Za-z0-9][A-Za-z0-9_.-]*$/.test(source)) return false; // a named volume
+  const expanded = source.replace(/^~(?=\/|$)/, home).replace(/^\$\{?HOME\}?(?=\/|$)/, home);
+  if (/\$/.test(expanded)) return true;
+  const resolved = path.resolve(cwd, expanded);
+  return /docker\.sock$/.test(resolved) || !(resolved === cwd || resolved.startsWith(cwd + path.sep));
+}
+export function dockerConfirmation(command, { cwd, home }) {
+  const text = String(command);
+  if (/--privileged\b|--pid[= ]host\b|--network[= ]host\b|--net[= ]host\b|--userns[= ]host\b|--cap-add\b/.test(text)) return 'the container gets the host\'s processes, network or extra privileges';
+  const mounts = [...text.matchAll(/(?:^|\s)(?:-v|--volume)(?:=|\s+)(['"]?)([^\s'"]+)\1/g)].map(match => match[2].split(':')[0]);
+  for (const match of text.matchAll(/--mount(?:=|\s+)(['"]?)([^\s'"]+)\1/g)) {
+    const source = /(?:^|,)(?:source|src)=([^,]+)/.exec(match[2])?.[1];
+    if (/(?:^|,)type=bind\b/.test(match[2])) mounts.push(source ?? '');
+  }
+  if (mounts.some(source => outside(source, cwd, home))) return 'it mounts a folder outside the project into a container';
+  if (/\bcompose\b/.test(text)) {
+    for (const name of COMPOSE_FILES) {
+      let content;
+      try { content = fs.readFileSync(path.join(cwd, name), 'utf8'); } catch { continue; }
+      if (/^\s*(privileged:\s*true|pid:\s*["']?host|network_mode:\s*["']?host)/m.test(content)) return `${name} gives a container the host's processes, network or privileges`;
+      const sources = [...content.matchAll(/^\s*-\s*["']?([^\s"':]+):[^\s]/gm), ...content.matchAll(/^\s*source:\s*["']?([^\s"']+)/gm)].map(match => match[1]);
+      if (sources.some(source => /^(\/|~|\.|\$)/.test(source) && outside(source, cwd, home))) return `${name} mounts a folder outside the project into a container`;
+    }
+  }
+  return null;
+}

package/packages/piagent-core/managed/continuation.mjs

@@ -0,0 +1,131 @@
+import { unfinished, planText, currentPlan, workflowPolicy } from './workflow.mjs';
+import { failureCode } from '../runtime/managed-failure.mjs';
+
+// A main agent often ends its turn between the steps of its own checklist
+// ("STEP06 done, STEP07 next"), though the member asked for all of them.
+// Under plan "require" the harness sends it back to the next open step, as a
+// new run (as if the member had sent "continue": each round gets its own
+// helpers, checks and review), until the checklist is done, the member stops
+// it, a round fails, or IDLE_ROUNDS rounds in a row change nothing.
+export const IDLE_ROUNDS = 2;
+// A checklist holds at most 30 steps: one round per step at most.
+export const MAX_ROUNDS = 30;
+// How the member's message ended, shown under the last answer.
+export const TURN_END_ENTRY = 'agent-watch-turn-end';
+export const TURN_END_STATES = ['done', 'midway', 'failed', 'cancelled'];
+
+const completed = plan => plan?.plan?.filter(p => p.status === 'completed').length ?? 0;
+const deferred = plan => plan?.plan?.filter(p => p.status === 'deferred').length ?? 0;
+
+export class Continuation {
+  constructor(policy) {
+    Object.assign(this, { policy, rounds: 0, idle: 0, touched: false, reason: null, startDone: 0 });
+  }
+  // A round is about to start: what its progress is measured from.
+  begin(plan) { this.startDone = completed(plan); }
+  // A round ended (its run closed). The message that starts the next round,
+  // or null: then `reason` says why the harness stopped sending it back.
+  next({ plan, planUpdated, changed, stopped, failed }) {
+    if (planUpdated) this.touched = true;
+    if (stopped) { this.reason = 'stopped'; return null; }
+    if (failed) { this.reason = 'failed'; return null; }
+    if (!this.touched || !unfinished(plan)) { this.reason = null; return null; }
+    if (this.policy.plan !== 'require') { this.reason = 'policy'; return null; }
+    // The member's own round always gets one round back; a harness round
+    // that neither completed a step nor changed code counts as idle.
+    if (this.rounds > 0) this.idle = completed(plan) > this.startDone || changed ? 0 : this.idle + 1;
+    if (this.idle >= IDLE_ROUNDS) { this.reason = 'idle'; return null; }
+    if (this.rounds >= MAX_ROUNDS) { this.reason = 'limit'; return null; }
+    this.rounds += 1;
+    const steps = plan.plan.length, done = completed(plan), open = steps - done - deferred(plan);
+    return { customType: 'agent-watch-process', display: true,
+      content: `Harness: your checklist still has ${open} open step(s) (${done}/${steps} completed):\n${planText(plan)}\nThe member asked for all of it, unless they told you to stop at this point. Continue with the next open step now and keep going until every step is completed; update the checklist with update_plan as you go. Do not stop to report progress between steps. If the member asked you to stop here (to review a plan before any change, for example) or you cannot go on without them (a decision, access, a service that is not running), ask with ask_user instead of going on. If a step is no longer needed, take it out of the checklist and say why in your final answer.`,
+      details: { phase: 'continue', round: this.rounds, maxRounds: MAX_ROUNDS, planOpen: open, planDone: done, planSteps: steps, ...(this.idle ? { idle: this.idle } : {}) } };
+  }
+}
+
+// How a member's message ended: every step done (or answered without a
+// checklist), stopped with steps open (and why the harness did not go on),
+// failed (which role, which kind) or stopped by the member.
+export function turnEnd(continuation, plan, { stopped, failure }) {
+  const steps = continuation.touched ? plan?.plan?.length ?? 0 : 0, done = continuation.touched ? completed(plan) : 0;
+  const state = stopped ? 'cancelled' : failure ? 'failed' : continuation.touched && unfinished(plan) ? 'midway' : 'done';
+  const later = continuation.touched ? deferred(plan) : 0;
+  return { state, planSteps: steps, planDone: done, ...(later ? { planDeferred: later } : {}), rounds: continuation.rounds,
+    ...(state === 'midway' && continuation.reason ? { reason: continuation.reason } : {}),
+    ...(state === 'failed' ? { role: failure.role ?? 'main', code: String(failure.code || 'unknown').toLowerCase().replace(/[^a-z0-9_]+/g, '_').slice(0, 64) } : {}),
+    at: new Date().toISOString() };
+}
+
+// One member message: its round, then the rounds the harness adds while the
+// checklist has open steps. `runRound(text, deliver)` runs one Studio run and
+// returns { result, preflight, planUpdated, changed, closeFailed }. A message the member
+// sends while a round closes (no model runs then) becomes the next round;
+// Stop ends the turn. Listeners hear "settled" once, after the last round.
+// "tiếp tục", "continue", the dashboard's Continue button: the member asks
+// for the open checklist, so it is this message's work even before the agent
+// touches it again.
+const CONTINUE = /^(tiep tuc|lam tiep|lam not|continue|go on|keep going|resume)\b/;
+export function asksToContinue(text) {
+  const normal = String(text ?? '').normalize('NFD').replace(/\p{M}/gu, '').replace(/[đĐ]/g, 'd').toLowerCase().trim();
+  return normal.length <= 60 && CONTINUE.test(normal);
+}
+const fresh = (self, manager, text) => {
+  const continuation = new Continuation(workflowPolicy(self.manifest));
+  if (asksToContinue(text) && unfinished(currentPlan(manager))) continuation.touched = true;
+  return continuation;
+};
+
+export async function memberTurn(self, { manager, prompt, runRound }, text, deliver) {
+  let continuation = fresh(self, manager, text), result, waiting = null, ended = null;
+  self.stopRequested = false; self.queued = [];
+  try {
+    for (let first = true; ; first = false) {
+      continuation.begin(currentPlan(manager));
+      self.between = false;
+      let round;
+      try { round = await runRound(text, deliver); }
+      catch (error) { waiting?.reject(error); waiting = null; throw error; }
+      if (first) result = round.result; else waiting?.resolve(round.result);
+      waiting = null;
+      const last = self.session.messages.findLast(m => m.role === 'assistant');
+      const stopped = self.stopRequested || last?.stopReason === 'aborted';
+      const failure = round.preflight || last?.stopReason === 'error' ? { role: 'main', code: failureCode(last?.errorMessage ?? '') }
+        : round.closeFailed ? { role: 'main', code: round.closeFailed } : null;
+      const plan = currentPlan(manager), message = continuation.next({ plan, planUpdated: round.planUpdated, changed: round.changed, stopped, failed: !!failure });
+      if (self.queued.length) {
+        // The member wrote while the round closed: theirs is the next round,
+        // a new request (Stop before it applied to the round before).
+        waiting = self.queued.shift(); self.stopRequested = false;
+        const next = waiting; text = next.text;
+        deliver = () => prompt(next.text, { ...next.options, expandPromptTemplates: false });
+        continuation = fresh(self, manager, next.text);
+      } else if (message) {
+        text = message.content;
+        deliver = () => { self.nextPurpose = 'continue'; return self.session.sendCustomMessage(message, { triggerTurn: true }); };
+      } else { ended = turnEnd(continuation, plan, { stopped, failure }); break; }
+    }
+  } finally {
+    self.between = false;
+    for (const queued of self.queued.splice(0)) queued.reject(Error('managed-turn-stopped'));
+    // How the member's message ended: an entry of the conversation (not a
+    // message: the model never reads it), shown under the last answer, and
+    // told to listeners (the company Terminal).
+    if (ended) {
+      try { manager.appendCustomEntry(TURN_END_ENTRY, ended); } catch { /* the answer stands */ }
+      self.notify({ type: 'managed_turn_end', end: ended, text: turnEndText(ended) });
+    }
+    self.activePrompt = false;
+    self.notify({ type: 'agent_settled' });
+  }
+  return result;
+}
+
+// The plain text of a turn's end (the Terminal shows it; the WebUI reads details).
+export function turnEndText(end) {
+  if (end.state === 'cancelled') return 'Turn stopped by the member.';
+  if (end.state === 'failed') return `Turn failed: ${end.role} agent, ${end.code}. Send "continue" to go on.`;
+  if (end.state === 'midway') return `Turn ended with ${end.planSteps - end.planDone - (end.planDeferred ?? 0)} of ${end.planSteps} checklist step(s) open${end.reason === 'idle' ? `: the agent stopped ${IDLE_ROUNDS} times in a row without progress` : end.reason === 'limit' ? `: ${MAX_ROUNDS} rounds reached` : ''}. Send "continue" to go on.`;
+  if (end.planDeferred) return `Done: ${end.planDone} of ${end.planSteps} checklist steps completed, ${end.planDeferred} left for later.`;
+  return end.planSteps ? `Done: all ${end.planSteps} checklist steps completed.` : 'Done.';
+}

package/packages/piagent-core/managed/doctor.mjs

@@ -86,6 +86,13 @@ export async function runDoctor({ sdkRoot, origin, broker, network = true }) {
       try { return await bash('node loopback.mjs'); }
       catch (error) { throw Error(/loopback-blocked/.test(String(error?.message)) ? 'a local proxy listens on this Mac: tests that use localhost need run_with_network' : first(String(error?.message))); }
     });
+    // run_with_docker: the engine answers through its socket, and only there.
+    await check('Docker for approved commands (run_with_docker)', false, async () => {
+      if (!boundary.engine) throw Error('no Docker engine running (Docker Desktop, Colima, OrbStack…): start it, then open a new conversation');
+      let refused = false; try { await bash('docker version --format "{{.Server.Version}}"'); } catch { refused = true; }
+      if (!refused) throw Error('a plain command reached the Docker engine');
+      return `engine ${await bash('docker version --format "{{.Server.Version}}"', { docker: true })}`;
+    });
     await check('package caches kept for the project', false, async () => { await bash('mkdir -p "$npm_config_cache" && touch "$npm_config_cache/.piagent-doctor"'); return boundary.packageCache; });
     // The languages installed on this Mac, each started once in the sandbox.
     // (macOS ships stubs for some, such as javac without a JDK: a probe decides.)