@piagent/platform 1.18.0 → 1.19.0

package/packages/piagent-core/managed/language-environment.mjs

@@ -10,6 +10,10 @@ import { execFileSync } from 'node:child_process';
 //   network (run_with_network), later runs work offline;
 // - the member's own dependency caches as read-only seeds, where the tool can
 //   layer one (Go, Gradle, Maven), so what is already downloaded is reused;
+// - the distributions the Maven Wrapper (./mvnw) and the Gradle Wrapper
+//   (./gradlew) already unpacked on this Mac, linked read-only into the
+//   project's cache, so they run without asking for network; one they have
+//   to download stays in the cache;
 // - runtimes installed in places the sandbox otherwise keeps closed (JDKs
 //   under ~/Library/Java, the Android SDK, the system gem folder, MacPorts);
 // - SwiftPM and xcodebuild, which cannot start their own sandbox inside this
@@ -62,6 +66,50 @@ case "$(basename "$0"):$1" in
 esac
 `;
 
+// Each <name>/<hash> distribution folder of the member's Maven Wrapper as a
+// link in the project's cache; one already there (linked, or downloaded by an
+// approved command) is kept.
+function linkDistributions(source, target) {
+  let names = [];
+  try { names = fs.readdirSync(source, { withFileTypes: true }).filter(entry => entry.isDirectory()); } catch { return; }
+  for (const name of names) {
+    let hashes = [];
+    try { hashes = fs.readdirSync(path.join(source, name.name), { withFileTypes: true }).filter(entry => entry.isDirectory()); } catch { continue; }
+    for (const hash of hashes) {
+      const link = path.join(target, name.name, hash.name);
+      try { fs.lstatSync(link); continue; } catch { /* not there yet */ }
+      try { fs.mkdirSync(path.dirname(link), { recursive: true, mode: 0o700 }); fs.symlinkSync(path.join(source, name.name, hash.name), link); } catch { /* best effort */ }
+    }
+  }
+}
+
+// The Gradle Wrapper locks <hash>/<zip>.lck and checks <zip>.ok before it
+// uses a distribution, so each <name>/<hash> is a folder of the cache with
+// the marker copied and the unpacked distribution linked.
+function linkGradleDistributions(source, target) {
+  let names = [];
+  try { names = fs.readdirSync(source, { withFileTypes: true }).filter(entry => entry.isDirectory()); } catch { return; }
+  for (const name of names) {
+    let hashes = [];
+    try { hashes = fs.readdirSync(path.join(source, name.name), { withFileTypes: true }).filter(entry => entry.isDirectory()); } catch { continue; }
+    for (const hash of hashes) {
+      const from = path.join(source, name.name, hash.name), to = path.join(target, name.name, hash.name);
+      let entries = [];
+      try { entries = fs.readdirSync(from, { withFileTypes: true }); } catch { continue; }
+      if (!entries.some(entry => entry.name.endsWith('.ok'))) continue; // not fully unpacked
+      try { fs.mkdirSync(to, { recursive: true, mode: 0o700 }); } catch { continue; }
+      for (const entry of entries) {
+        const link = path.join(to, entry.name);
+        try { fs.lstatSync(link); continue; } catch { /* not there yet */ }
+        try {
+          if (entry.isDirectory()) fs.symlinkSync(path.join(from, entry.name), link);
+          else if (entry.name.endsWith('.ok')) fs.writeFileSync(link, '', { mode: 0o600 });
+        } catch { /* best effort */ }
+      }
+    }
+  }
+}
+
 export function languageEnvironment({ userHome, repositoryTop, home }) {
   const linux = process.platform === 'linux';
   const root = linux ? path.join(process.env.XDG_CACHE_HOME || path.join(userHome, '.cache'), 'piagent/sandbox') : path.join(userHome, 'Library/Caches/Piagent/sandbox');
@@ -80,11 +128,19 @@ export function languageEnvironment({ userHome, repositoryTop, home }) {
     // .NET restores over TLS through the macOS Security framework, closed
     // here: packages the member restored are read from their own folder.
     nuget: existing(path.join(userHome, '.nuget/packages')),
+    mavenWrapper: existing(path.join(userHome, '.m2/wrapper/dists')),
+    gradleWrapper: existing(path.join(userHome, '.gradle/wrapper/dists')),
   };
   const java = javaHome(userHome), android = existing(path.join(userHome, linux ? 'Android/Sdk' : 'Library/Android/sdk'));
   const readRoots = [...new Set([...Object.values(seeds), java, android, existing(path.join(userHome, 'Library/Java/JavaVirtualMachines')),
     existing('/Library/Ruby'), existing('/opt/local')].filter(Boolean))];
 
+  // ./mvnw looks for its distribution in MAVEN_USER_HOME/wrapper/dists/<name>/<hash>
+  // (the sandbox's HOME is an empty folder per conversation).
+  if (seeds.mavenWrapper) linkDistributions(seeds.mavenWrapper, at('m2/wrapper/dists'));
+  // ./gradlew: GRADLE_USER_HOME/wrapper/dists/<name>/<hash>.
+  if (seeds.gradleWrapper) linkGradleDistributions(seeds.gradleWrapper, at('gradle/wrapper/dists'));
+
   const bin = path.join(home, '.piagent/bin');
   fs.mkdirSync(bin, { recursive: true, mode: 0o700 });
   // (Only macOS: SwiftPM on Linux starts no sandbox of its own.)
@@ -102,6 +158,7 @@ export function languageEnvironment({ userHome, repositoryTop, home }) {
     CARGO_HOME: at('cargo'), GRADLE_USER_HOME: at('gradle'), NUGET_PACKAGES: at('nuget'), COMPOSER_CACHE_DIR: at('composer'),
     PUB_CACHE: at('pub'), GEM_HOME: at('gem'), BUNDLE_PATH: at('bundle'), CP_HOME_DIR: at('cocoapods'), PIAGENT_DERIVED_DATA: at('DerivedData'),
     DOTNET_CLI_TELEMETRY_OPTOUT: '1', DOTNET_NOLOGO: '1', DOTNET_SKIP_FIRST_TIME_EXPERIENCE: '1',
+    MAVEN_USER_HOME: at('m2'),
     MAVEN_OPTS: [`-Dmaven.repo.local=${at('m2/repository')}`, ...(seeds.maven ? [`-Dmaven.repo.local.tail=${seeds.maven}`] : [])].join(' '),
     ...(seeds.gradle ? { GRADLE_RO_DEP_CACHE: seeds.gradle } : {}),
     ...(seeds.nuget ? { NUGET_FALLBACK_PACKAGES: seeds.nuget } : {}),

package/packages/piagent-core/managed/linux-sandbox.mjs

@@ -52,7 +52,7 @@ export function credentialFiles(roots, { limit = SCAN_ENTRIES } = {}) {
 }
 
 const depth = file => file.split('/').length;
-export function bubblewrapArgs({ cwd, sdkRoot, runtimeRoot, temporary, empty, node, readOnly = false, repository = [], gitDirs = [], toolchains = [], skills = [], caches = [], references = [], network = false, credentials = [] }) {
+export function bubblewrapArgs({ cwd, sdkRoot, runtimeRoot, temporary, empty, node, readOnly = false, repository = [], gitDirs = [], toolchains = [], skills = [], caches = [], references = [], network = false, credentials = [], docker = null }) {
   const exists = file => { try { fs.statSync(file); return true; } catch { return false; } };
   const readable = [...new Set([sdkRoot, runtimeRoot, path.dirname(node), ...repository, ...toolchains, ...skills, ...references, ...(readOnly ? [cwd, ...gitDirs] : [])])].filter(exists);
   const writable = [...new Set([...caches, ...(readOnly ? [] : [cwd, ...gitDirs])])].filter(exists);
@@ -66,6 +66,8 @@ export function bubblewrapArgs({ cwd, sdkRoot, runtimeRoot, temporary, empty, no
     '--proc', '/proc', '--dev', '/dev', '--tmpfs', '/tmp', '--bind', temporary, temporary,
     ...mounts.flatMap(([kind, dir]) => [kind, dir, dir]),
     ...credentials.filter(item => exists(item.path)).flatMap(item => item.directory ? ['--tmpfs', item.path] : ['--ro-bind', empty, item.path]),
+    // An approved Docker command reaches the engine's socket (run_with_docker).
+    ...(docker && exists(docker) ? ['--bind', docker, docker] : []),
     '--remount-ro', '/', '--chdir', cwd,
   ];
 }

package/packages/piagent-core/managed/patch-snapshot.mjs

@@ -10,14 +10,18 @@ const MAX_SNAPSHOT = 16 * 1024 * 1024;
 
 // The worker runs inside the tool boundary; what it prints is one short line.
 // `scope`: only these paths (relative to the project) make the patch.
-async function worker(boundary, mode, scope = null) {
+// `base`: the commit the patch starts from (the turn's starting HEAD), so a
+// commit made during the turn stays part of its change; none: HEAD.
+const BASE = /^[0-9a-f]{40}([0-9a-f]{24})?$/;
+async function worker(boundary, mode, scope = null, base = null) {
   let scopeName = null;
   if (scope) {
     scopeName = `scope-${randomUUID()}.json`;
     fs.writeFileSync(path.join(boundary.temporary, scopeName), JSON.stringify([...scope]), { mode: 0o600, flag: 'wx' });
   }
   let result;
-  try { result = await boundary.invoke('bash', { command: `${quote(process.execPath)} ${quote(WORKER)} ${mode}${scopeName ? ' ' + scopeName : ''}`, timeout: 60 }); }
+  const from = typeof base === 'string' && BASE.test(base) ? ' ' + base : '';
+  try { result = await boundary.invoke('bash', { command: `${quote(process.execPath)} ${quote(WORKER)} ${mode}${scopeName ? ' ' + scopeName : ''}${from}`, timeout: 60 }); }
   finally { if (scopeName) fs.rmSync(path.join(boundary.temporary, scopeName), { force: true }); }
   const text = textContent(result).trim();
   if (result.details?.truncation?.truncated || text.includes('\n')) throw Error(/review-(patch|file|untracked)-limit/.exec(text)?.[0] ?? 'managed-review-patch-unreadable');
@@ -28,14 +32,23 @@ async function worker(boundary, mode, scope = null) {
 
 // The digest of the patch a reviewer would see (diff against HEAD plus
 // untracked files): whether a review is still current. Nothing else moves.
-export async function readPatchDigest(boundary, scope = null) { return (await worker(boundary, 'digest', scope)).digest; }
+export async function readPatchDigest(boundary, scope = null, base = null) { return (await worker(boundary, 'digest', scope, base)).digest; }
+
+// The commit HEAD names now, or null (no repository, no commit yet).
+export async function readHead(boundary) {
+  try {
+    const result = await boundary.invoke('bash', { command: `${quote(process.execPath)} ${quote(WORKER)} head`, timeout: 60 });
+    const text = textContent(result).trim();
+    return BASE.test(text) ? text : null;
+  } catch { return null; }
+}
 
 // The patch a reviewer sees, read inside the tool boundary. The worker writes
 // it to the boundary's temporary directory and names it, with its digest, on
 // its output; the file is read once, must match that digest (a file changed
 // meanwhile never passes) and is removed.
-export async function readPatchSnapshot(boundary, scope = null) {
-  const { digest, bytes, name } = await worker(boundary, 'file', scope);
+export async function readPatchSnapshot(boundary, scope = null, base = null) {
+  const { digest, bytes, name } = await worker(boundary, 'file', scope, base);
   if (!/^review-[0-9a-f-]{36}\.json$/.test(name ?? '')) throw Error('managed-review-patch-unreadable');
   return { patch: readOnce(boundary, name, bytes, digest).toString('utf8'), digest };
 }
@@ -44,8 +57,8 @@ export async function readPatchSnapshot(boundary, scope = null) {
 // Compared before and after a command, it names the files that command
 // changed, so a conversation answers for its own changes, not for another
 // conversation's in the same folder.
-export async function readChangedFiles(boundary) {
-  const { digest, bytes, name } = await worker(boundary, 'files');
+export async function readChangedFiles(boundary, base = null) {
+  const { digest, bytes, name } = await worker(boundary, 'files', null, base);
   if (!/^files-[0-9a-f-]{36}\.json$/.test(name ?? '')) throw Error('managed-review-patch-unreadable');
   return new Map(Object.entries(JSON.parse(readOnce(boundary, name, bytes, digest).toString('utf8'))));
 }
@@ -74,6 +87,9 @@ export function reviewUnavailableReason(message) {
   return 'failed';
 }
 
+// What the diff is taken against: HEAD, or the commit the turn started from
+// (commits made during the turn are part of the change).
+const against = value => value?.base ? `diff against the commit the turn started from (${String(value.base).slice(0, 12)}), commits made since included` : 'diff against HEAD';
 // The patch as a reviewer reads it: the diff, then each new file in full.
 export function reviewText(snapshot) {
   let value;
@@ -82,7 +98,7 @@ export function reviewText(snapshot) {
     : f.mode === 'directory' ? `=== new folder ${f.path} (a repository of its own, not reviewed)`
     : f.encoding === 'omitted' ? `=== new file ${f.path} (${f.bytes} bytes, too large to review)`
     : f.encoding === 'utf8' ? `=== new file ${f.path}\n${f.contents}` : `=== new binary file ${f.path} (${Math.round(f.contents.length * 0.75)} bytes)`);
-  return `Patch snapshot ${snapshot.digest}:\n--- diff against HEAD ---\n${value.patch || '(no changes to tracked files)'}\n${files.length ? `--- new files ---\n${files.join('\n\n')}` : ''}`;
+  return `Patch snapshot ${snapshot.digest}:\n--- ${against(value)} ---\n${value.patch || '(no changes to tracked files)'}\n${files.length ? `--- new files ---\n${files.join('\n\n')}` : ''}`;
 }
 
 // A patch larger than one reviewer reads at once (REVIEW_PART_BYTES, about
@@ -125,7 +141,7 @@ export function reviewParts(snapshot, size = REVIEW_PART_BYTES) {
   const parts = groups.map((group, i) => {
     const files = group.sections.map(s => s.file), diff = group.sections.filter(s => s.kind === 'diff').map(s => s.text).join(''), news = group.sections.filter(s => s.kind === 'new').map(s => s.text);
     const head = groups.length === 1 ? `Patch snapshot ${snapshot.digest}.` : `Patch snapshot ${snapshot.digest}, part ${i + 1} of ${groups.length}. This part's files: ${files.join(', ')}. The other parts are reviewed separately: judge this part, and read other files only for context.`;
-    return { files, text: `${head}${skipped}\n--- diff against HEAD ---\n${diff || '(no changes to tracked files in this part)'}\n${news.length ? `--- new files ---\n${news.join('\n\n')}` : ''}` };
+    return { files, text: `${head}${skipped}\n--- ${against(value)} ---\n${diff || '(no changes to tracked files in this part)'}\n${news.length ? `--- new files ---\n${news.join('\n\n')}` : ''}` };
   });
   return { parts: parts.length ? parts : [{ files: [], text: `Patch snapshot ${snapshot.digest}: every changed file is too large to review.${skipped}` }], omitted };
 }

package/packages/piagent-core/managed/repository-operation.mjs

@@ -82,3 +82,23 @@ export async function executeRepositoryFetch(boundary,plan,signal,{transport=fet
     return {content:[{type:'text',text:`Fetched origin branches for ${plan.repository}. Working files and current branch were not changed.`}],details:{operation:'git.fetch',repository:plan.repository}};
   } finally {fs.rmSync(staging,{recursive:true,force:true});}
 }
+
+// The fetch_origin tool of a company conversation: one approved fetch of the
+// GitHub origin (Bypass fetches without asking).
+export function fetchOriginTool(self) {
+  return {name:'fetch_origin',label:'Fetch origin',description:'Request one approved GitHub origin fetch. Refreshes origin branches without changing working files. Does not expose credentials or allow arbitrary network commands.',
+    parameters:{type:'object',properties:{},additionalProperties:false},
+    execute:async(id,_args,signal,_update,ctx)=>{
+      const plan=await repositoryFetchPlan(self.boundary);
+      if(self.permission==='trusted-full-access'&&!signal?.aborted)return executeRepositoryFetch(self.boundary,plan,signal);
+      const {piApprovalBroker}=await import('../runtime/inspection/approval-broker.ts');
+      const decision=await piApprovalBroker.request({cwd:self.cwd,rawSessionId:self.session.sessionManager.getSessionId(),toolCallId:id,
+        action:{kind:'external-provider-action',preconditionClass:'runtime-only',toolName:'fetch_origin',rawAction:plan,
+          targetPaths:[self.cwd],provider:'github',urlOrigin:'https://github.com',requestedScope:'fetch-origin-once',
+          reason:`Fetch origin branches from ${plan.repository}`,riskClass:'low',allowConsequence:'Download origin branches once; keep the current branch and working files unchanged.',denyConsequence:'No network request or credential read.'},
+        terminalConfirm:()=>ctx?.ui?.confirm?.('Tải nhánh từ origin',`Tải các nhánh của ${plan.repository} về ${self.cwd} một lần.\n\nĐồng ý: chỉ tải nhánh; nhánh hiện tại và file đang làm không đổi.\nTừ chối: không gửi request mạng, không đọc thông tin đăng nhập.`)??Promise.resolve(false),
+        unavailableFallback:'terminal-confirm',recheck:()=>!signal?.aborted&&Boolean(self.grant)});
+      if(!decision.allowed||!decision.consume()||signal?.aborted)throw Error('managed-operation-denied');
+      return executeRepositoryFetch(self.boundary,plan,signal);
+    }};
+}

package/packages/piagent-core/managed/review-snapshot-worker.mjs

@@ -13,10 +13,17 @@ const MAX_SNAPSHOT = 16 * 1024 * 1024, MAX_UNTRACKED = 2000, READ_FILE = 400_000
 const git = args => execFileSync(managedGit(), ['--no-pager', ...args], { encoding: 'utf8', maxBuffer: MAX_SNAPSHOT + 1, env: { ...process.env, GIT_TERMINAL_PROMPT: '0', GIT_CONFIG_NOSYSTEM: '1' } });
 const sha256 = data => createHash('sha256').update(data).digest('hex');
 const mode = process.argv[2];
+// The arguments after the mode: a scope file, then the commit the patch starts
+// from (the turn's starting HEAD; commits made since are part of the change).
+// While HEAD has not moved, the patch is the plain one against HEAD.
+const head = () => { try { return git(['rev-parse', '--verify', '-q', 'HEAD^{commit}']).trim(); } catch { return ''; } };
+if (mode === 'head') { process.stdout.write(head() || 'none'); process.exit(0); }
+const extra = process.argv.slice(3), given = extra.find(a => /^[0-9a-f]{40}([0-9a-f]{24})?$/.test(a));
+const base = given && given !== head() ? given : 'HEAD';
 // "files": what each changed or new file holds now (a hash, "deleted"), so
 // the runtime can tell which files one conversation's command changed.
 if (mode === 'files') {
-  const changed = git(['diff', '--name-only', '--no-renames', '--relative', '-z', 'HEAD', '--', '.']).split('\0').filter(Boolean);
+  const changed = git(['diff', '--name-only', '--no-renames', '--relative', '-z', base, '--', '.']).split('\0').filter(Boolean);
   const fresh = git(['ls-files', '--others', '--exclude-standard', '-z']).split('\0').filter(Boolean);
   if (changed.length + fresh.length > MAX_UNTRACKED * 4) throw Error('review-untracked-limit');
   const print = name => {
@@ -33,11 +40,11 @@ if (mode === 'files') {
 }
 // A scope (a file the runtime wrote in this boundary's temporary directory):
 // only these paths, the ones this conversation changed, make the patch.
-const scopeName = process.argv[3];
+const scopeName = extra.find(a => a !== given);
 if (scopeName !== undefined && !/^scope-[0-9a-f-]{36}\.json$/.test(scopeName)) throw Error('review-scope-invalid');
 const scope = scopeName ? new Set(JSON.parse(fs.readFileSync(path.join(os.tmpdir(), scopeName), 'utf8'))) : null;
 if (scope && [...scope].some(p => typeof p !== 'string' || !p || path.isAbsolute(p) || p.split('/').includes('..'))) throw Error('review-scope-invalid');
-const patch = scope && !scope.size ? '' : git(['diff', '--binary', '--no-ext-diff', '--no-textconv', '--no-renames', 'HEAD', '--', ...(scope ? [...scope].sort().map(p => ':(literal)' + p) : ['.'])]);
+const patch = scope && !scope.size ? '' : git(['diff', '--binary', '--no-ext-diff', '--no-textconv', '--no-renames', base, '--', ...(scope ? [...scope].sort().map(p => ':(literal)' + p) : ['.'])]);
 const paths = git(['ls-files', '--others', '--exclude-standard', '-z']).split('\0').filter(Boolean).filter(p => !scope || scope.has(p)).sort();
 if (paths.length > MAX_UNTRACKED) throw Error('review-untracked-limit');
 const untracked = paths.map(name => {
@@ -55,7 +62,7 @@ const untracked = paths.map(name => {
   if (text !== null) return { path: name, mode, contents: text, encoding: 'utf8' };
   return stat.size > BINARY_INLINE ? { path: name, mode, encoding: 'omitted', bytes: stat.size, sha256: sha256(data) } : { path: name, mode, contents: data.toString('base64'), encoding: 'base64' };
 });
-const snapshot = Buffer.from(JSON.stringify({ patch, untracked }));
+const snapshot = Buffer.from(JSON.stringify(base === 'HEAD' ? { patch, untracked } : { base, patch, untracked }));
 if (snapshot.length > MAX_SNAPSHOT) throw Error('review-patch-limit');
 // "digest": the digest and size only (is a review still current?). "file":
 // the snapshot goes to a new file in this boundary's temporary directory,

package/packages/piagent-core/managed/sandbox-diagnostic.mjs

@@ -7,8 +7,13 @@ const OFFLINE = /ENOTFOUND|EAI_AGAIN|Could not resolve host|getaddrinfo|npm erro
 // name that does not resolve is the machine's network, not the sandbox.
 // `isolated`: a proxy listens on this Mac, so without approval a command does
 // not reach this Mac's own servers either (tool-boundary.mjs).
-export function sandboxDiagnostic(message, { network = false, isolated = false } = {}) {
+// `docker`: the command ran with the Docker engine (run_with_docker);
+// `engine`: one is there for run_with_docker, but this command ran without it.
+const DOCKER_DAEMON = /Cannot connect to the Docker daemon|connect to the docker API|docker\.sock|Is the docker daemon running|Could not find a valid Docker environment/i;
+export function sandboxDiagnostic(message, { network = false, isolated = false, docker = false, engine = false } = {}) {
   const text=String(message);
+  if(docker&&DOCKER_DAEMON.test(text))return 'managed-docker-unreachable: Lệnh chạy với Docker nhưng Docker engine không trả lời (Docker Desktop/Colima chưa chạy hoặc đang khởi động). Không xin duyệt lại cùng lệnh; báo người dùng mở Docker rồi thử lại.\n'+text;
+  if(!docker&&DOCKER_DAEMON.test(text))return (engine?'managed-docker-blocked: Lệnh bash thường không dùng được Docker trong chế độ công ty. Lệnh docker, docker compose, hoặc test cần Docker (Testcontainers) chạy qua run_with_docker để người dùng duyệt đúng lệnh đó.\n':'managed-docker-unavailable: Máy chưa có Docker engine đang chạy (Docker Desktop, Colima, OrbStack…). Báo người dùng mở Docker; sau đó cuộc trò chuyện mới có run_with_docker.\n')+text;
   if(isolated&&/ECONNREFUSED|EPERM|connect|Connection refused|could not connect/i.test(text))return 'managed-loopback-blocked: Máy đang chạy một proxy cục bộ, nên lệnh không có mạng cũng không được kết nối tới server trên localhost (proxy có thể đưa lệnh ra internet). Test cần server hoặc database trên localhost: dùng run_with_network để người dùng duyệt đúng lệnh đó.\n'+text;
   if(network&&!DENIAL.test(text)&&OFFLINE.test(text))return 'managed-network-unreachable: Lệnh đã được duyệt và chạy có mạng nhưng không tới được host (máy đang offline, cần VPN/proxy công ty, hoặc sai tên host). Không xin duyệt lại cùng lệnh; báo người dùng lỗi mạng này.\n'+text;
   if(!DENIAL.test(text)&&OFFLINE.test(text))return 'managed-network-blocked: Lệnh bash thường không có mạng trong chế độ công ty. Nếu lệnh thật sự cần mạng (cài package, tải dữ liệu), dùng run_with_network để người dùng duyệt đúng lệnh đó.\n'+text;

package/packages/piagent-core/managed/session.mjs

@@ -11,19 +11,21 @@ import { searchForRole } from './web-search.mjs';
 import { shareGrant, releaseGrant } from './grant-share.mjs';
 import { managedThinkingLevels, nearestLevel } from './capabilities.mjs';
 import { nativeManagedModel, isVendor, piProvider, studioAPI, studioPath } from './native-catalog.mjs';
-import { repositoryFetchPlan, executeRepositoryFetch } from './repository-operation.mjs';
+import { fetchOriginTool } from './repository-operation.mjs';
 import { describeFailure, failureCode, failureText } from '../runtime/managed-failure.mjs';
 import { enableCompanyTurnRetry, wrapRoleStreams } from './request-stream.mjs';
 import { runHelper } from './helper-run.mjs';
 import { askTool } from './member-questions.mjs';
 import { setTimeout as sleep } from 'node:timers/promises';
 import { stageCompaction, compactEarly, backOffFailedCompaction } from './compaction.mjs';
-import { readPatchDigest, readPatchSnapshot, readChangedFiles } from './patch-snapshot.mjs';
-import { workflowPolicy, repositoryChecks, planTool, currentPlan, PLAN_ENTRY, workflowPrompt, RunProcess, completionGate, pendingBaseline, pendingPaths, processEditTools } from './workflow.mjs';
+import { readPatchDigest, readPatchSnapshot, readChangedFiles, readHead } from './patch-snapshot.mjs';
+import { memberTurn } from './continuation.mjs';
+import { workflowPolicy, repositoryChecks, planTool, currentPlan, PLAN_ENTRY, workflowPrompt, RunProcess, completionGate, pendingBaseline, pendingPaths, pendingHead, processEditTools } from './workflow.mjs';
 import { beforeDelegate } from './objections.mjs';
 import { HELPER_CALLS, HELPER_ROLES, helperRoles, helperPrompt, webPrompt, delegateDescription } from './helper-roles.mjs';
 import { loadAgentResources } from './agent-skills.mjs';
-import { restorePermission, permissionSetter, networkConfirmation } from './permission.mjs';
+import { restorePermission, permissionSetter } from './permission.mjs';
+import { commandTools, servicesPrompt } from './command-tools.mjs';
 
 const PROVIDER = 'agent_watch_managed';
 // Who the agent is: the model account may put another product's name in an
@@ -33,10 +35,10 @@ const BASE_PROMPT = 'You are Piagent, the company coding assistant. If an earlie
 // they name) are readable for reference; the sandbox keeps them read-only.
 const referencePrompt = home => ` The member may point you to folders outside the project for reference (an @path mention or a folder they name): read them with read, ls, grep and find. They are read-only: changes go in the project only. In those tools ~ is the member's home folder (${home}); in bash ~ is a private empty folder, so use absolute paths there.`;
 // Tests in the sandbox (tool-boundary.mjs, language-environment.mjs).
-const TEST_PROMPT = ' To run unit and integration tests, use bash. Installing packages (npm, pnpm, pip, uv, go, cargo, gradle, maven…) needs run_with_network once; the project\'s package caches are kept, so later runs work offline. '
+const TEST_PROMPT = ' To run unit and integration tests, use bash. Installing packages (npm, pnpm, pip, uv, go, cargo, gradle, maven…) needs run_with_network once; the project\'s package caches are kept, so later runs work offline. ./mvnw and ./gradlew reuse the Maven and Gradle they already unpacked on this Mac; Maven\'s files are under $MAVEN_USER_HOME and $GRADLE_USER_HOME, not ~/.m2 or ~/.gradle (closed here). '
   + (process.platform === 'linux'
-    ? 'A command without network reaches only the servers it starts itself, which end with it: start a test server and run the tests in one command; a database or service already running on this machine needs run_with_network. Docker is not available in the sandbox: ask the member to start those services.'
-    : 'Servers on localhost (a test\'s own server, a local database) are reachable, except while a local proxy runs (the error says so: then use run_with_network). Docker and the iOS Simulator are not available in the sandbox: ask the member to start those services or run those tests.');
+    ? 'A command without network reaches only the servers it starts itself, which end with it: start a test server and run the tests in one command; a database or service already running on this machine needs run_with_network.'
+    : 'Servers on localhost (a test\'s own server, a local database) are reachable, except while a local proxy runs (the error says so: then use run_with_network).');
 const textContent = result => result.content?.filter(p => p.type === 'text').map(p => p.text).join('\n') ?? '';
 export function taskClass(text) {
   // Advisory hint only. Studio owns allowed models, budgets and run authority.
@@ -106,41 +108,12 @@ export class ManagedSession {
     const model = self.installModel(self.modelRuntime, preview);
     self.wrapStreams(self.modelRuntime, 'main');
     const customTools = processEditTools(self, self.boundary.tools(api));
-    customTools.push({name:'fetch_origin',label:'Fetch origin',description:'Request one approved GitHub origin fetch. Refreshes origin branches without changing working files. Does not expose credentials or allow arbitrary network commands.',
-      parameters:{type:'object',properties:{},additionalProperties:false},
-      execute:async(id,_args,signal,_update,ctx)=>{
-        const plan=await repositoryFetchPlan(self.boundary);
-        if(self.permission==='trusted-full-access'&&!signal?.aborted)return executeRepositoryFetch(self.boundary,plan,signal);
-        const {piApprovalBroker}=await import('../runtime/inspection/approval-broker.ts');
-        const decision=await piApprovalBroker.request({cwd:self.cwd,rawSessionId:self.session.sessionManager.getSessionId(),toolCallId:id,
-          action:{kind:'external-provider-action',preconditionClass:'runtime-only',toolName:'fetch_origin',rawAction:plan,
-            targetPaths:[self.cwd],provider:'github',urlOrigin:'https://github.com',requestedScope:'fetch-origin-once',
-            reason:`Fetch origin branches from ${plan.repository}`,riskClass:'low',allowConsequence:'Download origin branches once; keep the current branch and working files unchanged.',denyConsequence:'No network request or credential read.'},
-          terminalConfirm:()=>ctx?.ui?.confirm?.('Tải nhánh từ origin',`Tải các nhánh của ${plan.repository} về ${self.cwd} một lần.\n\nĐồng ý: chỉ tải nhánh; nhánh hiện tại và file đang làm không đổi.\nTừ chối: không gửi request mạng, không đọc thông tin đăng nhập.`)??Promise.resolve(false),
-          unavailableFallback:'terminal-confirm',recheck:()=>!signal?.aborted&&Boolean(self.grant)});
-        if(!decision.allowed||!decision.consume()||signal?.aborted)throw Error('managed-operation-denied');
-        return executeRepositoryFetch(self.boundary,plan,signal);
-      }});
+    customTools.push(fetchOriginTool(self));
     // With a research helper the web is its work: search results and pages
     // are read on its cheaper model, not in the main agent's context.
     if (!helperRoles(manifest).includes('research')) customTools.push(...self.webTools(self.modelRuntime, 'main'));
-    customTools.push({name:'run_with_network',label:'Run with network',description:'Run one shell command that needs the internet (package install, download, git pull of a public repository), or that starts a local server or a browser (end-to-end tests with Playwright\'s Chromium against a server on 127.0.0.1), after the user approves that exact command. Normal bash has no network and cannot listen on a port. Credentials (.npmrc, SSH keys, Keychain) stay unavailable, so private registries and git push are not possible here.',
-      parameters:{type:'object',properties:{command:{type:'string',minLength:1,maxLength:4000},reason:{type:'string',minLength:1,maxLength:300},timeout:{type:'number',minimum:1,maximum:1800}},required:['command','reason'],additionalProperties:false},
-      execute:async(id,args,signal,onUpdate,ctx)=>{
-        // Bypass runs it without asking, unless it is one the member must confirm.
-        const confirm=await networkConfirmation(self,args.command);
-        const decision=confirm===null?{allowed:true,consume:()=>true}:await (await import('../runtime/inspection/approval-broker.ts')).piApprovalBroker.request({cwd:self.cwd,rawSessionId:self.session.sessionManager.getSessionId(),toolCallId:id,
-          action:{kind:'external-provider-action',preconditionClass:'runtime-only',toolName:'run_with_network',rawAction:{command:args.command},commandPreview:String(args.command),
-            targetPaths:[self.cwd],provider:'network',urlOrigin:null,requestedScope:'network-command-once',reason:(confirm==='ask'?String(args.reason):`Bypass still asks: ${confirm}. ${args.reason}`).slice(0,300),riskClass:'medium',
-            allowConsequence:'Run this exact command once, with internet access; a server it starts accepts connections while it runs.',denyConsequence:'The command does not run; the agent is told you declined.'},
-          terminalConfirm:()=>ctx?.ui?.confirm?.('Chạy lệnh có internet',`${args.command}\n\nLý do: ${args.reason}${confirm==='ask'?'':`\nBypass vẫn hỏi: ${confirm}`}\n\nĐồng ý: chạy đúng lệnh này một lần, có internet; server nó mở nhận kết nối trong lúc chạy.\nTừ chối: lệnh không chạy, agent được báo bạn đã từ chối.`)??Promise.resolve(false),
-          unavailableFallback:'terminal-confirm',recheck:()=>!signal?.aborted&&Boolean(self.grant)});
-        if(!decision.allowed||!decision.consume()||signal?.aborted)throw Error('managed-operation-denied');
-        let ok=false;
-        const before=await self.changedFiles();
-        try { const result=await self.boundary.invoke('bash',{command:args.command,...(args.timeout?{timeout:args.timeout}:{})},signal,onUpdate,ctx?.model,{network:true}); ok=!result?.isError; return result; }
-        finally { await self.claimChanges(before); await self.run?.afterTool('bash',args,ok,()=>self.digest()); await self.refreshReview(); }
-      }});
+    // Commands with network, and with Docker when this machine has an engine.
+    customTools.push(...commandTools(self));
     // Every helper role passes the tool's schema: Pi fixes a tool's schema
     // and description when the conversation opens, so a helper a Harness
     // saved later adds must already pass it. The system prompt, rebuilt each
@@ -160,7 +133,7 @@ export class ManagedSession {
     const agentsFiles = projectInstructions(self.cwd, self.boundary.repositoryTop);
     self.checks = repositoryChecks(agentsFiles, self.cwd, self.boundary.repositoryTop);
     // The Harness workflow (possibly changed on a later enrollment) adds its process to the prompt.
-    const loader = managedResourceLoader(api, { systemPrompt: () => BASE_PROMPT + referencePrompt(self.boundary.userHome) + TEST_PROMPT + webPrompt(helperRoles(manifest)) + helperPrompt(helperRoles(self.manifest)) + workflowPrompt(workflowPolicy(self.manifest), self.checks), agentsFiles,
+    const loader = managedResourceLoader(api, { systemPrompt: () => BASE_PROMPT + referencePrompt(self.boundary.userHome) + TEST_PROMPT + servicesPrompt(self.boundary) + webPrompt(helperRoles(manifest)) + helperPrompt(helperRoles(self.manifest)) + workflowPrompt(workflowPolicy(self.manifest), self.checks), agentsFiles,
       skills: self.resources.skills, prompts: self.resources.prompts, ...await inlineExtensions(api, sdk, self.cwd, terminalExtensions) });
     const settings = api.SettingsManager.inMemory({ retry: { enabled: false, provider: { maxRetries: 0 } }, cacheWarming: 'off', enableInstallTelemetry: false, enableAnalytics: false, enableSkillCommands: true });
     const manager = sessionManager ?? api.SessionManager.inMemory(self.cwd);
@@ -219,9 +192,10 @@ export class ManagedSession {
     };
     self.review = manager.getEntries().filter(e => e.type === 'custom' && e.customType === 'agent-watch-review').at(-1)?.data ?? null;
     const abort = self.session.abort.bind(self.session);
-    self.session.abort = async (...args) => { self.gateAbort?.abort(); return abort(...args); };
-    // One member message is one run, harness rounds included (checks, review,
-    // fixes after the answer): listeners hear "settled" once, when it ends.
+    self.session.abort = async (...args) => { self.gateAbort?.abort(); if (self.activePrompt) self.stopRequested = true; return abort(...args); };
+    // One member message is one turn, harness rounds included (checks, review,
+    // fixes after the answer, rounds that continue an unfinished checklist):
+    // listeners hear "settled" once, when it ends.
     const subscribe = self.session.subscribe.bind(self.session), listeners = self.listeners;
     self.session.subscribe = listener => {
       listeners.add(listener);
@@ -229,14 +203,8 @@ export class ManagedSession {
       return () => { listeners.delete(listener); off(); };
     };
     const prompt = self.session.prompt.bind(self.session);
-    self.session.prompt = async (text, options) => {
-      // An extension command (/bypass, /piagent-update) runs here, never as a turn.
-      if (/^\/\S/.test(text) && self.session.extensionRunner?.getCommand(text.slice(1).split(/\s/)[0])) return prompt(text, options);
-      // /skill:name, /command: the run sees what the member asked for in full.
-      text = self.resources.expand(text);
-      if (self.starting) await self.starting;
-      if (self.activePrompt) return prompt(text, options); // steering/follow-up keep the root
-      await self.refreshReview();
+    // One run: started for the round's request, closed with its report.
+    const runRound = async (text, deliver) => {
       const start = async () => {
         // The Harness (now possibly changed) decides which levels exist; ask
         // for the member's level, or the nearest one it offers.
@@ -282,14 +250,18 @@ export class ManagedSession {
           });
           self.run = new RunProcess(workflowPolicy(self.manifest), { request: text, complex: taskClass(text) === 'complex', checks: self.checks });
           // The files this conversation changed and has not settled: carried
-          // over from a turn that was cut, otherwise none yet.
+          // over from a turn that was cut, otherwise none yet. The code is
+          // compared with the commit the turn started from, so a commit made
+          // during the turn is still its change.
           const pending = pendingBaseline(manager);
           self.ownPaths = new Set(pending !== null ? pendingPaths(manager) : []);
+          self.base = (pending !== null ? pendingHead(manager) : null) ?? await readHead(self.boundary);
           self.run.startDigest = pending ?? await self.digest();
         } catch (error) { self.preflight = describeFailure('main', failureText(error)); }
         self.activePrompt = true;
       })();
       try { await self.starting; } finally { self.starting = null; }
+      const round = { result: undefined, preflight: !!self.preflight, planUpdated: false, changed: false };
       try {
         // The last request of a long conversation was refused as too large:
         // by the model (it no longer fits the window of the model it runs on
@@ -297,13 +269,16 @@ export class ManagedSession {
         // model) or by Studio (a body over 4 MiB, before a 1M-token window is
         // full). The older part is summarised first, so continuing fits.
         if (!self.preflight && self.refusedAsTooLong()) { try { await self.session.compact(); } catch { /* nothing to compact: the request says why */ } }
-        const result = await prompt(text, { ...options, expandPromptTemplates: false });
+        round.result = await deliver();
         if (self.run && !self.preflight) {
           self.gateAbort = new AbortController();
           try { await completionGate(self, self.run, self.gateAbort.signal); } catch { /* the answer stands; the report keeps what is known */ } finally { self.gateAbort = null; }
         }
-        return result;
+        return round;
       } finally {
+        // The round's model work is over: a member message now waits for the next round.
+        self.between = true;
+        Object.assign(round, { planUpdated: !!self.run?.planUpdated, changed: !!self.run?.changed });
         await Promise.allSettled([...self.helpers.values()]);
         // What a command left running in the background ends with the turn.
         try { await self.boundary.stopStrays(); } catch { /* best effort; the boundary stops them on close */ }
@@ -318,12 +293,25 @@ export class ManagedSession {
             catch (error) { if (!process) throw error; await self.broker.request('close'); }
             manager.appendCustomEntry('agent-watch-run', { run_id: self.grant.run_id, state: 'closed' });
           }
-        } finally {
-          self.grant = null; self.run = null; self.activePrompt = false; self.preflight = null;
-          self.notify({ type: 'agent_settled' });
-        }
+        // A run that could not be closed (the network or Agent Watch went away)
+        // ends the turn as failed; the run stays "active" here, so reopening
+        // the conversation recovers or abandons it.
+        } catch (error) { round.closeFailed = failureCode(failureText(error)) || 'close_failed'; }
+        finally { self.grant = null; self.run = null; self.preflight = null; }
       }
     };
+    self.session.prompt = async (text, options) => {
+      // An extension command (/bypass, /piagent-update) runs here, never as a turn.
+      if (/^\/\S/.test(text) && self.session.extensionRunner?.getCommand(text.slice(1).split(/\s/)[0])) return prompt(text, options);
+      // /skill:name, /command: the run sees what the member asked for in full.
+      text = self.resources.expand(text);
+      if (self.starting) await self.starting;
+      // Between two rounds no model runs: the message waits for the next one.
+      if (self.between) return new Promise((resolve, reject) => self.queued.push({ text, options, resolve, reject }));
+      if (self.activePrompt) return prompt(text, options); // steering/follow-up keep the root
+      await self.refreshReview();
+      return memberTurn(self, { manager, prompt, runRound }, text, () => prompt(text, { ...options, expandPromptTemplates: false }));
+    };
     // Native ! commands use the same worker boundary as model bash calls.
     self.session.executeBash = async command => {
       try {
@@ -433,14 +421,14 @@ export class ManagedSession {
   // Whether this conversation changed code, and whether a check ran on it,
   // look only at the files it changed: another conversation (or the member)
   // changing other files in the same folder is not this run's change.
-  async changeDigest() { return readPatchDigest(this.boundary, this.ownPaths); }
+  async changeDigest() { return readPatchDigest(this.boundary, this.ownPaths, this.base); }
   async folderDigest() { try { return await readPatchDigest(this.boundary); } catch { return null; } }
   // What a reviewer reads: this conversation's files; before it changed any,
   // the whole folder (the member's own changes, asked to be reviewed).
   reviewScope() { return this.ownPaths.size ? this.ownPaths : null; }
-  async patchSnapshot() { return readPatchSnapshot(this.boundary, this.reviewScope()); }
-  async patchDigest() { return readPatchDigest(this.boundary, this.reviewScope()); }
-  async changedFiles() { try { return await readChangedFiles(this.boundary); } catch { return null; } }
+  async patchSnapshot() { return readPatchSnapshot(this.boundary, this.reviewScope(), this.base); }
+  async patchDigest() { return readPatchDigest(this.boundary, this.reviewScope(), this.base); }
+  async changedFiles() { try { return await readChangedFiles(this.boundary, this.base); } catch { return null; } }
   // A write or edit names its file; a command, the files it changed.
   claimPath(raw) {
     if (typeof raw !== 'string' || !raw) return;