@piagent/platform 1.2.6 → 1.2.8

package/CHANGELOG.md

@@ -2,6 +2,30 @@
 
 This file records release-facing changes for Pi Agent Platform. Copy the relevant version block into GitHub Releases when publishing a tag.
 
+## v1.2.8 - 2026-07-31
+
+### Changed
+
+- Global setup/update now installs `pi-web-access@0.17.0` by default so builtin researcher subagents can browse/search/fetch external sources instead of being limited to local repo/docs. Machines that cannot use web research can opt out with `--no-web-access`.
+
+### Fixed
+
+- Global install/update now removes older platform-owned `pi-web-access` registrations before installing the reviewed exact version, forcing Pi's shared npm package tree to refresh stale transitive dependencies.
+
+## v1.2.7 - 2026-07-31
+
+### Security
+
+- Updated the pinned MCP and subagent add-ons to `pi-mcp-adapter@2.15.0` and `pi-subagents@0.38.0`. Their resolved runtime tree uses patched `fast-uri@3.1.4`, `@hono/node-server@2.0.12`, and MCP SDK `1.30.0`; a clean resolution reports no add-on advisories.
+
+- Raised the runtime release gate from high/critical to moderate/high/critical. The only remaining accepted finding is the separately documented `brace-expansion` denial of service pinned inside Pi host `0.82.0`.
+
+### Fixed
+
+- Global install/update now removes older registrations for platform-owned MCP and subagent add-ons before installing their reviewed exact versions. This forces npm to refresh stale transitive dependencies instead of retaining a vulnerable version from an older shared Pi package lock.
+
+- An existing `pi-subagents` installation is detected and upgraded during a normal platform update. Clean machines still require `--with-subagents`, and `--no-subagents` remains an explicit opt-out.
+
 ## v1.2.6 - 2026-07-31
 
 ### Added

package/README.md

@@ -211,7 +211,7 @@ Keep provider keys in environment variables, never in committed config. Switchin
 
 ## Subagents
 
-`piagent-setup` installs `pi-subagents` with the `safe` preset unless disabled. Daily task prompts stay solo-first: they delegate bounded scout, planning, and review work only when it is independent enough to be worth the cost, and the final handoff states whether subagents were used and why.
+`piagent-setup` installs `pi-subagents` with the `safe` preset and `pi-web-access` for web-backed researcher runs unless disabled. Daily task prompts stay solo-first: they delegate bounded scout, planning, research, and review work only when it is independent enough to be worth the cost, and the final handoff states whether subagents were used and why.
 
 `/subagents-doctor` runs a health check; `/run piagent-scout "…"` and its planner, worker, and reviewer counterparts dispatch work. See [Subagents and multi-agent](docs/subagents-and-multiagent.md).
 
@@ -291,7 +291,7 @@ This repository intentionally excludes:
 
 ## Maturity
 
-The current package version is read from package metadata and release tags. Personal machines may follow the unpinned package source when accepting ongoing updates; production/team quickstarts and committed project settings should pin an explicit tag such as `v1.2.6` or a reviewed commit.
+The current package version is read from package metadata and release tags. Personal machines may follow the unpinned package source when accepting ongoing updates; production/team quickstarts and committed project settings should pin an explicit tag such as `v1.2.8` or a reviewed commit.
 
 Ready for:
 

package/docs/command-reference-vietnamese.md

@@ -465,8 +465,8 @@ Các lệnh này chạy ngoài Pi.
 | Command | Dùng khi nào |
 |---|---|
 | `npm install -g --ignore-scripts @earendil-works/pi-coding-agent@0.82.0` | Cài Pi CLI tương thích với release hiện tại. |
-| `npm install -g --ignore-scripts @piagent/platform@1.2.6` | Cài terminal helper `piagent-*` từ release tag hiện tại. |
-| `pi install git:github.com/Vt-mmm/piagent@v1.2.6` | Cài pinned release khi cần reproducible team setup. |
+| `npm install -g --ignore-scripts @piagent/platform@1.2.8` | Cài terminal helper `piagent-*` từ release tag hiện tại. |
+| `pi install git:github.com/Vt-mmm/piagent@v1.2.8` | Cài pinned release khi cần reproducible team setup. |
 | `pi install git:github.com/Vt-mmm/piagent` | Cài latest package platform cho máy cá nhân/sandbox. |
 | `piagent-update --check` | Báo version hiện tại vs version sẽ lên cho cả ba thành phần; không cài gì. |
 | `piagent-update` | Full update global một lệnh cho cả máy: Pi host → npm-global helper → Pi package, đúng thứ tự release yêu cầu. |
@@ -498,8 +498,8 @@ Các lệnh này chạy ngoài Pi.
 | `piagent-mcp --preset popular --scope global --replace` | Apply the governed MCP popular baseline: core + Playwright + Figma remote. |
 | `piagent-mcp --list` | List MCP presets. |
 | `piagent-subagents --preset safe` | Re-apply subagent safe config. |
-| `pi install npm:pi-web-access@0.13.0` | Optional: cấp web/search/fetch tools cho builtin `researcher`. |
-| `piagent-setup <project> --with-web-access` | Setup project + optional web access cho research subagents. |
+| `pi install npm:pi-web-access@0.17.0` | Cấp web/search/fetch tools cho builtin `researcher`; platform setup/update cài mặc định từ `v1.2.8`. |
+| `piagent-setup <project> --no-web-access` | Setup project nhưng bỏ web access khi máy không được phép browse/fetch external source. |
 | `piagent-usage /path/to/project` | Lấy exact usage của session mới nhất từ terminal khác. |
 | `piagent-usage --history /path/to/project --days 7` | Tổng usage lịch sử của project, gồm session đã end. |
 | `piagent-usage --history --all-projects --days 7 --csv` | Xuất usage tuần toàn máy để đưa vào report. |

package/docs/distribution-standard.md

@@ -14,9 +14,9 @@ Repo này phải chạy được cho nhiều project/domain khác nhau. Vì vậ
 
 | Use case | Package source |
 |---|---|
-| Team pinned release | `git:github.com/Vt-mmm/piagent@v1.2.6` |
+| Team pinned release | `git:github.com/Vt-mmm/piagent@v1.2.8` |
 | Personal/sandbox dev | `git:github.com/Vt-mmm/piagent` |
-| Registry distribution | `npm:@piagent/platform@1.2.6` |
+| Registry distribution | `npm:@piagent/platform@1.2.8` |
 | Enterprise npm (fork under another scope) | `npm:@your-scope/platform@x.y.z` |
 | Local platform dev | `/path/to/piagent` |
 
@@ -26,7 +26,7 @@ Latest tiện cho máy cá nhân muốn nhận cập nhật nhanh. Pin tag/commi
 
 | Channel | Command | Target | Policy |
 |---|---|---|---|
-| `stable` | `bash scripts/install-global.sh --stable` | Helper release tag resolved to commit SHA, currently `v1.2.6` | Install the Pi package matching the helper. |
+| `stable` | `bash scripts/install-global.sh --stable` | Helper release tag resolved to commit SHA, currently `v1.2.8` | Install the Pi package matching the helper. |
 | `exact` | `bash scripts/install-global.sh --version vX.Y.Z --resolve-tag` | Requested tag resolved to commit SHA | Pi-package-only rollout, rollback, and incident recovery. |
 | `dev` | `bash scripts/install-global.sh --dev` | Moving Git source | Personal/sandbox only; do not commit into project settings. |
 | `local` | `bash scripts/install-global.sh --local` | Current checkout path | Platform development only. |
@@ -53,7 +53,7 @@ Root `package.json` có `pi` manifest trỏ tới:
 Do đó team có thể:
 
 ```bash
-pi install git:github.com/Vt-mmm/piagent@v1.2.6
+pi install git:github.com/Vt-mmm/piagent@v1.2.8
 ```
 
 Không cần biết internal folder `packages/piagent-core`. Source không pin chỉ dành cho personal/sandbox như bảng channel ở trên.
@@ -65,12 +65,12 @@ Team nên install global package một lần:
 ```bash
 node --version  # >= 22.19.0
 npm install -g --ignore-scripts @earendil-works/pi-coding-agent@0.82.0
-npm install -g --ignore-scripts @piagent/platform@1.2.6
+npm install -g --ignore-scripts @piagent/platform@1.2.8
 piagent-install --stable --dry-run
 piagent-install --stable
 ```
 
-`pi install git:github.com/Vt-mmm/piagent@v1.2.6` vẫn hợp lệ nếu chỉ cần cài Pi package. Lệnh đó không tự tạo các binary terminal `piagent-*`; muốn có helper global thì dùng `npm install -g --ignore-scripts @piagent/platform@1.2.6`.
+`pi install git:github.com/Vt-mmm/piagent@v1.2.8` vẫn hợp lệ nếu chỉ cần cài Pi package. Lệnh đó không tự tạo các binary terminal `piagent-*`; muốn có helper global thì dùng `npm install -g --ignore-scripts @piagent/platform@1.2.8`.
 
 Support matrix hiện tại: macOS Apple Silicon + Bash và Linux x64 + Bash đã được verify; macOS Intel + Bash và Linux ARM64 + Bash là supported target cần chạy smoke trước rollout; native Windows chưa phải target rollout team; WSL2 experimental. Chi tiết và version runtime nằm trong [release/install policy](release-install-policy.md).
 
@@ -120,7 +120,7 @@ Nếu muốn commit sẵn `.pi/piagent-profile.json` vào repo hoặc bootstrap
 ```bash
 bash scripts/setup.sh /path/to/project \
   --profile be-readonly-fe \
-  --package-source git:github.com/Vt-mmm/piagent@v1.2.6 \
+  --package-source git:github.com/Vt-mmm/piagent@v1.2.8 \
   --mcp-preset core \
   --subagents-preset safe
 ```

package/docs/operator-manual-vietnamese.md

@@ -18,12 +18,12 @@ Support matrix release hiện tại: macOS Apple Silicon + Bash và Linux x64 +
 ```bash
 node --version  # >= 22.19.0
 npm install -g --ignore-scripts @earendil-works/pi-coding-agent@0.82.0
-npm install -g --ignore-scripts @piagent/platform@1.2.6
+npm install -g --ignore-scripts @piagent/platform@1.2.8
 piagent-install --stable --dry-run
 piagent-install --stable
 ```
 
-Khi seed `.pi/settings.json` cho team/repo cần audit lặp lại, giữ package source dạng pinned tag như `git:github.com/Vt-mmm/piagent@v1.2.6`. Máy cá nhân có thể dùng `git:github.com/Vt-mmm/piagent` để theo latest.
+Khi seed `.pi/settings.json` cho team/repo cần audit lặp lại, giữ package source dạng pinned tag như `git:github.com/Vt-mmm/piagent@v1.2.8`. Máy cá nhân có thể dùng `git:github.com/Vt-mmm/piagent` để theo latest.
 
 Nếu đang ở source checkout của platform, dùng helper theo channel để preview trước khi đổi:
 
@@ -99,7 +99,7 @@ install package once
 
 ```bash
 npm install -g --ignore-scripts @earendil-works/pi-coding-agent@0.82.0
-npm install -g --ignore-scripts @piagent/platform@1.2.6
+npm install -g --ignore-scripts @piagent/platform@1.2.8
 piagent-install --stable --dry-run
 piagent-install --stable
 ```
@@ -282,7 +282,7 @@ Không phải daily default. Dùng khi muốn tạo sẵn `.pi` files cho projec
 bash /path/to/piagent/scripts/setup.sh /path/to/project \
   --project-only \
   --profile auto \
-  --package-source git:github.com/Vt-mmm/piagent@v1.2.6 \
+  --package-source git:github.com/Vt-mmm/piagent@v1.2.8 \
   --mcp-preset core \
   --subagents-preset safe
 ```
@@ -894,8 +894,8 @@ Watchdog là optional adversarial reviewer ở cuối turn, không bật mặc
 
 | Command | Dùng để |
 |---|---|
-| `npm install -g --ignore-scripts @piagent/platform@1.2.6` | Cài terminal helper `piagent-*` từ release tag hiện tại. |
-| `pi install git:github.com/Vt-mmm/piagent@v1.2.6` | Install pinned release cho reproducible team setup. |
+| `npm install -g --ignore-scripts @piagent/platform@1.2.8` | Cài terminal helper `piagent-*` từ release tag hiện tại. |
+| `pi install git:github.com/Vt-mmm/piagent@v1.2.8` | Install pinned release cho reproducible team setup. |
 | `pi install git:github.com/Vt-mmm/piagent` | Install latest platform package cho máy cá nhân/sandbox. |
 | Cài exact Pi host của release, rồi `npm install -g --ignore-scripts @piagent/platform@X.Y.Z` và `piagent-install --stable` | Full update: đồng bộ host, terminal helper và Pi package. Mỗi release pin một Pi host chính xác; lấy đúng version của release đang cài trong [release/install policy](release-install-policy.md). |
 | Cài exact Pi host ghi trong release cũ, rồi helper `vPREVIOUS` và `piagent-install --stable` | Full rollback; đánh giá lại dependency findings của host cũ trước khi hạ version. |
@@ -1002,7 +1002,7 @@ Mở lại Pi session sau khi install.
 Cài lại terminal helper đúng release rồi kiểm tra `PATH`:
 
 ```bash
-npm install -g --ignore-scripts @piagent/platform@1.2.6
+npm install -g --ignore-scripts @piagent/platform@1.2.8
 command -v piagent-install
 ```
 

package/docs/publishing-for-teams.md

@@ -59,6 +59,8 @@ pi install /path/to/piagent
 - `1.2.4`: update global có fallback về user-writable npm prefix và project migration/doctor là bước hậu kiểm tùy chọn.
 - `1.2.5`: updater đọc đúng metadata singleton-array của npm 12.
 - `1.2.6`: Context Engine v2, dynamic tool loading, hard-budget retrieval, semantic compaction, Agent Watch telemetry/feedback và quality benchmark theo context efficiency.
+- `1.2.7`: refresh exact MCP/subagent add-on pins, loại dependency URL/static-server có advisory và chặn cả moderate advisory trong runtime release gate.
+- `1.2.8`: cài `pi-web-access@0.17.0` mặc định trong setup/update để researcher subagents có web/search/fetch thật; thêm `--no-web-access` cho máy không được phép browse.
 
 ## Không publish
 

package/docs/release-install-policy.md

@@ -10,7 +10,7 @@ This file is the canonical install, update, rollback, and release checklist. Oth
 
 All supported environments require Node.js `>=22.19.0` and Pi Coding Agent `0.82.0`. The Pi host is installed as a Node CLI; Pi Agent Platform still defines its own release matrix because the terminal helpers and shell policy rely on Bash/POSIX behavior.
 
-| Surface | Status for v1.2.6 | Rollout guidance |
+| Surface | Status for v1.2.8 | Rollout guidance |
 |---|---|---|
 | macOS Apple Silicon (`darwin/arm64`) + Bash | Verified for this release. | Safe default for team rollout after normal project smoke tests. |
 | Linux x64 + Bash | Verified in GitHub Actions. | Safe default for CI/server usage after normal project smoke tests. |
@@ -33,7 +33,7 @@ These three components are versioned independently. A full install, update, or r
 
 | Channel | Source shape | Mutability | Use when |
 |---|---|---:|---|
-| `stable` | `git:github.com/Vt-mmm/piagent@<resolved-commit-sha>` from `v1.2.6` | Fixed after resolution | Default for team rollout. |
+| `stable` | `git:github.com/Vt-mmm/piagent@<resolved-commit-sha>` from `v1.2.8` | Fixed after resolution | Default for team rollout. |
 | `exact` | Tag, reviewed commit, or a tag resolved with `--resolve-tag` | Fixed when using a commit SHA | Pi-package-only roll forward, rollback, or reproduction. |
 | `dev` | `git:github.com/Vt-mmm/piagent` | Moving | Personal machine or sandbox only. |
 | `local` | `/path/to/piagent` | Local workspace | Platform development and dry-run validation. |
@@ -53,7 +53,7 @@ Use this flow when the team needs both terminal commands and the Pi package:
 ```bash
 node --version  # >= 22.19.0
 npm install -g --ignore-scripts @earendil-works/pi-coding-agent@0.82.0
-npm install -g --ignore-scripts @piagent/platform@1.2.6
+npm install -g --ignore-scripts @piagent/platform@1.2.8
 piagent-install --stable --dry-run
 piagent-install --stable
 ```
@@ -61,8 +61,8 @@ piagent-install --stable
 The stable preview and apply output includes:
 
 ```text
-currentRelease: v1.2.6 (helper package version)
-tag: v1.2.6
+currentRelease: v1.2.8 (helper package version)
+tag: v1.2.8
 resolvedCommit: <40-char-sha>
 source: git:github.com/Vt-mmm/piagent@<40-char-sha>
 ```
@@ -79,7 +79,7 @@ bash scripts/install-global.sh --stable
 Use this only when terminal commands are not needed:
 
 ```bash
-pi install git:github.com/Vt-mmm/piagent@v1.2.6
+pi install git:github.com/Vt-mmm/piagent@v1.2.8
 ```
 
 Direct `pi install` does not create `piagent-*` commands on `PATH`.
@@ -317,5 +317,5 @@ Re-running the workflow from a branch instead skips publishing, because the publ
 - Do not use a moving source in committed project settings.
 - Do not publish local trust files, OAuth tokens, `auth.json`, sessions, caches, or `.env` files.
 - Review the resolved commit SHA before rollout; tag resolution improves reproducibility but is not signed package provenance by itself.
-- `npm audit --audit-level=high` covers this repository's helper dependency tree. `npm run audit:runtime` separately builds and audits the exact optional Pi host and pinned add-on dependency tree so `--legacy-peer-deps` cannot hide deployed runtime findings.
+- `npm audit --audit-level=high` covers this repository's helper dependency tree. `npm run audit:runtime` separately builds the exact optional Pi host and pinned add-on dependency tree and blocks unaccepted moderate, high, or critical findings so stale or permissive peer resolution cannot hide deployed runtime risk.
 - Run doctor after install, update, or rollback so package source, project profile, protected paths, and share policy are checked together.

package/docs/security-threat-model.md

@@ -21,7 +21,7 @@ This document covers the packaged guard, project profiles, capability locks, ins
 - The operator, operating-system account, Pi host, and explicitly trusted project repository are trusted to execute code.
 - Project-local Pi resources are loaded only after Pi project trust or an explicit operator override.
 - A human remains available to approve destructive and external-provider actions.
-- Supported release verification covers macOS Apple Silicon + Bash, Linux x64 + Bash, Node.js `>=22.19.0`, and the exact Pi host version declared by the release. macOS Intel + Bash and Linux ARM64 + Bash are supported targets that need local smoke verification before broad rollout. Native Windows is not a team-rollout target for v1.2.6, and WSL2 is experimental/unverified.
+- Supported release verification covers macOS Apple Silicon + Bash, Linux x64 + Bash, Node.js `>=22.19.0`, and the exact Pi host version declared by the release. macOS Intel + Bash and Linux ARM64 + Bash are supported targets that need local smoke verification before broad rollout. Native Windows is not a team-rollout target for v1.2.8, and WSL2 is experimental/unverified.
 - Registry, GitHub, model-provider, MCP-provider, and Vercel controls are external dependencies. Their account security and platform guarantees are not replaced by this repository.
 
 ## Threat actors and failure modes

package/docs/subagent-orchestration-capabilities.md

@@ -42,7 +42,7 @@ Core decisions:
   - `scheduledRuns.enabled: false`
   - bounded `maxSubagentDepth`, spawn cap, and parallel concurrency
 - `scripts/setup.sh` / `scripts/install-global.sh`
-  - optional `--with-web-access` installs `npm:pi-web-access@0.13.0` for web/docs research
+  - install `npm:pi-web-access@0.17.0` by default for web/docs research; `--no-web-access` opts out
 - Workflow prompts
   - `/workflow task`, `/workflow plan`, `/workflow review`, `/workflow be-to-fe`, `/workflow platform-improve` instruct the parent to auto-delegate when work is independent and bounded
 - Docs
@@ -81,7 +81,7 @@ Parallel review:
 Research-heavy task:
 
 ```bash
-pi install npm:pi-web-access@0.13.0
+pi install npm:pi-web-access@0.17.0
 ```
 
 ```text

package/docs/subagents-and-multiagent.md

@@ -48,7 +48,7 @@ Nếu chỉ cài global:
 
 ```bash
 pi install git:github.com/Vt-mmm/piagent
-pi install npm:pi-subagents@0.35.1
+pi install npm:pi-subagents@0.38.0
 bash /path/to/piagent/scripts/configure-subagents.sh --preset safe
 ```
 
@@ -103,15 +103,15 @@ Sau khi mở session mới hoặc `/reload`:
 
 `/subagents-doctor` là lệnh đầu tiên nên chạy nếu không thấy tool/agent.
 
-Optional research support:
+Web research support is installed by default in team setup/update:
 
 ```bash
-pi install npm:pi-web-access@0.13.0
-# hoặc
-bash /path/to/piagent/scripts/setup.sh . --with-web-access
+pi install npm:pi-web-access@0.17.0
+# hoặc full setup/update:
+bash /path/to/piagent/scripts/setup.sh .
 ```
 
-`researcher` builtin cần web/search/fetch tools từ package này. Không bật mặc định để tránh tăng tool surface cho team không cần web research.
+`researcher` builtin cần web/search/fetch tools từ package này. Từ `v1.2.8`, platform cài package này mặc định để `/parallel-research` không bị giới hạn ở local repo/docs. Nếu một máy thật sự không được phép browse/fetch web, dùng `--no-web-access`.
 
 Giải nghĩa nhanh:
 

package/docs/team-onboarding.md

@@ -9,7 +9,7 @@ Một thành viên mới không cần biết local path của maintainer. Luồn
 ```bash
 node --version  # >= 22.19.0
 npm install -g --ignore-scripts @earendil-works/pi-coding-agent@0.82.0
-npm install -g --ignore-scripts @piagent/platform@1.2.6
+npm install -g --ignore-scripts @piagent/platform@1.2.8
 piagent-install --stable
 cd /path/to/project
 pi
@@ -43,7 +43,7 @@ Mặc định team dùng stable helper:
 ```bash
 node --version  # >= 22.19.0
 npm install -g --ignore-scripts @earendil-works/pi-coding-agent@0.82.0
-npm install -g --ignore-scripts @piagent/platform@1.2.6
+npm install -g --ignore-scripts @piagent/platform@1.2.8
 piagent-install --stable --dry-run
 piagent-install --stable
 ```

package/docs-site/architecture.html

@@ -27,7 +27,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.2.6 docs</span>
+        <span class="pill"><span class="pill-dot"></span>v1.2.8 docs</span>
         <a class="button social" href="https://github.com/Vt-mmm/piagent" target="_blank" rel="noopener noreferrer" aria-label="Mở GitHub repository">
           <svg viewBox="0 0 24 24" fill="none" aria-hidden="true">
             <path d="M7 17 17 7M9 7h8v8" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" />

package/docs-site/commands.html

@@ -27,7 +27,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.2.6 docs</span>
+        <span class="pill"><span class="pill-dot"></span>v1.2.8 docs</span>
         <a class="button social" href="https://github.com/Vt-mmm/piagent" target="_blank" rel="noopener noreferrer" aria-label="Mở GitHub repository">
           <svg viewBox="0 0 24 24" fill="none" aria-hidden="true">
             <path d="M7 17 17 7M9 7h8v8" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" />

package/docs-site/context-engine.html

@@ -27,7 +27,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.2.6 docs</span>
+        <span class="pill"><span class="pill-dot"></span>v1.2.8 docs</span>
         <a class="button social" href="https://github.com/Vt-mmm/piagent" target="_blank" rel="noopener noreferrer" aria-label="Mở GitHub repository">
           <svg viewBox="0 0 24 24" fill="none" aria-hidden="true">
             <path d="M7 17 17 7M9 7h8v8" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" />

package/docs-site/index.html

@@ -27,7 +27,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.2.6 docs</span>
+        <span class="pill"><span class="pill-dot"></span>v1.2.8 docs</span>
         <a class="button social" href="https://github.com/Vt-mmm/piagent" target="_blank" rel="noopener noreferrer" aria-label="Mở GitHub repository">
           <svg viewBox="0 0 24 24" fill="none" aria-hidden="true">
             <path d="M7 17 17 7M9 7h8v8" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" />

package/docs-site/mcp-approval.html

@@ -27,7 +27,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.2.6 docs</span>
+        <span class="pill"><span class="pill-dot"></span>v1.2.8 docs</span>
         <a class="button social" href="https://github.com/Vt-mmm/piagent" target="_blank" rel="noopener noreferrer" aria-label="Mở GitHub repository">
           <svg viewBox="0 0 24 24" fill="none" aria-hidden="true">
             <path d="M7 17 17 7M9 7h8v8" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" />

package/docs-site/mcp-auth.html

@@ -27,7 +27,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.2.6 docs</span>
+        <span class="pill"><span class="pill-dot"></span>v1.2.8 docs</span>
         <a class="button social" href="https://github.com/Vt-mmm/piagent" target="_blank" rel="noopener noreferrer" aria-label="Mở GitHub repository">
           <svg viewBox="0 0 24 24" fill="none" aria-hidden="true">
             <path d="M7 17 17 7M9 7h8v8" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" />

package/docs-site/mcp-servers.html

@@ -27,7 +27,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.2.6 docs</span>
+        <span class="pill"><span class="pill-dot"></span>v1.2.8 docs</span>
         <a class="button social" href="https://github.com/Vt-mmm/piagent" target="_blank" rel="noopener noreferrer" aria-label="Mở GitHub repository">
           <svg viewBox="0 0 24 24" fill="none" aria-hidden="true">
             <path d="M7 17 17 7M9 7h8v8" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" />

package/docs-site/mcp.html

@@ -27,7 +27,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.2.6 docs</span>
+        <span class="pill"><span class="pill-dot"></span>v1.2.8 docs</span>
         <a class="button social" href="https://github.com/Vt-mmm/piagent" target="_blank" rel="noopener noreferrer" aria-label="Mở GitHub repository">
           <svg viewBox="0 0 24 24" fill="none" aria-hidden="true">
             <path d="M7 17 17 7M9 7h8v8" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" />

package/docs-site/permissions.html

@@ -27,7 +27,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.2.6 docs</span>
+        <span class="pill"><span class="pill-dot"></span>v1.2.8 docs</span>
         <a class="button social" href="https://github.com/Vt-mmm/piagent" target="_blank" rel="noopener noreferrer" aria-label="Mở GitHub repository">
           <svg viewBox="0 0 24 24" fill="none" aria-hidden="true">
             <path d="M7 17 17 7M9 7h8v8" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" />

package/docs-site/profiles.html

@@ -27,7 +27,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.2.6 docs</span>
+        <span class="pill"><span class="pill-dot"></span>v1.2.8 docs</span>
         <a class="button social" href="https://github.com/Vt-mmm/piagent" target="_blank" rel="noopener noreferrer" aria-label="Mở GitHub repository">
           <svg viewBox="0 0 24 24" fill="none" aria-hidden="true">
             <path d="M7 17 17 7M9 7h8v8" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" />

package/docs-site/quickstart.html

@@ -27,7 +27,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.2.6 docs</span>
+        <span class="pill"><span class="pill-dot"></span>v1.2.8 docs</span>
         <a class="button social" href="https://github.com/Vt-mmm/piagent" target="_blank" rel="noopener noreferrer" aria-label="Mở GitHub repository">
           <svg viewBox="0 0 24 24" fill="none" aria-hidden="true">
             <path d="M7 17 17 7M9 7h8v8" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" />

package/docs-site/runtime.html

@@ -27,7 +27,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.2.6 docs</span>
+        <span class="pill"><span class="pill-dot"></span>v1.2.8 docs</span>
         <a class="button social" href="https://github.com/Vt-mmm/piagent" target="_blank" rel="noopener noreferrer" aria-label="Mở GitHub repository">
           <svg viewBox="0 0 24 24" fill="none" aria-hidden="true">
             <path d="M7 17 17 7M9 7h8v8" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" />

package/docs-site/scope.html

@@ -27,7 +27,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.2.6 docs</span>
+        <span class="pill"><span class="pill-dot"></span>v1.2.8 docs</span>
         <a class="button social" href="https://github.com/Vt-mmm/piagent" target="_blank" rel="noopener noreferrer" aria-label="Mở GitHub repository">
           <svg viewBox="0 0 24 24" fill="none" aria-hidden="true">
             <path d="M7 17 17 7M9 7h8v8" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" />

package/docs-site/security.html

@@ -27,7 +27,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.2.6 docs</span>
+        <span class="pill"><span class="pill-dot"></span>v1.2.8 docs</span>
         <a class="button social" href="https://github.com/Vt-mmm/piagent" target="_blank" rel="noopener noreferrer" aria-label="Mở GitHub repository">
           <svg viewBox="0 0 24 24" fill="none" aria-hidden="true">
             <path d="M7 17 17 7M9 7h8v8" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" />

package/docs-site/team.html

@@ -27,7 +27,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.2.6 docs</span>
+        <span class="pill"><span class="pill-dot"></span>v1.2.8 docs</span>
         <a class="button social" href="https://github.com/Vt-mmm/piagent" target="_blank" rel="noopener noreferrer" aria-label="Mở GitHub repository">
           <svg viewBox="0 0 24 24" fill="none" aria-hidden="true">
             <path d="M7 17 17 7M9 7h8v8" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" />

package/docs-site/workflows.html

@@ -27,7 +27,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.2.6 docs</span>
+        <span class="pill"><span class="pill-dot"></span>v1.2.8 docs</span>
         <a class="button social" href="https://github.com/Vt-mmm/piagent" target="_blank" rel="noopener noreferrer" aria-label="Mở GitHub repository">
           <svg viewBox="0 0 24 24" fill="none" aria-hidden="true">
             <path d="M7 17 17 7M9 7h8v8" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" />

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@piagent/platform",
-  "version": "1.2.6",
+  "version": "1.2.8",
   "license": "MIT",
   "publishConfig": {
     "access": "public",

package/packages/piagent-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@piagent/core",
-  "version": "1.2.6",
+  "version": "1.2.8",
   "type": "module",
   "private": true,
   "license": "MIT",

package/scripts/audit-runtime-host.sh

@@ -27,9 +27,9 @@ require_exact_peer() {
 PI_CODING_VERSION="$(require_exact_peer "@earendil-works/pi-coding-agent")"
 PI_AI_VERSION="$(require_exact_peer "@earendil-works/pi-ai")"
 TYPEBOX_VERSION="$(require_exact_peer "typebox")"
-PI_MCP_ADAPTER_VERSION="2.11.0"
-PI_SUBAGENTS_VERSION="0.35.1"
-PI_WEB_ACCESS_VERSION="0.13.0"
+PI_MCP_ADAPTER_VERSION="2.15.0"
+PI_SUBAGENTS_VERSION="0.38.0"
+PI_WEB_ACCESS_VERSION="0.17.0"
 
 if [[ "$PI_CODING_VERSION" != "$PI_AI_VERSION" ]]; then
   echo "FAIL: Pi Coding Agent and Pi AI host versions must match." >&2
@@ -60,7 +60,7 @@ const target = process.argv[2];
 fs.writeFileSync(target, `${JSON.stringify({ name: "piagent-runtime-audit", version: "0.0.0", private: true }, null, 2)}\n`);
 NODE
 
-echo "Auditing Pi host ${PI_CODING_VERSION} and pinned add-ons at severity high and above..."
+echo "Auditing Pi host ${PI_CODING_VERSION} and pinned add-ons at severity moderate and above..."
 (
   cd "$AUDIT_ROOT"
   npm install --package-lock-only --ignore-scripts --no-audit --no-fund \

package/scripts/check-runtime-advisories.mjs

@@ -2,7 +2,8 @@
 
 // Applies the runtime advisory policy to `npm audit --json` read from stdin.
 //
-// The rule is still "no high or critical advisory in the pinned Pi host tree".
+// The rule is "no moderate, high, or critical advisory in the pinned Pi host
+// and add-on tree".
 // What this adds is a way to accept one named advisory when there is provably
 // nothing to do about it, without lowering the bar for everything else.
 //
@@ -77,7 +78,7 @@ if (report.auditReportVersion !== 2) {
 const blocking = [];
 const seen = new Set();
 for (const [name, vulnerability] of Object.entries(report.vulnerabilities ?? {})) {
-  if (!["high", "critical"].includes(vulnerability.severity)) continue;
+  if (!["moderate", "high", "critical"].includes(vulnerability.severity)) continue;
   const ids = advisoryIdsFor(vulnerability);
   if (ids.length === 0) {
     blocking.push({ name, severity: vulnerability.severity, id: "(no advisory id)" });
@@ -110,5 +111,5 @@ if (failures.length > 0) {
 
 const counts = report.metadata?.vulnerabilities ?? {};
 const acceptedList = ACCEPTED.map((entry) => `${entry.id} (review by ${entry.reviewBy})`).join(", ");
-console.log(`PASS: no unaccepted high or critical advisory (${counts.high ?? 0} high, ${counts.critical ?? 0} critical)`);
+console.log(`PASS: no unaccepted moderate, high, or critical advisory (${counts.moderate ?? 0} moderate, ${counts.high ?? 0} high, ${counts.critical ?? 0} critical)`);
 if (acceptedList) console.log(`Accepted, with reasons recorded in scripts/check-runtime-advisories.mjs: ${acceptedList}`);

package/scripts/install-global.sh

@@ -4,7 +4,7 @@ set -euo pipefail
 usage() {
   cat <<'USAGE'
 Usage:
-  scripts/install-global.sh [--stable|--dev|--local|--channel <stable|dev|local>] [--version <tag>] [--resolve-tag] [--package-source <source>] [--dry-run] [--with-mcp|--no-mcp] [--mcp-preset <preset>] [--with-subagents] [--subagents-preset <preset>] [--with-web-access] [--with-herdr] [--model-scope <preset>]
+  scripts/install-global.sh [--stable|--dev|--local|--channel <stable|dev|local>] [--version <tag>] [--resolve-tag] [--package-source <source>] [--dry-run] [--with-mcp|--no-mcp] [--mcp-preset <preset>] [--with-subagents|--no-subagents] [--subagents-preset <preset>] [--with-web-access|--no-web-access] [--with-herdr] [--model-scope <preset>]
 
 Purpose:
   Install the piagent Pi package into the current user's global Pi settings.
@@ -39,8 +39,10 @@ Notes:
     Skip it with --no-mcp. Writing the config does not start or authenticate anything:
     the GitHub server additionally needs Docker running and GITHUB_PERSONAL_ACCESS_TOKEN
     exported, and Chrome DevTools needs a local Chrome.
+  - An existing pi-subagents install is preserved and upgraded automatically.
+    New installs remain opt-in with --with-subagents; use --no-subagents to skip an existing install.
   - Subagents preset defaults to safe: compact tool description, bounded concurrency/depth.
-  - Web access is optional. Install it only when you want the builtin `researcher` subagent to browse/fetch web sources inside Pi.
+  - Web access is installed by default so the builtin `researcher` subagent can browse/fetch web sources inside Pi. Skip it with --no-web-access.
 USAGE
 }
 
@@ -57,9 +59,10 @@ WITH_MCP=true
 MCP_PRESET="core"
 MCP_PRESET_EXPLICIT=false
 WITH_SUBAGENTS=false
+SUBAGENTS_EXPLICIT=false
 SUBAGENTS_PRESET="safe"
 SUBAGENTS_MODEL_SCOPE="none"
-WITH_WEB_ACCESS=false
+WITH_WEB_ACCESS=true
 WITH_HERDR=false
 CONFIGURE_MODEL_SCOPE=true
 MODEL_SCOPE_PRESET="full"
@@ -71,12 +74,12 @@ RESOLVE_TAG=false
 RESOLVED_PACKAGE_TAG=""
 RESOLVED_PACKAGE_COMMIT=""
 CLI_PACKAGE_SELECTOR=""
-PI_MCP_ADAPTER_SOURCE="npm:pi-mcp-adapter@2.11.0"
-PI_SUBAGENTS_SOURCE="npm:pi-subagents@0.35.1"
-PI_WEB_ACCESS_SOURCE="npm:pi-web-access@0.13.0"
-PI_MCP_ADAPTER_INTEGRITY="sha512-4Y/eLbhbxnRih519dJUxMyQ5QASvPcdWyBlS8+dDXteAzaMuLnd4nMTWgoZw3JRIW+0r93KAQcz1Rbli4xCwEQ=="
-PI_SUBAGENTS_INTEGRITY="sha512-nIH6liO541FZ1RoeEu58Ligd59tiNw0/ODPgHh7uvx9Dk4UpWH08F84/l1+hXCzUgC85OCmyVtngWkZjcK94Cg=="
-PI_WEB_ACCESS_INTEGRITY="sha512-ny0bHisMWdobmu1hcMp/jqjaRh6pYrH7dctBK2CVyRF4ia7bP47RnOPYdG1yiks9ohtcanWir5Hl9EFap8h0zQ=="
+PI_MCP_ADAPTER_SOURCE="npm:pi-mcp-adapter@2.15.0"
+PI_SUBAGENTS_SOURCE="npm:pi-subagents@0.38.0"
+PI_WEB_ACCESS_SOURCE="npm:pi-web-access@0.17.0"
+PI_MCP_ADAPTER_INTEGRITY="sha512-HJAVt2I5IB52pKpSUYbVJnzOmuXYBCc/ZrI9ylHxYQWmE7p75j7aWzsHe734EFN+gL7WaM23CTX3eYHz2THKBA=="
+PI_SUBAGENTS_INTEGRITY="sha512-8wGQiX6rkR5J4V+AnWtQg3+LmC+cHnZIM1f/VWTjCTkVmcoKdeLsTAYG6BS2yKAugyEUjNUGj3vE5d9nj9m61A=="
+PI_WEB_ACCESS_INTEGRITY="sha512-rDAhkIzYtBmCCNgstTJ/zFnw91V64TQqhqLOeGXFxmnJaxE45nj+L4BkUPMYSUb3WFexDDYdGlONyBLLKE4eVw=="
 
 require_value() {
   local option="$1"
@@ -226,13 +229,40 @@ remove_existing_piagent_platform_sources() {
     if is_piagent_platform_source "$source"; then
       run_cmd pi remove "$source"
     fi
-  done < <(
-    pi list --approve 2>/dev/null | awk '
-      $0 == "User packages:" { in_user = 1; next }
-      $0 == "Project packages:" { in_user = 0; next }
-      in_user && $0 ~ /^  [^ ]/ { sub(/^  /, ""); print }
-    '
-  )
+  done < <(list_user_pi_sources)
+}
+
+list_user_pi_sources() {
+  pi list --approve 2>/dev/null | awk '
+    $0 == "User packages:" { in_user = 1; next }
+    $0 == "Project packages:" { in_user = 0; next }
+    in_user && $0 ~ /^  [^ ]/ { sub(/^  /, ""); print }
+  '
+}
+
+has_user_npm_package_source() {
+  local package_name="$1"
+  local source
+  while IFS= read -r source; do
+    case "$source" in
+      "npm:${package_name}"|"npm:${package_name}@"*)
+        return 0
+        ;;
+    esac
+  done < <(list_user_pi_sources)
+  return 1
+}
+
+remove_existing_npm_package_sources() {
+  local package_name="$1"
+  local source
+  while IFS= read -r source; do
+    case "$source" in
+      "npm:${package_name}"|"npm:${package_name}@"*)
+        run_cmd pi remove "$source"
+        ;;
+    esac
+  done < <(list_user_pi_sources)
 }
 
 verify_npm_integrity() {
@@ -348,6 +378,12 @@ while [[ $# -gt 0 ]]; do
       ;;
     --with-subagents)
       WITH_SUBAGENTS=true
+      SUBAGENTS_EXPLICIT=true
+      shift
+      ;;
+    --no-subagents)
+      WITH_SUBAGENTS=false
+      SUBAGENTS_EXPLICIT=true
       shift
       ;;
     --subagents-preset)
@@ -364,6 +400,10 @@ while [[ $# -gt 0 ]]; do
       WITH_WEB_ACCESS=true
       shift
       ;;
+    --no-web-access)
+      WITH_WEB_ACCESS=false
+      shift
+      ;;
     --with-herdr)
       WITH_HERDR=true
       shift
@@ -542,6 +582,10 @@ else
   fi
 fi
 
+if [[ "$SUBAGENTS_EXPLICIT" == false ]] && command -v pi >/dev/null 2>&1 && has_user_npm_package_source "pi-subagents"; then
+  WITH_SUBAGENTS=true
+fi
+
 echo "Installing Pi Agent Platform package:"
 echo "  channel: $RESOLVED_CHANNEL_LABEL"
 echo "  currentRelease: $CURRENT_RELEASE_TAG (helper package version)"
@@ -562,6 +606,7 @@ if [[ "$WITH_MCP" == true ]]; then
   if [[ "$DRY_RUN" == false ]]; then
     verify_npm_integrity "$PI_MCP_ADAPTER_SOURCE" "$PI_MCP_ADAPTER_INTEGRITY"
   fi
+  remove_existing_npm_package_sources "pi-mcp-adapter"
   run_cmd pi install "$PI_MCP_ADAPTER_SOURCE"
   if [[ "$DRY_RUN" == false ]] && command -v pi-mcp-adapter >/dev/null 2>&1; then
     pi-mcp-adapter init || true
@@ -575,6 +620,7 @@ if [[ "$WITH_SUBAGENTS" == true ]]; then
   if [[ "$DRY_RUN" == false ]]; then
     verify_npm_integrity "$PI_SUBAGENTS_SOURCE" "$PI_SUBAGENTS_INTEGRITY"
   fi
+  remove_existing_npm_package_sources "pi-subagents"
   run_cmd pi install "$PI_SUBAGENTS_SOURCE"
   echo "Configuring Pi subagents baseline:"
   run_cmd bash "$PLATFORM_ROOT/scripts/configure-subagents.sh" --preset "$SUBAGENTS_PRESET" --model-scope "$SUBAGENTS_MODEL_SCOPE"
@@ -585,6 +631,7 @@ if [[ "$WITH_WEB_ACCESS" == true ]]; then
   if [[ "$DRY_RUN" == false ]]; then
     verify_npm_integrity "$PI_WEB_ACCESS_SOURCE" "$PI_WEB_ACCESS_INTEGRITY"
   fi
+  remove_existing_npm_package_sources "pi-web-access"
   run_cmd pi install "$PI_WEB_ACCESS_SOURCE"
 fi
 

package/scripts/setup.sh

@@ -30,7 +30,8 @@ Options:
                                   Configure pi-subagents runtime baseline (default: safe)
   --subagents-model-scope <none|piagent|codex|claude>   model family for subagents
                                   Optional subagent model allowlist (default: none)
-  --with-web-access               Install pi-web-access for builtin `researcher` subagent (default: skip)
+  --with-web-access / --no-web-access
+                                  Install/skip pi-web-access for builtin `researcher` subagent (default: install)
   --with-herdr / --no-herdr      Install/skip Herdr Pi integration if herdr exists (default: install)
   --model-scope <full|codex|claude>   model families to enable
                                   Configure Pi enabledModels for selector/cycling (default: full)
@@ -73,7 +74,7 @@ MCP_PRESET_EXPLICIT=false
 WITH_SUBAGENTS=true
 SUBAGENTS_PRESET="safe"
 SUBAGENTS_MODEL_SCOPE="none"
-WITH_WEB_ACCESS=false
+WITH_WEB_ACCESS=true
 WITH_HERDR=true
 CONFIGURE_MODEL_SCOPE=true
 MODEL_SCOPE_PRESET="full"
@@ -154,6 +155,10 @@ while [[ $# -gt 0 ]]; do
       WITH_WEB_ACCESS=true
       shift
       ;;
+    --no-web-access)
+      WITH_WEB_ACCESS=false
+      shift
+      ;;
     --with-herdr)
       WITH_HERDR=true
       shift
@@ -397,9 +402,9 @@ if [[ "$DO_GLOBAL" == true ]]; then
   ensure_pi_cli
   install_args=("$PLATFORM_ROOT/scripts/install-global.sh" "--package-source" "$PACKAGE_SOURCE")
   # The opt-out has to be passed explicitly. The installer defaults MCP on, so
-  # saying nothing here would install it against the operator's choice; the
-  # flags below can stay one-sided only because the installer defaults them off.
-  #
+  # saying nothing here would install it against the operator's choice.
+  # Subagents also needs an explicit opt-out because the installer now preserves
+  # an existing install during updates.
   if [[ "$WITH_MCP" == true ]]; then
     install_args+=("--with-mcp" "--mcp-preset" "$MCP_PRESET")
   else
@@ -407,9 +412,13 @@ if [[ "$DO_GLOBAL" == true ]]; then
   fi
   if [[ "$WITH_SUBAGENTS" == true ]]; then
     install_args+=("--with-subagents" "--subagents-preset" "$SUBAGENTS_PRESET" "--subagents-model-scope" "$SUBAGENTS_MODEL_SCOPE")
+  else
+    install_args+=("--no-subagents")
   fi
   if [[ "$WITH_WEB_ACCESS" == true ]]; then
     install_args+=("--with-web-access")
+  else
+    install_args+=("--no-web-access")
   fi
   if [[ "$WITH_HERDR" == true ]]; then
     install_args+=("--with-herdr")

package/scripts/team-doctor.sh

@@ -224,13 +224,16 @@ function mcpSummary(file) {
 
 let piHasMcpAdapter = false;
 let piHasSubagents = false;
+let piHasWebAccess = false;
 if (commandExists("pi")) {
   const piList = spawnSync("pi", ["list"], { encoding: "utf8" });
   const combined = `${piList.stdout ?? ""}\n${piList.stderr ?? ""}`;
   piHasMcpAdapter = combined.includes("pi-mcp-adapter");
   piHasSubagents = combined.includes("pi-subagents");
-  if (!piHasMcpAdapter) warnings.push("Pi MCP adapter not found in `pi list`; run setup with --with-mcp or `pi install npm:pi-mcp-adapter@2.11.0`");
-  if (!piHasSubagents) warnings.push("Pi subagents package not found in `pi list`; run setup with --with-subagents or `pi install npm:pi-subagents@0.35.1`");
+  piHasWebAccess = combined.includes("pi-web-access");
+  if (!piHasMcpAdapter) warnings.push("Pi MCP adapter not found in `pi list`; run setup with --with-mcp or `pi install npm:pi-mcp-adapter@2.15.0`");
+  if (!piHasSubagents) warnings.push("Pi subagents package not found in `pi list`; run setup with --with-subagents or `pi install npm:pi-subagents@0.38.0`");
+  if (!piHasWebAccess) warnings.push("Pi web access package not found in `pi list`; run `piagent-update --force` or `pi install npm:pi-web-access@0.17.0` so researcher subagents can browse/fetch external sources");
 }
 
 const mcpFiles = [

package/scripts/verify-local.sh

@@ -344,12 +344,12 @@ require_documented "auto-delegation" "$ROOT/README.md" "$ROOT/docs" "$ROOT/packa
 require_documented "Subagents used/not used" "$ROOT/packages/piagent-core/prompts" "$ROOT/docs/auto-delegation-policy.md"
 require_documented "Subagent orchestration capabilities" "$ROOT/README.md" "$ROOT/docs/subagent-orchestration-capabilities.md"
 require_documented "pi-web-access" "$ROOT/README.md" "$ROOT/docs" "$ROOT/scripts/install-global.sh" "$ROOT/scripts/setup.sh"
-grep -F 'PI_MCP_ADAPTER_SOURCE="npm:pi-mcp-adapter@2.11.0"' "$ROOT/scripts/install-global.sh" >/dev/null
-grep -F 'PI_SUBAGENTS_SOURCE="npm:pi-subagents@0.35.1"' "$ROOT/scripts/install-global.sh" >/dev/null
-grep -F 'PI_WEB_ACCESS_SOURCE="npm:pi-web-access@0.13.0"' "$ROOT/scripts/install-global.sh" >/dev/null
-grep -F 'PI_MCP_ADAPTER_VERSION="2.11.0"' "$ROOT/scripts/audit-runtime-host.sh" >/dev/null
-grep -F 'PI_SUBAGENTS_VERSION="0.35.1"' "$ROOT/scripts/audit-runtime-host.sh" >/dev/null
-grep -F 'PI_WEB_ACCESS_VERSION="0.13.0"' "$ROOT/scripts/audit-runtime-host.sh" >/dev/null
+grep -F 'PI_MCP_ADAPTER_SOURCE="npm:pi-mcp-adapter@2.15.0"' "$ROOT/scripts/install-global.sh" >/dev/null
+grep -F 'PI_SUBAGENTS_SOURCE="npm:pi-subagents@0.38.0"' "$ROOT/scripts/install-global.sh" >/dev/null
+grep -F 'PI_WEB_ACCESS_SOURCE="npm:pi-web-access@0.17.0"' "$ROOT/scripts/install-global.sh" >/dev/null
+grep -F 'PI_MCP_ADAPTER_VERSION="2.15.0"' "$ROOT/scripts/audit-runtime-host.sh" >/dev/null
+grep -F 'PI_SUBAGENTS_VERSION="0.38.0"' "$ROOT/scripts/audit-runtime-host.sh" >/dev/null
+grep -F 'PI_WEB_ACCESS_VERSION="0.17.0"' "$ROOT/scripts/audit-runtime-host.sh" >/dev/null
 node --input-type=module - "$ROOT/scripts/install-global.sh" "$ROOT/scripts/audit-runtime-host.sh" <<'NODE'
 import fs from "node:fs";