@piagent/platform 1.2.7 → 1.2.9

package/packages/piagent-core/extensions/piagent-guard.ts

@@ -81,10 +81,15 @@ import {
   buildTestImpact,
   classifyContextTask,
   contextIndexV2Status,
+  ensureContextIndexV2,
   estimateContextTokens,
   searchContextIndexV2,
   toolResultFingerprint
 } from "./context-engine.js";
+import {
+  contextIndexExcludePatterns,
+  effectiveProtectedPaths
+} from "./context-index-policy.js";
 
 import type { ActionClassification } from "./guard-shell-analysis.ts";
 
@@ -99,7 +104,6 @@ import type {
   ContextIndexNodeKind,
   ContextIndexSettings,
   ContextPreflight,
-  EffectiveProtectedPaths,
   ExecPolicyConfig,
   ExternalActionPolicyConfig,
   FinalGateConfig,
@@ -1921,34 +1925,6 @@ function uniqueStrings(values: string[]): string[] {
   return [...new Set(values.filter((value) => typeof value === "string" && value.trim().length > 0))];
 }
 
-function effectiveProtectedPaths(policy: BasePolicy, profile: ProjectProfile): EffectiveProtectedPaths {
-  const baseReadProtectedPaths = policy.shellProtectedPaths ?? policy.protectedPaths;
-  const profileProtectedPaths = profile.protectedPaths ?? [];
-  const profileShellProtectedPaths = profile.shellProtectedPaths ?? profile.protectedPaths ?? [];
-  const readOnlyPaths = profile.readOnlyPaths ?? [];
-  const contextIndexStatePath = resolveContextIndexSettings(profile).path;
-  return {
-    readProtectedPaths: uniqueStrings([
-      ...baseReadProtectedPaths,
-      ...profileProtectedPaths,
-      contextIndexStatePath
-    ]),
-    writeProtectedPaths: uniqueStrings([
-      ...policy.protectedPaths,
-      ...profileProtectedPaths,
-      ...readOnlyPaths,
-      contextIndexStatePath
-    ]),
-    shellProtectedPaths: uniqueStrings([
-      ...baseReadProtectedPaths,
-      ...profileShellProtectedPaths,
-      ...readOnlyPaths,
-      contextIndexStatePath
-    ]),
-    readOnlyPaths: uniqueStrings(readOnlyPaths)
-  };
-}
-
 function classifyExternalAction(toolName: string, input: Record<string, unknown>, policy: BasePolicy): {
   decision: "not-external" | "safe-read" | "confirm";
   provider?: string;
@@ -4480,7 +4456,9 @@ export default function piagentGuard(pi: ExtensionAPI) {
     if (updateNotice) ctx.ui.notify(updateNotice, "info");
     let engineStatus: unknown;
     try {
-      engineStatus = await contextIndexV2Status(ctx.cwd);
+      engineStatus = await contextIndexV2Status(ctx.cwd, {
+        excludePatterns: contextIndexExcludePatterns(policy, profile)
+      });
     } catch (error) {
       engineStatus = { exists: false, error: error instanceof Error ? error.message : String(error) };
     }
@@ -4590,7 +4568,12 @@ export default function piagentGuard(pi: ExtensionAPI) {
     autoPackedPrompts.add(signal.promptHash);
     if (autoPackedPrompts.size > 50) autoPackedPrompts.delete(autoPackedPrompts.values().next().value as string);
     try {
-      const status = await contextIndexV2Status(ctx.cwd);
+      const excludePatterns = contextIndexExcludePatterns(policy, loadProfileFromContext(ctx));
+      const ensured = await ensureContextIndexV2(ctx.cwd, {
+        excludePatterns,
+        rebuildMissing: false
+      });
+      const status = ensured.status;
       if (!status.exists || status.stale) {
         telemetry(ctx, {
           event: "context_pack",
@@ -4603,7 +4586,12 @@ export default function piagentGuard(pi: ExtensionAPI) {
         return;
       }
       const budgetTokens = signal.lane === "high-risk" ? 1_200 : signal.lane === "tiny" ? 500 : 900;
-      const pack = await buildContextPack(ctx.cwd, query, { budgetTokens, includeCode: false, limit: 12 });
+      const pack = await buildContextPack(ctx.cwd, query, {
+        budgetTokens,
+        includeCode: false,
+        limit: 12,
+        excludePatterns
+      });
       telemetry(ctx, {
         event: "context_pack",
         queryHash: pack.queryHash,
@@ -5029,17 +5017,11 @@ export default function piagentGuard(pi: ExtensionAPI) {
     }),
     async execute(_toolCallId, params, _signal, _onUpdate, ctx) {
       const profile = loadProfileFromContext(ctx);
-      const pathPolicy = effectiveProtectedPaths(policy, profile);
-      const excludePatterns = Array.from(new Set([
-        ...pathPolicy.readProtectedPaths,
-        ...pathPolicy.writeProtectedPaths,
-        ".pi/context-index.json",
-        ".pi/piagent-state/**"
-      ]));
+      const excludePatterns = contextIndexExcludePatterns(policy, profile);
       let result: unknown;
       let text: string;
       if (params.action === "status") {
-        result = await contextIndexV2Status(ctx.cwd);
+        result = await contextIndexV2Status(ctx.cwd, { excludePatterns });
         const status = result as Awaited<ReturnType<typeof contextIndexV2Status>>;
         text = [
           `indexV2: ${status.exists ? "ready" : "missing"}`,
@@ -5062,12 +5044,13 @@ export default function piagentGuard(pi: ExtensionAPI) {
         ].join("\n");
       } else if (params.action === "search") {
         if (!params.query?.trim()) throw new Error("query is required for context search");
-        let status = await contextIndexV2Status(ctx.cwd);
-        if (params.refresh || !status.exists) {
-          await buildContextIndexV2(ctx.cwd, { excludePatterns });
-          status = await contextIndexV2Status(ctx.cwd);
-        }
-        result = await searchContextIndexV2(ctx.cwd, params.query, { limit: 15 });
+        const ensured = await ensureContextIndexV2(ctx.cwd, {
+          excludePatterns,
+          refresh: params.refresh,
+          rebuildMissing: true
+        });
+        const status = ensured.status;
+        result = await searchContextIndexV2(ctx.cwd, params.query, { limit: 15, excludePatterns });
         const search = result as Awaited<ReturnType<typeof searchContextIndexV2>>;
         text = [
           `confidence: ${search.confidence}`,
@@ -5076,20 +5059,23 @@ export default function piagentGuard(pi: ExtensionAPI) {
         ].join("\n");
       } else if (params.action === "pack") {
         if (!params.query?.trim()) throw new Error("query is required for a context pack");
-        let status = await contextIndexV2Status(ctx.cwd);
-        if (params.refresh || !status.exists) {
-          await buildContextIndexV2(ctx.cwd, { excludePatterns });
-          status = await contextIndexV2Status(ctx.cwd);
-        }
+        const ensured = await ensureContextIndexV2(ctx.cwd, {
+          excludePatterns,
+          refresh: params.refresh,
+          rebuildMissing: true
+        });
+        const status = ensured.status;
         const pack = await buildContextPack(ctx.cwd, params.query, {
           budgetTokens: params.budgetTokens ?? 6_000,
           includeCode: true,
-          limit: 18
+          limit: 18,
+          excludePatterns
         });
         result = { ...pack, text: undefined, status };
         text = pack.text;
       } else if (params.action === "impact") {
-        result = await buildTestImpact(ctx.cwd, params.files ?? []);
+        await ensureContextIndexV2(ctx.cwd, { excludePatterns, rebuildMissing: false });
+        result = await buildTestImpact(ctx.cwd, params.files ?? [], { excludePatterns });
         const impact = result as Awaited<ReturnType<typeof buildTestImpact>>;
         text = [
           `changed: ${impact.changedFiles.join(", ") || "none"}`,
@@ -5139,7 +5125,9 @@ export default function piagentGuard(pi: ExtensionAPI) {
       const contextIndex = buildContextIndexStatus(ctx.cwd, profile);
       let contextEngine: Awaited<ReturnType<typeof contextIndexV2Status>> | { exists: false; warnings: string[] };
       try {
-        contextEngine = await contextIndexV2Status(ctx.cwd);
+        contextEngine = await contextIndexV2Status(ctx.cwd, {
+          excludePatterns: contextIndexExcludePatterns(policy, profile)
+        });
       } catch (error) {
         contextEngine = { exists: false, warnings: [error instanceof Error ? error.message : String(error)] };
       }
@@ -7232,7 +7220,9 @@ export default function piagentGuard(pi: ExtensionAPI) {
 
   async function emitContextEngineStatus(ctx: ExtensionContext): Promise<void> {
     try {
-      const status = await contextIndexV2Status(ctx.cwd);
+      const status = await contextIndexV2Status(ctx.cwd, {
+        excludePatterns: contextIndexExcludePatterns(policy, loadProfileFromContext(ctx))
+      });
       emitRuntimeMessage(ctx, "piagent-context-engine-status", [
         `contextEngine: ${status.exists ? "ready" : "missing"}`,
         `path: ${status.path}`,
@@ -7251,15 +7241,10 @@ export default function piagentGuard(pi: ExtensionAPI) {
 
   async function rebuildContextEngine(ctx: ExtensionContext): Promise<void> {
     const profile = loadProfileFromContext(ctx);
-    const pathPolicy = effectiveProtectedPaths(policy, profile);
+    const excludePatterns = contextIndexExcludePatterns(policy, profile);
     try {
       const result = await buildContextIndexV2(ctx.cwd, {
-        excludePatterns: Array.from(new Set([
-          ...pathPolicy.readProtectedPaths,
-          ...pathPolicy.writeProtectedPaths,
-          ".pi/context-index.json",
-          ".pi/piagent-state/**"
-        ]))
+        excludePatterns
       });
       telemetry(ctx, { event: "context_engine_action", action: "rebuild", ...result });
       emitRuntimeMessage(ctx, "piagent-context-engine-rebuild", [
@@ -7275,9 +7260,13 @@ export default function piagentGuard(pi: ExtensionAPI) {
   }
 
   async function emitContextEngineSearch(ctx: ExtensionContext, query: string): Promise<boolean> {
-    const status = await contextIndexV2Status(ctx.cwd);
+    const excludePatterns = contextIndexExcludePatterns(policy, loadProfileFromContext(ctx));
+    const { status } = await ensureContextIndexV2(ctx.cwd, {
+      excludePatterns,
+      rebuildMissing: false
+    });
     if (!status.exists || !query.trim()) return false;
-    const search = await searchContextIndexV2(ctx.cwd, query, { limit: 12 });
+    const search = await searchContextIndexV2(ctx.cwd, query, { limit: 12, excludePatterns });
     emitRuntimeMessage(ctx, "piagent-context-engine-search", [
       `confidence: ${search.confidence}`,
       `stale: ${status.stale ? "yes" : "no"}`,
@@ -7291,12 +7280,21 @@ export default function piagentGuard(pi: ExtensionAPI) {
       emitRuntimeMessage(ctx, "piagent-context-pack-help", "Usage: /context pack <task or symbol>");
       return;
     }
-    const status = await contextIndexV2Status(ctx.cwd);
+    const excludePatterns = contextIndexExcludePatterns(policy, loadProfileFromContext(ctx));
+    const { status } = await ensureContextIndexV2(ctx.cwd, {
+      excludePatterns,
+      rebuildMissing: false
+    });
     if (!status.exists) {
       emitRuntimeMessage(ctx, "piagent-context-pack-help", "Context Engine index is missing. Run /context rebuild first.");
       return;
     }
-    const pack = await buildContextPack(ctx.cwd, query, { budgetTokens: 1_500, includeCode: false, limit: 15 });
+    const pack = await buildContextPack(ctx.cwd, query, {
+      budgetTokens: 1_500,
+      includeCode: false,
+      limit: 15,
+      excludePatterns
+    });
     telemetry(ctx, {
       event: "context_pack",
       queryHash: pack.queryHash,
@@ -7318,7 +7316,9 @@ export default function piagentGuard(pi: ExtensionAPI) {
 
   async function emitTestImpact(ctx: ExtensionContext, raw: string): Promise<void> {
     const files = raw.split(/\s+/).map((file) => file.trim()).filter(Boolean);
-    const impact = await buildTestImpact(ctx.cwd, files);
+    const excludePatterns = contextIndexExcludePatterns(policy, loadProfileFromContext(ctx));
+    await ensureContextIndexV2(ctx.cwd, { excludePatterns, rebuildMissing: false });
+    const impact = await buildTestImpact(ctx.cwd, files, { excludePatterns });
     emitRuntimeMessage(ctx, "piagent-context-impact", [
       `changed: ${impact.changedFiles.join(", ") || "none"}`,
       `impacted: ${impact.impactedFiles.map((item) => `${item.path} via ${item.via}`).join(", ") || "none"}`,

package/packages/piagent-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@piagent/core",
-  "version": "1.2.7",
+  "version": "1.2.9",
   "type": "module",
   "private": true,
   "license": "MIT",

package/scripts/audit-runtime-host.sh

@@ -29,7 +29,7 @@ PI_AI_VERSION="$(require_exact_peer "@earendil-works/pi-ai")"
 TYPEBOX_VERSION="$(require_exact_peer "typebox")"
 PI_MCP_ADAPTER_VERSION="2.15.0"
 PI_SUBAGENTS_VERSION="0.38.0"
-PI_WEB_ACCESS_VERSION="0.13.0"
+PI_WEB_ACCESS_VERSION="0.17.0"
 
 if [[ "$PI_CODING_VERSION" != "$PI_AI_VERSION" ]]; then
   echo "FAIL: Pi Coding Agent and Pi AI host versions must match." >&2

package/scripts/context-engine.mjs

@@ -9,9 +9,12 @@ import {
   buildContextPack,
   buildTestImpact,
   contextIndexV2Status,
+  ensureContextIndexV2,
   searchContextIndexV2
 } from "../packages/piagent-core/extensions/context-engine.js";
+import { loadProjectContextIndexPolicy } from "../packages/piagent-core/extensions/context-index-policy.js";
 
+const platformRoot = path.resolve(import.meta.dirname, "..");
 function usage() {
   return [
     "Pi Context Engine",
@@ -53,21 +56,6 @@ function parseArgs(argv) {
   return { command, project, json, tokens, values };
 }
 
-function projectExcludes(project) {
-  const target = path.join(project, ".pi", "piagent-profile.json");
-  try {
-    const profile = JSON.parse(fs.readFileSync(target, "utf8"));
-    return [
-      ...(Array.isArray(profile.protectedPaths) ? profile.protectedPaths : []),
-      ...(Array.isArray(profile.shellProtectedPaths) ? profile.shellProtectedPaths : []),
-      ".pi/context-index.json",
-      ".pi/piagent-state/**"
-    ];
-  } catch {
-    return [".pi/context-index.json", ".pi/piagent-state/**"];
-  }
-}
-
 function print(value, json) {
   if (json || typeof value === "string") {
     process.stdout.write(`${typeof value === "string" ? value : JSON.stringify(value, null, 2)}\n`);
@@ -88,21 +76,35 @@ if (!fs.existsSync(parsed.project) || !fs.statSync(parsed.project).isDirectory()
 }
 
 try {
+  const contextPolicy = ["status", "show", "rebuild", "build", "refresh", "search", "pack", "impact", "tests"]
+    .includes(parsed.command)
+    ? loadProjectContextIndexPolicy(platformRoot, parsed.project, {
+        profilePath: process.env.PIAGENT_PROFILE
+      })
+    : undefined;
+  const excludePatterns = contextPolicy?.excludePatterns ?? [];
   if (["status", "show"].includes(parsed.command)) {
-    print(await contextIndexV2Status(parsed.project), parsed.json);
+    print(await contextIndexV2Status(parsed.project, { excludePatterns }), parsed.json);
   } else if (["rebuild", "build", "refresh"].includes(parsed.command)) {
-    print(await buildContextIndexV2(parsed.project, { excludePatterns: projectExcludes(parsed.project) }), parsed.json);
+    print(await buildContextIndexV2(parsed.project, { excludePatterns }), parsed.json);
   } else if (parsed.command === "search") {
     const query = parsed.values.join(" ").trim();
     if (!query) throw new Error("search requires a query");
-    print(await searchContextIndexV2(parsed.project, query, { limit: 15 }), parsed.json);
+    await ensureContextIndexV2(parsed.project, { excludePatterns, rebuildMissing: true });
+    print(await searchContextIndexV2(parsed.project, query, { limit: 15, excludePatterns }), parsed.json);
   } else if (parsed.command === "pack") {
     const query = parsed.values.join(" ").trim();
     if (!query) throw new Error("pack requires a task or query");
-    const pack = await buildContextPack(parsed.project, query, { budgetTokens: parsed.tokens, includeCode: true });
+    await ensureContextIndexV2(parsed.project, { excludePatterns, rebuildMissing: true });
+    const pack = await buildContextPack(parsed.project, query, {
+      budgetTokens: parsed.tokens,
+      includeCode: true,
+      excludePatterns
+    });
     print(parsed.json ? pack : pack.text, parsed.json);
   } else if (["impact", "tests"].includes(parsed.command)) {
-    print(await buildTestImpact(parsed.project, parsed.values), parsed.json);
+    await ensureContextIndexV2(parsed.project, { excludePatterns, rebuildMissing: false });
+    print(await buildTestImpact(parsed.project, parsed.values, { excludePatterns }), parsed.json);
   } else if (["efficiency", "stats", "waste"].includes(parsed.command)) {
     print(buildContextEfficiencyReport(parsed.project), parsed.json);
   } else {

package/scripts/install-global.sh

@@ -4,7 +4,7 @@ set -euo pipefail
 usage() {
   cat <<'USAGE'
 Usage:
-  scripts/install-global.sh [--stable|--dev|--local|--channel <stable|dev|local>] [--version <tag>] [--resolve-tag] [--package-source <source>] [--dry-run] [--with-mcp|--no-mcp] [--mcp-preset <preset>] [--with-subagents|--no-subagents] [--subagents-preset <preset>] [--with-web-access] [--with-herdr] [--model-scope <preset>]
+  scripts/install-global.sh [--stable|--dev|--local|--channel <stable|dev|local>] [--version <tag>] [--resolve-tag] [--package-source <source>] [--dry-run] [--with-mcp|--no-mcp] [--mcp-preset <preset>] [--with-subagents|--no-subagents] [--subagents-preset <preset>] [--with-web-access|--no-web-access] [--with-herdr] [--model-scope <preset>]
 
 Purpose:
   Install the piagent Pi package into the current user's global Pi settings.
@@ -42,7 +42,7 @@ Notes:
   - An existing pi-subagents install is preserved and upgraded automatically.
     New installs remain opt-in with --with-subagents; use --no-subagents to skip an existing install.
   - Subagents preset defaults to safe: compact tool description, bounded concurrency/depth.
-  - Web access is optional. Install it only when you want the builtin `researcher` subagent to browse/fetch web sources inside Pi.
+  - Web access is installed by default so the builtin `researcher` subagent can browse/fetch web sources inside Pi. Skip it with --no-web-access.
 USAGE
 }
 
@@ -62,7 +62,7 @@ WITH_SUBAGENTS=false
 SUBAGENTS_EXPLICIT=false
 SUBAGENTS_PRESET="safe"
 SUBAGENTS_MODEL_SCOPE="none"
-WITH_WEB_ACCESS=false
+WITH_WEB_ACCESS=true
 WITH_HERDR=false
 CONFIGURE_MODEL_SCOPE=true
 MODEL_SCOPE_PRESET="full"
@@ -76,10 +76,10 @@ RESOLVED_PACKAGE_COMMIT=""
 CLI_PACKAGE_SELECTOR=""
 PI_MCP_ADAPTER_SOURCE="npm:pi-mcp-adapter@2.15.0"
 PI_SUBAGENTS_SOURCE="npm:pi-subagents@0.38.0"
-PI_WEB_ACCESS_SOURCE="npm:pi-web-access@0.13.0"
+PI_WEB_ACCESS_SOURCE="npm:pi-web-access@0.17.0"
 PI_MCP_ADAPTER_INTEGRITY="sha512-HJAVt2I5IB52pKpSUYbVJnzOmuXYBCc/ZrI9ylHxYQWmE7p75j7aWzsHe734EFN+gL7WaM23CTX3eYHz2THKBA=="
 PI_SUBAGENTS_INTEGRITY="sha512-8wGQiX6rkR5J4V+AnWtQg3+LmC+cHnZIM1f/VWTjCTkVmcoKdeLsTAYG6BS2yKAugyEUjNUGj3vE5d9nj9m61A=="
-PI_WEB_ACCESS_INTEGRITY="sha512-ny0bHisMWdobmu1hcMp/jqjaRh6pYrH7dctBK2CVyRF4ia7bP47RnOPYdG1yiks9ohtcanWir5Hl9EFap8h0zQ=="
+PI_WEB_ACCESS_INTEGRITY="sha512-rDAhkIzYtBmCCNgstTJ/zFnw91V64TQqhqLOeGXFxmnJaxE45nj+L4BkUPMYSUb3WFexDDYdGlONyBLLKE4eVw=="
 
 require_value() {
   local option="$1"
@@ -400,6 +400,10 @@ while [[ $# -gt 0 ]]; do
       WITH_WEB_ACCESS=true
       shift
       ;;
+    --no-web-access)
+      WITH_WEB_ACCESS=false
+      shift
+      ;;
     --with-herdr)
       WITH_HERDR=true
       shift
@@ -627,6 +631,7 @@ if [[ "$WITH_WEB_ACCESS" == true ]]; then
   if [[ "$DRY_RUN" == false ]]; then
     verify_npm_integrity "$PI_WEB_ACCESS_SOURCE" "$PI_WEB_ACCESS_INTEGRITY"
   fi
+  remove_existing_npm_package_sources "pi-web-access"
   run_cmd pi install "$PI_WEB_ACCESS_SOURCE"
 fi
 

package/scripts/setup.sh

@@ -30,7 +30,8 @@ Options:
                                   Configure pi-subagents runtime baseline (default: safe)
   --subagents-model-scope <none|piagent|codex|claude>   model family for subagents
                                   Optional subagent model allowlist (default: none)
-  --with-web-access               Install pi-web-access for builtin `researcher` subagent (default: skip)
+  --with-web-access / --no-web-access
+                                  Install/skip pi-web-access for builtin `researcher` subagent (default: install)
   --with-herdr / --no-herdr      Install/skip Herdr Pi integration if herdr exists (default: install)
   --model-scope <full|codex|claude>   model families to enable
                                   Configure Pi enabledModels for selector/cycling (default: full)
@@ -73,7 +74,7 @@ MCP_PRESET_EXPLICIT=false
 WITH_SUBAGENTS=true
 SUBAGENTS_PRESET="safe"
 SUBAGENTS_MODEL_SCOPE="none"
-WITH_WEB_ACCESS=false
+WITH_WEB_ACCESS=true
 WITH_HERDR=true
 CONFIGURE_MODEL_SCOPE=true
 MODEL_SCOPE_PRESET="full"
@@ -154,6 +155,10 @@ while [[ $# -gt 0 ]]; do
       WITH_WEB_ACCESS=true
       shift
       ;;
+    --no-web-access)
+      WITH_WEB_ACCESS=false
+      shift
+      ;;
     --with-herdr)
       WITH_HERDR=true
       shift
@@ -412,6 +417,8 @@ if [[ "$DO_GLOBAL" == true ]]; then
   fi
   if [[ "$WITH_WEB_ACCESS" == true ]]; then
     install_args+=("--with-web-access")
+  else
+    install_args+=("--no-web-access")
   fi
   if [[ "$WITH_HERDR" == true ]]; then
     install_args+=("--with-herdr")

package/scripts/team-doctor.sh

@@ -224,13 +224,16 @@ function mcpSummary(file) {
 
 let piHasMcpAdapter = false;
 let piHasSubagents = false;
+let piHasWebAccess = false;
 if (commandExists("pi")) {
   const piList = spawnSync("pi", ["list"], { encoding: "utf8" });
   const combined = `${piList.stdout ?? ""}\n${piList.stderr ?? ""}`;
   piHasMcpAdapter = combined.includes("pi-mcp-adapter");
   piHasSubagents = combined.includes("pi-subagents");
+  piHasWebAccess = combined.includes("pi-web-access");
   if (!piHasMcpAdapter) warnings.push("Pi MCP adapter not found in `pi list`; run setup with --with-mcp or `pi install npm:pi-mcp-adapter@2.15.0`");
   if (!piHasSubagents) warnings.push("Pi subagents package not found in `pi list`; run setup with --with-subagents or `pi install npm:pi-subagents@0.38.0`");
+  if (!piHasWebAccess) warnings.push("Pi web access package not found in `pi list`; run `piagent-update --force` or `pi install npm:pi-web-access@0.17.0` so researcher subagents can browse/fetch external sources");
 }
 
 const mcpFiles = [

package/scripts/update-global.mjs

@@ -302,7 +302,7 @@ function summarizeMigration(report, dryRun) {
 
 function runProjectMigration(project, options, activePlatformRoot) {
   const migrator = path.join(activePlatformRoot, "scripts/migrate-project-state.mjs");
-  if (!options.dryRun && !fs.existsSync(migrator)) {
+  if (!fs.existsSync(migrator)) {
     fail(`the updated helper has no project migrator at ${migrator}`);
   }
   const args = options.dryRun

package/scripts/verify-local.sh

@@ -52,6 +52,7 @@ required_files=(
   "$ROOT/packages/piagent-core/package.json"
   "$ROOT/packages/piagent-core/extensions/piagent-guard.ts"
   "$ROOT/packages/piagent-core/extensions/context-engine.js"
+  "$ROOT/packages/piagent-core/extensions/context-index-policy.js"
   "$ROOT/packages/piagent-core/extensions/policy-core.js"
   "$ROOT/packages/piagent-core/extensions/redaction-core.js"
   "$ROOT/packages/piagent-core/extensions/runtime-evidence.js"
@@ -346,10 +347,10 @@ require_documented "Subagent orchestration capabilities" "$ROOT/README.md" "$ROO
 require_documented "pi-web-access" "$ROOT/README.md" "$ROOT/docs" "$ROOT/scripts/install-global.sh" "$ROOT/scripts/setup.sh"
 grep -F 'PI_MCP_ADAPTER_SOURCE="npm:pi-mcp-adapter@2.15.0"' "$ROOT/scripts/install-global.sh" >/dev/null
 grep -F 'PI_SUBAGENTS_SOURCE="npm:pi-subagents@0.38.0"' "$ROOT/scripts/install-global.sh" >/dev/null
-grep -F 'PI_WEB_ACCESS_SOURCE="npm:pi-web-access@0.13.0"' "$ROOT/scripts/install-global.sh" >/dev/null
+grep -F 'PI_WEB_ACCESS_SOURCE="npm:pi-web-access@0.17.0"' "$ROOT/scripts/install-global.sh" >/dev/null
 grep -F 'PI_MCP_ADAPTER_VERSION="2.15.0"' "$ROOT/scripts/audit-runtime-host.sh" >/dev/null
 grep -F 'PI_SUBAGENTS_VERSION="0.38.0"' "$ROOT/scripts/audit-runtime-host.sh" >/dev/null
-grep -F 'PI_WEB_ACCESS_VERSION="0.13.0"' "$ROOT/scripts/audit-runtime-host.sh" >/dev/null
+grep -F 'PI_WEB_ACCESS_VERSION="0.17.0"' "$ROOT/scripts/audit-runtime-host.sh" >/dev/null
 node --input-type=module - "$ROOT/scripts/install-global.sh" "$ROOT/scripts/audit-runtime-host.sh" <<'NODE'
 import fs from "node:fs";
 
@@ -545,6 +546,7 @@ fi
 
 node --check "$ROOT/packages/piagent-core/extensions/piagent-guard.ts" >/dev/null
 node --check "$ROOT/packages/piagent-core/extensions/context-engine.js" >/dev/null
+node --check "$ROOT/packages/piagent-core/extensions/context-index-policy.js" >/dev/null
 node --check "$ROOT/packages/piagent-core/extensions/policy-core.js" >/dev/null
 node --check "$ROOT/packages/piagent-core/extensions/redaction-core.js" >/dev/null
 node --check "$ROOT/packages/piagent-core/extensions/runtime-evidence.js" >/dev/null