@piagent/platform 1.28.1 → 1.28.2

package/packages/piagent-webui/dist/client/index.html

@@ -7,7 +7,7 @@
     <meta name="csp-nonce" content="__PIAGENT_CSP_NONCE__" />
     <meta name="piagent-webui-mode" content="__PIAGENT_WEBUI_MODE__" />
     <title>Piagent WebUI</title>
-    <script type="module" crossorigin src="/assets/index-DWkb1mpZ.js"></script>
+    <script type="module" crossorigin src="/assets/index-8YNd9KDA.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-B5XOKQy-.css">
   </head>
   <body>

package/packages/piagent-webui/gateway/managed-launch.ts

@@ -17,6 +17,7 @@ type Binding = { file: string; profile: string; node: string; entrypoint: string
 
 const CLEAN_ENV = { PATH: "/usr/bin:/bin", LANG: "en_US.UTF-8", TERM: "xterm-256color", ...interopEnvironment() };
 const READY = /^Agent Watch Auto: ready$/m;
+const BINDING_WAIT = /\[managed-binding-wait\]$/m, BINDING_WAIT_MS = 95_000;
 const sha256 = (file: string) => createHash("sha256").update(fs.readFileSync(file)).digest("hex");
 const HEX64 = /^[a-f0-9]{64}$/;
 
@@ -130,8 +131,12 @@ async function start(agentDir: string, home: string, timeoutMs: number): Promise
     child.once("exit", () => { exited = true; }); child.once("error", () => { exited = true; }); child.unref();
   } finally { fs.closeSync(fd); }
   try {
-    for (const started = Date.now(); Date.now() - started < timeoutMs;) {
+    // Right after an update the entrypoint waits (up to 90 s) for Agent Watch
+    // to write the new binding; give it that long before timing out.
+    let limit = timeoutMs;
+    for (const started = Date.now(); Date.now() - started < limit;) {
       const text = fs.readFileSync(log, "utf8");
+      if (limit === timeoutMs && BINDING_WAIT.test(text)) limit = timeoutMs + BINDING_WAIT_MS;
       // The launch may just have pointed this slot at the member's store.
       if (READY.test(text)) return controlSocket(home, pinned.profile);
       if (exited) throw new Error(text.match(/Agent Watch: (managed-[a-z:_-]+)\./)?.[1] ?? "managed-launch-failed");

package/packages/piagent-webui/shared/company-copy.ts

@@ -12,6 +12,8 @@ export const LAUNCH_REASONS: Record<string, [string, string]> = {
   "managed-key-unavailable": ["Agent Watch không đọc được key công ty trên máy này. Mở Agent Watch, dán lại mã kết nối, bấm Kết nối Piagent trong WSL rồi kết nối lại.", "Agent Watch cannot read the company key on this computer. Open Agent Watch, paste the connection code again, choose Connect Piagent in WSL, then connect again."],
   "managed-profile-disconnected": ["Cấu hình Piagent đang thuộc key công ty đã ngắt kết nối. Nhập lại cấu hình cho Piagent trong Agent Watch (trên Windows: Kết nối Piagent trong WSL).", "The Piagent configuration belongs to a disconnected company key. Import it again in Agent Watch (on Windows: Connect Piagent in WSL)."],
   "managed-launch-binding-changed": ["Agent Watch hoặc Piagent vừa cập nhật. Nhập lại cấu hình cho Piagent trong Agent Watch (trên Windows: Kết nối Piagent trong WSL).", "Agent Watch or Piagent changed. Import the Piagent configuration again in Agent Watch (on Windows: Connect Piagent in WSL)."],
+  "managed-binding-update-pending": ["Agent Watch đang chạy nhưng chưa cập nhật cấu hình cho bản Piagent mới. Mở Agent Watch → Studio, bấm Áp dụng cho Piagent rồi mở lại.", "Agent Watch is running but has not updated the configuration for the new Piagent yet. Open Agent Watch → Studio, apply for Piagent, then open it again."],
+  "managed-binding-watch-not-running": ["Piagent vừa cập nhật nhưng Agent Watch không chạy nên chưa cập nhật cấu hình. Mở Agent Watch, chờ vài giây rồi mở lại.", "Piagent was updated but Agent Watch is not running, so the configuration was not updated. Open Agent Watch, wait a few seconds, then open it again."],
   "managed-launch-version-mismatch": ["Agent Watch đang dùng một bản Piagent khác với dashboard này. Mở Agent Watch → Studio, bấm Áp dụng cho Piagent rồi kết nối lại.", "Agent Watch points at another Piagent install than this dashboard. Open Agent Watch → Studio, apply for Piagent, then connect again."],
   "managed-launch-stale-runtime": ["Phiên công ty của bản Piagent cũ chưa dừng được. Thử kết nối lại sau ít giây.", "The company runtime from the previous Piagent did not stop yet. Connect again in a few seconds."],
   "managed-launch-timeout": ["Phiên công ty khởi động quá lâu. Kết nối lại.", "The company runtime took too long to start. Connect again."],

package/scripts/company-terminal.mjs

@@ -68,7 +68,7 @@ export function companyTerminalExtension({ managed, packageRoot, sdkRoot, bindin
     };
 
     registerTerminalUpdateOffer(pi, { installed, packageRoot, restart: 'piagent studio',
-      afterUpdate: () => bindingChanged() ? 'Bản mới đổi trình khởi chạy công ty: mở Agent Watch → Studio và nhập lại cấu hình cho Piagent trước khi mở lại.' : null });
+      afterUpdate: () => bindingChanged() ? 'Bản mới đổi trình khởi chạy công ty: Agent Watch tự cập nhật cấu hình (cần Agent Watch đang chạy); piagent studio chờ việc này khi mở lại.' : null });
 
     // Ask first or Bypass, kept with the conversation like the dashboard's switch.
     const showPermission = (ctx) => ctx.ui?.setStatus?.(PERMISSION_STATUS, managed()?.permission === 'trusted-full-access' ? 'Bypass' : undefined);

package/scripts/piagent-studio.mjs

@@ -7,6 +7,7 @@ import { fileURLToPath, pathToFileURL } from 'node:url';
 import { ManagedBrokerClient } from '../packages/piagent-core/managed/broker-client.mjs';
 import { ManagedSession } from '../packages/piagent-core/managed/session.mjs';
 import { agentWatchDataDirectory, interopEnvironment, resolveStore, storedSlot } from '../packages/piagent-core/managed/store.mjs';
+import { agentWatchRunning, awaitRebind, bindingMismatch, installedAfterBinding } from '../packages/piagent-core/managed/binding-wait.mjs';
 
 const digest = file => createHash('sha256').update(fs.readFileSync(file)).digest('hex');
 // Node's experimental-feature notices (type stripping, SQLite) are not
@@ -30,18 +31,32 @@ Object.assign(process.env, clean);
 let broker, current, gateway, hold;
 try {
   const configPath = fs.realpathSync(flags.get('--config') ?? path.join(home,'.pi/agent/agent-watch-managed.json'));
-  if (!fs.statSync(configPath).isFile() || fs.statSync(configPath).size > 16384) throw Error('managed-config-invalid');
-  const config = JSON.parse(fs.readFileSync(configPath));
+  const readConfig = () => {
+    if (!fs.statSync(configPath).isFile() || fs.statSync(configPath).size > 16384) throw Error('managed-config-invalid');
+    return JSON.parse(fs.readFileSync(configPath));
+  };
+  let config = readConfig();
   // Agent Watch rewrites this when the key or its harness changes.
   const bindingRevision = () => { try { return String(JSON.parse(fs.readFileSync(configPath, 'utf8')).configuration_revision ?? '') || null; } catch { return null; } };
   // --serve backs the personal dashboard: no browser, no project of its own.
   // Its startup probe runs in an empty private folder that is never listed.
   const serve = flags.has('--serve');
   if (serve && (flags.has('--project') || flags.has('--web') || flags.has('--check') || flags.has('--prompt'))) throw Error('managed-launch-arguments');
-  if (config.schema_version !== 1 || config.model !== 'agent-watch-auto' || !/^[a-f0-9]{64}$/.test(config.profile_id)
-    || config.entrypoint !== fs.realpathSync(fileURLToPath(import.meta.url)) || config.node !== fs.realpathSync(process.execPath)
-    || digest(config.entrypoint) !== config.entrypoint_sha256 || digest(config.node) !== config.node_sha256
-    || digest(config.broker) !== config.broker_sha256) throw Error('managed-launch-binding-changed');
+  const running = { self: fs.realpathSync(fileURLToPath(import.meta.url)), node: fs.realpathSync(process.execPath) };
+  const mismatch = bindingMismatch(config, running);
+  // Right after a Piagent update only the launcher's hash differs until Agent
+  // Watch writes the new binding: wait for it. Nothing runs before every
+  // pinned path and hash matches again.
+  if (mismatch === 'entrypoint' && installedAfterBinding(configPath, config.entrypoint)) {
+    const watch = () => agentWatchRunning(config.broker);
+    const rebound = await awaitRebind({ running: watch,
+      current: () => { try { const next = readConfig(); return bindingMismatch(next, running) === null ? next : null; } catch { return null; } },
+      waiting: state => process.stderr.write(state === false
+        ? 'Piagent vừa cập nhật nhưng Agent Watch không chạy. Mở Agent Watch; Piagent tự tiếp tục khi cấu hình được cập nhật… [managed-binding-wait]\n'
+        : 'Agent Watch đang cập nhật cấu hình cho bản Piagent mới… [managed-binding-wait]\n') });
+    if (!rebound) throw Error(watch() === false ? 'managed-binding-watch-not-running' : 'managed-binding-update-pending');
+    config = rebound;
+  } else if (mismatch) throw Error('managed-launch-binding-changed');
   // What company sessions need on this machine, checked with the real sandbox
   // and broker; no conversation, no model request.
   if (flags.has('--doctor')) {