@piagent/platform 1.36.1 → 1.37.1

package/packages/piagent-core/managed/helper-settlement.mjs

@@ -78,8 +78,11 @@ export function failedSettlement(role, error, signal, spec = {}) {
     evidence: [], files: [], ...(Object.keys(spec ?? {}).length ? { spec } : {}) };
 }
 
-// Sends the report with the attempt's own token; never fails the helper.
-export async function settleHelper(managed, grant, report, fetchImpl = (...args) => globalThis.fetch(...args)) {
+// Sends the report with the attempt's own token; never fails the helper. A
+// passing failure (no answer, 5xx, 429) is sent again after these pauses:
+// Studio keeps one report per role, so a repeat is safe.
+const SETTLE_PAUSES_MS = [500, 2_000];
+export async function settleHelper(managed, grant, report, fetchImpl = (...args) => globalThis.fetch(...args), pauses = SETTLE_PAUSES_MS) {
   if (!report || !hasCapability(managed, 'managed.settle.v1')) return false;
   let held = null;
   try {
@@ -87,10 +90,18 @@ export async function settleHelper(managed, grant, report, fetchImpl = (...args)
     // current one (the attempt's first token may be stale by now).
     if (typeof grant === 'function') { held = await grant(); grant = held.grant; }
     if (!grant?.token) return false;
-    const response = await fetchImpl(`${managed.origin}/v1/managed/settle`, { method: 'POST', signal: AbortSignal.timeout(3_000),
-      headers: { Authorization: `Bearer ${grant.token}`, 'Content-Type': 'application/json', 'User-Agent': CLIENT_AGENT }, body: JSON.stringify(report) });
-    void response.body?.cancel?.().catch(() => {});
-    return response.ok;
+    for (let attempt = 0; ; attempt += 1) {
+      let status = 0;
+      try {
+        const response = await fetchImpl(`${managed.origin}/v1/managed/settle`, { method: 'POST', signal: AbortSignal.timeout(3_000),
+          headers: { Authorization: `Bearer ${grant.token}`, 'Content-Type': 'application/json', 'User-Agent': CLIENT_AGENT }, body: JSON.stringify(report) });
+        void response.body?.cancel?.().catch(() => {});
+        if (response.ok) return true;
+        status = response.status;
+      } catch { /* no answer */ }
+      if ((status && status < 500 && status !== 429) || attempt >= pauses.length) return false;
+      await new Promise(resolve => setTimeout(resolve, pauses[attempt]));
+    }
   } catch { return false; } finally { held?.release(); }
 }
 

package/packages/piagent-core/managed/ip-policy.mjs

@@ -0,0 +1,50 @@
+import net from 'node:net';
+
+// Whether an address is this machine, a private network or not routable on
+// the internet (IANA special-purpose registries). One classifier for every
+// outbound check (web-fetch, package-proxy). IPv6 forms that carry an IPv4
+// address (mapped, compatible, translated, NAT64, 6to4), dotted or hex, are
+// judged by that IPv4 address. Teredo, IPv6 outside 2000::/3, and anything
+// that does not parse count as private: fail closed.
+const V4_RANGES = [['0.0.0.0', 8], ['10.0.0.0', 8], ['100.64.0.0', 10], ['127.0.0.0', 8], ['169.254.0.0', 16], ['172.16.0.0', 12],
+  ['192.0.0.0', 24], ['192.0.2.0', 24], ['192.88.99.0', 24], ['192.168.0.0', 16], ['198.18.0.0', 15], ['198.51.100.0', 24],
+  ['203.0.113.0', 24], ['224.0.0.0', 4], ['240.0.0.0', 4]].map(([base, bits]) => [v4Number(base), 2 ** (32 - bits)]);
+
+function v4Number(text) {
+  const parts = String(text).split('.');
+  if (parts.length !== 4 || !parts.every(part => /^(0|[1-9]\d{0,2})$/.test(part) && Number(part) <= 255)) return null;
+  return parts.reduce((value, part) => value * 256 + Number(part), 0);
+}
+const v4Private = value => V4_RANGES.some(([base, size]) => value >= base && value < base + size);
+
+// Eight 16-bit groups, or null: "::" expanded, a dotted IPv4 tail and a zone id accepted.
+function v6Groups(text) {
+  let value = String(text).toLowerCase().replace(/%[^%]*$/, '');
+  const tail = /:(\d+\.\d+\.\d+\.\d+)$/.exec(value);
+  if (tail) {
+    const v4 = v4Number(tail[1]); if (v4 === null) return null;
+    value = value.slice(0, -tail[1].length) + `${(v4 >>> 16).toString(16)}:${(v4 & 0xffff).toString(16)}`;
+  }
+  const halves = value.split('::');
+  if (halves.length > 2) return null;
+  const head = halves[0] ? halves[0].split(':') : [], rest = halves[1] ? halves[1].split(':') : [];
+  const missing = 8 - head.length - rest.length;
+  if (halves.length === 2 ? missing < 1 : missing !== 0) return null;
+  const groups = [...head, ...Array(halves.length === 2 ? missing : 0).fill('0'), ...rest];
+  return groups.every(group => /^[0-9a-f]{1,4}$/.test(group)) ? groups.map(group => parseInt(group, 16)) : null;
+}
+
+export function privateAddress(address) {
+  if (net.isIPv4(String(address))) { const v4 = v4Number(address); return v4 === null || v4Private(v4); }
+  const g = v6Groups(address);
+  if (!g) return true;
+  const zero = (from, to) => g.slice(from, to).every(group => group === 0);
+  const v4 = (high, low) => v4Private(high * 0x10000 + low);
+  if (zero(0, 5) && (g[5] === 0xffff || g[5] === 0)) return v4(g[6], g[7]); // ::ffff:0:0/96 mapped, ::/96 compatible (with :: and ::1)
+  if (zero(0, 4) && g[4] === 0xffff && g[5] === 0) return v4(g[6], g[7]); // ::ffff:0:0:0/96 translated
+  if (g[0] === 0x64 && g[1] === 0xff9b) return zero(2, 6) ? v4(g[6], g[7]) : true; // NAT64 64:ff9b::/96; 64:ff9b:1::/48 local
+  if (g[0] === 0x2002) return v4(g[1], g[2]); // 6to4
+  if ((g[0] & 0xe000) !== 0x2000) return true; // not global unicast: 100::/64, fc00::/7, fe80::/10, fec0::/10, ff00::/8, ...
+  return g[0] === 0x2001 && (g[1] === 0 || g[1] === 0xdb8 || (g[1] === 2 && g[2] === 0)) // Teredo, documentation, benchmarking
+    || (g[0] & 0xfff0) === 0x3ff0; // 3fff::/20 documentation
+}

package/packages/piagent-core/managed/memory-lessons.mjs

@@ -43,6 +43,9 @@ function passed(output) {
 // What an error says, without what varies between runs: numbers, ids,
 // temporary paths and quoted values.
 export const errorShape = text => clean(text,180).replace(/\/(?:tmp|var\/folders|private)\/\S*/g,'<tmp>').replace(/\b[0-9a-f]{8,}\b/gi,'<id>').replace(/\d+/g,'N').replace(/(["'`])[^"'`]{1,80}\1/g,'$1…$1');
+// A command without what varies between runs (temporary paths, ids,
+// numbers): \`curl service-a\` and \`curl service-b\` stay two commands.
+const commandShape = text => clean(text,160).replace(/\/(?:tmp|var\/folders|private)\/\S*/g,'<tmp>').replace(/\b[0-9a-f]{8,}\b/gi,'<id>').replace(/\d+/g,'N');
 const ERROR_LINE = /error|fail|exception|not found|no such|denied|refused|cannot|unknown (?:option|flag|command)|invalid|EADDRINUSE|ENOENT|EACCES/i;
 const MAX_LESSONS = 3;
 
@@ -55,7 +58,7 @@ export class CheckLessons {
   if(/managed[-_](?:tool[-_]cancelled|operation[-_]denied|helper[-_]cancelled)|Command aborted|Command timed out/i.test(output))return;
   const line=output.split('\n').find(l=>ERROR_LINE.test(l));
   if(!line)return;
-  const command=clean(call.command,160).split(' ')[0];
+  const command=commandShape(call.command);
   if(!command)return;
   const shape=errorShape(line), key=hash(command+'\0'+shape), seen=this.errors.get(key);
   if(!seen){if(this.errors.size>=40)this.errors.delete(this.errors.keys().next().value);this.errors.set(key,{id:event.toolCallId,command:clean(call.command,160),error:clean(line,180),done:false});return;}

package/packages/piagent-core/managed/memory.mjs

@@ -78,7 +78,7 @@ export class TeamMemory {
     const scope = this.scope(), id = scopeID(scope);
     if (id !== this.scopeHash) {
       this.scopeHash = id; this.outbox = new MemoryOutbox(this.stateDir, scope, this.now);
-      this.protocol = 0; this.briefed = false; this.offUntil = 0; this.retain = true;
+      this.protocol = 0; this.briefed = false; this.offUntil = 0; this.retain = true; this.serves = new RoundServes(); // served under the old scope
     }
     return scope;
   }

package/packages/piagent-core/managed/package-proxy.mjs

@@ -3,6 +3,9 @@ import http from 'node:http';
 import net from 'node:net';
 import path from 'node:path';
 import { lookup } from 'node:dns/promises';
+import { privateAddress } from './ip-policy.mjs';
+
+export { privateAddress };
 
 // The package registries a company command reaches without asking: plain
 // bash has no network, except through this proxy, which the trusted runtime
@@ -10,6 +13,10 @@ import { lookup } from 'node:dns/promises';
 // HTTP to the hosts below and the member's own additions, on ports 443 and
 // 80 only, never to an IP literal or a name that resolves to this machine or
 // a private network (DNS rebinding), and connects to the address it checked.
+// With a company upstream proxy (HTTPS_PROXY) the name is still looked up and
+// checked here, and the upstream is asked for that checked address, never the
+// name, so it cannot resolve it elsewhere; a name this machine cannot look up
+// is refused (run_with_network still reaches it after the member approves).
 // Everything else is refused with 403 and remembered, so the command's
 // failure names the host and run_with_network (the member approves it).
 // Registries (and GitHub) take no upload without a token, and tokens stay
@@ -50,17 +57,8 @@ export function domainAllowed(host, domains) {
   return domains.some(rule => rule.startsWith('*.') ? name.endsWith(rule.slice(1)) && name.length > rule.length - 1 : name === rule);
 }
 
-// Addresses that are this machine, a private network or not routable.
-export function privateAddress(address) {
-  if (net.isIPv4(address)) {
-    const [a, b] = address.split('.').map(Number);
-    return a === 0 || a === 10 || a === 127 || (a === 100 && b >= 64 && b < 128) || (a === 169 && b === 254) || (a === 172 && b >= 16 && b < 32)
-      || (a === 192 && b === 168) || (a === 198 && (b === 18 || b === 19)) || a >= 224;
-  }
-  const v6 = address.toLowerCase();
-  if (v6.startsWith('::ffff:')) return privateAddress(v6.slice(7));
-  return v6 === '::' || v6 === '::1' || /^f[cd]/.test(v6) || /^fe[89ab]/.test(v6) || v6.startsWith('ff');
-}
+// host:port of a checked address, as a CONNECT target or URL host.
+const authority = ({ host, port }) => `${net.isIPv6(host) ? `[${host}]` : host}:${port}`;
 
 function upstreamProxy(env) {
   for (const name of ['HTTPS_PROXY', 'https_proxy']) {
@@ -101,7 +99,6 @@ export class PackageProxy {
   // The checked public address of an allowed host, or null.
   async #target(host, port) {
     if (!this.ports.has(port) || !domainAllowed(host, this.domains)) { this.#deny(host); return null; }
-    if (this.upstream) return { host, port };
     try {
       const addresses = await this.resolve(host);
       if (!addresses.length || addresses.some(entry => this.isPrivate(entry.address))) { this.#deny(host); return null; }
@@ -117,7 +114,7 @@ export class PackageProxy {
     upstream.setTimeout(10 * 60_000, () => upstream.destroy());
     upstream.once('connect', () => {
       if (this.upstream) {
-        upstream.write(`CONNECT ${match[1]}:${match[2]} HTTP/1.1\r\nHost: ${match[1]}:${match[2]}\r\n\r\n`);
+        upstream.write(`CONNECT ${authority(target)} HTTP/1.1\r\nHost: ${authority(target)}\r\n\r\n`);
         let reply = Buffer.alloc(0);
         const onData = chunk => {
           reply = Buffer.concat([reply, chunk]);
@@ -144,8 +141,9 @@ export class PackageProxy {
     const target = await this.#target(url.hostname, Number(url.port) || 80);
     if (!target) { response.writeHead(403, { 'X-Piagent-Proxy': 'domain-not-allowed', 'Content-Type': 'text/plain; charset=utf-8' }).end(`piagent: ${url.hostname} is not an allowed package registry\n`); return; }
     const headers = { ...request.headers, host: url.host }; delete headers['proxy-connection']; delete headers['proxy-authorization'];
+    const pinned = new URL(url); pinned.host = authority(target);
     const outgoing = http.request(this.upstream
-      ? { host: this.upstream.host, port: this.upstream.port, path: url.href, method: request.method, headers }
+      ? { host: this.upstream.host, port: this.upstream.port, path: pinned.href, method: request.method, headers }
       : { host: target.host, port: target.port, path: url.pathname + url.search, method: request.method, headers, servername: url.hostname }, incoming => {
       response.writeHead(incoming.statusCode ?? 502, incoming.headers); incoming.pipe(response);
     });

package/packages/piagent-core/managed/session.mjs

@@ -13,7 +13,7 @@ import { managedThinkingLevels, nearestLevel } from './capabilities.mjs';
 import { nativeManagedModel, isVendor, piProvider, studioAPI, studioPath } from './native-catalog.mjs';
 import { fetchOriginTool } from './repository-operation.mjs';
 import { describeFailure, failureCode, failureText } from '../runtime/managed-failure.mjs';
-import { enableCompanyTurnRetry, wrapRoleStreams, conversationSession } from './request-stream.mjs'; import { StudioLink, viaLink } from './studio-link.mjs';
+import { enableCompanyTurnRetry, wrapRoleStreams, conversationSession } from './request-stream.mjs'; import { StudioLink, closeRun } from './studio-link.mjs';
 import { trackToolFailures } from './tool-failures.mjs';
 import { fastServed, fastSetter, fastState, recordFast, restoreFast } from './fast-mode.mjs';
 import { runHelper } from './helper-run.mjs';
@@ -296,15 +296,14 @@ export class ManagedSession {
             // the newest version the broker advertises.
             const features = self.manifest.broker_features ?? [];
             const process = self.run && features.includes('process') ? self.run.report(currentPlan(manager), features.includes('process-v3') ? 3 : features.includes('process-v2') ? 2 : 1) : null;
-            try { await viaLink(self.studioLink, () => self.broker.request('close', process ? { process } : {}), { conversation: conversationSession(self), runId: self.grant.run_id }); } // only a refused report closes again without it; an unconfirmed close fails the turn
-            catch (error) { if (!process || String(error?.message) !== 'managed-broker:invalidResponse') throw error; await viaLink(self.studioLink, () => self.broker.request('close'), { conversation: conversationSession(self), runId: self.grant.run_id }); }
-            manager.appendCustomEntry('agent-watch-run', { run_id: self.grant.run_id, state: 'closed' });
+            // A close Studio may not have had stays "active" here (closeRun).
+            if (await closeRun(self.studioLink, self.broker, features, process, { conversation: conversationSession(self), runId: self.grant.run_id })) manager.appendCustomEntry('agent-watch-run', { run_id: self.grant.run_id, state: 'closed' });
           }
         // A run that could not be closed (the network or Agent Watch went away)
         // ends the turn as failed; the run stays "active" here, so reopening
         // the conversation recovers or abandons it.
         } catch (error) { round.closeFailed = failureCode(failureText(error)) || 'close_failed'; }
-        finally { self.grant = null; self.run = null; self.preflight = null; }
+        finally { self.grant = null; self.run = null; self.preflight = null; self.unclosed = null; }
       }
     };
     self.session.prompt = async (text, options) => {

package/packages/piagent-core/managed/skill-feedback.mjs

@@ -5,9 +5,17 @@
 // Piagent never edits a skill itself and makes no model call for this.
 import fs from 'node:fs';
 import path from 'node:path';
+import { createHash } from 'node:crypto';
 
 const MIN_FAILURES = 3, MIN_SHARE = 0.5, KEEP = 10, REPROPOSE_MS = 7 * 86400_000;
-const safeName = name => String(name).replace(/[^A-Za-z0-9_.-]/g, '_').slice(0, 80);
+// One file name per skill name: a name with other characters (or capitals,
+// on a case-insensitive disk) gets a digest of itself, so \`a/b\` and \`a_b\`
+// keep their own counts.
+const safeName = name => {
+  name = String(name);
+  if (/^[a-z0-9_.-]{1,80}$/.test(name) && !/^\.+$/.test(name)) return name;
+  return `${name.replace(/[^A-Za-z0-9_.-]/g, '_').slice(0, 60)}~${createHash('sha256').update(name).digest('hex').slice(0, 12)}`;
+};
 
 export class SkillFeedback {
   // A managed round's tracker, when the conversation has skills.

package/packages/piagent-core/managed/studio-link.mjs

@@ -269,3 +269,19 @@ export async function viaLink(link, ask, { conversation = null, runId = null } =
     }
   }
 }
+
+// Closing a round's run, asked again through the link. Only a refused report
+// closes again without it; an unconfirmed close throws (the turn fails). An
+// Agent Watch without close-retry forgets a run whose close failed, so asking
+// again "succeeds" without reaching Studio: false then, and the run stays
+// "active" for the runtime (reopening recovers or abandons it).
+export async function closeRun(link, broker, features, process, where) {
+  let unsent = false;
+  const close = args => viaLink(link, () => broker.request('close', args).catch(error => {
+    if (!features.includes('close-retry') && String(error?.message) !== 'managed-broker:invalidResponse') unsent = true;
+    throw error;
+  }), where);
+  try { await close(process ? { process } : {}); }
+  catch (error) { if (!process || String(error?.message) !== 'managed-broker:invalidResponse') throw error; await close(); }
+  return !unsent;
+}

package/packages/piagent-core/managed/web-fetch.mjs

@@ -2,6 +2,9 @@ import dns from 'node:dns/promises';
 import https from 'node:https';
 import net from 'node:net';
 import zlib from 'node:zlib';
+import { privateAddress } from './ip-policy.mjs';
+
+export { privateAddress };
 
 // Reads one public https page for the company session, from the runtime
 // process (tools in the sandbox have no network). GET only, no cookies or
@@ -11,20 +14,6 @@ const MAX_BYTES = 5 * 1024 * 1024;
 const MAX_REDIRECTS = 5;
 const TEXT = /^(text\/|application\/(json|xml|xhtml\+xml|javascript|x-yaml|yaml|ld\+json|rss\+xml|atom\+xml))/i;
 
-function v4Private(address) {
-  const [a, b] = address.split('.').map(Number);
-  return a === 0 || a === 10 || a === 127 || a >= 224 || (a === 100 && b >= 64 && b <= 127) || (a === 169 && b === 254)
-    || (a === 172 && b >= 16 && b <= 31) || (a === 192 && b === 168) || (a === 192 && b === 0) || (a === 198 && (b === 18 || b === 19));
-}
-export function privateAddress(address) {
-  if (net.isIPv4(address)) return v4Private(address);
-  if (!net.isIPv6(address)) return true;
-  const value = address.toLowerCase();
-  const mapped = value.match(/^(?:0*:)*:ffff:(\d+\.\d+\.\d+\.\d+)$/) ?? value.match(/^64:ff9b::(\d+\.\d+\.\d+\.\d+)$/);
-  if (mapped) return v4Private(mapped[1]);
-  return value === '::' || value === '::1' || /^f[cd]/.test(value) || /^fe[89ab]/.test(value) || /^ff/.test(value) || value.startsWith('2001:db8');
-}
-
 async function publicTarget(url, resolve) {
   if (url.protocol !== 'https:' || url.username || url.password) throw new Error('web-fetch-url-not-allowed');
   const host = url.hostname.replace(/^\[|\]$/g, '');

package/packages/piagent-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@piagent/core",
-  "version": "1.36.1",
+  "version": "1.37.1",
   "type": "module",
   "private": true,
   "license": "MIT",

package/packages/piagent-core/runtime/managed-failure.mjs

@@ -166,6 +166,11 @@ export function failureCode(raw) {
   // The provider library's words for an answer stream that ended empty: Studio
   // admitted the request and nothing came back. It is not asked again.
   if (/stream ended without a (terminal event|stop reason)|response has no body/i.test(text)) return 'upstream_incomplete';
+  // Studio's own words when its upstream cut an answer already streaming: its
+  // error event carries the code, which the provider libraries drop (seen
+  // 2026-10-21: "Request interrupted" stopped a long task with no ask again).
+  if (/^Request interrupted\b/i.test(text)) return 'upstream_interrupted';
+  if (/^The answer ran past its output limit\b/i.test(text)) return 'output_limit_exceeded';
   if (NETWORK.test(text)) return 'studio-unreachable';
   return 'managed-request-failed';
 }

package/scripts/company-terminal.mjs

@@ -388,7 +388,8 @@ export function companyTerminalExtension({ managed, packageRoot, sdkRoot, bindin
       const session = managed()?.session;
       if (!session?.subscribe || heard === session) return;
       heard = session;
-      const showBranch = async () => { const branch = await branchOf(managed()?.cwd ?? ctx.cwd); ctx.ui?.setStatus?.('agent-watch-branch', branch ? `⎇ ${branch}` : undefined); };
+      // The conversation can close while git answers (a client ends right after a turn): its ctx is then stale.
+      const showBranch = async () => { try { const branch = await branchOf(managed()?.cwd ?? ctx.cwd); ctx.ui?.setStatus?.('agent-watch-branch', branch ? `⎇ ${branch}` : undefined); } catch { /* closed meanwhile */ } };
       ctx.ui?.setWorkingMessage?.(WORKING);
       void showBranch();
       session.subscribe((event) => {

package/scripts/piagent-studio.mjs

@@ -15,16 +15,17 @@ const digest = file => createHash('sha256').update(fs.readFileSync(file)).digest
 process.removeAllListeners('warning');
 process.on('warning', warning => { if (warning.name !== 'ExperimentalWarning') process.stderr.write(`${warning.name}: ${warning.message}\n`); });
 const args = process.argv.slice(2), flags = new Map();
-if (args.includes('--help')) { console.log('piagent studio [--web [--no-open] | --serve | --check | --doctor | --prompt <text> [--json]] [--config <Agent Watch configuration>] [--project <folder>]\nDefaults: the configuration imported into ~/.pi/agent and the current project. Personal sessions remain under pi / piagent dashboard.\n--json with --prompt writes the event stream of `pi --mode json` (JSONL on stdout; failures on stderr, exit 1).'); process.exit(0); }
+if (args.includes('--help')) { console.log('piagent studio [--web [--no-open] | --serve | --check | --doctor | --prompt <text> [--json] | --rpc] [--config <Agent Watch configuration>] [--project <folder>]\nDefaults: the configuration imported into ~/.pi/agent and the current project. Personal sessions remain under pi / piagent dashboard.\n--json with --prompt writes the event stream of `pi --mode json` (JSONL on stdout; failures on stderr, exit 1).\n--rpc speaks the protocol of `pi --mode rpc` on stdin/stdout for one company conversation (several messages, questions as extension UI requests).'); process.exit(0); }
 for (let i = 0; i < args.length; i++) {
-  if (['--check', '--doctor', '--web', '--serve', '--no-open', '--json'].includes(args[i])) { flags.set(args[i], true); continue; }
+  if (['--check', '--doctor', '--web', '--serve', '--no-open', '--json', '--rpc'].includes(args[i])) { flags.set(args[i], true); continue; }
   if (!['--config', '--project', '--prompt'].includes(args[i]) || flags.has(args[i]) || !args[i + 1]) throw Error('managed-launch-arguments');
   flags.set(args[i], args[++i]);
 }
 if (flags.has('--json') && !flags.has('--prompt')) throw Error('managed-launch-arguments');
+if (flags.has('--rpc') && ['--check', '--doctor', '--web', '--serve', '--prompt', '--json'].some((f) => flags.has(f))) throw Error('managed-launch-arguments');
 const home = os.homedir();
 // Joining Agent Watch takes a few seconds; keys typed before the Terminal draws are lost, so say so.
-if (!['--check', '--prompt', '--serve', '--doctor', '--web'].some((f) => flags.has(f)) && process.stderr.isTTY) process.stderr.write('Piagent công ty: đang kết nối Agent Watch, chờ ô nhập hiện ra rồi gõ…\n');
+if (!['--check', '--prompt', '--serve', '--doctor', '--web', '--rpc'].some((f) => flags.has(f)) && process.stderr.isTTY) process.stderr.write('Piagent công ty: đang kết nối Agent Watch, chờ ô nhập hiện ra rồi gõ…\n');
 // Do this before importing the SDK: it must not discover personal keys, Node
 // preload hooks, proxy overrides or provider endpoints from an ambient shell.
 const clean = { PATH: '/usr/bin:/bin', HOME: home, LANG: 'en_US.UTF-8', TERM: process.env.TERM || 'xterm-256color', ...interopEnvironment() };
@@ -182,6 +183,15 @@ try {
       const { failureLines } = await import('./company-terminal.mjs');
       process.stderr.write(`${failureLines(last.errorMessage) ?? String(last.errorMessage??'Agent Watch: the request failed [managed-request-failed]')}\n`);process.exitCode = 1;
     }
+  } else if (flags.has('--rpc')) {
+    // One company conversation driven by a client (a script, a test that
+    // plays the member) over Pi's RPC protocol. Pi exits the process when the
+    // client closes stdin, so the conversation, its broker and its lease are
+    // released inside Pi's own dispose instead of the finally below.
+    process.env.PI_OFFLINE = '1'; process.env.PI_SKIP_VERSION_CHECK = '1';
+    const dispose = host.dispose.bind(host);
+    host.dispose = async () => { try { await dispose(); } finally { await current?.dispose(); current = null; hold?.release(); } };
+    await api.runRpcMode(host);
   } else {
     // The company terminal runs the pinned Pi release: no "Run pi update" notice
     // (updating Pi breaks the Agent Watch import), no package-update, catalog or