@piagent/platform 1.37.1 → 1.38.2

package/packages/piagent-core/extensions/workspace-write.ts

@@ -0,0 +1,116 @@
+import { createHash, randomBytes } from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { inspectWorkspaceEntry, readWorkspaceFile, WorkspaceReadError } from "../security/workspace-file-reader.ts";
+import { workspacePathFlags, type WorkspacePolicy } from "./workspace-inspection.ts";
+
+const MAX_BYTES = 1 << 20;
+const digest = (bytes: Buffer) => createHash("sha256").update(bytes).digest("hex");
+export class WorkspaceWriteError extends Error {
+  readonly code: "invalid-write" | "path-protected" | "read-only" | "stale-content" | "unsafe-path";
+  readonly currentDigest: string | null;
+  constructor(code: WorkspaceWriteError["code"], currentDigest: string | null = null) {
+    super(code); this.name = "WorkspaceWriteError"; this.code = code; this.currentDigest = currentDigest;
+  }
+}
+export type WorkspaceWriteInput = { path: string; content: string; expectedDigest: string; operation?: "write" | "rename" | "delete"; destination?: string };
+
+const validPath = (value: unknown): value is string => typeof value === "string" && !!value && value.length <= 4096
+  && !/[\\\x00-\x1f\x7f]/.test(value) && !path.isAbsolute(value) && !value.split("/").some(part => !part || part === "." || part === "..");
+function fileState(root: string, relative: string): { digest: string; mode: number; stat: fs.Stats | null } {
+  try {
+    const stat = inspectWorkspaceEntry(root, relative);
+    if (!stat.isFile() || stat.isSymbolicLink()) throw new WorkspaceWriteError("unsafe-path");
+    return { digest: digest(readWorkspaceFile(root, relative, MAX_BYTES)), mode: stat.mode & 0o777, stat };
+  } catch (error) {
+    // A new file gets the mode any editor would give it, not owner-only.
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return { digest: "absent", mode: 0o666 & ~process.umask(), stat: null };
+    throw error;
+  }
+}
+function allowed(relative: string, policy: WorkspacePolicy) {
+  const flags = workspacePathFlags(relative, policy);
+  if (flags.protected) throw new WorkspaceWriteError("path-protected");
+  if (flags.readOnly || (policy.readOnly === undefined && policy.profile.permissionProfile === "read-only")) throw new WorkspaceWriteError("read-only");
+}
+// The folder a file lives in; a new file's missing folders are made, one
+// checked segment at a time, never through a link.
+function folder(root: string, relative: string, create: boolean, policy: WorkspacePolicy) {
+  const segments = path.posix.dirname(relative) === "." ? [] : path.posix.dirname(relative).split("/");
+  for (let index = 1; index <= segments.length; index++) {
+    const partial = segments.slice(0, index).join("/");
+    if (create) { allowed(partial, policy); try { fs.mkdirSync(path.join(root, partial)); } catch (error) { if ((error as NodeJS.ErrnoException).code !== "EEXIST") throw error; } }
+    const stat = inspectWorkspaceEntry(root, partial);
+    if (!stat.isDirectory() || stat.isSymbolicLink()) throw new WorkspaceWriteError("unsafe-path");
+  }
+  const parent = path.join(root, ...segments), stat = fs.lstatSync(parent);
+  if (!stat.isDirectory() || fs.realpathSync(parent) !== parent) throw new WorkspaceWriteError("unsafe-path");
+  return { parent, stat };
+}
+const unchanged = (parent: string, before: fs.Stats) => {
+  const now = fs.lstatSync(parent);
+  if (now.dev !== before.dev || now.ino !== before.ino || fs.realpathSync(parent) !== parent) throw new WorkspaceWriteError("unsafe-path");
+};
+// Errors that refuse before anything changed are named, so the member sees
+// "refused" instead of "the result is uncertain".
+function definite(error: unknown): never {
+  if (error instanceof WorkspaceWriteError) throw error;
+  if (error instanceof WorkspaceReadError) throw new WorkspaceWriteError(error.code === "oversized" ? "invalid-write" : error.code === "changed-during-read" ? "stale-content" : "unsafe-path");
+  const code = (error as NodeJS.ErrnoException).code;
+  if (code === "ENOENT" || code === "ENOTDIR" || code === "EEXIST") throw new WorkspaceWriteError("stale-content");
+  throw error;
+}
+
+// Keep the final digest check and the rename/link synchronous, with no queued
+// callback between them. Member writes never update the agent's observed read
+// digest. A new file is linked into place, which fails rather than replace one
+// that appeared meanwhile; rename and delete apply to a file whose content the
+// member saw (its digest).
+export function writeWorkspaceFile(rootPath: string, input: WorkspaceWriteInput, policy: WorkspacePolicy) {
+  const operation = input?.operation ?? "write";
+  if (!input || !validPath(input.path) || !["write", "rename", "delete"].includes(operation)
+    || typeof input.content !== "string" || Buffer.byteLength(input.content) > MAX_BYTES
+    || (input.expectedDigest !== "absent" && !/^[a-f0-9]{64}$/.test(input.expectedDigest))
+    || (operation === "rename") !== (input.destination !== undefined) || operation === "rename" && (!validPath(input.destination) || input.destination === input.path)
+    || operation !== "write" && (input.content !== "" || input.expectedDigest === "absent")) throw new WorkspaceWriteError("invalid-write");
+  allowed(input.path, policy);
+  if (operation === "rename") allowed(input.destination!, policy);
+  const root = fs.realpathSync(rootPath);
+  try {
+    const source = folder(root, input.path, operation === "write" && input.expectedDigest === "absent", policy);
+    const before = fileState(root, input.path);
+    if (before.digest !== input.expectedDigest) throw new WorkspaceWriteError("stale-content", before.digest);
+    const recheck = () => {
+      unchanged(source.parent, source.stat);
+      const current = fileState(root, input.path);
+      if (current.digest !== before.digest || current.stat?.ino !== before.stat?.ino || current.stat?.dev !== before.stat?.dev)
+        throw new WorkspaceWriteError("stale-content", current.digest);
+    };
+    if (operation === "delete") {
+      recheck(); fs.unlinkSync(path.join(root, input.path));
+      return { path: input.path, digest: before.digest, previousDigest: before.digest, created: false, revision: `sha256:${before.digest}` };
+    }
+    if (operation === "rename") {
+      const target = folder(root, input.destination!, true, policy);
+      if (fileState(root, input.destination!).digest !== "absent") throw new WorkspaceWriteError("stale-content");
+      recheck(); unchanged(target.parent, target.stat);
+      fs.linkSync(path.join(root, input.path), path.join(root, input.destination!));
+      fs.unlinkSync(path.join(root, input.path));
+      return { path: input.path, digest: before.digest, previousDigest: before.digest, created: false, revision: `sha256:${before.digest}` };
+    }
+    const bytes = Buffer.from(input.content), nextDigest = digest(bytes), target = path.join(root, input.path);
+    const temporary = path.join(source.parent, `.piagent-write-${process.pid}-${randomBytes(12).toString("hex")}`);
+    let descriptor: number | undefined;
+    try {
+      descriptor = fs.openSync(temporary, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL | (fs.constants.O_NOFOLLOW ?? 0), 0o600);
+      fs.writeFileSync(descriptor, bytes); fs.fchmodSync(descriptor, before.mode); fs.fsyncSync(descriptor);
+      fs.closeSync(descriptor); descriptor = undefined;
+      recheck();
+      if (before.digest === "absent") fs.linkSync(temporary, target); else fs.renameSync(temporary, target);
+      return { path: input.path, digest: nextDigest, previousDigest: before.digest, created: before.digest === "absent", revision: `sha256:${nextDigest}` };
+    } finally {
+      if (descriptor !== undefined) fs.closeSync(descriptor);
+      fs.rmSync(temporary, { force: true });
+    }
+  } catch (error) { return definite(error); }
+}

package/packages/piagent-core/managed/background-process.mjs

@@ -53,15 +53,20 @@ export class BackgroundProcesses {
     entry.status = 'stopped'; entry.reason = reason; clearTimeout(entry.timer);
     // Its process group, what it started (found by parent, since ps cannot
     // read the environment of Apple's own binaries), then its marker.
-    const tree = descendants(entry.child.pid);
-    for (const pid of [-entry.child.pid, ...tree]) try { process.kill(pid, 'SIGTERM'); } catch { /* already gone */ }
-    await this.boundary.stopBackground(entry.key);
-    for (const pid of tree) try { process.kill(pid, 'SIGKILL'); } catch { /* stopped */ }
+    await stopProcessGroup(entry.child, () => this.boundary.stopBackground(entry.key));
     return entry;
   }
   async dispose() { await Promise.all(this.running().map(entry => this.stop(entry.id, 'the conversation closed'))); }
 }
 
+export async function stopProcessGroup(child, stopMarked = () => new Promise(resolve => setTimeout(resolve, 100))) {
+  if (!Number.isInteger(child.pid) || child.pid <= 1 || child.exitCode != null || child.signalCode != null) return;
+  const tree = descendants(child.pid);
+  for (const pid of [-child.pid, ...tree]) try { process.kill(pid, 'SIGTERM'); } catch { /* already gone */ }
+  await stopMarked();
+  for (const pid of [...tree, -child.pid]) try { process.kill(pid, 'SIGKILL'); } catch { /* stopped */ }
+}
+
 function descendants(root) {
   let rows = [];
   try { rows = execFileSync('/bin/ps', ['-axo', 'pid=,ppid='], { encoding: 'utf8', timeout: 5000 }).trim().split('\n').map(row => row.trim().split(/\s+/).map(Number)); } catch { return []; }

package/packages/piagent-core/managed/boundary-package-proxy.mjs

@@ -0,0 +1,21 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { randomUUID } from 'node:crypto';
+import { DEFAULT_DOMAINS, PackageProxy, mavenSettings, memberDomains } from './package-proxy.mjs';
+
+export async function startBoundaryPackageProxy(boundary, apply) {
+  boundary.proxy = new PackageProxy({ domains: [...DEFAULT_DOMAINS, ...memberDomains(boundary.userHome)] });
+  try {
+    let url;
+    if (boundary.linux) {
+      boundary.proxySocket = path.join(os.tmpdir(), `piagent-proxy-${randomUUID().slice(0, 8)}.sock`);
+      await boundary.proxy.listen(boundary.proxySocket);
+      url = 'http://127.0.0.1:3128';
+    } else url = `http://127.0.0.1:${(await boundary.proxy.listen()).port}`;
+    const settings = path.join(boundary.home, '.m2/settings.xml');
+    fs.mkdirSync(path.dirname(settings), { recursive: true, mode: 0o700 });
+    fs.writeFileSync(settings, mavenSettings(url), { mode: 0o600 });
+    boundary.proxyUrl = url; apply();
+  } catch { await boundary.proxy.close().catch(() => {}); boundary.proxy = null; }
+}

package/packages/piagent-core/managed/boundary-queue.mjs

@@ -0,0 +1,24 @@
+// One queue spans the agent's reads and every change, the member's included,
+// so two concurrent edits observe a deterministic order. What the member's
+// explorer, editor and review panels only read does not wait behind the
+// agent's running command: a few run beside it, a few more wait for them, and
+// beyond that they are refused (the panels retry).
+const LIMIT = 3, WAITING = 16;
+const memberRead = (name, args) => name === 'workspace' && (['tree', 'file', 'paths', 'search', 'write-state'].includes(args?.kind)
+  || args?.kind === 'source' && ['sources', 'diff', 'preview'].includes(args.request?.kind));
+export class BoundaryQueue {
+  #tail = Promise.resolve();
+  #reads = 0;
+  #waiting = [];
+  run(name, args, action) {
+    if (!memberRead(name, args)) { const run = this.#tail.then(action); this.#tail = run.catch(() => {}); return run; }
+    if (this.#reads < LIMIT) return this.#read(action);
+    if (this.#waiting.length >= WAITING) return Promise.reject(new Error('managed-workspace-busy'));
+    return new Promise(resolve => this.#waiting.push(resolve)).then(() => this.#read(action));
+  }
+  #read(action) {
+    this.#reads++;
+    return Promise.resolve().then(action).finally(() => { this.#reads--; this.#waiting.shift()?.(); });
+  }
+  idle() { return this.#tail; }
+}

package/packages/piagent-core/managed/checkpoint-git.mjs

@@ -0,0 +1,16 @@
+// This adapter contains no host Git/filesystem access. The pinned workspace
+// worker applies path policy and byte-preserving Git operations in the sandbox.
+export class BoundaryCheckpointGit {
+  constructor(managed) { this.managed = managed; }
+  request(operation, payload = {}, guard) {
+    guard?.();
+    return this.managed.boundary.invoke('workspace', { kind: 'checkpoint', operation, ...payload },
+      undefined, undefined, undefined, { guard });
+  }
+  available() { return this.request('available'); }
+  tree() { return this.request('tree'); }
+  changed(from, to) { return this.request('changed', { from, to }); }
+  restore(before, restore, remove, expectedTree, guard) {
+    return this.request('restore', { before, restore, remove, expectedTree }, guard);
+  }
+}

package/packages/piagent-core/managed/checkpoints.mjs

@@ -1,69 +1,22 @@
-// Turn checkpoints and /undo for company conversations in a git repository.
-// Before a run first changes files, the working tree (tracked and untracked,
-// .gitignore honoured) is written as a git tree through a private index; when
-// the run ends, the tree after it. /undo puts back the files the last turn
-// changed, and refuses when one of them changed again since (the member's own
-// edit is never overwritten). The member's index, HEAD and commits are not
-// touched: a commit made in the turn stays. The private index is copied with
-// its time kept, so git still re-reads a file changed within the same second
-// at the same size. Commands run in the command sandbox.
-const SNAPSHOT = `set -e; git rev-parse --is-inside-work-tree >/dev/null 2>&1 || { echo NOREPO; exit 0; }
-top=$(git rev-parse --show-toplevel); cd "$top"; idx="$TMPDIR/piagent-checkpoint-$$"
-real=$(git rev-parse --git-path index); if [ -f "$real" ]; then cp -p "$real" "$idx"; fi
-GIT_INDEX_FILE="$idx" git add -A >/dev/null 2>&1; tree=$(GIT_INDEX_FILE="$idx" git write-tree); rm -f "$idx"; echo "TREE $tree"`;
-const b64 = list => Buffer.from(list.map(p => p + '\0').join(''), 'utf8').toString('base64');
+import { BoundaryCheckpointGit } from './checkpoint-git.mjs';
+import { TurnCheckpointService } from '../runtime/checkpoints/turn-checkpoints.mjs';
+import { workspaceMemberEditsSince } from '../runtime/session/workspace-member-edits.mjs';
 
-export class TurnCheckpoints {
-  #stack = [];
-  constructor(managed) { this.managed = managed; }
-  async #bash(command) {
-    const result = await this.managed.boundary.invoke('bash', { command, timeout: 120 });
-    return (result.content ?? []).map(part => part.text ?? '').join('');
+// Keep the company API and sandbox execution while sharing checkpoint behavior.
+export class TurnCheckpoints extends TurnCheckpointService {
+  constructor(managed) {
+    super(new BoundaryCheckpointGit(managed), { busy: () => managed.activePrompt,
+      memberEdits: since => workspaceMemberEditsSince(managed.session?.sessionManager, since) });
+    this.managed = managed;
   }
-  async #tree() {
-    const out = await this.#bash(SNAPSHOT);
-    return out.match(/^TREE ([0-9a-f]{40,64})$/m)?.[1] ?? null;
-  }
-  // Before the first change of a run; once per run.
-  async take(run = this.managed.run) {
-    if (!run || run.checkpoint !== undefined) return;
-    run.checkpoint = null;
-    try { const before = await this.#tree(); if (before) { run.checkpoint = { before, after: null, at: Date.now() }; } } catch { /* no checkpoint: /undo says so */ }
-  }
-  // When the run ends: the tree after it, kept when the run changed something.
-  async finish(run = this.managed.run) {
-    const point = run?.checkpoint;
-    if (!point) return;
-    try { point.after = await this.#tree(); } catch { return; }
-    if (point.after && point.after !== point.before) this.#stack.push(point);
-  }
-  async #changed(from, to) {
-    const out = await this.#bash(`top=$(git rev-parse --show-toplevel) && cd "$top" && git diff --no-renames --name-status -z ${from} ${to}`);
-    const parts = out.split('\0').filter(Boolean), files = [];
-    for (let i = 0; i + 1 < parts.length; i += 2) files.push({ status: parts[i].trim(), path: parts[i + 1] });
-    return files;
-  }
-  // Puts back what the last turn changed: { result, restored, removed, files }
-  // for the WebUI note (phase "undo") and `text`, the sentence for the member.
-  async undo() {
-    const answer = (undo, text) => ({ ...undo, text });
-    if (this.managed.activePrompt) return answer({ result: 'busy', restored: 0, removed: 0, files: [] }, 'Đang có một lượt chạy: chờ nó xong (hoặc dừng nó) rồi /undo.');
-    const point = this.#stack.at(-1);
-    if (!point) return answer({ result: 'none', restored: 0, removed: 0, files: [] }, 'Không có lượt nào để hoàn tác trong cuộc trò chuyện này (chỉ áp dụng cho project là git repository; checkpoint có từ khi mở cuộc trò chuyện).');
-    const now = await this.#tree();
-    if (!now) return answer({ result: 'failed', restored: 0, removed: 0, files: [] }, 'Không đọc được trạng thái hiện tại của project; không hoàn tác.');
-    const turn = await this.#changed(point.before, point.after), since = new Set((await this.#changed(point.after, now)).map(f => f.path));
-    const touched = turn.filter(f => since.has(f.path)).map(f => f.path);
-    if (touched.length) return answer({ result: 'refused', restored: 0, removed: 0, files: touched.slice(0, 5) },
-      `Không hoàn tác: ${touched.length} file lượt trước đã sửa lại thay đổi sau đó (${touched.slice(0, 5).join(', ')}${touched.length > 5 ? ', …' : ''}). Hoàn tác sẽ ghi đè thay đổi đó.`);
-    const restore = turn.filter(f => f.status !== 'A').map(f => f.path), remove = turn.filter(f => f.status === 'A').map(f => f.path);
-    const steps = ['set -e', 'top=$(git rev-parse --show-toplevel); cd "$top"; idx="$TMPDIR/piagent-undo-$$"'];
-    if (restore.length) steps.push(`GIT_INDEX_FILE="$idx" git read-tree ${point.before}`, `printf %s ${b64(restore)} | base64 --decode | GIT_INDEX_FILE="$idx" git checkout-index -f -z --stdin`, 'rm -f "$idx"');
-    if (remove.length) steps.push(`printf %s ${b64(remove)} | base64 --decode | xargs -0 rm -f --`);
-    await this.#bash(steps.join('\n'));
-    this.#stack.pop();
-    return answer({ result: 'done', restored: restore.length, removed: remove.length, files: [...restore, ...remove].slice(0, 5), more: this.#stack.length > 0 },
-      `Đã hoàn tác lượt trước: ${restore.length} file trả về như trước lượt đó, ${remove.length} file lượt đó tạo đã xoá.${this.#stack.length ? ' /undo lần nữa để hoàn tác lượt trước nữa.' : ''} Commit tạo trong lượt đó (nếu có) vẫn giữ nguyên.`);
+  take(run = this.managed.run) {
+    if (run && !run.turnRef) {
+      const branch = this.managed.session?.sessionManager?.getBranch?.() ?? [];
+      const entry = [...branch].reverse().find(entry => entry.type === 'message' && entry.message?.role === 'user');
+      if (entry?.id) run.turnRef = entry.id;
+    }
+    return super.take(run);
   }
+  finish(run = this.managed.run) { return super.finish(run); }
 }
 export const checkpointsOf = managed => (managed.checkpoints ??= new TurnCheckpoints(managed));

package/packages/piagent-core/managed/command-tools.mjs

@@ -1,5 +1,5 @@
 import { spawn } from 'node:child_process';
-import { networkConfirmation } from './permission.mjs';
+import { asksNothing, broadAccess, networkConfirmation } from './permission.mjs';
 import { engineAlive, engineLauncher } from './container-engine.mjs';
 import { MEMBER_ONLY, memberOnlyReason, runHostCommand } from './host-command.mjs';
 import { processTools } from './background-process.mjs';
@@ -34,9 +34,9 @@ const KINDS = {
     description: 'Run one shell command on the member\'s machine, outside the sandbox, as the member, after they approve that exact command. Use it when the sandbox blocks what the task needs and no other tool covers it: install a runtime or tool the project needs (brew install openjdk@21, brew install node@22, sdk install java…), git pull or git push with the member\'s sign-in, a private registry, a file outside the project. It has the member\'s files, Keychain and sign-ins, so ask only for what the task needs and say why in reason. No input can be typed: commands that need the member\'s password (sudo, a .pkg installer) or an interactive sign-in are refused; ask the member with ask_user for those.',
     allow: 'Run this exact command once on this machine, outside the sandbox, as you: it can read and change your files and use your sign-ins.',
     title: 'Chạy lệnh trên máy (ngoài sandbox)', allowText: 'chạy đúng lệnh này một lần trên máy bạn, ngoài sandbox, bằng quyền của bạn: lệnh đọc/sửa được file và dùng được tài khoản đã đăng nhập trên máy.',
-    // Bypass does not cover it: the member approves each command (with what
-    // Bypass would still have asked about, when there is something).
-    confirm: async (self, command) => await networkConfirmation(self, command) ?? 'ask',
+    // Full access does not cover it: the member approves each command (with
+    // what Full access would still have asked about). Bypass asks nothing.
+    confirm: async (self, command) => asksNothing(self) ? null : await networkConfirmation(self, command) ?? 'ask',
   },
 };
 
@@ -66,7 +66,7 @@ function commandTool(self, kind) {
       if (memberOnly) throw Error(MEMBER_ONLY(memberOnly));
       const confirm = await spec.confirm(self, args.command);
       if (confirm !== null) await approve(self, id, signal, ctx, { toolName: spec.name, rawAction: { command: args.command }, commandPreview: String(args.command),
-        provider: spec.provider, requestedScope: spec.scope, reason: (confirm === 'ask' ? String(args.reason) : `Bypass still asks: ${confirm}. ${args.reason}`).slice(0, 300), riskClass: spec.riskClass,
+        provider: spec.provider, requestedScope: spec.scope, reason: (confirm === 'ask' ? String(args.reason) : `Full access still asks: ${confirm}. ${args.reason}`).slice(0, 300), riskClass: spec.riskClass,
         allowConsequence: spec.allow, denyConsequence: 'The command does not run; the agent is told you declined.' },
       { title: spec.title, body: `${args.command}\n\nLý do: ${args.reason}${confirm === 'ask' ? '' : `\nBypass vẫn hỏi: ${confirm}`}\n\nĐồng ý: ${spec.allowText}\nTừ chối: lệnh không chạy, agent được báo bạn đã từ chối.` });
       let ok = false;
@@ -97,7 +97,7 @@ function startDockerTool(self, { wait = 180_000, every = 2000, launcher: found =
       if (!launcher) throw Error(self.boundary.dockerCli ? MEMBER_ONLY("starting this machine's Docker service needs the member's password")
         : 'managed-docker-not-installed: Máy chưa cài Docker. Hỏi member bằng ask_user: cài Docker Desktop hoặc OrbStack (trình cài cần mật khẩu nên member tự cài; máy có Homebrew thì có thể xin run_on_host "brew install colima docker"), hay chạy check theo cách khác.');
       const preview = `${launcher.command} ${launcher.args.join(' ')}`;
-      if (self.permission !== 'trusted-full-access') await approve(self, id, signal, ctx, { toolName: 'start_docker', rawAction: { launcher: launcher.label }, commandPreview: preview,
+      if (!broadAccess(self)) await approve(self, id, signal, ctx, { toolName: 'start_docker', rawAction: { launcher: launcher.label }, commandPreview: preview,
         provider: 'docker', requestedScope: 'start-docker-once', reason: String(args.reason).slice(0, 300), riskClass: 'medium',
         allowConsequence: `Start ${launcher.label} on this machine; it keeps running after the conversation.`, denyConsequence: 'Docker is not started; the agent is told you declined.' },
       { title: `Mở ${launcher.label}`, body: `${preview}\n\nLý do: ${args.reason}\n\nĐồng ý: mở ${launcher.label} trên máy; nó vẫn chạy sau cuộc trò chuyện.\nTừ chối: không mở Docker, agent được báo bạn đã từ chối.` });

package/packages/piagent-core/managed/continuation.mjs

@@ -1,4 +1,5 @@
 import { checkpointsOf } from './checkpoints.mjs';
+import { takeWorkspaceMemberEditNotice } from '../runtime/session/workspace-member-edits.mjs';
 import { unfinished, planText, currentPlan, workflowPolicy } from './workflow.mjs';
 import { failureCode } from '../runtime/managed-failure.mjs';
 import { providerResumeMessage, resumeMessage } from './studio-link.mjs';
@@ -87,6 +88,8 @@ const fresh = (self, manager, text) => {
 };
 
 export async function memberTurn(self, { manager, prompt, runRound }, text, deliver) {
+  const notice = takeWorkspaceMemberEditNotice(manager);
+  if (notice) await self.session.sendCustomMessage(notice, { triggerTurn: false });
   // /undo from the WebUI (the Terminal has its own command): the last turn's
   // files go back, said in a note, with no model request (checkpoints.mjs).
   if (/^\s*\/undo\s*$/.test(text)) {

package/packages/piagent-core/managed/dist/workspace/assets/adapters/backend-api/profile.json

@@ -0,0 +1,88 @@
+{
+  "schemaVersion": 1,
+  "projectId": "backend-api-project",
+  "displayName": "Backend API Project",
+  "mode": "backend-api",
+  "permissionProfile": "workspace-write",
+  "rootMarkers": [
+    "AGENTS.md",
+    "README.md",
+    "package.json",
+    "pom.xml",
+    "build.gradle",
+    "build.gradle.kts",
+    "pyproject.toml"
+  ],
+  "protectedPaths": [
+    ".git/**",
+    "**/auth.json",
+    "**/.env",
+    "**/.env.*",
+    "**/*.pem",
+    "**/*.key",
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/target/**",
+    "**/.gradle/**",
+    "**/coverage/**"
+  ],
+  "requiredContext": [
+    "AGENTS.md",
+    ".pi/project-context.md",
+    "README.md"
+  ],
+  "taskModes": {
+    "readOnly": {
+      "tools": [
+        "read",
+        "grep",
+        "find",
+        "ls"
+      ]
+    },
+    "sourceWrite": {
+      "requiresPlan": true,
+      "requiresVerify": true
+    },
+    "migrationOrSchema": {
+      "requiresPlan": true,
+      "requiresVerify": true,
+      "requiresHumanGate": true
+    }
+  },
+  "verifyCommands": {
+    "docsOnly": [
+      "test -s README.md"
+    ],
+    "source": [
+      "if test -f package.json; then node -e \"const s=require('./package.json').scripts||{}; const n=['type-check','typecheck','lint','test']; if(!n.some(k=>s[k])){console.error('No backend Node verifier is configured');process.exit(2)}\" && npm run type-check --if-present && npm run typecheck --if-present && npm run lint --if-present && npm test --if-present; elif test -x ./mvnw; then ./mvnw test; elif test -x ./gradlew; then ./gradlew test; elif test -f pyproject.toml && command -v uv >/dev/null 2>&1; then uv run pytest; elif test -f pyproject.toml; then python -m pytest; else echo 'No backend verify command configured; update .pi/piagent-profile.json' >&2; exit 2; fi"
+    ]
+  },
+  "mcpCapabilities": [
+    "filesystem-readonly",
+    "filesystem-write",
+    "shell",
+    "github",
+    "database-readonly",
+    "memory"
+  ],
+  "memory": {
+    "enabled": true,
+    "mode": "manual",
+    "scope": "project",
+    "summaryFile": ".pi/memory/memory_summary.md",
+    "handbookFile": ".pi/memory/MEMORY.md",
+    "localDir": ".pi/memory/local",
+    "readBeforeTask": true,
+    "writePolicy": "explicit-only",
+    "maxInjectedChars": 4000,
+    "externalPackages": []
+  },
+  "runtimePolicy": {
+    "execPolicy": "enforce",
+    "contextBudget": "enforce",
+    "toolRegistry": "advisory",
+    "finalGate": "enforce"
+  }
+}

package/packages/piagent-core/managed/dist/workspace/assets/adapters/be-readonly-fe/profile.json

@@ -0,0 +1,130 @@
+{
+  "schemaVersion": 1,
+  "projectId": "be-readonly-fe-project",
+  "displayName": "Backend Readonly / Frontend Write Project",
+  "mode": "be-readonly-fe",
+  "permissionProfile": "workspace-write",
+  "rootMarkers": [
+    "AGENTS.md",
+    "README.md",
+    "package.json",
+    "frontend",
+    "backend",
+    "apps",
+    "packages"
+  ],
+  "protectedPaths": [
+    ".git/**",
+    "**/auth.json",
+    "**/.env",
+    "**/.env.*",
+    "**/*.pem",
+    "**/*.key",
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**",
+    "**/coverage/**"
+  ],
+  "readOnlyPaths": [
+    "backend/**",
+    "*backend*/**",
+    "server/**",
+    "api/**",
+    "apps/api/**",
+    "apps/server/**",
+    "apps/backend/**",
+    "packages/api/**",
+    "packages/server/**",
+    "packages/backend/**",
+    "services/*/**",
+    "**/migrations/**"
+  ],
+  "shellProtectedPaths": [
+    ".git/**",
+    "**/auth.json",
+    "**/.env",
+    "**/.env.*",
+    "**/*.pem",
+    "**/*.key",
+    "backend/**",
+    "*backend*/**",
+    "server/**",
+    "api/**",
+    "apps/api/**",
+    "apps/server/**",
+    "apps/backend/**",
+    "packages/api/**",
+    "packages/server/**",
+    "packages/backend/**",
+    "services/*/**",
+    "**/migrations/**",
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**",
+    "**/coverage/**"
+  ],
+  "requiredContext": [
+    "AGENTS.md",
+    ".pi/project-context.md",
+    "README.md"
+  ],
+  "taskModes": {
+    "backendScout": {
+      "readOnly": true,
+      "tools": [
+        "read",
+        "grep",
+        "find",
+        "ls"
+      ]
+    },
+    "frontendSourceWrite": {
+      "requiresPlan": true,
+      "requiresContractSnapshot": true,
+      "requiresVerify": true
+    },
+    "backendContractGap": {
+      "requiresReport": true,
+      "backendWriteAllowed": false
+    }
+  },
+  "verifyCommands": {
+    "docsOnly": [
+      "test -s README.md"
+    ],
+    "frontendSource": [
+      "if test -f frontend/package.json; then cd frontend; elif test -f apps/web/package.json; then cd apps/web; elif test -f apps/frontend/package.json; then cd apps/frontend; elif test -f packages/web/package.json; then cd packages/web; elif test -f packages/frontend/package.json; then cd packages/frontend; elif test -f client/package.json; then cd client; elif test -f package.json; then :; else echo 'No frontend verify command configured; update .pi/piagent-profile.json' >&2; exit 2; fi; node -e \"const s=require('./package.json').scripts||{}; const n=['type-check','typecheck','lint','test']; if(!n.some(k=>s[k])){console.error('No frontend source verifier is configured');process.exit(2)}\" && npm run type-check --if-present && npm run typecheck --if-present && npm run lint --if-present && npm test --if-present"
+    ],
+    "frontendRuntime": [
+      "if test -f frontend/package.json; then cd frontend; elif test -f apps/web/package.json; then cd apps/web; elif test -f apps/frontend/package.json; then cd apps/frontend; elif test -f packages/web/package.json; then cd packages/web; elif test -f packages/frontend/package.json; then cd packages/frontend; elif test -f client/package.json; then cd client; elif test -f package.json; then :; else echo 'No frontend runtime verify command configured; update .pi/piagent-profile.json' >&2; exit 2; fi; node -e \"const s=require('./package.json').scripts||{}; if(!s['test:e2e']){console.error('No frontend runtime verifier is configured');process.exit(2)}\" && npm run test:e2e"
+    ]
+  },
+  "mcpCapabilities": [
+    "filesystem-readonly",
+    "filesystem-write",
+    "shell",
+    "github",
+    "browser",
+    "memory"
+  ],
+  "memory": {
+    "enabled": true,
+    "mode": "manual",
+    "scope": "project",
+    "summaryFile": ".pi/memory/memory_summary.md",
+    "handbookFile": ".pi/memory/MEMORY.md",
+    "localDir": ".pi/memory/local",
+    "readBeforeTask": true,
+    "writePolicy": "explicit-only",
+    "maxInjectedChars": 4000,
+    "externalPackages": []
+  },
+  "runtimePolicy": {
+    "execPolicy": "enforce",
+    "contextBudget": "enforce",
+    "toolRegistry": "advisory",
+    "finalGate": "enforce"
+  }
+}