@piagent/platform 1.38.2 → 1.40.0

package/packages/piagent-webui/dist/client/assets/{tab-close-nAxrK7Lq.js → tab-close-CqPDs-w5.js}

@@ -1 +1 @@
-import{D as e}from"./ui-preferences-BO3AV7QE.js";import{m as t}from"./Alert-DGWhP2MM.js";import{E as n}from"./index-a-perpOX.js";var r=e(),i=t((0,r.jsx)(`path`,{d:`M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z`}),`Close`);function a(e,t,a){let o=e=>{e.stopPropagation(),e.preventDefault(),a()};return(0,r.jsxs)(n,{component:`span`,sx:{display:`inline-flex`,alignItems:`center`,gap:.75},children:[(0,r.jsx)(`span`,{children:e}),(0,r.jsx)(n,{component:`span`,role:`button`,tabIndex:0,"aria-label":t,title:t,onClick:o,onMouseDown:e=>e.stopPropagation(),onKeyDown:e=>{(e.key===`Enter`||e.key===` `)&&o(e)},sx:{display:`inline-grid`,placeItems:`center`,width:18,height:18,borderRadius:`2px`,opacity:.7,"&:hover":{opacity:1,bgcolor:`action.hover`}},children:(0,r.jsx)(i,{sx:{fontSize:14}})})]})}export{i as n,a as t};
+import{D as e}from"./ui-preferences-BO3AV7QE.js";import{m as t}from"./Alert-DGWhP2MM.js";import{E as n}from"./index-BgJgso6j.js";var r=e(),i=t((0,r.jsx)(`path`,{d:`M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z`}),`Close`);function a(e,t,a){let o=e=>{e.stopPropagation(),e.preventDefault(),a()};return(0,r.jsxs)(n,{component:`span`,sx:{display:`inline-flex`,alignItems:`center`,gap:.75},children:[(0,r.jsx)(`span`,{children:e}),(0,r.jsx)(n,{component:`span`,role:`button`,tabIndex:0,"aria-label":t,title:t,onClick:o,onMouseDown:e=>e.stopPropagation(),onKeyDown:e=>{(e.key===`Enter`||e.key===` `)&&o(e)},sx:{display:`inline-grid`,placeItems:`center`,width:18,height:18,borderRadius:`2px`,opacity:.7,"&:hover":{opacity:1,bgcolor:`action.hover`}},children:(0,r.jsx)(i,{sx:{fontSize:14}})})]})}export{i as n,a as t};

package/packages/piagent-webui/dist/client/index.html

@@ -7,7 +7,7 @@
     <meta name="csp-nonce" content="__PIAGENT_CSP_NONCE__" />
     <meta name="piagent-webui-mode" content="__PIAGENT_WEBUI_MODE__" />
     <title>Piagent WebUI</title>
-    <script type="module" crossorigin src="/assets/index-a-perpOX.js"></script>
+    <script type="module" crossorigin src="/assets/index-BgJgso6j.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-hePW80VL.js">
     <link rel="modulepreload" crossorigin href="/assets/ui-preferences-BO3AV7QE.js">
     <link rel="modulepreload" crossorigin href="/assets/useId-DEefKUAT.js">

package/packages/piagent-webui/gateway/gateway-service.ts

@@ -54,6 +54,7 @@ import { ProviderAuthBroker } from "./provider-auth-broker.ts";
 import { McpAuthBroker } from "./mcp-auth-broker.ts";
 import { AgentStatusFiles } from "./agent-status-files.ts";
 import type { ScopedBrokerRouter, RuntimeFactory } from "./session-runtime-factory.ts";
+import { UiPreferencesStore } from "./ui-preferences-store.ts";
 
 function unavailable(reasonCode: string) {
   return { status: "unavailable" as const, version: null, reasonCode };
@@ -292,7 +293,9 @@ export async function startPiagentGateway(options: {
     const sourceReverts = options.managed ? new ManagedSourceRevertSessions({ root: state.root, key, gatewayInstanceRef, runtimes,
       managedSource: options.managed.managedSource, changed: sessionRef => events.publish("session.changed", { sessionRef }) }) : new SourceRevertSessions({ root: state.root, key, runtimes, managed: !!options.managed,
       provider: sessionRef => inspections.provider(sessionRef), changed: sessionRef => events.publish("session.changed", { sessionRef }) });
+    const uiPreferences = new UiPreferencesStore(state.root);
     loopback = await startLoopbackServer({
+      uiPreferences: { read: () => uiPreferences.read(), write: value => uiPreferences.write(value) },
       checkpoints: {
         state: sessionRef => company(sessionRef) ? relay!.json("GET", `/api/v1/sessions/${encodeURIComponent(sessionRef)}/checkpoints`) : checkpoints.state(sessionRef),
         preview: (sessionRef, target) => company(sessionRef) ? relay!.json("GET", `/api/v1/sessions/${encodeURIComponent(sessionRef)}/checkpoints/${encodeURIComponent(target)}`) : checkpoints.preview(sessionRef, target),

package/packages/piagent-webui/gateway/managed-projection.ts

@@ -36,7 +36,13 @@ export function managedProjection(context: any, entries: any[]) {
   const permission = chosen === 'bypass' ? (bypassAllowed ? 'bypass' : 'trusted-full-access') : chosen === 'trusted-full-access' ? 'trusted-full-access' : 'workspace-write';
   // Fast mode, only where the conversation's Harness allows it (fast-mode.mjs).
   const fast = last('agent-watch-fast');
+  // Projects Studio says do not belong to the key's team (workspace-report.mjs);
+  // a local project carries its folder name.
+  const project = last('agent-watch-project'), kinds = ['other_team', 'unlisted', 'unregistered', 'no_repository'];
+  const projectWarnings = Array.isArray(project?.warnings) ? project.warnings.filter((w: any) => kinds.includes(w?.kind) && typeof w.repo === 'string' && w.repo.trim())
+    .slice(0, 6).map((w: any) => ({ repo: w.repo.trim().slice(0, 200), kind: w.kind, ...(typeof w.name === 'string' && w.name.trim() ? { name: w.name.trim().slice(0, 80) } : {}) })) : [];
+  const projectWarning = projectWarnings.length ? { warnings: projectWarnings, ...(typeof project.team === 'string' && project.team.trim() ? { team: project.team.trim().slice(0, 80) } : {}) } : null;
   return {modelLabel:'agent-watch-auto', managedPermission: permission, ...(bypassAllowed ? {managedBypass: true as const} : {}), ...(fast?.allowed === true ? {managedFast: fast.enabled === true ? 'on' as const : 'off' as const} : {}), managedHelpers:{active:Number.isInteger(counter?.active) && counter.active>=0 && counter.active<=maximum ? counter.active : 0, maximum},
     ...(Array.isArray(capabilities)?{managedThinkingLevels:levels.filter(level=>capabilities.includes(level))}:{}),
-    ...(steps ? {managedPlan:{steps}} : {}), ...(process ? {managedProcess:process} : {}), ...(turnEnd ? {managedTurnEnd:turnEnd} : {}), ...(review ? {managedReview:review} : {})};
+    ...(steps ? {managedPlan:{steps}} : {}), ...(process ? {managedProcess:process} : {}), ...(turnEnd ? {managedTurnEnd:turnEnd} : {}), ...(review ? {managedReview:review} : {}), ...(projectWarning ? {managedProjectWarning:projectWarning} : {})};
 }

package/packages/piagent-webui/gateway/session-catalog.ts

@@ -49,7 +49,7 @@ function catalogRef(key: Buffer, namespace: string, value: string): string {
 }
 
 export type SessionOwnerProjection = Pick<SessionRow, "state" | "liveState" | "composerAvailable" | "needsAttention" | "owner" | "reasonCode">;
-export type SessionOptionProjection = Pick<SessionRow, "modelLabel" | "thinkingLevel" | "managedHelpers" | "managedThinkingLevels" | "managedPermission" | "managedBypass" | "managedFast" | "managedPlan" | "managedProcess" | "managedTurnEnd" | "managedReview">;
+export type SessionOptionProjection = Pick<SessionRow, "modelLabel" | "thinkingLevel" | "managedHelpers" | "managedThinkingLevels" | "managedPermission" | "managedBypass" | "managedFast" | "managedPlan" | "managedProcess" | "managedTurnEnd" | "managedReview" | "managedProjectWarning">;
 
 function display(value: unknown, maximum: number, fallback: string): string {
   const clean = redactSensitiveText(String(value ?? "")).text
@@ -141,6 +141,7 @@ function row(key: Buffer, info: PiSessionInfo, metadata: SessionMetadata | undef
     ...(sessionOptions?.managedProcess ? {managedProcess:sessionOptions.managedProcess} : {}),
     ...(sessionOptions?.managedTurnEnd ? {managedTurnEnd:sessionOptions.managedTurnEnd} : {}),
     ...(sessionOptions?.managedReview ? {managedReview:sessionOptions.managedReview} : {}),
+    ...(sessionOptions?.managedProjectWarning ? {managedProjectWarning:sessionOptions.managedProjectWarning} : {}),
     modelLabel: sessionOptions?.modelLabel ?? null,
     thinkingLevel: sessionOptions?.thinkingLevel ?? "unknown",
     contextUsage: { usedTokens: null, contextWindow: null, ratio: null, state: "unknown" },
@@ -149,7 +150,7 @@ function row(key: Buffer, info: PiSessionInfo, metadata: SessionMetadata | undef
       ? { kind: "none", ownerEpoch: null, gatewayInstanceRef: null, runtimeInstanceRef: null, continuity: "released" }
       : ownership?.owner ?? { kind: "none", ownerEpoch: null, gatewayInstanceRef: null, runtimeInstanceRef: null, continuity: "unknown" },
     sessionRevision: revision(key, [info.path, info.modified.toISOString(), info.messageCount, info.name ?? null, metadata?.revision ?? null,
-      sessionOptions?.modelLabel ?? null, sessionOptions?.thinkingLevel ?? "unknown", sessionOptions?.managedHelpers, sessionOptions?.managedThinkingLevels, sessionOptions?.managedPermission ?? null, sessionOptions?.managedBypass ?? null, sessionOptions?.managedFast ?? null, sessionOptions?.managedPlan, sessionOptions?.managedProcess, sessionOptions?.managedTurnEnd, sessionOptions?.managedReview,
+      sessionOptions?.modelLabel ?? null, sessionOptions?.thinkingLevel ?? "unknown", sessionOptions?.managedHelpers, sessionOptions?.managedThinkingLevels, sessionOptions?.managedPermission ?? null, sessionOptions?.managedBypass ?? null, sessionOptions?.managedFast ?? null, sessionOptions?.managedPlan, sessionOptions?.managedProcess, sessionOptions?.managedTurnEnd, sessionOptions?.managedReview, sessionOptions?.managedProjectWarning,
       gitBranch, gitRepositories,
       metadata?.archived ? "archived" : ownership ? [ownership.state, ownership.liveState, ownership.owner.kind,
         ownership.owner.ownerEpoch, ownership.owner.runtimeInstanceRef, ownership.reasonCode] : "offline"]),

package/packages/piagent-webui/gateway/ui-preferences-store.ts

@@ -0,0 +1,45 @@
+import fs from "node:fs";
+import path from "node:path";
+import { randomBytes } from "node:crypto";
+
+// The dashboard's language and colour theme, kept by the Gateway so they
+// survive a restart: the browser's own storage belongs to one origin, and the
+// dashboard's port changes each time it starts.
+export type UiPreferences = { locale?: "vi" | "en"; themeId?: string };
+const MAX_BYTES = 4096, THEME = /^[a-z0-9][a-z0-9-]{0,39}$/;
+
+function valid(value: unknown): UiPreferences | null {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const { locale, themeId, ...rest } = value as Record<string, unknown>;
+  if (Object.keys(rest).length) return null;
+  if (locale !== undefined && locale !== "vi" && locale !== "en") return null;
+  if (themeId !== undefined && (typeof themeId !== "string" || !THEME.test(themeId))) return null;
+  return { ...(locale ? { locale: locale as "vi" | "en" } : {}), ...(themeId ? { themeId: themeId as string } : {}) };
+}
+
+export class UiPreferencesStore {
+  readonly file: string;
+  #root: string;
+  constructor(root: string) { this.#root = root; this.file = path.join(root, "ui-preferences.json"); }
+
+  read(): UiPreferences {
+    try {
+      const stat = fs.lstatSync(this.file);
+      if (!stat.isFile() || stat.size > MAX_BYTES) return {};
+      return valid(JSON.parse(fs.readFileSync(this.file, "utf8"))) ?? {};
+    } catch { return {}; }
+  }
+
+  // Merges what the browser sent; anything else is refused unchanged.
+  write(value: unknown): UiPreferences {
+    const change = valid(value);
+    if (!change) throw new Error("preferences-invalid");
+    const next = { ...this.read(), ...change };
+    const temporary = path.join(this.#root, `.ui-preferences-${process.pid}-${randomBytes(8).toString("hex")}.tmp`);
+    const descriptor = fs.openSync(temporary, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL, 0o600);
+    try { fs.writeFileSync(descriptor, `${JSON.stringify(next)}\n`); fs.fsyncSync(descriptor); }
+    finally { fs.closeSync(descriptor); }
+    fs.renameSync(temporary, this.file);
+    return next;
+  }
+}

package/packages/piagent-webui/server/loopback-server.ts

@@ -3,7 +3,7 @@ import http, { type ServerResponse } from "node:http";
 import { randomBytes } from "node:crypto";
 
 import { errorResponse, applySecurityHeaders, jsonResponse, requestBody } from "./http-security.ts";
-import { routeMemberRequest, type UpdateRoutes } from "./member-routes.ts";
+import { routeMemberRequest, type UiPreferenceRoutes, type UpdateRoutes } from "./member-routes.ts";
 import { routeWorkspaceWrite, type WorkspaceWriteRoutes } from "./workspace-write-routes.ts";
 import { routeCheckpoint, type CheckpointRoutes } from "./checkpoint-routes.ts";
 import { ReadModelNotFound, type WebUiReadModelProvider } from "./read-model-provider.ts";
@@ -81,6 +81,7 @@ export async function startLoopbackServer(options: {
   listBranches?: (projectRef: string, repository: string | null) => unknown | Promise<unknown>;
   switchBranch?: (projectRef: string, request: unknown) => unknown | Promise<unknown>;
   updates?: UpdateRoutes;
+  uiPreferences?: UiPreferenceRoutes;
   bootstrapTtlMs?: number;
   sessionTtlMs?: number;
   // Requests a minute from one address before it has a browser session (the

package/packages/piagent-webui/server/member-routes.ts

@@ -23,6 +23,9 @@ export type UpdateRoutes = {
   apply(request: unknown): unknown | Promise<unknown>;
 };
 
+// The dashboard's language and theme, kept across restarts (the Gateway only).
+export type UiPreferenceRoutes = { read(): unknown | Promise<unknown>; write(value: unknown): unknown | Promise<unknown> };
+
 type Context = {
   request: IncomingMessage; response: ServerResponse; url: URL; origin: string; requestOrigin: string | undefined;
   auth: SessionAuthority; now: number; consumeControl(sessionId: string, now: number): boolean;
@@ -40,6 +43,7 @@ type Options = {
   listBranches?: (projectRef: string, repository: string | null) => unknown | Promise<unknown>;
   switchBranch?: (projectRef: string, request: unknown) => unknown | Promise<unknown>;
   updates?: UpdateRoutes;
+  uiPreferences?: UiPreferenceRoutes;
 };
 
 // The checks every change shares; a refusal is answered here and false returned.
@@ -137,6 +141,22 @@ export async function routeMemberRequest(context: Context, options: Options): Pr
     return true;
   }
 
+  if (options.uiPreferences && url.pathname === "/api/v1/preferences") {
+    const store = options.uiPreferences;
+    if (request.method === "GET") {
+      if (!auth.authenticate(request)) { errorResponse(response, 401, "authentication-required"); return true; }
+      try { jsonResponse(response, 200, await store.read()); } catch { errorResponse(response, 503, "preferences-unavailable"); }
+      return true;
+    }
+    if (request.method !== "POST") { errorResponse(response, 405, "method-not-allowed"); return true; }
+    if (!authorizeChange(context)) return true;
+    const body = await jsonBody(context, "preferences-invalid");
+    if (!body.ok) return true;
+    try { jsonResponse(response, 200, await store.write(body.value)); }
+    catch (error) { const invalid = error instanceof Error && error.message === "preferences-invalid"; errorResponse(response, invalid ? 400 : 503, invalid ? "preferences-invalid" : "preferences-unavailable"); }
+    return true;
+  }
+
   if (!options.updates || !url.pathname.startsWith("/api/v1/updates")) return false;
   const updates = options.updates;
   if (request.method === "GET" && url.pathname === "/api/v1/updates") {

package/packages/piagent-webui/shared/project-warning-copy.ts

@@ -0,0 +1,21 @@
+// The line a member reads when Studio says their company conversation works
+// in a project that does not belong to the key's team ("agent-watch-project"),
+// in the dashboard and in the company Terminal. A local project (no readable
+// remote) is named by its folder.
+import type { CopyLocale } from "./company-copy.ts";
+
+export type ProjectWarningItem = { repo: string; kind: "other_team" | "unlisted" | "unregistered" | "no_repository"; name?: string };
+
+const label = (item: ProjectWarningItem) => item.name ?? item.repo;
+
+export function projectWarningText(warnings: readonly ProjectWarningItem[], team: string | null | undefined, locale: CopyLocale): string {
+  const vi = locale === "vi", name = team ? ` ${team}` : "", told = vi ? " Admin Studio đã được báo." : " Studio administrators were told.";
+  const of = (kind: ProjectWarningItem["kind"]) => warnings.filter(item => item.kind === kind).map(label).join(", ");
+  const parts: string[] = [];
+  const other = of("other_team"), unlisted = of("unlisted"), unregistered = of("unregistered"), none = of("no_repository");
+  if (other) parts.push(vi ? `${other} thuộc team khác, không phải team${name} của key này.` : `${other} belongs to another team, not this key's team${name}.`);
+  if (unlisted) parts.push(vi ? `${unlisted} chưa có trong danh sách project của team${name}.` : `${unlisted} is not in the project list of team${name}.`);
+  if (unregistered) parts.push(vi ? `${unregistered} chưa được đăng ký cho team${name}.` : `${unregistered} is not registered to team${name}.`);
+  if (none) parts.push(vi ? `Không xác định được project của thư mục ${none}.` : `The project of folder ${none} could not be identified.`);
+  return parts.join(" ") + told;
+}

package/schemas/piagent-webui/session-catalog-v1.schema.json

@@ -92,7 +92,7 @@
         "composerAvailable": { "type": "boolean" },
         "needsAttention": { "type": "boolean" },
         "managedHelpers": { "type": "object", "additionalProperties": false, "required": ["active", "maximum"], "properties": {"active": {"type": ["integer", "null"], "minimum": 0, "maximum": 4}, "maximum": {"type": "integer", "minimum": 0, "maximum": 4}} },
-        "managedThinkingLevels": {"type": "array", "uniqueItems": true, "maxItems": 7, "items": {"enum": ["off","minimal","low","medium","high","xhigh","max"]}}, "managedPermission": {"enum": ["workspace-write","trusted-full-access","bypass"]}, "managedBypass": {"const": true}, "managedFast": {"enum": ["off","on"]},
+        "managedThinkingLevels": {"type": "array", "uniqueItems": true, "maxItems": 7, "items": {"enum": ["off","minimal","low","medium","high","xhigh","max"]}}, "managedPermission": {"enum": ["workspace-write","trusted-full-access","bypass"]}, "managedBypass": {"const": true}, "managedProjectWarning": {"type": "object", "additionalProperties": false, "required": ["warnings"], "properties": {"team": {"type": "string", "minLength": 1, "maxLength": 80}, "warnings": {"type": "array", "minItems": 1, "maxItems": 6, "items": {"type": "object", "additionalProperties": false, "required": ["repo", "kind"], "properties": {"repo": {"type": "string", "minLength": 1, "maxLength": 200}, "name": {"type": "string", "minLength": 1, "maxLength": 80}, "kind": {"enum": ["other_team", "unlisted", "unregistered", "no_repository"]}}}}}}, "managedFast": {"enum": ["off","on"]},
         "managedPlan": { "type": "object", "additionalProperties": false, "required": ["steps"], "properties": {
           "steps": { "type": "array", "minItems": 1, "maxItems": 30, "items": { "type": "object", "additionalProperties": false, "required": ["step", "status"], "properties": {
             "step": { "type": "string", "minLength": 1, "maxLength": 200 }, "status": { "enum": ["pending", "in_progress", "completed", "deferred"] } } } } } },

package/scripts/check-runtime-advisories.mjs

@@ -7,7 +7,11 @@
 // The only exceptions are listed in runtime-advisory-exceptions.json, each an
 // owner decision for one advisory at one package path in the tree, with a day
 // it stops applying. The same advisory anywhere else, any other advisory, and
-// an exception past its day all block. Its tests check every entry.
+// an exception past its day all block. Its tests check every entry. A package
+// flagged only because it depends on flagged packages (no advisory of its
+// own, `via` names packages) is carried: it passes when every package it
+// names is in the report with all of its advisories accepted, and blocks
+// otherwise.
 import fs from "node:fs";
 
 function readStdin() {
@@ -50,12 +54,14 @@ const { exceptions } = JSON.parse(fs.readFileSync(process.env.PIAGENT_ADVISORY_E
 // A test seam for the day exceptions are judged on; the gate uses today (UTC).
 const today = process.env.PIAGENT_ADVISORY_TODAY ?? new Date().toISOString().slice(0, 10);
 
-const blocking = [], accepted = [];
+const blocking = [], accepted = [], pending = [], carried = [];
 for (const [name, vulnerability] of Object.entries(report.vulnerabilities ?? {})) {
   if (!["moderate", "high", "critical"].includes(vulnerability.severity)) continue;
   const ids = advisoryIdsFor(vulnerability);
   if (ids.length === 0) {
-    blocking.push({ name, severity: vulnerability.severity, id: "(no advisory id)" });
+    const via = vulnerability.via ?? [];
+    if (via.length > 0 && via.every((item) => typeof item === "string")) pending.push({ name, severity: vulnerability.severity, via });
+    else blocking.push({ name, severity: vulnerability.severity, id: "(no advisory id)" });
     continue;
   }
   const nodes = Array.isArray(vulnerability.nodes) ? vulnerability.nodes : [];
@@ -67,10 +73,29 @@ for (const [name, vulnerability] of Object.entries(report.vulnerabilities ?? {})
   }
 }
 
+// Carried packages may chain (a via b via c): settle them until nothing changes;
+// whatever is left names a package that is not accepted.
+const cleared = new Set(accepted.map((entry) => entry.name).filter((name) => !blocking.some((entry) => entry.name === name)));
+for (let changed = true; changed;) {
+  changed = false;
+  for (const entry of [...pending]) {
+    if (!entry.via.every((name) => cleared.has(name))) continue;
+    pending.splice(pending.indexOf(entry), 1);
+    carried.push(entry);
+    cleared.add(entry.name);
+    changed = true;
+  }
+}
+for (const entry of pending) blocking.push({ name: entry.name, severity: entry.severity, id: `(no advisory id, through ${entry.via.join(", ")})` });
+
 for (const entry of accepted) {
   console.log(`ACCEPTED: ${entry.severity} advisory ${entry.id} in ${entry.name} at ${entry.exception.node} until ${entry.exception.until} (owner decision ${entry.exception.decided})`);
 }
 
+for (const entry of carried) {
+  console.log(`CARRIED: ${entry.severity} in ${entry.name} only through accepted advisories of ${entry.via.join(", ")}`);
+}
+
 const failures = blocking.map(
   (entry) => `${entry.severity} advisory ${entry.id} in ${entry.name} blocks the supported runtime`
     + (entry.expired ? ` (its exception ended ${entry.expired})` : "")

package/scripts/company-terminal.mjs

@@ -16,6 +16,7 @@ import { memoryOn } from '../packages/piagent-core/managed/memory.mjs';
 import { companyFailureText } from '../packages/piagent-webui/shared/company-copy.ts';
 import { headlineText, outcomeText, processItems } from '../packages/piagent-webui/shared/process-copy.ts';
 import { turnEndCopy, turnEndOf } from '../packages/piagent-webui/shared/turn-end.ts';
+import { projectWarningText } from '../packages/piagent-webui/shared/project-warning-copy.ts';
 
 const LOCALE = 'vi';
 
@@ -399,6 +400,7 @@ export function companyTerminalExtension({ managed, packageRoot, sdkRoot, bindin
       void showBranch();
       session.subscribe((event) => {
         if (event?.type === 'managed_helpers') ctx.ui?.setStatus?.('agent-watch-helpers', event.active ? `Subagent ${event.active}/${event.maximum}` : undefined);
+        if (event?.type === 'managed_project_warning') ctx.ui?.notify?.(projectWarningText(event.warnings, event.team, LOCALE), 'warning');
         const end = event?.type === 'managed_turn_end' ? turnEndOf(event.end) : null;
         if (!end) return;
         const copy = turnEndCopy(end, LOCALE), stats = turnStats(session.messages);

package/scripts/runtime-advisory-exceptions.json

@@ -1,4 +1,29 @@
 {
   "version": 1,
-  "exceptions": []
+  "exceptions": [
+    {
+      "id": "GHSA-xjj6-f33q-929c",
+      "package": "undici",
+      "node": "node_modules/undici",
+      "decided": "2026-10-24",
+      "until": "2026-11-07",
+      "reason": "Denial of service (an unhandled error crashes the process) when a response lists too many content-encodings; no data exposure. undici 8.10.2 is an exact dependency of every published Pi host (1.3.0 and 1.4.0), installed globally, so no Piagent change can update it; 8.12.2 fixes it. Remove when a Pi host carries undici >= 8.12.2."
+    },
+    {
+      "id": "GHSA-4qv8-2p9j-2685",
+      "package": "undici",
+      "node": "node_modules/undici",
+      "decided": "2026-10-24",
+      "until": "2026-11-07",
+      "reason": "Denial of service (unbounded memory) in undici's EventSource parser fed by a hostile server; no data exposure. Pinned by the Pi host as above; fixed in undici 8.12.2."
+    },
+    {
+      "id": "GHSA-f72v-6w45-q472",
+      "package": "undici",
+      "node": "node_modules/undici",
+      "decided": "2026-10-24",
+      "until": "2026-11-07",
+      "reason": "Subresource Integrity check bypassed with a non-lowercase algorithm token; Pi does not fetch with integrity metadata. Pinned by the Pi host as above; fixed in undici 8.12.2."
+    }
+  ]
 }