@piagent/platform 1.39.0 → 1.41.0

package/packages/piagent-webui/dist/client/assets/{tab-close-ggR0dHlZ.js → tab-close-BoJRyBO_.js}

@@ -1 +1 @@
-import{D as e}from"./ui-preferences-BO3AV7QE.js";import{m as t}from"./Alert-DGWhP2MM.js";import{E as n}from"./index-BeBiJUDV.js";var r=e(),i=t((0,r.jsx)(`path`,{d:`M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z`}),`Close`);function a(e,t,a){let o=e=>{e.stopPropagation(),e.preventDefault(),a()};return(0,r.jsxs)(n,{component:`span`,sx:{display:`inline-flex`,alignItems:`center`,gap:.75},children:[(0,r.jsx)(`span`,{children:e}),(0,r.jsx)(n,{component:`span`,role:`button`,tabIndex:0,"aria-label":t,title:t,onClick:o,onMouseDown:e=>e.stopPropagation(),onKeyDown:e=>{(e.key===`Enter`||e.key===` `)&&o(e)},sx:{display:`inline-grid`,placeItems:`center`,width:18,height:18,borderRadius:`2px`,opacity:.7,"&:hover":{opacity:1,bgcolor:`action.hover`}},children:(0,r.jsx)(i,{sx:{fontSize:14}})})]})}export{i as n,a as t};
+import{D as e}from"./ui-preferences-BO3AV7QE.js";import{m as t}from"./Alert-DGWhP2MM.js";import{E as n}from"./index-rlyRccut.js";var r=e(),i=t((0,r.jsx)(`path`,{d:`M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z`}),`Close`);function a(e,t,a){let o=e=>{e.stopPropagation(),e.preventDefault(),a()};return(0,r.jsxs)(n,{component:`span`,sx:{display:`inline-flex`,alignItems:`center`,gap:.75},children:[(0,r.jsx)(`span`,{children:e}),(0,r.jsx)(n,{component:`span`,role:`button`,tabIndex:0,"aria-label":t,title:t,onClick:o,onMouseDown:e=>e.stopPropagation(),onKeyDown:e=>{(e.key===`Enter`||e.key===` `)&&o(e)},sx:{display:`inline-grid`,placeItems:`center`,width:18,height:18,borderRadius:`2px`,opacity:.7,"&:hover":{opacity:1,bgcolor:`action.hover`}},children:(0,r.jsx)(i,{sx:{fontSize:14}})})]})}export{i as n,a as t};

package/packages/piagent-webui/dist/client/index.html

@@ -7,7 +7,7 @@
     <meta name="csp-nonce" content="__PIAGENT_CSP_NONCE__" />
     <meta name="piagent-webui-mode" content="__PIAGENT_WEBUI_MODE__" />
     <title>Piagent WebUI</title>
-    <script type="module" crossorigin src="/assets/index-BeBiJUDV.js"></script>
+    <script type="module" crossorigin src="/assets/index-rlyRccut.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-hePW80VL.js">
     <link rel="modulepreload" crossorigin href="/assets/ui-preferences-BO3AV7QE.js">
     <link rel="modulepreload" crossorigin href="/assets/useId-DEefKUAT.js">
@@ -16,7 +16,7 @@
     <link rel="modulepreload" crossorigin href="/assets/DialogTitle-CyaFPaiW.js">
     <link rel="modulepreload" crossorigin href="/assets/Button-QItfZUNj.js">
     <link rel="modulepreload" crossorigin href="/assets/bootstrap-CedkNtRG.js">
-    <link rel="stylesheet" crossorigin href="/assets/index-Brs_HjIo.css">
+    <link rel="stylesheet" crossorigin href="/assets/index-DBUTrEXi.css">
   </head>
   <body>
     <div id="root"></div>

package/packages/piagent-webui/extension/piagent-webui.ts

@@ -155,6 +155,7 @@ function readMethod(provider: CoreInspectionProvider, queue: HeldMessageQueue, s
   if (method === "releaseMonitor" && args.length === 0) return provider.releaseMonitor();
   if (method === "documents" && args.length === 0) return provider.documents();
   if (method === "document" && args.length === 1 && typeof args[0] === "string" && REF.test(args[0])) return provider.document(args[0]);
+  if (method === "documentAsset" && args.length === 2 && typeof args[0] === "string" && REF.test(args[0]) && typeof args[1] === "string" && REF.test(args[1])) return provider.documentAsset(args[0], args[1]);
   if (method === "logPreview" && args.length === 1 && typeof args[0] === "string" && REF.test(args[0])) return provider.logPreview(args[0]);
   if (method === "transcript" && args.length === 2 && (args[0] === null || typeof args[0] === "string" && REF.test(args[0]))
     && Number.isInteger(args[1]) && Number(args[1]) >= 1 && Number(args[1]) <= 200) return provider.transcript(args[0] as string | null, Number(args[1]));

package/packages/piagent-webui/gateway/managed-projection.ts

@@ -36,10 +36,11 @@ export function managedProjection(context: any, entries: any[]) {
   const permission = chosen === 'bypass' ? (bypassAllowed ? 'bypass' : 'trusted-full-access') : chosen === 'trusted-full-access' ? 'trusted-full-access' : 'workspace-write';
   // Fast mode, only where the conversation's Harness allows it (fast-mode.mjs).
   const fast = last('agent-watch-fast');
-  // Repositories Studio says do not belong to the key's team (workspace-report.mjs).
-  const project = last('agent-watch-project'), kinds = ['other_team', 'unlisted'];
+  // Projects Studio says do not belong to the key's team (workspace-report.mjs);
+  // a local project carries its folder name.
+  const project = last('agent-watch-project'), kinds = ['other_team', 'unlisted', 'unregistered', 'no_repository'];
   const projectWarnings = Array.isArray(project?.warnings) ? project.warnings.filter((w: any) => kinds.includes(w?.kind) && typeof w.repo === 'string' && w.repo.trim())
-    .slice(0, 6).map((w: any) => ({ repo: w.repo.trim().slice(0, 200), kind: w.kind })) : [];
+    .slice(0, 6).map((w: any) => ({ repo: w.repo.trim().slice(0, 200), kind: w.kind, ...(typeof w.name === 'string' && w.name.trim() ? { name: w.name.trim().slice(0, 80) } : {}) })) : [];
   const projectWarning = projectWarnings.length ? { warnings: projectWarnings, ...(typeof project.team === 'string' && project.team.trim() ? { team: project.team.trim().slice(0, 80) } : {}) } : null;
   return {modelLabel:'agent-watch-auto', managedPermission: permission, ...(bypassAllowed ? {managedBypass: true as const} : {}), ...(fast?.allowed === true ? {managedFast: fast.enabled === true ? 'on' as const : 'off' as const} : {}), managedHelpers:{active:Number.isInteger(counter?.active) && counter.active>=0 && counter.active<=maximum ? counter.active : 0, maximum},
     ...(Array.isArray(capabilities)?{managedThinkingLevels:levels.filter(level=>capabilities.includes(level))}:{}),

package/packages/piagent-webui/server/core-inspection-provider.ts

@@ -246,6 +246,11 @@ export class CoreInspectionProvider implements WebUiReadModelProvider {
     return core.projectDocumentWorkspaceDocument({ ...this.#documentWorkspaceInput(core.matchesProtectedPath), documentRef });
   }
 
+  async documentAsset(documentRef: string, name: string): Promise<unknown> {
+    const core = await loadCoreInspection();
+    return core.projectDocumentWorkspaceAsset({ ...this.#documentWorkspaceInput(core.matchesProtectedPath), documentRef, name });
+  }
+
   #documentWorkspaceInput(matchesProtectedPath: (candidate: string, patterns: string[]) => unknown) {
     const protectedPaths = this.#input.protectedPaths?.() ?? [];
     return { cwd: this.#input.cwd, profileRoots: this.#input.documentReadRoots?.(),

package/packages/piagent-webui/server/ipc-read-model-client.ts

@@ -64,6 +64,7 @@ export class IpcReadModelClient implements WebUiReadModelProvider {
   releaseMonitor(): Promise<unknown> { return this.#request("releaseMonitor"); }
   documents(): Promise<unknown> { return this.#request("documents"); }
   document(documentRef: string): Promise<unknown> { return this.#request("document", [documentRef]); }
+  documentAsset(documentRef: string, name: string): Promise<unknown> { return this.#request("documentAsset", [documentRef, name]); }
   activity(): Promise<unknown> { return this.#request("activity"); }
   logPreview(activityRef: string): Promise<unknown> { return this.#request("logPreview", [activityRef]); }
   transcript(beforeCursor: string | null, limit: number): Promise<unknown> { return this.#request("transcript", [beforeCursor, limit]); }

package/packages/piagent-webui/server/read-model-provider.ts

@@ -27,6 +27,7 @@ export type WebUiReadModelProvider = {
   releaseMonitor(): unknown | Promise<unknown>;
   documents(): unknown | Promise<unknown>;
   document(documentRef: string): unknown | Promise<unknown>;
+  documentAsset?(documentRef: string, name: string): unknown | Promise<unknown>;
   activity(): unknown | Promise<unknown>;
   logPreview(activityRef: string): unknown | Promise<unknown>;
   transcript(beforeCursor: string | null, limit: number): unknown | Promise<unknown>;

package/packages/piagent-webui/server/read-only-router.ts

@@ -33,6 +33,12 @@ export async function routeReadOnlyRequest(url: URL, provider: WebUiReadModelPro
     return { handled: true, status: 200, value: await provider.subagentTree(ref) };
   }
   if (url.pathname === "/api/v1/documents" && !url.search) return { handled: true, status: 200, value: await provider.documents() };
+  const asset = /^\/api\/v1\/documents\/([^/]+)\/assets\/([^/]+)$/.exec(url.pathname);
+  if (asset) {
+    if (url.search || !OPAQUE_REF.test(asset[1]) || !OPAQUE_REF.test(asset[2])) return { handled: true, status: 400, value: { error: { code: "invalid-document-asset-ref" } } };
+    if (!provider.documentAsset) return { handled: true, status: 503, value: { error: { code: "document-asset-unavailable" } } };
+    return { handled: true, status: 200, value: await provider.documentAsset(asset[1], asset[2]) };
+  }
   if (url.pathname.startsWith("/api/v1/documents/")) {
     const ref = url.pathname.slice("/api/v1/documents/".length);
     if (url.search || !OPAQUE_REF.test(ref) || ref.includes("/")) return { handled: true, status: 400, value: { error: { code: "invalid-document-ref" } } };

package/packages/piagent-webui/shared/project-warning-copy.ts

@@ -1,16 +1,21 @@
 // The line a member reads when Studio says their company conversation works
-// in a repository that does not belong to the key's team
-// ("agent-watch-project"), in the dashboard and in the company Terminal.
+// in a project that does not belong to the key's team ("agent-watch-project"),
+// in the dashboard and in the company Terminal. A local project (no readable
+// remote) is named by its folder.
 import type { CopyLocale } from "./company-copy.ts";
 
-export type ProjectWarningItem = { repo: string; kind: "other_team" | "unlisted" };
+export type ProjectWarningItem = { repo: string; kind: "other_team" | "unlisted" | "unregistered" | "no_repository"; name?: string };
+
+const label = (item: ProjectWarningItem) => item.name ?? item.repo;
 
 export function projectWarningText(warnings: readonly ProjectWarningItem[], team: string | null | undefined, locale: CopyLocale): string {
-  const repos = warnings.map(item => item.repo).join(", "), name = team ? ` ${team}` : "";
-  if (warnings.some(item => item.kind === "other_team")) return locale === "vi"
-    ? `${repos} thuộc team khác, không phải team${name} của key này. Admin Studio đã được báo.`
-    : `${repos} belongs to another team, not this key's team${name}. Studio administrators were told.`;
-  return locale === "vi"
-    ? `${repos} chưa có trong danh sách repository của team${name}. Admin Studio đã được báo.`
-    : `${repos} is not in the repository list of team${name}. Studio administrators were told.`;
+  const vi = locale === "vi", name = team ? ` ${team}` : "", told = vi ? " Admin Studio đã được báo." : " Studio administrators were told.";
+  const of = (kind: ProjectWarningItem["kind"]) => warnings.filter(item => item.kind === kind).map(label).join(", ");
+  const parts: string[] = [];
+  const other = of("other_team"), unlisted = of("unlisted"), unregistered = of("unregistered"), none = of("no_repository");
+  if (other) parts.push(vi ? `${other} thuộc team khác, không phải team${name} của key này.` : `${other} belongs to another team, not this key's team${name}.`);
+  if (unlisted) parts.push(vi ? `${unlisted} chưa có trong danh sách project của team${name}.` : `${unlisted} is not in the project list of team${name}.`);
+  if (unregistered) parts.push(vi ? `${unregistered} chưa được đăng ký cho team${name}.` : `${unregistered} is not registered to team${name}.`);
+  if (none) parts.push(vi ? `Không xác định được project của thư mục ${none}.` : `The project of folder ${none} could not be identified.`);
+  return parts.join(" ") + told;
 }

package/schemas/piagent-webui/catalog-v1.json

@@ -182,6 +182,15 @@
       "supported": true,
       "current": true
     },
+    {
+      "name": "document-asset-v1",
+      "file": "document-asset-v1.schema.json",
+      "id": "https://piagent.io.vn/schemas/piagent-webui/document-asset-v1.schema.json",
+      "documentVersion": 1,
+      "role": "read-model",
+      "supported": true,
+      "current": true
+    },
     {
       "name": "control-command-v1",
       "file": "control-command-v1.schema.json",

package/schemas/piagent-webui/document-asset-v1.schema.json

@@ -0,0 +1,57 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://piagent.io.vn/schemas/piagent-webui/document-asset-v1.schema.json",
+  "title": "Piagent WebUI change report screenshot v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "version", "generatedAt", "documentRef", "name", "state", "mediaType", "sizeBytes", "base64", "reasonCode"],
+  "properties": {
+    "schemaVersion": { "const": 1 },
+    "version": { "const": "piagent-webui-document-asset-v1" },
+    "generatedAt": { "$ref": "common-v1.schema.json#/$defs/timestamp" },
+    "documentRef": { "$ref": "common-v1.schema.json#/$defs/opaqueRef" },
+    "name": {
+      "anyOf": [
+        { "type": "string", "minLength": 1, "maxLength": 128, "pattern": "^(before|after|diff)-[a-z0-9][a-z0-9-]{0,100}\\.png$" },
+        { "type": "null" }
+      ]
+    },
+    "state": { "enum": ["ready", "unavailable"] },
+    "mediaType": { "enum": ["image/png", null] },
+    "sizeBytes": {
+      "anyOf": [
+        { "type": "integer", "minimum": 8, "maximum": 8388608 },
+        { "type": "null" }
+      ]
+    },
+    "base64": {
+      "anyOf": [
+        { "type": "string", "minLength": 12, "maxLength": 11184812, "pattern": "^[A-Za-z0-9+/]+={0,2}$" },
+        { "type": "null" }
+      ]
+    },
+    "reasonCode": { "$ref": "common-v1.schema.json#/$defs/nullableReasonCode" }
+  },
+  "allOf": [
+    {
+      "if": { "properties": { "state": { "const": "ready" } }, "required": ["state"] },
+      "then": {
+        "properties": {
+          "name": { "type": "string" },
+          "mediaType": { "const": "image/png" },
+          "sizeBytes": { "type": "integer" },
+          "base64": { "type": "string" },
+          "reasonCode": { "type": "null" }
+        }
+      },
+      "else": {
+        "properties": {
+          "mediaType": { "type": "null" },
+          "sizeBytes": { "type": "null" },
+          "base64": { "type": "null" },
+          "reasonCode": { "$ref": "common-v1.schema.json#/$defs/reasonCode" }
+        }
+      }
+    }
+  ]
+}

package/schemas/piagent-webui/session-catalog-v1.schema.json

@@ -92,7 +92,7 @@
         "composerAvailable": { "type": "boolean" },
         "needsAttention": { "type": "boolean" },
         "managedHelpers": { "type": "object", "additionalProperties": false, "required": ["active", "maximum"], "properties": {"active": {"type": ["integer", "null"], "minimum": 0, "maximum": 4}, "maximum": {"type": "integer", "minimum": 0, "maximum": 4}} },
-        "managedThinkingLevels": {"type": "array", "uniqueItems": true, "maxItems": 7, "items": {"enum": ["off","minimal","low","medium","high","xhigh","max"]}}, "managedPermission": {"enum": ["workspace-write","trusted-full-access","bypass"]}, "managedBypass": {"const": true}, "managedProjectWarning": {"type": "object", "additionalProperties": false, "required": ["warnings"], "properties": {"team": {"type": "string", "minLength": 1, "maxLength": 80}, "warnings": {"type": "array", "minItems": 1, "maxItems": 6, "items": {"type": "object", "additionalProperties": false, "required": ["repo", "kind"], "properties": {"repo": {"type": "string", "minLength": 1, "maxLength": 200}, "kind": {"enum": ["other_team", "unlisted"]}}}}}}, "managedFast": {"enum": ["off","on"]},
+        "managedThinkingLevels": {"type": "array", "uniqueItems": true, "maxItems": 7, "items": {"enum": ["off","minimal","low","medium","high","xhigh","max"]}}, "managedPermission": {"enum": ["workspace-write","trusted-full-access","bypass"]}, "managedBypass": {"const": true}, "managedProjectWarning": {"type": "object", "additionalProperties": false, "required": ["warnings"], "properties": {"team": {"type": "string", "minLength": 1, "maxLength": 80}, "warnings": {"type": "array", "minItems": 1, "maxItems": 6, "items": {"type": "object", "additionalProperties": false, "required": ["repo", "kind"], "properties": {"repo": {"type": "string", "minLength": 1, "maxLength": 200}, "name": {"type": "string", "minLength": 1, "maxLength": 80}, "kind": {"enum": ["other_team", "unlisted", "unregistered", "no_repository"]}}}}}}, "managedFast": {"enum": ["off","on"]},
         "managedPlan": { "type": "object", "additionalProperties": false, "required": ["steps"], "properties": {
           "steps": { "type": "array", "minItems": 1, "maxItems": 30, "items": { "type": "object", "additionalProperties": false, "required": ["step", "status"], "properties": {
             "step": { "type": "string", "minLength": 1, "maxLength": 200 }, "status": { "enum": ["pending", "in_progress", "completed", "deferred"] } } } } } },

package/scripts/check-runtime-advisories.mjs

@@ -7,7 +7,11 @@
 // The only exceptions are listed in runtime-advisory-exceptions.json, each an
 // owner decision for one advisory at one package path in the tree, with a day
 // it stops applying. The same advisory anywhere else, any other advisory, and
-// an exception past its day all block. Its tests check every entry.
+// an exception past its day all block. Its tests check every entry. A package
+// flagged only because it depends on flagged packages (no advisory of its
+// own, `via` names packages) is carried: it passes when every package it
+// names is in the report with all of its advisories accepted, and blocks
+// otherwise.
 import fs from "node:fs";
 
 function readStdin() {
@@ -50,12 +54,14 @@ const { exceptions } = JSON.parse(fs.readFileSync(process.env.PIAGENT_ADVISORY_E
 // A test seam for the day exceptions are judged on; the gate uses today (UTC).
 const today = process.env.PIAGENT_ADVISORY_TODAY ?? new Date().toISOString().slice(0, 10);
 
-const blocking = [], accepted = [];
+const blocking = [], accepted = [], pending = [], carried = [];
 for (const [name, vulnerability] of Object.entries(report.vulnerabilities ?? {})) {
   if (!["moderate", "high", "critical"].includes(vulnerability.severity)) continue;
   const ids = advisoryIdsFor(vulnerability);
   if (ids.length === 0) {
-    blocking.push({ name, severity: vulnerability.severity, id: "(no advisory id)" });
+    const via = vulnerability.via ?? [];
+    if (via.length > 0 && via.every((item) => typeof item === "string")) pending.push({ name, severity: vulnerability.severity, via });
+    else blocking.push({ name, severity: vulnerability.severity, id: "(no advisory id)" });
     continue;
   }
   const nodes = Array.isArray(vulnerability.nodes) ? vulnerability.nodes : [];
@@ -67,10 +73,29 @@ for (const [name, vulnerability] of Object.entries(report.vulnerabilities ?? {})
   }
 }
 
+// Carried packages may chain (a via b via c): settle them until nothing changes;
+// whatever is left names a package that is not accepted.
+const cleared = new Set(accepted.map((entry) => entry.name).filter((name) => !blocking.some((entry) => entry.name === name)));
+for (let changed = true; changed;) {
+  changed = false;
+  for (const entry of [...pending]) {
+    if (!entry.via.every((name) => cleared.has(name))) continue;
+    pending.splice(pending.indexOf(entry), 1);
+    carried.push(entry);
+    cleared.add(entry.name);
+    changed = true;
+  }
+}
+for (const entry of pending) blocking.push({ name: entry.name, severity: entry.severity, id: `(no advisory id, through ${entry.via.join(", ")})` });
+
 for (const entry of accepted) {
   console.log(`ACCEPTED: ${entry.severity} advisory ${entry.id} in ${entry.name} at ${entry.exception.node} until ${entry.exception.until} (owner decision ${entry.exception.decided})`);
 }
 
+for (const entry of carried) {
+  console.log(`CARRIED: ${entry.severity} in ${entry.name} only through accepted advisories of ${entry.via.join(", ")}`);
+}
+
 const failures = blocking.map(
   (entry) => `${entry.severity} advisory ${entry.id} in ${entry.name} blocks the supported runtime`
     + (entry.expired ? ` (its exception ended ${entry.expired})` : "")

package/scripts/runtime-advisory-exceptions.json

@@ -1,4 +1,29 @@
 {
   "version": 1,
-  "exceptions": []
+  "exceptions": [
+    {
+      "id": "GHSA-xjj6-f33q-929c",
+      "package": "undici",
+      "node": "node_modules/undici",
+      "decided": "2026-10-24",
+      "until": "2026-11-07",
+      "reason": "Denial of service (an unhandled error crashes the process) when a response lists too many content-encodings; no data exposure. undici 8.10.2 is an exact dependency of every published Pi host (1.3.0 and 1.4.0), installed globally, so no Piagent change can update it; 8.12.2 fixes it. Remove when a Pi host carries undici >= 8.12.2."
+    },
+    {
+      "id": "GHSA-4qv8-2p9j-2685",
+      "package": "undici",
+      "node": "node_modules/undici",
+      "decided": "2026-10-24",
+      "until": "2026-11-07",
+      "reason": "Denial of service (unbounded memory) in undici's EventSource parser fed by a hostile server; no data exposure. Pinned by the Pi host as above; fixed in undici 8.12.2."
+    },
+    {
+      "id": "GHSA-f72v-6w45-q472",
+      "package": "undici",
+      "node": "node_modules/undici",
+      "decided": "2026-10-24",
+      "until": "2026-11-07",
+      "reason": "Subresource Integrity check bypassed with a non-lowercase algorithm token; Pi does not fetch with integrity metadata. Pinned by the Pi host as above; fixed in undici 8.12.2."
+    }
+  ]
 }