@piagent/platform 1.43.9 → 1.44.1

package/packages/piagent-core/themes/piagent-focus.json

@@ -0,0 +1,78 @@
+{
+	"$schema": "https://pi.dev/schemas/theme.schema.json",
+	"name": "piagent-focus",
+	"appearance": "dark",
+	"vars": {
+		"text": "okhsl(60 4% 88%)",
+		"muted": "okhsl(60 3% 64%)",
+		"violet": "okhsl(70 80% 70%)",
+		"blue": "okhsl(60 10% 78%)",
+		"green": "okhsl(140 30% 66%)",
+		"red": "okhsl(25 60% 66%)",
+		"yellow": "okhsl(70 80% 70%)",
+		"blueBg": "okhsl(60 6% 22%)"
+	},
+	"colors": {
+		"accent": "violet",
+		"border": "okhsl(231 14% 65%)",
+		"borderAccent": "okhsl(295 13% 64%)",
+		"borderMuted": "okhsl(229 2% 53%)",
+		"success": "green",
+		"error": "red",
+		"warning": "yellow",
+		"muted": "muted",
+		"dim": "okhsl(229 2% 56%)",
+		"text": "text",
+		"thinkingText": "okhsl(226 2% 65%)",
+		"selectedBg": "blueBg",
+		"scrollbarTrack": "okhsl(237 2% 33%)",
+		"scrollbarThumb": "okhsl(232 2% 65%)",
+		"searchMatchBg": "okhsl(53 13% 24%)",
+		"searchMatchText": "muted",
+		"userMessageBg": "blueBg",
+		"userMessageText": "text",
+		"customMessageBg": "okhsl(295 10% 24%)",
+		"customMessageText": "muted",
+		"customMessageLabel": "violet",
+		"toolPendingBg": "okhsl(229 1% 24%)",
+		"toolSuccessBg": "okhsl(158 12% 25%)",
+		"toolErrorBg": "okhsl(19 14% 25%)",
+		"toolTitle": "text",
+		"toolOutput": "muted",
+		"mdHeading": "yellow",
+		"mdLink": "blue",
+		"mdLinkUrl": "muted",
+		"mdCode": "violet",
+		"mdCodeBlock": "green",
+		"mdCodeBlockBorder": "muted",
+		"mdQuote": "muted",
+		"mdQuoteBorder": "muted",
+		"mdHr": "muted",
+		"mdListBullet": "violet",
+		"toolDiffAdded": "green",
+		"toolDiffRemoved": "red",
+		"toolDiffContext": "muted",
+		"syntaxComment": "muted",
+		"syntaxKeyword": "blue",
+		"syntaxFunction": "yellow",
+		"syntaxVariable": "okhsl(202 14% 67%)",
+		"syntaxString": "okhsl(52 17% 67%)",
+		"syntaxNumber": "green",
+		"syntaxType": "violet",
+		"syntaxOperator": "muted",
+		"syntaxPunctuation": "muted",
+		"thinkingOff": "okhsl(229 2% 49%)",
+		"thinkingMinimal": "okhsl(232 5% 52%)",
+		"thinkingLow": "okhsl(232 11% 54%)",
+		"thinkingMedium": "okhsl(263 15% 56%)",
+		"thinkingHigh": "okhsl(295 18% 59%)",
+		"thinkingXhigh": "okhsl(337 20% 61%)",
+		"thinkingMax": "okhsl(20 25% 63%)",
+		"bashMode": "okhsl(159 16% 65%)"
+	},
+	"export": {
+		"pageBg": "okhsl(262 4% 16%)",
+		"cardBg": "okhsl(264 3% 19%)",
+		"infoBg": "okhsl(53 13% 24%)"
+	}
+}

package/packages/piagent-core/themes/piagent-ocean.json

@@ -0,0 +1,78 @@
+{
+	"$schema": "https://pi.dev/schemas/theme.schema.json",
+	"name": "piagent-ocean",
+	"appearance": "dark",
+	"vars": {
+		"text": "okhsl(200 8% 90%)",
+		"muted": "okhsl(200 10% 68%)",
+		"violet": "okhsl(185 70% 68%)",
+		"blue": "okhsl(215 70% 70%)",
+		"green": "okhsl(150 60% 68%)",
+		"red": "okhsl(15 75% 68%)",
+		"yellow": "okhsl(75 85% 70%)",
+		"blueBg": "okhsl(205 45% 22%)"
+	},
+	"colors": {
+		"accent": "violet",
+		"border": "okhsl(191 51% 65%)",
+		"borderAccent": "okhsl(255 48% 64%)",
+		"borderMuted": "okhsl(189 7% 53%)",
+		"success": "green",
+		"error": "red",
+		"warning": "yellow",
+		"muted": "muted",
+		"dim": "okhsl(189 7% 56%)",
+		"text": "text",
+		"thinkingText": "okhsl(186 6% 65%)",
+		"selectedBg": "blueBg",
+		"scrollbarTrack": "okhsl(197 6% 33%)",
+		"scrollbarThumb": "okhsl(192 6% 65%)",
+		"searchMatchBg": "okhsl(13 46% 24%)",
+		"searchMatchText": "muted",
+		"userMessageBg": "blueBg",
+		"userMessageText": "text",
+		"customMessageBg": "okhsl(255 38% 24%)",
+		"customMessageText": "muted",
+		"customMessageLabel": "violet",
+		"toolPendingBg": "okhsl(189 4% 24%)",
+		"toolSuccessBg": "okhsl(118 41% 25%)",
+		"toolErrorBg": "okhsl(339 49% 25%)",
+		"toolTitle": "text",
+		"toolOutput": "muted",
+		"mdHeading": "yellow",
+		"mdLink": "blue",
+		"mdLinkUrl": "muted",
+		"mdCode": "violet",
+		"mdCodeBlock": "green",
+		"mdCodeBlockBorder": "muted",
+		"mdQuote": "muted",
+		"mdQuoteBorder": "muted",
+		"mdHr": "muted",
+		"mdListBullet": "violet",
+		"toolDiffAdded": "green",
+		"toolDiffRemoved": "red",
+		"toolDiffContext": "muted",
+		"syntaxComment": "muted",
+		"syntaxKeyword": "blue",
+		"syntaxFunction": "yellow",
+		"syntaxVariable": "okhsl(162 52% 67%)",
+		"syntaxString": "okhsl(12 60% 67%)",
+		"syntaxNumber": "green",
+		"syntaxType": "violet",
+		"syntaxOperator": "muted",
+		"syntaxPunctuation": "muted",
+		"thinkingOff": "okhsl(189 7% 49%)",
+		"thinkingMinimal": "okhsl(192 18% 52%)",
+		"thinkingLow": "okhsl(192 40% 54%)",
+		"thinkingMedium": "okhsl(223 53% 56%)",
+		"thinkingHigh": "okhsl(255 66% 59%)",
+		"thinkingXhigh": "okhsl(297 73% 61%)",
+		"thinkingMax": "okhsl(340 89% 63%)",
+		"bashMode": "okhsl(119 58% 65%)"
+	},
+	"export": {
+		"pageBg": "okhsl(222 13% 16%)",
+		"cardBg": "okhsl(224 12% 19%)",
+		"infoBg": "okhsl(13 46% 24%)"
+	}
+}

package/packages/piagent-core/themes/piagent-paper.json

@@ -0,0 +1,78 @@
+{
+	"$schema": "https://pi.dev/schemas/theme.schema.json",
+	"name": "piagent-paper",
+	"appearance": "light",
+	"vars": {
+		"text": "okhsl(40 10% 22%)",
+		"muted": "okhsl(40 8% 44%)",
+		"violet": "okhsl(330 55% 42%)",
+		"blue": "okhsl(225 65% 42%)",
+		"green": "okhsl(150 70% 36%)",
+		"red": "okhsl(25 85% 44%)",
+		"yellow": "okhsl(70 95% 40%)",
+		"blueBg": "okhsl(50 30% 90%)"
+	},
+	"colors": {
+		"accent": "violet",
+		"border": "okhsl(231 60% 55%)",
+		"borderAccent": "okhsl(295 53% 55%)",
+		"borderMuted": "okhsl(235 6% 66%)",
+		"success": "green",
+		"error": "red",
+		"warning": "yellow",
+		"muted": "muted",
+		"dim": "okhsl(229 6% 59%)",
+		"text": "text",
+		"thinkingText": "okhsl(234 7% 55%)",
+		"selectedBg": "blueBg",
+		"scrollbarTrack": "okhsl(248 3% 90%)",
+		"scrollbarThumb": "okhsl(226 6% 65%)",
+		"searchMatchBg": "okhsl(56 20% 91%)",
+		"searchMatchText": "muted",
+		"userMessageBg": "blueBg",
+		"userMessageText": "text",
+		"customMessageBg": "okhsl(295 22% 91%)",
+		"customMessageText": "muted",
+		"customMessageLabel": "violet",
+		"toolPendingBg": "okhsl(248 3% 91%)",
+		"toolSuccessBg": "okhsl(156 19% 91%)",
+		"toolErrorBg": "okhsl(24 21% 91%)",
+		"toolTitle": "text",
+		"toolOutput": "muted",
+		"mdHeading": "yellow",
+		"mdLink": "blue",
+		"mdLinkUrl": "muted",
+		"mdCode": "violet",
+		"mdCodeBlock": "green",
+		"mdCodeBlockBorder": "muted",
+		"mdQuote": "muted",
+		"mdQuoteBorder": "muted",
+		"mdHr": "muted",
+		"mdListBullet": "violet",
+		"toolDiffAdded": "green",
+		"toolDiffRemoved": "red",
+		"toolDiffContext": "muted",
+		"syntaxComment": "muted",
+		"syntaxKeyword": "blue",
+		"syntaxFunction": "yellow",
+		"syntaxVariable": "okhsl(203 66% 46%)",
+		"syntaxString": "okhsl(52 76% 46%)",
+		"syntaxNumber": "green",
+		"syntaxType": "violet",
+		"syntaxOperator": "muted",
+		"syntaxPunctuation": "muted",
+		"thinkingOff": "okhsl(223 4% 80%)",
+		"thinkingMinimal": "okhsl(229 13% 78%)",
+		"thinkingLow": "okhsl(232 30% 76%)",
+		"thinkingMedium": "okhsl(264 43% 74%)",
+		"thinkingHigh": "okhsl(295 56% 72%)",
+		"thinkingXhigh": "okhsl(337 67% 70%)",
+		"thinkingMax": "okhsl(20 88% 68%)",
+		"bashMode": "okhsl(159 67% 55%)"
+	},
+	"export": {
+		"pageBg": "okhsl(17 3% 94%)",
+		"cardBg": "okhsl(17 4% 97%)",
+		"infoBg": "okhsl(56 20% 91%)"
+	}
+}

package/packages/piagent-webui/gateway/pi-host.ts

@@ -4,6 +4,7 @@ import os from "node:os";
 import path from "node:path";
 import { createRequire } from "node:module";
 import { pathToFileURL } from "node:url";
+import { privateHostRoot } from "../../piagent-core/managed/pi-host.mjs";
 
 const require = createRequire(import.meta.url);
 
@@ -73,8 +74,19 @@ export function installedPiHostRoot(): string {
   throw new Error("pi-host-unavailable");
 }
 
+// The host of the pinned release: the installed one when it is that release,
+// else Piagent's private copy, kept beside a member's own newer Pi
+// (packages/piagent-core/managed/pi-host.mjs).
+export function pinnedPiHostRoot(expectedVersion: string): string {
+  const own = privateHostRoot(expectedVersion) as string | null;
+  let root: string;
+  try { root = installedPiHostRoot(); } catch (error) { if (own) return own; throw error; }
+  try { if ((JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf8")) as { version?: string }).version === expectedVersion) return root; } catch { /* unreadable: the private copy, if any */ }
+  return own ?? root;
+}
+
 export async function loadPinnedPiHost(expectedVersion: string): Promise<any> {
-  const root = installedPiHostRoot();
+  const root = pinnedPiHostRoot(expectedVersion);
   const actual = JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf8")) as { version?: string };
   if (actual.version !== expectedVersion) throw new Error("pi-host-version-mismatch");
   return await import(pathToFileURL(path.join(root, "dist", "index.js")).href);

package/scripts/company-terminal.mjs

@@ -9,6 +9,7 @@ import { execFile } from 'node:child_process';
 import { pathToFileURL } from 'node:url';
 
 import { registerTerminalUpdateOffer } from '../packages/piagent-core/runtime/update/terminal-update-offer.mjs';
+import { registerStyleCommand } from '../packages/piagent-core/runtime/terminal/terminal-style.mjs';
 import { parseFailure } from '../packages/piagent-core/runtime/managed-failure.mjs';
 import { checkpointsOf } from '../packages/piagent-core/managed/checkpoints.mjs';
 import { bypassAllowed, effectivePermission } from '../packages/piagent-core/managed/permission.mjs';
@@ -59,7 +60,7 @@ export function memoryResultLines(text, expanded = false) {
 const branchOf = (cwd) => new Promise((resolve) => execFile('git', ['-C', cwd, 'rev-parse', '--abbrev-ref', 'HEAD'], { timeout: 3000 },
   (error, out) => resolve(error ? null : String(out).trim() || null)));
 export const HELP_TEXT = [
-  'Cuộc trò chuyện công ty: /undo hoàn tác file lượt trước đã sửa · /bypass on|full|off|status quyền của cuộc trò chuyện · /fast on|off|status (khi Harness cho phép) · /skill:<tên> hoặc /<lệnh> của bạn và của project.',
+  'Cuộc trò chuyện công ty: /undo hoàn tác file lượt trước đã sửa · /bypass on|full|off|status quyền của cuộc trò chuyện · /fast on|off|status (khi Harness cho phép) · /style giao diện Terminal · /skill:<tên> hoặc /<lệnh> của bạn và của project.',
   'Pi: /session thông tin cuộc trò chuyện · /resume mở cuộc trò chuyện công ty khác · /new cuộc mới · /compact nén ngữ cảnh · /tree, /fork nhánh · /name đặt tên · /copy, /export · /hotkeys toàn bộ phím tắt · /quit thoát.',
   'Phím: ! <lệnh> chạy shell · Esc dừng lượt đang chạy · Ctrl+C xoá ô nhập, hai lần để thoát · Ctrl+O xem thêm.',
   'Mở lại sau: piagent studio --project <thư mục>, rồi /resume. Đừng mở cuộc trò chuyện công ty bằng pi cá nhân.',
@@ -112,7 +113,7 @@ export function companyCommandText(name, summary = {}) {
     case 'login': case 'logout': return 'Cuộc trò chuyện công ty dùng tài khoản AI của team qua Agent Watch: không cần /login hay /logout. Tài khoản và API key cá nhân chỉ dùng trong pi cá nhân.';
     case 'model': case 'scoped-models': return `Model do Harness của team quyết định${main}; Terminal không chọn model. ${ADMIN}`;
     case 'thinking': return `Mức suy luận do Harness của team quyết định${main}. ${ADMIN}`;
-    case 'settings': return `Cài đặt của cuộc trò chuyện công ty (compaction, retry…) do Harness quyết định. Phím tắt: /hotkeys. ${ADMIN}`;
+    case 'settings': return `Cài đặt của cuộc trò chuyện công ty (compaction, retry…) do Harness quyết định. Giao diện Terminal: /style. Phím tắt: /hotkeys. ${ADMIN}`;
     default: return null;
   }
 }
@@ -288,6 +289,9 @@ export function companyTerminalExtension({ managed, packageRoot, sdkRoot, bindin
     registerTerminalUpdateOffer(pi, { installed, packageRoot, restart: 'piagent studio',
       afterUpdate: () => bindingChanged() ? 'Bản mới đổi trình khởi chạy công ty: Agent Watch tự cập nhật cấu hình (cần Agent Watch đang chạy); piagent studio chờ việc này khi mở lại.' : null });
 
+    // The member's pick of look (/style); /settings is not offered here.
+    registerStyleCommand(pi, { remember: true });
+
     // Ask first or Bypass, kept with the conversation like the dashboard's switch.
     const showPermission = (ctx) => { const mode = managed() ? effectivePermission(managed()) : null; ctx.ui?.setStatus?.(PERMISSION_STATUS, mode && mode !== 'workspace-write' ? PERMISSION_NAME[mode] : undefined); };
     pi.on('session_start', async (_event, ctx) => showPermission(ctx));

package/scripts/install-global.sh

@@ -701,7 +701,19 @@ else
   if [[ "$pi_version_output" =~ ([0-9]+\.[0-9]+\.[0-9]+([+-][0-9A-Za-z.-]+)?) ]]; then
     current_pi_version="${BASH_REMATCH[1]}"
   fi
-  if [[ "$current_pi_version" != "$EXPECTED_PI_VERSION" ]]; then
+  pi_host_plan="$(node --input-type=module -e 'const { hostPlan } = await import(process.argv[1]); process.stdout.write(hostPlan(process.argv[2] || null));' "$PLATFORM_ROOT/packages/piagent-core/managed/pi-host.mjs" "$current_pi_version")"
+  if [[ "$pi_host_plan" == "private" ]]; then
+    # The member's own, newer pi stays: it loads the Piagent package as any Pi
+    # package, and company sessions and `piagent pi` run the private pinned host.
+    echo "NOTE: your pi $current_pi_version stays as it is; Piagent is qualified on Pi $EXPECTED_PI_VERSION." >&2
+    pi_host_args=(ensure --force)
+    [[ "$DRY_RUN" == true ]] && pi_host_args+=(--dry-run)
+    if ! node "$PLATFORM_ROOT/scripts/pi-host.mjs" "${pi_host_args[@]}" >&2; then
+      echo "FAIL: could not install the private Pi $EXPECTED_PI_VERSION." >&2
+      exit 1
+    fi
+    echo "NOTE: run \`piagent pi\` for the qualified release; \`pi\` ($current_pi_version) loads Piagent too, unqualified." >&2
+  elif [[ "$current_pi_version" != "$EXPECTED_PI_VERSION" ]]; then
     echo "FAIL: Pi Coding Agent $EXPECTED_PI_VERSION is required; found ${current_pi_version:-${pi_version_output:-unknown}}." >&2
     echo "Install the supported host with: npm install -g --ignore-scripts @earendil-works/pi-coding-agent@$EXPECTED_PI_VERSION" >&2
     exit 1

package/scripts/pi-host.mjs

@@ -0,0 +1,109 @@
+#!/usr/bin/env node
+// The Pi host Piagent runs on, when the member keeps a Pi of their own.
+//
+// Piagent pins one Pi release (package.json peerDependencies). A member who
+// already uses Pi may run a newer one: setup used to replace it with the
+// pinned release. Now theirs stays as it is, and the pinned release is
+// installed privately (packages/piagent-core/managed/pi-host.mjs); company
+// sessions and the dashboard run it, and `piagent pi` opens it for personal use.
+//
+//   pi-host.mjs status [--json]      the pinned host, the `pi` on PATH, the private copy
+//   pi-host.mjs ensure [--dry-run]   install the private copy when PATH has another Pi
+//   pi-host.mjs root                 the host root Piagent runs (empty when none)
+//   pi-host.mjs run [-- args]        run Pi on the pinned host
+import { spawn, spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { PI_HOST_VERSION, hostCli, hostPlan, installPrivateHost, privateHostRoot } from '../packages/piagent-core/managed/pi-host.mjs';
+
+const HOST_NAME = '@earendil-works/pi-coding-agent';
+
+function usage() {
+  return `Usage:
+  piagent pi [pi arguments]        Run Pi ${PI_HOST_VERSION} (the release Piagent is qualified on)
+  piagent pi-host status [--json]  Show the pinned host, your own pi and the private copy
+  piagent pi-host ensure [--dry-run]
+                                   Install the pinned host privately when your pi is another release
+`;
+}
+
+// The `pi` on PATH: its package root and version, or nulls.
+export function pathHost(env = process.env, { probe = true } = {}) {
+  for (const dir of (env.PATH ?? '').split(path.delimiter)) {
+    if (!path.isAbsolute(dir)) continue;
+    let root;
+    try { root = path.dirname(fs.realpathSync(path.join(dir, process.platform === 'win32' ? 'pi.cmd' : 'pi'))); } catch { continue; }
+    for (let depth = 0; depth < 4; depth += 1, root = path.dirname(root)) {
+      try {
+        const manifest = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
+        if (manifest.name === HOST_NAME) return { root, version: manifest.version ?? null };
+      } catch { /* keep walking up */ }
+    }
+  }
+  if (!probe) return { root: null, version: null };
+  // A `pi` that is not an npm package (a standalone build): ask it.
+  const output = spawnSync('pi', ['--version'], { encoding: 'utf8', timeout: 5_000, shell: process.platform === 'win32' });
+  const version = output.status === 0 ? /(\d+\.\d+\.\d+(?:[+-][0-9A-Za-z.-]+)?)/.exec(output.stdout)?.[1] ?? null : null;
+  return { root: null, version };
+}
+
+// The host Piagent runs: the `pi` on PATH when it is the pinned release, else
+// the private copy, else (not installed yet) whatever PATH has.
+export function activeHostRoot({ env = process.env, home } = {}) {
+  const own = pathHost(env, { probe: false });
+  if (own.root && own.version === PI_HOST_VERSION) return own.root;
+  return privateHostRoot(PI_HOST_VERSION, home) ?? own.root;
+}
+
+export function status({ env = process.env, home } = {}) {
+  const own = pathHost(env), privateRoot = privateHostRoot(PI_HOST_VERSION, home);
+  return { pinned: PI_HOST_VERSION, own: own.version, ownRoot: own.root, privateRoot, plan: hostPlan(own.version), active: activeHostRoot({ env, home }) };
+}
+
+function describe(report) {
+  const lines = [`Piagent runs on Pi ${report.pinned}.`];
+  if (!report.own) lines.push('No `pi` on PATH.');
+  else if (report.plan === 'current') lines.push(`Your pi is ${report.own}: the same release, used as it is.`);
+  else if (report.plan === 'private') lines.push(`Your pi is ${report.own}: kept as it is. Company sessions and \`piagent pi\` use a private Pi ${report.pinned}.`);
+  else lines.push(`Your pi is ${report.own}: older than ${report.pinned}; piagent-setup updates it.`);
+  lines.push(report.privateRoot ? `Private copy: ${report.privateRoot}` : 'Private copy: not installed');
+  return lines.join('\n');
+}
+
+async function main(argv) {
+  const [command, ...rest] = argv;
+  if ([undefined, 'help', '--help', '-h'].includes(command)) { process.stdout.write(usage()); return 0; }
+  if (command === 'status') {
+    const report = status();
+    process.stdout.write(rest.includes('--json') ? `${JSON.stringify(report, null, 2)}\n` : `${describe(report)}\n`);
+    return 0;
+  }
+  if (command === 'root') { process.stdout.write(`${activeHostRoot() ?? ''}\n`); return 0; }
+  if (command === 'ensure') {
+    const report = status(), dryRun = rest.includes('--dry-run');
+    if (report.plan !== 'private' && !rest.includes('--force')) { process.stdout.write(`${describe(report)}\n`); return 0; }
+    try {
+      const root = installPrivateHost({ dryRun, log: (line) => process.stdout.write(`${line}\n`) });
+      process.stdout.write(`${dryRun ? 'DRY RUN: ' : ''}Pi ${PI_HOST_VERSION} for Piagent: ${root}\n`);
+      if (report.own) process.stdout.write(`Your pi ${report.own} is unchanged.\n`);
+      return 0;
+    } catch (error) { process.stderr.write(`FAIL: ${error.message}\n`); return 1; }
+  }
+  if (command === 'run') {
+    const args = rest[0] === '--' ? rest.slice(1) : rest;
+    const root = activeHostRoot();
+    if (!root || JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8')).version !== PI_HOST_VERSION) {
+      process.stderr.write(`FAIL: Pi ${PI_HOST_VERSION} is not installed for Piagent. Run: piagent pi-host ensure --force\n`);
+      return 1;
+    }
+    const child = spawn(process.execPath, [hostCli(root), ...args], { stdio: 'inherit' });
+    for (const signal of ['SIGTERM', 'SIGHUP']) process.on(signal, () => { try { child.kill(signal); } catch { /* gone */ } });
+    process.on('SIGINT', () => {});
+    return await new Promise((resolve) => child.once('exit', (code, signal) => resolve(signal ? 1 : code ?? 1)));
+  }
+  process.stderr.write(usage());
+  return 2;
+}
+
+if (process.argv[1] && fs.realpathSync(process.argv[1]) === fileURLToPath(import.meta.url)) process.exitCode = await main(process.argv.slice(2));

package/scripts/piagent-cli.mjs

@@ -26,7 +26,9 @@ const scriptByCommand = {
   "piagent-context": "scripts/context-engine.mjs",
   "piagent-explain": "scripts/explain-command.mjs",
   "piagent-webui": "scripts/piagent-webui-launcher.mjs",
-  "piagent-dashboard": "scripts/piagent-dashboard.mjs"
+  "piagent-dashboard": "scripts/piagent-dashboard.mjs",
+  "piagent-pi-host": "scripts/pi-host.mjs",
+  "piagent-skills": "scripts/skill-sources.mjs"
 };
 
 const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
@@ -42,6 +44,10 @@ if (invokedAs === "piagent") {
   } else if (subcommand === "dashboard") {
     script = "scripts/piagent-dashboard.mjs";
     forwardedArgs = forwardedArgs.slice(1);
+  } else if (subcommand === "pi") {
+    // Pi itself, on the release Piagent is qualified on, whatever `pi` the member keeps.
+    script = "scripts/pi-host.mjs";
+    forwardedArgs = ["run", "--", ...forwardedArgs.slice(1)];
   } else if (subcommand === "explain") {
     script = "scripts/explain-command.mjs";
     forwardedArgs = forwardedArgs.slice(1);
@@ -64,6 +70,9 @@ if (invokedAs === "piagent") {
     console.log("Commands:");
     console.log("  dashboard   Open and manage the local session hub");
     console.log("  studio      Open the managed company agent imported by Agent Watch");
+    console.log("  pi          Run Pi on the release Piagent is qualified on (your own pi stays as it is)");
+    console.log("  pi-host     Show or install the Pi host Piagent runs");
+    console.log("  skills      Add, list or remove skill sources such as mattpocock/skills");
     console.log("  explain     Say why the guard would allow or block a shell command");
     console.log("  approve-verification  Preview or approve an independent verification plan");
     console.log("  select-verification   Preview reusable contracts for exact task criteria");
@@ -95,8 +104,10 @@ function benchmarkSourceRoot() {
   process.exit(1);
 }
 
-// The Pi host this member runs: the `pi` found on PATH, as its package root.
-function piHost() {
+// The Pi host this member runs: the `pi` on PATH when it is the pinned release,
+// else Piagent's private copy (a member keeping a newer Pi of their own).
+async function piHost() {
+  try { return (await import("./pi-host.mjs")).activeHostRoot(); } catch { /* the `pi` on PATH, below */ }
   for (const dir of (process.env.PATH ?? "").split(path.delimiter)) {
     if (!path.isAbsolute(dir)) continue;
     let root;
@@ -113,7 +124,7 @@ function piHost() {
 // entrypoint, the Node running it and the Pi host. Source checkouts never
 // register, and a failure here never blocks the command. Asking for help or the
 // version changes nothing in the operator's agent directory.
-function recordRuntime() {
+async function recordRuntime() {
   try {
     if (forwardedArgs.some((value) => ["--help", "-h", "--version", "-v"].includes(value))) return;
     if (!packageRoot.split(path.sep).includes("node_modules")) return;
@@ -129,7 +140,7 @@ function recordRuntime() {
       version: JSON.parse(fs.readFileSync(path.join(packageRoot, "package.json"), "utf8")).version,
       entrypoint: fs.realpathSync(path.join(packageRoot, "scripts", "piagent-studio.mjs")),
       node: fs.realpathSync(process.execPath),
-      pi_sdk_root: piHost()
+      pi_sdk_root: await piHost()
     }, null, 2)}\n`;
     const file = path.join(agentDir, "piagent-runtime.json");
     try { if (fs.readFileSync(file, "utf8") === body) return; } catch { /* first run */ }
@@ -138,7 +149,7 @@ function recordRuntime() {
     fs.renameSync(temporary, file);
   } catch { /* optional: Agent Watch falls back to known install locations */ }
 }
-recordRuntime();
+await recordRuntime();
 
 const sourceRoot = invokedAs === "piagent-benchmark" ? benchmarkSourceRoot() : packageRoot;
 const target = path.join(sourceRoot, script);

package/scripts/piagent-dashboard.mjs

@@ -7,7 +7,7 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 
 import { requestGatewayControl } from "../packages/piagent-webui/gateway/control-socket.ts";
 import { browserCommand } from "../packages/piagent-core/runtime/host/browser-opener.mjs";
-import { installedPiHostRoot } from "../packages/piagent-webui/gateway/pi-host.ts";
+import { pinnedPiHostRoot } from "../packages/piagent-webui/gateway/pi-host.ts";
 import { gatewayProfileState, profileRef, readGatewayDescriptor, readOrCreateCatalogKey,
   removeGatewayDescriptor } from "../packages/piagent-webui/gateway/profile-state.ts";
 import { startPiagentGateway } from "../packages/piagent-webui/gateway/gateway-service.ts";
@@ -266,7 +266,7 @@ async function main() {
     const key = readOrCreateCatalogKey(state), descriptor = readGatewayDescriptor(state);
     let actual = null;
     try {
-      const hostRoot = installedPiHostRoot();
+      const hostRoot = pinnedPiHostRoot(expectedPiVersion);
       actual = JSON.parse(fs.readFileSync(path.join(hostRoot, "package.json"), "utf8")).version;
     } catch { /* reported as a failed check below */ }
     let health = null;

package/scripts/runtime-advisory-exceptions.json

@@ -24,6 +24,46 @@
       "decided": "2026-10-24",
       "until": "2026-11-07",
       "reason": "Subresource Integrity check bypassed with a non-lowercase algorithm token; Pi does not fetch with integrity metadata. Pinned by the Pi host as above; fixed in undici 8.12.2."
+    },
+    {
+      "id": "GHSA-4w7w-5xrc-9h26",
+      "package": "undici",
+      "node": "node_modules/undici",
+      "decided": "2026-10-28",
+      "until": "2026-11-07",
+      "reason": "Cache poisoning and cross-user disclosure through cross-origin redirects in undici's cache; Pi does not share an HTTP cache between users. Pinned by the Pi host as above (8.10.2 in 1.3.0 and 1.4.0); fixed in undici 8.12.2."
+    },
+    {
+      "id": "GHSA-2m5v-pch6-74hx",
+      "package": "undici",
+      "node": "node_modules/undici",
+      "decided": "2026-10-28",
+      "until": "2026-11-07",
+      "reason": "TLS certificate validation bypassed when an Agent drops its tls options; affects callers that pass custom tls settings to an undici Agent. Pinned by the Pi host as above; fixed in undici 8.12.2. Owner accepted on 2026-10-28 to keep releases going; revisit as soon as a Pi host carries undici >= 8.12.2."
+    },
+    {
+      "id": "GHSA-qrxm-fqhp-jwvm",
+      "package": "undici",
+      "node": "node_modules/undici",
+      "decided": "2026-10-28",
+      "until": "2026-11-07",
+      "reason": "Denial of service through a TLS 1.2 certificate-changing renegotiation by a hostile server; no data exposure. Pinned by the Pi host as above; fixed in undici 8.12.2."
+    },
+    {
+      "id": "GHSA-9fm3-97px-rjf6",
+      "package": "undici",
+      "node": "node_modules/undici",
+      "decided": "2026-10-28",
+      "until": "2026-11-07",
+      "reason": "Denial of service from unbounded automatic PONG buffering in the WebSocket client fed by a hostile server; no data exposure. Pinned by the Pi host as above; fixed in undici 8.12.2."
+    },
+    {
+      "id": "GHSA-55wc-3pg8-jfw6",
+      "package": "undici",
+      "node": "node_modules/undici",
+      "decided": "2026-10-28",
+      "until": "2026-11-07",
+      "reason": "Denial of service from an unhandled exception in the decompress interceptor; no data exposure. Pinned by the Pi host as above; fixed in undici 8.12.2."
     }
   ]
 }

package/scripts/setup.sh

@@ -80,6 +80,7 @@ CONFIGURE_MODEL_SCOPE=true
 MODEL_SCOPE_PRESET="full"
 DEFAULT_MODEL="openai-codex/gpt-6-sol:high"
 AUTO_INSTALL_PI=true
+PI_HOST_PRIVATE=false
 FORCE_PROFILE=false
 FORCE_SETTINGS=false
 SKIP_AGENTS=false
@@ -347,6 +348,19 @@ ensure_pi_cli() {
     if [[ "$current_version" == "$expected_pi_version" ]]; then
       return
     fi
+    # A newer pi is the member's own: it stays, and the pinned host is
+    # installed privately beside it (scripts/pi-host.mjs).
+    if [[ -n "$current_version" ]] && [[ "$(node -e 'const [a,b]=process.argv.slice(1).map(v=>v.split(/[+-]/)[0].split(".").map(Number)); for (let i=0;i<3;i++) if (a[i]!==b[i]) { process.stdout.write(a[i]>b[i]?"newer":"older"); process.exit(0); } process.stdout.write("same");' "$current_version" "$expected_pi_version")" == "newer" ]]; then
+      echo "Pi CLI $current_version is your own and stays as it is; Piagent runs on a private Pi $expected_pi_version."
+      local ensure_args=(ensure --force)
+      [[ "$DRY_RUN" == true ]] && ensure_args+=(--dry-run)
+      if ! node "$PLATFORM_ROOT/scripts/pi-host.mjs" "${ensure_args[@]}"; then
+        echo "FAIL: could not install the private Pi $expected_pi_version." >&2
+        exit 1
+      fi
+      PI_HOST_PRIVATE=true
+      return
+    fi
     if [[ "$AUTO_INSTALL_PI" == false ]]; then
       echo "FAIL: Pi Coding Agent $expected_pi_version is required; found ${current_version:-${current_output:-unknown}}. Remove --no-install-pi or upgrade it manually." >&2
       exit 1
@@ -490,7 +504,11 @@ echo "Next:"
 if [[ "$DO_PROJECT" == true ]]; then
   echo "  cd \"$PROJECT_PATH\""
 fi
-echo "  pi"
+if [[ "$PI_HOST_PRIVATE" == true ]]; then
+  echo "  piagent pi         # Pi $(node -p 'require(process.argv[1]).peerDependencies["@earendil-works/pi-coding-agent"]' "$PLATFORM_ROOT/package.json"), the release Piagent is qualified on; your own pi also loads Piagent"
+else
+  echo "  pi"
+fi
 echo "  /login             # first time only"
 if [[ "$DO_PROJECT" == true ]]; then
   echo "  /model             # or Ctrl+L: select provider/model from Pi selector"