@piagent/platform 1.46.2 → 1.47.0

package/packages/piagent-core/managed/command-tools.mjs

@@ -4,6 +4,7 @@ import { engineAlive, engineLauncher } from './container-engine.mjs';
 import { MEMBER_ONLY, memberOnlyReason, credentialReason, runHostCommand } from './host-command.mjs';
 import { processTools } from './background-process.mjs';
 import { checkpointsOf } from './checkpoints.mjs';
+import { detachedEmulator, simulatorCommandReason } from './simulator-commands.mjs';
 
 // Commands that leave the plain sandbox, each after the member approves that
 // exact command: run_with_network (internet, a local server or browser),
@@ -40,6 +41,16 @@ const KINDS = {
     // credentials: a prompt injection's "cat ~/.ssh/id_rsa" is never silent.
     confirm: async (self, command) => asksNothing(self) ? credentialReason(command) : await networkConfirmation(self, command) ?? 'ask',
   },
+  // The sandbox reaches neither CoreSimulator nor adb. Simulator and app build
+  // commands only (simulator-commands.mjs), asked about as network commands:
+  // Full access and Bypass run them, except what reaches credentials.
+  simulator: {
+    name: 'run_on_simulator', label: 'Run on simulator', scope: 'simulator-command-once', provider: 'host', riskClass: 'medium',
+    description: 'Run one iOS Simulator or Android emulator command on the member\'s machine, outside the sandbox. iOS: xcrun simctl (list, boot, bootstatus -b, install, launch, terminate, openurl, io <device> screenshot <file>, ui appearance, status_bar, spawn <device> log show --info --last 5m --predicate \'process == "<App>"\'), xcodebuild with a simulator destination (build, test: XCUITest is the reliable way to tap, type and answer system dialogs), xcodegen generate, axe (describe-ui reads the screen\'s elements; tap, type, swipe where this Xcode accepts them), open -a Simulator (some Xcode versions run simulators without that window; the device works without it). Android: adb (devices, install, shell am start, shell input tap/text/swipe, exec-out screencap -p > <file>, logcat -d), emulator -avd <name> (started in the background), avdmanager, ./gradlew installDebug. Also flutter, pod install, npx expo/react-native/cap, mkdir -p and cd inside the project. Parts may be joined by && or || and piped into grep, head, tail, xcbeautify or jq; files may be written only inside the project or to /dev/null. Read a screenshot you saved with read to see the screen. Other commands: run_on_host.',
+    allow: 'Run this exact simulator or app build command once on this machine, outside the sandbox: a build can run the project\'s build scripts as you.',
+    title: 'Chạy lệnh simulator', allowText: 'chạy đúng lệnh simulator/build app này một lần trên máy bạn, ngoài sandbox: build có thể chạy script build của project bằng quyền của bạn.',
+    confirm: async (self, command) => credentialReason(command) ?? await networkConfirmation(self, command),
+  },
 };
 
 // The engine answers, looked up again when it did not (started since).
@@ -66,6 +77,8 @@ function commandTool(self, kind) {
       if (kind === 'docker' && !await engineReady(self.boundary)) throw Error(DOCKER_STOPPED);
       const memberOnly = kind === 'host' ? memberOnlyReason(args.command) : null;
       if (memberOnly) throw Error(MEMBER_ONLY(memberOnly));
+      const notSimulator = kind === 'simulator' ? simulatorCommandReason(args.command, self.cwd) : null;
+      if (notSimulator) throw Error(`managed-simulator-command: ${notSimulator}.`);
       const confirm = await spec.confirm(self, args.command);
       if (confirm !== null) await approve(self, id, signal, ctx, { toolName: spec.name, rawAction: { command: args.command }, commandPreview: String(args.command),
         provider: spec.provider, requestedScope: spec.scope, reason: (confirm === 'ask' ? String(args.reason) : `Full access still asks: ${confirm}. ${args.reason}`).slice(0, 300), riskClass: spec.riskClass,
@@ -75,7 +88,8 @@ function commandTool(self, kind) {
       if (self.run) await checkpointsOf(self).take();
       const before = await self.changedFiles();
       try {
-        const result = kind === 'host' ? await runHostCommand({ command: args.command, cwd: self.cwd, userHome: self.boundary.userHome, timeout: args.timeout, signal, onUpdate })
+        const result = kind === 'simulator' && detachedEmulator(args.command) ? await runHostCommand({ command: `nohup ${args.command} >/dev/null 2>&1 & sleep 3; echo "Emulator started in the background; wait for it with: adb wait-for-device"`, cwd: self.cwd, userHome: self.boundary.userHome, timeout: 60, signal, onUpdate })
+          : kind === 'host' || kind === 'simulator' ? await runHostCommand({ command: args.command, cwd: self.cwd, userHome: self.boundary.userHome, timeout: args.timeout, signal, onUpdate })
           : await self.boundary.invoke('bash', { command: args.command, ...(args.timeout ? { timeout: args.timeout } : {}) }, signal, onUpdate, ctx?.model, kind === 'docker' ? { docker: true } : { network: true });
         ok = !result?.isError; return result;
       } finally {
@@ -115,14 +129,14 @@ function startDockerTool(self, { wait = 180_000, every = 2000, launcher: found =
 
 export function commandTools(self, options) {
   const docker = self.boundary.engine || self.boundary.dockerCli;
-  return [commandTool(self, 'network'), ...(docker ? [commandTool(self, 'docker')] : []), startDockerTool(self, options), commandTool(self, 'host'), ...processTools(self)];
+  return [commandTool(self, 'network'), ...(docker ? [commandTool(self, 'docker')] : []), startDockerTool(self, options), commandTool(self, 'host'), commandTool(self, 'simulator'), ...processTools(self)];
 }
 
 // What the system prompt says about services and what the sandbox blocks: it
 // is read for every request, so a Docker started since shows up.
 const HOST_PROMPT = ' When the sandbox blocks something the task needs (a missing runtime such as a JDK or a Node version, the member\'s sign-in for git pull or git push or a private registry, a file outside the project), do not stop and do not tell the member to run it: request run_on_host with the exact command; it runs on the member\'s machine once they approve. Only what needs the member themselves (their password for sudo or an installer, an interactive sign-in, a window to click) goes to ask_user, with the exact steps and the options to continue or skip; after their answer, check and carry on.';
 export function servicesPrompt(boundary) {
-  const simulator = ' The iOS Simulator is not available in the sandbox: ask the member with ask_user to run those tests.';
+  const simulator = ' The iOS Simulator and Android emulator are not reachable from bash: boot them, build and install the app, launch it, tap and type, and take screenshots with run_on_simulator (save the screenshot in the project, then read it to see the screen). Do not ask the member to run simulator steps you can run.';
   if (boundary.engine) return ' Docker is available through run_with_docker (the member approves each command): a database or service for tests (docker compose up -d, then the tests through bash or run_with_network), docker build, or Testcontainers tests. If the engine stops answering, start_docker asks the member to start it. Stop what you started when done unless the member wants it kept.' + simulator + HOST_PROMPT;
   if (boundary.dockerCli) return ' Docker is installed but not running: when the task needs it, call start_docker (the member approves), then run_with_docker.' + simulator + HOST_PROMPT;
   return ' Docker is not installed on this machine: when the task needs it, ask the member with ask_user (install it, or check another way).' + simulator + HOST_PROMPT;

package/packages/piagent-core/managed/copies.mjs

@@ -20,17 +20,27 @@ export function namedCount(words) {
 }
 // The copies a delegate call asks for, checked against the member's words;
 // null for a plain call. `split`: one line per copy naming its share of the work.
+// Copies the member did not ask for come back as `{ dropped }`: one helper runs
+// and the main agent is told why. A refusal here sent agents round in retries,
+// each quoting other words, until the member stopped the turn.
 export function fanOut(manager, role, args, harness) {
   const split = Array.isArray(args?.split) ? args.split.map(s => typeof s === 'string' ? s.trim().slice(0, 500) : '').filter(Boolean) : [];
   const n = split.length || (Number.isInteger(args?.copies) ? args.copies : 1);
-  if (n <= 1 && !args?.member_words) return null;
+  if (n <= 1) return null;
   if (harness) throw Error('managed-copies-invalid: the harness runs one helper per call.');
-  if (n < 2 || n > MAX_COPIES) throw Error(`managed-copies-invalid: ask for 2 to ${MAX_COPIES} ${role} helpers (copies, or one split line per helper).`);
   const words = normal(args?.member_words);
-  if (words.length < 3 || !memberRequest(memberMessages(manager)).some(text => normal(text).includes(words)) || namedCount(words) < n || !HELPER_WORDS.test(words))
-    throw Error(`managed-copies-not-asked: more than one ${role} helper runs only when the member asks for it. Quote in member_words the member's own words that ask for ${n} (verbatim, with the number); otherwise use one helper.`);
+  if (words.length < 3 || !memberRequest(memberMessages(manager)).some(text => normal(text).includes(words)) || namedCount(words) < n || !HELPER_WORDS.test(words)) return { dropped: n };
+  if (n > MAX_COPIES) throw Error(`managed-copies-invalid: ask for 2 to ${MAX_COPIES} ${role} helpers (copies, or one split line per helper).`);
   return { n, split: split.length ? split : null };
 }
+// The helper's answer, with what the main agent reads above it when it asked
+// for helpers the member did not (`asked`: what fanOut returned).
+export function withDroppedNote(result, role, asked) {
+  const n = asked?.dropped, first = result?.content?.[0];
+  if (!n || first?.type !== 'text') return result;
+  const note = `One ${role} helper ran, not ${n}: the member's own words did not ask for ${n} ${role} helpers. Go on with this answer; run several only when the member asks for that many.\n\n`;
+  return { ...result, content: [{ ...first, text: note + first.text }, ...result.content.slice(1)] };
+}
 // What one copy reads under its brief.
 export function copyNote(role, i, fan) {
   return `\n\nThe member asked for ${fan.n} ${role} helpers; you are ${role} helper ${i + 1} of ${fan.n}. ${fan.split ? `Your share of the work: ${fan.split[i]}. The others cover the rest.` : 'The others have the same brief: answer on your own judgement.'}`;

package/packages/piagent-core/managed/member-mcp.mjs

@@ -0,0 +1,71 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { evaluateMcpApproval } from '../runtime/mcp-repository-gate.mjs';
+import { userToolchains } from './toolchain.mjs';
+import { fenced } from './untrusted.mjs';
+
+// The member's MCP servers in company sessions. Company sessions load no Pi
+// extension of the member's, with one exception: the MCP adapter Piagent
+// installs (pi-mcp-adapter in Piagent's own Pi home). It reads the same
+// configuration as personal Piagent (piagent-mcp add, ~/.config/mcp/mcp.json,
+// a project's .mcp.json, /mcp) and the same logins (/mcp-auth), so a server the
+// member added once works in both. The member decides which servers exist;
+// company sessions keep the two protections personal Piagent has: a server a
+// repository defines runs only once someone on this machine approved it, and
+// what a server returns reaches the agent as data, not instructions.
+
+const ADAPTER = 'pi-mcp-adapter';
+const readJson = file => { try { return JSON.parse(fs.readFileSync(file, 'utf8')); } catch { return null; } };
+const inside = (file, dir) => { const relative = path.relative(dir, file); return !!relative && !relative.startsWith('..') && !path.isAbsolute(relative); };
+
+// The adapter the member installed in Piagent's Pi home and still lists among
+// its packages, or null. `piagent studio` starts from a cleared environment, so
+// the home is the default one (~/.piagent/agent) unless a caller names another.
+export function memberMcpAdapter(home = os.homedir(), agentDir = path.join(home, '.piagent', 'agent')) {
+  const packages = readJson(path.join(agentDir, 'settings.json'))?.packages;
+  const listed = Array.isArray(packages) && packages.some(entry => new RegExp(`(^|[:/])${ADAPTER}(@|$)`).test(String(typeof entry === 'string' ? entry : entry?.source ?? '')));
+  const dir = path.join(agentDir, 'npm', 'node_modules', ADAPTER);
+  if (!listed || !fs.existsSync(path.join(dir, 'package.json'))) return null;
+  return { agentDir, dir: fs.realpathSync(dir) };
+}
+
+// What the adapter and the servers it starts need from a cleared environment:
+// Piagent's Pi home (its mcp.json, logins and caches, shared with personal
+// Piagent) and a PATH that finds npx, uvx, docker… as in the member's
+// Terminal. Nothing else of the member's shell is passed, as for host commands.
+export function memberMcpEnvironment(adapter, home = os.homedir(), env = process.env) {
+  env.PI_CODING_AGENT_DIR ||= adapter.agentDir;
+  const toolchains = userToolchains(home);
+  const dirs = [...toolchains.bins, path.dirname(process.execPath), '/opt/homebrew/bin', '/usr/local/bin', ...(env.PATH ?? '/usr/bin:/bin').split(':')];
+  env.PATH = [...new Set(dirs.filter(Boolean))].join(':');
+  for (const [name, value] of Object.entries(toolchains.env)) env[name] ||= value;
+  return env;
+}
+
+// The repository approval gate on every tool call (as personal Piagent's
+// guard), and the adapter's results fenced as data.
+export function memberMcpGuard(cwd, adapterDir) {
+  return pi => {
+    const fromAdapter = name => { const source = pi.getAllTools().find(tool => tool.name === name)?.sourceInfo?.path; return !!source && (source === adapterDir || inside(source, adapterDir)); };
+    pi.on('tool_call', event => {
+      const decision = evaluateMcpApproval(cwd, event.toolName, event.input ?? {});
+      return decision.block ? { block: true, reason: decision.reason } : undefined;
+    });
+    pi.on('tool_result', event => {
+      if (!fromAdapter(event.toolName)) return undefined;
+      const text = (event.content ?? []).filter(part => part?.type === 'text').map(part => part.text).join('\n');
+      const images = (event.content ?? []).filter(part => part?.type === 'image');
+      return { content: [{ type: 'text', text: fenced(`Result of MCP tool ${event.toolName}`, text) }, ...images] };
+    });
+  };
+}
+
+// The company session's own extension factories, with the member's MCP added
+// when the adapter is installed: [factories, extension paths] for inlineExtensions.
+export function withMemberMcp(cwd, factories, home = os.homedir()) {
+  const adapter = memberMcpAdapter(home);
+  if (!adapter) return [factories, []];
+  memberMcpEnvironment(adapter, home);
+  return [[...factories, memberMcpGuard(cwd, adapter.dir)], [adapter.dir]];
+}

package/packages/piagent-core/managed/memory-lessons.mjs

@@ -8,7 +8,7 @@ import { createHash } from 'node:crypto';
 import { redactedText } from '../runtime/managed-failure.mjs';
 import { isCheckCommand } from './workflow.mjs';
 
-const COMMAND_TOOLS = new Set(['bash','run_with_network','run_with_docker','run_on_host']);
+const COMMAND_TOOLS = new Set(['bash','run_with_network','run_with_docker','run_on_host','run_on_simulator']);
 const textOf = result => (result?.content ?? []).filter(p => p?.type === 'text').map(p => p.text ?? '').join('\n');
 const clean = (value, max) => redactedText(String(value ?? '')).replace(/\bas_(?:live|run)_[A-Za-z0-9_-]{8,}/g,'[REDACTED_SECRET]').split(os.homedir()).join('~').replace(/\s+/g,' ').trim().slice(0,max);
 const hash = s => createHash('sha256').update(s).digest('hex').slice(0,20);

package/packages/piagent-core/managed/resource-loader.mjs

@@ -26,10 +26,10 @@ export function projectInstructions(cwd, top = cwd) {
 // discovered in a project. Skills and commands are text (agent-skills.mjs):
 // what they ask for runs with the session's own tools.
 // themes: Piagent's own (the company Terminal's /style), loaded by the host.
-export function managedResourceLoader(api, { systemPrompt, extensions = [], runtime = api.createExtensionRuntime(), agentsFiles = [], skills = [], prompts = [], themes = [] } = {}) {
+export function managedResourceLoader(api, { systemPrompt, extensions = [], runtime = api.createExtensionRuntime(), errors = [], agentsFiles = [], skills = [], prompts = [], themes = [] } = {}) {
   const empty = Object.freeze([]);
   return Object.freeze({
-    getExtensions: () => ({ extensions, errors: empty, runtime }),
+    getExtensions: () => ({ extensions, errors: [...errors], runtime }),
     getSkills: () => ({ skills: [...skills], diagnostics: empty }),
     getPrompts: () => ({ prompts: [...prompts], diagnostics: empty }),
     getThemes: () => ({ themes: [...themes], diagnostics: empty }),
@@ -45,12 +45,24 @@ export function managedResourceLoader(api, { systemPrompt, extensions = [], runt
 
 // Extensions the company Terminal adds itself (its commands and how Harness
 // notes read), built the way Pi builds an inline extension. Never project code.
-export async function inlineExtensions(api, sdkRoot, cwd, factories = []) {
+// `paths`: installed extensions loaded the way Pi loads a package's (only the
+// member's MCP adapter, member-mcp.mjs); one that fails to load is reported in
+// `errors` and the session opens without it.
+export async function inlineExtensions(api, sdkRoot, cwd, factories = [], paths = []) {
   const runtime = api.createExtensionRuntime();
-  if (!factories.length) return { extensions: [], runtime };
+  if (!factories.length && !paths.length) return { extensions: [], runtime };
   const load = (file) => import(pathToFileURL(path.join(sdkRoot, 'dist', ...file.split('/'))).href);
-  const [{ loadExtensionFromFactory }, { createEventBus }] = await Promise.all([load('core/extensions/loader.js'), load('core/event-bus.js')]);
-  const bus = createEventBus(), extensions = [];
+  const [{ loadExtensionFromFactory, loadExtensions }, { createEventBus }] = await Promise.all([load('core/extensions/loader.js'), load('core/event-bus.js')]);
+  const bus = createEventBus(), extensions = [], errors = [];
   for (const [index, factory] of factories.entries()) extensions.push(await loadExtensionFromFactory(factory, cwd, bus, runtime, `<inline:company-terminal-${index + 1}>`));
-  return { extensions, runtime };
+  if (paths.length) {
+    // Pi's theme exists only once a terminal draws; the MCP adapter colours its
+    // status line with it in every mode, and without one (RPC, the WebUI) its
+    // start failed. The Terminal sets its own theme later.
+    const { theme, initTheme } = await load('modes/interactive/theme/theme.js');
+    try { void theme.fg; } catch { initTheme(); }
+    try { const loaded = await loadExtensions(paths, cwd, bus, runtime); extensions.push(...loaded.extensions); errors.push(...loaded.errors); }
+    catch (error) { errors.push({ path: paths.join(', '), error: error instanceof Error ? error.message : String(error) }); }
+  }
+  return { extensions, runtime, errors };
 }

package/packages/piagent-core/managed/sandbox-diagnostic.mjs

@@ -21,11 +21,15 @@ const DOCKER_DAEMON = /Cannot connect to the Docker daemon|connect to the docker
 // A runtime or tool the command needs is not on this machine (or not the
 // version the project asks for).
 const TOOLCHAIN = /Unable to locate a Java Runtime|No Java runtime present|JAVA_HOME is not (?:set|defined correctly)|(?:^|\n)\S*?(?:ba|z)?sh: (?:line \d+: )?[\w.+-]+: command not found|zsh: command not found: [\w.+-]+|xcrun: error: (?:unable to find utility|invalid active developer path)|env: '?[\w.+-]+'?: No such file or directory|Unsupported class file major version|invalid target release: \d+|release version \d+ not supported|requires? (?:at least )?Java \d+|The engine "node" is incompatible|Unsupported engine/i;
+// The iOS Simulator (CoreSimulator) and Android's adb/emulator, which the
+// sandbox does not reach.
+const SIMULATOR = /CoreSimulator|simctl|Unable to boot device|Unable to lookup in current state|Failed to start launchd_sim|adb: (?:cannot connect|failed to check server version|no devices|device offline)|cannot connect to daemon|\bemulator: (?:ERROR|PANIC)|Unable to find a destination matching|xcodebuild: error: Unable to find a destination/i;
 // The member's sign-in, which the sandbox does not have.
 const SIGN_IN = /could not read (?:Username|Password) for|terminal prompts disabled|Authentication failed for|Permission denied \(publickey|Host key verification failed|not logged into any GitHub hosts|please run:\s+gh auth login|Could not open a connection to your authentication agent|\bENEEDAUTH\b|\bE401\b|\b401 Unauthorized|requires authentication|denied: requested access to the resource is denied|pull access denied/i;
 
 export function sandboxDiagnostic(message, { network = false, isolated = false, docker = false, engine = false } = {}) {
   const text=String(message);
+  if(!network&&SIMULATOR.test(text))return 'managed-simulator-unreachable: Lệnh bash trong sandbox không tới được iOS Simulator hay Android emulator. Chạy lệnh simulator (xcrun simctl, xcodebuild cho simulator, adb, emulator, ./gradlew installDebug, flutter, npx expo) bằng run_on_simulator.\n'+text;
   if(docker&&DOCKER_DAEMON.test(text))return 'managed-docker-unreachable: Lệnh chạy với Docker nhưng Docker engine không trả lời (Docker Desktop/Colima/OrbStack chưa chạy hoặc đang khởi động). Gọi start_docker để xin member duyệt mở Docker, rồi chạy lại đúng lệnh này bằng run_with_docker.\n'+text;
   if(!docker&&DOCKER_DAEMON.test(text))return (engine?'managed-docker-blocked: Lệnh bash thường không dùng được Docker trong chế độ công ty. Lệnh docker, docker compose, hoặc test cần Docker (Testcontainers) chạy qua run_with_docker để người dùng duyệt đúng lệnh đó.\n':'managed-docker-unavailable: Docker engine trên máy chưa chạy. Gọi start_docker để xin member duyệt mở Docker, rồi chạy lệnh bằng run_with_docker.\n')+text;
   if(TOOLCHAIN.test(text))return 'managed-toolchain-missing: Máy thiếu runtime/công cụ mà lệnh cần, hoặc sai version project yêu cầu. Đừng dừng ở đây: xem project cần gì (pom.xml, build.gradle, .nvmrc, .tool-versions, package.json engines…) rồi dùng run_on_host để xin member duyệt cài trên máy (ví dụ brew install openjdk@21, brew install node@22, sdk install java 21-tem), sau đó chạy lại lệnh. Nếu project build được trong Docker thì có thể đề xuất run_with_docker. Trình cài cần mật khẩu (sudo, file .pkg) thì hỏi member bằng ask_user.\n'+text;

package/packages/piagent-core/managed/session.mjs

@@ -24,7 +24,7 @@ import { readPatchDigest, readPatchSnapshot, readChangedFiles, readHead } from '
 import { memberTurn } from './continuation.mjs';
 import { workflowPolicy, repositoryChecks, sessionPlanTool, currentPlan, workflowPrompt, RunProcess, completionGate, pendingBaseline, pendingPaths, pendingHead, processEditTools } from './workflow.mjs';
 import { workflowContextTool, workflowContextExtension } from './workflow-context.mjs';
-import { beforeDelegate, resolveTool } from './objections.mjs'; import { fanOut } from './copies.mjs';
+import { beforeDelegate, resolveTool } from './objections.mjs'; import { fanOut, withDroppedNote } from './copies.mjs'; import { withMemberMcp } from './member-mcp.mjs';
 import { HELPER_CALLS, HELPER_ROLES, helperRoles, helperPrompt, webPrompt, delegateDescription, mainWebLookups, limitedWebTools } from './helper-roles.mjs'; import { delegateParameters, delegateArgs, SPEC_PROMPT } from './helper-settlement.mjs';
 import { loadAgentResources } from './agent-skills.mjs';
 import { loadPiagentThemes } from '../runtime/terminal/terminal-style.mjs';
@@ -137,8 +137,8 @@ export class ManagedSession {
     self.checks = repositoryChecks(agentsFiles, self.cwd, self.boundary.repositoryTop);
     // The Harness workflow (possibly changed on a later enrollment) adds its process to the prompt.
     const loader = managedResourceLoader(api, { systemPrompt: () => BASE_PROMPT + referencePrompt(self.boundary.userHome) + TEST_PROMPT + servicesPrompt(self.boundary) + webPrompt(helperRoles(manifest), mainWebLookups(manifest)) + helperPrompt(helperRoles(self.manifest)) + workflowPrompt(workflowPolicy(self.manifest), self.checks), agentsFiles,
-      skills: self.resources.skills, prompts: self.resources.prompts, themes: terminalExtensions.length ? await loadPiagentThemes(sdk) : [], ...await inlineExtensions(api, sdk, self.cwd,
-        [...terminalExtensions, workflowContextExtension(self.cwd, () => self.session.sessionManager)]) });
+      skills: self.resources.skills, prompts: self.resources.prompts, themes: terminalExtensions.length ? await loadPiagentThemes(sdk) : [], ...await inlineExtensions(api, sdk, self.cwd, // and the member's MCP servers (member-mcp.mjs)
+        ...withMemberMcp(self.cwd, [...terminalExtensions, workflowContextExtension(self.cwd, () => self.session.sessionManager)])) });
     const settings = api.SettingsManager.inMemory({ retry: { enabled: false, provider: { maxRetries: 0 } }, cacheWarming: 'off', enableInstallTelemetry: false, enableAnalytics: false, enableSkillCommands: true });
     const manager = sessionManager ?? api.SessionManager.inMemory(self.cwd); attachMemory(self, manager, agentDir, g => verifyGrant(g, self.manifest, 'main')); self.studioLink = new StudioLink({ origin: self.origin, agentDir, notify: event => self.notify(event), ui: () => self.session?.extensionRunner?.getUIContext?.() });
     const scope = scopeOf(self.origin, manifest);
@@ -469,7 +469,7 @@ export class ManagedSession {
     if (!enabled.includes(role)) throw Error(`managed-helper-not-configured: the company Harness has no ${role} subagent${enabled.length ? `; use ${enabled.join(', ')}` : ''}.`);
     // Studio lets each helper role run HELPER_CALLS times per run (one user
     // message), each helper the member asked for counted (copies.mjs). Say so at once.
-    const fan = fanOut(this.session?.sessionManager, role, more, harness);
+    const asked = fanOut(this.session?.sessionManager, role, more, harness), fan = asked?.dropped ? null : asked;
     if ((this.helperCalls.get(role) ?? 0) + (fan?.n ?? 1) > HELPER_CALLS) throw Error(`managed-helper-limit: the ${role} subagent already ran ${HELPER_CALLS} times for this user message. Go on with what it returned, or use it again after the next user message.`);
     beforeDelegate(this.run, role, harness, { since, review: this.review, changed: (this.ownPaths?.size ?? 0) > 0, asked: !!fan });
     const job = this.runHelper(role, task, signal, harness, title, role === 'review' && typeof since === 'string' && since.trim() ? since.trim() : null, fan); this.helpers.set(role, job); this.publishHelpers();
@@ -477,7 +477,7 @@ export class ManagedSession {
     // quiet: a beat each minute tells the dashboard's watchdog, which stops a
     // turn after 15 minutes without an event, that the turn is working.
     const beat = setInterval(() => this.notify({ type: 'managed_helper_progress', role }), this.helperBeatMs ?? HELPER_BEAT_MS); beat.unref?.();
-    try { return await job; } finally { clearInterval(beat); this.helpers.delete(role); this.publishHelpers(); }
+    try { return withDroppedNote(await job, role, asked); } finally { clearInterval(beat); this.helpers.delete(role); this.publishHelpers(); }
   }
   publishHelpers() {
     // One of each enabled helper role can run at a time.

package/packages/piagent-core/managed/simulator-commands.mjs

@@ -0,0 +1,117 @@
+import path from 'node:path';
+
+// What run_on_simulator runs on the member's machine: the iOS Simulator and
+// Android emulator, and the builds that install an app on them (the sandbox
+// reaches neither CoreSimulator nor adb). Only these programs, joined by &&,
+// || or a pipe into an output filter; output may go to a file in the project
+// (a screenshot), nothing else leaves it. Anything wider is run_on_host.
+
+const XCRUN = new Set(['simctl', 'xcodebuild', 'devicectl', 'xcresulttool', 'xctrace']);
+// `simctl spawn` starts a program of the simulator's runtime as the member:
+// only `log` (the app's logs).
+const simctl = words => words[1] !== 'simctl' || words[2] !== 'spawn' || words.slice(3).filter(word => !word.startsWith('-'))[1] === 'log';
+const NPX = /^(expo|react-native|@react-native-community\/cli|cap|@capacitor\/cli)(@[\w.-]+)?$/;
+// Program → whether its arguments are allowed (`words` without assignments,
+// `inProject` a path check against the project folder).
+const PROGRAMS = {
+  xcrun: words => XCRUN.has(words[1]) && simctl(words),
+  xcodebuild: () => true,
+  open: words => words.length === 3 && words[1] === '-a' && words[2] === 'Simulator',
+  adb: () => true, emulator: () => true, avdmanager: () => true, sdkmanager: () => true,
+  gradlew: (words, inProject) => inProject(words[0]),
+  // Taps, typing and the screen's accessibility tree; `axe init` writes into other tools' settings.
+  axe: words => !!words[1] && words[1] !== 'init',
+  xcodegen: words => words[1] === 'generate',
+  flutter: () => true,
+  pod: words => words[1] === 'install',
+  npx: words => NPX.test(words[1] === '--yes' || words[1] === '-y' ? words[2] ?? '' : words[1] ?? ''),
+  // Waiting for a boot, and reading what a build printed.
+  sleep: words => words.length === 2 && /^\d{1,3}$/.test(words[1]),
+  xcbeautify: () => true, xcpretty: () => true,
+  grep: () => true, head: () => true, tail: () => true, wc: () => true, sort: () => true, uniq: () => true, jq: () => true,
+  cd: (words, inProject) => words.length === 2 && inProject(words[1]),
+  mkdir: (words, inProject) => { const paths = words.slice(1).filter(word => word !== '-p'); return paths.length > 0 && paths.every(inProject); },
+};
+// Variables a command may set for itself; never what changes how programs load.
+const ASSIGNMENT = /^([A-Z][A-Z0-9_]*)=/;
+const UNSAFE_VARIABLE = /^(PATH|DYLD_\w*|LD_\w*|NODE_OPTIONS|BASH_ENV|ENV|ZDOTDIR|SHELL|HOME)$/;
+
+// A path in the project folder: relative without climbing out of it, or
+// absolute inside it (agents name files by their full path). Without the
+// folder, only a relative one.
+function insideProject(cwd) {
+  return target => {
+    if (typeof target !== 'string' || !target || target.startsWith('~') || target.includes('$') || target.split('/').includes('..')) return false;
+    if (!target.startsWith('/')) return true;
+    if (!cwd) return false;
+    const relative = path.relative(path.resolve(cwd), path.resolve(target));
+    return !relative.startsWith('..') && !path.isAbsolute(relative);
+  };
+}
+
+// Shell words with their quotes resolved, and the operators between them.
+// null for what this reader does not follow (an unclosed quote).
+function tokens(command) {
+  const out = []; let word = null, quote = null;
+  const push = () => { if (word !== null) { out.push({ word }); word = null; } };
+  for (let i = 0; i < command.length; i += 1) {
+    const c = command[i];
+    if (quote) { if (c === quote) quote = null; else if (c === '\\' && quote === '"' && i + 1 < command.length) word += command[++i]; else word += c; continue; }
+    if (c === "'" || c === '"') { quote = c; word ??= ''; continue; }
+    if (c === '\\' && i + 1 < command.length) { word = (word ?? '') + command[++i]; continue; }
+    if (/\s/.test(c)) { push(); continue; }
+    const two = command.slice(i, i + 2);
+    if (['&&', '||', '>>', '2>'].includes(two)) {
+      push();
+      if (two === '2>' && command[i + 2] === '&' && command[i + 3] === '1') { out.push({ op: '2>&1' }); i += 3; continue; }
+      out.push({ op: two }); i += 1; continue;
+    }
+    if (c === '|' || c === '>') { push(); out.push({ op: c }); continue; }
+    word = (word ?? '') + c;
+  }
+  if (quote) return null;
+  push();
+  return out;
+}
+
+// Why the command is not a simulator command, or null when it is. `cwd`:
+// the project folder, where output files and `cd` may go.
+export function simulatorCommandReason(command, cwd = null) {
+  const text = String(command ?? ''), inProject = insideProject(cwd);
+  if (!text.trim()) return 'the command is empty';
+  if (/[`;\n]|\$\(|<\(|>\(|</.test(text) || text.replaceAll('&&', '').replaceAll('2>&1', '').includes('&')) return 'only commands joined by &&, || or | are run (no ;, &, $( ), backticks or subshells)';
+  const list = tokens(text);
+  if (!list) return 'an unclosed quote';
+  let words = [];
+  const close = () => {
+    if (!words.length) return 'an empty part between operators';
+    while (words.length && ASSIGNMENT.test(words[0])) {
+      const name = ASSIGNMENT.exec(words[0])[1];
+      if (UNSAFE_VARIABLE.test(name)) return `${name} cannot be set here`;
+      words = words.slice(1);
+    }
+    const name = words[0]?.split('/').pop();
+    const allowed = Object.hasOwn(PROGRAMS, name) && PROGRAMS[name](words, inProject);
+    words = [];
+    return allowed ? null : `${name ?? 'this part'} is not a simulator or app build command (use run_on_host for other commands)`;
+  };
+  for (let i = 0; i < list.length; i += 1) {
+    const { word, op } = list[i];
+    if (word !== undefined) { words.push(word); continue; }
+    if (op === '2>&1') continue;
+    if (op === '>' || op === '>>' || op === '2>') {
+      const target = list[i + 1]?.word;
+      if (!(target === '/dev/null' || inProject(target))) return 'output may go only to a file inside the project or /dev/null';
+      i += 1; continue;
+    }
+    const reason = close(); if (reason) return reason;
+  }
+  return close();
+}
+
+// A lone `emulator …` keeps running while the virtual device is up: it is
+// started detached and the tool returns once it is launched.
+export function detachedEmulator(command) {
+  const list = tokens(String(command ?? ''));
+  return !!list && list.length > 0 && list.every(token => token.word !== undefined) && list[0].word.split('/').pop() === 'emulator';
+}

package/packages/piagent-core/mcp/mcp-server-catalog.js

@@ -151,6 +151,18 @@ export const CATALOG_SERVERS = {
       directTools: false
     }
   },
+  // Atlassian's own remote server (Jira and Confluence Cloud). It registers its
+  // OAuth client itself (the metadata sits at the origin, not at the protected
+  // resource), so the member signs in with /mcp-auth and their own Jira access.
+  atlassian: {
+    description: "Atlassian Rovo MCP server: Jira and Confluence Cloud, with the member's own Atlassian login (OAuth).",
+    config: {
+      url: "https://mcp.atlassian.com/v1/mcp",
+      auth: "oauth",
+      lifecycle: "lazy",
+      directTools: false
+    }
+  },
   // Converts .docx, .xlsx, .pptx and .pdf to Markdown locally. Local matters:
   // the alternative to this is uploading a document somewhere to read it, and a
   // document worth converting is usually one worth not uploading.
@@ -202,6 +214,10 @@ export const CATALOG_PREREQUISITES = {
     "Developer Preview: no Pi OAuth end-to-end release proof exists yet",
     "Google's supported client guides use an OAuth client id and secret; Pi's public-client/PKCE compatibility is unverified"
   ],
+  atlassian: [
+    "a Jira or Confluence Cloud site (Server and Data Center are not served by this endpoint)",
+    "sign in once with /mcp-auth atlassian; a site admin may have to allow the Atlassian MCP connection"
+  ],
   markitdown: [
     "uv on PATH (https://docs.astral.sh/uv); the first run downloads a Python runtime and roughly 120 MB of dependencies",
     "note: markitdown-mcp is published as an alpha, so pin changes deliberately"
@@ -244,11 +260,12 @@ export const CATALOG_PRESETS = {
   "google-mail": ["gmail"],
   google: ["google-drive", "google-docs", "google-sheets"],
   "google-all": ["google-drive", "gmail", "google-docs", "google-sheets"],
+  atlassian: ["atlassian"],
   core: ["context7", "chrome-devtools", "github"],
   popular: ["context7", "chrome-devtools", "playwright", "github", "figma-desktop"],
   all: [
     "context7", "chrome-devtools", "playwright", "github", "figma-desktop", "figma",
-    "markitdown", "google-drive", "gmail", "google-docs", "google-sheets"
+    "markitdown", "atlassian", "google-drive", "gmail", "google-docs", "google-sheets"
   ]
 };
 

package/packages/piagent-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@piagent/core",
-  "version": "1.46.2",
+  "version": "1.47.0",
   "type": "module",
   "private": true,
   "license": "MIT",

package/packages/piagent-core/runtime/managed-failure.mjs

@@ -96,7 +96,6 @@ const CODES = {
   'managed-review-by-harness': ['tool', 'the harness reviews the final patch; the agent does not ask for one'],
   'managed-review-once': ['tool', 'this change was reviewed already; ask again only after fixing blocking findings'],
   'managed-copies-invalid': ['tool', 'several helpers of a role run 2 or 3 at a time, at the member\'s request'],
-  'managed-copies-not-asked': ['tool', 'more than one helper of a role runs only when the member asks for it'],
   helper_run_limit_reached: ['tool', 'this subagent already ran 8 times for this message'],
   'managed-helper-cancelled': ['tool', 'the subagent was stopped'],
   'managed-helper-failed': ['failed', 'the subagent ended without an answer'],

package/packages/piagent-core/runtime/mcp-repository-gate.d.mts

@@ -0,0 +1,10 @@
+export interface RepositoryMcpGate {
+  blocked: Map<string, { state: string; origin: string }>;
+  serverNames: Set<string>;
+  unverifiable: string[];
+}
+
+export const mcpApprovalCache: Map<string, { signature: string; gate: RepositoryMcpGate }>;
+export function mcpServerFromToolCall(toolName: string, input: Record<string, unknown>, candidates: Iterable<string>): string | undefined;
+export function repositoryMcpGate(cwd: string): RepositoryMcpGate;
+export function evaluateMcpApproval(cwd: string, toolName: string, input: Record<string, unknown>): { block: boolean; reason?: string };