@piagent/platform 1.46.4 → 1.47.0

package/docs-site/update.html

@@ -37,7 +37,7 @@
         <span class="brand-mark"><img src="/assets/piagent-logo.svg" alt="" width="28" height="28" /></span>
         <span class="brand-name"><b>Piagent</b> <span>Platform</span></span>
       </a>
-      <a class="version-badge" href="/whats-new" data-docs-version="v1.46.4" title="v1.46.4 docs · VI"><span class="dot"></span>v1.46.4</a>
+      <a class="version-badge" href="/whats-new" data-docs-version="v1.47.0" title="v1.47.0 docs · VI"><span class="dot"></span>v1.47.0</a>
       <nav class="top-nav" aria-label="Tài liệu">
         <a href="/quickstart">Tài liệu</a>
         <a href="/whats-new">Changelog</a>
@@ -145,9 +145,9 @@
   <h2 id="pin-cho-team">Pin một bản cho cả team</h2>
   <p>Khi rollout cho team, cài đúng bản Pi host và đúng bản platform, rồi chạy installer ở chế độ stable. Bước <code>--dry-run</code> in ra những gì sẽ đổi.</p>
   <div class="command-card">
-    <header><span>Cài pin theo bản</span><button class="clip-btn" data-clip="npm install -g --ignore-scripts @earendil-works/pi-coding-agent@1.3.0&#10;npm install -g --ignore-scripts @piagent/platform@1.46.4&#10;piagent-install --stable --dry-run&#10;piagent-install --stable">Lấy lệnh</button></header>
+    <header><span>Cài pin theo bản</span><button class="clip-btn" data-clip="npm install -g --ignore-scripts @earendil-works/pi-coding-agent@1.3.0&#10;npm install -g --ignore-scripts @piagent/platform@1.47.0&#10;piagent-install --stable --dry-run&#10;piagent-install --stable">Lấy lệnh</button></header>
     <pre><code>npm install -g --ignore-scripts @earendil-works/pi-coding-agent@1.3.0
-npm install -g --ignore-scripts @piagent/platform@1.46.4
+npm install -g --ignore-scripts @piagent/platform@1.47.0
 piagent-install --stable --dry-run
 piagent-install --stable</code></pre>
   </div>

package/docs-site/whats-new.html

@@ -37,7 +37,7 @@
         <span class="brand-mark"><img src="/assets/piagent-logo.svg" alt="" width="28" height="28" /></span>
         <span class="brand-name"><b>Piagent</b> <span>Platform</span></span>
       </a>
-      <a class="version-badge" href="/whats-new" data-docs-version="v1.46.4" title="v1.46.4 docs · VI"><span class="dot"></span>v1.46.4</a>
+      <a class="version-badge" href="/whats-new" data-docs-version="v1.47.0" title="v1.47.0 docs · VI"><span class="dot"></span>v1.47.0</a>
       <nav class="top-nav" aria-label="Tài liệu">
         <a href="/quickstart">Tài liệu</a>
         <a href="/whats-new" aria-current="page">Changelog</a>
@@ -108,7 +108,20 @@
 <div class="release-filter" role="toolbar" aria-label="Lọc theo loại thay đổi"><button type="button" data-filter-kind="all" aria-pressed="true">Tất cả</button><button type="button" data-filter-kind="new" aria-pressed="false">Mới</button><button type="button" data-filter-kind="improved" aria-pressed="false">Cải thiện</button><button type="button" data-filter-kind="fixed" aria-pressed="false">Sửa lỗi</button><button type="button" data-filter-kind="security" aria-pressed="false">Bảo mật</button></div>
 <section class="section releases" data-releases>
 <h2 id="latest" class="sr-only">Mới nhất</h2>
-<article class="release latest" id="v1-46-4" data-release>
+<article class="release latest" id="v1-47-0" data-release>
+  <div class="release-meta"><a class="release-version" href="#v1-47-0">v1.47.0</a><time class="release-date" datetime="2026-10-29">29/10/2026</time></div>
+  <div class="release-body">
+    <h3 data-toc-skip id="v1-47-0-title">Phiên công ty dùng MCP server của bạn và điều khiển simulator iOS, Android</h3>
+    <p>Jira, GitHub và mọi MCP server bạn cài cho Piagent giờ dùng được trong phiên công ty, và agent tự build, chạy, chụp màn hình và test app mobile trên simulator.</p>
+    <ul class="release-items">
+      <li data-kind="new"><span class="kind kind-new">Mới</span><span>Phiên công ty nạp các MCP server đã cài cho Piagent cá nhân, dùng chung login. Server do repo khai báo vẫn cần duyệt; kết quả tới agent dưới dạng dữ liệu.</span></li>
+      <li data-kind="new"><span class="kind kind-new">Mới</span><span>Preset atlassian thêm Jira và Confluence Cloud: piagent-mcp --preset atlassian, rồi /mcp-auth atlassian bằng tài khoản Atlassian của bạn.</span></li>
+      <li data-kind="new"><span class="kind kind-new">Mới</span><span>run_on_simulator boot simulator, build, cài và mở app, chạy XCUITest, chụp màn hình, đọc log: xcrun simctl, xcodebuild, adb, emulator, gradlew, flutter, expo.</span></li>
+      <li data-kind="security"><span class="kind kind-security">Bảo mật</span><span>run_on_simulator từ chối chương trình khác, ;, &amp;, $( ) và file ngoài project. Full access và Bypass chạy luôn, nhưng vẫn hỏi khi lệnh đụng tới credentials.</span></li>
+    </ul>
+  </div>
+</article>
+<article class="release" id="v1-46-4" data-release>
   <div class="release-meta"><a class="release-version" href="#v1-46-4">v1.46.4</a><time class="release-date" datetime="2026-10-29">29/10/2026</time></div>
   <div class="release-body">
     <h3 data-toc-skip id="v1-46-4-title">Một subagent thay vì bị chặn; bản cập nhật đọc được models.json có comment</h3>
@@ -405,26 +418,25 @@
     </ul>
   </div>
 </article>
-<article class="release" id="v1-41-0" data-release>
-  <div class="release-meta"><a class="release-version" href="#v1-41-0">v1.41.0</a><time class="release-date" datetime="2026-10-24">24/10/2026</time></div>
-  <div class="release-body">
-    <h3 data-toc-skip id="v1-41-0-title">Báo cáo thay đổi giao diện với ảnh trước/sau</h3>
-    <p>Skill mới biến task front-end thành báo cáo có ảnh trước/sau được khoanh khung, thay đổi business và logic, kết quả check, hiện ngay trên dashboard.</p>
-    <ul class="release-items">
-      <li data-kind="new"><span class="kind kind-new">Mới</span><span>Skill <code>fe-change-report</code> chụp trang cũ và mới ở chế độ headless trên cùng dữ liệu, khoanh từng thay đổi bằng khung đỏ đánh số trên cả hai ảnh.</span></li>
-      <li data-kind="new"><span class="kind kind-new">Mới</span><span>Agent chạy check của project và toàn bộ E2E headless, ghi rõ lỗi có từ trước, rồi viết lại thay đổi về business, logic và giao diện.</span></li>
-      <li data-kind="new"><span class="kind kind-new">Mới</span><span>Tài liệu trên dashboard vẽ <code>reports/fe-change/&lt;slug&gt;/report.json</code> thành báo cáo, có phóng to từng khung, kích thước màn hình khác và toàn màn hình.</span></li>
-      <li data-kind="new"><span class="kind kind-new">Mới</span><span>Script dùng Playwright có sẵn của project, không thêm dependency, và xuất một file <code>report.html</code> độc lập, không có script, để gửi cho bất kỳ ai.</span></li>
-      <li data-kind="security"><span class="kind kind-security">Bảo mật</span><span>Báo cáo được vẽ từ dữ liệu, không từ file HTML, và chỉ ảnh PNG của nó được trả về, nên dashboard vẫn không hiển thị markup do model tạo.</span></li>
-    </ul>
-  </div>
-</article>
 </section>
 <section class="section archive">
   <h2 id="archive">Các bản trước</h2>
   <p class="section-lead">Bản cũ hơn, gom theo tháng. Mở một tháng để xem từng thay đổi.</p>
   <details class="release-archive">
-    <summary><span>Tháng 10/2026</span><span class="archive-count">61</span></summary>
+    <summary><span>Tháng 10/2026</span><span class="archive-count">62</span></summary>
+    <div class="archive-row" id="v1-41-0">
+      <div class="archive-head"><a class="release-version" href="#v1-41-0">v1.41.0</a> <span class="release-date">24/10/2026</span></div>
+      <div class="archive-body">
+        <p><strong>Báo cáo thay đổi giao diện với ảnh trước/sau</strong> — Skill mới biến task front-end thành báo cáo có ảnh trước/sau được khoanh khung, thay đổi business và logic, kết quả check, hiện ngay trên dashboard.</p>
+        <ul class="release-items">
+        <li data-kind="new"><span class="kind kind-new">Mới</span><span>Skill <code>fe-change-report</code> chụp trang cũ và mới ở chế độ headless trên cùng dữ liệu, khoanh từng thay đổi bằng khung đỏ đánh số trên cả hai ảnh.</span></li>
+        <li data-kind="new"><span class="kind kind-new">Mới</span><span>Agent chạy check của project và toàn bộ E2E headless, ghi rõ lỗi có từ trước, rồi viết lại thay đổi về business, logic và giao diện.</span></li>
+        <li data-kind="new"><span class="kind kind-new">Mới</span><span>Tài liệu trên dashboard vẽ <code>reports/fe-change/&lt;slug&gt;/report.json</code> thành báo cáo, có phóng to từng khung, kích thước màn hình khác và toàn màn hình.</span></li>
+        <li data-kind="new"><span class="kind kind-new">Mới</span><span>Script dùng Playwright có sẵn của project, không thêm dependency, và xuất một file <code>report.html</code> độc lập, không có script, để gửi cho bất kỳ ai.</span></li>
+        <li data-kind="security"><span class="kind kind-security">Bảo mật</span><span>Báo cáo được vẽ từ dữ liệu, không từ file HTML, và chỉ ảnh PNG của nó được trả về, nên dashboard vẫn không hiển thị markup do model tạo.</span></li>
+        </ul>
+      </div>
+    </div>
     <div class="archive-row" id="v1-40-0">
       <div class="archive-head"><a class="release-version" href="#v1-40-0">v1.40.0</a> <span class="release-date">24/10/2026</span></div>
       <div class="archive-body">

package/docs-site/windows.html

@@ -37,7 +37,7 @@
         <span class="brand-mark"><img src="/assets/piagent-logo.svg" alt="" width="28" height="28" /></span>
         <span class="brand-name"><b>Piagent</b> <span>Platform</span></span>
       </a>
-      <a class="version-badge" href="/whats-new" data-docs-version="v1.46.4" title="v1.46.4 docs · VI"><span class="dot"></span>v1.46.4</a>
+      <a class="version-badge" href="/whats-new" data-docs-version="v1.47.0" title="v1.47.0 docs · VI"><span class="dot"></span>v1.47.0</a>
       <nav class="top-nav" aria-label="Tài liệu">
         <a href="/quickstart">Tài liệu</a>
         <a href="/whats-new">Changelog</a>

package/docs-site/workflows.html

@@ -37,7 +37,7 @@
         <span class="brand-mark"><img src="/assets/piagent-logo.svg" alt="" width="28" height="28" /></span>
         <span class="brand-name"><b>Piagent</b> <span>Platform</span></span>
       </a>
-      <a class="version-badge" href="/whats-new" data-docs-version="v1.46.4" title="v1.46.4 docs · VI"><span class="dot"></span>v1.46.4</a>
+      <a class="version-badge" href="/whats-new" data-docs-version="v1.47.0" title="v1.47.0 docs · VI"><span class="dot"></span>v1.47.0</a>
       <nav class="top-nav" aria-label="Tài liệu">
         <a href="/quickstart">Tài liệu</a>
         <a href="/whats-new">Changelog</a>

package/evals/private-holdout-v1/public-exposure.v2.json

@@ -256,8 +256,8 @@
     },
     {
       "path": "tests",
-      "fileCount": 636,
-      "sha256": "7d8a3af48dd9179f3bf3921cae65d3e6d18d17ff87d3454c29247f8cf1b34b63"
+      "fileCount": 638,
+      "sha256": "74109d76ee46eeb519070b53699a7e582a3705c74030e9ca067242566afbb5df"
     }
   ],
   "custodianComparisonRules": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@piagent/platform",
-  "version": "1.46.4",
+  "version": "1.47.0",
   "license": "MIT",
   "publishConfig": {
     "access": "public",

package/packages/piagent-core/extensions/piagent-guard.ts

@@ -38,15 +38,8 @@ import {
 import { detectProfileName } from "./project-shape.js";
 import { evaluateUpdateCheck, isInstalledPlatform, readUpdateCache, startUpdateProbe } from "./update-check.js";
 import { dormantInPersonalPi, personalPiAgentDir } from "./agent-home.js";
-import {
-  REPOSITORY_SCOPES,
-  collectServers,
-  configPathForScope,
-  mcpDecisionInputs,
-  unverifiableMcpConfig
-} from "../mcp/mcp-config-layers.js";
-import { attributeDirectTool } from "../mcp/mcp-tool-naming.js";
-import { approvalState } from "../mcp/mcp-approval-store.js";
+import { collectServers } from "../mcp/mcp-config-layers.js";
+import { evaluateMcpApproval, mcpApprovalCache } from "../runtime/mcp-repository-gate.mjs";
 import { evaluateServerReadiness, readinessNotice } from "../mcp/mcp-auth-readiness.js";
 import * as mcpActions from "../mcp/mcp-command-actions.js";
 import { buildExtendingProfile, resolveProjectProfileDocument } from "../capabilities/project-profile.js";
@@ -1789,143 +1782,6 @@ function prepareToolInputForPolicy(
   };
 }
 
-// Which MCP server a tool call is addressed to. The adapter exposes one proxy
-// tool named `mcp` that carries the server in `input.server`, and, under
-// directTools, one tool per server tool named `<prefix>_<tool>` where the prefix
-// is derived from the server name. Direct names are matched against the servers
-// this gate is holding rather than against a fixed pattern, because the prefix
-// is the server's own name and there is nothing constant to anchor on.
-function mcpServerFromToolCall(
-  toolName: string,
-  input: Record<string, unknown>,
-  candidates: Iterable<string>
-): string | undefined {
-  if (normalizeActionToken(toolName) === "mcp") {
-    return typeof input.server === "string" && input.server.trim() ? input.server.trim() : undefined;
-  }
-  return attributeDirectTool(toolName, candidates);
-}
-
-// Servers a repository defines are not usable until somebody on this machine has
-// approved them. This is the enforcement point: the adapter owns the connection
-// and this extension cannot prevent one being opened, but no tool call reaches an
-// unapproved server. The residual exposure is the connection itself, which is
-// worth stating plainly rather than describing this as a full block.
-//
-// Recomputed only when one of the files behind the decision changes, because
-// this runs on every tool call.
-interface RepositoryMcpGate {
-  blocked: Map<string, { state: string; origin: string }>; serverNames: Set<string>;
-  // Conditions under which no tool call can be checked at all, each with the
-  // sentence to show. These are not "a server is unapproved" — they are "this
-  // repository's config has put the gate in a state where it cannot tell which
-  // server a call belongs to", and the only sound answer to that is to stop.
-  unverifiable: string[];
-}
-
-const mcpApprovalCache = new Map<string, { signature: string; gate: RepositoryMcpGate }>();
-
-function repositoryMcpGate(cwd: string): RepositoryMcpGate {
-  // Repository scopes plus anything an `imports` key drags in from a file the
-  // clone carries. Collecting those here is the whole point: a server the gate
-  // never enumerates is a server it silently permits.
-  const servers = collectServers({ projectPath: cwd, scopes: [...REPOSITORY_SCOPES] });
-  const repositoryFiles = [...REPOSITORY_SCOPES].map((scope) => ({
-    scope,
-    file: configPathForScope(scope, { projectPath: cwd })
-  }));
-  // Every file the decision reads, listed by the module that reads them rather
-  // than restated here. Building this by hand is what went wrong: the scan grew
-  // to read merged settings from all four scopes and to stat import targets
-  // outside the repository, the hand-written list did not, and an already-loaded
-  // guard went on permitting calls after a personal global config had put the
-  // session in the state this gate exists to refuse.
-  const signature = [
-    ...servers.map((server) => `${server.origin}:${server.name}:${fileSignature(server.file)}`),
-    ...repositoryFiles.map((layer) => `layer:${layer.scope}:${fileSignature(layer.file)}`),
-    ...mcpDecisionInputs({ projectPath: cwd }).map((file) => `input:${file}:${fileSignature(file)}`),
-    `store:${fileSignature(path.join(os.homedir(), ".pi", "piagent-mcp-approvals.json"))}`
-  ].join("|");
-  const cached = mcpApprovalCache.get(cwd);
-  if (cached?.signature === signature) return cached.gate;
-
-  const blocked = new Map<string, { state: string; origin: string }>();
-  for (const server of servers) {
-    const state = approvalState({ projectPath: cwd, name: server.name, entry: server.entry });
-    if (state.state === "approved") continue;
-    // A name defined more than once keeps its blocking entry: the approved copy
-    // does not vouch for the one nobody has looked at.
-    blocked.set(server.name, { state: state.state, origin: server.origin });
-  }
-
-  // Two things a repository-carried config can do that leave nothing to check.
-  //
-  // It can ask for tools with no prefix, so a direct tool arrives under a bare
-  // name carrying no evidence of its server. Refusing only the proxy there was
-  // not a fix: the proxy is the one form that names its server, so blocking it
-  // and allowing the bare names left the hole exactly where it was.
-  //
-  // It can also import a kind whose config this platform cannot enumerate, and
-  // then the set of servers reaching the session is simply unknown. Blocking the
-  // servers that could be listed says nothing about the ones that could not.
-  //
-  // Both stop every tool call. A repository can make a session refuse to run;
-  // it must not be able to make one run a server nobody approved.
-  // Read from the shared module rather than decided here, so `piagent-mcp
-  // doctor` reports exactly what this refuses. The two disagreeing is how an
-  // operator ends up reading "PASS" while every tool call is being stopped.
-  const unverifiable = unverifiableMcpConfig({ projectPath: cwd }).map((problem) => problem.detail);
-
-  const gate = { blocked, serverNames: new Set(servers.map((server) => server.name)), unverifiable };
-  mcpApprovalCache.set(cwd, { signature, gate });
-  return gate;
-}
-
-function fileSignature(file: string): string {
-  try {
-    const stat = fs.statSync(file);
-    return `${stat.mtimeMs}:${stat.size}`;
-  } catch {
-    return "absent";
-  }
-}
-
-function evaluateMcpApproval(
-  cwd: string,
-  toolName: string,
-  input: Record<string, unknown>
-): { block: boolean; reason?: string } {
-  const gate = repositoryMcpGate(cwd);
-
-  // Every tool call, not only the ones that look like MCP. Under either of these
-  // conditions a call cannot be traced to a server, so there is no such thing as
-  // a call this gate can clear.
-  if (gate.unverifiable.length > 0) {
-    return { block: true, reason: `Blocked every tool call: ${gate.unverifiable.join(" ")}` };
-  }
-
-  const server = mcpServerFromToolCall(toolName, input, gate.blocked.keys());
-  if (!server) return { block: false };
-  const record = gate.blocked.get(server);
-  if (!record) return { block: false };
-  const explanation = record.state === "rejected"
-    ? "it was rejected for this project"
-    : record.state === "changed"
-      ? "its definition changed since it was approved"
-      : record.origin.startsWith("import:")
-        ? `this repository imports it from ${record.origin.slice("import:".length)} config and nobody on this machine has approved it here`
-        : "this repository defines it and nobody on this machine has approved it";
-  return {
-    block: true,
-    // Named as commands, because this is read inside a session: the reader can
-    // run these where they already are, without shelling out.
-    reason:
-      `Blocked MCP server ${server}: ${explanation}. ` +
-      `Review it with \`/piagent-mcp get ${server}\`, then \`/piagent-mcp approve ${server}\` to allow it ` +
-      `or \`/piagent-mcp reject ${server}\` to refuse it.`
-  };
-}
-
 // A word whose final path segment glues literal text onto an expansion --
 // `.en$(echo v)`, `${D}.env` -- names a file this process cannot know without
 // running the substitution. Matching the literal half against the protected

package/packages/piagent-core/managed/command-tools.mjs

@@ -4,6 +4,7 @@ import { engineAlive, engineLauncher } from './container-engine.mjs';
 import { MEMBER_ONLY, memberOnlyReason, credentialReason, runHostCommand } from './host-command.mjs';
 import { processTools } from './background-process.mjs';
 import { checkpointsOf } from './checkpoints.mjs';
+import { detachedEmulator, simulatorCommandReason } from './simulator-commands.mjs';
 
 // Commands that leave the plain sandbox, each after the member approves that
 // exact command: run_with_network (internet, a local server or browser),
@@ -40,6 +41,16 @@ const KINDS = {
     // credentials: a prompt injection's "cat ~/.ssh/id_rsa" is never silent.
     confirm: async (self, command) => asksNothing(self) ? credentialReason(command) : await networkConfirmation(self, command) ?? 'ask',
   },
+  // The sandbox reaches neither CoreSimulator nor adb. Simulator and app build
+  // commands only (simulator-commands.mjs), asked about as network commands:
+  // Full access and Bypass run them, except what reaches credentials.
+  simulator: {
+    name: 'run_on_simulator', label: 'Run on simulator', scope: 'simulator-command-once', provider: 'host', riskClass: 'medium',
+    description: 'Run one iOS Simulator or Android emulator command on the member\'s machine, outside the sandbox. iOS: xcrun simctl (list, boot, bootstatus -b, install, launch, terminate, openurl, io <device> screenshot <file>, ui appearance, status_bar, spawn <device> log show --info --last 5m --predicate \'process == "<App>"\'), xcodebuild with a simulator destination (build, test: XCUITest is the reliable way to tap, type and answer system dialogs), xcodegen generate, axe (describe-ui reads the screen\'s elements; tap, type, swipe where this Xcode accepts them), open -a Simulator (some Xcode versions run simulators without that window; the device works without it). Android: adb (devices, install, shell am start, shell input tap/text/swipe, exec-out screencap -p > <file>, logcat -d), emulator -avd <name> (started in the background), avdmanager, ./gradlew installDebug. Also flutter, pod install, npx expo/react-native/cap, mkdir -p and cd inside the project. Parts may be joined by && or || and piped into grep, head, tail, xcbeautify or jq; files may be written only inside the project or to /dev/null. Read a screenshot you saved with read to see the screen. Other commands: run_on_host.',
+    allow: 'Run this exact simulator or app build command once on this machine, outside the sandbox: a build can run the project\'s build scripts as you.',
+    title: 'Chạy lệnh simulator', allowText: 'chạy đúng lệnh simulator/build app này một lần trên máy bạn, ngoài sandbox: build có thể chạy script build của project bằng quyền của bạn.',
+    confirm: async (self, command) => credentialReason(command) ?? await networkConfirmation(self, command),
+  },
 };
 
 // The engine answers, looked up again when it did not (started since).
@@ -66,6 +77,8 @@ function commandTool(self, kind) {
       if (kind === 'docker' && !await engineReady(self.boundary)) throw Error(DOCKER_STOPPED);
       const memberOnly = kind === 'host' ? memberOnlyReason(args.command) : null;
       if (memberOnly) throw Error(MEMBER_ONLY(memberOnly));
+      const notSimulator = kind === 'simulator' ? simulatorCommandReason(args.command, self.cwd) : null;
+      if (notSimulator) throw Error(`managed-simulator-command: ${notSimulator}.`);
       const confirm = await spec.confirm(self, args.command);
       if (confirm !== null) await approve(self, id, signal, ctx, { toolName: spec.name, rawAction: { command: args.command }, commandPreview: String(args.command),
         provider: spec.provider, requestedScope: spec.scope, reason: (confirm === 'ask' ? String(args.reason) : `Full access still asks: ${confirm}. ${args.reason}`).slice(0, 300), riskClass: spec.riskClass,
@@ -75,7 +88,8 @@ function commandTool(self, kind) {
       if (self.run) await checkpointsOf(self).take();
       const before = await self.changedFiles();
       try {
-        const result = kind === 'host' ? await runHostCommand({ command: args.command, cwd: self.cwd, userHome: self.boundary.userHome, timeout: args.timeout, signal, onUpdate })
+        const result = kind === 'simulator' && detachedEmulator(args.command) ? await runHostCommand({ command: `nohup ${args.command} >/dev/null 2>&1 & sleep 3; echo "Emulator started in the background; wait for it with: adb wait-for-device"`, cwd: self.cwd, userHome: self.boundary.userHome, timeout: 60, signal, onUpdate })
+          : kind === 'host' || kind === 'simulator' ? await runHostCommand({ command: args.command, cwd: self.cwd, userHome: self.boundary.userHome, timeout: args.timeout, signal, onUpdate })
           : await self.boundary.invoke('bash', { command: args.command, ...(args.timeout ? { timeout: args.timeout } : {}) }, signal, onUpdate, ctx?.model, kind === 'docker' ? { docker: true } : { network: true });
         ok = !result?.isError; return result;
       } finally {
@@ -115,14 +129,14 @@ function startDockerTool(self, { wait = 180_000, every = 2000, launcher: found =
 
 export function commandTools(self, options) {
   const docker = self.boundary.engine || self.boundary.dockerCli;
-  return [commandTool(self, 'network'), ...(docker ? [commandTool(self, 'docker')] : []), startDockerTool(self, options), commandTool(self, 'host'), ...processTools(self)];
+  return [commandTool(self, 'network'), ...(docker ? [commandTool(self, 'docker')] : []), startDockerTool(self, options), commandTool(self, 'host'), commandTool(self, 'simulator'), ...processTools(self)];
 }
 
 // What the system prompt says about services and what the sandbox blocks: it
 // is read for every request, so a Docker started since shows up.
 const HOST_PROMPT = ' When the sandbox blocks something the task needs (a missing runtime such as a JDK or a Node version, the member\'s sign-in for git pull or git push or a private registry, a file outside the project), do not stop and do not tell the member to run it: request run_on_host with the exact command; it runs on the member\'s machine once they approve. Only what needs the member themselves (their password for sudo or an installer, an interactive sign-in, a window to click) goes to ask_user, with the exact steps and the options to continue or skip; after their answer, check and carry on.';
 export function servicesPrompt(boundary) {
-  const simulator = ' The iOS Simulator is not available in the sandbox: ask the member with ask_user to run those tests.';
+  const simulator = ' The iOS Simulator and Android emulator are not reachable from bash: boot them, build and install the app, launch it, tap and type, and take screenshots with run_on_simulator (save the screenshot in the project, then read it to see the screen). Do not ask the member to run simulator steps you can run.';
   if (boundary.engine) return ' Docker is available through run_with_docker (the member approves each command): a database or service for tests (docker compose up -d, then the tests through bash or run_with_network), docker build, or Testcontainers tests. If the engine stops answering, start_docker asks the member to start it. Stop what you started when done unless the member wants it kept.' + simulator + HOST_PROMPT;
   if (boundary.dockerCli) return ' Docker is installed but not running: when the task needs it, call start_docker (the member approves), then run_with_docker.' + simulator + HOST_PROMPT;
   return ' Docker is not installed on this machine: when the task needs it, ask the member with ask_user (install it, or check another way).' + simulator + HOST_PROMPT;

package/packages/piagent-core/managed/member-mcp.mjs

@@ -0,0 +1,71 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { evaluateMcpApproval } from '../runtime/mcp-repository-gate.mjs';
+import { userToolchains } from './toolchain.mjs';
+import { fenced } from './untrusted.mjs';
+
+// The member's MCP servers in company sessions. Company sessions load no Pi
+// extension of the member's, with one exception: the MCP adapter Piagent
+// installs (pi-mcp-adapter in Piagent's own Pi home). It reads the same
+// configuration as personal Piagent (piagent-mcp add, ~/.config/mcp/mcp.json,
+// a project's .mcp.json, /mcp) and the same logins (/mcp-auth), so a server the
+// member added once works in both. The member decides which servers exist;
+// company sessions keep the two protections personal Piagent has: a server a
+// repository defines runs only once someone on this machine approved it, and
+// what a server returns reaches the agent as data, not instructions.
+
+const ADAPTER = 'pi-mcp-adapter';
+const readJson = file => { try { return JSON.parse(fs.readFileSync(file, 'utf8')); } catch { return null; } };
+const inside = (file, dir) => { const relative = path.relative(dir, file); return !!relative && !relative.startsWith('..') && !path.isAbsolute(relative); };
+
+// The adapter the member installed in Piagent's Pi home and still lists among
+// its packages, or null. `piagent studio` starts from a cleared environment, so
+// the home is the default one (~/.piagent/agent) unless a caller names another.
+export function memberMcpAdapter(home = os.homedir(), agentDir = path.join(home, '.piagent', 'agent')) {
+  const packages = readJson(path.join(agentDir, 'settings.json'))?.packages;
+  const listed = Array.isArray(packages) && packages.some(entry => new RegExp(`(^|[:/])${ADAPTER}(@|$)`).test(String(typeof entry === 'string' ? entry : entry?.source ?? '')));
+  const dir = path.join(agentDir, 'npm', 'node_modules', ADAPTER);
+  if (!listed || !fs.existsSync(path.join(dir, 'package.json'))) return null;
+  return { agentDir, dir: fs.realpathSync(dir) };
+}
+
+// What the adapter and the servers it starts need from a cleared environment:
+// Piagent's Pi home (its mcp.json, logins and caches, shared with personal
+// Piagent) and a PATH that finds npx, uvx, docker… as in the member's
+// Terminal. Nothing else of the member's shell is passed, as for host commands.
+export function memberMcpEnvironment(adapter, home = os.homedir(), env = process.env) {
+  env.PI_CODING_AGENT_DIR ||= adapter.agentDir;
+  const toolchains = userToolchains(home);
+  const dirs = [...toolchains.bins, path.dirname(process.execPath), '/opt/homebrew/bin', '/usr/local/bin', ...(env.PATH ?? '/usr/bin:/bin').split(':')];
+  env.PATH = [...new Set(dirs.filter(Boolean))].join(':');
+  for (const [name, value] of Object.entries(toolchains.env)) env[name] ||= value;
+  return env;
+}
+
+// The repository approval gate on every tool call (as personal Piagent's
+// guard), and the adapter's results fenced as data.
+export function memberMcpGuard(cwd, adapterDir) {
+  return pi => {
+    const fromAdapter = name => { const source = pi.getAllTools().find(tool => tool.name === name)?.sourceInfo?.path; return !!source && (source === adapterDir || inside(source, adapterDir)); };
+    pi.on('tool_call', event => {
+      const decision = evaluateMcpApproval(cwd, event.toolName, event.input ?? {});
+      return decision.block ? { block: true, reason: decision.reason } : undefined;
+    });
+    pi.on('tool_result', event => {
+      if (!fromAdapter(event.toolName)) return undefined;
+      const text = (event.content ?? []).filter(part => part?.type === 'text').map(part => part.text).join('\n');
+      const images = (event.content ?? []).filter(part => part?.type === 'image');
+      return { content: [{ type: 'text', text: fenced(`Result of MCP tool ${event.toolName}`, text) }, ...images] };
+    });
+  };
+}
+
+// The company session's own extension factories, with the member's MCP added
+// when the adapter is installed: [factories, extension paths] for inlineExtensions.
+export function withMemberMcp(cwd, factories, home = os.homedir()) {
+  const adapter = memberMcpAdapter(home);
+  if (!adapter) return [factories, []];
+  memberMcpEnvironment(adapter, home);
+  return [[...factories, memberMcpGuard(cwd, adapter.dir)], [adapter.dir]];
+}

package/packages/piagent-core/managed/memory-lessons.mjs

@@ -8,7 +8,7 @@ import { createHash } from 'node:crypto';
 import { redactedText } from '../runtime/managed-failure.mjs';
 import { isCheckCommand } from './workflow.mjs';
 
-const COMMAND_TOOLS = new Set(['bash','run_with_network','run_with_docker','run_on_host']);
+const COMMAND_TOOLS = new Set(['bash','run_with_network','run_with_docker','run_on_host','run_on_simulator']);
 const textOf = result => (result?.content ?? []).filter(p => p?.type === 'text').map(p => p.text ?? '').join('\n');
 const clean = (value, max) => redactedText(String(value ?? '')).replace(/\bas_(?:live|run)_[A-Za-z0-9_-]{8,}/g,'[REDACTED_SECRET]').split(os.homedir()).join('~').replace(/\s+/g,' ').trim().slice(0,max);
 const hash = s => createHash('sha256').update(s).digest('hex').slice(0,20);

package/packages/piagent-core/managed/resource-loader.mjs

@@ -26,10 +26,10 @@ export function projectInstructions(cwd, top = cwd) {
 // discovered in a project. Skills and commands are text (agent-skills.mjs):
 // what they ask for runs with the session's own tools.
 // themes: Piagent's own (the company Terminal's /style), loaded by the host.
-export function managedResourceLoader(api, { systemPrompt, extensions = [], runtime = api.createExtensionRuntime(), agentsFiles = [], skills = [], prompts = [], themes = [] } = {}) {
+export function managedResourceLoader(api, { systemPrompt, extensions = [], runtime = api.createExtensionRuntime(), errors = [], agentsFiles = [], skills = [], prompts = [], themes = [] } = {}) {
   const empty = Object.freeze([]);
   return Object.freeze({
-    getExtensions: () => ({ extensions, errors: empty, runtime }),
+    getExtensions: () => ({ extensions, errors: [...errors], runtime }),
     getSkills: () => ({ skills: [...skills], diagnostics: empty }),
     getPrompts: () => ({ prompts: [...prompts], diagnostics: empty }),
     getThemes: () => ({ themes: [...themes], diagnostics: empty }),
@@ -45,12 +45,24 @@ export function managedResourceLoader(api, { systemPrompt, extensions = [], runt
 
 // Extensions the company Terminal adds itself (its commands and how Harness
 // notes read), built the way Pi builds an inline extension. Never project code.
-export async function inlineExtensions(api, sdkRoot, cwd, factories = []) {
+// `paths`: installed extensions loaded the way Pi loads a package's (only the
+// member's MCP adapter, member-mcp.mjs); one that fails to load is reported in
+// `errors` and the session opens without it.
+export async function inlineExtensions(api, sdkRoot, cwd, factories = [], paths = []) {
   const runtime = api.createExtensionRuntime();
-  if (!factories.length) return { extensions: [], runtime };
+  if (!factories.length && !paths.length) return { extensions: [], runtime };
   const load = (file) => import(pathToFileURL(path.join(sdkRoot, 'dist', ...file.split('/'))).href);
-  const [{ loadExtensionFromFactory }, { createEventBus }] = await Promise.all([load('core/extensions/loader.js'), load('core/event-bus.js')]);
-  const bus = createEventBus(), extensions = [];
+  const [{ loadExtensionFromFactory, loadExtensions }, { createEventBus }] = await Promise.all([load('core/extensions/loader.js'), load('core/event-bus.js')]);
+  const bus = createEventBus(), extensions = [], errors = [];
   for (const [index, factory] of factories.entries()) extensions.push(await loadExtensionFromFactory(factory, cwd, bus, runtime, `<inline:company-terminal-${index + 1}>`));
-  return { extensions, runtime };
+  if (paths.length) {
+    // Pi's theme exists only once a terminal draws; the MCP adapter colours its
+    // status line with it in every mode, and without one (RPC, the WebUI) its
+    // start failed. The Terminal sets its own theme later.
+    const { theme, initTheme } = await load('modes/interactive/theme/theme.js');
+    try { void theme.fg; } catch { initTheme(); }
+    try { const loaded = await loadExtensions(paths, cwd, bus, runtime); extensions.push(...loaded.extensions); errors.push(...loaded.errors); }
+    catch (error) { errors.push({ path: paths.join(', '), error: error instanceof Error ? error.message : String(error) }); }
+  }
+  return { extensions, runtime, errors };
 }

package/packages/piagent-core/managed/sandbox-diagnostic.mjs

@@ -21,11 +21,15 @@ const DOCKER_DAEMON = /Cannot connect to the Docker daemon|connect to the docker
 // A runtime or tool the command needs is not on this machine (or not the
 // version the project asks for).
 const TOOLCHAIN = /Unable to locate a Java Runtime|No Java runtime present|JAVA_HOME is not (?:set|defined correctly)|(?:^|\n)\S*?(?:ba|z)?sh: (?:line \d+: )?[\w.+-]+: command not found|zsh: command not found: [\w.+-]+|xcrun: error: (?:unable to find utility|invalid active developer path)|env: '?[\w.+-]+'?: No such file or directory|Unsupported class file major version|invalid target release: \d+|release version \d+ not supported|requires? (?:at least )?Java \d+|The engine "node" is incompatible|Unsupported engine/i;
+// The iOS Simulator (CoreSimulator) and Android's adb/emulator, which the
+// sandbox does not reach.
+const SIMULATOR = /CoreSimulator|simctl|Unable to boot device|Unable to lookup in current state|Failed to start launchd_sim|adb: (?:cannot connect|failed to check server version|no devices|device offline)|cannot connect to daemon|\bemulator: (?:ERROR|PANIC)|Unable to find a destination matching|xcodebuild: error: Unable to find a destination/i;
 // The member's sign-in, which the sandbox does not have.
 const SIGN_IN = /could not read (?:Username|Password) for|terminal prompts disabled|Authentication failed for|Permission denied \(publickey|Host key verification failed|not logged into any GitHub hosts|please run:\s+gh auth login|Could not open a connection to your authentication agent|\bENEEDAUTH\b|\bE401\b|\b401 Unauthorized|requires authentication|denied: requested access to the resource is denied|pull access denied/i;
 
 export function sandboxDiagnostic(message, { network = false, isolated = false, docker = false, engine = false } = {}) {
   const text=String(message);
+  if(!network&&SIMULATOR.test(text))return 'managed-simulator-unreachable: Lệnh bash trong sandbox không tới được iOS Simulator hay Android emulator. Chạy lệnh simulator (xcrun simctl, xcodebuild cho simulator, adb, emulator, ./gradlew installDebug, flutter, npx expo) bằng run_on_simulator.\n'+text;
   if(docker&&DOCKER_DAEMON.test(text))return 'managed-docker-unreachable: Lệnh chạy với Docker nhưng Docker engine không trả lời (Docker Desktop/Colima/OrbStack chưa chạy hoặc đang khởi động). Gọi start_docker để xin member duyệt mở Docker, rồi chạy lại đúng lệnh này bằng run_with_docker.\n'+text;
   if(!docker&&DOCKER_DAEMON.test(text))return (engine?'managed-docker-blocked: Lệnh bash thường không dùng được Docker trong chế độ công ty. Lệnh docker, docker compose, hoặc test cần Docker (Testcontainers) chạy qua run_with_docker để người dùng duyệt đúng lệnh đó.\n':'managed-docker-unavailable: Docker engine trên máy chưa chạy. Gọi start_docker để xin member duyệt mở Docker, rồi chạy lệnh bằng run_with_docker.\n')+text;
   if(TOOLCHAIN.test(text))return 'managed-toolchain-missing: Máy thiếu runtime/công cụ mà lệnh cần, hoặc sai version project yêu cầu. Đừng dừng ở đây: xem project cần gì (pom.xml, build.gradle, .nvmrc, .tool-versions, package.json engines…) rồi dùng run_on_host để xin member duyệt cài trên máy (ví dụ brew install openjdk@21, brew install node@22, sdk install java 21-tem), sau đó chạy lại lệnh. Nếu project build được trong Docker thì có thể đề xuất run_with_docker. Trình cài cần mật khẩu (sudo, file .pkg) thì hỏi member bằng ask_user.\n'+text;

package/packages/piagent-core/managed/session.mjs

@@ -24,7 +24,7 @@ import { readPatchDigest, readPatchSnapshot, readChangedFiles, readHead } from '
 import { memberTurn } from './continuation.mjs';
 import { workflowPolicy, repositoryChecks, sessionPlanTool, currentPlan, workflowPrompt, RunProcess, completionGate, pendingBaseline, pendingPaths, pendingHead, processEditTools } from './workflow.mjs';
 import { workflowContextTool, workflowContextExtension } from './workflow-context.mjs';
-import { beforeDelegate, resolveTool } from './objections.mjs'; import { fanOut, withDroppedNote } from './copies.mjs';
+import { beforeDelegate, resolveTool } from './objections.mjs'; import { fanOut, withDroppedNote } from './copies.mjs'; import { withMemberMcp } from './member-mcp.mjs';
 import { HELPER_CALLS, HELPER_ROLES, helperRoles, helperPrompt, webPrompt, delegateDescription, mainWebLookups, limitedWebTools } from './helper-roles.mjs'; import { delegateParameters, delegateArgs, SPEC_PROMPT } from './helper-settlement.mjs';
 import { loadAgentResources } from './agent-skills.mjs';
 import { loadPiagentThemes } from '../runtime/terminal/terminal-style.mjs';
@@ -137,8 +137,8 @@ export class ManagedSession {
     self.checks = repositoryChecks(agentsFiles, self.cwd, self.boundary.repositoryTop);
     // The Harness workflow (possibly changed on a later enrollment) adds its process to the prompt.
     const loader = managedResourceLoader(api, { systemPrompt: () => BASE_PROMPT + referencePrompt(self.boundary.userHome) + TEST_PROMPT + servicesPrompt(self.boundary) + webPrompt(helperRoles(manifest), mainWebLookups(manifest)) + helperPrompt(helperRoles(self.manifest)) + workflowPrompt(workflowPolicy(self.manifest), self.checks), agentsFiles,
-      skills: self.resources.skills, prompts: self.resources.prompts, themes: terminalExtensions.length ? await loadPiagentThemes(sdk) : [], ...await inlineExtensions(api, sdk, self.cwd,
-        [...terminalExtensions, workflowContextExtension(self.cwd, () => self.session.sessionManager)]) });
+      skills: self.resources.skills, prompts: self.resources.prompts, themes: terminalExtensions.length ? await loadPiagentThemes(sdk) : [], ...await inlineExtensions(api, sdk, self.cwd, // and the member's MCP servers (member-mcp.mjs)
+        ...withMemberMcp(self.cwd, [...terminalExtensions, workflowContextExtension(self.cwd, () => self.session.sessionManager)])) });
     const settings = api.SettingsManager.inMemory({ retry: { enabled: false, provider: { maxRetries: 0 } }, cacheWarming: 'off', enableInstallTelemetry: false, enableAnalytics: false, enableSkillCommands: true });
     const manager = sessionManager ?? api.SessionManager.inMemory(self.cwd); attachMemory(self, manager, agentDir, g => verifyGrant(g, self.manifest, 'main')); self.studioLink = new StudioLink({ origin: self.origin, agentDir, notify: event => self.notify(event), ui: () => self.session?.extensionRunner?.getUIContext?.() });
     const scope = scopeOf(self.origin, manifest);