@piagent/platform 1.46.4 → 1.48.0

package/CHANGELOG.md

@@ -4,6 +4,43 @@ Every release of Pi Agent Platform (`@piagent/platform`), newest first. Versions
 
 This file is generated from `docs-site/releases.json` by `node scripts/build-docs-site.mjs`, which also renders the [Changelog page](https://piagent.io.vn/en/whats-new). Edit the JSON, not this file. When publishing a tag, copy the version's block into the GitHub Release.
 
+## v1.48.0 - 2026-10-30
+
+**Bypass stops at the handoff: every mode asks before work leaves the machine.** Pushes, pull requests, publishes and deploys are always approved by you, commands are checked against a full shell syntax tree, approvals gain session and stop answers, and the dashboard streams more smoothly.
+
+### Added
+
+- Approvals offer four answers: allow once, allow the same exact action for the session, deny, and deny and stop the turn. A handoff is always approved one at a time.
+- Projects can refuse commands with autoDeny in .pi/piagent-profile.json. The rules hold in every mode, Bypass included; terminate also ends the agent's turn.
+
+### Improved
+
+- Smoother dashboard: a streaming answer redraws only its last paragraph, sidebar rows redraw only when they change, and a dropped connection is noticed and restored sooner.
+
+### Fixed
+
+- Approval cards, the dashboard, the terminal and the docs describe each access mode exactly as it behaves; personal sessions are no longer labelled as sandboxed.
+
+### Security
+
+- Every access mode asks before work leaves this machine: git push in any spelling, pull requests and merges, releases, publish, deploy, registry push, ssh and cloud tools, uploads.
+- Bypass runs the work without asking and stops at the handoff, in personal and company sessions alike, including run_on_host with your sign-in and MCP tools that write outside.
+- Commands are read by the policy scanner and a shell syntax tree: a push or a destructive delete inside if/then, a function, case, bash -c, eval or a heredoc is caught.
+
+## v1.47.0 - 2026-10-29
+
+**Company sessions use your MCP servers and drive iOS and Android simulators.** Jira, GitHub and every MCP server you set up for Piagent now work in company sessions, and the agent builds, runs, screenshots and tests mobile apps on simulators itself.
+
+### Added
+
+- Company sessions load the MCP servers set up for personal Piagent, with the same logins. Repository-defined servers still need approval; results reach the agent as data.
+- The atlassian preset adds Jira and Confluence Cloud: piagent-mcp --preset atlassian, then /mcp-auth atlassian with your own Atlassian login.
+- run_on_simulator boots simulators, builds, installs and launches apps, runs XCUITest, takes screenshots and reads logs: xcrun simctl, xcodebuild, adb, emulator, gradlew, flutter, expo.
+
+### Security
+
+- run_on_simulator refuses other programs, ;, &, $( ) and files outside the project. Full access and Bypass run it, but still ask when a command reaches credentials.
+
 ## v1.46.4 - 2026-10-29
 
 **One subagent instead of a refused request; update reads a commented models.json.** Company sessions no longer loop on a refused subagent call, and the update no longer stops when the Pi model list file has comments.

package/README.md

@@ -119,9 +119,22 @@ Credentials, trust decisions, sessions, todos and project memory are never remov
 | Profile | Use when | Guard behaviour |
 |---|---|---|
 | `read-only` | Scout, audit, review | Allows `read`, `grep`, `find`, `ls` and piagent state tools; blocks shell, edits and unknown tools. |
-| `workspace-write` | Normal implementation | Default. Protected-path, read-only-path, shell and capability checks; asks before destructive or external actions. |
-| `trusted-full-access` | Trusted local automation | More autonomy, still enforces protected paths, secret redaction, capability lock integrity and destructive/external confirmation. |
-| `bypass` | You accept every risk | No gate asks or blocks. Output is still redacted and every turn keeps its `/undo` checkpoint. Remove it from `permissionProfiles.allowedModes` to forbid it; in company mode the Studio admin can turn it off (`bypass_mode`). |
+| `workspace-write` | Normal implementation | Default. Protected-path, read-only-path, shell and capability checks; asks before destructive steps and the handoff. |
+| `trusted-full-access` | Trusted local automation | More autonomy, still enforces protected paths, secret redaction, capability lock integrity, and asks before destructive steps and the handoff. |
+| `bypass` | The work runs unattended | No gate asks or blocks the work. The handoff is still asked. Output is still redacted and every turn keeps its `/undo` checkpoint. Remove it from `permissionProfiles.allowedModes` to forbid it; in company mode the Studio admin can turn it off (`bypass_mode`). |
+
+The handoff is what sends the work out of this machine: `git push`, creating or merging a pull request, a release, a package publish, a deploy, a registry push, `ssh`, cloud and cluster tools (`vercel`, `aws`, `kubectl`, `terraform`…), uploads, and MCP tools that write to the system behind them. Every mode asks before it, personal and company, Bypass included; one list decides it ([handoff-policy.mjs](packages/piagent-core/runtime/policy/handoff-policy.mjs)). Commands are read twice, by the policy scanner and by a shell syntax tree, so a push or a destructive delete inside a function, a `case` arm, `bash -c`, `eval` or a heredoc substitution is found.
+
+Every approval offers four answers: **Allow once**, **Allow for session** (the same exact action runs without asking until the session ends; never offered for a handoff), **Deny**, and **Deny and stop**, which also ends the agent's turn so it does not try again. The dashboard card shows the four buttons; the terminal shows them as a menu.
+
+A project can refuse commands outright with `autoDeny` in `.pi/piagent-profile.json`. The rules hold in every mode, Bypass included; `terminate` also ends the turn:
+
+```json
+"autoDeny": [
+  { "pattern": "sleep ", "reason": "Do not wait with sleep; background processes report when they end.", "terminate": true },
+  { "pattern": "^npm run seed", "match": "regex", "reason": "Seeding is done by hand." }
+]
+```
 
 Inside Pi use `/permission` (menu), `/permission status`, `/permission read-only`, `/permission workspace-write`, `/permission full-access [task]` or `/permission bypass`. For one run: `PIAGENT_PERMISSION_PROFILE=…` or `piagent-auto --read-only|--workspace-write|--full-access|--bypass`. The guard exposes `piagent_permission_status` to the model.
 

package/README.vi.md

@@ -119,9 +119,22 @@ Credential, trust, session, todo và memory của project không bao giờ bị
 | Profile | Dùng khi | Guard làm gì |
 |---|---|---|
 | `read-only` | Khảo sát, audit, review | Cho `read`, `grep`, `find`, `ls` và tool state của piagent; chặn shell, sửa file và tool lạ. |
-| `workspace-write` | Code bình thường | Mặc định. Kiểm tra protected path, read-only path, shell và capability; hỏi trước việc phá huỷ hay bên ngoài. |
-| `trusted-full-access` | Tự động hoá tin cậy trên máy | Tự chủ hơn, vẫn giữ protected path, che secret, toàn vẹn capability lock và xác nhận việc phá huỷ/bên ngoài. |
-| `bypass` | Bạn chấp nhận mọi rủi ro | Không gate nào hỏi hay chặn. Output vẫn được che secret và mỗi lượt vẫn có checkpoint `/undo`. Bỏ khỏi `permissionProfiles.allowedModes` để cấm; ở chế độ công ty admin Studio tắt được (`bypass_mode`). |
+| `workspace-write` | Code bình thường | Mặc định. Kiểm tra protected path, read-only path, shell và capability; hỏi trước việc phá huỷ và việc bàn giao. |
+| `trusted-full-access` | Tự động hoá tin cậy trên máy | Tự chủ hơn, vẫn giữ protected path, che secret, toàn vẹn capability lock, và hỏi trước việc phá huỷ và việc bàn giao. |
+| `bypass` | Để việc chạy không cần trông | Không gate nào hỏi hay chặn việc làm. Việc bàn giao vẫn hỏi. Output vẫn được che secret và mỗi lượt vẫn có checkpoint `/undo`. Bỏ khỏi `permissionProfiles.allowedModes` để cấm; ở chế độ công ty admin Studio tắt được (`bypass_mode`). |
+
+Việc bàn giao là bước đưa việc ra khỏi máy này: `git push`, tạo hoặc merge pull request, release, publish package, deploy, push lên registry, `ssh`, tool cloud và cluster (`vercel`, `aws`, `kubectl`, `terraform`…), upload, và công cụ MCP ghi vào hệ thống phía sau. Mọi chế độ đều hỏi trước bước này, personal lẫn công ty, kể cả Bypass; một danh sách duy nhất quyết định ([handoff-policy.mjs](packages/piagent-core/runtime/policy/handoff-policy.mjs)). Lệnh được đọc hai lần, bằng bộ quét của policy và bằng cây cú pháp shell, nên lệnh push hay lệnh xoá nguy hiểm nằm trong function, nhánh `case`, `bash -c`, `eval` hay substitution trong heredoc đều bị phát hiện.
+
+Mỗi lần duyệt có bốn lựa chọn: **Cho phép đúng 1 lần**, **Cho cả session** (lệnh giống hệt chạy không hỏi lại tới hết session; không có với việc bàn giao), **Từ chối**, và **Từ chối và dừng**, kết thúc luôn lượt của agent để nó không thử lại. Thẻ trên dashboard có bốn nút; terminal hiện thành menu.
+
+Project có thể chặn hẳn một số lệnh bằng `autoDeny` trong `.pi/piagent-profile.json`. Luật áp dụng ở mọi chế độ, kể cả Bypass; `terminate` kết thúc luôn lượt:
+
+```json
+"autoDeny": [
+  { "pattern": "sleep ", "reason": "Không chờ bằng sleep; tiến trình nền tự báo khi xong.", "terminate": true },
+  { "pattern": "^npm run seed", "match": "regex", "reason": "Seed dữ liệu do người làm bằng tay." }
+]
+```
 
 Trong Pi dùng `/permission` (menu), `/permission status`, `/permission read-only`, `/permission workspace-write`, `/permission full-access [việc]` hoặc `/permission bypass`. Cho một lần chạy: `PIAGENT_PERMISSION_PROFILE=…` hoặc `piagent-auto --read-only|--workspace-write|--full-access|--bypass`.
 

package/docs/command-reference-vietnamese.md

@@ -137,7 +137,7 @@ Các command này đến từ package `piagent-core`; tất cả chạy ngay và
 | `/piagent-update` | Kiểm tra bản Piagent mới ngay (Terminal tự hỏi mỗi giờ, giữa các lượt). | Hỏi "Cập nhật ngay / Để sau"; cập nhật xong nhắc mở lại `pi` hoặc `piagent studio`. Không gọi model. |
 | `/share`, `/bug` | Trong `piagent studio`: bị tắt, chỉ báo lý do. | Hai lệnh này đưa hội thoại và code ra ngoài công ty (GitHub Gist, báo cáo cho nhà phát triển Pi). Dùng `/export` để lưu file trên máy. |
 | `/login`, `/logout`, `/model`, `/scoped-models`, `/thinking`, `/settings` | Trong `piagent studio`: chỉ báo "Harness của team quyết định" (Ctrl+L, Ctrl+P, Shift+Tab cũng vậy). | Model, mức suy luận và cài đặt do Harness trong Agent Studio quyết định; tài khoản là của team qua Agent Watch. `/changelog` hiện "Có gì mới" của Piagent. |
-| `/bypass [on\|off\|status]` | Chỉ trong `piagent studio`: bật/tắt Bypass cho cuộc trò chuyện công ty (giống công tắc trên dashboard). | Bypass: lệnh cần internet chạy luôn, vẫn hỏi việc bắt buộc (đẩy/gửi ra ngoài, migration, xoá không rõ đích, sudo). Footer hiện "Bypass". Không gọi model. |
+| `/bypass [on\|full\|off\|status]` | Chỉ trong `piagent studio`: chọn Bypass, Toàn quyền hoặc Hỏi trước cho cuộc trò chuyện công ty (giống công tắc trên dashboard). | Bypass: việc làm chạy luôn (internet, Docker, lệnh trên máy, migration), chỉ hỏi việc bàn giao (push, PR, publish, deploy, upload, ssh, MCP ghi ra ngoài) và lệnh đụng thông tin đăng nhập. Toàn quyền: hỏi thêm migration, xoá không rõ đích, sudo và từng lệnh trên máy. Footer hiện chế độ. Không gọi model. |
 
 `/piagent-inspector` không thêm bước bắt buộc nào. Panel bốn dòng tự hiện sát
 phía trên footer native từ lúc mở session và dùng working-tree status (bản ghi
@@ -477,8 +477,8 @@ Các lệnh này chạy ngoài Pi.
 | Command | Dùng khi nào |
 |---|---|
 | `npm install -g --ignore-scripts @earendil-works/pi-coding-agent@1.3.0` | Cài Pi CLI tương thích với release hiện tại. |
-| `npm install -g --ignore-scripts @piagent/platform@1.46.4` | Cài terminal helper `piagent-*` từ release tag hiện tại. |
-| `pi install git:github.com/Vt-mmm/piagent@v1.46.4` | Cài pinned release khi cần reproducible team setup. |
+| `npm install -g --ignore-scripts @piagent/platform@1.48.0` | Cài terminal helper `piagent-*` từ release tag hiện tại. |
+| `pi install git:github.com/Vt-mmm/piagent@v1.48.0` | Cài pinned release khi cần reproducible team setup. |
 | `pi install git:github.com/Vt-mmm/piagent` | Cài latest package platform cho máy cá nhân/sandbox. |
 | `piagent pi-host status` | Xem Pi host Piagent đang chạy: bản pin, `pi` riêng của bạn, bản Pi riêng của Piagent. |
 | `piagent pi` | Mở Pi đúng bản Piagent đã kiểm định (vd `1.3.0`) khi `pi` của bạn là bản mới hơn (vd `1.4.0`); `pi` của bạn giữ nguyên. |
@@ -506,7 +506,7 @@ Các lệnh này chạy ngoài Pi.
 | `piagent-auto --full-access -p "<task>"` | Trusted automation style; không tắt protected paths/redaction/human gates. |
 | `/style`, `/style <tên>` | Chọn giao diện Terminal: `system`, `dark`, `light` của Pi và `piagent-ocean`, `piagent-paper`, `piagent-contrast`, `piagent-focus` của Piagent. Pi cá nhân lưu trong settings của Pi; Terminal công ty (`piagent studio`) lưu ở `~/.pi/piagent-terminal-style.json`. |
 | `pi` rồi `/permission full-access <task>` | Một lệnh trong Pi để bật full-access cho session và giao task. Alias `/full-access <task>` vẫn chạy. |
-| `piagent-auto --bypass`, `/permission bypass` | Bypass như Codex: không hỏi, không chặn gì (xoá, push, migration, gửi ra ngoài, file được bảo vệ đều chạy). Output vẫn che secret, `/undo` vẫn hoàn tác từng lượt. Company: `/bypass on` (Bypass), `/bypass full` (Toàn quyền), `/bypass off` (Hỏi trước); admin Studio tắt được Bypass trong Harness, khi đó cuộc trò chuyện chạy như Toàn quyền. |
+| `piagent-auto --bypass`, `/permission bypass` | Bypass: việc làm chạy luôn, không hỏi, không chặn (xoá, migration, file được bảo vệ, lệnh trên máy đều chạy); việc bàn giao vẫn hỏi (git push, tạo/merge PR, publish, deploy, ssh, tool cloud, upload, MCP ghi ra ngoài). Output vẫn che secret, `/undo` vẫn hoàn tác từng lượt. Company: `/bypass on` (Bypass), `/bypass full` (Toàn quyền), `/bypass off` (Hỏi trước); admin Studio tắt được Bypass trong Harness, khi đó cuộc trò chuyện chạy như Toàn quyền. |
 | `pi --list-models` | Xem model Pi thấy được theo credentials hiện tại. |
 | `piagent-install --with-mcp --with-subagents` | Cài global package + MCP + subagent baseline từ package bin. |
 | `piagent-setup <project> --profile auto` | Setup đầy đủ cho một project khi muốn preseed bằng bin. |

package/docs/company-dev-commands.md

@@ -27,7 +27,7 @@ In a git repository, `/undo` in the company Terminal puts back the files the age
 
 ## The company Terminal's screen
 
-`piagent studio` opens with a company header instead of Pi's: the team, the Harness's main model and effort, the review model, Ask first or Bypass, Fast (where the Harness allows it), team memory and the Piagent release. The footer shows the Harness's main model and effort from the start (the granted ones after a run) and no USD cost. While `ask_user` waits for the member the loader reads "Đang chờ bạn trả lời", and the plan is drawn as a checklist (☑ done, ☐ open, ⊘ deferred).
+`piagent studio` opens with a company header instead of Pi's: the team, the Harness's main model and effort, the review model, Ask first, Full access or Bypass, Fast (where the Harness allows it), team memory and the Piagent release. The footer shows the Harness's main model and effort from the start (the granted ones after a run) and no USD cost. While `ask_user` waits for the member the loader reads "Đang chờ bạn trả lời", and the plan is drawn as a checklist (☑ done, ☐ open, ⊘ deferred).
 
 Pi commands that would send the conversation outside the company are refused with a notice: `/share` (a GitHub Gist) and `/bug` (a report to Pi's developers); Pi's "/bug sends a report" hint after errors is not shown. `/login`, `/logout`, `/model`, `/scoped-models`, `/thinking`, `/settings` and the keys that do the same (Ctrl+L, Ctrl+P, Shift+Tab) say that the team's Harness decides. `/changelog` shows Piagent's latest release notes. Personal `pi` is unchanged.
 
@@ -44,7 +44,7 @@ The dashboard composer takes the Terminal's `/` commands. Typing `/` lists them
 | `/thinking <level>` | Thinking level, from the levels this conversation offers |
 | `/model <name>` | Model, by name or ref (personal conversations) |
 | `/permission read-only\|ask\|full` | Access (personal; `full` asks for confirmation) |
-| `/bypass on\|off`, `/fast [on\|off]`, `/undo` | Company conversations: Bypass (`on` asks for confirmation), Fast where the Harness allows it, undo the last turn |
+| `/bypass on\|full\|off`, `/fast [on\|off]`, `/undo` | Company conversations: Bypass (`on`, asks for confirmation), Full access (`full`), Ask first (`off`); Fast where the Harness allows it; undo the last turn |
 | `/changes`, `/settings`, `/help` | Source Changes, Settings, this list |
 
 Shortcuts: ⌘K command palette, ⌘⇧O new chat, ⌘, Settings, ⌘/ opens the `/` commands in the composer, Esc stops the running turn.
@@ -55,7 +55,7 @@ Shortcuts: ⌘K command palette, ⌘⇧O new chat, ⌘, Settings, ⌘/ opens the
 
 ## Needs the member's approval
 
-Each refusal names the tool that asks; nothing below runs silently.
+Each refusal names the tool to use. In Ask first every one of these tools asks; Full access runs `run_with_network`, `run_with_docker`, `run_on_simulator`, `start_docker` and `fetch_origin` without asking, and Bypass runs `run_on_host` too. The handoff (push, pull request, publish, deploy, registry push, `ssh`, cloud tools, uploads, MCP writes) is asked in every mode.
 
 | Work | What the agent is told | Tool |
 |---|---|---|
@@ -63,14 +63,15 @@ Each refusal names the tool that asks; nothing below runs silently.
 | Tests against a localhost server while a local proxy (VPN, corporate proxy) listens | `managed-loopback-blocked` | `run_with_network` |
 | Docker, `docker compose`, Testcontainers | `managed-docker-blocked` / `managed-docker-unavailable` | `run_with_docker`, `start_docker` |
 | `git fetch` from GitHub | — | `fetch_origin` |
-| `git push`, `git pull`, `gh`, private registries, SSH | `managed-credentials-unavailable` | `run_on_host` (asks every time, Bypass included) |
+| `git push`, `git pull`, `gh`, private registries, SSH | `managed-credentials-unavailable` | `run_on_host` (Ask first and Full access ask every command; Bypass asks before a push, pull request, publish, deploy, `ssh` or a command that reaches credentials) |
 | Installing a missing runtime (`brew install openjdk@21`) or Playwright's browsers (`npx playwright install chromium`) | `managed-toolchain-missing` | `run_on_host` |
+| iOS Simulator and Android emulator: `xcrun simctl`, `xcodebuild` for a simulator, `adb`, `emulator`, `./gradlew installDebug`, `flutter`, `pod install`, `npx expo` / `react-native` / `cap`, screenshots saved in the project | `managed-simulator-unreachable` | `run_on_simulator` (asks in Ask mode; Full access and Bypass run it unless it reaches credentials; other programs are refused and go to `run_on_host`) |
 
 ## Not covered yet
 
 - GitHub work beyond `fetch_origin` (pull requests, CI status, review comments) goes through `run_on_host` one command at a time; there is no scoped GitHub tool.
 - Private npm registries, `gh` and SSH-agent operations have no sandboxed path.
 - There is no browser tool of Piagent's own: UI checks use the project's Playwright (owner, 2026-10-15).
-- MCP servers do not run in company sessions (owner, 2026-10-15: later, after a Studio allowlist is designed).
+- MCP servers run in company sessions from the member's own Piagent setup, with no Studio allowlist (owner, 2026-10-29); see docs/mcp-and-tools.md.
 - `start_process` is not offered on Linux and WSL yet.
 - At the end of a turn, a process a bash command left running is found by the marker in its environment; `ps` cannot read that for Apple's own binaries (`/bin/sleep`), so such a process is not stopped until it ends. Processes started with `start_process` are stopped by process group and parent as well.

package/docs/distribution-standard.md

@@ -15,9 +15,9 @@ Repo này phải chạy được cho nhiều project/domain khác nhau. Vì vậ
 
 | Use case | Package source |
 |---|---|
-| Team pinned release | `git:github.com/Vt-mmm/piagent@v1.46.4` |
+| Team pinned release | `git:github.com/Vt-mmm/piagent@v1.48.0` |
 | Personal/sandbox dev | `git:github.com/Vt-mmm/piagent` |
-| Registry distribution | `npm:@piagent/platform@1.46.4` |
+| Registry distribution | `npm:@piagent/platform@1.48.0` |
 | Enterprise npm (fork under another scope) | `npm:@your-scope/platform@x.y.z` |
 | Local platform dev | `/path/to/piagent` |
 
@@ -54,7 +54,7 @@ Root `package.json` có `pi` manifest trỏ tới:
 Do đó team có thể:
 
 ```bash
-pi install git:github.com/Vt-mmm/piagent@v1.46.4
+pi install git:github.com/Vt-mmm/piagent@v1.48.0
 ```
 
 Không cần biết internal folder `packages/piagent-core`. Source không pin chỉ dành cho personal/sandbox như bảng channel ở trên.
@@ -66,12 +66,12 @@ Team nên install global package một lần:
 ```bash
 node --version  # >= 22.19.0
 npm install -g --ignore-scripts @earendil-works/pi-coding-agent@1.3.0
-npm install -g --ignore-scripts @piagent/platform@1.46.4
+npm install -g --ignore-scripts @piagent/platform@1.48.0
 piagent-install --stable --dry-run
 piagent-install --stable
 ```
 
-`pi install git:github.com/Vt-mmm/piagent@v1.46.4` vẫn hợp lệ nếu chỉ cần cài Pi package. Lệnh đó không tự tạo các binary terminal `piagent-*`; muốn có helper global thì dùng `npm install -g --ignore-scripts @piagent/platform@1.46.4`.
+`pi install git:github.com/Vt-mmm/piagent@v1.48.0` vẫn hợp lệ nếu chỉ cần cài Pi package. Lệnh đó không tự tạo các binary terminal `piagent-*`; muốn có helper global thì dùng `npm install -g --ignore-scripts @piagent/platform@1.48.0`.
 
 Support matrix hiện tại: macOS Apple Silicon + Bash và Linux x64 + Bash đã được verify; macOS Intel + Bash và Linux ARM64 + Bash là supported target cần chạy smoke trước rollout; native Windows chưa phải target rollout team; WSL2 experimental. Chi tiết và version runtime nằm trong [release/install policy](release-install-policy.md).
 
@@ -118,7 +118,7 @@ Nếu muốn commit sẵn `.pi/piagent-profile.json` vào repo hoặc bootstrap
 ```bash
 bash scripts/setup.sh /path/to/project \
   --profile be-readonly-fe \
-  --package-source git:github.com/Vt-mmm/piagent@v1.46.4 \
+  --package-source git:github.com/Vt-mmm/piagent@v1.48.0 \
   --mcp-preset core \
   --subagents-preset safe
 ```

package/docs/languages.json

@@ -21,8 +21,8 @@
       "en": "README.md",
       "vi": "README.vi.md",
       "consistentAt": {
-        "en": "ec9ece92a6c4d8ef2ffadd920d6fd8c5399cd9cd",
-        "vi": "d4839d20168be049da85c73b69fcac4521770474"
+        "en": "ee5c4722c566f80160bfa8e9c61954ef305b088f",
+        "vi": "c3cafd3917fc059244d4da4d56026e78d378773c"
       }
     },
     {

package/docs/mcp-and-tools.md

@@ -24,6 +24,25 @@ Từ `v0.3.7`, repo có thêm:
 - template `.mcp.json` project-shared;
 - doctor warning khi adapter có nhưng không có MCP server nào.
 
+## MCP trong phiên công ty
+
+Phiên công ty (`piagent studio`, terminal và WebUI công ty) dùng chính các MCP server dev đã cài cho Piagent cá nhân: cùng `pi-mcp-adapter` trong `~/.piagent/agent`, cùng config (`piagent-mcp add`, `~/.config/mcp/mcp.json`, `.mcp.json` của project, `/mcp`) và cùng login (`/mcp-auth`). Dev tự thêm server, Studio không quản lý danh sách này.
+
+```bash
+piagent-mcp --preset atlassian
+```
+
+Sau đó đăng nhập một lần bằng `/mcp-auth atlassian` (trong `piagent` hoặc terminal công ty). Phiên công ty mở sau đó có tool `mcp` với server `atlassian`.
+
+Phiên công ty giữ hai lớp bảo vệ như Piagent cá nhân:
+
+- server do repo khai báo (`.mcp.json`, `.pi/mcp.json`) chỉ chạy sau khi có người trên máy duyệt (`/piagent-mcp approve <name>`), xem mục approval gate bên dưới;
+- kết quả MCP tới agent dưới dạng dữ liệu trong vùng rào, không phải lệnh: một issue Jira viết "bỏ qua hướng dẫn" không điều khiển được agent.
+
+Host công ty chạy với môi trường đã xoá sạch. Server MCP local nhận `PATH` gồm Homebrew, `~/.local/bin` và các toolchain trên máy (nvm, volta, pyenv…), cộng với `env` khai trong config của server; không nhận biến nào khác từ shell của dev.
+
+Adapter chưa cài, hoặc đã gỡ khỏi `packages` trong `~/.piagent/agent/settings.json`, thì phiên công ty mở bình thường, không có tool `mcp`.
+
 ## Hai bề mặt
 
 Trong session Pi thì dùng slash command, ngoài terminal thì dùng CLI. Cùng module đọc config, cùng cách phân loại trạng thái.
@@ -270,9 +289,10 @@ Quy ước của platform:
 | `google-mail` | Gmail | **experimental**, chỉ hộp thư |
 | `google` | Drive, Docs, Sheets | **experimental**, không gồm hộp thư |
 | `google-all` | Drive, Gmail, Docs, Sheets | **experimental**, toàn bộ Google Workspace |
+| `atlassian` | Atlassian Rovo (Jira, Confluence Cloud) | issue/page Jira và Confluence, đăng nhập bằng tài khoản Atlassian của dev |
 | `core` | Context7, Chrome DevTools, GitHub | default team baseline |
 | `popular` | core + Playwright + Figma desktop | baseline nhiều team dev dùng |
-| `all` | popular + Figma remote + MarkItDown + toàn bộ Google | mọi thứ trong catalog |
+| `all` | popular + Figma remote + MarkItDown + Atlassian + toàn bộ Google | mọi thứ trong catalog |
 
 Mỗi sản phẩm Google là **một server riêng, một preset riêng** — đó là lý do
 Google tách làm bốn. Đọc một spreadsheet không nên tốn một grant lên cả Drive

package/docs/operator-manual-vietnamese.md

@@ -19,12 +19,12 @@ Support matrix release hiện tại: macOS Apple Silicon + Bash và Linux x64 +
 ```bash
 node --version  # >= 22.19.0
 npm install -g --ignore-scripts @earendil-works/pi-coding-agent@1.3.0
-npm install -g --ignore-scripts @piagent/platform@1.46.4
+npm install -g --ignore-scripts @piagent/platform@1.48.0
 piagent-install --stable --dry-run
 piagent-install --stable
 ```
 
-Khi seed `.pi/settings.json` cho team/repo cần audit lặp lại, giữ package source dạng pinned tag như `git:github.com/Vt-mmm/piagent@v1.46.4`. Máy cá nhân có thể dùng `git:github.com/Vt-mmm/piagent` để theo latest.
+Khi seed `.pi/settings.json` cho team/repo cần audit lặp lại, giữ package source dạng pinned tag như `git:github.com/Vt-mmm/piagent@v1.48.0`. Máy cá nhân có thể dùng `git:github.com/Vt-mmm/piagent` để theo latest.
 
 Nếu đang ở source checkout của platform, dùng helper theo channel để preview trước khi đổi:
 
@@ -100,7 +100,7 @@ install package once
 
 ```bash
 npm install -g --ignore-scripts @earendil-works/pi-coding-agent@1.3.0
-npm install -g --ignore-scripts @piagent/platform@1.46.4
+npm install -g --ignore-scripts @piagent/platform@1.48.0
 piagent-install --stable --dry-run
 piagent-install --stable
 ```
@@ -285,7 +285,7 @@ Không phải daily default. Dùng khi muốn tạo sẵn `.pi` files cho projec
 bash /path/to/piagent/scripts/setup.sh /path/to/project \
   --project-only \
   --profile auto \
-  --package-source git:github.com/Vt-mmm/piagent@v1.46.4 \
+  --package-source git:github.com/Vt-mmm/piagent@v1.48.0 \
   --mcp-preset core \
   --subagents-preset safe
 ```
@@ -999,8 +999,8 @@ Watchdog là optional adversarial reviewer ở cuối turn, không bật mặc
 
 | Command | Dùng để |
 |---|---|
-| `npm install -g --ignore-scripts @piagent/platform@1.46.4` | Cài terminal helper `piagent-*` từ release tag hiện tại. |
-| `pi install git:github.com/Vt-mmm/piagent@v1.46.4` | Install pinned release cho reproducible team setup. |
+| `npm install -g --ignore-scripts @piagent/platform@1.48.0` | Cài terminal helper `piagent-*` từ release tag hiện tại. |
+| `pi install git:github.com/Vt-mmm/piagent@v1.48.0` | Install pinned release cho reproducible team setup. |
 | `pi install git:github.com/Vt-mmm/piagent` | Install latest platform package cho máy cá nhân/sandbox. |
 | Cài exact Pi host của release, rồi `npm install -g --ignore-scripts @piagent/platform@X.Y.Z` và `piagent-install --stable` | Full update: đồng bộ host, terminal helper và Pi package. Mỗi release pin một Pi host chính xác; lấy đúng version của release đang cài trong [release/install policy](release-install-policy.md). |
 | Cài exact Pi host ghi trong release cũ, rồi helper `vPREVIOUS` và `piagent-install --stable` | Full rollback; đánh giá lại dependency findings của host cũ trước khi hạ version. |
@@ -1096,7 +1096,7 @@ Mở lại Pi session sau khi install.
 Cài lại terminal helper đúng release rồi kiểm tra `PATH`:
 
 ```bash
-npm install -g --ignore-scripts @piagent/platform@1.46.4
+npm install -g --ignore-scripts @piagent/platform@1.48.0
 command -v piagent-install
 ```
 

package/docs/publishing-for-teams.md

@@ -41,6 +41,8 @@ pi install /path/to/piagent
 
 ## Versioning
 
+- `1.48.0`: Bypass dừng ở bước bàn giao: mọi chế độ hỏi trước khi push, tạo hoặc merge pull request, publish, deploy, chạy `ssh` hay tool cloud, upload, và trước công cụ MCP ghi ra ngoài; lệnh được kiểm tra thêm bằng cây cú pháp shell; thẻ duyệt có bốn lựa chọn (một lần, cả session, từ chối, từ chối và dừng lượt); `autoDeny` trong profile chặn lệnh ở mọi chế độ; dashboard stream mượt hơn.
+- `1.47.0`: phiên công ty dùng các MCP server dev đã cài cho Piagent (cùng login; server do repo khai báo vẫn cần duyệt), thêm preset `atlassian` cho Jira và Confluence Cloud; tool `run_on_simulator` cho agent tự boot simulator iOS/Android, build, cài, mở app, chạy XCUITest, chụp màn hình và đọc log.
 - `1.46.4`: agent xin nhiều subagent mà member không yêu cầu thì chạy một subagent thay vì bị chặn (một số model từng gọi lại liên tục đến khi member dừng); `piagent-update` đọc được `models.json` có comment như Pi, và lỗi cấu hình danh sách model không còn làm dừng cả bản cài.
 - `1.46.3`: (tag, chưa publish do tiêu đề bản phát hành dài quá giới hạn của trang) cùng nội dung 1.46.4.
 - `1.46.2`: tin nhắn gửi ngay sau một câu trả lời hiện ngay trong terminal (trước đây mất 1–2 giây vì panel PIAGENT quét working tree trước khi Pi nhận tin tiếp theo); WebUI hiện câu trả lời từng chữ trong khi model đang viết thay vì đợi hết đoạn, vẫn che bí mật viết qua nhiều từ.

package/docs/release-install-policy.md

@@ -155,7 +155,7 @@ Use this flow when the team needs both terminal commands and the Pi package:
 ```bash
 node --version  # >= 22.19.0
 npm install -g --ignore-scripts @earendil-works/pi-coding-agent@1.3.0
-npm install -g --ignore-scripts @piagent/platform@1.46.4
+npm install -g --ignore-scripts @piagent/platform@1.48.0
 piagent-install --stable --dry-run
 piagent-install --stable
 ```
@@ -181,7 +181,7 @@ bash scripts/install-global.sh --stable
 Use this only when terminal commands are not needed:
 
 ```bash
-pi install git:github.com/Vt-mmm/piagent@v1.46.4
+pi install git:github.com/Vt-mmm/piagent@v1.48.0
 ```
 
 Direct `pi install` does not create `piagent-*` commands on `PATH`.

package/docs/security-threat-model.md

@@ -65,7 +65,9 @@ The final category is outside the containment capability of the Piagent guard. I
 
 ## Permission model
 
-`read-only`, `workspace-write`, and `trusted-full-access` change the allowed working scope; they do not disable protected paths, secret redaction, capability integrity, destructive confirmation, or external-provider confirmation. `trusted-full-access` is intended for an already trusted repository in an externally safe environment. It is not a bypass or sandbox mode.
+`read-only`, `workspace-write`, and `trusted-full-access` change the allowed working scope; they do not disable protected paths, secret redaction, capability integrity, destructive confirmation, or the handoff confirmation. `trusted-full-access` is intended for an already trusted repository in an externally safe environment. It is not a bypass or sandbox mode.
+
+`bypass` removes every question and block on the work itself (protected paths, destructive confirmation, the policy gates). It keeps secret redaction, the turn checkpoints and the handoff confirmation: a push, pull request, merge, release, publish, deploy, registry push, remote shell, cloud or cluster tool, upload, or MCP write is asked about in every mode (`runtime/policy/handoff-policy.mjs`). Personal sessions run on the host with no OS sandbox in every mode; company sessions run plain commands in the sandbox.
 
 ## Outbound network from a session
 

package/docs/team-onboarding.md

@@ -10,7 +10,7 @@ Một thành viên mới không cần biết local path của maintainer. Luồn
 ```bash
 node --version  # >= 22.19.0
 npm install -g --ignore-scripts @earendil-works/pi-coding-agent@1.3.0
-npm install -g --ignore-scripts @piagent/platform@1.46.4
+npm install -g --ignore-scripts @piagent/platform@1.48.0
 piagent-install --stable
 cd /path/to/project
 pi
@@ -45,7 +45,7 @@ Mặc định team dùng stable helper:
 ```bash
 node --version  # >= 22.19.0
 npm install -g --ignore-scripts @earendil-works/pi-coding-agent@1.3.0
-npm install -g --ignore-scripts @piagent/platform@1.46.4
+npm install -g --ignore-scripts @piagent/platform@1.48.0
 piagent-install --stable --dry-run
 piagent-install --stable
 ```

package/docs-site/architecture.html

@@ -37,7 +37,7 @@
         <span class="brand-mark"><img src="/assets/piagent-logo.svg" alt="" width="28" height="28" /></span>
         <span class="brand-name"><b>Piagent</b> <span>Platform</span></span>
       </a>
-      <a class="version-badge" href="/whats-new" data-docs-version="v1.46.4" title="v1.46.4 docs · VI"><span class="dot"></span>v1.46.4</a>
+      <a class="version-badge" href="/whats-new" data-docs-version="v1.48.0" title="v1.48.0 docs · VI"><span class="dot"></span>v1.48.0</a>
       <nav class="top-nav" aria-label="Tài liệu">
         <a href="/quickstart">Tài liệu</a>
         <a href="/whats-new">Changelog</a>

package/docs-site/assets/search-en.json

@@ -1 +1 @@
-[{"href":"/en/","icon":"home","group":"Get started","nav":"Overview","title":"Pi Agent Platform","lead":"A coding agent for the whole team: a guard checks every tool call, the team's Harness runs checks and review, one dashboard for Terminal and the browser.","headings":[{"id":"different","text":"The agent works fast. The platform keeps it right."},{"id":"one-turn","text":"You say what you need. The rest is verified."},{"id":"screens","text":"Captured from a running dashboard"},{"id":"two-modes","text":"One dashboard, two ways to use models"},{"id":"install","text":"Running in two minutes"},{"id":"latest-updates","text":"Steady releases, every change written down"}]},{"href":"/en/ecosystem","icon":"network","group":"Get started","nav":"Ecosystem","title":"Piagent, Agent Watch and Agent Studio","lead":"What runs on your machine, what runs on the company server, and when to use your own model or the company's.","headings":[{"id":"overview","text":"One dashboard, two ways to use models"},{"id":"parts","text":"Each part does one job"},{"id":"piagent","text":"Piagent"},{"id":"guard","text":"Guard"},{"id":"agent-watch","text":"Agent Watch"},{"id":"agent-studio","text":"Agent Studio"},{"id":"one-turn","text":"From a message to \"A check passed · Review found no blocking issue\""},{"id":"choose","text":"When to use personal, when to use company"}]},{"href":"/en/quickstart","icon":"rocket","group":"Get started","nav":"Install","title":"Install and run your first turn","lead":"Two commands to install. Open a repository, pick its profile and permissions, then ask in plain language.","headings":[{"id":"install","text":"Install"},{"id":"open-project","text":"Open a project"},{"id":"read-project","text":"Let the agent read the project"},{"id":"profile-and-permission","text":"Pick a profile and permission"},{"id":"ask","text":"Ask in plain language"},{"id":"check","text":"Check the installation"},{"id":"supported","text":"Supported systems"},{"id":"next","text":"Next"}]},{"href":"/en/windows","icon":"windows","group":"Get started","nav":"Windows","title":"Install on Windows with one command","lead":"One PowerShell command installs WSL2, Ubuntu, Piagent and Agent Watch, binds the company key and adds Piagent to the Start menu. Run it again to update.","headings":[{"id":"one-command","text":"Install with one command"},{"id":"every-day","text":"Every day"},{"id":"when-setup-fails","text":"When setup fails"},{"id":"why-wsl2","text":"Why WSL2"}]},{"href":"/en/update","icon":"refresh","group":"Get started","nav":"Update & uninstall","title":"Update, roll back and uninstall","lead":"One command moves to a new release, and the dashboard and Terminal tell you when one is out. Rollback and uninstall both preview first.","headings":[{"id":"update","text":"Update"},{"id":"what-it-does","text":"What it does, in order"},{"id":"options","text":"Common options"},{"id":"pin-for-a-team","text":"Pin one release for a team"},{"id":"rollback","text":"Roll back"},{"id":"uninstall","text":"Uninstall"},{"id":"windows","text":"On Windows"}]},{"href":"/en/whats-new","icon":"sparkles","group":"Get started","nav":"Changelog","title":"Changelog","lead":"Every release: what changed and which Studio or Agent Watch it needs. Newest first.","headings":[{"id":"latest","text":"Latest"},{"id":"v1-46-4-title","text":"One subagent instead of a refused request; update reads a commented models.json"},{"id":"v1-46-3-title","text":"One subagent instead of a refused request; update reads a commented models.json not published"},{"id":"v1-46-2-title","text":"A message sent after an answer shows at once; the WebUI streams word by word"},{"id":"v1-46-1-title","text":"Objections on the record, one review per turn, parallel subagents on request"},{"id":"v1-46-0-title","text":"Piagent runs from its own Pi home and your own pi stays stock"},{"id":"v1-45-0-title","text":"Files and images in a prompt follow the read policy, and the terminal stays responsive"},{"id":"v1-44-4-title","text":"Company conversations come back in Herdr panes"},{"id":"v1-44-3-title","text":"Prompt injection cannot quietly read the system"},{"id":"v1-44-2-title","text":"The company harness follows the size of a change"},{"id":"v1-44-1-title","text":"Your own Pi stays, pick a Terminal style, add skill repositories"},{"id":"v1-44-0-title","text":"Your own Pi stays, pick a Terminal style, add skill repositories not published"},{"id":"v1-43-9-title","text":"Every installed skill, and files the agent hands back"},{"id":"v1-43-8-title","text":"Every installed skill, and files the agent hands back not published"},{"id":"v1-43-7-title","text":"Every installed skill, and files the agent hands back not published"},{"id":"v1-43-6-title","text":"Watch the agent's edits while it runs"},{"id":"v1-43-5-title","text":"Image previews and office attachments"},{"id":"v1-43-4-title","text":"Your workflow, with adaptive backend and frontend support"},{"id":"v1-43-3-title","text":"Your workflow, with adaptive backend and frontend support not published"},{"id":"v1-43-2-title","text":"Your workflow, with adaptive backend and frontend support not published"},{"id":"v1-43-1-title","text":"Your workflow, with adaptive backend and frontend support not published"},{"id":"v1-43-0-title","text":"Your workflow, with adaptive backend and frontend support not published"},{"id":"v1-42-1-title","text":"Faster dashboard loading and less workspace hashing memory"},{"id":"v1-42-0-title","text":"A redesigned dashboard and older messages that load without jumping"},{"id":"v1-41-0-title","text":"Front-end change reports with before/after screenshots"},{"id":"archive","text":"Earlier releases"}]},{"href":"/en/scope","icon":"target","group":"Get started","nav":"Platform scope","title":"What the platform owns","lead":"Every agent has governance primitives. This platform packages one repeatable operating model on Pi for every repository.","headings":[{"id":"not-a-new-agent","text":"This is not a new agent"},{"id":"complementary-layers","text":"The two layers are complementary"},{"id":"lower-layer","text":"The lower layer sees processes"},{"id":"upper-layer","text":"The upper layer sees intent"},{"id":"when-not-needed","text":"When you may not need it"}]},{"href":"/en/profiles","icon":"sliders","group":"Build","nav":"Project profiles","title":"Choose the right profile","lead":"A profile sets protected paths, verification commands and the capabilities a repository is granted.","headings":[]},{"href":"/en/permissions","icon":"key","group":"Build","nav":"Permission modes","title":"Change permissions per task","lead":"Permission modes apply to the current session only. Changing one does not modify the project profile.","headings":[]},{"href":"/en/commands","icon":"terminal","group":"Build","nav":"Command catalog","title":"Short commands, predictable behaviour","lead":"Slash commands package policy and flow, with one inspector for diffs, commands, safety and context.","headings":[{"id":"session-basics","text":"Session basics"},{"id":"project-profile","text":"Project profile"},{"id":"implementation-workflow","text":"Assigning work"},{"id":"git-handoff","text":"Git handoff"},{"id":"fresh-sessions","text":"New sessions"},{"id":"mcp","text":"MCP"},{"id":"subagents","text":"Subagents"},{"id":"product-status-commands","text":"Inspect runtime decisions"},{"id":"skills-and-packages","text":"Audit test quality, run experiment loops"}]},{"href":"/en/workflows","icon":"branch","group":"Build","nav":"Workflows","title":"Day-to-day work","lead":"No workflow launchers: say what you need in plain language. Inspection commands only observe and never start a model turn.","headings":[{"id":"conclusion","text":"No new command is mandatory in the daily flow"},{"id":"command-effects","text":"How far the inspection commands affect a workflow"},{"id":"example-flow","text":"A complete flow can look like this"}]},{"href":"/en/mcp","icon":"plug","group":"MCP","nav":"MCP overview","title":"MCP in Pi Agent Platform","lead":"The platform installs pi-mcp-adapter for token-efficient MCP access and manages servers across four configuration layers.","headings":[{"id":"start","text":"Where to start"},{"id":"three-similar-names","text":"Three similar names that are not connected"},{"id":"four-config-layers","text":"Four configuration layers"},{"id":"presets","text":"Pinned presets"},{"id":"token-efficiency","text":"Token efficiency"}]},{"href":"/en/mcp-servers","icon":"server","group":"MCP","nav":"Server management","title":"Add, inspect and remove MCP servers","lead":"piagent-mcp provides add, remove, get, list, enable and disable across all four scopes.","headings":[{"id":"two-surfaces","text":"Two surfaces for two contexts"},{"id":"commands","text":"Commands"},{"id":"in-session","text":"In a session"},{"id":"add-server","text":"Add a server"},{"id":"inspect","text":"Inspect"},{"id":"disable-remove","text":"Disable and remove"},{"id":"preset-command","text":"Preset"},{"id":"output","text":"Output names the modified file"},{"id":"updates","text":"Custom servers and updates"},{"id":"preserved","text":"Preserved"},{"id":"overwritten","text":"Replaced"}]},{"href":"/en/mcp-auth","icon":"lock","group":"MCP","nav":"Authentication","title":"Authentication and readiness","lead":"The platform stores no tokens and runs no OAuth. It rejects secrets in configuration and reports which servers are actually ready.","headings":[{"id":"no-token-storage","text":"The platform does not store tokens"},{"id":"reject-secrets","text":"Secrets are rejected before configuration is written"},{"id":"field-name","text":"Field-name detection"},{"id":"value-shape","text":"Value-shape detection"},{"id":"readiness","text":"Readiness states"}]},{"href":"/en/mcp-approval","icon":"shield-check","group":"MCP","nav":"Approval gate","title":"Repository servers require approval","lead":"Cloning an untrusted repository must not give its author a process on your machine. Decisions live outside the repository, pinned by digest.","headings":[{"id":"problem","text":"The problem"},{"id":"three-properties","text":"Three properties"},{"id":"outside-repository","text":"The decision lives outside the repository"},{"id":"digest-pinning","text":"Pinned by digest"},{"id":"tool-call-enforcement","text":"Enforced at tool call"},{"id":"limit","text":"Limit"},{"id":"imports","text":"Servers supplied through imports"},{"id":"design-decisions","text":"Design decisions"},{"id":"migration","text":"Migration"}]},{"href":"/en/security","icon":"shield","group":"Operate","nav":"Security model","title":"Policy enforcement, not an OS sandbox","lead":"Controlled tool surfaces fail closed when profiles, integrity locks or permissions are invalid.","headings":[{"id":"protected-paths","text":"Protected paths"},{"id":"shell-hardening","text":"Shell hardening"},{"id":"secret-redaction","text":"Secret redaction"},{"id":"capability-lock","text":"Capability lock"},{"id":"human-action-gate","text":"Human-action gate"},{"id":"verify-evidence","text":"Real checks"}]},{"href":"/en/architecture","icon":"layers","group":"Operate","nav":"Architecture","title":"Repository architecture","lead":"Core holds reusable policy and runtime infrastructure; business logic stays in the project that owns it.","headings":[{"id":"composition","text":"Composition"},{"id":"runtime-adapters","text":"Runtime adapters"},{"id":"core-services","text":"Core services"},{"id":"integrations","text":"Integrations"},{"id":"entrypoints","text":"Entrypoints"},{"id":"product-assets","text":"Product assets"},{"id":"adaptive-runtime","text":"Piagent now separates runtime decisions from Pi wiring"},{"id":"state-ownership","text":"Each state has one source of truth"}]},{"href":"/en/context-engine","icon":"cpu","group":"Operate","nav":"Context Engine","title":"Less context, same model quality","lead":"Local indexing, ranked retrieval, task-driven tool loading, semantic compaction and transparent telemetry.","headings":[{"id":"dynamic-tools","text":"Task-driven tools"},{"id":"local-index","text":"Local index"},{"id":"ranked-context","text":"Ranked context"},{"id":"semantic-compact","text":"Semantic compaction"},{"id":"test-impact","text":"Test impact"},{"id":"agent-watch","text":"Agent Watch"}]},{"href":"/en/benchmark","icon":"chart","group":"Operate","nav":"Benchmark","title":"Quality and efficiency evidence","lead":"Piagent against codex-cli on the same model and thinking level: 18 task families, 108 automatically graded sessions.","headings":[{"id":"benchmark-verdict","text":"Historical fresh-token score: 9.97/10"},{"id":"configuration","text":"Same model, same tasks, automatic grading"},{"id":"scores","text":"Token reduction does not trade away quality"},{"id":"tokens","text":"Measure the fixed workload, not only successful tasks"},{"id":"coverage","text":"Six domains with three families each"},{"id":"benchmark-bands","text":"Use the right suite for the decision"},{"id":"transparency","text":"Interpret results within their measured scope"},{"id":"historical-v1-2-12","text":"v1.2.12 remains historical evidence"}]},{"href":"/en/runtime","icon":"wrench","group":"Operate","nav":"Runtime tools","title":"Terminal commands for operators","lead":"Commands that run outside Pi: setup, updates, doctor, benchmarks, capabilities and MCP.","headings":[]},{"href":"/en/team","icon":"users","group":"Operate","nav":"Team usage","title":"One operating standard for the team","lead":"Each repository links the package, selects a fitting profile and keeps project documentation in its own repository.","headings":[{"id":"do","text":"Do"},{"id":"avoid","text":"Avoid"}]}]
+[{"href":"/en/","icon":"home","group":"Get started","nav":"Overview","title":"Pi Agent Platform","lead":"A coding agent for the whole team: a guard checks every tool call, the team's Harness runs checks and review, one dashboard for Terminal and the browser.","headings":[{"id":"different","text":"The agent works fast. The platform keeps it right."},{"id":"one-turn","text":"You say what you need. The rest is verified."},{"id":"screens","text":"Captured from a running dashboard"},{"id":"two-modes","text":"One dashboard, two ways to use models"},{"id":"install","text":"Running in two minutes"},{"id":"latest-updates","text":"Steady releases, every change written down"}]},{"href":"/en/ecosystem","icon":"network","group":"Get started","nav":"Ecosystem","title":"Piagent, Agent Watch and Agent Studio","lead":"What runs on your machine, what runs on the company server, and when to use your own model or the company's.","headings":[{"id":"overview","text":"One dashboard, two ways to use models"},{"id":"parts","text":"Each part does one job"},{"id":"piagent","text":"Piagent"},{"id":"guard","text":"Guard"},{"id":"agent-watch","text":"Agent Watch"},{"id":"agent-studio","text":"Agent Studio"},{"id":"one-turn","text":"From a message to \"A check passed · Review found no blocking issue\""},{"id":"choose","text":"When to use personal, when to use company"}]},{"href":"/en/quickstart","icon":"rocket","group":"Get started","nav":"Install","title":"Install and run your first turn","lead":"Two commands to install. Open a repository, pick its profile and permissions, then ask in plain language.","headings":[{"id":"install","text":"Install"},{"id":"open-project","text":"Open a project"},{"id":"read-project","text":"Let the agent read the project"},{"id":"profile-and-permission","text":"Pick a profile and permission"},{"id":"ask","text":"Ask in plain language"},{"id":"check","text":"Check the installation"},{"id":"supported","text":"Supported systems"},{"id":"next","text":"Next"}]},{"href":"/en/windows","icon":"windows","group":"Get started","nav":"Windows","title":"Install on Windows with one command","lead":"One PowerShell command installs WSL2, Ubuntu, Piagent and Agent Watch, binds the company key and adds Piagent to the Start menu. Run it again to update.","headings":[{"id":"one-command","text":"Install with one command"},{"id":"every-day","text":"Every day"},{"id":"when-setup-fails","text":"When setup fails"},{"id":"why-wsl2","text":"Why WSL2"}]},{"href":"/en/update","icon":"refresh","group":"Get started","nav":"Update & uninstall","title":"Update, roll back and uninstall","lead":"One command moves to a new release, and the dashboard and Terminal tell you when one is out. Rollback and uninstall both preview first.","headings":[{"id":"update","text":"Update"},{"id":"what-it-does","text":"What it does, in order"},{"id":"options","text":"Common options"},{"id":"pin-for-a-team","text":"Pin one release for a team"},{"id":"rollback","text":"Roll back"},{"id":"uninstall","text":"Uninstall"},{"id":"windows","text":"On Windows"}]},{"href":"/en/whats-new","icon":"sparkles","group":"Get started","nav":"Changelog","title":"Changelog","lead":"Every release: what changed and which Studio or Agent Watch it needs. Newest first.","headings":[{"id":"latest","text":"Latest"},{"id":"v1-48-0-title","text":"Bypass stops at the handoff: every mode asks before work leaves the machine"},{"id":"v1-47-0-title","text":"Company sessions use your MCP servers and drive iOS and Android simulators"},{"id":"v1-46-4-title","text":"One subagent instead of a refused request; update reads a commented models.json"},{"id":"v1-46-3-title","text":"One subagent instead of a refused request; update reads a commented models.json not published"},{"id":"v1-46-2-title","text":"A message sent after an answer shows at once; the WebUI streams word by word"},{"id":"v1-46-1-title","text":"Objections on the record, one review per turn, parallel subagents on request"},{"id":"v1-46-0-title","text":"Piagent runs from its own Pi home and your own pi stays stock"},{"id":"v1-45-0-title","text":"Files and images in a prompt follow the read policy, and the terminal stays responsive"},{"id":"v1-44-4-title","text":"Company conversations come back in Herdr panes"},{"id":"v1-44-3-title","text":"Prompt injection cannot quietly read the system"},{"id":"v1-44-2-title","text":"The company harness follows the size of a change"},{"id":"v1-44-1-title","text":"Your own Pi stays, pick a Terminal style, add skill repositories"},{"id":"v1-44-0-title","text":"Your own Pi stays, pick a Terminal style, add skill repositories not published"},{"id":"v1-43-9-title","text":"Every installed skill, and files the agent hands back"},{"id":"v1-43-8-title","text":"Every installed skill, and files the agent hands back not published"},{"id":"v1-43-7-title","text":"Every installed skill, and files the agent hands back not published"},{"id":"v1-43-6-title","text":"Watch the agent's edits while it runs"},{"id":"v1-43-5-title","text":"Image previews and office attachments"},{"id":"v1-43-4-title","text":"Your workflow, with adaptive backend and frontend support"},{"id":"v1-43-3-title","text":"Your workflow, with adaptive backend and frontend support not published"},{"id":"v1-43-2-title","text":"Your workflow, with adaptive backend and frontend support not published"},{"id":"v1-43-1-title","text":"Your workflow, with adaptive backend and frontend support not published"},{"id":"v1-43-0-title","text":"Your workflow, with adaptive backend and frontend support not published"},{"id":"v1-42-1-title","text":"Faster dashboard loading and less workspace hashing memory"},{"id":"archive","text":"Earlier releases"}]},{"href":"/en/scope","icon":"target","group":"Get started","nav":"Platform scope","title":"What the platform owns","lead":"Every agent has governance primitives. This platform packages one repeatable operating model on Pi for every repository.","headings":[{"id":"not-a-new-agent","text":"This is not a new agent"},{"id":"complementary-layers","text":"The two layers are complementary"},{"id":"lower-layer","text":"The lower layer sees processes"},{"id":"upper-layer","text":"The upper layer sees intent"},{"id":"when-not-needed","text":"When you may not need it"}]},{"href":"/en/profiles","icon":"sliders","group":"Build","nav":"Project profiles","title":"Choose the right profile","lead":"A profile sets protected paths, verification commands and the capabilities a repository is granted.","headings":[]},{"href":"/en/permissions","icon":"key","group":"Build","nav":"Permission modes","title":"Change permissions per task","lead":"Permission modes apply to the current session only. Changing one does not modify the project profile.","headings":[]},{"href":"/en/commands","icon":"terminal","group":"Build","nav":"Command catalog","title":"Short commands, predictable behaviour","lead":"Slash commands package policy and flow, with one inspector for diffs, commands, safety and context.","headings":[{"id":"session-basics","text":"Session basics"},{"id":"project-profile","text":"Project profile"},{"id":"implementation-workflow","text":"Assigning work"},{"id":"git-handoff","text":"Git handoff"},{"id":"fresh-sessions","text":"New sessions"},{"id":"mcp","text":"MCP"},{"id":"subagents","text":"Subagents"},{"id":"product-status-commands","text":"Inspect runtime decisions"},{"id":"skills-and-packages","text":"Audit test quality, run experiment loops"}]},{"href":"/en/workflows","icon":"branch","group":"Build","nav":"Workflows","title":"Day-to-day work","lead":"No workflow launchers: say what you need in plain language. Inspection commands only observe and never start a model turn.","headings":[{"id":"conclusion","text":"No new command is mandatory in the daily flow"},{"id":"command-effects","text":"How far the inspection commands affect a workflow"},{"id":"example-flow","text":"A complete flow can look like this"}]},{"href":"/en/mcp","icon":"plug","group":"MCP","nav":"MCP overview","title":"MCP in Pi Agent Platform","lead":"The platform installs pi-mcp-adapter for token-efficient MCP access and manages servers across four configuration layers.","headings":[{"id":"start","text":"Where to start"},{"id":"three-similar-names","text":"Three similar names that are not connected"},{"id":"four-config-layers","text":"Four configuration layers"},{"id":"presets","text":"Pinned presets"},{"id":"company-sessions","text":"In company sessions"},{"id":"token-efficiency","text":"Token efficiency"}]},{"href":"/en/mcp-servers","icon":"server","group":"MCP","nav":"Server management","title":"Add, inspect and remove MCP servers","lead":"piagent-mcp provides add, remove, get, list, enable and disable across all four scopes.","headings":[{"id":"two-surfaces","text":"Two surfaces for two contexts"},{"id":"commands","text":"Commands"},{"id":"in-session","text":"In a session"},{"id":"add-server","text":"Add a server"},{"id":"inspect","text":"Inspect"},{"id":"disable-remove","text":"Disable and remove"},{"id":"preset-command","text":"Preset"},{"id":"output","text":"Output names the modified file"},{"id":"updates","text":"Custom servers and updates"},{"id":"preserved","text":"Preserved"},{"id":"overwritten","text":"Replaced"}]},{"href":"/en/mcp-auth","icon":"lock","group":"MCP","nav":"Authentication","title":"Authentication and readiness","lead":"The platform stores no tokens and runs no OAuth. It rejects secrets in configuration and reports which servers are actually ready.","headings":[{"id":"no-token-storage","text":"The platform does not store tokens"},{"id":"reject-secrets","text":"Secrets are rejected before configuration is written"},{"id":"field-name","text":"Field-name detection"},{"id":"value-shape","text":"Value-shape detection"},{"id":"readiness","text":"Readiness states"}]},{"href":"/en/mcp-approval","icon":"shield-check","group":"MCP","nav":"Approval gate","title":"Repository servers require approval","lead":"Cloning an untrusted repository must not give its author a process on your machine. Decisions live outside the repository, pinned by digest.","headings":[{"id":"problem","text":"The problem"},{"id":"three-properties","text":"Three properties"},{"id":"outside-repository","text":"The decision lives outside the repository"},{"id":"digest-pinning","text":"Pinned by digest"},{"id":"tool-call-enforcement","text":"Enforced at tool call"},{"id":"limit","text":"Limit"},{"id":"imports","text":"Servers supplied through imports"},{"id":"design-decisions","text":"Design decisions"},{"id":"migration","text":"Migration"}]},{"href":"/en/security","icon":"shield","group":"Operate","nav":"Security model","title":"Policy enforcement, not an OS sandbox","lead":"Controlled tool surfaces fail closed when profiles, integrity locks or permissions are invalid.","headings":[{"id":"protected-paths","text":"Protected paths"},{"id":"shell-hardening","text":"Shell hardening"},{"id":"secret-redaction","text":"Secret redaction"},{"id":"capability-lock","text":"Capability lock"},{"id":"human-action-gate","text":"Human-action gate"},{"id":"verify-evidence","text":"Real checks"}]},{"href":"/en/architecture","icon":"layers","group":"Operate","nav":"Architecture","title":"Repository architecture","lead":"Core holds reusable policy and runtime infrastructure; business logic stays in the project that owns it.","headings":[{"id":"composition","text":"Composition"},{"id":"runtime-adapters","text":"Runtime adapters"},{"id":"core-services","text":"Core services"},{"id":"integrations","text":"Integrations"},{"id":"entrypoints","text":"Entrypoints"},{"id":"product-assets","text":"Product assets"},{"id":"adaptive-runtime","text":"Piagent now separates runtime decisions from Pi wiring"},{"id":"state-ownership","text":"Each state has one source of truth"}]},{"href":"/en/context-engine","icon":"cpu","group":"Operate","nav":"Context Engine","title":"Less context, same model quality","lead":"Local indexing, ranked retrieval, task-driven tool loading, semantic compaction and transparent telemetry.","headings":[{"id":"dynamic-tools","text":"Task-driven tools"},{"id":"local-index","text":"Local index"},{"id":"ranked-context","text":"Ranked context"},{"id":"semantic-compact","text":"Semantic compaction"},{"id":"test-impact","text":"Test impact"},{"id":"agent-watch","text":"Agent Watch"}]},{"href":"/en/benchmark","icon":"chart","group":"Operate","nav":"Benchmark","title":"Quality and efficiency evidence","lead":"Piagent against codex-cli on the same model and thinking level: 18 task families, 108 automatically graded sessions.","headings":[{"id":"benchmark-verdict","text":"Historical fresh-token score: 9.97/10"},{"id":"configuration","text":"Same model, same tasks, automatic grading"},{"id":"scores","text":"Token reduction does not trade away quality"},{"id":"tokens","text":"Measure the fixed workload, not only successful tasks"},{"id":"coverage","text":"Six domains with three families each"},{"id":"benchmark-bands","text":"Use the right suite for the decision"},{"id":"transparency","text":"Interpret results within their measured scope"},{"id":"historical-v1-2-12","text":"v1.2.12 remains historical evidence"}]},{"href":"/en/runtime","icon":"wrench","group":"Operate","nav":"Runtime tools","title":"Terminal commands for operators","lead":"Commands that run outside Pi: setup, updates, doctor, benchmarks, capabilities and MCP.","headings":[]},{"href":"/en/team","icon":"users","group":"Operate","nav":"Team usage","title":"One operating standard for the team","lead":"Each repository links the package, selects a fitting profile and keeps project documentation in its own repository.","headings":[{"id":"do","text":"Do"},{"id":"avoid","text":"Avoid"}]}]