@piagent/platform 1.46.4 → 1.48.0

package/docs-site/whats-new.html

@@ -37,7 +37,7 @@
         <span class="brand-mark"><img src="/assets/piagent-logo.svg" alt="" width="28" height="28" /></span>
         <span class="brand-name"><b>Piagent</b> <span>Platform</span></span>
       </a>
-      <a class="version-badge" href="/whats-new" data-docs-version="v1.46.4" title="v1.46.4 docs · VI"><span class="dot"></span>v1.46.4</a>
+      <a class="version-badge" href="/whats-new" data-docs-version="v1.48.0" title="v1.48.0 docs · VI"><span class="dot"></span>v1.48.0</a>
       <nav class="top-nav" aria-label="Tài liệu">
         <a href="/quickstart">Tài liệu</a>
         <a href="/whats-new" aria-current="page">Changelog</a>
@@ -108,7 +108,36 @@
 <div class="release-filter" role="toolbar" aria-label="Lọc theo loại thay đổi"><button type="button" data-filter-kind="all" aria-pressed="true">Tất cả</button><button type="button" data-filter-kind="new" aria-pressed="false">Mới</button><button type="button" data-filter-kind="improved" aria-pressed="false">Cải thiện</button><button type="button" data-filter-kind="fixed" aria-pressed="false">Sửa lỗi</button><button type="button" data-filter-kind="security" aria-pressed="false">Bảo mật</button></div>
 <section class="section releases" data-releases>
 <h2 id="latest" class="sr-only">Mới nhất</h2>
-<article class="release latest" id="v1-46-4" data-release>
+<article class="release latest" id="v1-48-0" data-release>
+  <div class="release-meta"><a class="release-version" href="#v1-48-0">v1.48.0</a><time class="release-date" datetime="2026-10-30">30/10/2026</time></div>
+  <div class="release-body">
+    <h3 data-toc-skip id="v1-48-0-title">Bypass dừng ở bước bàn giao: mọi chế độ hỏi trước khi việc rời khỏi máy</h3>
+    <p>Push, pull request, publish và deploy luôn do bạn duyệt, lệnh được kiểm tra bằng cây cú pháp shell đầy đủ, thẻ duyệt có thêm lựa chọn cho cả session và dừng lượt, dashboard stream mượt hơn.</p>
+    <ul class="release-items">
+      <li data-kind="new"><span class="kind kind-new">Mới</span><span>Thẻ duyệt có bốn lựa chọn: cho phép một lần, cho lệnh giống hệt chạy cả session, từ chối, và từ chối rồi dừng lượt. Việc bàn giao luôn duyệt từng lần.</span></li>
+      <li data-kind="new"><span class="kind kind-new">Mới</span><span>Project có thể chặn hẳn lệnh bằng autoDeny trong .pi/piagent-profile.json. Luật áp dụng ở mọi chế độ, kể cả Bypass; terminate kết thúc luôn lượt của agent.</span></li>
+      <li data-kind="improved"><span class="kind kind-improved">Cải thiện</span><span>Dashboard mượt hơn: câu trả lời đang stream chỉ vẽ lại đoạn cuối, sidebar chỉ vẽ lại dòng thay đổi, kết nối bị rớt được phát hiện và nối lại sớm hơn.</span></li>
+      <li data-kind="fixed"><span class="kind kind-fixed">Sửa lỗi</span><span>Thẻ duyệt, dashboard, terminal và tài liệu mô tả đúng cách từng chế độ truy cập hoạt động; phiên cá nhân không còn bị ghi là chạy trong sandbox.</span></li>
+      <li data-kind="security"><span class="kind kind-security">Bảo mật</span><span>Mọi chế độ truy cập đều hỏi trước khi việc rời khỏi máy: git push dù viết kiểu nào, pull request và merge, release, publish, deploy, push registry, ssh và tool cloud, upload.</span></li>
+      <li data-kind="security"><span class="kind kind-security">Bảo mật</span><span>Bypass chạy việc không hỏi và dừng ở bước bàn giao, ở cả phiên cá nhân lẫn công ty, kể cả run_on_host dùng tài khoản của bạn và công cụ MCP ghi ra ngoài.</span></li>
+      <li data-kind="security"><span class="kind kind-security">Bảo mật</span><span>Lệnh được đọc bằng bộ quét của policy và cây cú pháp shell: push hay lệnh xoá nguy hiểm nằm trong if/then, function, case, bash -c, eval hay heredoc đều bị bắt.</span></li>
+    </ul>
+  </div>
+</article>
+<article class="release" id="v1-47-0" data-release>
+  <div class="release-meta"><a class="release-version" href="#v1-47-0">v1.47.0</a><time class="release-date" datetime="2026-10-29">29/10/2026</time></div>
+  <div class="release-body">
+    <h3 data-toc-skip id="v1-47-0-title">Phiên công ty dùng MCP server của bạn và điều khiển simulator iOS, Android</h3>
+    <p>Jira, GitHub và mọi MCP server bạn cài cho Piagent giờ dùng được trong phiên công ty, và agent tự build, chạy, chụp màn hình và test app mobile trên simulator.</p>
+    <ul class="release-items">
+      <li data-kind="new"><span class="kind kind-new">Mới</span><span>Phiên công ty nạp các MCP server đã cài cho Piagent cá nhân, dùng chung login. Server do repo khai báo vẫn cần duyệt; kết quả tới agent dưới dạng dữ liệu.</span></li>
+      <li data-kind="new"><span class="kind kind-new">Mới</span><span>Preset atlassian thêm Jira và Confluence Cloud: piagent-mcp --preset atlassian, rồi /mcp-auth atlassian bằng tài khoản Atlassian của bạn.</span></li>
+      <li data-kind="new"><span class="kind kind-new">Mới</span><span>run_on_simulator boot simulator, build, cài và mở app, chạy XCUITest, chụp màn hình, đọc log: xcrun simctl, xcodebuild, adb, emulator, gradlew, flutter, expo.</span></li>
+      <li data-kind="security"><span class="kind kind-security">Bảo mật</span><span>run_on_simulator từ chối chương trình khác, ;, &amp;, $( ) và file ngoài project. Full access và Bypass chạy luôn, nhưng vẫn hỏi khi lệnh đụng tới credentials.</span></li>
+    </ul>
+  </div>
+</article>
+<article class="release" id="v1-46-4" data-release>
   <div class="release-meta"><a class="release-version" href="#v1-46-4">v1.46.4</a><time class="release-date" datetime="2026-10-29">29/10/2026</time></div>
   <div class="release-body">
     <h3 data-toc-skip id="v1-46-4-title">Một subagent thay vì bị chặn; bản cập nhật đọc được models.json có comment</h3>
@@ -390,41 +419,39 @@
     </ul>
   </div>
 </article>
-<article class="release" id="v1-42-0" data-release>
-  <div class="release-meta"><a class="release-version" href="#v1-42-0">v1.42.0</a><time class="release-date" datetime="2026-10-25">25/10/2026</time></div>
-  <div class="release-body">
-    <h3 data-toc-skip id="v1-42-0-title">Dashboard thiết kế lại, tin cũ tải mà không nhảy trang</h3>
-    <p>Dashboard có một thang thiết kế và mọi theme tô tới mọi khung; tin cũ tự tải khi cuộn lên và tin bạn đang đọc đứng yên.</p>
-    <ul class="release-items">
-      <li data-kind="new"><span class="kind kind-new">Mới</span><span>Tin cũ tự tải khi cuộn gần đầu, và tin đang đọc không còn bị đẩy đi khi có trang mới chèn phía trên.</span></li>
-      <li data-kind="improved"><span class="kind kind-improved">Cải thiện</span><span>Cả 13 theme giờ tô tới diff, thẻ duyệt, câu hỏi và tài liệu; header, sidebar, ô soạn tin và trang tạo mới được thiết kế lại.</span></li>
-      <li data-kind="improved"><span class="kind kind-improved">Cải thiện</span><span>Một lượt đang chạy chỉ có một hiệu ứng chạy: spinner của bước, con trỏ khi chữ đang về, hoặc spinner khi agent đang nghĩ.</span></li>
-      <li data-kind="improved"><span class="kind kind-improved">Cải thiện</span><span>Website và README mới, có hướng dẫn Cập nhật và gỡ; ghi chú phát hành giờ từ một file duy nhất, file này sinh luôn <code>CHANGELOG.md</code>.</span></li>
-      <li data-kind="fixed"><span class="kind kind-fixed">Sửa lỗi</span><span>Lịch sử từng hiện markdown thô rồi co lại; giờ hiện đúng định dạng ngay từ đầu.</span></li>
-      <li data-kind="fixed"><span class="kind kind-fixed">Sửa lỗi</span><span>Tải nhiều trang tin cũ từng làm mất tin mới nhất mà không báo; cửa sổ giờ giữ 1.000 mục và có nút về tin mới nhất.</span></li>
-    </ul>
-  </div>
-</article>
-<article class="release" id="v1-41-0" data-release>
-  <div class="release-meta"><a class="release-version" href="#v1-41-0">v1.41.0</a><time class="release-date" datetime="2026-10-24">24/10/2026</time></div>
-  <div class="release-body">
-    <h3 data-toc-skip id="v1-41-0-title">Báo cáo thay đổi giao diện với ảnh trước/sau</h3>
-    <p>Skill mới biến task front-end thành báo cáo có ảnh trước/sau được khoanh khung, thay đổi business và logic, kết quả check, hiện ngay trên dashboard.</p>
-    <ul class="release-items">
-      <li data-kind="new"><span class="kind kind-new">Mới</span><span>Skill <code>fe-change-report</code> chụp trang cũ và mới ở chế độ headless trên cùng dữ liệu, khoanh từng thay đổi bằng khung đỏ đánh số trên cả hai ảnh.</span></li>
-      <li data-kind="new"><span class="kind kind-new">Mới</span><span>Agent chạy check của project và toàn bộ E2E headless, ghi rõ lỗi có từ trước, rồi viết lại thay đổi về business, logic và giao diện.</span></li>
-      <li data-kind="new"><span class="kind kind-new">Mới</span><span>Tài liệu trên dashboard vẽ <code>reports/fe-change/&lt;slug&gt;/report.json</code> thành báo cáo, có phóng to từng khung, kích thước màn hình khác và toàn màn hình.</span></li>
-      <li data-kind="new"><span class="kind kind-new">Mới</span><span>Script dùng Playwright có sẵn của project, không thêm dependency, và xuất một file <code>report.html</code> độc lập, không có script, để gửi cho bất kỳ ai.</span></li>
-      <li data-kind="security"><span class="kind kind-security">Bảo mật</span><span>Báo cáo được vẽ từ dữ liệu, không từ file HTML, và chỉ ảnh PNG của nó được trả về, nên dashboard vẫn không hiển thị markup do model tạo.</span></li>
-    </ul>
-  </div>
-</article>
 </section>
 <section class="section archive">
   <h2 id="archive">Các bản trước</h2>
   <p class="section-lead">Bản cũ hơn, gom theo tháng. Mở một tháng để xem từng thay đổi.</p>
   <details class="release-archive">
-    <summary><span>Tháng 10/2026</span><span class="archive-count">61</span></summary>
+    <summary><span>Tháng 10/2026</span><span class="archive-count">63</span></summary>
+    <div class="archive-row" id="v1-42-0">
+      <div class="archive-head"><a class="release-version" href="#v1-42-0">v1.42.0</a> <span class="release-date">25/10/2026</span></div>
+      <div class="archive-body">
+        <p><strong>Dashboard thiết kế lại, tin cũ tải mà không nhảy trang</strong> — Dashboard có một thang thiết kế và mọi theme tô tới mọi khung; tin cũ tự tải khi cuộn lên và tin bạn đang đọc đứng yên.</p>
+        <ul class="release-items">
+        <li data-kind="new"><span class="kind kind-new">Mới</span><span>Tin cũ tự tải khi cuộn gần đầu, và tin đang đọc không còn bị đẩy đi khi có trang mới chèn phía trên.</span></li>
+        <li data-kind="improved"><span class="kind kind-improved">Cải thiện</span><span>Cả 13 theme giờ tô tới diff, thẻ duyệt, câu hỏi và tài liệu; header, sidebar, ô soạn tin và trang tạo mới được thiết kế lại.</span></li>
+        <li data-kind="improved"><span class="kind kind-improved">Cải thiện</span><span>Một lượt đang chạy chỉ có một hiệu ứng chạy: spinner của bước, con trỏ khi chữ đang về, hoặc spinner khi agent đang nghĩ.</span></li>
+        <li data-kind="improved"><span class="kind kind-improved">Cải thiện</span><span>Website và README mới, có hướng dẫn Cập nhật và gỡ; ghi chú phát hành giờ từ một file duy nhất, file này sinh luôn <code>CHANGELOG.md</code>.</span></li>
+        <li data-kind="fixed"><span class="kind kind-fixed">Sửa lỗi</span><span>Lịch sử từng hiện markdown thô rồi co lại; giờ hiện đúng định dạng ngay từ đầu.</span></li>
+        <li data-kind="fixed"><span class="kind kind-fixed">Sửa lỗi</span><span>Tải nhiều trang tin cũ từng làm mất tin mới nhất mà không báo; cửa sổ giờ giữ 1.000 mục và có nút về tin mới nhất.</span></li>
+        </ul>
+      </div>
+    </div>
+    <div class="archive-row" id="v1-41-0">
+      <div class="archive-head"><a class="release-version" href="#v1-41-0">v1.41.0</a> <span class="release-date">24/10/2026</span></div>
+      <div class="archive-body">
+        <p><strong>Báo cáo thay đổi giao diện với ảnh trước/sau</strong> — Skill mới biến task front-end thành báo cáo có ảnh trước/sau được khoanh khung, thay đổi business và logic, kết quả check, hiện ngay trên dashboard.</p>
+        <ul class="release-items">
+        <li data-kind="new"><span class="kind kind-new">Mới</span><span>Skill <code>fe-change-report</code> chụp trang cũ và mới ở chế độ headless trên cùng dữ liệu, khoanh từng thay đổi bằng khung đỏ đánh số trên cả hai ảnh.</span></li>
+        <li data-kind="new"><span class="kind kind-new">Mới</span><span>Agent chạy check của project và toàn bộ E2E headless, ghi rõ lỗi có từ trước, rồi viết lại thay đổi về business, logic và giao diện.</span></li>
+        <li data-kind="new"><span class="kind kind-new">Mới</span><span>Tài liệu trên dashboard vẽ <code>reports/fe-change/&lt;slug&gt;/report.json</code> thành báo cáo, có phóng to từng khung, kích thước màn hình khác và toàn màn hình.</span></li>
+        <li data-kind="new"><span class="kind kind-new">Mới</span><span>Script dùng Playwright có sẵn của project, không thêm dependency, và xuất một file <code>report.html</code> độc lập, không có script, để gửi cho bất kỳ ai.</span></li>
+        <li data-kind="security"><span class="kind kind-security">Bảo mật</span><span>Báo cáo được vẽ từ dữ liệu, không từ file HTML, và chỉ ảnh PNG của nó được trả về, nên dashboard vẫn không hiển thị markup do model tạo.</span></li>
+        </ul>
+      </div>
+    </div>
     <div class="archive-row" id="v1-40-0">
       <div class="archive-head"><a class="release-version" href="#v1-40-0">v1.40.0</a> <span class="release-date">24/10/2026</span></div>
       <div class="archive-body">

package/docs-site/windows.html

@@ -37,7 +37,7 @@
         <span class="brand-mark"><img src="/assets/piagent-logo.svg" alt="" width="28" height="28" /></span>
         <span class="brand-name"><b>Piagent</b> <span>Platform</span></span>
       </a>
-      <a class="version-badge" href="/whats-new" data-docs-version="v1.46.4" title="v1.46.4 docs · VI"><span class="dot"></span>v1.46.4</a>
+      <a class="version-badge" href="/whats-new" data-docs-version="v1.48.0" title="v1.48.0 docs · VI"><span class="dot"></span>v1.48.0</a>
       <nav class="top-nav" aria-label="Tài liệu">
         <a href="/quickstart">Tài liệu</a>
         <a href="/whats-new">Changelog</a>

package/docs-site/workflows.html

@@ -37,7 +37,7 @@
         <span class="brand-mark"><img src="/assets/piagent-logo.svg" alt="" width="28" height="28" /></span>
         <span class="brand-name"><b>Piagent</b> <span>Platform</span></span>
       </a>
-      <a class="version-badge" href="/whats-new" data-docs-version="v1.46.4" title="v1.46.4 docs · VI"><span class="dot"></span>v1.46.4</a>
+      <a class="version-badge" href="/whats-new" data-docs-version="v1.48.0" title="v1.48.0 docs · VI"><span class="dot"></span>v1.48.0</a>
       <nav class="top-nav" aria-label="Tài liệu">
         <a href="/quickstart">Tài liệu</a>
         <a href="/whats-new">Changelog</a>

package/evals/private-holdout-v1/public-exposure.v2.json

@@ -256,8 +256,8 @@
     },
     {
       "path": "tests",
-      "fileCount": 636,
-      "sha256": "7d8a3af48dd9179f3bf3921cae65d3e6d18d17ff87d3454c29247f8cf1b34b63"
+      "fileCount": 641,
+      "sha256": "35835601b983facf21131404df71c12f622503a45ddfcdc1869610022e7bb101"
     }
   ],
   "custodianComparisonRules": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@piagent/platform",
-  "version": "1.46.4",
+  "version": "1.48.0",
   "license": "MIT",
   "publishConfig": {
     "access": "public",
@@ -141,6 +141,7 @@
     }
   },
   "dependencies": {
+    "@aliou/sh": "0.3.4",
     "@babel/parser": "7.29.8",
     "ws": "8.21.3"
   },

package/packages/piagent-core/extensions/guard-types.ts

@@ -29,6 +29,7 @@ export type ProjectProfile = {
   memory?: MemorySettings;
   contextIndex?: ContextIndexSettings;
   runtimePolicy?: RuntimePolicySettings;
+  autoDeny?: AutoDenyRule[];
   orchestration?: OrchestrationPolicySettings;
   techStack?: ProjectTechStackReference;
 };
@@ -322,8 +323,9 @@ export type ResolvedOrchestrationPolicy = {
   rules: string[];
 };
 
-// "bypass": personal sessions only; no Piagent gate asks or blocks (as Codex's
-// --dangerously-bypass-approvals-and-sandbox). Output redaction and turn checkpoints still run.
+// "bypass": personal sessions only; no Piagent gate asks or blocks the work. The
+// handoff (runtime/policy/handoff-policy.mjs) is still asked; output redaction
+// and turn checkpoints still run.
 export type PermissionProfileMode = "read-only" | "workspace-write" | "trusted-full-access" | "bypass";
 
 export type PermissionProfilesConfig = {
@@ -459,8 +461,14 @@ export type CommandRule = {
   ignoreSearchArguments?: boolean;
   value: string | string[];
   reason: string;
+  // A forbid that also ends the agent's turn, so it does not retry.
+  terminate?: boolean;
 };
 
+// A project's own refusals (profile `autoDeny`): matched like an exec rule,
+// refused in every permission mode, Bypass included.
+export type AutoDenyRule = { pattern: string; match?: "contains" | "regex" | "prefix"; reason: string; terminate?: boolean };
+
 export type ExecPolicyConfig = {
   defaultMode?: "advisory" | "enforce";
   bannedPrefixSuggestions?: string[][];

package/packages/piagent-core/extensions/piagent-guard.ts

@@ -38,15 +38,8 @@ import {
 import { detectProfileName } from "./project-shape.js";
 import { evaluateUpdateCheck, isInstalledPlatform, readUpdateCache, startUpdateProbe } from "./update-check.js";
 import { dormantInPersonalPi, personalPiAgentDir } from "./agent-home.js";
-import {
-  REPOSITORY_SCOPES,
-  collectServers,
-  configPathForScope,
-  mcpDecisionInputs,
-  unverifiableMcpConfig
-} from "../mcp/mcp-config-layers.js";
-import { attributeDirectTool } from "../mcp/mcp-tool-naming.js";
-import { approvalState } from "../mcp/mcp-approval-store.js";
+import { collectServers } from "../mcp/mcp-config-layers.js";
+import { evaluateMcpApproval, mcpApprovalCache } from "../runtime/mcp-repository-gate.mjs";
 import { evaluateServerReadiness, readinessNotice } from "../mcp/mcp-auth-readiness.js";
 import * as mcpActions from "../mcp/mcp-command-actions.js";
 import { buildExtendingProfile, resolveProjectProfileDocument } from "../capabilities/project-profile.js";
@@ -93,8 +86,9 @@ import { currentWorkspaceRevisionDigest } from "./workspace-revision.js";
 import { appendJsonlBounded } from "./state-retention.js";
 import { ensurePrivateStateDirectory, resolveLocalStatePath } from "./local-state-path.js";
 import { hasDurableContextEvidence } from "./context-evidence.js";
-import { piApprovalBroker, type ApprovalActionDraft, type ApprovalUnavailableFallback } from "../runtime/inspection/approval-broker.ts";
+import { piApprovalBroker, type ApprovalActionDraft, type ApprovalChoice, type ApprovalUnavailableFallback } from "../runtime/inspection/approval-broker.ts";
 import { createSourceMutationGuardBindings } from "../runtime/policy/source-mutation-guard-binding.ts";
+import { FULL_ACCESS_RUNS, handoffReason, mcpWriteAction, treeExecFinding } from "../runtime/policy/handoff-policy.mjs";
 import { createWorkspaceWriteAuthorityBindings } from "../runtime/policy/workspace-write-authority.ts";
 import { registerWorkspaceMemberEdits } from "../runtime/session/workspace-member-edits.mjs";
 import {
@@ -213,6 +207,7 @@ import type {
   ResolvedPermissionProfile,
   ReviewLens,
   RuntimePolicySettings,
+  CommandRule,
   TaskContract,
   TechContextSnapshot,
   TechOption,
@@ -561,8 +556,6 @@ function verifyProjectCapabilityState(
   }
 }
 
-// Exec-policy prompts a full-access session does not show: local, reversible.
-const FULL_ACCESS_SKIPPED_PROMPTS = ["prompt-git-add-broad"];
 
 function evaluateExecPolicy(command: string, profile: ProjectProfile, policy: BasePolicy): {
   mode: RuntimePolicySettings["execPolicy"];
@@ -571,7 +564,7 @@ function evaluateExecPolicy(command: string, profile: ProjectProfile, policy: Ba
   segments: Array<{ command: string; words: string[]; matches: string[]; warnings: string[] }>;
 } {
   const runtime = resolveRuntimePolicy(profile);
-  const execPolicy = execPolicyConfig(policy);
+  const execPolicy = { ...execPolicyConfig(policy), rules: [...execPolicyConfig(policy).rules, ...autoDenyRules(profile)] };
   const mode = runtime.execPolicy === "off" ? "off" : runtime.execPolicy ?? execPolicy.defaultMode;
   return evaluateExecPolicyCore(command, { policy: { ...policy, execPolicy }, mode }) as {
     mode: RuntimePolicySettings["execPolicy"];
@@ -930,6 +923,36 @@ function approvalUnavailableFallback(ctx: Pick<ExtensionContext, "ui">): Approva
   }
 }
 
+// A project's own refusals (profile `autoDeny`) as exec-policy forbid rules.
+function autoDenyRules(profile: ProjectProfile): CommandRule[] {
+  return (Array.isArray(profile.autoDeny) ? profile.autoDeny : []).filter((rule) => typeof rule?.pattern === "string" && rule.pattern.trim())
+    .map((rule, index) => ({ id: `auto-deny-${index + 1}`, action: "forbid" as const, match: rule.match ?? "contains", value: rule.pattern,
+      reason: String(rule.reason ?? "Refused by this project's autoDeny rule"), terminate: rule.terminate === true }));
+}
+// The block for a refused command; a rule with terminate also ends the turn.
+function execRefusal(decision: { reasons: string[]; segments: Array<{ matches: string[] }> }): { block: true; reason: string; terminate?: boolean } {
+  const terminate = decision.segments.some((segment) => segment.matches.some((match) => match.startsWith("terminate:")));
+  return { block: true, reason: decision.reasons.join("; ") + (terminate ? " Do not retry; the turn ends here." : ""), ...(terminate ? { terminate: true } : {}) };
+}
+
+// The member's four answers in the terminal (Pi's TUI). Elsewhere the
+// terminal keeps its yes/no question and the dashboard card offers the four.
+const TERMINAL_CHOICES: Record<ApprovalChoice, string> = { once: "Allow once", session: "Allow this exact action for the rest of the session",
+  deny: "Deny", stop: "Deny and stop the turn" };
+function terminalChooser(ctx: ExtensionContext, title: string, prompt: string, grantable: boolean): (() => Promise<ApprovalChoice>) | undefined {
+  if (ctx.mode !== "tui" || !ctx.hasUI || typeof ctx.ui.select !== "function") return undefined;
+  const choices = (["once", ...(grantable ? ["session"] : []), "deny", "stop"] as ApprovalChoice[]);
+  return async () => {
+    const picked = await ctx.ui.select(`${title}\n\n${prompt}`, choices.map((choice) => TERMINAL_CHOICES[choice]));
+    return choices.find((choice) => TERMINAL_CHOICES[choice] === picked) ?? "deny";
+  };
+}
+
+// Actions the member allowed for the rest of a session: the same tool with
+// the same exact command or input. A handoff is never kept.
+const sessionGrants = new Map<string, Set<string>>();
+const grantKey = (toolName: string, command: string | null, input: unknown) => `${toolName}\u0000${command ?? JSON.stringify(input ?? {})}`;
+
 function evaluatePathLikeToolAccess(
   cwd: string,
   toolName: string,
@@ -1131,10 +1154,13 @@ function normalizePermissionProfileMode(value: unknown): PermissionProfileMode |
 }
 
 function runtimeEquivalentForPermissionProfile(mode: PermissionProfileMode): string {
-  if (mode === "read-only") return "sandbox_mode=read-only";
-  if (mode === "trusted-full-access") return "sandbox_mode=danger-full-access + approval_policy=never, with Piagent protected-path and human-action gates still enforced";
-  if (mode === "bypass") return "sandbox_mode=danger-full-access + approval_policy=never; every Piagent gate off (output redaction and turn checkpoints remain)";
-  return "sandbox_mode=workspace-write + approval_policy=on-request";
+  // What the mode resembles in common sandbox terms. A personal session runs on this
+  // machine with no OS sandbox (execution-backend.js "host"): Piagent's policy
+  // checks are the boundary.
+  if (mode === "read-only") return "like sandbox_mode=read-only, enforced by Piagent policy (no OS sandbox)";
+  if (mode === "trusted-full-access") return "like sandbox_mode=danger-full-access; protected paths, destructive steps and the handoff (push, PR, publish, deploy, remote tools) are still asked";
+  if (mode === "bypass") return "like sandbox_mode=danger-full-access + approval_policy=never for the work; the handoff (push, PR, publish, deploy, remote tools, MCP writes) is still asked, and output redaction and turn checkpoints remain";
+  return "like sandbox_mode=workspace-write + approval_policy=on-request, enforced by Piagent policy (no OS sandbox)";
 }
 
 function sessionPermissionOverrideKey(ctx: ExtensionContext): string {
@@ -1789,143 +1815,6 @@ function prepareToolInputForPolicy(
   };
 }
 
-// Which MCP server a tool call is addressed to. The adapter exposes one proxy
-// tool named `mcp` that carries the server in `input.server`, and, under
-// directTools, one tool per server tool named `<prefix>_<tool>` where the prefix
-// is derived from the server name. Direct names are matched against the servers
-// this gate is holding rather than against a fixed pattern, because the prefix
-// is the server's own name and there is nothing constant to anchor on.
-function mcpServerFromToolCall(
-  toolName: string,
-  input: Record<string, unknown>,
-  candidates: Iterable<string>
-): string | undefined {
-  if (normalizeActionToken(toolName) === "mcp") {
-    return typeof input.server === "string" && input.server.trim() ? input.server.trim() : undefined;
-  }
-  return attributeDirectTool(toolName, candidates);
-}
-
-// Servers a repository defines are not usable until somebody on this machine has
-// approved them. This is the enforcement point: the adapter owns the connection
-// and this extension cannot prevent one being opened, but no tool call reaches an
-// unapproved server. The residual exposure is the connection itself, which is
-// worth stating plainly rather than describing this as a full block.
-//
-// Recomputed only when one of the files behind the decision changes, because
-// this runs on every tool call.
-interface RepositoryMcpGate {
-  blocked: Map<string, { state: string; origin: string }>; serverNames: Set<string>;
-  // Conditions under which no tool call can be checked at all, each with the
-  // sentence to show. These are not "a server is unapproved" — they are "this
-  // repository's config has put the gate in a state where it cannot tell which
-  // server a call belongs to", and the only sound answer to that is to stop.
-  unverifiable: string[];
-}
-
-const mcpApprovalCache = new Map<string, { signature: string; gate: RepositoryMcpGate }>();
-
-function repositoryMcpGate(cwd: string): RepositoryMcpGate {
-  // Repository scopes plus anything an `imports` key drags in from a file the
-  // clone carries. Collecting those here is the whole point: a server the gate
-  // never enumerates is a server it silently permits.
-  const servers = collectServers({ projectPath: cwd, scopes: [...REPOSITORY_SCOPES] });
-  const repositoryFiles = [...REPOSITORY_SCOPES].map((scope) => ({
-    scope,
-    file: configPathForScope(scope, { projectPath: cwd })
-  }));
-  // Every file the decision reads, listed by the module that reads them rather
-  // than restated here. Building this by hand is what went wrong: the scan grew
-  // to read merged settings from all four scopes and to stat import targets
-  // outside the repository, the hand-written list did not, and an already-loaded
-  // guard went on permitting calls after a personal global config had put the
-  // session in the state this gate exists to refuse.
-  const signature = [
-    ...servers.map((server) => `${server.origin}:${server.name}:${fileSignature(server.file)}`),
-    ...repositoryFiles.map((layer) => `layer:${layer.scope}:${fileSignature(layer.file)}`),
-    ...mcpDecisionInputs({ projectPath: cwd }).map((file) => `input:${file}:${fileSignature(file)}`),
-    `store:${fileSignature(path.join(os.homedir(), ".pi", "piagent-mcp-approvals.json"))}`
-  ].join("|");
-  const cached = mcpApprovalCache.get(cwd);
-  if (cached?.signature === signature) return cached.gate;
-
-  const blocked = new Map<string, { state: string; origin: string }>();
-  for (const server of servers) {
-    const state = approvalState({ projectPath: cwd, name: server.name, entry: server.entry });
-    if (state.state === "approved") continue;
-    // A name defined more than once keeps its blocking entry: the approved copy
-    // does not vouch for the one nobody has looked at.
-    blocked.set(server.name, { state: state.state, origin: server.origin });
-  }
-
-  // Two things a repository-carried config can do that leave nothing to check.
-  //
-  // It can ask for tools with no prefix, so a direct tool arrives under a bare
-  // name carrying no evidence of its server. Refusing only the proxy there was
-  // not a fix: the proxy is the one form that names its server, so blocking it
-  // and allowing the bare names left the hole exactly where it was.
-  //
-  // It can also import a kind whose config this platform cannot enumerate, and
-  // then the set of servers reaching the session is simply unknown. Blocking the
-  // servers that could be listed says nothing about the ones that could not.
-  //
-  // Both stop every tool call. A repository can make a session refuse to run;
-  // it must not be able to make one run a server nobody approved.
-  // Read from the shared module rather than decided here, so `piagent-mcp
-  // doctor` reports exactly what this refuses. The two disagreeing is how an
-  // operator ends up reading "PASS" while every tool call is being stopped.
-  const unverifiable = unverifiableMcpConfig({ projectPath: cwd }).map((problem) => problem.detail);
-
-  const gate = { blocked, serverNames: new Set(servers.map((server) => server.name)), unverifiable };
-  mcpApprovalCache.set(cwd, { signature, gate });
-  return gate;
-}
-
-function fileSignature(file: string): string {
-  try {
-    const stat = fs.statSync(file);
-    return `${stat.mtimeMs}:${stat.size}`;
-  } catch {
-    return "absent";
-  }
-}
-
-function evaluateMcpApproval(
-  cwd: string,
-  toolName: string,
-  input: Record<string, unknown>
-): { block: boolean; reason?: string } {
-  const gate = repositoryMcpGate(cwd);
-
-  // Every tool call, not only the ones that look like MCP. Under either of these
-  // conditions a call cannot be traced to a server, so there is no such thing as
-  // a call this gate can clear.
-  if (gate.unverifiable.length > 0) {
-    return { block: true, reason: `Blocked every tool call: ${gate.unverifiable.join(" ")}` };
-  }
-
-  const server = mcpServerFromToolCall(toolName, input, gate.blocked.keys());
-  if (!server) return { block: false };
-  const record = gate.blocked.get(server);
-  if (!record) return { block: false };
-  const explanation = record.state === "rejected"
-    ? "it was rejected for this project"
-    : record.state === "changed"
-      ? "its definition changed since it was approved"
-      : record.origin.startsWith("import:")
-        ? `this repository imports it from ${record.origin.slice("import:".length)} config and nobody on this machine has approved it here`
-        : "this repository defines it and nobody on this machine has approved it";
-  return {
-    block: true,
-    // Named as commands, because this is read inside a session: the reader can
-    // run these where they already are, without shelling out.
-    reason:
-      `Blocked MCP server ${server}: ${explanation}. ` +
-      `Review it with \`/piagent-mcp get ${server}\`, then \`/piagent-mcp approve ${server}\` to allow it ` +
-      `or \`/piagent-mcp reject ${server}\` to refuse it.`
-  };
-}
-
 // A word whose final path segment glues literal text onto an expansion --
 // `.en$(echo v)`, `${D}.env` -- names a file this process cannot know without
 // running the substitution. Matching the literal half against the protected
@@ -3861,6 +3750,38 @@ export default function piagentGuard(pi: ExtensionAPI) {
   // Bypass is for personal sessions only: a company session keeps Studio's rules.
   const bypassActive = (ctx: ExtensionContext) => !isCompanySession(ctx) && ctx.model?.provider !== "agent_watch_managed"
     && resolvePermissionProfile(loadProfileFromContext(ctx), policy, permissionOverrideFromContext(ctx)).mode === "bypass";
+  // Bypass runs the work without asking and stops at the handoff: a push, a
+  // PR or merge, a publish or deploy, a remote or cloud tool, an upload or an
+  // MCP tool that writes outside is asked about, as in every other mode.
+  const bypassHandoff = async (event: { toolName: string; toolCallId?: string; input?: unknown }, ctx: ExtensionContext): Promise<{ block: true; reason: string; terminate?: boolean } | undefined> => {
+    const input = isPlainRecord(event.input) ? event.input : {};
+    const prepared = SHELL_TOOL_NAMES.has(event.toolName) ? null : prepareToolInputForPolicy(event.toolName, input, policy);
+    const shell = extractShellCommandInput(prepared?.proxyShellCarrier && prepared.proxyArgs ? prepared.proxyArgs : SHELL_TOOL_NAMES.has(event.toolName) ? input : {});
+    const command = shell.command ? normalizeShellCommandForPolicy(shell.command) : null;
+    // The project's autoDeny rules hold in Bypass too: they are its own refusals.
+    const projectRules = autoDenyRules(loadProfileFromContext(ctx));
+    if (command && projectRules.length) {
+      const refused = evaluateExecPolicyCore(command, { policy: { execPolicy: { defaultMode: "enforce", bannedPrefixSuggestions: [], rules: projectRules } }, mode: "enforce" });
+      if (refused.decision === "forbid") return execRefusal(refused);
+    }
+    let reason = command ? await handoffReason(command) : null;
+    if (!reason && !command && prepared && classifyExternalAction(event.toolName, prepared.input, policy).decision === "confirm") {
+      const action = await mcpWriteAction(prepared.proxyTool ?? event.toolName);
+      if (action) reason = `${prepared.proxyToolName ?? event.toolName} writes outside this machine (${action})`;
+    }
+    if (!reason) return undefined;
+    const preview = command ?? prepared?.confirmationSummary ?? event.toolName;
+    const approval = await piApprovalBroker.request({ cwd: ctx.cwd, rawSessionId: ctx.sessionManager.getSessionId(), toolCallId: String(event.toolCallId), expectedTask: null,
+      action: { kind: "external-provider-action", preconditionClass: "runtime-only", treePrecondition: null, toolName: event.toolName, rawAction: { toolName: event.toolName, command, input },
+        commandPreview: command, parameterPreview: preview, targetPaths: [], targetSummaries: [reason], provider: command ? "shell-external" : String(prepared?.proxyToolName ?? event.toolName),
+        urlOrigin: null, requestedScope: "one-handoff", reason: `Bypass still asks before a handoff: ${reason}`, riskClass: "high",
+        allowConsequence: "Run this exact step once; the work leaves this machine.", denyConsequence: "The step does not run; the agent is told you declined." },
+      terminalConfirm: () => ctx.ui.confirm(`Bypass still asks before a handoff.\n\n${reason}\n\n${preview}\n\nAllow?`, "Piagent handoff confirmation"),
+      terminalChoose: terminalChooser(ctx, "Piagent handoff confirmation", `Bypass still asks before a handoff.\n\n${reason}\n\n${preview}`, false), unavailableFallback: approvalUnavailableFallback(ctx) });
+    if (!approval.allowed) return approval.choice === "stop" ? { block: true, terminate: true, reason: `User denied the handoff and stopped the turn: ${reason}. Do not retry; wait for the member.` } : { block: true, reason: `User denied the handoff: ${reason}` };
+    if (!approval.consume()) return { block: true, reason: "Approval became stale before tool start; the action was blocked." };
+    return undefined;
+  };
   registerToolCallHook(pi, {
     extractLikelyPath: extractLikelyPathFromInput,
     redactText,
@@ -3922,10 +3843,10 @@ export default function piagentGuard(pi: ExtensionAPI) {
       return undefined;
     },
     authorize: async (event, ctx) => {
-    // Bypass: no Piagent gate asks or blocks, as with Codex's
-    // --dangerously-bypass-approvals-and-sandbox. Tool output is still
-    // redacted and the turn still gets its checkpoint; neither stops a command.
-    if (bypassActive(ctx)) return;
+    // Bypass: no Piagent gate asks or blocks the work. The handoff is still
+    // asked (bypassHandoff); tool output is still redacted and the turn still
+    // gets its checkpoint.
+    if (bypassActive(ctx)) return bypassHandoff(event, ctx);
     const preInput = isPlainRecord(event.input) ? event.input : {};
     const authorizationTargetInspection = authorizationMutationTargetInspection(ctx.cwd, event.toolName, preInput);
     if (authorizationTargetInspection.reason) {
@@ -4016,9 +3937,11 @@ export default function piagentGuard(pi: ExtensionAPI) {
           && !candidate.startsWith("../")
           && !candidate.startsWith(".pi/piagent-state/")
         ));
-      if (execDecision.mode !== "off" && execDecision.decision === "forbid") {
-        return { block: true, reason: execDecision.reasons.join("; ") };
-      }
+      if (execDecision.mode !== "off" && execDecision.decision === "forbid") return execRefusal(execDecision);
+      // The shell syntax tree reads what the scanner may miss: a command in a
+      // function, a case arm or an unquoted heredoc's $( … ).
+      const treeFinding = execDecision.mode !== "off" ? treeExecFinding(command) : null;
+      if (treeFinding?.decision === "forbid") return { block: true, reason: treeFinding.reason };
 
       const protectedHit = findProtectedPathInCommand(command, pathPolicy.shellProtectedPaths);
       if (protectedHit) {
@@ -4047,16 +3970,21 @@ export default function piagentGuard(pi: ExtensionAPI) {
 
       // Full access skips the prompts for local, reversible steps; deletes,
       // migrations and anything sent outside this machine are still asked.
-      const confirmationReasons = (execDecision.mode !== "off" && execDecision.decision === "prompt" ? [...execDecision.reasons] : [])
+      const confirmationReasons = [...(execDecision.mode !== "off" && execDecision.decision === "prompt" ? execDecision.reasons : []), ...(treeFinding?.decision === "prompt" && !execDecision.reasons.includes(treeFinding.reason) ? [treeFinding.reason] : [])]
         .filter((reason) => permissionProfile.mode !== "trusted-full-access"
-          || !FULL_ACCESS_SKIPPED_PROMPTS.some((id) => reason.startsWith(`Prompt required by exec policy ${id}:`)));
-      const externalReason = findShellExternalConfirmationReason(execDecision.segments, externalActionPolicyConfig(policy));
-      if (externalReason) confirmationReasons.push(externalReason);
+          || ![...FULL_ACCESS_RUNS].some((id) => reason.startsWith(`Prompt required by exec policy ${id}:`)));
+      // The handoff (push, PR, publish, deploy, remote and cloud tools,
+      // uploads) is asked in every mode: runtime/policy/handoff-policy.mjs.
+      const handoff = await handoffReason(command);
+      const shellExternal = findShellExternalConfirmationReason(execDecision.segments, externalActionPolicyConfig(policy));
+      const handoffNote = handoff && !shellExternal && !confirmationReasons.includes(handoff) ? `Handoff requires confirmation: ${handoff}` : undefined;
+      const externalReason = shellExternal ?? (handoff ? handoffNote ?? handoff : undefined);
+      for (const reason of [shellExternal, handoffNote]) if (reason) confirmationReasons.push(reason);
       if (confirmationReasons.length > 0) {
         pendingHumanApproval = { prompt: `Command requires confirmation.\n\n${confirmationReasons.join("\n")}\n\nAllow?`, title: "Piagent exec policy confirmation",
           action: { kind: externalReason ? "external-provider-action" : "workspace-patch", preconditionClass: externalReason ? "runtime-only" : "workspace-tree", toolName: event.toolName, rawAction: { toolName: event.toolName, command, input: preparedInput.input },
             commandPreview: command, parameterPreview: preparedInput.confirmationSummary ?? "Shell command", targetPaths: shellMutationTargets, targetSummaries: confirmationReasons, provider: externalReason ? "shell-external" : null, urlOrigin: null,
-            requestedScope: "one-shell-command", reason: confirmationReasons.join("; "), riskClass: shellProjectMutation ? "high" : "medium", allowConsequence: "Run this exact command once, after the guard checks the working tree again.", denyConsequence: "The command does not run; the agent is told you declined." } };
+            requestedScope: handoff ? "one-handoff" : "one-shell-command", reason: confirmationReasons.join("; "), riskClass: shellProjectMutation ? "high" : "medium", allowConsequence: "Run this exact command once, after the guard checks the working tree again.", denyConsequence: "The command does not run; the agent is told you declined." } };
       }
     }
 
@@ -4109,16 +4037,25 @@ export default function piagentGuard(pi: ExtensionAPI) {
         : classifiedExternalAction;
       if (externalAction.decision === "confirm") {
         const inputSummary = preparedInput.confirmationSummary ? `\ninput: ${preparedInput.confirmationSummary}` : "";
+        // A write to the system behind the tool is a handoff: approved one at a time.
+        const writesOut = Boolean(await mcpWriteAction(preparedInput.proxyTool ?? event.toolName));
         pendingHumanApproval = { prompt: `External provider action requires confirmation.\n\nprovider: ${externalAction.provider}\naction: ${externalAction.action}\ntool: ${event.toolName}${inputSummary}\n\nAllow?`, title: "Piagent external action confirmation",
           action: { kind: "external-provider-action", preconditionClass: "runtime-only", toolName: event.toolName, rawAction: { toolName: event.toolName, input: preparedInput.input, provider: externalAction.provider, action: externalAction.action },
             commandPreview: null, parameterPreview: preparedInput.confirmationSummary ?? String(externalAction.action), targetPaths: [], targetSummaries: [], provider: String(externalAction.provider),
-            urlOrigin: null, requestedScope: "one-external-action", reason: `External provider action ${String(externalAction.action)} requires confirmation`, riskClass: "high", allowConsequence: "Run this exact action once, after the guard checks its authority again.", denyConsequence: "The action does not run; nothing outside changes." } };
+            urlOrigin: null, requestedScope: writesOut ? "one-handoff" : "one-external-action", reason: `External provider action ${String(externalAction.action)} requires confirmation`, riskClass: "high", allowConsequence: "Run this exact action once, after the guard checks its authority again.", denyConsequence: "The action does not run; nothing outside changes." } };
       }
     }
 
+    const grants = sessionGrants.get(ctx.sessionManager.getSessionId()) ?? new Set<string>();
+    const grantable = Boolean(pendingHumanApproval) && !/handoff/.test(String(pendingHumanApproval!.action.requestedScope));
+    const grant = grantKey(event.toolName, typeof pendingHumanApproval?.action.commandPreview === "string" ? pendingHumanApproval.action.commandPreview : null, preparedInput.input);
+    if (pendingHumanApproval && grantable && grants.has(grant)) pendingHumanApproval = null;
     if (pendingHumanApproval) {
-      const approval = await piApprovalBroker.request({ cwd: ctx.cwd, rawSessionId: ctx.sessionManager.getSessionId(), toolCallId: String(event.toolCallId), expectedTask: null, action: { ...pendingHumanApproval.action, preconditionClass: "runtime-only", treePrecondition: null }, terminalConfirm: () => ctx.ui.confirm(pendingHumanApproval!.prompt, pendingHumanApproval!.title), unavailableFallback: approvalUnavailableFallback(ctx) });
-      if (!approval.allowed) return { block: true, reason: pendingHumanApproval.action.kind === "external-provider-action" && !SHELL_TOOL_NAMES.has(event.toolName) ? `User denied external provider action: ${event.toolName}` : `User denied command: ${pendingHumanApproval.action.reason}` };
+      const approval = await piApprovalBroker.request({ cwd: ctx.cwd, rawSessionId: ctx.sessionManager.getSessionId(), toolCallId: String(event.toolCallId), expectedTask: null, action: { ...pendingHumanApproval.action, preconditionClass: "runtime-only", treePrecondition: null }, terminalConfirm: () => ctx.ui.confirm(pendingHumanApproval!.prompt, pendingHumanApproval!.title),
+        terminalChoose: terminalChooser(ctx, pendingHumanApproval.title, pendingHumanApproval.prompt, grantable), unavailableFallback: approvalUnavailableFallback(ctx) });
+      if (!approval.allowed) return { block: true, reason: pendingHumanApproval.action.kind === "external-provider-action" && !SHELL_TOOL_NAMES.has(event.toolName) ? `User denied external provider action: ${event.toolName}` : `User denied command: ${pendingHumanApproval.action.reason}`,
+        ...(approval.choice === "stop" ? { terminate: true, reason: `User denied and stopped the turn: ${pendingHumanApproval.action.reason}. Do not retry; wait for the member.` } : {}) };
+      if (approval.choice === "session" && grantable) sessionGrants.set(ctx.sessionManager.getSessionId(), grants.add(grant));
       // A WebUI allow is provisional until the guard consumes it here. Without
       // this the decision request never got its receipt and the approval stayed
       // pending, filling the broker until it stopped accepting WebUI decisions.