@piagent/platform 1.46.4 → 1.48.0

package/packages/piagent-core/managed/resource-loader.mjs

@@ -26,10 +26,10 @@ export function projectInstructions(cwd, top = cwd) {
 // discovered in a project. Skills and commands are text (agent-skills.mjs):
 // what they ask for runs with the session's own tools.
 // themes: Piagent's own (the company Terminal's /style), loaded by the host.
-export function managedResourceLoader(api, { systemPrompt, extensions = [], runtime = api.createExtensionRuntime(), agentsFiles = [], skills = [], prompts = [], themes = [] } = {}) {
+export function managedResourceLoader(api, { systemPrompt, extensions = [], runtime = api.createExtensionRuntime(), errors = [], agentsFiles = [], skills = [], prompts = [], themes = [] } = {}) {
   const empty = Object.freeze([]);
   return Object.freeze({
-    getExtensions: () => ({ extensions, errors: empty, runtime }),
+    getExtensions: () => ({ extensions, errors: [...errors], runtime }),
     getSkills: () => ({ skills: [...skills], diagnostics: empty }),
     getPrompts: () => ({ prompts: [...prompts], diagnostics: empty }),
     getThemes: () => ({ themes: [...themes], diagnostics: empty }),
@@ -45,12 +45,24 @@ export function managedResourceLoader(api, { systemPrompt, extensions = [], runt
 
 // Extensions the company Terminal adds itself (its commands and how Harness
 // notes read), built the way Pi builds an inline extension. Never project code.
-export async function inlineExtensions(api, sdkRoot, cwd, factories = []) {
+// `paths`: installed extensions loaded the way Pi loads a package's (only the
+// member's MCP adapter, member-mcp.mjs); one that fails to load is reported in
+// `errors` and the session opens without it.
+export async function inlineExtensions(api, sdkRoot, cwd, factories = [], paths = []) {
   const runtime = api.createExtensionRuntime();
-  if (!factories.length) return { extensions: [], runtime };
+  if (!factories.length && !paths.length) return { extensions: [], runtime };
   const load = (file) => import(pathToFileURL(path.join(sdkRoot, 'dist', ...file.split('/'))).href);
-  const [{ loadExtensionFromFactory }, { createEventBus }] = await Promise.all([load('core/extensions/loader.js'), load('core/event-bus.js')]);
-  const bus = createEventBus(), extensions = [];
+  const [{ loadExtensionFromFactory, loadExtensions }, { createEventBus }] = await Promise.all([load('core/extensions/loader.js'), load('core/event-bus.js')]);
+  const bus = createEventBus(), extensions = [], errors = [];
   for (const [index, factory] of factories.entries()) extensions.push(await loadExtensionFromFactory(factory, cwd, bus, runtime, `<inline:company-terminal-${index + 1}>`));
-  return { extensions, runtime };
+  if (paths.length) {
+    // Pi's theme exists only once a terminal draws; the MCP adapter colours its
+    // status line with it in every mode, and without one (RPC, the WebUI) its
+    // start failed. The Terminal sets its own theme later.
+    const { theme, initTheme } = await load('modes/interactive/theme/theme.js');
+    try { void theme.fg; } catch { initTheme(); }
+    try { const loaded = await loadExtensions(paths, cwd, bus, runtime); extensions.push(...loaded.extensions); errors.push(...loaded.errors); }
+    catch (error) { errors.push({ path: paths.join(', '), error: error instanceof Error ? error.message : String(error) }); }
+  }
+  return { extensions, runtime, errors };
 }

package/packages/piagent-core/managed/sandbox-diagnostic.mjs

@@ -21,11 +21,15 @@ const DOCKER_DAEMON = /Cannot connect to the Docker daemon|connect to the docker
 // A runtime or tool the command needs is not on this machine (or not the
 // version the project asks for).
 const TOOLCHAIN = /Unable to locate a Java Runtime|No Java runtime present|JAVA_HOME is not (?:set|defined correctly)|(?:^|\n)\S*?(?:ba|z)?sh: (?:line \d+: )?[\w.+-]+: command not found|zsh: command not found: [\w.+-]+|xcrun: error: (?:unable to find utility|invalid active developer path)|env: '?[\w.+-]+'?: No such file or directory|Unsupported class file major version|invalid target release: \d+|release version \d+ not supported|requires? (?:at least )?Java \d+|The engine "node" is incompatible|Unsupported engine/i;
+// The iOS Simulator (CoreSimulator) and Android's adb/emulator, which the
+// sandbox does not reach.
+const SIMULATOR = /CoreSimulator|simctl|Unable to boot device|Unable to lookup in current state|Failed to start launchd_sim|adb: (?:cannot connect|failed to check server version|no devices|device offline)|cannot connect to daemon|\bemulator: (?:ERROR|PANIC)|Unable to find a destination matching|xcodebuild: error: Unable to find a destination/i;
 // The member's sign-in, which the sandbox does not have.
 const SIGN_IN = /could not read (?:Username|Password) for|terminal prompts disabled|Authentication failed for|Permission denied \(publickey|Host key verification failed|not logged into any GitHub hosts|please run:\s+gh auth login|Could not open a connection to your authentication agent|\bENEEDAUTH\b|\bE401\b|\b401 Unauthorized|requires authentication|denied: requested access to the resource is denied|pull access denied/i;
 
 export function sandboxDiagnostic(message, { network = false, isolated = false, docker = false, engine = false } = {}) {
   const text=String(message);
+  if(!network&&SIMULATOR.test(text))return 'managed-simulator-unreachable: Lệnh bash trong sandbox không tới được iOS Simulator hay Android emulator. Chạy lệnh simulator (xcrun simctl, xcodebuild cho simulator, adb, emulator, ./gradlew installDebug, flutter, npx expo) bằng run_on_simulator.\n'+text;
   if(docker&&DOCKER_DAEMON.test(text))return 'managed-docker-unreachable: Lệnh chạy với Docker nhưng Docker engine không trả lời (Docker Desktop/Colima/OrbStack chưa chạy hoặc đang khởi động). Gọi start_docker để xin member duyệt mở Docker, rồi chạy lại đúng lệnh này bằng run_with_docker.\n'+text;
   if(!docker&&DOCKER_DAEMON.test(text))return (engine?'managed-docker-blocked: Lệnh bash thường không dùng được Docker trong chế độ công ty. Lệnh docker, docker compose, hoặc test cần Docker (Testcontainers) chạy qua run_with_docker để người dùng duyệt đúng lệnh đó.\n':'managed-docker-unavailable: Docker engine trên máy chưa chạy. Gọi start_docker để xin member duyệt mở Docker, rồi chạy lệnh bằng run_with_docker.\n')+text;
   if(TOOLCHAIN.test(text))return 'managed-toolchain-missing: Máy thiếu runtime/công cụ mà lệnh cần, hoặc sai version project yêu cầu. Đừng dừng ở đây: xem project cần gì (pom.xml, build.gradle, .nvmrc, .tool-versions, package.json engines…) rồi dùng run_on_host để xin member duyệt cài trên máy (ví dụ brew install openjdk@21, brew install node@22, sdk install java 21-tem), sau đó chạy lại lệnh. Nếu project build được trong Docker thì có thể đề xuất run_with_docker. Trình cài cần mật khẩu (sudo, file .pkg) thì hỏi member bằng ask_user.\n'+text;

package/packages/piagent-core/managed/session.mjs

@@ -24,7 +24,7 @@ import { readPatchDigest, readPatchSnapshot, readChangedFiles, readHead } from '
 import { memberTurn } from './continuation.mjs';
 import { workflowPolicy, repositoryChecks, sessionPlanTool, currentPlan, workflowPrompt, RunProcess, completionGate, pendingBaseline, pendingPaths, pendingHead, processEditTools } from './workflow.mjs';
 import { workflowContextTool, workflowContextExtension } from './workflow-context.mjs';
-import { beforeDelegate, resolveTool } from './objections.mjs'; import { fanOut, withDroppedNote } from './copies.mjs';
+import { beforeDelegate, resolveTool } from './objections.mjs'; import { fanOut, withDroppedNote } from './copies.mjs'; import { withMemberMcp } from './member-mcp.mjs';
 import { HELPER_CALLS, HELPER_ROLES, helperRoles, helperPrompt, webPrompt, delegateDescription, mainWebLookups, limitedWebTools } from './helper-roles.mjs'; import { delegateParameters, delegateArgs, SPEC_PROMPT } from './helper-settlement.mjs';
 import { loadAgentResources } from './agent-skills.mjs';
 import { loadPiagentThemes } from '../runtime/terminal/terminal-style.mjs';
@@ -137,8 +137,8 @@ export class ManagedSession {
     self.checks = repositoryChecks(agentsFiles, self.cwd, self.boundary.repositoryTop);
     // The Harness workflow (possibly changed on a later enrollment) adds its process to the prompt.
     const loader = managedResourceLoader(api, { systemPrompt: () => BASE_PROMPT + referencePrompt(self.boundary.userHome) + TEST_PROMPT + servicesPrompt(self.boundary) + webPrompt(helperRoles(manifest), mainWebLookups(manifest)) + helperPrompt(helperRoles(self.manifest)) + workflowPrompt(workflowPolicy(self.manifest), self.checks), agentsFiles,
-      skills: self.resources.skills, prompts: self.resources.prompts, themes: terminalExtensions.length ? await loadPiagentThemes(sdk) : [], ...await inlineExtensions(api, sdk, self.cwd,
-        [...terminalExtensions, workflowContextExtension(self.cwd, () => self.session.sessionManager)]) });
+      skills: self.resources.skills, prompts: self.resources.prompts, themes: terminalExtensions.length ? await loadPiagentThemes(sdk) : [], ...await inlineExtensions(api, sdk, self.cwd, // and the member's MCP servers (member-mcp.mjs)
+        ...withMemberMcp(self.cwd, [...terminalExtensions, workflowContextExtension(self.cwd, () => self.session.sessionManager)], undefined, self)) });
     const settings = api.SettingsManager.inMemory({ retry: { enabled: false, provider: { maxRetries: 0 } }, cacheWarming: 'off', enableInstallTelemetry: false, enableAnalytics: false, enableSkillCommands: true });
     const manager = sessionManager ?? api.SessionManager.inMemory(self.cwd); attachMemory(self, manager, agentDir, g => verifyGrant(g, self.manifest, 'main')); self.studioLink = new StudioLink({ origin: self.origin, agentDir, notify: event => self.notify(event), ui: () => self.session?.extensionRunner?.getUIContext?.() });
     const scope = scopeOf(self.origin, manifest);
@@ -169,7 +169,7 @@ export class ManagedSession {
     self.session = result.session;
     self.session.managedExecution = true;
     self.turnRetry = enableCompanyTurnRetry(self.session, settings, self.studioLink);
-    // The member's access for this conversation: ask first, or Bypass (permission.mjs).
+    // The member's access for this conversation: Ask first, Full access or Bypass (permission.mjs).
     self.permission = restorePermission(manager); recordBypass(self, manager); self.session.managedSetPermission = permissionSetter(self, manager);
     // Fast mode, where the Harness allows it (fast-mode.mjs): off until the member turns it on.
     self.fast = restoreFast(manager); recordFast(self, manager); self.session.managedSetFast = fastSetter(self, manager); self.session.managedFastState = () => fastState(self); // null where the Harness does not allow it

package/packages/piagent-core/managed/simulator-commands.mjs

@@ -0,0 +1,117 @@
+import path from 'node:path';
+
+// What run_on_simulator runs on the member's machine: the iOS Simulator and
+// Android emulator, and the builds that install an app on them (the sandbox
+// reaches neither CoreSimulator nor adb). Only these programs, joined by &&,
+// || or a pipe into an output filter; output may go to a file in the project
+// (a screenshot), nothing else leaves it. Anything wider is run_on_host.
+
+const XCRUN = new Set(['simctl', 'xcodebuild', 'devicectl', 'xcresulttool', 'xctrace']);
+// `simctl spawn` starts a program of the simulator's runtime as the member:
+// only `log` (the app's logs).
+const simctl = words => words[1] !== 'simctl' || words[2] !== 'spawn' || words.slice(3).filter(word => !word.startsWith('-'))[1] === 'log';
+const NPX = /^(expo|react-native|@react-native-community\/cli|cap|@capacitor\/cli)(@[\w.-]+)?$/;
+// Program → whether its arguments are allowed (`words` without assignments,
+// `inProject` a path check against the project folder).
+const PROGRAMS = {
+  xcrun: words => XCRUN.has(words[1]) && simctl(words),
+  xcodebuild: () => true,
+  open: words => words.length === 3 && words[1] === '-a' && words[2] === 'Simulator',
+  adb: () => true, emulator: () => true, avdmanager: () => true, sdkmanager: () => true,
+  gradlew: (words, inProject) => inProject(words[0]),
+  // Taps, typing and the screen's accessibility tree; `axe init` writes into other tools' settings.
+  axe: words => !!words[1] && words[1] !== 'init',
+  xcodegen: words => words[1] === 'generate',
+  flutter: () => true,
+  pod: words => words[1] === 'install',
+  npx: words => NPX.test(words[1] === '--yes' || words[1] === '-y' ? words[2] ?? '' : words[1] ?? ''),
+  // Waiting for a boot, and reading what a build printed.
+  sleep: words => words.length === 2 && /^\d{1,3}$/.test(words[1]),
+  xcbeautify: () => true, xcpretty: () => true,
+  grep: () => true, head: () => true, tail: () => true, wc: () => true, sort: () => true, uniq: () => true, jq: () => true,
+  cd: (words, inProject) => words.length === 2 && inProject(words[1]),
+  mkdir: (words, inProject) => { const paths = words.slice(1).filter(word => word !== '-p'); return paths.length > 0 && paths.every(inProject); },
+};
+// Variables a command may set for itself; never what changes how programs load.
+const ASSIGNMENT = /^([A-Z][A-Z0-9_]*)=/;
+const UNSAFE_VARIABLE = /^(PATH|DYLD_\w*|LD_\w*|NODE_OPTIONS|BASH_ENV|ENV|ZDOTDIR|SHELL|HOME)$/;
+
+// A path in the project folder: relative without climbing out of it, or
+// absolute inside it (agents name files by their full path). Without the
+// folder, only a relative one.
+function insideProject(cwd) {
+  return target => {
+    if (typeof target !== 'string' || !target || target.startsWith('~') || target.includes('$') || target.split('/').includes('..')) return false;
+    if (!target.startsWith('/')) return true;
+    if (!cwd) return false;
+    const relative = path.relative(path.resolve(cwd), path.resolve(target));
+    return !relative.startsWith('..') && !path.isAbsolute(relative);
+  };
+}
+
+// Shell words with their quotes resolved, and the operators between them.
+// null for what this reader does not follow (an unclosed quote).
+function tokens(command) {
+  const out = []; let word = null, quote = null;
+  const push = () => { if (word !== null) { out.push({ word }); word = null; } };
+  for (let i = 0; i < command.length; i += 1) {
+    const c = command[i];
+    if (quote) { if (c === quote) quote = null; else if (c === '\\' && quote === '"' && i + 1 < command.length) word += command[++i]; else word += c; continue; }
+    if (c === "'" || c === '"') { quote = c; word ??= ''; continue; }
+    if (c === '\\' && i + 1 < command.length) { word = (word ?? '') + command[++i]; continue; }
+    if (/\s/.test(c)) { push(); continue; }
+    const two = command.slice(i, i + 2);
+    if (['&&', '||', '>>', '2>'].includes(two)) {
+      push();
+      if (two === '2>' && command[i + 2] === '&' && command[i + 3] === '1') { out.push({ op: '2>&1' }); i += 3; continue; }
+      out.push({ op: two }); i += 1; continue;
+    }
+    if (c === '|' || c === '>') { push(); out.push({ op: c }); continue; }
+    word = (word ?? '') + c;
+  }
+  if (quote) return null;
+  push();
+  return out;
+}
+
+// Why the command is not a simulator command, or null when it is. `cwd`:
+// the project folder, where output files and `cd` may go.
+export function simulatorCommandReason(command, cwd = null) {
+  const text = String(command ?? ''), inProject = insideProject(cwd);
+  if (!text.trim()) return 'the command is empty';
+  if (/[`;\n]|\$\(|<\(|>\(|</.test(text) || text.replaceAll('&&', '').replaceAll('2>&1', '').includes('&')) return 'only commands joined by &&, || or | are run (no ;, &, $( ), backticks or subshells)';
+  const list = tokens(text);
+  if (!list) return 'an unclosed quote';
+  let words = [];
+  const close = () => {
+    if (!words.length) return 'an empty part between operators';
+    while (words.length && ASSIGNMENT.test(words[0])) {
+      const name = ASSIGNMENT.exec(words[0])[1];
+      if (UNSAFE_VARIABLE.test(name)) return `${name} cannot be set here`;
+      words = words.slice(1);
+    }
+    const name = words[0]?.split('/').pop();
+    const allowed = Object.hasOwn(PROGRAMS, name) && PROGRAMS[name](words, inProject);
+    words = [];
+    return allowed ? null : `${name ?? 'this part'} is not a simulator or app build command (use run_on_host for other commands)`;
+  };
+  for (let i = 0; i < list.length; i += 1) {
+    const { word, op } = list[i];
+    if (word !== undefined) { words.push(word); continue; }
+    if (op === '2>&1') continue;
+    if (op === '>' || op === '>>' || op === '2>') {
+      const target = list[i + 1]?.word;
+      if (!(target === '/dev/null' || inProject(target))) return 'output may go only to a file inside the project or /dev/null';
+      i += 1; continue;
+    }
+    const reason = close(); if (reason) return reason;
+  }
+  return close();
+}
+
+// A lone `emulator …` keeps running while the virtual device is up: it is
+// started detached and the tool returns once it is launched.
+export function detachedEmulator(command) {
+  const list = tokens(String(command ?? ''));
+  return !!list && list.length > 0 && list.every(token => token.word !== undefined) && list[0].word.split('/').pop() === 'emulator';
+}

package/packages/piagent-core/mcp/mcp-server-catalog.js

@@ -151,6 +151,18 @@ export const CATALOG_SERVERS = {
       directTools: false
     }
   },
+  // Atlassian's own remote server (Jira and Confluence Cloud). It registers its
+  // OAuth client itself (the metadata sits at the origin, not at the protected
+  // resource), so the member signs in with /mcp-auth and their own Jira access.
+  atlassian: {
+    description: "Atlassian Rovo MCP server: Jira and Confluence Cloud, with the member's own Atlassian login (OAuth).",
+    config: {
+      url: "https://mcp.atlassian.com/v1/mcp",
+      auth: "oauth",
+      lifecycle: "lazy",
+      directTools: false
+    }
+  },
   // Converts .docx, .xlsx, .pptx and .pdf to Markdown locally. Local matters:
   // the alternative to this is uploading a document somewhere to read it, and a
   // document worth converting is usually one worth not uploading.
@@ -202,6 +214,10 @@ export const CATALOG_PREREQUISITES = {
     "Developer Preview: no Pi OAuth end-to-end release proof exists yet",
     "Google's supported client guides use an OAuth client id and secret; Pi's public-client/PKCE compatibility is unverified"
   ],
+  atlassian: [
+    "a Jira or Confluence Cloud site (Server and Data Center are not served by this endpoint)",
+    "sign in once with /mcp-auth atlassian; a site admin may have to allow the Atlassian MCP connection"
+  ],
   markitdown: [
     "uv on PATH (https://docs.astral.sh/uv); the first run downloads a Python runtime and roughly 120 MB of dependencies",
     "note: markitdown-mcp is published as an alpha, so pin changes deliberately"
@@ -244,11 +260,12 @@ export const CATALOG_PRESETS = {
   "google-mail": ["gmail"],
   google: ["google-drive", "google-docs", "google-sheets"],
   "google-all": ["google-drive", "gmail", "google-docs", "google-sheets"],
+  atlassian: ["atlassian"],
   core: ["context7", "chrome-devtools", "github"],
   popular: ["context7", "chrome-devtools", "playwright", "github", "figma-desktop"],
   all: [
     "context7", "chrome-devtools", "playwright", "github", "figma-desktop", "figma",
-    "markitdown", "google-drive", "gmail", "google-docs", "google-sheets"
+    "markitdown", "atlassian", "google-drive", "gmail", "google-docs", "google-sheets"
   ]
 };
 

package/packages/piagent-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@piagent/core",
-  "version": "1.46.4",
+  "version": "1.48.0",
   "type": "module",
   "private": true,
   "license": "MIT",

package/packages/piagent-core/runtime/hooks/session-start-hook.ts

@@ -320,7 +320,7 @@ export function registerSessionStartHook(pi: ExtensionAPI, dependencies: Session
       ctx.ui.notify("Piagent permission profile trusted-full-access is active; protected paths, secret redaction, and destructive/external confirmations remain enforced.", "warning");
     }
     if (permissionProfile.mode === "bypass") {
-      ctx.ui.notify("Piagent bypass is active: no confirmation, protected-path or policy gate applies in this personal session. Output redaction and /undo checkpoints remain.", "warning");
+      ctx.ui.notify("Piagent bypass is active: the work runs without confirmation, protected-path or policy gates in this personal session. The handoff (push, PR, publish, deploy, remote tools, MCP writes) is still asked; output redaction and /undo checkpoints remain.", "warning");
     }
     const mcpNotice = dependencies.mcpReadinessNotice(ctx.cwd);
     if (mcpNotice) ctx.ui.notify(mcpNotice, "warning");

package/packages/piagent-core/runtime/inspection/approval-broker.ts

@@ -40,8 +40,15 @@ type Binding = { cwd: string; rawSessionId: string; runtimeInstanceId: string; s
 type Pending = { request: Request; resolve(value: ApprovalGuardDecision): void; receipt: Receipt | null; timer: NodeJS.Timeout;
   finalWaiters: Array<(receipt: Receipt) => void>; recheck(): boolean };
 export type ApprovalBrokerEvent = { kind: "requested" | "resolved" | "expired" | "cancelled"; approvalRef: string; request?: Request; receipt?: Receipt };
-export type ApprovalGuardDecision = { allowed: boolean; brokered: boolean; receipt: Receipt | null;
+// What the member chose: allow this exact action once, allow the same exact
+// action for the rest of the session (offered only where the request allows
+// it, never for a handoff), deny it, or deny it and stop the turn so the
+// agent does not try again. A decision without a choice is once or deny.
+export type ApprovalChoice = "once" | "session" | "deny" | "stop";
+export type ApprovalGuardDecision = { allowed: boolean; brokered: boolean; receipt: Receipt | null; choice: ApprovalChoice;
   consume(): boolean; cancel(reasonCode?: string): void };
+const choiceOf = (allowed: boolean, value?: { scope?: unknown; stop?: unknown }): ApprovalChoice =>
+  allowed ? (value?.scope === "session" ? "session" : "once") : (value?.stop === true ? "stop" : "deny");
 export type ApprovalUnavailableFallback = "terminal-confirm" | "deny";
 
 function canonical(value: unknown): string {
@@ -54,6 +61,12 @@ function exactTimestamp(value: unknown): value is string {
   if (typeof value !== "string" || !TIMESTAMP.test(value)) return false;
   const parsed = Date.parse(value); return Number.isFinite(parsed) && new Date(parsed).toISOString() === value;
 }
+// The member's answer in the terminal: their choice where the caller offers
+// the four, else yes or no.
+function terminalChoice(input: { terminalConfirm(): Promise<boolean>; terminalChoose?(): Promise<ApprovalChoice> }): () => Promise<ApprovalChoice> {
+  return input.terminalChoose ? () => input.terminalChoose!() : () => input.terminalConfirm().then((allow) => allow ? "once" as const : "deny" as const);
+}
+
 function exactKeys(value: unknown, keys: string[]): boolean {
   return Boolean(value && typeof value === "object" && !Array.isArray(value)
     && canonical(Object.keys(value as Record<string, unknown>).sort()) === canonical([...keys].sort()));
@@ -135,7 +148,7 @@ export class PiApprovalBroker {
   }
 
   async request(input: { cwd: string; rawSessionId: string; toolCallId: string; action: ApprovalActionDraft;
-    expectedTask?: { taskId: string; taskRunId: string } | null; terminalConfirm(): Promise<boolean>;
+    expectedTask?: { taskId: string; taskRunId: string } | null; terminalConfirm(): Promise<boolean>; terminalChoose?(): Promise<ApprovalChoice>;
     unavailableFallback?: ApprovalUnavailableFallback; recheck?(): boolean; ttlMs?: number }): Promise<ApprovalGuardDecision> {
     const binding = this.#bindings.get(key(input.cwd, input.rawSessionId));
     const authority = binding?.authority();
@@ -166,8 +179,8 @@ export class PiApprovalBroker {
       while (binding.requests.size > MAX_PENDING + MAX_RECENT) binding.requests.delete(binding.requests.keys().next().value as string);
     });
     this.#emit(binding, { kind: "requested", approvalRef, request: clone(request) });
-    void Promise.resolve().then(input.terminalConfirm).then(
-      (allow) => this.#settle(binding, approvalRef, allow ? "allow" : "deny", "terminal", ref("decision", binding.secret, [approvalRef, "terminal", now])),
+    void Promise.resolve().then(terminalChoice(input)).then(
+      (choice) => this.#settle(binding, approvalRef, choice === "once" || choice === "session" ? "allow" : "deny", "terminal", ref("decision", binding.secret, [approvalRef, "terminal", now]), choice),
       () => this.#settle(binding, approvalRef, "deny", "terminal", ref("decision", binding.secret, [approvalRef, "terminal-error", now]))
     );
     return result;
@@ -191,20 +204,21 @@ export class PiApprovalBroker {
     }
     if (Date.now() >= Date.parse(pending.request.expiresAt)) { this.#expire(binding, approvalRef); throw new Error("approval-expired"); }
     const final = new Promise<Receipt>((resolve) => pending.finalWaiters.push(resolve));
-    this.#settle(binding, approvalRef, decision.decision, "webui", decision.decisionId);
+    this.#settle(binding, approvalRef, decision.decision, "webui", decision.decisionId, choiceOf(decision.decision === "allow", decision));
     if (decision.decision === "deny") return clone(binding.recent.at(-1)!);
     return final;
   }
 
-  #terminalOnly(confirm: () => Promise<boolean>): Promise<ApprovalGuardDecision> {
-    return Promise.resolve().then(confirm).then((allowed) => ({ allowed, brokered: false, receipt: null,
-      consume: () => allowed, cancel: () => undefined }), () => ({ allowed: false, brokered: false, receipt: null,
-      consume: () => false, cancel: () => undefined }));
+  #terminalOnly(choose: () => Promise<ApprovalChoice>): Promise<ApprovalGuardDecision> {
+    return Promise.resolve().then(choose).then((choice) => {
+      const allowed = choice === "once" || choice === "session";
+      return { allowed, brokered: false, receipt: null, choice, consume: () => allowed, cancel: () => undefined };
+    }, () => ({ allowed: false, brokered: false, receipt: null, choice: "deny" as const, consume: () => false, cancel: () => undefined }));
   }
 
-  #unavailable(input: { terminalConfirm(): Promise<boolean>; unavailableFallback?: ApprovalUnavailableFallback }): Promise<ApprovalGuardDecision> {
-    if (input.unavailableFallback !== "deny") return this.#terminalOnly(input.terminalConfirm);
-    return Promise.resolve({ allowed: false, brokered: false, receipt: null, consume: () => false, cancel: () => undefined });
+  #unavailable(input: { terminalConfirm(): Promise<boolean>; terminalChoose?(): Promise<ApprovalChoice>; unavailableFallback?: ApprovalUnavailableFallback }): Promise<ApprovalGuardDecision> {
+    if (input.unavailableFallback !== "deny") return this.#terminalOnly(terminalChoice(input));
+    return Promise.resolve({ allowed: false, brokered: false, receipt: null, choice: "deny", consume: () => false, cancel: () => undefined });
   }
 
   #action(binding: Binding, draft: ApprovalActionDraft, cwd: string): Record<string, unknown> {
@@ -238,9 +252,12 @@ export class PiApprovalBroker {
   }
 
   #validDecision(value: unknown, request?: Request, receipt?: Receipt | null): boolean {
+    const optional = value && typeof value === "object" ? ["scope", "stop"].filter((name) => Object.hasOwn(value, name)) : [];
     if (!exactKeys(value, ["schemaVersion", "version", "recordType", "approvalRef", "decisionId", "decisionToken", "identity", "actionDigest",
-      "expectedRevisions", "decision", "reason", "decidedAt", "expiresAt", "decisionSurface", "executor", "directExecution"])) return false;
+      "expectedRevisions", "decision", "reason", "decidedAt", "expiresAt", "decisionSurface", "executor", "directExecution", ...optional])) return false;
     const item = value as any;
+    if (Object.hasOwn(item, "scope") && !(["once", "session"].includes(item.scope) && (item.scope === "once" || item.decision === "allow"))) return false;
+    if (Object.hasOwn(item, "stop") && !(typeof item.stop === "boolean" && (!item.stop || item.decision === "deny"))) return false;
     if (item.schemaVersion !== 1 || item.version !== "piagent-webui-approval-v1" || item.recordType !== "decision"
       || !REF.test(item.approvalRef) || !REF.test(item.decisionId) || typeof item.decisionToken !== "string" || item.decisionToken.length < 32
       || !["allow", "deny"].includes(item.decision) || !exactTimestamp(item.decidedAt) || !exactTimestamp(item.expiresAt)
@@ -258,7 +275,7 @@ export class PiApprovalBroker {
     return value === null || Boolean(REVISION.test(value.workspaceRevision) && (value.indexRevision === null || REVISION.test(value.indexRevision)) && DIGEST.test(value.preimageDigest));
   }
 
-  #settle(binding: Binding, approvalRef: string, decision: "allow" | "deny", surface: "webui" | "terminal", decisionId: string): void {
+  #settle(binding: Binding, approvalRef: string, decision: "allow" | "deny", surface: "webui" | "terminal", decisionId: string, choice: ApprovalChoice = decision === "allow" ? "once" : "deny"): void {
     const pending = binding.pending.get(approvalRef); if (!pending || pending.receipt) return;
     clearTimeout(pending.timer); const resolvedAt = new Date().toISOString();
     const postRevision = this.#nextRevision(binding, "resolved", [approvalRef, decision, surface]);
@@ -272,7 +289,7 @@ export class PiApprovalBroker {
       auditRef: ref("approval-audit", binding.secret, [approvalRef, resolvedAt, surface, decision]), executor: "pi-guard", directExecution: false };
     pending.receipt = receipt; binding.recent.push(receipt); binding.recent = binding.recent.slice(-MAX_RECENT);
     this.#emit(binding, { kind: "resolved", approvalRef, receipt: clone(receipt) });
-    const decisionResult: ApprovalGuardDecision = { allowed: decision === "allow", brokered: true, receipt: clone(receipt),
+    const decisionResult: ApprovalGuardDecision = { allowed: decision === "allow", brokered: true, receipt: clone(receipt), choice,
       consume: () => this.#consume(binding, receipt), cancel: (reason = "guard-cancelled") => this.#cancelPermit(binding, receipt, reason) };
     pending.resolve(decisionResult);
     if (decision === "deny") this.#finish(binding, pending, receipt);
@@ -323,7 +340,7 @@ export class PiApprovalBroker {
       deduplicated: false, auditRef: ref("approval-audit", binding.secret, [approvalRef, resolvedAt, surface]), executor: "pi-guard", directExecution: false };
     pending.receipt = receipt; binding.recent.push(receipt); binding.recent = binding.recent.slice(-MAX_RECENT);
     this.#emit(binding, { kind: state === "expired" ? "expired" : "cancelled", approvalRef, receipt: clone(receipt) });
-    pending.resolve({ allowed: false, brokered: true, receipt: clone(receipt), consume: () => false, cancel: () => undefined }); this.#finish(binding, pending, receipt);
+    pending.resolve({ allowed: false, brokered: true, receipt: clone(receipt), choice: "deny", consume: () => false, cancel: () => undefined }); this.#finish(binding, pending, receipt);
   }
 
   #finish(binding: Binding, pending: Pending, receipt: Receipt): void {

package/packages/piagent-core/runtime/mcp-repository-gate.d.mts

@@ -0,0 +1,10 @@
+export interface RepositoryMcpGate {
+  blocked: Map<string, { state: string; origin: string }>;
+  serverNames: Set<string>;
+  unverifiable: string[];
+}
+
+export const mcpApprovalCache: Map<string, { signature: string; gate: RepositoryMcpGate }>;
+export function mcpServerFromToolCall(toolName: string, input: Record<string, unknown>, candidates: Iterable<string>): string | undefined;
+export function repositoryMcpGate(cwd: string): RepositoryMcpGate;
+export function evaluateMcpApproval(cwd: string, toolName: string, input: Record<string, unknown>): { block: boolean; reason?: string };

package/packages/piagent-core/runtime/mcp-repository-gate.mjs

@@ -0,0 +1,150 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import {
+  REPOSITORY_SCOPES,
+  collectServers,
+  configPathForScope,
+  mcpDecisionInputs,
+  unverifiableMcpConfig
+} from "../mcp/mcp-config-layers.js";
+import { approvalState } from "../mcp/mcp-approval-store.js";
+import { attributeDirectTool } from "../mcp/mcp-tool-naming.js";
+
+// Servers a repository defines are not usable until somebody on this machine has
+// approved them. This is the enforcement point, shared by personal Piagent
+// (piagent-guard) and company sessions (managed/member-mcp.mjs): the adapter
+// owns the connection and neither can prevent one being opened, but no tool
+// call reaches an unapproved server. The residual exposure is the connection
+// itself, which is worth stating plainly rather than describing this as a full
+// block.
+
+// The same token form the guard's action policy uses: `MCP`, `mcp` and `Mcp`
+// all name the adapter's proxy tool.
+const actionToken = (value) => String(value)
+  .replace(/([a-z0-9])([A-Z])/g, "$1-$2")
+  .toLowerCase()
+  .replace(/[^a-z0-9]+/g, "-")
+  .replace(/^-+|-+$/g, "");
+
+// Which MCP server a tool call is addressed to. The adapter exposes one proxy
+// tool named `mcp` that carries the server in `input.server`, and, under
+// directTools, one tool per server tool named `<prefix>_<tool>` where the prefix
+// is derived from the server name. Direct names are matched against the servers
+// this gate is holding rather than against a fixed pattern, because the prefix
+// is the server's own name and there is nothing constant to anchor on.
+export function mcpServerFromToolCall(toolName, input, candidates) {
+  if (actionToken(toolName) === "mcp") {
+    return typeof input?.server === "string" && input.server.trim() ? input.server.trim() : undefined;
+  }
+  return attributeDirectTool(toolName, candidates);
+}
+
+// Recomputed only when one of the files behind the decision changes, because
+// this runs on every tool call. Approving or rejecting a server clears the
+// project's entry.
+export const mcpApprovalCache = new Map();
+
+function fileSignature(file) {
+  try {
+    const stat = fs.statSync(file);
+    return `${stat.mtimeMs}:${stat.size}`;
+  } catch {
+    return "absent";
+  }
+}
+
+// `blocked`: the servers a call must not reach, with why. `unverifiable`:
+// conditions under which no tool call can be checked at all, each with the
+// sentence to show. Those are not "a server is unapproved" but "this
+// repository's config has put the gate in a state where it cannot tell which
+// server a call belongs to", and the only sound answer to that is to stop.
+export function repositoryMcpGate(cwd) {
+  // Repository scopes plus anything an `imports` key drags in from a file the
+  // clone carries. Collecting those here is the whole point: a server the gate
+  // never enumerates is a server it silently permits.
+  const servers = collectServers({ projectPath: cwd, scopes: [...REPOSITORY_SCOPES] });
+  const repositoryFiles = [...REPOSITORY_SCOPES].map((scope) => ({
+    scope,
+    file: configPathForScope(scope, { projectPath: cwd })
+  }));
+  // Every file the decision reads, listed by the module that reads them rather
+  // than restated here. Building this by hand is what went wrong: the scan grew
+  // to read merged settings from all four scopes and to stat import targets
+  // outside the repository, the hand-written list did not, and an already-loaded
+  // guard went on permitting calls after a personal global config had put the
+  // session in the state this gate exists to refuse.
+  const signature = [
+    ...servers.map((server) => `${server.origin}:${server.name}:${fileSignature(server.file)}`),
+    ...repositoryFiles.map((layer) => `layer:${layer.scope}:${fileSignature(layer.file)}`),
+    ...mcpDecisionInputs({ projectPath: cwd }).map((file) => `input:${file}:${fileSignature(file)}`),
+    `store:${fileSignature(path.join(os.homedir(), ".pi", "piagent-mcp-approvals.json"))}`
+  ].join("|");
+  const cached = mcpApprovalCache.get(cwd);
+  if (cached?.signature === signature) return cached.gate;
+
+  const blocked = new Map();
+  for (const server of servers) {
+    const state = approvalState({ projectPath: cwd, name: server.name, entry: server.entry });
+    if (state.state === "approved") continue;
+    // A name defined more than once keeps its blocking entry: the approved copy
+    // does not vouch for the one nobody has looked at.
+    blocked.set(server.name, { state: state.state, origin: server.origin });
+  }
+
+  // Two things a repository-carried config can do that leave nothing to check.
+  //
+  // It can ask for tools with no prefix, so a direct tool arrives under a bare
+  // name carrying no evidence of its server. Refusing only the proxy there was
+  // not a fix: the proxy is the one form that names its server, so blocking it
+  // and allowing the bare names left the hole exactly where it was.
+  //
+  // It can also import a kind whose config this platform cannot enumerate, and
+  // then the set of servers reaching the session is simply unknown. Blocking the
+  // servers that could be listed says nothing about the ones that could not.
+  //
+  // Both stop every tool call. A repository can make a session refuse to run;
+  // it must not be able to make one run a server nobody approved.
+  // Read from the shared module rather than decided here, so `piagent-mcp
+  // doctor` reports exactly what this refuses. The two disagreeing is how an
+  // operator ends up reading "PASS" while every tool call is being stopped.
+  const unverifiable = unverifiableMcpConfig({ projectPath: cwd }).map((problem) => problem.detail);
+
+  const gate = { blocked, serverNames: new Set(servers.map((server) => server.name)), unverifiable };
+  mcpApprovalCache.set(cwd, { signature, gate });
+  return gate;
+}
+
+// Whether a tool call may go ahead in `cwd`: `{ block: false }`, or the
+// reason it may not, naming the commands that resolve it.
+export function evaluateMcpApproval(cwd, toolName, input) {
+  const gate = repositoryMcpGate(cwd);
+
+  // Every tool call, not only the ones that look like MCP. Under either of these
+  // conditions a call cannot be traced to a server, so there is no such thing as
+  // a call this gate can clear.
+  if (gate.unverifiable.length > 0) {
+    return { block: true, reason: `Blocked every tool call: ${gate.unverifiable.join(" ")}` };
+  }
+
+  const server = mcpServerFromToolCall(toolName, input, gate.blocked.keys());
+  if (!server) return { block: false };
+  const record = gate.blocked.get(server);
+  if (!record) return { block: false };
+  const explanation = record.state === "rejected"
+    ? "it was rejected for this project"
+    : record.state === "changed"
+      ? "its definition changed since it was approved"
+      : record.origin.startsWith("import:")
+        ? `this repository imports it from ${record.origin.slice("import:".length)} config and nobody on this machine has approved it here`
+        : "this repository defines it and nobody on this machine has approved it";
+  return {
+    block: true,
+    // Named as commands, because this is read inside a session: the reader can
+    // run these where they already are, without shelling out.
+    reason:
+      `Blocked MCP server ${server}: ${explanation}. ` +
+      `Review it with \`/piagent-mcp get ${server}\`, then \`/piagent-mcp approve ${server}\` to allow it ` +
+      `or \`/piagent-mcp reject ${server}\` to refuse it.`
+  };
+}