@piagent/platform 1.47.0 → 1.48.0

package/docs-site/scope.html

@@ -37,7 +37,7 @@
         <span class="brand-mark"><img src="/assets/piagent-logo.svg" alt="" width="28" height="28" /></span>
         <span class="brand-name"><b>Piagent</b> <span>Platform</span></span>
       </a>
-      <a class="version-badge" href="/whats-new" data-docs-version="v1.47.0" title="v1.47.0 docs · VI"><span class="dot"></span>v1.47.0</a>
+      <a class="version-badge" href="/whats-new" data-docs-version="v1.48.0" title="v1.48.0 docs · VI"><span class="dot"></span>v1.48.0</a>
       <nav class="top-nav" aria-label="Tài liệu">
         <a href="/quickstart">Tài liệu</a>
         <a href="/whats-new">Changelog</a>

package/docs-site/security.html

@@ -37,7 +37,7 @@
         <span class="brand-mark"><img src="/assets/piagent-logo.svg" alt="" width="28" height="28" /></span>
         <span class="brand-name"><b>Piagent</b> <span>Platform</span></span>
       </a>
-      <a class="version-badge" href="/whats-new" data-docs-version="v1.47.0" title="v1.47.0 docs · VI"><span class="dot"></span>v1.47.0</a>
+      <a class="version-badge" href="/whats-new" data-docs-version="v1.48.0" title="v1.48.0 docs · VI"><span class="dot"></span>v1.48.0</a>
       <nav class="top-nav" aria-label="Tài liệu">
         <a href="/quickstart">Tài liệu</a>
         <a href="/whats-new">Changelog</a>

package/docs-site/team.html

@@ -37,7 +37,7 @@
         <span class="brand-mark"><img src="/assets/piagent-logo.svg" alt="" width="28" height="28" /></span>
         <span class="brand-name"><b>Piagent</b> <span>Platform</span></span>
       </a>
-      <a class="version-badge" href="/whats-new" data-docs-version="v1.47.0" title="v1.47.0 docs · VI"><span class="dot"></span>v1.47.0</a>
+      <a class="version-badge" href="/whats-new" data-docs-version="v1.48.0" title="v1.48.0 docs · VI"><span class="dot"></span>v1.48.0</a>
       <nav class="top-nav" aria-label="Tài liệu">
         <a href="/quickstart">Tài liệu</a>
         <a href="/whats-new">Changelog</a>

package/docs-site/update.html

@@ -37,7 +37,7 @@
         <span class="brand-mark"><img src="/assets/piagent-logo.svg" alt="" width="28" height="28" /></span>
         <span class="brand-name"><b>Piagent</b> <span>Platform</span></span>
       </a>
-      <a class="version-badge" href="/whats-new" data-docs-version="v1.47.0" title="v1.47.0 docs · VI"><span class="dot"></span>v1.47.0</a>
+      <a class="version-badge" href="/whats-new" data-docs-version="v1.48.0" title="v1.48.0 docs · VI"><span class="dot"></span>v1.48.0</a>
       <nav class="top-nav" aria-label="Tài liệu">
         <a href="/quickstart">Tài liệu</a>
         <a href="/whats-new">Changelog</a>
@@ -145,9 +145,9 @@
   <h2 id="pin-cho-team">Pin một bản cho cả team</h2>
   <p>Khi rollout cho team, cài đúng bản Pi host và đúng bản platform, rồi chạy installer ở chế độ stable. Bước <code>--dry-run</code> in ra những gì sẽ đổi.</p>
   <div class="command-card">
-    <header><span>Cài pin theo bản</span><button class="clip-btn" data-clip="npm install -g --ignore-scripts @earendil-works/pi-coding-agent@1.3.0&#10;npm install -g --ignore-scripts @piagent/platform@1.47.0&#10;piagent-install --stable --dry-run&#10;piagent-install --stable">Lấy lệnh</button></header>
+    <header><span>Cài pin theo bản</span><button class="clip-btn" data-clip="npm install -g --ignore-scripts @earendil-works/pi-coding-agent@1.3.0&#10;npm install -g --ignore-scripts @piagent/platform@1.48.0&#10;piagent-install --stable --dry-run&#10;piagent-install --stable">Lấy lệnh</button></header>
     <pre><code>npm install -g --ignore-scripts @earendil-works/pi-coding-agent@1.3.0
-npm install -g --ignore-scripts @piagent/platform@1.47.0
+npm install -g --ignore-scripts @piagent/platform@1.48.0
 piagent-install --stable --dry-run
 piagent-install --stable</code></pre>
   </div>

package/docs-site/whats-new.html

@@ -37,7 +37,7 @@
         <span class="brand-mark"><img src="/assets/piagent-logo.svg" alt="" width="28" height="28" /></span>
         <span class="brand-name"><b>Piagent</b> <span>Platform</span></span>
       </a>
-      <a class="version-badge" href="/whats-new" data-docs-version="v1.47.0" title="v1.47.0 docs · VI"><span class="dot"></span>v1.47.0</a>
+      <a class="version-badge" href="/whats-new" data-docs-version="v1.48.0" title="v1.48.0 docs · VI"><span class="dot"></span>v1.48.0</a>
       <nav class="top-nav" aria-label="Tài liệu">
         <a href="/quickstart">Tài liệu</a>
         <a href="/whats-new" aria-current="page">Changelog</a>
@@ -108,7 +108,23 @@
 <div class="release-filter" role="toolbar" aria-label="Lọc theo loại thay đổi"><button type="button" data-filter-kind="all" aria-pressed="true">Tất cả</button><button type="button" data-filter-kind="new" aria-pressed="false">Mới</button><button type="button" data-filter-kind="improved" aria-pressed="false">Cải thiện</button><button type="button" data-filter-kind="fixed" aria-pressed="false">Sửa lỗi</button><button type="button" data-filter-kind="security" aria-pressed="false">Bảo mật</button></div>
 <section class="section releases" data-releases>
 <h2 id="latest" class="sr-only">Mới nhất</h2>
-<article class="release latest" id="v1-47-0" data-release>
+<article class="release latest" id="v1-48-0" data-release>
+  <div class="release-meta"><a class="release-version" href="#v1-48-0">v1.48.0</a><time class="release-date" datetime="2026-10-30">30/10/2026</time></div>
+  <div class="release-body">
+    <h3 data-toc-skip id="v1-48-0-title">Bypass dừng ở bước bàn giao: mọi chế độ hỏi trước khi việc rời khỏi máy</h3>
+    <p>Push, pull request, publish và deploy luôn do bạn duyệt, lệnh được kiểm tra bằng cây cú pháp shell đầy đủ, thẻ duyệt có thêm lựa chọn cho cả session và dừng lượt, dashboard stream mượt hơn.</p>
+    <ul class="release-items">
+      <li data-kind="new"><span class="kind kind-new">Mới</span><span>Thẻ duyệt có bốn lựa chọn: cho phép một lần, cho lệnh giống hệt chạy cả session, từ chối, và từ chối rồi dừng lượt. Việc bàn giao luôn duyệt từng lần.</span></li>
+      <li data-kind="new"><span class="kind kind-new">Mới</span><span>Project có thể chặn hẳn lệnh bằng autoDeny trong .pi/piagent-profile.json. Luật áp dụng ở mọi chế độ, kể cả Bypass; terminate kết thúc luôn lượt của agent.</span></li>
+      <li data-kind="improved"><span class="kind kind-improved">Cải thiện</span><span>Dashboard mượt hơn: câu trả lời đang stream chỉ vẽ lại đoạn cuối, sidebar chỉ vẽ lại dòng thay đổi, kết nối bị rớt được phát hiện và nối lại sớm hơn.</span></li>
+      <li data-kind="fixed"><span class="kind kind-fixed">Sửa lỗi</span><span>Thẻ duyệt, dashboard, terminal và tài liệu mô tả đúng cách từng chế độ truy cập hoạt động; phiên cá nhân không còn bị ghi là chạy trong sandbox.</span></li>
+      <li data-kind="security"><span class="kind kind-security">Bảo mật</span><span>Mọi chế độ truy cập đều hỏi trước khi việc rời khỏi máy: git push dù viết kiểu nào, pull request và merge, release, publish, deploy, push registry, ssh và tool cloud, upload.</span></li>
+      <li data-kind="security"><span class="kind kind-security">Bảo mật</span><span>Bypass chạy việc không hỏi và dừng ở bước bàn giao, ở cả phiên cá nhân lẫn công ty, kể cả run_on_host dùng tài khoản của bạn và công cụ MCP ghi ra ngoài.</span></li>
+      <li data-kind="security"><span class="kind kind-security">Bảo mật</span><span>Lệnh được đọc bằng bộ quét của policy và cây cú pháp shell: push hay lệnh xoá nguy hiểm nằm trong if/then, function, case, bash -c, eval hay heredoc đều bị bắt.</span></li>
+    </ul>
+  </div>
+</article>
+<article class="release" id="v1-47-0" data-release>
   <div class="release-meta"><a class="release-version" href="#v1-47-0">v1.47.0</a><time class="release-date" datetime="2026-10-29">29/10/2026</time></div>
   <div class="release-body">
     <h3 data-toc-skip id="v1-47-0-title">Phiên công ty dùng MCP server của bạn và điều khiển simulator iOS, Android</h3>
@@ -403,27 +419,26 @@
     </ul>
   </div>
 </article>
-<article class="release" id="v1-42-0" data-release>
-  <div class="release-meta"><a class="release-version" href="#v1-42-0">v1.42.0</a><time class="release-date" datetime="2026-10-25">25/10/2026</time></div>
-  <div class="release-body">
-    <h3 data-toc-skip id="v1-42-0-title">Dashboard thiết kế lại, tin cũ tải mà không nhảy trang</h3>
-    <p>Dashboard có một thang thiết kế và mọi theme tô tới mọi khung; tin cũ tự tải khi cuộn lên và tin bạn đang đọc đứng yên.</p>
-    <ul class="release-items">
-      <li data-kind="new"><span class="kind kind-new">Mới</span><span>Tin cũ tự tải khi cuộn gần đầu, và tin đang đọc không còn bị đẩy đi khi có trang mới chèn phía trên.</span></li>
-      <li data-kind="improved"><span class="kind kind-improved">Cải thiện</span><span>Cả 13 theme giờ tô tới diff, thẻ duyệt, câu hỏi và tài liệu; header, sidebar, ô soạn tin và trang tạo mới được thiết kế lại.</span></li>
-      <li data-kind="improved"><span class="kind kind-improved">Cải thiện</span><span>Một lượt đang chạy chỉ có một hiệu ứng chạy: spinner của bước, con trỏ khi chữ đang về, hoặc spinner khi agent đang nghĩ.</span></li>
-      <li data-kind="improved"><span class="kind kind-improved">Cải thiện</span><span>Website và README mới, có hướng dẫn Cập nhật và gỡ; ghi chú phát hành giờ từ một file duy nhất, file này sinh luôn <code>CHANGELOG.md</code>.</span></li>
-      <li data-kind="fixed"><span class="kind kind-fixed">Sửa lỗi</span><span>Lịch sử từng hiện markdown thô rồi co lại; giờ hiện đúng định dạng ngay từ đầu.</span></li>
-      <li data-kind="fixed"><span class="kind kind-fixed">Sửa lỗi</span><span>Tải nhiều trang tin cũ từng làm mất tin mới nhất mà không báo; cửa sổ giờ giữ 1.000 mục và có nút về tin mới nhất.</span></li>
-    </ul>
-  </div>
-</article>
 </section>
 <section class="section archive">
   <h2 id="archive">Các bản trước</h2>
   <p class="section-lead">Bản cũ hơn, gom theo tháng. Mở một tháng để xem từng thay đổi.</p>
   <details class="release-archive">
-    <summary><span>Tháng 10/2026</span><span class="archive-count">62</span></summary>
+    <summary><span>Tháng 10/2026</span><span class="archive-count">63</span></summary>
+    <div class="archive-row" id="v1-42-0">
+      <div class="archive-head"><a class="release-version" href="#v1-42-0">v1.42.0</a> <span class="release-date">25/10/2026</span></div>
+      <div class="archive-body">
+        <p><strong>Dashboard thiết kế lại, tin cũ tải mà không nhảy trang</strong> — Dashboard có một thang thiết kế và mọi theme tô tới mọi khung; tin cũ tự tải khi cuộn lên và tin bạn đang đọc đứng yên.</p>
+        <ul class="release-items">
+        <li data-kind="new"><span class="kind kind-new">Mới</span><span>Tin cũ tự tải khi cuộn gần đầu, và tin đang đọc không còn bị đẩy đi khi có trang mới chèn phía trên.</span></li>
+        <li data-kind="improved"><span class="kind kind-improved">Cải thiện</span><span>Cả 13 theme giờ tô tới diff, thẻ duyệt, câu hỏi và tài liệu; header, sidebar, ô soạn tin và trang tạo mới được thiết kế lại.</span></li>
+        <li data-kind="improved"><span class="kind kind-improved">Cải thiện</span><span>Một lượt đang chạy chỉ có một hiệu ứng chạy: spinner của bước, con trỏ khi chữ đang về, hoặc spinner khi agent đang nghĩ.</span></li>
+        <li data-kind="improved"><span class="kind kind-improved">Cải thiện</span><span>Website và README mới, có hướng dẫn Cập nhật và gỡ; ghi chú phát hành giờ từ một file duy nhất, file này sinh luôn <code>CHANGELOG.md</code>.</span></li>
+        <li data-kind="fixed"><span class="kind kind-fixed">Sửa lỗi</span><span>Lịch sử từng hiện markdown thô rồi co lại; giờ hiện đúng định dạng ngay từ đầu.</span></li>
+        <li data-kind="fixed"><span class="kind kind-fixed">Sửa lỗi</span><span>Tải nhiều trang tin cũ từng làm mất tin mới nhất mà không báo; cửa sổ giờ giữ 1.000 mục và có nút về tin mới nhất.</span></li>
+        </ul>
+      </div>
+    </div>
     <div class="archive-row" id="v1-41-0">
       <div class="archive-head"><a class="release-version" href="#v1-41-0">v1.41.0</a> <span class="release-date">24/10/2026</span></div>
       <div class="archive-body">

package/docs-site/windows.html

@@ -37,7 +37,7 @@
         <span class="brand-mark"><img src="/assets/piagent-logo.svg" alt="" width="28" height="28" /></span>
         <span class="brand-name"><b>Piagent</b> <span>Platform</span></span>
       </a>
-      <a class="version-badge" href="/whats-new" data-docs-version="v1.47.0" title="v1.47.0 docs · VI"><span class="dot"></span>v1.47.0</a>
+      <a class="version-badge" href="/whats-new" data-docs-version="v1.48.0" title="v1.48.0 docs · VI"><span class="dot"></span>v1.48.0</a>
       <nav class="top-nav" aria-label="Tài liệu">
         <a href="/quickstart">Tài liệu</a>
         <a href="/whats-new">Changelog</a>

package/docs-site/workflows.html

@@ -37,7 +37,7 @@
         <span class="brand-mark"><img src="/assets/piagent-logo.svg" alt="" width="28" height="28" /></span>
         <span class="brand-name"><b>Piagent</b> <span>Platform</span></span>
       </a>
-      <a class="version-badge" href="/whats-new" data-docs-version="v1.47.0" title="v1.47.0 docs · VI"><span class="dot"></span>v1.47.0</a>
+      <a class="version-badge" href="/whats-new" data-docs-version="v1.48.0" title="v1.48.0 docs · VI"><span class="dot"></span>v1.48.0</a>
       <nav class="top-nav" aria-label="Tài liệu">
         <a href="/quickstart">Tài liệu</a>
         <a href="/whats-new">Changelog</a>

package/evals/private-holdout-v1/public-exposure.v2.json

@@ -256,8 +256,8 @@
     },
     {
       "path": "tests",
-      "fileCount": 638,
-      "sha256": "74109d76ee46eeb519070b53699a7e582a3705c74030e9ca067242566afbb5df"
+      "fileCount": 641,
+      "sha256": "35835601b983facf21131404df71c12f622503a45ddfcdc1869610022e7bb101"
     }
   ],
   "custodianComparisonRules": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@piagent/platform",
-  "version": "1.47.0",
+  "version": "1.48.0",
   "license": "MIT",
   "publishConfig": {
     "access": "public",
@@ -141,6 +141,7 @@
     }
   },
   "dependencies": {
+    "@aliou/sh": "0.3.4",
     "@babel/parser": "7.29.8",
     "ws": "8.21.3"
   },

package/packages/piagent-core/extensions/guard-types.ts

@@ -29,6 +29,7 @@ export type ProjectProfile = {
   memory?: MemorySettings;
   contextIndex?: ContextIndexSettings;
   runtimePolicy?: RuntimePolicySettings;
+  autoDeny?: AutoDenyRule[];
   orchestration?: OrchestrationPolicySettings;
   techStack?: ProjectTechStackReference;
 };
@@ -322,8 +323,9 @@ export type ResolvedOrchestrationPolicy = {
   rules: string[];
 };
 
-// "bypass": personal sessions only; no Piagent gate asks or blocks (as Codex's
-// --dangerously-bypass-approvals-and-sandbox). Output redaction and turn checkpoints still run.
+// "bypass": personal sessions only; no Piagent gate asks or blocks the work. The
+// handoff (runtime/policy/handoff-policy.mjs) is still asked; output redaction
+// and turn checkpoints still run.
 export type PermissionProfileMode = "read-only" | "workspace-write" | "trusted-full-access" | "bypass";
 
 export type PermissionProfilesConfig = {
@@ -459,8 +461,14 @@ export type CommandRule = {
   ignoreSearchArguments?: boolean;
   value: string | string[];
   reason: string;
+  // A forbid that also ends the agent's turn, so it does not retry.
+  terminate?: boolean;
 };
 
+// A project's own refusals (profile `autoDeny`): matched like an exec rule,
+// refused in every permission mode, Bypass included.
+export type AutoDenyRule = { pattern: string; match?: "contains" | "regex" | "prefix"; reason: string; terminate?: boolean };
+
 export type ExecPolicyConfig = {
   defaultMode?: "advisory" | "enforce";
   bannedPrefixSuggestions?: string[][];

package/packages/piagent-core/extensions/piagent-guard.ts

@@ -86,8 +86,9 @@ import { currentWorkspaceRevisionDigest } from "./workspace-revision.js";
 import { appendJsonlBounded } from "./state-retention.js";
 import { ensurePrivateStateDirectory, resolveLocalStatePath } from "./local-state-path.js";
 import { hasDurableContextEvidence } from "./context-evidence.js";
-import { piApprovalBroker, type ApprovalActionDraft, type ApprovalUnavailableFallback } from "../runtime/inspection/approval-broker.ts";
+import { piApprovalBroker, type ApprovalActionDraft, type ApprovalChoice, type ApprovalUnavailableFallback } from "../runtime/inspection/approval-broker.ts";
 import { createSourceMutationGuardBindings } from "../runtime/policy/source-mutation-guard-binding.ts";
+import { FULL_ACCESS_RUNS, handoffReason, mcpWriteAction, treeExecFinding } from "../runtime/policy/handoff-policy.mjs";
 import { createWorkspaceWriteAuthorityBindings } from "../runtime/policy/workspace-write-authority.ts";
 import { registerWorkspaceMemberEdits } from "../runtime/session/workspace-member-edits.mjs";
 import {
@@ -206,6 +207,7 @@ import type {
   ResolvedPermissionProfile,
   ReviewLens,
   RuntimePolicySettings,
+  CommandRule,
   TaskContract,
   TechContextSnapshot,
   TechOption,
@@ -554,8 +556,6 @@ function verifyProjectCapabilityState(
   }
 }
 
-// Exec-policy prompts a full-access session does not show: local, reversible.
-const FULL_ACCESS_SKIPPED_PROMPTS = ["prompt-git-add-broad"];
 
 function evaluateExecPolicy(command: string, profile: ProjectProfile, policy: BasePolicy): {
   mode: RuntimePolicySettings["execPolicy"];
@@ -564,7 +564,7 @@ function evaluateExecPolicy(command: string, profile: ProjectProfile, policy: Ba
   segments: Array<{ command: string; words: string[]; matches: string[]; warnings: string[] }>;
 } {
   const runtime = resolveRuntimePolicy(profile);
-  const execPolicy = execPolicyConfig(policy);
+  const execPolicy = { ...execPolicyConfig(policy), rules: [...execPolicyConfig(policy).rules, ...autoDenyRules(profile)] };
   const mode = runtime.execPolicy === "off" ? "off" : runtime.execPolicy ?? execPolicy.defaultMode;
   return evaluateExecPolicyCore(command, { policy: { ...policy, execPolicy }, mode }) as {
     mode: RuntimePolicySettings["execPolicy"];
@@ -923,6 +923,36 @@ function approvalUnavailableFallback(ctx: Pick<ExtensionContext, "ui">): Approva
   }
 }
 
+// A project's own refusals (profile `autoDeny`) as exec-policy forbid rules.
+function autoDenyRules(profile: ProjectProfile): CommandRule[] {
+  return (Array.isArray(profile.autoDeny) ? profile.autoDeny : []).filter((rule) => typeof rule?.pattern === "string" && rule.pattern.trim())
+    .map((rule, index) => ({ id: `auto-deny-${index + 1}`, action: "forbid" as const, match: rule.match ?? "contains", value: rule.pattern,
+      reason: String(rule.reason ?? "Refused by this project's autoDeny rule"), terminate: rule.terminate === true }));
+}
+// The block for a refused command; a rule with terminate also ends the turn.
+function execRefusal(decision: { reasons: string[]; segments: Array<{ matches: string[] }> }): { block: true; reason: string; terminate?: boolean } {
+  const terminate = decision.segments.some((segment) => segment.matches.some((match) => match.startsWith("terminate:")));
+  return { block: true, reason: decision.reasons.join("; ") + (terminate ? " Do not retry; the turn ends here." : ""), ...(terminate ? { terminate: true } : {}) };
+}
+
+// The member's four answers in the terminal (Pi's TUI). Elsewhere the
+// terminal keeps its yes/no question and the dashboard card offers the four.
+const TERMINAL_CHOICES: Record<ApprovalChoice, string> = { once: "Allow once", session: "Allow this exact action for the rest of the session",
+  deny: "Deny", stop: "Deny and stop the turn" };
+function terminalChooser(ctx: ExtensionContext, title: string, prompt: string, grantable: boolean): (() => Promise<ApprovalChoice>) | undefined {
+  if (ctx.mode !== "tui" || !ctx.hasUI || typeof ctx.ui.select !== "function") return undefined;
+  const choices = (["once", ...(grantable ? ["session"] : []), "deny", "stop"] as ApprovalChoice[]);
+  return async () => {
+    const picked = await ctx.ui.select(`${title}\n\n${prompt}`, choices.map((choice) => TERMINAL_CHOICES[choice]));
+    return choices.find((choice) => TERMINAL_CHOICES[choice] === picked) ?? "deny";
+  };
+}
+
+// Actions the member allowed for the rest of a session: the same tool with
+// the same exact command or input. A handoff is never kept.
+const sessionGrants = new Map<string, Set<string>>();
+const grantKey = (toolName: string, command: string | null, input: unknown) => `${toolName}\u0000${command ?? JSON.stringify(input ?? {})}`;
+
 function evaluatePathLikeToolAccess(
   cwd: string,
   toolName: string,
@@ -1124,10 +1154,13 @@ function normalizePermissionProfileMode(value: unknown): PermissionProfileMode |
 }
 
 function runtimeEquivalentForPermissionProfile(mode: PermissionProfileMode): string {
-  if (mode === "read-only") return "sandbox_mode=read-only";
-  if (mode === "trusted-full-access") return "sandbox_mode=danger-full-access + approval_policy=never, with Piagent protected-path and human-action gates still enforced";
-  if (mode === "bypass") return "sandbox_mode=danger-full-access + approval_policy=never; every Piagent gate off (output redaction and turn checkpoints remain)";
-  return "sandbox_mode=workspace-write + approval_policy=on-request";
+  // What the mode resembles in common sandbox terms. A personal session runs on this
+  // machine with no OS sandbox (execution-backend.js "host"): Piagent's policy
+  // checks are the boundary.
+  if (mode === "read-only") return "like sandbox_mode=read-only, enforced by Piagent policy (no OS sandbox)";
+  if (mode === "trusted-full-access") return "like sandbox_mode=danger-full-access; protected paths, destructive steps and the handoff (push, PR, publish, deploy, remote tools) are still asked";
+  if (mode === "bypass") return "like sandbox_mode=danger-full-access + approval_policy=never for the work; the handoff (push, PR, publish, deploy, remote tools, MCP writes) is still asked, and output redaction and turn checkpoints remain";
+  return "like sandbox_mode=workspace-write + approval_policy=on-request, enforced by Piagent policy (no OS sandbox)";
 }
 
 function sessionPermissionOverrideKey(ctx: ExtensionContext): string {
@@ -3717,6 +3750,38 @@ export default function piagentGuard(pi: ExtensionAPI) {
   // Bypass is for personal sessions only: a company session keeps Studio's rules.
   const bypassActive = (ctx: ExtensionContext) => !isCompanySession(ctx) && ctx.model?.provider !== "agent_watch_managed"
     && resolvePermissionProfile(loadProfileFromContext(ctx), policy, permissionOverrideFromContext(ctx)).mode === "bypass";
+  // Bypass runs the work without asking and stops at the handoff: a push, a
+  // PR or merge, a publish or deploy, a remote or cloud tool, an upload or an
+  // MCP tool that writes outside is asked about, as in every other mode.
+  const bypassHandoff = async (event: { toolName: string; toolCallId?: string; input?: unknown }, ctx: ExtensionContext): Promise<{ block: true; reason: string; terminate?: boolean } | undefined> => {
+    const input = isPlainRecord(event.input) ? event.input : {};
+    const prepared = SHELL_TOOL_NAMES.has(event.toolName) ? null : prepareToolInputForPolicy(event.toolName, input, policy);
+    const shell = extractShellCommandInput(prepared?.proxyShellCarrier && prepared.proxyArgs ? prepared.proxyArgs : SHELL_TOOL_NAMES.has(event.toolName) ? input : {});
+    const command = shell.command ? normalizeShellCommandForPolicy(shell.command) : null;
+    // The project's autoDeny rules hold in Bypass too: they are its own refusals.
+    const projectRules = autoDenyRules(loadProfileFromContext(ctx));
+    if (command && projectRules.length) {
+      const refused = evaluateExecPolicyCore(command, { policy: { execPolicy: { defaultMode: "enforce", bannedPrefixSuggestions: [], rules: projectRules } }, mode: "enforce" });
+      if (refused.decision === "forbid") return execRefusal(refused);
+    }
+    let reason = command ? await handoffReason(command) : null;
+    if (!reason && !command && prepared && classifyExternalAction(event.toolName, prepared.input, policy).decision === "confirm") {
+      const action = await mcpWriteAction(prepared.proxyTool ?? event.toolName);
+      if (action) reason = `${prepared.proxyToolName ?? event.toolName} writes outside this machine (${action})`;
+    }
+    if (!reason) return undefined;
+    const preview = command ?? prepared?.confirmationSummary ?? event.toolName;
+    const approval = await piApprovalBroker.request({ cwd: ctx.cwd, rawSessionId: ctx.sessionManager.getSessionId(), toolCallId: String(event.toolCallId), expectedTask: null,
+      action: { kind: "external-provider-action", preconditionClass: "runtime-only", treePrecondition: null, toolName: event.toolName, rawAction: { toolName: event.toolName, command, input },
+        commandPreview: command, parameterPreview: preview, targetPaths: [], targetSummaries: [reason], provider: command ? "shell-external" : String(prepared?.proxyToolName ?? event.toolName),
+        urlOrigin: null, requestedScope: "one-handoff", reason: `Bypass still asks before a handoff: ${reason}`, riskClass: "high",
+        allowConsequence: "Run this exact step once; the work leaves this machine.", denyConsequence: "The step does not run; the agent is told you declined." },
+      terminalConfirm: () => ctx.ui.confirm(`Bypass still asks before a handoff.\n\n${reason}\n\n${preview}\n\nAllow?`, "Piagent handoff confirmation"),
+      terminalChoose: terminalChooser(ctx, "Piagent handoff confirmation", `Bypass still asks before a handoff.\n\n${reason}\n\n${preview}`, false), unavailableFallback: approvalUnavailableFallback(ctx) });
+    if (!approval.allowed) return approval.choice === "stop" ? { block: true, terminate: true, reason: `User denied the handoff and stopped the turn: ${reason}. Do not retry; wait for the member.` } : { block: true, reason: `User denied the handoff: ${reason}` };
+    if (!approval.consume()) return { block: true, reason: "Approval became stale before tool start; the action was blocked." };
+    return undefined;
+  };
   registerToolCallHook(pi, {
     extractLikelyPath: extractLikelyPathFromInput,
     redactText,
@@ -3778,10 +3843,10 @@ export default function piagentGuard(pi: ExtensionAPI) {
       return undefined;
     },
     authorize: async (event, ctx) => {
-    // Bypass: no Piagent gate asks or blocks, as with Codex's
-    // --dangerously-bypass-approvals-and-sandbox. Tool output is still
-    // redacted and the turn still gets its checkpoint; neither stops a command.
-    if (bypassActive(ctx)) return;
+    // Bypass: no Piagent gate asks or blocks the work. The handoff is still
+    // asked (bypassHandoff); tool output is still redacted and the turn still
+    // gets its checkpoint.
+    if (bypassActive(ctx)) return bypassHandoff(event, ctx);
     const preInput = isPlainRecord(event.input) ? event.input : {};
     const authorizationTargetInspection = authorizationMutationTargetInspection(ctx.cwd, event.toolName, preInput);
     if (authorizationTargetInspection.reason) {
@@ -3872,9 +3937,11 @@ export default function piagentGuard(pi: ExtensionAPI) {
           && !candidate.startsWith("../")
           && !candidate.startsWith(".pi/piagent-state/")
         ));
-      if (execDecision.mode !== "off" && execDecision.decision === "forbid") {
-        return { block: true, reason: execDecision.reasons.join("; ") };
-      }
+      if (execDecision.mode !== "off" && execDecision.decision === "forbid") return execRefusal(execDecision);
+      // The shell syntax tree reads what the scanner may miss: a command in a
+      // function, a case arm or an unquoted heredoc's $( … ).
+      const treeFinding = execDecision.mode !== "off" ? treeExecFinding(command) : null;
+      if (treeFinding?.decision === "forbid") return { block: true, reason: treeFinding.reason };
 
       const protectedHit = findProtectedPathInCommand(command, pathPolicy.shellProtectedPaths);
       if (protectedHit) {
@@ -3903,16 +3970,21 @@ export default function piagentGuard(pi: ExtensionAPI) {
 
       // Full access skips the prompts for local, reversible steps; deletes,
       // migrations and anything sent outside this machine are still asked.
-      const confirmationReasons = (execDecision.mode !== "off" && execDecision.decision === "prompt" ? [...execDecision.reasons] : [])
+      const confirmationReasons = [...(execDecision.mode !== "off" && execDecision.decision === "prompt" ? execDecision.reasons : []), ...(treeFinding?.decision === "prompt" && !execDecision.reasons.includes(treeFinding.reason) ? [treeFinding.reason] : [])]
         .filter((reason) => permissionProfile.mode !== "trusted-full-access"
-          || !FULL_ACCESS_SKIPPED_PROMPTS.some((id) => reason.startsWith(`Prompt required by exec policy ${id}:`)));
-      const externalReason = findShellExternalConfirmationReason(execDecision.segments, externalActionPolicyConfig(policy));
-      if (externalReason) confirmationReasons.push(externalReason);
+          || ![...FULL_ACCESS_RUNS].some((id) => reason.startsWith(`Prompt required by exec policy ${id}:`)));
+      // The handoff (push, PR, publish, deploy, remote and cloud tools,
+      // uploads) is asked in every mode: runtime/policy/handoff-policy.mjs.
+      const handoff = await handoffReason(command);
+      const shellExternal = findShellExternalConfirmationReason(execDecision.segments, externalActionPolicyConfig(policy));
+      const handoffNote = handoff && !shellExternal && !confirmationReasons.includes(handoff) ? `Handoff requires confirmation: ${handoff}` : undefined;
+      const externalReason = shellExternal ?? (handoff ? handoffNote ?? handoff : undefined);
+      for (const reason of [shellExternal, handoffNote]) if (reason) confirmationReasons.push(reason);
       if (confirmationReasons.length > 0) {
         pendingHumanApproval = { prompt: `Command requires confirmation.\n\n${confirmationReasons.join("\n")}\n\nAllow?`, title: "Piagent exec policy confirmation",
           action: { kind: externalReason ? "external-provider-action" : "workspace-patch", preconditionClass: externalReason ? "runtime-only" : "workspace-tree", toolName: event.toolName, rawAction: { toolName: event.toolName, command, input: preparedInput.input },
             commandPreview: command, parameterPreview: preparedInput.confirmationSummary ?? "Shell command", targetPaths: shellMutationTargets, targetSummaries: confirmationReasons, provider: externalReason ? "shell-external" : null, urlOrigin: null,
-            requestedScope: "one-shell-command", reason: confirmationReasons.join("; "), riskClass: shellProjectMutation ? "high" : "medium", allowConsequence: "Run this exact command once, after the guard checks the working tree again.", denyConsequence: "The command does not run; the agent is told you declined." } };
+            requestedScope: handoff ? "one-handoff" : "one-shell-command", reason: confirmationReasons.join("; "), riskClass: shellProjectMutation ? "high" : "medium", allowConsequence: "Run this exact command once, after the guard checks the working tree again.", denyConsequence: "The command does not run; the agent is told you declined." } };
       }
     }
 
@@ -3965,16 +4037,25 @@ export default function piagentGuard(pi: ExtensionAPI) {
         : classifiedExternalAction;
       if (externalAction.decision === "confirm") {
         const inputSummary = preparedInput.confirmationSummary ? `\ninput: ${preparedInput.confirmationSummary}` : "";
+        // A write to the system behind the tool is a handoff: approved one at a time.
+        const writesOut = Boolean(await mcpWriteAction(preparedInput.proxyTool ?? event.toolName));
         pendingHumanApproval = { prompt: `External provider action requires confirmation.\n\nprovider: ${externalAction.provider}\naction: ${externalAction.action}\ntool: ${event.toolName}${inputSummary}\n\nAllow?`, title: "Piagent external action confirmation",
           action: { kind: "external-provider-action", preconditionClass: "runtime-only", toolName: event.toolName, rawAction: { toolName: event.toolName, input: preparedInput.input, provider: externalAction.provider, action: externalAction.action },
             commandPreview: null, parameterPreview: preparedInput.confirmationSummary ?? String(externalAction.action), targetPaths: [], targetSummaries: [], provider: String(externalAction.provider),
-            urlOrigin: null, requestedScope: "one-external-action", reason: `External provider action ${String(externalAction.action)} requires confirmation`, riskClass: "high", allowConsequence: "Run this exact action once, after the guard checks its authority again.", denyConsequence: "The action does not run; nothing outside changes." } };
+            urlOrigin: null, requestedScope: writesOut ? "one-handoff" : "one-external-action", reason: `External provider action ${String(externalAction.action)} requires confirmation`, riskClass: "high", allowConsequence: "Run this exact action once, after the guard checks its authority again.", denyConsequence: "The action does not run; nothing outside changes." } };
       }
     }
 
+    const grants = sessionGrants.get(ctx.sessionManager.getSessionId()) ?? new Set<string>();
+    const grantable = Boolean(pendingHumanApproval) && !/handoff/.test(String(pendingHumanApproval!.action.requestedScope));
+    const grant = grantKey(event.toolName, typeof pendingHumanApproval?.action.commandPreview === "string" ? pendingHumanApproval.action.commandPreview : null, preparedInput.input);
+    if (pendingHumanApproval && grantable && grants.has(grant)) pendingHumanApproval = null;
     if (pendingHumanApproval) {
-      const approval = await piApprovalBroker.request({ cwd: ctx.cwd, rawSessionId: ctx.sessionManager.getSessionId(), toolCallId: String(event.toolCallId), expectedTask: null, action: { ...pendingHumanApproval.action, preconditionClass: "runtime-only", treePrecondition: null }, terminalConfirm: () => ctx.ui.confirm(pendingHumanApproval!.prompt, pendingHumanApproval!.title), unavailableFallback: approvalUnavailableFallback(ctx) });
-      if (!approval.allowed) return { block: true, reason: pendingHumanApproval.action.kind === "external-provider-action" && !SHELL_TOOL_NAMES.has(event.toolName) ? `User denied external provider action: ${event.toolName}` : `User denied command: ${pendingHumanApproval.action.reason}` };
+      const approval = await piApprovalBroker.request({ cwd: ctx.cwd, rawSessionId: ctx.sessionManager.getSessionId(), toolCallId: String(event.toolCallId), expectedTask: null, action: { ...pendingHumanApproval.action, preconditionClass: "runtime-only", treePrecondition: null }, terminalConfirm: () => ctx.ui.confirm(pendingHumanApproval!.prompt, pendingHumanApproval!.title),
+        terminalChoose: terminalChooser(ctx, pendingHumanApproval.title, pendingHumanApproval.prompt, grantable), unavailableFallback: approvalUnavailableFallback(ctx) });
+      if (!approval.allowed) return { block: true, reason: pendingHumanApproval.action.kind === "external-provider-action" && !SHELL_TOOL_NAMES.has(event.toolName) ? `User denied external provider action: ${event.toolName}` : `User denied command: ${pendingHumanApproval.action.reason}`,
+        ...(approval.choice === "stop" ? { terminate: true, reason: `User denied and stopped the turn: ${pendingHumanApproval.action.reason}. Do not retry; wait for the member.` } : {}) };
+      if (approval.choice === "session" && grantable) sessionGrants.set(ctx.sessionManager.getSessionId(), grants.add(grant));
       // A WebUI allow is provisional until the guard consumes it here. Without
       // this the decision request never got its receipt and the approval stayed
       // pending, filling the broker until it stopped accepting WebUI decisions.

package/packages/piagent-core/extensions/policy-core.js

@@ -1,5 +1,5 @@
-import { excludedFindSelectorValue, findSelectorOption, SEARCH_COMMANDS, SEARCH_FILE_OPTIONS, SEARCH_GLOB_OPTIONS,
-  SEARCH_PATTERN_OPTIONS, searchSelectorIsExclusion, searchSelectorWithinToken } from "./shell-selector-policy.js";
+import { excludedFindSelectorValue, findSelectorOption, SEARCH_COMMANDS, SEARCH_FILE_OPTIONS, SEARCH_GLOB_OPTIONS, SEARCH_PATTERN_OPTIONS, searchSelectorIsExclusion, searchSelectorWithinToken } from "./shell-selector-policy.js";
+import { CONTROL_PREFIXES, gitSubcommandWords } from "./shell-command-words.js";
 
 const PATH_REDIRECT_OPERATORS = new Set(["<", ">", ">>", "1>", "1>>", "2>", "2>>", "&>", "&>>"]);
 const DATA_ONLY_COMMANDS = new Set(["echo", "printf"]);
@@ -35,7 +35,7 @@ const INLINE_CODE_FLAGS = new Map([
   ["perl", new Set(["-e", "-E"])],
   ["php", new Set(["-r"])]
 ]);
-const SIMPLE_WRAPPERS = new Set(["sudo", "nohup", "time", "nice", "ionice", "command"]);
+const SIMPLE_WRAPPERS = new Set(["sudo", "doas", "nohup", "time", "nice", "ionice", "command", "exec"]);
 
 function escapeRegex(value) {
   return value.replace(/[.+^${}()|[\]\\]/g, "\\$&");
@@ -703,13 +703,13 @@ function isLeadingRedirection(word) {
   return /^[0-9]*(?:>>?\|?|<>?|>&|<&)/.test(word);
 }
 
-function stripWrapper(words) {
+export function stripWrapper(words) {
   let current = [...words];
   let changed = true;
 
   while (changed && current.length > 0) {
     changed = false;
-    while (current.length > 0 && isAssignment(current[0])) {
+    while (current.length > 0 && (isAssignment(current[0]) || CONTROL_PREFIXES.has(current[0]))) {
       current = current.slice(1);
       changed = true;
     }
@@ -1186,7 +1186,7 @@ export function evaluateExecPolicyCore(command, options) {
 
     for (const rule of execPolicy.rules) {
       if (!commandRuleMatches(rule, text, words)) continue;
-      matches.push(`${rule.action}:${rule.id}`);
+      matches.push(`${rule.action}:${rule.id}`, ...(rule.action === "forbid" && rule.terminate ? [`terminate:${rule.id}`] : []));
       if (rule.action === "forbid") reasons.push(`Forbidden by exec policy ${rule.id}: ${rule.reason}`);
       if (rule.action === "prompt") reasons.push(`Prompt required by exec policy ${rule.id}: ${rule.reason}`);
     }
@@ -1229,7 +1229,7 @@ export function evaluateExecPolicyCore(command, options) {
   const confirmationPatternMatches = (pattern, words) => {
     const expected = shellWords(String(pattern ?? ""));
     if (expected.length === 0) return false;
-    const executableWords = stripWrapper(words);
+    const executableWords = gitSubcommandWords(stripWrapper(words));
     if (arrayStartsWith(executableWords, expected)) return true;
     if (expected.length !== 1) return false;
     const action = expected[0];

package/packages/piagent-core/extensions/shell-ast.js

@@ -0,0 +1,85 @@
+// The simple commands a shell line runs, read from a real shell syntax tree.
+//
+// policy-core.js splits a line into segments with its own scanner; this reads
+// the same line through a POSIX/Bash parser and walks every place a command
+// can sit: pipelines, && and ||, if/while/for/case bodies, functions, ( … ),
+// { … }, $( … ), backticks and <( … ). `bash -c '…'`, `sh -c` and `eval` are
+// parsed again, so the text they run is read as commands too. A check that
+// reads both lists sees a command whichever reader finds it.
+//
+// Words come back as text. A word built from an expansion the shell decides
+// at run time ($VAR, $(…), `…`) keeps it as written and is flagged dynamic;
+// nothing is evaluated here. A line the parser rejects gives null: callers
+// keep the scanner's answer, which is never weakened by this module.
+import { parse } from "@aliou/sh";
+
+const SHELLS = new Set(["sh", "bash", "zsh", "dash", "ksh", "mksh"]);
+const MAX_DEPTH = 8;
+
+function wordText(word) {
+  let text = "", dynamic = false;
+  const visit = (parts) => {
+    for (const part of parts ?? []) {
+      if (part.type === "Literal" || part.type === "SglQuoted") text += part.value;
+      else if (part.type === "DblQuoted") visit(part.parts);
+      else if (part.type === "ParamExp") { text += `$${part.param?.value ?? ""}`; dynamic = true; }
+      else { text += "$(…)"; dynamic = true; }
+    }
+  };
+  visit(word?.parts);
+  return { text, dynamic };
+}
+
+// The $( … ) and ` … ` an unquoted heredoc body runs: the parser keeps the
+// body as text, and the shell expands it.
+function substitutions(text) {
+  const found = [];
+  for (let index = 0; index < text.length; index += 1) {
+    if (text[index] === "`") {
+      const close = text.indexOf("`", index + 1);
+      if (close < 0) break;
+      found.push(text.slice(index + 1, close)); index = close;
+    } else if (text.startsWith("$(", index) && text[index + 2] !== "(") {
+      let depth = 0, close = -1;
+      for (let at = index + 1; at < text.length; at += 1) {
+        if (text[at] === "(") depth += 1;
+        else if (text[at] === ")" && --depth === 0) { close = at; break; }
+      }
+      if (close < 0) break;
+      found.push(text.slice(index + 2, close)); index = close;
+    }
+  }
+  return found;
+}
+
+function collect(node, found, depth) {
+  if (!node || typeof node !== "object") return;
+  if (Array.isArray(node)) { for (const item of node) collect(item, found, depth); return; }
+  if (node.type === "Redirect" && node.heredoc && node.target?.parts?.every((part) => part.type === "Literal") && depth < MAX_DEPTH) {
+    for (const source of substitutions(wordText(node.heredoc).text)) collectSource(source, found, depth + 1);
+  }
+  if (node.type === "SimpleCommand" && node.words?.length) {
+    const words = node.words.map(wordText);
+    found.push({ words: words.map((word) => word.text), dynamic: words.some((word) => word.dynamic) });
+    const name = String(words[0]?.text ?? "").split("/").pop();
+    const inline = SHELLS.has(name) ? words.findIndex((word, index) => index > 0 && /^-[a-z]*c[a-z]*$/.test(word.text)) + 1 : name === "eval" ? 1 : 0;
+    if (inline > 0 && depth < MAX_DEPTH) {
+      const source = name === "eval" ? words.slice(1).map((word) => word.text).join(" ") : words[inline]?.text;
+      if (source) collectSource(source, found, depth + 1);
+    }
+  }
+  for (const [key, value] of Object.entries(node)) {
+    if (key !== "pos" && key !== "end" && value && typeof value === "object") collect(value, found, depth);
+  }
+}
+
+function collectSource(source, found, depth) {
+  try { collect(parse(String(source), { dialect: "bash" }).ast, found, depth); } catch { /* the scanner still reads it */ }
+}
+
+// [{ words, dynamic }] for every simple command, or null when the line does not parse.
+export function astCommands(command) {
+  const found = [];
+  try { collect(parse(String(command), { dialect: "bash" }).ast, found, 0); } catch { return null; }
+  return found;
+}

package/packages/piagent-core/extensions/shell-command-words.js

@@ -0,0 +1,19 @@
+// How a simple command's words name what runs, shared by policy-core.js and
+// the handoff policy (runtime/policy/handoff-policy.mjs).
+
+// Shell words that open a compound statement: the command follows them.
+// `if true; then rm -rf /; fi` splits into `then rm -rf /`, which runs rm.
+export const CONTROL_PREFIXES = new Set(["!", "{", "(", "if", "then", "do", "elif", "else", "while", "until"]);
+
+// Git's global options come before the subcommand: `git -C api push` and
+// `git -c core.hooksPath=x --no-pager push` push as `git push` does. Without
+// this a rule written as "git push" matched only the plain spelling.
+const GIT_OPTIONS_WITH_VALUE = new Set(["-C", "-c", "--git-dir", "--work-tree", "--namespace", "--super-prefix", "--config-env", "--exec-path", "--list-cmds"]);
+export function gitSubcommandWords(words) {
+  if (String(words[0] ?? "").split("/").pop() !== "git") return words;
+  let index = 1;
+  while (index < words.length && words[index].startsWith("-")) {
+    index += GIT_OPTIONS_WITH_VALUE.has(words[index]) ? 2 : 1;
+  }
+  return ["git", ...words.slice(index)];
+}