@piagent/platform 1.47.0 → 1.48.1

package/packages/piagent-core/extensions/piagent-guard.ts

@@ -86,8 +86,9 @@ import { currentWorkspaceRevisionDigest } from "./workspace-revision.js";
 import { appendJsonlBounded } from "./state-retention.js";
 import { ensurePrivateStateDirectory, resolveLocalStatePath } from "./local-state-path.js";
 import { hasDurableContextEvidence } from "./context-evidence.js";
-import { piApprovalBroker, type ApprovalActionDraft, type ApprovalUnavailableFallback } from "../runtime/inspection/approval-broker.ts";
+import { piApprovalBroker, type ApprovalActionDraft, type ApprovalChoice, type ApprovalUnavailableFallback } from "../runtime/inspection/approval-broker.ts";
 import { createSourceMutationGuardBindings } from "../runtime/policy/source-mutation-guard-binding.ts";
+import { FULL_ACCESS_RUNS, handoffReason, mcpWriteAction, treeExecFinding } from "../runtime/policy/handoff-policy.mjs";
 import { createWorkspaceWriteAuthorityBindings } from "../runtime/policy/workspace-write-authority.ts";
 import { registerWorkspaceMemberEdits } from "../runtime/session/workspace-member-edits.mjs";
 import {
@@ -147,7 +148,7 @@ import { parentRoutingModeFromEnvironment, routingObjectiveFromEnvironment } fro
 import { ModelSelectionProvenanceTracker } from "../runtime/model/model-selection-provenance.ts";
 import type { TaskFeatures } from "../runtime/solver/solver-types.ts";
 import { planRetrievalRoute } from "../runtime/context/retrieval-route-policy.ts";
-import { evaluateRuntimeSolver } from "../runtime/solver/runtime-features.ts";
+import { evaluateRuntimeSolver, refreshGitShape } from "../runtime/solver/runtime-features.ts";
 import { SolverShadowRuntime, solverModeFromEnvironment } from "../runtime/solver/solver-shadow.ts";
 import { TrajectoryRuntime } from "../runtime/trajectory/trajectory-runtime.ts";
 import { parseApplyPatchTargets, registerApplyPatchTool } from "../runtime/tools/apply-patch-tool.ts";
@@ -206,6 +207,7 @@ import type {
   ResolvedPermissionProfile,
   ReviewLens,
   RuntimePolicySettings,
+  CommandRule,
   TaskContract,
   TechContextSnapshot,
   TechOption,
@@ -554,8 +556,6 @@ function verifyProjectCapabilityState(
   }
 }
 
-// Exec-policy prompts a full-access session does not show: local, reversible.
-const FULL_ACCESS_SKIPPED_PROMPTS = ["prompt-git-add-broad"];
 
 function evaluateExecPolicy(command: string, profile: ProjectProfile, policy: BasePolicy): {
   mode: RuntimePolicySettings["execPolicy"];
@@ -564,7 +564,7 @@ function evaluateExecPolicy(command: string, profile: ProjectProfile, policy: Ba
   segments: Array<{ command: string; words: string[]; matches: string[]; warnings: string[] }>;
 } {
   const runtime = resolveRuntimePolicy(profile);
-  const execPolicy = execPolicyConfig(policy);
+  const execPolicy = { ...execPolicyConfig(policy), rules: [...execPolicyConfig(policy).rules, ...autoDenyRules(profile)] };
   const mode = runtime.execPolicy === "off" ? "off" : runtime.execPolicy ?? execPolicy.defaultMode;
   return evaluateExecPolicyCore(command, { policy: { ...policy, execPolicy }, mode }) as {
     mode: RuntimePolicySettings["execPolicy"];
@@ -923,6 +923,36 @@ function approvalUnavailableFallback(ctx: Pick<ExtensionContext, "ui">): Approva
   }
 }
 
+// A project's own refusals (profile `autoDeny`) as exec-policy forbid rules.
+function autoDenyRules(profile: ProjectProfile): CommandRule[] {
+  return (Array.isArray(profile.autoDeny) ? profile.autoDeny : []).filter((rule) => typeof rule?.pattern === "string" && rule.pattern.trim())
+    .map((rule, index) => ({ id: `auto-deny-${index + 1}`, action: "forbid" as const, match: rule.match ?? "contains", value: rule.pattern,
+      reason: String(rule.reason ?? "Refused by this project's autoDeny rule"), terminate: rule.terminate === true }));
+}
+// The block for a refused command; a rule with terminate also ends the turn.
+function execRefusal(decision: { reasons: string[]; segments: Array<{ matches: string[] }> }): { block: true; reason: string; terminate?: boolean } {
+  const terminate = decision.segments.some((segment) => segment.matches.some((match) => match.startsWith("terminate:")));
+  return { block: true, reason: decision.reasons.join("; ") + (terminate ? " Do not retry; the turn ends here." : ""), ...(terminate ? { terminate: true } : {}) };
+}
+
+// The member's four answers in the terminal (Pi's TUI). Elsewhere the
+// terminal keeps its yes/no question and the dashboard card offers the four.
+const TERMINAL_CHOICES: Record<ApprovalChoice, string> = { once: "Allow once", session: "Allow this exact action for the rest of the session",
+  deny: "Deny", stop: "Deny and stop the turn" };
+function terminalChooser(ctx: ExtensionContext, title: string, prompt: string, grantable: boolean): (() => Promise<ApprovalChoice>) | undefined {
+  if (ctx.mode !== "tui" || !ctx.hasUI || typeof ctx.ui.select !== "function") return undefined;
+  const choices = (["once", ...(grantable ? ["session"] : []), "deny", "stop"] as ApprovalChoice[]);
+  return async () => {
+    const picked = await ctx.ui.select(`${title}\n\n${prompt}`, choices.map((choice) => TERMINAL_CHOICES[choice]));
+    return choices.find((choice) => TERMINAL_CHOICES[choice] === picked) ?? "deny";
+  };
+}
+
+// Actions the member allowed for the rest of a session: the same tool with
+// the same exact command or input. A handoff is never kept.
+const sessionGrants = new Map<string, Set<string>>();
+const grantKey = (toolName: string, command: string | null, input: unknown) => `${toolName}\u0000${command ?? JSON.stringify(input ?? {})}`;
+
 function evaluatePathLikeToolAccess(
   cwd: string,
   toolName: string,
@@ -1124,10 +1154,13 @@ function normalizePermissionProfileMode(value: unknown): PermissionProfileMode |
 }
 
 function runtimeEquivalentForPermissionProfile(mode: PermissionProfileMode): string {
-  if (mode === "read-only") return "sandbox_mode=read-only";
-  if (mode === "trusted-full-access") return "sandbox_mode=danger-full-access + approval_policy=never, with Piagent protected-path and human-action gates still enforced";
-  if (mode === "bypass") return "sandbox_mode=danger-full-access + approval_policy=never; every Piagent gate off (output redaction and turn checkpoints remain)";
-  return "sandbox_mode=workspace-write + approval_policy=on-request";
+  // What the mode resembles in common sandbox terms. A personal session runs on this
+  // machine with no OS sandbox (execution-backend.js "host"): Piagent's policy
+  // checks are the boundary.
+  if (mode === "read-only") return "like sandbox_mode=read-only, enforced by Piagent policy (no OS sandbox)";
+  if (mode === "trusted-full-access") return "like sandbox_mode=danger-full-access; protected paths, destructive steps and the handoff (push, PR, publish, deploy, remote tools) are still asked";
+  if (mode === "bypass") return "like sandbox_mode=danger-full-access + approval_policy=never for the work; the handoff (push, PR, publish, deploy, remote tools, MCP writes) is still asked, and output redaction and turn checkpoints remain";
+  return "like sandbox_mode=workspace-write + approval_policy=on-request, enforced by Piagent policy (no OS sandbox)";
 }
 
 function sessionPermissionOverrideKey(ctx: ExtensionContext): string {
@@ -3353,6 +3386,11 @@ export default function piagentGuard(pi: ExtensionAPI) {
   });
   const runtimeSnapshotCapture = new RuntimeSnapshotCapture(), runtimeVersions = readRuntimeVersionMetadata(PLATFORM_ROOT);
   const solverShadow = solverMode === "off" ? undefined : new SolverShadowRuntime(solverMode);
+  if (solverShadow) {
+    // The solver's Git shape is read ahead of the prompt (runtime-features.ts).
+    pi.on("session_start", (_event, ctx) => { void refreshGitShape(ctx.cwd); });
+    pi.on("agent_settled", (_event, ctx) => { void refreshGitShape(ctx.cwd); });
+  }
   const modelRouteRuntime = new ModelRouteRuntime(parentRoutingMode, routingObjective);
   const modelSelectionProvenance = new ModelSelectionProvenanceTracker();
   const serviceTierRuntime = new ServiceTierRuntime({ environmentValue: process.env.PIAGENT_FAST_MODE });
@@ -3717,6 +3755,38 @@ export default function piagentGuard(pi: ExtensionAPI) {
   // Bypass is for personal sessions only: a company session keeps Studio's rules.
   const bypassActive = (ctx: ExtensionContext) => !isCompanySession(ctx) && ctx.model?.provider !== "agent_watch_managed"
     && resolvePermissionProfile(loadProfileFromContext(ctx), policy, permissionOverrideFromContext(ctx)).mode === "bypass";
+  // Bypass runs the work without asking and stops at the handoff: a push, a
+  // PR or merge, a publish or deploy, a remote or cloud tool, an upload or an
+  // MCP tool that writes outside is asked about, as in every other mode.
+  const bypassHandoff = async (event: { toolName: string; toolCallId?: string; input?: unknown }, ctx: ExtensionContext): Promise<{ block: true; reason: string; terminate?: boolean } | undefined> => {
+    const input = isPlainRecord(event.input) ? event.input : {};
+    const prepared = SHELL_TOOL_NAMES.has(event.toolName) ? null : prepareToolInputForPolicy(event.toolName, input, policy);
+    const shell = extractShellCommandInput(prepared?.proxyShellCarrier && prepared.proxyArgs ? prepared.proxyArgs : SHELL_TOOL_NAMES.has(event.toolName) ? input : {});
+    const command = shell.command ? normalizeShellCommandForPolicy(shell.command) : null;
+    // The project's autoDeny rules hold in Bypass too: they are its own refusals.
+    const projectRules = autoDenyRules(loadProfileFromContext(ctx));
+    if (command && projectRules.length) {
+      const refused = evaluateExecPolicyCore(command, { policy: { execPolicy: { defaultMode: "enforce", bannedPrefixSuggestions: [], rules: projectRules } }, mode: "enforce" });
+      if (refused.decision === "forbid") return execRefusal(refused);
+    }
+    let reason = command ? await handoffReason(command) : null;
+    if (!reason && !command && prepared && classifyExternalAction(event.toolName, prepared.input, policy).decision === "confirm") {
+      const action = await mcpWriteAction(prepared.proxyTool ?? event.toolName);
+      if (action) reason = `${prepared.proxyToolName ?? event.toolName} writes outside this machine (${action})`;
+    }
+    if (!reason) return undefined;
+    const preview = command ?? prepared?.confirmationSummary ?? event.toolName;
+    const approval = await piApprovalBroker.request({ cwd: ctx.cwd, rawSessionId: ctx.sessionManager.getSessionId(), toolCallId: String(event.toolCallId), expectedTask: null,
+      action: { kind: "external-provider-action", preconditionClass: "runtime-only", treePrecondition: null, toolName: event.toolName, rawAction: { toolName: event.toolName, command, input },
+        commandPreview: command, parameterPreview: preview, targetPaths: [], targetSummaries: [reason], provider: command ? "shell-external" : String(prepared?.proxyToolName ?? event.toolName),
+        urlOrigin: null, requestedScope: "one-handoff", reason: `Bypass still asks before a handoff: ${reason}`, riskClass: "high",
+        allowConsequence: "Run this exact step once; the work leaves this machine.", denyConsequence: "The step does not run; the agent is told you declined." },
+      terminalConfirm: () => ctx.ui.confirm(`Bypass still asks before a handoff.\n\n${reason}\n\n${preview}\n\nAllow?`, "Piagent handoff confirmation"),
+      terminalChoose: terminalChooser(ctx, "Piagent handoff confirmation", `Bypass still asks before a handoff.\n\n${reason}\n\n${preview}`, false), unavailableFallback: approvalUnavailableFallback(ctx) });
+    if (!approval.allowed) return approval.choice === "stop" ? { block: true, terminate: true, reason: `User denied the handoff and stopped the turn: ${reason}. Do not retry; wait for the member.` } : { block: true, reason: `User denied the handoff: ${reason}` };
+    if (!approval.consume()) return { block: true, reason: "Approval became stale before tool start; the action was blocked." };
+    return undefined;
+  };
   registerToolCallHook(pi, {
     extractLikelyPath: extractLikelyPathFromInput,
     redactText,
@@ -3778,10 +3848,10 @@ export default function piagentGuard(pi: ExtensionAPI) {
       return undefined;
     },
     authorize: async (event, ctx) => {
-    // Bypass: no Piagent gate asks or blocks, as with Codex's
-    // --dangerously-bypass-approvals-and-sandbox. Tool output is still
-    // redacted and the turn still gets its checkpoint; neither stops a command.
-    if (bypassActive(ctx)) return;
+    // Bypass: no Piagent gate asks or blocks the work. The handoff is still
+    // asked (bypassHandoff); tool output is still redacted and the turn still
+    // gets its checkpoint.
+    if (bypassActive(ctx)) return bypassHandoff(event, ctx);
     const preInput = isPlainRecord(event.input) ? event.input : {};
     const authorizationTargetInspection = authorizationMutationTargetInspection(ctx.cwd, event.toolName, preInput);
     if (authorizationTargetInspection.reason) {
@@ -3872,9 +3942,11 @@ export default function piagentGuard(pi: ExtensionAPI) {
           && !candidate.startsWith("../")
           && !candidate.startsWith(".pi/piagent-state/")
         ));
-      if (execDecision.mode !== "off" && execDecision.decision === "forbid") {
-        return { block: true, reason: execDecision.reasons.join("; ") };
-      }
+      if (execDecision.mode !== "off" && execDecision.decision === "forbid") return execRefusal(execDecision);
+      // The shell syntax tree reads what the scanner may miss: a command in a
+      // function, a case arm or an unquoted heredoc's $( … ).
+      const treeFinding = execDecision.mode !== "off" ? treeExecFinding(command) : null;
+      if (treeFinding?.decision === "forbid") return { block: true, reason: treeFinding.reason };
 
       const protectedHit = findProtectedPathInCommand(command, pathPolicy.shellProtectedPaths);
       if (protectedHit) {
@@ -3903,16 +3975,21 @@ export default function piagentGuard(pi: ExtensionAPI) {
 
       // Full access skips the prompts for local, reversible steps; deletes,
       // migrations and anything sent outside this machine are still asked.
-      const confirmationReasons = (execDecision.mode !== "off" && execDecision.decision === "prompt" ? [...execDecision.reasons] : [])
+      const confirmationReasons = [...(execDecision.mode !== "off" && execDecision.decision === "prompt" ? execDecision.reasons : []), ...(treeFinding?.decision === "prompt" && !execDecision.reasons.includes(treeFinding.reason) ? [treeFinding.reason] : [])]
         .filter((reason) => permissionProfile.mode !== "trusted-full-access"
-          || !FULL_ACCESS_SKIPPED_PROMPTS.some((id) => reason.startsWith(`Prompt required by exec policy ${id}:`)));
-      const externalReason = findShellExternalConfirmationReason(execDecision.segments, externalActionPolicyConfig(policy));
-      if (externalReason) confirmationReasons.push(externalReason);
+          || ![...FULL_ACCESS_RUNS].some((id) => reason.startsWith(`Prompt required by exec policy ${id}:`)));
+      // The handoff (push, PR, publish, deploy, remote and cloud tools,
+      // uploads) is asked in every mode: runtime/policy/handoff-policy.mjs.
+      const handoff = await handoffReason(command);
+      const shellExternal = findShellExternalConfirmationReason(execDecision.segments, externalActionPolicyConfig(policy));
+      const handoffNote = handoff && !shellExternal && !confirmationReasons.includes(handoff) ? `Handoff requires confirmation: ${handoff}` : undefined;
+      const externalReason = shellExternal ?? (handoff ? handoffNote ?? handoff : undefined);
+      for (const reason of [shellExternal, handoffNote]) if (reason) confirmationReasons.push(reason);
       if (confirmationReasons.length > 0) {
         pendingHumanApproval = { prompt: `Command requires confirmation.\n\n${confirmationReasons.join("\n")}\n\nAllow?`, title: "Piagent exec policy confirmation",
           action: { kind: externalReason ? "external-provider-action" : "workspace-patch", preconditionClass: externalReason ? "runtime-only" : "workspace-tree", toolName: event.toolName, rawAction: { toolName: event.toolName, command, input: preparedInput.input },
             commandPreview: command, parameterPreview: preparedInput.confirmationSummary ?? "Shell command", targetPaths: shellMutationTargets, targetSummaries: confirmationReasons, provider: externalReason ? "shell-external" : null, urlOrigin: null,
-            requestedScope: "one-shell-command", reason: confirmationReasons.join("; "), riskClass: shellProjectMutation ? "high" : "medium", allowConsequence: "Run this exact command once, after the guard checks the working tree again.", denyConsequence: "The command does not run; the agent is told you declined." } };
+            requestedScope: handoff ? "one-handoff" : "one-shell-command", reason: confirmationReasons.join("; "), riskClass: shellProjectMutation ? "high" : "medium", allowConsequence: "Run this exact command once, after the guard checks the working tree again.", denyConsequence: "The command does not run; the agent is told you declined." } };
       }
     }
 
@@ -3965,16 +4042,25 @@ export default function piagentGuard(pi: ExtensionAPI) {
         : classifiedExternalAction;
       if (externalAction.decision === "confirm") {
         const inputSummary = preparedInput.confirmationSummary ? `\ninput: ${preparedInput.confirmationSummary}` : "";
+        // A write to the system behind the tool is a handoff: approved one at a time.
+        const writesOut = Boolean(await mcpWriteAction(preparedInput.proxyTool ?? event.toolName));
         pendingHumanApproval = { prompt: `External provider action requires confirmation.\n\nprovider: ${externalAction.provider}\naction: ${externalAction.action}\ntool: ${event.toolName}${inputSummary}\n\nAllow?`, title: "Piagent external action confirmation",
           action: { kind: "external-provider-action", preconditionClass: "runtime-only", toolName: event.toolName, rawAction: { toolName: event.toolName, input: preparedInput.input, provider: externalAction.provider, action: externalAction.action },
             commandPreview: null, parameterPreview: preparedInput.confirmationSummary ?? String(externalAction.action), targetPaths: [], targetSummaries: [], provider: String(externalAction.provider),
-            urlOrigin: null, requestedScope: "one-external-action", reason: `External provider action ${String(externalAction.action)} requires confirmation`, riskClass: "high", allowConsequence: "Run this exact action once, after the guard checks its authority again.", denyConsequence: "The action does not run; nothing outside changes." } };
+            urlOrigin: null, requestedScope: writesOut ? "one-handoff" : "one-external-action", reason: `External provider action ${String(externalAction.action)} requires confirmation`, riskClass: "high", allowConsequence: "Run this exact action once, after the guard checks its authority again.", denyConsequence: "The action does not run; nothing outside changes." } };
       }
     }
 
+    const grants = sessionGrants.get(ctx.sessionManager.getSessionId()) ?? new Set<string>();
+    const grantable = Boolean(pendingHumanApproval) && !/handoff/.test(String(pendingHumanApproval!.action.requestedScope));
+    const grant = grantKey(event.toolName, typeof pendingHumanApproval?.action.commandPreview === "string" ? pendingHumanApproval.action.commandPreview : null, preparedInput.input);
+    if (pendingHumanApproval && grantable && grants.has(grant)) pendingHumanApproval = null;
     if (pendingHumanApproval) {
-      const approval = await piApprovalBroker.request({ cwd: ctx.cwd, rawSessionId: ctx.sessionManager.getSessionId(), toolCallId: String(event.toolCallId), expectedTask: null, action: { ...pendingHumanApproval.action, preconditionClass: "runtime-only", treePrecondition: null }, terminalConfirm: () => ctx.ui.confirm(pendingHumanApproval!.prompt, pendingHumanApproval!.title), unavailableFallback: approvalUnavailableFallback(ctx) });
-      if (!approval.allowed) return { block: true, reason: pendingHumanApproval.action.kind === "external-provider-action" && !SHELL_TOOL_NAMES.has(event.toolName) ? `User denied external provider action: ${event.toolName}` : `User denied command: ${pendingHumanApproval.action.reason}` };
+      const approval = await piApprovalBroker.request({ cwd: ctx.cwd, rawSessionId: ctx.sessionManager.getSessionId(), toolCallId: String(event.toolCallId), expectedTask: null, action: { ...pendingHumanApproval.action, preconditionClass: "runtime-only", treePrecondition: null }, terminalConfirm: () => ctx.ui.confirm(pendingHumanApproval!.prompt, pendingHumanApproval!.title),
+        terminalChoose: terminalChooser(ctx, pendingHumanApproval.title, pendingHumanApproval.prompt, grantable), unavailableFallback: approvalUnavailableFallback(ctx) });
+      if (!approval.allowed) return { block: true, reason: pendingHumanApproval.action.kind === "external-provider-action" && !SHELL_TOOL_NAMES.has(event.toolName) ? `User denied external provider action: ${event.toolName}` : `User denied command: ${pendingHumanApproval.action.reason}`,
+        ...(approval.choice === "stop" ? { terminate: true, reason: `User denied and stopped the turn: ${pendingHumanApproval.action.reason}. Do not retry; wait for the member.` } : {}) };
+      if (approval.choice === "session" && grantable) sessionGrants.set(ctx.sessionManager.getSessionId(), grants.add(grant));
       // A WebUI allow is provisional until the guard consumes it here. Without
       // this the decision request never got its receipt and the approval stayed
       // pending, filling the broker until it stopped accepting WebUI decisions.

package/packages/piagent-core/extensions/policy-core.js

@@ -1,5 +1,5 @@
-import { excludedFindSelectorValue, findSelectorOption, SEARCH_COMMANDS, SEARCH_FILE_OPTIONS, SEARCH_GLOB_OPTIONS,
-  SEARCH_PATTERN_OPTIONS, searchSelectorIsExclusion, searchSelectorWithinToken } from "./shell-selector-policy.js";
+import { excludedFindSelectorValue, findSelectorOption, SEARCH_COMMANDS, SEARCH_FILE_OPTIONS, SEARCH_GLOB_OPTIONS, SEARCH_PATTERN_OPTIONS, searchSelectorIsExclusion, searchSelectorWithinToken } from "./shell-selector-policy.js";
+import { CONTROL_PREFIXES, gitSubcommandWords } from "./shell-command-words.js";
 
 const PATH_REDIRECT_OPERATORS = new Set(["<", ">", ">>", "1>", "1>>", "2>", "2>>", "&>", "&>>"]);
 const DATA_ONLY_COMMANDS = new Set(["echo", "printf"]);
@@ -35,7 +35,7 @@ const INLINE_CODE_FLAGS = new Map([
   ["perl", new Set(["-e", "-E"])],
   ["php", new Set(["-r"])]
 ]);
-const SIMPLE_WRAPPERS = new Set(["sudo", "nohup", "time", "nice", "ionice", "command"]);
+const SIMPLE_WRAPPERS = new Set(["sudo", "doas", "nohup", "time", "nice", "ionice", "command", "exec"]);
 
 function escapeRegex(value) {
   return value.replace(/[.+^${}()|[\]\\]/g, "\\$&");
@@ -703,13 +703,13 @@ function isLeadingRedirection(word) {
   return /^[0-9]*(?:>>?\|?|<>?|>&|<&)/.test(word);
 }
 
-function stripWrapper(words) {
+export function stripWrapper(words) {
   let current = [...words];
   let changed = true;
 
   while (changed && current.length > 0) {
     changed = false;
-    while (current.length > 0 && isAssignment(current[0])) {
+    while (current.length > 0 && (isAssignment(current[0]) || CONTROL_PREFIXES.has(current[0]))) {
       current = current.slice(1);
       changed = true;
     }
@@ -1186,7 +1186,7 @@ export function evaluateExecPolicyCore(command, options) {
 
     for (const rule of execPolicy.rules) {
       if (!commandRuleMatches(rule, text, words)) continue;
-      matches.push(`${rule.action}:${rule.id}`);
+      matches.push(`${rule.action}:${rule.id}`, ...(rule.action === "forbid" && rule.terminate ? [`terminate:${rule.id}`] : []));
       if (rule.action === "forbid") reasons.push(`Forbidden by exec policy ${rule.id}: ${rule.reason}`);
       if (rule.action === "prompt") reasons.push(`Prompt required by exec policy ${rule.id}: ${rule.reason}`);
     }
@@ -1229,7 +1229,7 @@ export function evaluateExecPolicyCore(command, options) {
   const confirmationPatternMatches = (pattern, words) => {
     const expected = shellWords(String(pattern ?? ""));
     if (expected.length === 0) return false;
-    const executableWords = stripWrapper(words);
+    const executableWords = gitSubcommandWords(stripWrapper(words));
     if (arrayStartsWith(executableWords, expected)) return true;
     if (expected.length !== 1) return false;
     const action = expected[0];

package/packages/piagent-core/extensions/shell-ast.js

@@ -0,0 +1,85 @@
+// The simple commands a shell line runs, read from a real shell syntax tree.
+//
+// policy-core.js splits a line into segments with its own scanner; this reads
+// the same line through a POSIX/Bash parser and walks every place a command
+// can sit: pipelines, && and ||, if/while/for/case bodies, functions, ( … ),
+// { … }, $( … ), backticks and <( … ). `bash -c '…'`, `sh -c` and `eval` are
+// parsed again, so the text they run is read as commands too. A check that
+// reads both lists sees a command whichever reader finds it.
+//
+// Words come back as text. A word built from an expansion the shell decides
+// at run time ($VAR, $(…), `…`) keeps it as written and is flagged dynamic;
+// nothing is evaluated here. A line the parser rejects gives null: callers
+// keep the scanner's answer, which is never weakened by this module.
+import { parse } from "@aliou/sh";
+
+const SHELLS = new Set(["sh", "bash", "zsh", "dash", "ksh", "mksh"]);
+const MAX_DEPTH = 8;
+
+function wordText(word) {
+  let text = "", dynamic = false;
+  const visit = (parts) => {
+    for (const part of parts ?? []) {
+      if (part.type === "Literal" || part.type === "SglQuoted") text += part.value;
+      else if (part.type === "DblQuoted") visit(part.parts);
+      else if (part.type === "ParamExp") { text += `$${part.param?.value ?? ""}`; dynamic = true; }
+      else { text += "$(…)"; dynamic = true; }
+    }
+  };
+  visit(word?.parts);
+  return { text, dynamic };
+}
+
+// The $( … ) and ` … ` an unquoted heredoc body runs: the parser keeps the
+// body as text, and the shell expands it.
+function substitutions(text) {
+  const found = [];
+  for (let index = 0; index < text.length; index += 1) {
+    if (text[index] === "`") {
+      const close = text.indexOf("`", index + 1);
+      if (close < 0) break;
+      found.push(text.slice(index + 1, close)); index = close;
+    } else if (text.startsWith("$(", index) && text[index + 2] !== "(") {
+      let depth = 0, close = -1;
+      for (let at = index + 1; at < text.length; at += 1) {
+        if (text[at] === "(") depth += 1;
+        else if (text[at] === ")" && --depth === 0) { close = at; break; }
+      }
+      if (close < 0) break;
+      found.push(text.slice(index + 2, close)); index = close;
+    }
+  }
+  return found;
+}
+
+function collect(node, found, depth) {
+  if (!node || typeof node !== "object") return;
+  if (Array.isArray(node)) { for (const item of node) collect(item, found, depth); return; }
+  if (node.type === "Redirect" && node.heredoc && node.target?.parts?.every((part) => part.type === "Literal") && depth < MAX_DEPTH) {
+    for (const source of substitutions(wordText(node.heredoc).text)) collectSource(source, found, depth + 1);
+  }
+  if (node.type === "SimpleCommand" && node.words?.length) {
+    const words = node.words.map(wordText);
+    found.push({ words: words.map((word) => word.text), dynamic: words.some((word) => word.dynamic) });
+    const name = String(words[0]?.text ?? "").split("/").pop();
+    const inline = SHELLS.has(name) ? words.findIndex((word, index) => index > 0 && /^-[a-z]*c[a-z]*$/.test(word.text)) + 1 : name === "eval" ? 1 : 0;
+    if (inline > 0 && depth < MAX_DEPTH) {
+      const source = name === "eval" ? words.slice(1).map((word) => word.text).join(" ") : words[inline]?.text;
+      if (source) collectSource(source, found, depth + 1);
+    }
+  }
+  for (const [key, value] of Object.entries(node)) {
+    if (key !== "pos" && key !== "end" && value && typeof value === "object") collect(value, found, depth);
+  }
+}
+
+function collectSource(source, found, depth) {
+  try { collect(parse(String(source), { dialect: "bash" }).ast, found, depth); } catch { /* the scanner still reads it */ }
+}
+
+// [{ words, dynamic }] for every simple command, or null when the line does not parse.
+export function astCommands(command) {
+  const found = [];
+  try { collect(parse(String(command), { dialect: "bash" }).ast, found, 0); } catch { return null; }
+  return found;
+}

package/packages/piagent-core/extensions/shell-command-words.js

@@ -0,0 +1,19 @@
+// How a simple command's words name what runs, shared by policy-core.js and
+// the handoff policy (runtime/policy/handoff-policy.mjs).
+
+// Shell words that open a compound statement: the command follows them.
+// `if true; then rm -rf /; fi` splits into `then rm -rf /`, which runs rm.
+export const CONTROL_PREFIXES = new Set(["!", "{", "(", "if", "then", "do", "elif", "else", "while", "until"]);
+
+// Git's global options come before the subcommand: `git -C api push` and
+// `git -c core.hooksPath=x --no-pager push` push as `git push` does. Without
+// this a rule written as "git push" matched only the plain spelling.
+const GIT_OPTIONS_WITH_VALUE = new Set(["-C", "-c", "--git-dir", "--work-tree", "--namespace", "--super-prefix", "--config-env", "--exec-path", "--list-cmds"]);
+export function gitSubcommandWords(words) {
+  if (String(words[0] ?? "").split("/").pop() !== "git") return words;
+  let index = 1;
+  while (index < words.length && words[index].startsWith("-")) {
+    index += GIT_OPTIONS_WITH_VALUE.has(words[index]) ? 2 : 1;
+  }
+  return ["git", ...words.slice(index)];
+}

package/packages/piagent-core/managed/command-tools.mjs

@@ -1,49 +1,55 @@
 import { spawn } from 'node:child_process';
-import { asksNothing, broadAccess, networkConfirmation } from './permission.mjs';
+import { asksOnlyHandoff, broadAccess, effectivePermission, networkConfirmation } from './permission.mjs';
+import { handoffReason } from '../runtime/policy/handoff-policy.mjs';
 import { engineAlive, engineLauncher } from './container-engine.mjs';
 import { MEMBER_ONLY, memberOnlyReason, credentialReason, runHostCommand } from './host-command.mjs';
 import { processTools } from './background-process.mjs';
 import { checkpointsOf } from './checkpoints.mjs';
 import { detachedEmulator, simulatorCommandReason } from './simulator-commands.mjs';
 
-// Commands that leave the plain sandbox, each after the member approves that
-// exact command: run_with_network (internet, a local server or browser),
-// run_with_docker when this machine has Docker (the same plus the engine's
-// socket) and run_on_host (on the member's machine, outside the sandbox).
-// Bypass runs the first two without asking (owner, 2026-10-09), except what
-// must be confirmed for any command (bypass-policy.mjs: pushes, deploys,
-// registry logins, deletes known only at run time). run_on_host asks in every
-// mode but Bypass; Bypass still asks when the command reaches credentials.
+// Commands that leave the plain sandbox: run_with_network (internet, a local
+// server or browser), run_with_docker when this machine has Docker (the same
+// plus the engine's socket), run_on_host (on the member's machine, outside the
+// sandbox) and run_on_simulator. What each mode asks (permission.mjs):
+// - Ask first: every command.
+// - Full access: run_with_network, run_with_docker and run_on_simulator run,
+//   except the handoff and destructive steps (mustConfirm); run_on_host asks
+//   every command.
+// - Bypass: all four run, except the handoff (handoffReason: push, PR,
+//   publish, deploy, remote and cloud tools, uploads) and, on the host, a
+//   command that reaches credentials.
 const PARAMETERS = { type: 'object', properties: { command: { type: 'string', minLength: 1, maxLength: 4000 }, reason: { type: 'string', minLength: 1, maxLength: 300 }, timeout: { type: 'number', minimum: 1, maximum: 1800 } }, required: ['command', 'reason'], additionalProperties: false };
 
 const KINDS = {
   network: {
     name: 'run_with_network', label: 'Run with network', scope: 'network-command-once', provider: 'network', riskClass: 'medium',
-    description: 'Run one shell command that needs the internet beyond the package registries bash already reaches (a download site or registry the package proxy refuses), or that starts a local server or a browser (end-to-end tests with Playwright\'s Chromium against a server on 127.0.0.1), after the user approves that exact command. Normal bash has no internet; on macOS it reaches servers on this Mac and runs Playwright\'s Chromium against them, except while a local proxy listens. Credentials (.npmrc, SSH keys, Keychain) stay unavailable, so private registries and git push are not possible here.',
+    description: 'Run one shell command that needs the internet beyond the package registries bash already reaches (a download site or registry the package proxy refuses), or that starts a local server or a browser (end-to-end tests with Playwright\'s Chromium against a server on 127.0.0.1), after the user approves that exact command (Full access and Bypass run it without asking, but a push, publish, deploy or upload is always asked). Normal bash has no internet; on macOS it reaches servers on this Mac and runs Playwright\'s Chromium against them, except while a local proxy listens. Credentials (.npmrc, SSH keys, Keychain) stay unavailable, so private registries and git push are not possible here.',
     allow: 'Run this exact command once, with internet access; a server it starts accepts connections while it runs.',
     title: 'Chạy lệnh có internet', allowText: 'chạy đúng lệnh này một lần, có internet; server nó mở nhận kết nối trong lúc chạy.',
     confirm: (self, command) => networkConfirmation(self, command),
   },
   docker: {
     name: 'run_with_docker', label: 'Run with Docker', scope: 'docker-command-once', provider: 'docker', riskClass: 'high',
-    description: 'Run one shell command that needs the Docker engine of this machine: docker, docker compose (a database or service for tests), docker build, or tests that start containers themselves (Testcontainers), after the user approves that exact command. It has internet access too. Normal bash and run_with_network cannot reach Docker. Mount only folders inside the project. Registry credentials are unavailable: public images pull, private registries and docker push do not. Containers started in the background (-d, compose up -d) keep running after the command: stop them (docker compose down) when the work is done unless the member wants them kept.',
+    description: 'Run one shell command that needs the Docker engine of this machine: docker, docker compose (a database or service for tests), docker build, or tests that start containers themselves (Testcontainers), after the user approves that exact command (Full access and Bypass run it without asking, but docker push or login and any other handoff is always asked). It has internet access too. Normal bash and run_with_network cannot reach Docker. Mount only folders inside the project. Registry credentials are unavailable: public images pull, private registries and docker push do not. Containers started in the background (-d, compose up -d) keep running after the command: stop them (docker compose down) when the work is done unless the member wants them kept.',
     allow: 'Run this exact command once, with internet access and the Docker engine; a container it starts can read folders Docker shares from this machine and may keep running.',
     title: 'Chạy lệnh dùng Docker', allowText: 'chạy đúng lệnh này một lần, có internet và Docker; container nó tạo có thể đọc thư mục Docker được chia sẻ trên máy và có thể tiếp tục chạy.',
     confirm: (self, command) => networkConfirmation(self, command),
   },
   host: {
     name: 'run_on_host', label: 'Run on this machine', scope: 'host-command-once', provider: 'host', riskClass: 'high',
-    description: 'Run one shell command on the member\'s machine, outside the sandbox, as the member, after they approve that exact command. Use it when the sandbox blocks what the task needs and no other tool covers it: install a runtime or tool the project needs (brew install openjdk@21, brew install node@22, sdk install java…), git pull or git push with the member\'s sign-in, a private registry, a file outside the project. It has the member\'s files, Keychain and sign-ins, so ask only for what the task needs and say why in reason. No input can be typed: commands that need the member\'s password (sudo, a .pkg installer) or an interactive sign-in are refused; ask the member with ask_user for those.',
+    description: 'Run one shell command on the member\'s machine, outside the sandbox, as the member, after they approve that exact command (only Bypass runs it without asking, and even there a push, PR, publish, deploy or a command that reaches credentials is asked). Use it when the sandbox blocks what the task needs and no other tool covers it: install a runtime or tool the project needs (brew install openjdk@21, brew install node@22, sdk install java…), git pull with the member\'s sign-in, git push only when the member asked for it, a private registry, a file outside the project. It has the member\'s files, Keychain and sign-ins, so ask only for what the task needs and say why in reason. No input can be typed: commands that need the member\'s password (sudo, a .pkg installer) or an interactive sign-in are refused; ask the member with ask_user for those.',
     allow: 'Run this exact command once on this machine, outside the sandbox, as you: it can read and change your files and use your sign-ins.',
     title: 'Chạy lệnh trên máy (ngoài sandbox)', allowText: 'chạy đúng lệnh này một lần trên máy bạn, ngoài sandbox, bằng quyền của bạn: lệnh đọc/sửa được file và dùng được tài khoản đã đăng nhập trên máy.',
     // Full access does not cover it: the member approves each command (with
-    // what Full access would still have asked about). Bypass asks only about
-    // credentials: a prompt injection's "cat ~/.ssh/id_rsa" is never silent.
-    confirm: async (self, command) => asksNothing(self) ? credentialReason(command) : await networkConfirmation(self, command) ?? 'ask',
+    // what Full access would still have asked about). Bypass asks about the
+    // handoff and about credentials: a prompt injection's "cat ~/.ssh/id_rsa"
+    // or "git push --force" is never silent.
+    confirm: async (self, command) => asksOnlyHandoff(self) ? credentialReason(command) ?? await handoffReason(command) : await networkConfirmation(self, command) ?? 'ask',
   },
   // The sandbox reaches neither CoreSimulator nor adb. Simulator and app build
   // commands only (simulator-commands.mjs), asked about as network commands:
-  // Full access and Bypass run them, except what reaches credentials.
+  // Full access and Bypass run them, except what reaches credentials and what
+  // either mode asks about any command.
   simulator: {
     name: 'run_on_simulator', label: 'Run on simulator', scope: 'simulator-command-once', provider: 'host', riskClass: 'medium',
     description: 'Run one iOS Simulator or Android emulator command on the member\'s machine, outside the sandbox. iOS: xcrun simctl (list, boot, bootstatus -b, install, launch, terminate, openurl, io <device> screenshot <file>, ui appearance, status_bar, spawn <device> log show --info --last 5m --predicate \'process == "<App>"\'), xcodebuild with a simulator destination (build, test: XCUITest is the reliable way to tap, type and answer system dialogs), xcodegen generate, axe (describe-ui reads the screen\'s elements; tap, type, swipe where this Xcode accepts them), open -a Simulator (some Xcode versions run simulators without that window; the device works without it). Android: adb (devices, install, shell am start, shell input tap/text/swipe, exec-out screencap -p > <file>, logcat -d), emulator -avd <name> (started in the background), avdmanager, ./gradlew installDebug. Also flutter, pod install, npx expo/react-native/cap, mkdir -p and cd inside the project. Parts may be joined by && or || and piped into grep, head, tail, xcbeautify or jq; files may be written only inside the project or to /dev/null. Read a screenshot you saved with read to see the screen. Other commands: run_on_host.',
@@ -60,14 +66,34 @@ async function engineReady(boundary) {
 }
 const DOCKER_STOPPED = 'managed-docker-unreachable: Docker engine trên máy không chạy. Gọi start_docker để xin member duyệt mở Docker, rồi chạy lại đúng lệnh này bằng run_with_docker.';
 
-// One approval of the member (the dashboard card, else the Terminal).
+// Why a mode that runs commands without asking asks about this one, as the
+// card says it: the mode named as it is.
+export function stillAsks(self, reason) {
+  return effectivePermission(self) === 'bypass' ? { en: `Bypass still asks: ${reason}`, vi: `Bypass vẫn hỏi: ${reason}` }
+    : { en: `Full access still asks: ${reason}`, vi: `Full access vẫn hỏi: ${reason}` };
+}
+
+// One approval of the member (the dashboard card, else the Terminal). The
+// member may allow it once, allow the same exact action for the rest of the
+// conversation (never a handoff: its scope names it), deny it, or deny it and
+// stop the turn so the agent does not try again.
+const CHOICES = { once: 'Đồng ý một lần', session: 'Đồng ý cho cả cuộc trò chuyện (đúng lệnh này)', deny: 'Từ chối', stop: 'Từ chối và dừng lượt này' };
 export async function approve(self, id, signal, ctx, action, { title, body }) {
+  const grantable = !/handoff/.test(String(action.requestedScope ?? '')), key = `${action.toolName}\u0000${action.commandPreview ?? JSON.stringify(action.rawAction ?? {})}`;
+  if (grantable && self.sessionApprovals?.has(key)) return;
   const { piApprovalBroker } = await import('../runtime/inspection/approval-broker.ts');
+  const choices = ['once', ...(grantable ? ['session'] : []), 'deny', 'stop'];
   const decision = await piApprovalBroker.request({ cwd: self.cwd, rawSessionId: self.session.sessionManager.getSessionId(), toolCallId: id,
     action: { kind: 'external-provider-action', preconditionClass: 'runtime-only', targetPaths: [self.cwd], urlOrigin: null, ...action },
     terminalConfirm: () => ctx?.ui?.confirm?.(title, body) ?? Promise.resolve(false),
+    ...(ctx?.mode === 'tui' && ctx?.hasUI && typeof ctx.ui?.select === 'function' ? { terminalChoose: async () => {
+      const picked = await ctx.ui.select(`${title}\n\n${body}`, choices.map(choice => CHOICES[choice]));
+      return choices.find(choice => CHOICES[choice] === picked) ?? 'deny';
+    } } : {}),
     unavailableFallback: 'terminal-confirm', recheck: () => !signal?.aborted && Boolean(self.grant) });
+  if (!decision.allowed && decision.choice === 'stop') { try { ctx?.abort?.(); } catch { /* the denial below still stands */ } throw Error('managed-operation-denied-stop: bạn đã từ chối và dừng lượt này; không thử lại, chờ member.'); }
   if (!decision.allowed || !decision.consume() || signal?.aborted) throw Error('managed-operation-denied');
+  if (decision.choice === 'session' && grantable) (self.sessionApprovals ??= new Set()).add(key);
 }
 
 function commandTool(self, kind) {
@@ -80,10 +106,13 @@ function commandTool(self, kind) {
       const notSimulator = kind === 'simulator' ? simulatorCommandReason(args.command, self.cwd) : null;
       if (notSimulator) throw Error(`managed-simulator-command: ${notSimulator}.`);
       const confirm = await spec.confirm(self, args.command);
-      if (confirm !== null) await approve(self, id, signal, ctx, { toolName: spec.name, rawAction: { command: args.command }, commandPreview: String(args.command),
-        provider: spec.provider, requestedScope: spec.scope, reason: (confirm === 'ask' ? String(args.reason) : `Full access still asks: ${confirm}. ${args.reason}`).slice(0, 300), riskClass: spec.riskClass,
-        allowConsequence: spec.allow, denyConsequence: 'The command does not run; the agent is told you declined.' },
-      { title: spec.title, body: `${args.command}\n\nLý do: ${args.reason}${confirm === 'ask' ? '' : `\nBypass vẫn hỏi: ${confirm}`}\n\nĐồng ý: ${spec.allowText}\nTừ chối: lệnh không chạy, agent được báo bạn đã từ chối.` });
+      if (confirm !== null) {
+        const why = confirm === 'ask' ? null : stillAsks(self, confirm), handoff = await handoffReason(args.command);
+        await approve(self, id, signal, ctx, { toolName: spec.name, rawAction: { command: args.command }, commandPreview: String(args.command),
+          provider: spec.provider, requestedScope: handoff ? 'handoff-once' : spec.scope, reason: (why ? `${why.en}. ${args.reason}` : String(args.reason)).slice(0, 300), riskClass: spec.riskClass,
+          allowConsequence: spec.allow, denyConsequence: 'The command does not run; the agent is told you declined.' },
+        { title: spec.title, body: `${args.command}\n\nLý do: ${args.reason}${why ? `\n${why.vi}` : ''}\n\nĐồng ý: ${spec.allowText}\nTừ chối: lệnh không chạy, agent được báo bạn đã từ chối.` });
+      }
       let ok = false;
       if (self.run) await checkpointsOf(self).take();
       const before = await self.changedFiles();
@@ -101,7 +130,8 @@ function commandTool(self, kind) {
 }
 
 // start_docker: the engine the member installed, started after they approve
-// (Bypass starts it without asking: local and reversible), then waited for.
+// (Full access and Bypass start it without asking: local and reversible),
+// then waited for.
 const textResult = text => ({ content: [{ type: 'text', text }], details: {} });
 function startDockerTool(self, { wait = 180_000, every = 2000, launcher: found = engineLauncher, spawnImpl = spawn } = {}) {
   return { name: 'start_docker', label: 'Start Docker',
@@ -134,10 +164,10 @@ export function commandTools(self, options) {
 
 // What the system prompt says about services and what the sandbox blocks: it
 // is read for every request, so a Docker started since shows up.
-const HOST_PROMPT = ' When the sandbox blocks something the task needs (a missing runtime such as a JDK or a Node version, the member\'s sign-in for git pull or git push or a private registry, a file outside the project), do not stop and do not tell the member to run it: request run_on_host with the exact command; it runs on the member\'s machine once they approve. Only what needs the member themselves (their password for sudo or an installer, an interactive sign-in, a window to click) goes to ask_user, with the exact steps and the options to continue or skip; after their answer, check and carry on.';
+const HOST_PROMPT = ' When the sandbox blocks something the task needs (a missing runtime such as a JDK or a Node version, the member\'s sign-in for git pull or a private registry, a file outside the project), do not stop and do not tell the member to run it: request run_on_host with the exact command; it runs on the member\'s machine once they approve. The work ends at the handoff: commit locally, then report what is ready; push, open or merge a pull request, publish or deploy only when the member asked for it in this conversation, and each of those steps is asked about in every access mode. Only what needs the member themselves (their password for sudo or an installer, an interactive sign-in, a window to click) goes to ask_user, with the exact steps and the options to continue or skip; after their answer, check and carry on.';
 export function servicesPrompt(boundary) {
   const simulator = ' The iOS Simulator and Android emulator are not reachable from bash: boot them, build and install the app, launch it, tap and type, and take screenshots with run_on_simulator (save the screenshot in the project, then read it to see the screen). Do not ask the member to run simulator steps you can run.';
-  if (boundary.engine) return ' Docker is available through run_with_docker (the member approves each command): a database or service for tests (docker compose up -d, then the tests through bash or run_with_network), docker build, or Testcontainers tests. If the engine stops answering, start_docker asks the member to start it. Stop what you started when done unless the member wants it kept.' + simulator + HOST_PROMPT;
+  if (boundary.engine) return ' Docker is available through run_with_docker (in Ask first the member approves each command): a database or service for tests (docker compose up -d, then the tests through bash or run_with_network), docker build, or Testcontainers tests. If the engine stops answering, start_docker asks the member to start it. Stop what you started when done unless the member wants it kept.' + simulator + HOST_PROMPT;
   if (boundary.dockerCli) return ' Docker is installed but not running: when the task needs it, call start_docker (the member approves), then run_with_docker.' + simulator + HOST_PROMPT;
   return ' Docker is not installed on this machine: when the task needs it, ask the member with ask_user (install it, or check another way).' + simulator + HOST_PROMPT;
 }

package/packages/piagent-core/managed/fetch-guard.mjs

@@ -1,4 +1,4 @@
-import { asksNothing } from './permission.mjs';
+import { asksOnlyHandoff } from './permission.mjs';
 import { approve } from './command-tools.mjs';
 
 // web_fetch is a request to any public https address: a page that tells the
@@ -6,7 +6,7 @@ import { approve } from './command-tools.mjs';
 // Documentation and package registries are read freely. Another host is asked
 // about once per conversation; an address there that carries a query or a
 // fragment (where data rides along) is asked about every time. Bypass asks
-// only about the latter. A helper cannot ask the member: it is told to hand
+// only about the latter: data sent out is a handoff. A helper cannot ask the member: it is told to hand
 // the address to the main agent.
 const TRUSTED = ['github.com', 'raw.githubusercontent.com', 'docs.github.com', 'npmjs.com', 'www.npmjs.com', 'registry.npmjs.org', 'pypi.org', 'docs.python.org',
   'developer.mozilla.org', 'nodejs.org', 'go.dev', 'pkg.go.dev', 'crates.io', 'docs.rs', 'doc.rust-lang.org', 'learn.microsoft.com', 'developer.apple.com',
@@ -21,7 +21,7 @@ export function fetchDecision(owner, role, raw) {
   if (trustedHost(host)) return null;
   const carries = Boolean(url.search || url.hash), known = owner.fetchHosts?.has(host);
   if (role !== 'main') return carries || !known ? 'refuse' : null;
-  if (asksNothing(owner)) return carries ? 'ask' : null;
+  if (asksOnlyHandoff(owner)) return carries ? 'ask' : null;
   return carries || !known ? 'ask' : null;
 }
 export async function guardFetch(owner, role, raw, id, signal, ctx) {