@piagent/platform 1.49.1 → 1.51.0

package/packages/piagent-core/managed/dist/workspace/assets/packages/piagent-core/policies/base-policy.json

@@ -94,7 +94,8 @@
       "read-only",
       "workspace-write",
       "trusted-full-access",
-      "bypass"
+      "bypass",
+      "always-bypass"
     ]
   },
   "execPolicy": {

package/packages/piagent-core/managed/dist/workspace/manifest.json

@@ -15,7 +15,7 @@
     },
     {
       "file": "assets/packages/piagent-core/policies/base-policy.json",
-      "sha256": "422b26bca154240747970d948cdf1ded57b9dcb544d6547dedb4d1ddfda4b4da"
+      "sha256": "4e049d4663ad3aec174941e6df39c677123a8ad50e66b6449e96969bf53cae6a"
     },
     {
       "file": "assets/adapters/backend-api/profile.json",

package/packages/piagent-core/managed/fetch-guard.mjs

@@ -1,4 +1,4 @@
-import { asksOnlyHandoff } from './permission.mjs';
+import { alwaysBypass, asksOnlyHandoff } from './permission.mjs';
 import { approve } from './command-tools.mjs';
 
 // web_fetch is a request to any public https address: a page that tells the
@@ -16,6 +16,7 @@ export const trustedHost = host => TRUSTED.includes(String(host).toLowerCase().r
 
 // null: fetch it; 'ask': the member approves first; 'refuse': a helper's fetch the member would have to approve.
 export function fetchDecision(owner, role, raw) {
+  if (alwaysBypass(owner)) return null;
   let url; try { url = new URL(raw); } catch { return null; } // web_fetch refuses it on its own
   const host = url.hostname.toLowerCase();
   if (trustedHost(host)) return null;

package/packages/piagent-core/managed/helper-roles.mjs

@@ -87,7 +87,7 @@ export function countedCheck(managed, tool) {
     try { const result = await tool.execute(...args); ok = !result?.isError; return result; }
     finally {
       const after = counted && before !== null ? await folder() : null;
-      if (after !== null && after === before) await managed.run.afterTool('bash', args[1], ok, () => managed.digest());
+      if (after !== null && after === before) await managed.run.afterTool('bash', args[1], ok, () => managed.digest(), managed);
     }
   } };
 }

package/packages/piagent-core/managed/helper-run.mjs

@@ -4,6 +4,7 @@
 // refusal, starts once more: Studio then gives the new helper the next model
 // of its role that serves (an auto role's list).
 import { fenced, HELPER_UNTRUSTED_RULE } from './untrusted.mjs';
+import { relevantChecks } from './check-evidence.mjs';
 import { jobTitle } from './call-purpose.mjs';
 import { ManagedToolBoundary } from './tool-boundary.mjs';
 import { managedResourceLoader } from './resource-loader.mjs';
@@ -20,6 +21,8 @@ import { trackToolFailures } from './tool-failures.mjs';
 import { helperMemoryTools, renewer } from './memory.mjs';
 import { answeredSettlement, failedSettlement, settleHelper, OUTCOME_WORDS } from './helper-settlement.mjs';
 import { viaLink } from './studio-link.mjs';
+import { unsandboxedBash } from './command-tools.mjs';
+import { alwaysBypass } from './permission.mjs';
 
 const textContent = result => result.content?.filter(p => p.type === 'text').map(p => p.text).join('\n') ?? '';
 // A helper failure that another model of its role may not have: the model's
@@ -143,8 +146,8 @@ async function answerUnder(managed, key, task, signal, harness, snapshot, parts,
     // Studio's logs name the job by its title (the brief's first line without one).
     (managed.jobTitles ??= new WeakMap()).set(runtime, jobTitle(task, title));
     const setup = HELPER_SETUP[role], memory = helperMemoryTools(managed, () => grant, renew);
-    boundary = new ManagedToolBoundary({ cwd: managed.cwd, sdkRoot: managed.sdk, protectedRoots: managed.protectedRoots, readOnly: true, commands: setup.commands });
-    const checks = role === 'verify' ? `\n\nRepository checks: ${managed.checks.commands.length ? managed.checks.commands.map(c => '`' + c + '`').join(', ') : 'none declared or detected; choose the tests, type check or build that cover the claims'}.${managed.run?.fullAsked || managed.run?.scopeChoice === 'full' ? '' : ' Run only the tests that cover the claims: the member decides about a whole-suite run.'}` : '';
+    boundary = new ManagedToolBoundary({ cwd: managed.cwd, sdkRoot: managed.sdk, protectedRoots: managed.protectedRoots, readOnly: true, commands: setup.commands }); boundary.unsandboxed = () => alwaysBypass(managed);
+    const checks = role === 'verify' ? `\n\nRepository checks: ${managed.checks.commands.length ? relevantChecks(managed, managed.checks.commands).map(c => '`' + c + '`').join(', ') : 'none declared or detected; choose the tests, type check or build that cover the claims'}.${managed.run?.fullAsked || managed.run?.scopeChoice === 'full' ? '' : ' Run only the tests that cover the claims: the member decides about a whole-suite run.'}` : '';
     // One helper session answers the brief (with one part of the patch for a
     // review in parts); its reply and tokens. A helper runs at its role's
     // level from Studio (fixed by the Harness, or its main agent's).
@@ -152,7 +155,7 @@ async function answerUnder(managed, key, task, signal, harness, snapshot, parts,
       const { session } = await managed.api.createAgentSession({ cwd: managed.cwd, model, modelRuntime: runtime, thinkingLevel: grant.effort || 'off',
         settingsManager: managed.api.SettingsManager.inMemory({ retry: { enabled: false, provider: { maxRetries: 0 } }, cacheWarming: 'off' }),
         sessionManager: managed.api.SessionManager.inMemory(managed.cwd), noTools: 'builtin', tools: [...READ_TOOLS, ...(setup.commands ? ['bash'] : []), ...(setup.web ? ['web_search', 'web_fetch'] : []), ...memory.map(tool => tool.name)],
-        customTools: [...boundary.tools(managed.api).filter(tool => READ_TOOLS.includes(tool.name) || setup.commands && tool.name === 'bash').map(tool => countedCheck(managed, tool)),
+        customTools: [...unsandboxedBash(managed, boundary.tools(managed.api)).filter(tool => READ_TOOLS.includes(tool.name) || setup.commands && tool.name === 'bash').map(tool => countedCheck(managed, tool)),
           ...(setup.web ? managed.webTools(runtime, key) : []), ...memory], resourceLoader: managedResourceLoader(managed.api, { systemPrompt: setup.prompt + HELPER_UNTRUSTED_RULE }) });
       sessions.add(session); trackToolFailures(managed, session, role); watched.add(who); watchHelper(managed, who, session, task, title);
       const abort = () => void session.abort(); signal?.addEventListener('abort', abort, { once: true });

package/packages/piagent-core/managed/host-command.mjs

@@ -51,16 +51,20 @@ const TAIL = 50 * 1024;
 const tail = text => text.length > TAIL ? `[… ${text.length - TAIL} characters before …]\n${text.slice(-TAIL)}` : text;
 const shell = () => process.platform === 'darwin' ? '/bin/zsh' : fs.existsSync('/bin/bash') ? '/bin/bash' : '/bin/sh';
 
+export function spawnOnHost(command, cwd, userHome = os.homedir(), spawnImpl = spawn) {
+  const login = shell(), user = os.userInfo().username;
+  return spawnImpl(login, ['-lc', command], { cwd, detached: true, stdio: ['ignore', 'pipe', 'pipe'],
+    env: { HOME: userHome, USER: user, LOGNAME: user, SHELL: login, PATH: '/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin', LANG: 'en_US.UTF-8', TERM: 'dumb',
+      GIT_TERMINAL_PROMPT: '0', NONINTERACTIVE: '1', HOMEBREW_NO_ENV_HINTS: '1', DEBIAN_FRONTEND: 'noninteractive' } });
+}
+
 // Runs one command as the member, in a login shell (Homebrew, SDKMAN… on
 // PATH as in their Terminal). Nothing of Piagent's own environment (Studio
 // tokens) is passed; no input, so a prompt ends the command instead of hanging.
 export function runHostCommand({ command, cwd, userHome = os.homedir(), timeout = 600, signal, onUpdate, spawnImpl = spawn }) {
   return new Promise((resolve, reject) => {
     if (signal?.aborted) return reject(Error('Command aborted'));
-    const login = shell(), user = os.userInfo().username;
-    const child = spawnImpl(login, ['-lc', command], { cwd, detached: true, stdio: ['ignore', 'pipe', 'pipe'],
-      env: { HOME: userHome, USER: user, LOGNAME: user, SHELL: login, PATH: '/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin', LANG: 'en_US.UTF-8', TERM: 'dumb',
-        GIT_TERMINAL_PROMPT: '0', NONINTERACTIVE: '1', HOMEBREW_NO_ENV_HINTS: '1', DEBIAN_FRONTEND: 'noninteractive' } });
+    const child = spawnOnHost(command, cwd, userHome, spawnImpl);
     let output = '', ended = null, last = 0;
     const kill = why => { ended ??= why; try { process.kill(-child.pid, 'SIGTERM'); } catch {} setTimeout(() => { try { process.kill(-child.pid, 'SIGKILL'); } catch {} }, 2000).unref(); };
     const seconds = Math.min(Math.max(Number(timeout) || 600, 1), 1800);

package/packages/piagent-core/managed/ledger.mjs

@@ -120,7 +120,7 @@ export function rejudgeBrief(item) {
 // One step of the completion gate (true: the gate goes round again). A
 // rejected premise objection goes back to its helper, which withdraws it or
 // keeps it for the member; then the items the main agent never decided are
-// put to it once, with no new review.
+// put to it once each, with no new review: a later review's findings are new items.
 export async function settleLedger(managed, run, { note, send, signal }) {
   const rejected = toRejudge(run)[0];
   if (rejected) {
@@ -133,9 +133,9 @@ export async function settleLedger(managed, run, { note, send, signal }) {
     await note(`Harness: the ${rejected.role} subagent keeps its objection; the member decides.\n${itemText(rejected)}`, { phase: 'dispute', role: rejected.role, id: rejected.id });
     return true;
   }
-  const pending = undecided(run);
-  if (!pending.length || run.decideAsked) return false;
-  run.decideAsked = true;
+  const asked = run.decidedAsked ??= new Set(), pending = undecided(run).filter(item => !asked.has(item.id));
+  if (!pending.length) return false;
+  for (const item of pending) asked.add(item.id);
   await send(decideText(pending), { phase: 'answer', ids: pending.map(i => i.id), issues: pending.slice(0, 10).map(i => ({ kind: i.kind, detail: i.detail })) });
   return true;
 }
@@ -151,7 +151,7 @@ export function ledgerWords(run) {
   const items = ledgerOf(run), count = s => items.filter(i => i.status === s).length, words = [];
   if (!items.length && !run.minorFindings) return null;
   for (const [status, label] of [['accepted', 'accepted'], ['rejected', 'rejected'], ['withdrawn', 'withdrawn by the helper'], ['cleared', 'cleared by a later check'], ['disputed', 'for the member'], ['open', 'left without a decision'], ['noted', 'noted']])
-    if (count(status)) words.push(`${count(status)} ${label}`);
+    if (count(status)) words.push(`${count(status)} ${label}${status === 'open' ? ` (${items.filter(i => i.status === 'open').map(i => i.id).join(', ')})` : ''}`);
   if (run.minorFindings) words.push(`${run.minorFindings} minor finding(s) listed`);
   return `objections: ${words.join(', ')}`;
 }

package/packages/piagent-core/managed/member-mcp.mjs

@@ -2,6 +2,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import os from 'node:os';
 import { evaluateMcpApproval } from '../runtime/mcp-repository-gate.mjs';
+import { alwaysBypass } from './permission.mjs';
 import { mcpWriteAction } from '../runtime/policy/handoff-policy.mjs';
 import { userToolchains } from './toolchain.mjs';
 import { fenced } from './untrusted.mjs';
@@ -62,6 +63,7 @@ export function memberMcpGuard(cwd, adapterDir, owner = null) {
     const fromAdapter = name => { const source = pi.getAllTools().find(tool => tool.name === name)?.sourceInfo?.path; return !!source && (source === adapterDir || inside(source, adapterDir)); };
     pi.on('tool_call', async (event, ctx) => {
       const decision = evaluateMcpApproval(cwd, event.toolName, event.input ?? {});
+      if (owner && alwaysBypass(owner)) return undefined;
       if (decision.block) return { block: true, reason: decision.reason };
       const called = mcpToolCalled(event.toolName, event.input, fromAdapter);
       const action = called && await mcpWriteAction(called.tool);

package/packages/piagent-core/managed/memory-lessons.mjs

@@ -55,7 +55,7 @@ export class CheckLessons {
  // shape it becomes a failure lesson for the team memory.
  #toolError(call,event,output) {
   if(!COMMAND_TOOLS.has(call.tool)||call.check||this.lessons.length>=MAX_LESSONS)return;
-  if(/managed[-_](?:tool[-_]cancelled|operation[-_]denied|helper[-_]cancelled)|Command aborted|Command timed out/i.test(output))return;
+  if(/managed[-_](?:tool[-_]cancelled|operation[-_](?:denied|expired|cancelled)|helper[-_]cancelled)|Command aborted|Command timed out/i.test(output))return;
   const line=output.split('\n').find(l=>ERROR_LINE.test(l));
   if(!line)return;
   const command=commandShape(call.command);
@@ -85,7 +85,7 @@ export class CheckLessons {
   const output=textOf(event.result), c=call.check;
   const exitFailed=event.isError || (event.result?.details?.exitCode !== undefined && event.result.details.exitCode!==0);
   if(exitFailed || (c.piped && failedOutput(output))) {
-   if(/managed[-_](?:tool[-_]cancelled|operation[-_]denied|helper[-_]cancelled)|Command aborted|Command timed out/i.test(output))return;
+   if(/managed[-_](?:tool[-_]cancelled|operation[-_](?:denied|expired|cancelled)|helper[-_]cancelled)|Command aborted|Command timed out/i.test(output))return;
    this.failed++;this.last='failed';
    const diagnostic=output.split('\n').find(l=>/error|fail|exception|not found|EADDRINUSE/i.test(l)) ?? 'Check exited unsuccessfully';
    if(this.failures.size>=20)this.failures.delete(this.failures.keys().next().value);

package/packages/piagent-core/managed/permission.mjs

@@ -7,9 +7,15 @@
 // tools, uploads), where the team's Harness allows it
 // (harness.configuration.bypass_mode, an administrator's switch in Studio).
 // The sandbox itself stays: bypass removes questions, not the boundary.
-import { handoffReason, mustConfirm } from '../runtime/policy/handoff-policy.mjs';
+// "always-bypass" (owner, 2026-11-02) removes both, as the member's own decision
+// after a warning; no Harness switch governs it. Only committing and pushing
+// code and an rm on a critical path are asked (critical-removal.mjs); the
+// project's autoDeny rules hold; what needs the member's password stays theirs.
+import os from 'node:os';
+import { criticalRemovalReason } from '../runtime/policy/critical-removal.mjs';
+import { codeHandoffReason, handoffReason, mustConfirm } from '../runtime/policy/handoff-policy.mjs';
 
-export const PERMISSIONS = ['workspace-write', 'trusted-full-access', 'bypass'];
+export const PERMISSIONS = ['workspace-write', 'trusted-full-access', 'bypass', 'always-bypass'];
 const ENTRY = 'agent-watch-permission';
 
 // Only an explicit yes from Studio: an Agent Watch that does not carry the
@@ -41,11 +47,13 @@ export function recordBypass(owner, manager) {
 // Whether this conversation skips the questions Full access still asks
 // (everything but the handoff).
 export const asksOnlyHandoff = owner => effectivePermission(owner) === 'bypass';
-export const broadAccess = owner => ['trusted-full-access', 'bypass'].includes(effectivePermission(owner));
+export const alwaysBypass = owner => effectivePermission(owner) === 'always-bypass';
+export const broadAccess = owner => ['trusted-full-access', 'bypass', 'always-bypass'].includes(effectivePermission(owner));
 // Why a command that leaves the sandbox must be asked about: the reason, or
 // 'ask' in Ask first, or null to run it. Every mode asks about the handoff.
 export const networkConfirmation = async (owner, command) => {
   const mode = effectivePermission(owner);
+  if (mode === 'always-bypass') return criticalRemovalReason(command, { cwd: owner.cwd ?? process.cwd(), home: owner.boundary?.userHome ?? os.homedir() }) ?? codeHandoffReason(command);
   if (mode === 'bypass') return handoffReason(command);
   if (mode === 'trusted-full-access') return mustConfirm(command);
   return 'ask';

package/packages/piagent-core/managed/repository-operation.mjs

@@ -1,4 +1,5 @@
 import { broadAccess } from './permission.mjs';
+import { approvalRefusal } from './approval-refusal.mjs';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -121,7 +122,7 @@ export function fetchOriginTool(self) {
           reason:`Fetch origin branches from ${plan.repository}`,riskClass:'low',allowConsequence:'Download origin branches once; keep the current branch and working files unchanged.',denyConsequence:'No network request or credential read.'},
         terminalConfirm:()=>ctx?.ui?.confirm?.('Tải nhánh từ origin',`Tải các nhánh của ${plan.repository} về ${plan.cwd} một lần.\n\nĐồng ý: chỉ tải nhánh; nhánh hiện tại và file đang làm không đổi.\nTừ chối: không gửi request mạng, không đọc thông tin đăng nhập.`)??Promise.resolve(false),
         unavailableFallback:'terminal-confirm',recheck:()=>!signal?.aborted&&Boolean(self.grant)});
-      if(!decision.allowed||!decision.consume()||signal?.aborted)throw Error('managed-operation-denied');
+      if(!decision.allowed||!decision.consume()||signal?.aborted)throw approvalRefusal(decision);
       return executeRepositoryFetch(self.boundary,plan,signal);
     }};
 }

package/packages/piagent-core/managed/session.mjs

@@ -28,8 +28,8 @@ import { beforeDelegate, resolveTool } from './objections.mjs'; import { fanOut,
 import { HELPER_CALLS, HELPER_ROLES, helperRoles, helperPrompt, webPrompt, delegateDescription, mainWebLookups, limitedWebTools } from './helper-roles.mjs'; import { delegateParameters, delegateArgs, SPEC_PROMPT } from './helper-settlement.mjs';
 import { loadAgentResources } from './agent-skills.mjs';
 import { loadPiagentThemes } from '../runtime/terminal/terminal-style.mjs';
-import { restorePermission, recordBypass, permissionSetter } from './permission.mjs';
-import { commandTools, servicesPrompt } from './command-tools.mjs'; import { waiveChecksTool } from './check-waiver.mjs'; import { attachMemory, memoryToolsFor, openRound, closeRound, prepareMemoryContext, trackMemoryLessons } from './memory.mjs';
+import { alwaysBypass, restorePermission, recordBypass, permissionSetter } from './permission.mjs';
+import { commandTools, hostBash, servicesPrompt, unsandboxedBash } from './command-tools.mjs'; import { waiveChecksTool } from './check-waiver.mjs'; import { attachMemory, memoryToolsFor, openRound, closeRound, prepareMemoryContext, trackMemoryLessons } from './memory.mjs';
 
 const PROVIDER = 'agent_watch_managed';
 export const HELPER_BEAT_MS = 60_000;
@@ -113,7 +113,7 @@ export class ManagedSession {
     const preview = { model_id: candidate.id, provider: candidate.owned_by, provider_model_id: candidate.provider_model_id };
     const model = self.installModel(self.modelRuntime, preview);
     self.wrapStreams(self.modelRuntime, 'main');
-    const customTools = processEditTools(self, self.boundary.tools(api));
+    const customTools = processEditTools(self, unsandboxedBash(self, self.boundary.tools(api)));
     customTools.push(fetchOriginTool(self));
     // With a research helper the web is its work (pages read on its cheaper model), beyond the Harness's few quick lookups.
     if (!helperRoles(manifest).includes('research')) customTools.push(...self.webTools(self.modelRuntime, 'main'));
@@ -170,7 +170,7 @@ export class ManagedSession {
     self.session.managedExecution = true;
     self.turnRetry = enableCompanyTurnRetry(self.session, settings, self.studioLink);
     // The member's access for this conversation: Ask first, Full access or Bypass (permission.mjs).
-    self.permission = restorePermission(manager); recordBypass(self, manager); self.session.managedSetPermission = permissionSetter(self, manager);
+    self.permission = restorePermission(manager); recordBypass(self, manager); self.session.managedSetPermission = permissionSetter(self, manager); self.boundary.unsandboxed = () => alwaysBypass(self);
     // Fast mode, where the Harness allows it (fast-mode.mjs): off until the member turns it on.
     self.fast = restoreFast(manager); recordFast(self, manager); self.session.managedSetFast = fastSetter(self, manager); self.session.managedFastState = () => fastState(self); // null where the Harness does not allow it
     self.session.managedFastServed = () => { const route = self.routes.get(self.modelRuntime); return route ? fastServed(route) : null; };
@@ -323,7 +323,7 @@ export class ManagedSession {
     // Native ! commands use the same worker boundary as model bash calls.
     self.session.executeBash = async command => {
       try {
-        const result = await self.boundary.invoke('bash', { command });
+        const result = alwaysBypass(self) ? await hostBash(self, { command }) : await self.boundary.invoke('bash', { command });
         return { output: textContent(result), exitCode: 0, cancelled: false, truncated: false };
       } finally { await self.refreshReview(); }
     };

package/packages/piagent-core/managed/tool-boundary.mjs

@@ -21,7 +21,7 @@ import { proxyEnvironment } from './package-proxy.mjs';
 import { startBoundaryPackageProxy } from './boundary-package-proxy.mjs';
 import { SourceRevertRequests } from './source-revert-requests.mjs';
 import { BWRAP, bubblewrapArgs, credentialFiles, referenceFolders } from './linux-sandbox.mjs';
-import { agentWatchDataDirectory } from './store.mjs';
+import { agentWatchDataDirectory } from './store.mjs'; import { spawnOnHost } from './host-command.mjs';
 const TOOL_NAMES = Object.freeze(['read', 'bash', 'edit', 'write', 'grep', 'find', 'ls']);
 const MAX_WIRE_BYTES = 12 * 1024 * 1024;
 const workerPath = fileURLToPath(new URL('./tool-worker.mjs', import.meta.url));
@@ -112,7 +112,7 @@ ${proxyPort && !network ? `(allow mach-lookup (global-name "com.apple.trustd.age
 (allow network-outbound (literal ${literal(docker)}))` : ''}` : loopback ? '(allow network-outbound (remote ip "localhost:*"))' : proxyPort ? `(allow network-outbound (remote ip "localhost:${Number(proxyPort)}"))` : ''}
 ${denied.map(root => `(deny file-read* file-write* (require-all (subpath ${literal(root)})${skills.filter(dir => inside(dir, root) && dir !== root).map(dir => ` (require-not (subpath ${literal(dir)}))`).join('')}))`).join('\n')}
 (deny file-read* file-read-metadata file-write* (require-all (require-any (regex #"(^|/)(\\.env([./]|$)|credentials([./]|$)|\\.npmrc$|\\.netrc$)") (regex #"/\\.[^/]+/auth\\.json$") ${projectRoots.map(root => `(literal ${literal(path.join(root, 'auth.json'))})`).join(' ')})
-  (require-not (regex #"(^|/)\\.env\\.(example|sample|template|dist|defaults)$"))))
+  (require-not (regex #"(^|/)\\.env\\.(example|sample|template|dist|defaults)$"))))  (allow file-read* file-read-metadata file-write* (require-all (subpath ${literal(temporary)}) (regex #"/\\.env([.][^/]*)?$")))
 `;
 }
 // Toolchains from the pinned node/git and Homebrew, compilers and SDK; the
@@ -369,9 +369,9 @@ export class ManagedToolBoundary {
     if (Buffer.byteLength(message) > MAX_WIRE_BYTES) throw new Error('managed-tool-input-too-large');
     return await new Promise((resolve, reject) => {
       guard?.();
-      const [sandbox, sandboxArgs] = this.linux ? [BWRAP, this.bubblewrap(network, docker)]
+      const [sandbox, sandboxArgs] = this.unsandboxed?.() ? [null, []] : this.linux ? [BWRAP, this.bubblewrap(network, docker)]
         : ['/usr/bin/sandbox-exec', ['-p', docker ? this.dockerProfile : network ? this.networkProfile : isolated ? this.isolatedProfile : this.profile]];
-      const child = spawn(sandbox, [...sandboxArgs, this.node, this.workerPath, this.sdkPath, this.cwd], {
+      const child = spawn(sandbox ?? this.node, [...sandboxArgs, ...(sandbox ? [this.node] : []), this.workerPath, this.sdkPath, this.cwd], {
         cwd: this.cwd, detached: true, stdio: ['pipe', 'pipe', 'pipe'],
         env: docker ? this.environment.docker : network ? this.environment.network : this.environment.offline,
       });
@@ -455,7 +455,7 @@ export class ManagedToolBoundary {
   // A process the agent keeps running across turns (background-process.mjs):
   // the plain command sandbox and environment, marked as this conversation's
   // background process instead of the turn's, so stopStrays leaves it.
-  async spawnBackground(command, key) { return this.spawnSandboxed(['/bin/bash', '-c', command], key); }
+  async spawnBackground(command, key) { return this.unsandboxed?.() ? { child: spawnOnHost(command, this.cwd, this.userHome), isolated: false } : this.spawnSandboxed(['/bin/bash', '-c', command], key); }
   // `argv` in the plain command sandbox; stdin 'pipe' for a process that
   // answers requests (ts-diagnostics.mjs).
   async spawnSandboxed(argv, key, { stdin = 'ignore' } = {}) {

package/packages/piagent-core/managed/tool-failures.mjs

@@ -15,7 +15,7 @@ const INPUT_CHARS = 500, ERROR_HEAD = 1000, ERROR_TAIL = 2000;
 // One request carries at most BATCH failures; KEEP wait for the next one.
 const BATCH = 20, KEEP = 100, ATTEMPTS = 3;
 // The member stopped the tool or declined to approve it: not a failure.
-const NOT_FAILURES = new Set(['managed_tool_cancelled', 'managed_helper_cancelled', 'managed_operation_denied']);
+const NOT_FAILURES = new Set(['managed_tool_cancelled', 'managed_helper_cancelled', 'managed_operation_denied', 'managed_operation_expired', 'managed_operation_cancelled']);
 
 const text = result => typeof result === 'string' ? result
   : Array.isArray(result?.content) ? result.content.filter(part => part?.type === 'text').map(part => part.text ?? '').join('\n') : '';

package/packages/piagent-core/managed/workflow.mjs

@@ -4,7 +4,8 @@ import { TsDiagnostics } from './ts-diagnostics.mjs';
 import { checkpointsOf } from './checkpoints.mjs';
 import { declaredChecks, detectedChecks, repositoryChecks, isCheckCommand, isReadOnlyCommand, nonCodePath, onlyNonCode } from './repository-checks.mjs';
 export { declaredChecks, detectedChecks, repositoryChecks, isCheckCommand, isReadOnlyCommand, nonCodePath, onlyNonCode };
-import { askCheckScope, asksFullChecks, beforeCheckOrPush, checkScope } from './check-questions.mjs';
+import { askCheckScope, asksFullChecks, beforeCheckOrPush, checkScope, suitePart } from './check-questions.mjs';
+import { recordCheck, relevantChecks } from './check-evidence.mjs';
 import { LANE_LIMITS, patchStats, changeLane, lanePolicy } from './risk-lanes.mjs';
 import { briefCounts, decisionsText, ledgerGuard, ledgerOf, ledgerWords, reviewFocus, saveLedger, setStatus, settleLedger } from './ledger.mjs';
 
@@ -81,7 +82,7 @@ export function workflowPrompt(policy, checks) {
     const L = LANE_LIMITS;
     lines.push(`- Size: the process follows the size of your change. A small change (at most ${L.tinyFiles} files and ${L.tinyLines} changed lines, no migration, auth, security, CI, dependency or AGENTS.md file) ends after its checks, without a review: do not ask for one. A risky change (a complex request, one of those files, more than ${L.riskyFiles} files or ${L.riskyLines} lines) must pass the checks${policy.review !== 'off' ? ' and the harness review' : ''} even where they are only suggested.`);
   }
-  return lines.length ? `\n\nProcess for code changes (company Harness):\n${lines.join('\n')}\n${process.platform === 'darwin' ? 'End-to-end and UI checks run in bash with the project\'s Playwright (@playwright/test; add it with npm when the project lacks it) and the browsers installed on this Mac, against a server the test or start_process starts; while a local proxy listens they need run_with_network. When Playwright\'s browsers are missing, ask with run_on_host to run `npx playwright install chromium`.' : 'End-to-end tests that start a local server and a browser run through run_with_network, which the user approves.'} If a check cannot run because the machine lacks something (a runtime such as a JDK, Docker, a database or another service, the network), do not stop there: request the approval that makes it run (run_with_network, run_with_docker, start_docker, or run_on_host to install what is missing) or ask the member with ask_user; never install or start anything without that approval.\nA command stops after 10 minutes and anything left running in the background stops when the turn ends: run the checks that cover your change first and a long suite in parts, not in the background.${process.platform === 'darwin' ? ' A dev server, watcher or local service you need across turns runs with start_process (read it with process_output, stop it with stop_process).' : ''}` : '';
+  return lines.length ? `\n\nProcess for code changes (company Harness):\n${lines.join('\n')}\n${process.platform === 'darwin' ? 'A bash command stops after 10 minutes unless you pass timeout in seconds, at most 1800: a long suite needs that, not another tool. End-to-end and UI checks run in bash with the project\'s Playwright (@playwright/test; add it with npm when the project lacks it) and the browsers installed on this Mac, against a server the test or start_process starts; while a local proxy listens they need run_with_network. When Playwright\'s browsers are missing, ask with run_on_host to run `npx playwright install chromium`.' : 'End-to-end tests that start a local server and a browser run through run_with_network, which the user approves.'} If a check cannot run because the machine lacks something (a runtime such as a JDK, Docker, a database or another service, the network), do not stop there: request the approval that makes it run (run_with_network, run_with_docker, start_docker, or run_on_host to install what is missing) or ask the member with ask_user; never install or start anything without that approval.\nA command stops after 10 minutes and anything left running in the background stops when the turn ends: run the checks that cover your change first and a long suite in parts, not in the background.${process.platform === 'darwin' ? ' A dev server, watcher or local service you need across turns runs with start_process (read it with process_output, stop it with stop_process).' : ''}` : '';
 }
 
 // Every helper checks the brief it was given: it may object with evidence, it
@@ -173,7 +174,7 @@ export class RunProcess {
       // asked for, and where the harness last sent the agent back (to read
       // its answer and see whether the code moved).
       ledger: [], disputes: [], verifyFails: [], claimsAsked: false, claimsAt: null, claimsRechecked: false, claimsDone: false, mainReviews: 0, minorFindings: 0,
-      sentAt: null, sentDigest: null, rejudged: false, reviewSettled: false, decideAsked: false,
+      sentAt: null, sentDigest: null, rejudged: false, reviewSettled: false,
       // How much of the suite the member wants run (check-questions.mjs).
       scopeChoice: null, scopeWords: null, fullAsked: asksFullChecks(request), pushAllowedOn: undefined,
       // The patch's risk lane (workflow.lanes) and the main agent's own web lookups.
@@ -197,15 +198,17 @@ export class RunProcess {
   changedWithoutPlan() {
     this.unplannedChange = true; this.planSkipped = true;
   }
-  async afterTool(name, args, ok, digestOf) {
+  // `owner`: the conversation the command ran in, for what passed in which repository.
+  async afterTool(name, args, ok, digestOf, owner = null) {
     if (['write', 'edit'].includes(name) && ok) this.edited = true;
     if (name === 'bash' && isCheckCommand(args?.command, this.checks.commands)) {
       const scope = checkScope(args.command, this.checks.commands), digest = await digestOf(), last = this.lastCheck;
       this.checksRun += 1; if (!ok) this.checksFailed += 1;
       // A lint after a partial test run does not make it the whole suite.
       this.lastCheck = { ok, digest, mutations: this.mutations, scope: scope ?? (last?.scope === 'partial' && last.digest === digest ? 'partial' : 'other') };
-      // The member's "run it all" covers one run; after a fix they are asked again.
-      if (scope === 'suite' && this.scopeChoice === 'full') this.scopeChoice = null;
+      await recordCheck(this, owner, args.command, scope, ok, suitePart(args.command));
+      // The member's "run it all" covers one run in each repository a push needs; after a failure they are asked again.
+      if (scope === 'suite' && this.scopeChoice === 'full' && (!ok || !this.fullFor?.size)) { this.scopeChoice = null; this.fullFor = null; }
     // A command may change files, so it counts. Without a git repository to
     // compare the code against, one that only reads does not: counting every
     // command reported code changes in turns that only read and checked.
@@ -298,7 +301,7 @@ export async function completionGate(managed, run, signal) {
       }
       if (policy.verify === 'require' && (!run.verified || run.scopeWords) && !run.docsOnly && !verifyGaveUp && run.waivedDigest !== digest) {
         run.fixLoops += 1;
-        const list = run.checks.commands.length ? run.checks.commands.map(c => '`' + c + '`').join(', ') : 'the tests, type check or build that cover the change';
+        const list = run.checks.commands.length ? relevantChecks(managed, run.checks.commands).map(c => '`' + c + '`').join(', ') : 'the tests, type check or build that cover the change';
         const words = run.scopeWords; run.scopeWords = null;
         const ask = words ? `The member answered about testing: "${String(words).slice(0, 500)}". Follow that and fix what fails.`
           : run.scopeChoice === 'partial' ? 'Run only the tests that cover your change (one file, a filter, one package), not the whole suite, and fix what fails.'
@@ -446,7 +449,7 @@ export function processEditTools(session, tools) {
         }
         return result;
       }
-      finally { await session.run?.afterTool(tool.name, args[1], ok, () => session.digest()); await session.refreshReview(); }
+      finally { await session.run?.afterTool(tool.name, args[1], ok, () => session.digest(), session); await session.refreshReview(); }
     } };
   });
 }

package/packages/piagent-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@piagent/core",
-  "version": "1.49.1",
+  "version": "1.51.0",
   "type": "module",
   "private": true,
   "license": "MIT",

package/packages/piagent-core/policies/base-policy.json

@@ -94,7 +94,8 @@
       "read-only",
       "workspace-write",
       "trusted-full-access",
-      "bypass"
+      "bypass",
+      "always-bypass"
     ]
   },
   "execPolicy": {

package/packages/piagent-core/runtime/hooks/session-start-hook.ts

@@ -319,6 +319,9 @@ export function registerSessionStartHook(pi: ExtensionAPI, dependencies: Session
     if (permissionProfile.mode === "trusted-full-access") {
       ctx.ui.notify("Piagent permission profile trusted-full-access is active; protected paths, secret redaction, and destructive/external confirmations remain enforced.", "warning");
     }
+    if (permissionProfile.mode === "always-bypass") {
+      ctx.ui.notify("Warning: Piagent always bypass is active, by your decision. Only committing and pushing code and removing a critical path (rm -rf ~) are asked; deploys, MCP, network and credentials run. The project's autoDeny rules, output redaction and /undo checkpoints remain.", "warning");
+    }
     if (permissionProfile.mode === "bypass") {
       ctx.ui.notify("Piagent bypass is active: the work runs without confirmation, protected-path or policy gates in this personal session. The handoff (push, PR, publish, deploy, remote tools, MCP writes) is still asked; output redaction and /undo checkpoints remain.", "warning");
     }

package/packages/piagent-core/runtime/inspection/approval-broker.ts

@@ -8,7 +8,7 @@ const PUBLIC_REF = /^[A-Za-z0-9][A-Za-z0-9._:@~-]{0,159}$/;
 const REVISION = /^[A-Za-z0-9][A-Za-z0-9._:~-]{0,159}$/;
 const DIGEST = /^sha256:[a-f0-9]{64}$/;
 const TIMESTAMP = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
-const MAX_PENDING = 32, MAX_RECENT = 64, DEFAULT_TTL_MS = 5 * 60_000;
+const MAX_PENDING = 32, MAX_RECENT = 64, DEFAULT_TTL_MS = 5 * 60_000, MAX_TTL_MS = 30 * 60_000;
 
 type Identity = { projectRef: string; runtimeInstanceId: string; sessionRef: string; taskId: string; taskRunId: string;
   agentOperationId: string; toolCallId: string };
@@ -161,7 +161,7 @@ export class PiApprovalBroker {
     if (!binding || !authority || authority.taskState !== "active" || input.expectedTask && (authority.identity.taskId !== input.expectedTask.taskId || authority.identity.taskRunId !== input.expectedTask.taskRunId)
       || !REF.test(authority.identity.agentOperationId)
       || !toolCallId || binding.pending.size >= MAX_PENDING) return this.#unavailable(input);
-    const now = Date.now(), requestedAt = new Date(now).toISOString(), expiresAt = new Date(now + Math.min(Math.max(input.ttlMs ?? DEFAULT_TTL_MS, 5_000), DEFAULT_TTL_MS)).toISOString();
+    const now = Date.now(), requestedAt = new Date(now).toISOString(), expiresAt = new Date(now + Math.min(Math.max(input.ttlMs ?? DEFAULT_TTL_MS, 5_000), MAX_TTL_MS)).toISOString();
     const approvalRef = ref("approval", binding.secret, [toolCallId, now, randomUUID()]);
     const decisionToken = randomBytes(32).toString("base64url");
     const nextRevision = this.#nextRevision(binding, "requested", approvalRef);

package/packages/piagent-core/runtime/policy/critical-removal.mjs

@@ -0,0 +1,122 @@
+// What Always bypass asks about besides commit and push: an rm or rmdir whose
+// target is a critical path, by the rules of Claude's bypassPermissions
+// (permission-modes, "Critical paths" and "The mounted drive prompt"). A text
+// check, not a boundary: other commands and scripts can delete these paths too.
+import fs from 'node:fs';
+import path from 'node:path';
+import { evaluateExecPolicyCore } from '../../extensions/policy-core.js';
+import { astCommands } from '../../extensions/shell-ast.js';
+import { executable } from './handoff-policy.mjs';
+
+const TOP_LEVEL = new Set(['bin', 'boot', 'dev', 'etc', 'home', 'lib', 'lib64', 'media', 'mnt', 'opt', 'proc', 'root', 'run', 'sbin', 'srv', 'sys', 'tmp', 'usr', 'var', 'Applications', 'Library', 'System', 'Users', 'Volumes', 'private']);
+const DIRECTORY_PRINTER = /(?:^|[\s;&|(])([A-Za-z_]\w*)=["']?(?:\$\(|`)\s*(?:pwd|git\s+rev-parse\s+--show-toplevel|dirname\b|realpath\b)/g;
+const MOUNTED = [/^\/Volumes\/[^/]+(\/[^/]+)?$/, /^\/System\/Volumes(\/[^/]+){0,2}$/, /^\/media\/[^/]+(\/[^/]+){0,2}$/, /^\/run\/media(\/[^/]+){0,3}$/, /^\/mnt\/[^/]+$/, /^\/mnt\/[A-Za-z]\/[^/]+$/];
+const DYNAMIC = /\$(?:\(…\)|[A-Za-z_@*#?!\d]\w*)/;
+const onlyDynamic = /^\$(?:\(…\)|[A-Za-z_@*#?!\d]\w*)$/;
+
+// On Windows the checks below see one spelling of a path: `D:\\a\\B`, `d:/a/b` and
+// Git Bash's `/d/a/b` are all `/d:/a/b`.
+function comparable(value) {
+  if (process.platform !== 'win32') return value;
+  return value.replace(/\\/g, '/').toLowerCase().replace(/^\/?([a-z]):?(?=\/|$)/, (_, drive) => `/${drive}:`);
+}
+
+// `{/,}` is `/` by the time it runs.
+function expanded(word) {
+  const brace = /^(.*?)\{([^{}]*,[^{}]*)\}(.*)$/.exec(word);
+  return brace ? brace[2].split(',').flatMap(part => expanded(brace[1] + part + brace[3])) : [word];
+}
+function parseTargets(args) {
+  const targets = []; let recursive = false, options = true;
+  for (const arg of args) {
+    if (options && arg === '--') options = false;
+    else if (options && arg.startsWith('-') && arg !== '-') recursive ||= arg === '--recursive' || (!arg.startsWith('--') && /[rR]/.test(arg));
+    else targets.push(arg);
+  }
+  return { targets, recursive };
+}
+
+function isCritical(target, cwd, home) {
+  if (target === '/' || path.posix.dirname(target) === '/') return true;
+  return target === home || target === cwd || cwd.startsWith(`${target}/`);
+}
+
+// Why this one target needs the member, or null.
+function targetReason(raw, { cwd, project, home, recursive, guarded, printers, singleQuotedScript, afterCd }) {
+  const DANGER = text => `Dangerous rm operation on critical path: ${text}`;
+  if (/^\\+$/.test(raw)) return DANGER(raw);
+  let word = raw.replace(/^~(?=\/|$)/, home).replace(/\$\{?HOME\}?(?=\/|$)/, home).replace(/\$\{?PWD\}?(?=\/|$)/, cwd);
+  if (/^~/.test(word)) return DANGER(raw);
+  for (const name of printers) if (new RegExp(`\\$${name}(?:\\b|/|$)`).test(word)) return `Dangerous rm operation: ${raw} comes from a directory-printing substitution`;
+  const dynamic = DYNAMIC.exec(word);
+  if (dynamic) {
+    const name = dynamic[0].slice(1), positional = /^[@*\d#]/.test(name);
+    if (onlyDynamic.test(word) && word.includes('(…)') && recursive) return `Dangerous rm operation: ${raw} is only the output of a command`;
+    const under = /^\$[^/]*\/(\*(\/\*)*\/?)?$/.test(word), glob = under && !(guarded.has(name) || (positional && singleQuotedScript));
+    if (glob) return `Dangerous rm operation: ${raw} removes from the filesystem root when the variable is empty`;
+    if (/^\$[^/]+\/[^/]+$/.test(word) && TOP_LEVEL.has(word.split('/')[1]) && !guarded.has(name)) return DANGER(`${raw} (/${word.split('/')[1]} when the variable is empty)`);
+    const before = word.slice(0, dynamic.index);
+    // A trailing substitution: the path that remains when it expands empty.
+    if (word.slice(dynamic.index) === dynamic[0] && before.startsWith('/') && isCritical(path.posix.resolve(comparable(before)), cwd, home)) return DANGER(raw);
+    return null;
+  }
+  const glob = /\/?\*\/?$/.test(word) || word === '*';
+  if (glob && (/\*\/(\*\/?)?$/.test(word) || (afterCd && !word.startsWith('/')))) return `Dangerous rm operation: ${raw} cannot be checked before the command runs`;
+  const literal = word.replace(/\/?\*$/, '') || (word.startsWith('/') ? '/' : '.');
+  const resolved = path.posix.resolve(cwd, comparable(literal));
+  if (isCritical(resolved, cwd, home) || isCritical(resolved, project, home)) return DANGER(raw);
+  if ((recursive || glob) && MOUNTED.some(rule => rule.test(resolved))) return `Dangerous rm operation on mounted drive path: ${raw}`;
+  return null;
+}
+
+// Why this command must be asked about in Always bypass, or null.
+export function criticalRemovalReason(command, options) {
+  const cwd = comparable(options.cwd), home = comparable(options.home);
+  const text = String(command), commands = astCommands(text);
+  if (commands === null) return /\b(rm|rmdir)\b/.test(text) ? 'Dangerous rm operation not ruled out: the shell may read this command differently than it was parsed' : null;
+  const guarded = new Set([...text.matchAll(/\$\{([A-Za-z_]\w*):\?/g)].map(match => match[1]));
+  const printers = new Set([...text.matchAll(DIRECTORY_PRINTER)].map(match => match[1]));
+  const singleQuotedScript = /\s-[a-z]*c\s+'/.test(text);
+  let base = cwd, afterCd = false;
+  for (const { words } of commands) {
+    const [name, ...args] = executable(words), program = String(name ?? '').split('/').pop();
+    if (program === 'cd') {
+      afterCd = true;
+      if (args[0] && !DYNAMIC.test(args[0])) base = path.posix.resolve(base, comparable(args[0].replace(/^~(?=\/|$)/, home)));
+      continue;
+    }
+    if (program !== 'rm' && program !== 'rmdir') continue;
+    const { targets, recursive } = parseTargets(args);
+    for (const target of targets.flatMap(expanded)) {
+      const reason = targetReason(target, { cwd: base, project: cwd, home, recursive, guarded, printers, singleQuotedScript, afterCd });
+      if (reason) return reason;
+    }
+  }
+  return null;
+}
+
+// A project's own refusals (profile `autoDeny`) in a company session, as a deny
+// rule holds in every mode: the reason, or null.
+export function projectDenyReason(command, cwd) {
+  let profile;
+  try { profile = JSON.parse(fs.readFileSync(path.join(cwd, '.pi', 'piagent-profile.json'), 'utf8')); } catch { return null; }
+  const rules = (Array.isArray(profile?.autoDeny) ? profile.autoDeny : []).filter(rule => typeof rule?.pattern === 'string' && rule.pattern.trim())
+    .map((rule, index) => ({ id: `auto-deny-${index + 1}`, action: 'forbid', match: rule.match ?? 'contains', value: rule.pattern, reason: String(rule.reason ?? "Refused by this project's autoDeny rule") }));
+  if (!rules.length) return null;
+  const refused = evaluateExecPolicyCore(String(command), { policy: { execPolicy: { defaultMode: 'enforce', bannedPrefixSuggestions: [], rules } }, mode: 'enforce' });
+  return refused.decision === 'forbid' ? refused.reasons[0] ?? 'Refused by this project' : null;
+}
+
+// Claude's time limit: two minutes, then a denial that lets the work go on; after
+// three unanswered prompts, denied at once until the member sends a message.
+export const REMOVAL_TTL_MS = 120_000;
+export const REMOVAL_EXPIRED = 'the member did not answer within two minutes, so this removal did not run. Carry on with the rest of the work: name the exact paths to remove instead, or leave the removal to the member and say so.';
+const unanswered = new Map();
+const memberMessages = manager => (manager?.getEntries?.() ?? []).filter(entry => entry.type === 'message' && entry.message?.role === 'user').length;
+const current = (id, manager) => {
+  const turn = memberMessages(manager), held = unanswered.get(id);
+  if (held?.turn === turn) return held;
+  const fresh = { turn, count: 0 }; unanswered.set(id, fresh); return fresh;
+};
+export const removalsHeld = (id, manager) => current(id, manager).count >= 3;
+export const noteRemovalExpired = (id, manager) => { current(id, manager).count += 1; };