@piagent/platform 1.50.0 → 1.51.0

package/docs-site/team.html

@@ -37,7 +37,7 @@
         <span class="brand-mark"><img src="/assets/piagent-logo.svg" alt="" width="28" height="28" /></span>
         <span class="brand-name"><b>Piagent</b> <span>Platform</span></span>
       </a>
-      <a class="version-badge" href="/whats-new" data-docs-version="v1.50.0" title="v1.50.0 docs · VI"><span class="dot"></span>v1.50.0</a>
+      <a class="version-badge" href="/whats-new" data-docs-version="v1.51.0" title="v1.51.0 docs · VI"><span class="dot"></span>v1.51.0</a>
       <nav class="top-nav" aria-label="Tài liệu">
         <a href="/quickstart">Tài liệu</a>
         <a href="/whats-new">Changelog</a>

package/docs-site/update.html

@@ -37,7 +37,7 @@
         <span class="brand-mark"><img src="/assets/piagent-logo.svg" alt="" width="28" height="28" /></span>
         <span class="brand-name"><b>Piagent</b> <span>Platform</span></span>
       </a>
-      <a class="version-badge" href="/whats-new" data-docs-version="v1.50.0" title="v1.50.0 docs · VI"><span class="dot"></span>v1.50.0</a>
+      <a class="version-badge" href="/whats-new" data-docs-version="v1.51.0" title="v1.51.0 docs · VI"><span class="dot"></span>v1.51.0</a>
       <nav class="top-nav" aria-label="Tài liệu">
         <a href="/quickstart">Tài liệu</a>
         <a href="/whats-new">Changelog</a>
@@ -153,9 +153,9 @@
   <h2 id="pin-cho-team">Pin một bản cho cả team</h2>
   <p>Khi rollout cho team, cài đúng bản Pi host và đúng bản platform, rồi chạy installer ở chế độ stable. Bước <code>--dry-run</code> in ra những gì sẽ đổi.</p>
   <div class="command-card">
-    <header><span>Cài pin theo bản</span><button class="clip-btn" data-clip="npm install -g --ignore-scripts @earendil-works/pi-coding-agent@1.3.0&#10;npm install -g --ignore-scripts @piagent/platform@1.50.0&#10;piagent-install --stable --dry-run&#10;piagent-install --stable">Lấy lệnh</button></header>
+    <header><span>Cài pin theo bản</span><button class="clip-btn" data-clip="npm install -g --ignore-scripts @earendil-works/pi-coding-agent@1.3.0&#10;npm install -g --ignore-scripts @piagent/platform@1.51.0&#10;piagent-install --stable --dry-run&#10;piagent-install --stable">Lấy lệnh</button></header>
     <pre><code>npm install -g --ignore-scripts @earendil-works/pi-coding-agent@1.3.0
-npm install -g --ignore-scripts @piagent/platform@1.50.0
+npm install -g --ignore-scripts @piagent/platform@1.51.0
 piagent-install --stable --dry-run
 piagent-install --stable</code></pre>
   </div>

package/docs-site/whats-new.html

@@ -37,7 +37,7 @@
         <span class="brand-mark"><img src="/assets/piagent-logo.svg" alt="" width="28" height="28" /></span>
         <span class="brand-name"><b>Piagent</b> <span>Platform</span></span>
       </a>
-      <a class="version-badge" href="/whats-new" data-docs-version="v1.50.0" title="v1.50.0 docs · VI"><span class="dot"></span>v1.50.0</a>
+      <a class="version-badge" href="/whats-new" data-docs-version="v1.51.0" title="v1.51.0 docs · VI"><span class="dot"></span>v1.51.0</a>
       <nav class="top-nav" aria-label="Tài liệu">
         <a href="/quickstart">Tài liệu</a>
         <a href="/whats-new" aria-current="page">Changelog</a>
@@ -108,7 +108,23 @@
 <div class="release-filter" role="toolbar" aria-label="Lọc theo loại thay đổi"><button type="button" data-filter-kind="all" aria-pressed="true">Tất cả</button><button type="button" data-filter-kind="new" aria-pressed="false">Mới</button><button type="button" data-filter-kind="improved" aria-pressed="false">Cải thiện</button><button type="button" data-filter-kind="fixed" aria-pressed="false">Sửa lỗi</button><button type="button" data-filter-kind="security" aria-pressed="false">Bảo mật</button></div>
 <section class="section releases" data-releases>
 <h2 id="latest" class="sr-only">Mới nhất</h2>
-<article class="release latest" id="v1-50-0" data-release>
+<article class="release latest" id="v1-51-0" data-release>
+  <div class="release-meta"><a class="release-version" href="#v1-51-0">v1.51.0</a><time class="release-date" datetime="2026-11-02">02/11/2026</time></div>
+  <div class="release-body">
+    <h3 data-toc-skip id="v1-51-0-title">Theo dõi mọi session từ bên ngoài, thêm quyền Always bypass</h3>
+    <p>Khi mở nhiều session, bạn biết session nào đang chạy, tạm dừng hay bị lỗi mà không cần mở từng cái, từ terminal bất kỳ và ngay trên sidebar Herdr. Always bypass, quyền mới do bạn tự chọn, bỏ sandbox và chỉ hỏi khi commit, push và xoá đường dẫn quan trọng.</p>
+    <ul class="release-items">
+      <li data-kind="new"><span class="kind kind-new">Mới</span><span>Always bypass: agent và helper không còn sandbox; internet, MCP, file và deploy chạy không hỏi. Chỉ hỏi commit, push, gh pr merge và rm đường dẫn quan trọng. Chỉ cảnh báo một lần.</span></li>
+      <li data-kind="new"><span class="kind kind-new">Mới</span><span>piagent sessions liệt kê mọi session đang mở: processing, paused, failed, done hoặc idle, gồm cả cuộc trò chuyện công ty. Thêm --watch để tự làm mới.</span></li>
+      <li data-kind="new"><span class="kind kind-new">Mới</span><span>piagent sessions --setup-herdr hiện trạng thái ngay trên từng space và agent ở sidebar Herdr.</span></li>
+      <li data-kind="improved"><span class="kind kind-improved">Cải thiện</span><span>Lệnh xoá đường dẫn quan trọng không được trả lời trong 2 phút sẽ không chạy và agent làm tiếp; sau 3 lần, các lệnh này bị từ chối đến khi bạn nhắn tiếp.</span></li>
+      <li data-kind="fixed"><span class="kind kind-fixed">Sửa lỗi</span><span>Herdr lại thấy piagent: từ khi Piagent có home riêng, mọi pane đều là unknown và danh sách agent trống.</span></li>
+      <li data-kind="fixed"><span class="kind kind-fixed">Sửa lỗi</span><span>Terminal công ty không còn báo idle trên Herdr giữa các vòng của một tin nhắn, và câu hỏi đang chờ bạn được báo là blocked.</span></li>
+      <li data-kind="security"><span class="kind kind-security">Bảo mật</span><span>Always bypass không chống được prompt injection: trang web hay file lừa được agent thì secret có thể bị gửi ra ngoài mà không hỏi. Chỉ bật khi bạn chấp nhận điều đó.</span></li>
+    </ul>
+  </div>
+</article>
+<article class="release" id="v1-50-0" data-release>
   <div class="release-meta"><a class="release-version" href="#v1-50-0">v1.50.0</a><time class="release-date" datetime="2026-11-01">01/11/2026</time></div>
   <div class="release-body">
     <h3 data-toc-skip id="v1-50-0-title">Push được xét theo từng repo và review trước</h3>
@@ -414,24 +430,23 @@
     </ul>
   </div>
 </article>
-<article class="release" id="v1-43-7" data-release>
-  <div class="release-meta"><a class="release-version" href="#v1-43-7">v1.43.7</a><time class="release-date" datetime="2026-10-27">27/10/2026</time></div>
-  <div class="release-body">
-    <h3 data-toc-skip id="v1-43-7-title">Đủ skill đã cài, và mở file agent gửi lại <span class="tag">không phát hành</span></h3>
-    <p>Đã tag nhưng chưa publish: kiểm tra wording công khai chặn release vì tên sản phẩm trong ghi chú. Thay bằng 1.43.9.</p>
-    <ul class="release-items">
-      <li data-kind="new"><span class="kind kind-new">Mới</span><span>File agent gắn link trong câu trả lời mở ngay trong explorer: code đúng dòng, ảnh hiện hình, PDF và file office hiện nội dung chữ.</span></li>
-      <li data-kind="improved"><span class="kind kind-improved">Cải thiện</span><span>Skill và lệnh trong plugin Claude và Codex của dev được liệt kê và đọc được, lấy bản mới nhất; gõ /plugin:skill cũng được.</span></li>
-      <li data-kind="fixed"><span class="kind kind-fixed">Sửa lỗi</span><span>Chọn thư mục project mở lại được hộp chọn thư mục của Windows, kể cả khi dashboard chạy nền.</span></li>
-    </ul>
-  </div>
-</article>
 </section>
 <section class="section archive">
   <h2 id="archive">Các bản trước</h2>
   <p class="section-lead">Bản cũ hơn, gom theo tháng. Mở một tháng để xem từng thay đổi.</p>
   <details class="release-archive">
-    <summary><span>Tháng 10/2026</span><span class="archive-count">71</span></summary>
+    <summary><span>Tháng 10/2026</span><span class="archive-count">72</span></summary>
+    <div class="archive-row" id="v1-43-7">
+      <div class="archive-head"><a class="release-version" href="#v1-43-7">v1.43.7</a> <span class="release-date">27/10/2026</span></div>
+      <div class="archive-body">
+        <p><strong>Đủ skill đã cài, và mở file agent gửi lại</strong> <span class="tag">không phát hành</span> — Đã tag nhưng chưa publish: kiểm tra wording công khai chặn release vì tên sản phẩm trong ghi chú. Thay bằng 1.43.9.</p>
+        <ul class="release-items">
+        <li data-kind="new"><span class="kind kind-new">Mới</span><span>File agent gắn link trong câu trả lời mở ngay trong explorer: code đúng dòng, ảnh hiện hình, PDF và file office hiện nội dung chữ.</span></li>
+        <li data-kind="improved"><span class="kind kind-improved">Cải thiện</span><span>Skill và lệnh trong plugin Claude và Codex của dev được liệt kê và đọc được, lấy bản mới nhất; gõ /plugin:skill cũng được.</span></li>
+        <li data-kind="fixed"><span class="kind kind-fixed">Sửa lỗi</span><span>Chọn thư mục project mở lại được hộp chọn thư mục của Windows, kể cả khi dashboard chạy nền.</span></li>
+        </ul>
+      </div>
+    </div>
     <div class="archive-row" id="v1-43-6">
       <div class="archive-head"><a class="release-version" href="#v1-43-6">v1.43.6</a> <span class="release-date">27/10/2026</span></div>
       <div class="archive-body">

package/docs-site/windows.html

@@ -37,7 +37,7 @@
         <span class="brand-mark"><img src="/assets/piagent-logo.svg" alt="" width="28" height="28" /></span>
         <span class="brand-name"><b>Piagent</b> <span>Platform</span></span>
       </a>
-      <a class="version-badge" href="/whats-new" data-docs-version="v1.50.0" title="v1.50.0 docs · VI"><span class="dot"></span>v1.50.0</a>
+      <a class="version-badge" href="/whats-new" data-docs-version="v1.51.0" title="v1.51.0 docs · VI"><span class="dot"></span>v1.51.0</a>
       <nav class="top-nav" aria-label="Tài liệu">
         <a href="/quickstart">Tài liệu</a>
         <a href="/whats-new">Changelog</a>

package/docs-site/workflows.html

@@ -37,7 +37,7 @@
         <span class="brand-mark"><img src="/assets/piagent-logo.svg" alt="" width="28" height="28" /></span>
         <span class="brand-name"><b>Piagent</b> <span>Platform</span></span>
       </a>
-      <a class="version-badge" href="/whats-new" data-docs-version="v1.50.0" title="v1.50.0 docs · VI"><span class="dot"></span>v1.50.0</a>
+      <a class="version-badge" href="/whats-new" data-docs-version="v1.51.0" title="v1.51.0 docs · VI"><span class="dot"></span>v1.51.0</a>
       <nav class="top-nav" aria-label="Tài liệu">
         <a href="/quickstart">Tài liệu</a>
         <a href="/whats-new">Changelog</a>
@@ -210,6 +210,12 @@ Implement frontend support cho endpoint user status mới. Backend chỉ đọc.
     </article>
   </div>
 </section>
+
+<section class="section">
+  <p class="section-kicker">Nhiều session</p>
+  <h2 id="sessions">Xem mọi session mà không cần vào từng space</h2>
+  <p class="section-lead"><span class="inline-code">piagent sessions</span> liệt kê mọi session đang mở: <span class="inline-code">processing</span> đang chạy, <span class="inline-code">paused</span> đang chờ bạn, <span class="inline-code">failed</span> bị lỗi, <span class="inline-code">done</span> đã xong. Thêm <span class="inline-code">--watch</span> để tự làm mới. Dùng Herdr thì chạy <span class="inline-code">piagent sessions --setup-herdr</span> một lần để thấy trạng thái ngay trên từng space.</p>
+</section>
             <nav class="pager" aria-label="Trang kế tiếp">
               <a class="pager-prev" href="/commands">
                 <span class="pager-label">← Trước</span>

package/evals/private-holdout-v1/public-exposure.v2.json

@@ -256,8 +256,8 @@
     },
     {
       "path": "tests",
-      "fileCount": 648,
-      "sha256": "35ef07c0ab53282fccd92472562e92fa1e505305c4a47f7c527391eecf1cafec"
+      "fileCount": 651,
+      "sha256": "02e75d8917cda9a4abc8833a33058700d7ee0baf9553b2efc54d894ff845023b"
     }
   ],
   "custodianComparisonRules": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@piagent/platform",
-  "version": "1.50.0",
+  "version": "1.51.0",
   "license": "MIT",
   "publishConfig": {
     "access": "public",
@@ -72,6 +72,7 @@
   "bin": {
     "piagent": "scripts/piagent-cli.mjs",
     "piagent-dashboard": "scripts/piagent-cli.mjs",
+    "piagent-sessions": "scripts/piagent-cli.mjs",
     "piagent-setup": "scripts/piagent-cli.mjs",
     "piagent-install": "scripts/piagent-cli.mjs",
     "piagent-update": "scripts/piagent-cli.mjs",

package/packages/piagent-core/extensions/fallback-base-policy.ts

@@ -31,7 +31,7 @@ export function fallbackBasePolicy(
     defaultRequiredContext: ["AGENTS.md", "README.md"],
     permissionProfiles: {
       defaultMode: "workspace-write",
-      allowedModes: ["read-only", "workspace-write", "trusted-full-access", "bypass"]
+      allowedModes: ["read-only", "workspace-write", "trusted-full-access", "bypass", "always-bypass"]
     },
     execPolicy: {
       defaultMode: "enforce",

package/packages/piagent-core/extensions/guard-types.ts

@@ -326,7 +326,10 @@ export type ResolvedOrchestrationPolicy = {
 // "bypass": personal sessions only; no Piagent gate asks or blocks the work. The
 // handoff (runtime/policy/handoff-policy.mjs) is still asked; output redaction
 // and turn checkpoints still run.
-export type PermissionProfileMode = "read-only" | "workspace-write" | "trusted-full-access" | "bypass";
+// "always-bypass": only committing and pushing code and an rm on a critical path
+// are asked (critical-removal.mjs);
+// the project's autoDeny rules, output redaction and turn checkpoints remain.
+export type PermissionProfileMode = "read-only" | "workspace-write" | "trusted-full-access" | "bypass" | "always-bypass";
 
 export type PermissionProfilesConfig = {
   defaultMode?: PermissionProfileMode;

package/packages/piagent-core/{managed/herdr-reporter.mjs → extensions/herdr-reporter.js}

@@ -7,7 +7,7 @@ import net from 'node:net';
 // the company Terminal's own reporter: the same socket requests (newline JSON,
 // pane.report_agent), with the command that reopens this conversation in
 // `piagent studio` instead of personal Pi.
-const SOURCE = 'custom:piagent-studio', AGENT = 'piagent';
+const COMPANY_SOURCE = 'custom:piagent-studio', AGENT = 'piagent';
 
 // What a Herdr pane gives its processes, read before the environment is
 // cleared; null outside Herdr. Nothing else of it reaches the conversation.
@@ -21,7 +21,7 @@ export function herdrEnvironment(environment = process.env) {
 // control characters (its POSIX quoting), so such a path is not offered.
 export function herdrResumeArgv(cwd, sessionFile) {
   const argv = ['piagent', 'studio', '--project', cwd, ...(sessionFile ? ['--session', sessionFile] : [])];
-  return argv.every(part => typeof part === 'string' && part && !part.includes("'") && !/\p{Cc}/u.test(part)) ? argv : null;
+  return safeArgv(argv);
 }
 
 // One request, delivered when Herdr answers; a second, longer try when the
@@ -42,12 +42,15 @@ export async function sendHerdrRequest(socketPath, request) {
   if (!await sendOnce(socketPath, request, 500)) await sendOnce(socketPath, request, 1500);
 }
 
+// Herdr refuses a resume command with an apostrophe or control characters.
+const safeArgv = argv => argv && argv.every(part => typeof part === 'string' && part && !part.includes("'") && !/\p{Cc}/u.test(part)) ? argv : null;
+
 // working while a turn runs, blocked while the conversation waits for the
-// member (Pi's `herdr:blocked` events), idle otherwise. Reports go out one at a
-// time, the newest state winning.
-export function companyHerdrExtension(herdr, { send = sendHerdrRequest } = {}) {
+// member (Pi's blocking dialogs, or `herdr:blocked` events), idle otherwise.
+// Reports go out one at a time, the newest state winning.
+export function herdrReporterExtension(herdr, { source, resume, managed = null, send = sendHerdrRequest }) {
   return (pi) => {
-    let seq = Date.now() * 1000, active = false, blocked = 0, label, last, resumeArgv, queued, sending = false;
+    let unsubscribe, seq = Date.now() * 1000, active = false, blocked = 0, label, last, resumeArgv, queued, sending = false;
     const desired = () => blocked > 0 ? { state: 'blocked', message: label } : { state: active ? 'working' : 'idle', message: undefined };
     const drain = async () => {
       if (sending) return;
@@ -55,8 +58,8 @@ export function companyHerdrExtension(herdr, { send = sendHerdrRequest } = {}) {
       try {
         while (queued) {
           const next = queued; queued = undefined;
-          await send(herdr.socket, { id: `${SOURCE}:${next.seq}`, method: 'pane.report_agent',
-            params: { pane_id: herdr.pane, source: SOURCE, agent: AGENT, state: next.state, message: next.message, seq: next.seq, ...(resumeArgv ? { resume_argv: resumeArgv } : {}) } });
+          await send(herdr.socket, { id: `${source}:${next.seq}`, method: 'pane.report_agent',
+            params: { pane_id: herdr.pane, source, agent: AGENT, state: next.state, message: next.message, seq: next.seq, ...(resumeArgv ? { resume_argv: resumeArgv } : {}) } });
         }
       } finally { sending = false; if (queued) void drain(); }
     };
@@ -68,18 +71,31 @@ export function companyHerdrExtension(herdr, { send = sendHerdrRequest } = {}) {
     const follow = ctx => {
       let file;
       try { file = ctx?.sessionManager?.getSessionFile?.(); } catch { file = undefined; }
-      const argv = herdrResumeArgv(ctx?.cwd, typeof file === 'string' && file ? file : undefined);
+      const argv = safeArgv(resume(ctx?.cwd, typeof file === 'string' && file ? file : undefined));
       const changed = JSON.stringify(argv) !== JSON.stringify(resumeArgv);
       resumeArgv = argv ?? undefined;
       return changed;
     };
-    pi.events?.on?.('herdr:blocked', data => {
+    const wait = data => {
       if (data?.active) { blocked += 1; label = data.label; } else { blocked = Math.max(0, blocked - 1); if (!blocked) label = undefined; }
       publish();
-    });
+    };
+    pi.events?.on?.('herdr:blocked', wait);
+    // A long list as a title is not a label Herdr can show.
+    pi.on('ui_prompt_start', event => wait({ active: true, label: event?.title?.slice(0, 80) }));
+    pi.on('ui_prompt_end', () => wait({ active: false }));
     // /new, /resume and /fork start another session: Herdr follows it.
-    pi.on('session_start', async (_event, ctx) => { follow(ctx); active = ctx?.isIdle?.() === false; publish(true); });
+    pi.on('session_start', async (_event, ctx) => {
+      follow(ctx); active = ctx?.isIdle?.() === false || !!managed?.()?.activePrompt; publish(true);
+      // One company message is many rounds: it is idle when the turn itself ends.
+      unsubscribe?.();
+      unsubscribe = managed?.()?.session?.subscribe?.(event => { if (event?.type === 'agent_settled' && !managed()?.activePrompt) { active = false; publish(); } });
+    });
     pi.on('agent_start', (_event, ctx) => { const changed = follow(ctx); active = true; publish(changed); });
-    pi.on('agent_settled', (_event, ctx) => { if (ctx?.isIdle?.() !== true) return; active = false; publish(); });
+    pi.on('agent_settled', (_event, ctx) => { if (ctx?.isIdle?.() !== true || managed?.()?.activePrompt) return; active = false; publish(); });
   };
 }
+
+export function companyHerdrExtension(herdr, { send, managed } = {}) {
+  return herdrReporterExtension(herdr, { source: COMPANY_SOURCE, resume: herdrResumeArgv, managed, ...(send ? { send } : {}) });
+}

package/packages/piagent-core/extensions/piagent-guard.ts

@@ -38,6 +38,7 @@ import {
 import { detectProfileName } from "./project-shape.js";
 import { evaluateUpdateCheck, isInstalledPlatform, readUpdateCache, startUpdateProbe } from "./update-check.js";
 import { dormantInPersonalPi, personalPiAgentDir } from "./agent-home.js";
+import { registerTerminalSessionStatus } from "./session-status.js";
 import { collectServers } from "../mcp/mcp-config-layers.js";
 import { evaluateMcpApproval, mcpApprovalCache } from "../runtime/mcp-repository-gate.mjs";
 import { evaluateServerReadiness, readinessNotice } from "../mcp/mcp-auth-readiness.js";
@@ -88,7 +89,8 @@ import { ensurePrivateStateDirectory, resolveLocalStatePath } from "./local-stat
 import { hasDurableContextEvidence } from "./context-evidence.js";
 import { piApprovalBroker, type ApprovalActionDraft, type ApprovalChoice, type ApprovalUnavailableFallback } from "../runtime/inspection/approval-broker.ts";
 import { createSourceMutationGuardBindings } from "../runtime/policy/source-mutation-guard-binding.ts";
-import { FULL_ACCESS_RUNS, handoffReason, mcpWriteAction, treeExecFinding } from "../runtime/policy/handoff-policy.mjs";
+import { REMOVAL_EXPIRED, REMOVAL_TTL_MS, criticalRemovalReason, noteRemovalExpired, removalsHeld } from "../runtime/policy/critical-removal.mjs";
+import { FULL_ACCESS_RUNS, codeHandoffReason, handoffReason, mcpWriteAction, treeExecFinding } from "../runtime/policy/handoff-policy.mjs";
 import { createWorkspaceWriteAuthorityBindings } from "../runtime/policy/workspace-write-authority.ts";
 import { registerWorkspaceMemberEdits } from "../runtime/session/workspace-member-edits.mjs";
 import {
@@ -343,6 +345,8 @@ const PERMISSION_PROFILE_ALIASES: Record<string, PermissionProfileMode> = {
   "trusted_full_access": "trusted-full-access",
   "danger-full-access": "trusted-full-access",
   "danger_full_access": "trusted-full-access",
+  "always-bypass": "always-bypass",
+  "always_bypass": "always-bypass",
   bypass: "bypass",
   yolo: "bypass",
   "dangerously-bypass": "bypass",
@@ -1160,6 +1164,7 @@ function runtimeEquivalentForPermissionProfile(mode: PermissionProfileMode): str
   // checks are the boundary.
   if (mode === "read-only") return "like sandbox_mode=read-only, enforced by Piagent policy (no OS sandbox)";
   if (mode === "trusted-full-access") return "like sandbox_mode=danger-full-access; protected paths, destructive steps and the handoff (push, PR, publish, deploy, remote tools) are still asked";
+  if (mode === "always-bypass") return "like sandbox_mode=danger-full-access + approval_policy=never except committing and pushing code and removing a critical path; the project's autoDeny rules, output redaction and turn checkpoints remain";
   if (mode === "bypass") return "like sandbox_mode=danger-full-access + approval_policy=never for the work; the handoff (push, PR, publish, deploy, remote tools, MCP writes) is still asked, and output redaction and turn checkpoints remain";
   return "like sandbox_mode=workspace-write + approval_policy=on-request, enforced by Piagent policy (no OS sandbox)";
 }
@@ -1239,7 +1244,7 @@ function isPiagentTool(toolName: string): boolean {
 }
 
 // Full access or more: the profile does not narrow reads or the tool registry.
-const broadAccess = (mode: PermissionProfileMode) => mode === "trusted-full-access" || mode === "bypass";
+const broadAccess = (mode: PermissionProfileMode) => mode === "trusted-full-access" || mode === "bypass" || mode === "always-bypass";
 
 function evaluatePermissionProfileToolAccess(
   toolName: string,
@@ -3346,6 +3351,7 @@ export default function piagentGuard(pi: ExtensionAPI) {
   // The member's own `pi` stays stock even when an older install or a project
   // still registers this package there; Piagent runs through `piagent`.
   if (dormantInPersonalPi()) return;
+  registerTerminalSessionStatus(pi);
   const extensionDir = path.dirname(fileURLToPath(import.meta.url));
   const policy = loadPolicy(extensionDir);
   const bashResults = createBashResultLedger({ maxEntries: 300 });
@@ -3754,8 +3760,9 @@ export default function piagentGuard(pi: ExtensionAPI) {
   });
 
   // Bypass is for personal sessions only: a company session keeps Studio's rules.
-  const bypassActive = (ctx: ExtensionContext) => !isCompanySession(ctx) && ctx.model?.provider !== "agent_watch_managed"
-    && resolvePermissionProfile(loadProfileFromContext(ctx), policy, permissionOverrideFromContext(ctx)).mode === "bypass";
+  const bypassMode = (ctx: ExtensionContext) => !isCompanySession(ctx) && ctx.model?.provider !== "agent_watch_managed"
+    ? resolvePermissionProfile(loadProfileFromContext(ctx), policy, permissionOverrideFromContext(ctx)).mode : null;
+  const bypassActive = (ctx: ExtensionContext) => ["bypass", "always-bypass"].includes(String(bypassMode(ctx)));
   // Bypass runs the work without asking and stops at the handoff: a push, a
   // PR or merge, a publish or deploy, a remote or cloud tool, an upload or an
   // MCP tool that writes outside is asked about, as in every other mode.
@@ -3770,8 +3777,11 @@ export default function piagentGuard(pi: ExtensionAPI) {
       const refused = evaluateExecPolicyCore(command, { policy: { execPolicy: { defaultMode: "enforce", bannedPrefixSuggestions: [], rules: projectRules } }, mode: "enforce" });
       if (refused.decision === "forbid") return execRefusal(refused);
     }
-    let reason = command ? await handoffReason(command) : null;
-    if (!reason && !command && prepared && classifyExternalAction(event.toolName, prepared.input, policy).decision === "confirm") {
+    const always = bypassMode(ctx) === "always-bypass", modeName = always ? "Always bypass" : "Bypass";
+    const removal = always && command ? criticalRemovalReason(command, { cwd: ctx.cwd, home: os.homedir() }) : null;
+    let reason = !command ? null : always ? removal ?? codeHandoffReason(command) : await handoffReason(command);
+    if (removal && removalsHeld(ctx.sessionManager.getSessionId(), ctx.sessionManager)) return { block: true, reason: `${removal}. ${REMOVAL_EXPIRED}` };
+    if (!always && !reason && !command && prepared && classifyExternalAction(event.toolName, prepared.input, policy).decision === "confirm") {
       const action = await mcpWriteAction(prepared.proxyTool ?? event.toolName);
       if (action) reason = `${prepared.proxyToolName ?? event.toolName} writes outside this machine (${action})`;
     }
@@ -3780,10 +3790,11 @@ export default function piagentGuard(pi: ExtensionAPI) {
     const approval = await piApprovalBroker.request({ cwd: ctx.cwd, rawSessionId: ctx.sessionManager.getSessionId(), toolCallId: String(event.toolCallId), expectedTask: null,
       action: { kind: "external-provider-action", preconditionClass: "runtime-only", treePrecondition: null, toolName: event.toolName, rawAction: { toolName: event.toolName, command, input },
         commandPreview: command, parameterPreview: preview, targetPaths: [], targetSummaries: [reason], provider: command ? "shell-external" : String(prepared?.proxyToolName ?? event.toolName),
-        urlOrigin: null, requestedScope: "one-handoff", reason: `Bypass still asks before a handoff: ${reason}`, riskClass: "high",
+        urlOrigin: null, requestedScope: "one-handoff", reason: `${modeName} still asks before a handoff: ${reason}`, riskClass: "high",
         allowConsequence: "Run this exact step once; the work leaves this machine.", denyConsequence: "The step does not run; the agent is told you declined." },
-      terminalConfirm: () => ctx.ui.confirm(`Bypass still asks before a handoff.\n\n${reason}\n\n${preview}\n\nAllow?`, "Piagent handoff confirmation"),
-      terminalChoose: terminalChooser(ctx, "Piagent handoff confirmation", `Bypass still asks before a handoff.\n\n${reason}\n\n${preview}`, false), unavailableFallback: approvalUnavailableFallback(ctx) });
+      terminalConfirm: () => ctx.ui.confirm(`${modeName} still asks before a handoff.\n\n${reason}\n\n${preview}\n\nAllow?`, "Piagent handoff confirmation"),
+      terminalChoose: terminalChooser(ctx, "Piagent handoff confirmation", `${modeName} still asks before a handoff.\n\n${reason}\n\n${preview}`, false), unavailableFallback: approvalUnavailableFallback(ctx), ...(removal ? { ttlMs: REMOVAL_TTL_MS } : {}) });
+    if (removal && approval.receipt?.state === "expired") { noteRemovalExpired(ctx.sessionManager.getSessionId(), ctx.sessionManager); return { block: true, reason: `${removal}. ${REMOVAL_EXPIRED}` }; }
     if (!approval.allowed) return approval.choice === "stop" ? { block: true, terminate: true, reason: `User denied the handoff and stopped the turn: ${reason}. Do not retry; wait for the member.` } : { block: true, reason: `User denied the handoff: ${reason}` };
     if (!approval.consume()) return { block: true, reason: "Approval became stale before tool start; the action was blocked." };
     return undefined;

package/packages/piagent-core/extensions/session-status.d.ts

@@ -0,0 +1 @@
+export function registerTerminalSessionStatus(pi: unknown, env?: NodeJS.ProcessEnv): void;

package/packages/piagent-core/extensions/session-status.js

@@ -0,0 +1,217 @@
+import fs from "node:fs";
+import path from "node:path";
+import { piagentAgentDir, agentWatchControlDir } from "./agent-home.js";
+import { herdrEnvironment, herdrReporterExtension, sendHerdrRequest } from "./herdr-reporter.js";
+
+// What every open Piagent session is doing, readable from outside it: one small
+// file per Terminal under <piagent home>/status/sessions/, listed by
+// `piagent sessions`, and inside Herdr a summary on the row of each space, so a
+// developer with many sessions sees which one runs, waits or failed without
+// opening it. A file never holds the member's prompt or the agent's answer.
+export const SESSION_STATES = ["failed", "paused", "processing", "done", "idle"];
+const GLYPHS = { failed: "✖", paused: "⏸", processing: "▶", done: "✓" };
+const HEARTBEAT_MS = 30_000, DEAD_AFTER_MS = 120_000, COMPANY_KEEP_MS = 24 * 3_600_000;
+const SPACE_SOURCE = "piagent:sessions", PANE_SOURCE = "piagent:session";
+export const SPACE_TOKEN = "piagent_sessions", PANE_TOKEN = "piagent_status";
+
+const clip = (text, n) => (text.length > n ? `${text.slice(0, n - 1)}…` : text);
+export const sessionStatusDir = (agentDir = piagentAgentDir()) => path.join(agentDir, "status", "sessions");
+
+function writeAtomic(file, value) {
+  const temporary = `${file}.${process.pid}.tmp`;
+  fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+  fs.writeFileSync(temporary, JSON.stringify(value), { mode: 0o600 });
+  fs.renameSync(temporary, file);
+}
+
+function readJsonFiles(dir) {
+  let names;
+  try { names = fs.readdirSync(dir); } catch { return []; }
+  return names.filter(name => name.endsWith(".json")).flatMap(name => {
+    try { return [{ file: path.join(dir, name), value: JSON.parse(fs.readFileSync(path.join(dir, name), "utf8")) }]; } catch { return []; }
+  });
+}
+
+function processAlive(pid) {
+  try { process.kill(pid, 0); return true; } catch (error) { return error?.code === "EPERM"; }
+}
+
+// The last turn's outcome: Pi's retries end in one agent_end per attempt, so
+// only what the final one says counts.
+export function failureOf(messages) {
+  const last = [...(messages ?? [])].reverse().find(message => message?.role === "assistant");
+  return last?.stopReason === "error" ? clip(String(last.errorMessage || "The model request failed"), 160) : null;
+}
+
+// A Terminal that vanished in the middle of a turn failed; one that vanished
+// at rest has nothing left to say. The heartbeat tells a reused pid apart.
+export function liveRow(value, now, alive = processAlive) {
+  if (alive(value.pid) && now - Date.parse(value.updated_at) <= DEAD_AFTER_MS) return { ...value, alive: true };
+  if (value.state === "processing" || value.state === "paused") return { ...value, alive: false, state: "failed", message: "The Terminal ended during the task" };
+  return value.state === "failed" ? { ...value, alive: false } : null;
+}
+
+// Conversations of the dashboard and of Agent Watch's company Gateway publish
+// their own files (packages/piagent-webui/gateway/agent-status-files.ts).
+export function gatewayRow(value, source) {
+  const state = value.state === "working" ? "processing" : value.state === "blocked" ? "paused"
+    : value.state === "error" || value.ended === "failed" ? "failed"
+    : value.ended === "stopped" ? "paused" : value.state === "done" ? "done" : "idle";
+  return { id: `${source}:${value.conversation}`, source, state, project: value.project, title: value.title, since: value.since, updated_at: value.updated_at,
+    ...(value.state === "blocked" && value.kind ? { message: `Waiting: ${value.kind}` } : {}) };
+}
+
+export function readSessions({ agentDir = piagentAgentDir(), controlDir = agentWatchControlDir(), now = Date.now(), alive = processAlive, prune = false, gateways = true } = {}) {
+  const rows = [];
+  for (const { file, value } of readJsonFiles(sessionStatusDir(agentDir))) {
+    const row = liveRow(value, now, alive);
+    if (row && (row.alive || now - Date.parse(row.updated_at) <= COMPANY_KEEP_MS)) rows.push(row);
+    else if (prune) fs.rmSync(file, { force: true });
+  }
+  for (const source of gateways ? ["company", "dashboard"] : []) {
+    for (const { value } of readJsonFiles(path.join(controlDir, "status", source))) {
+      if (now - Date.parse(value.updated_at) <= COMPANY_KEEP_MS) rows.push(gatewayRow(value, source));
+    }
+  }
+  return rows.sort((a, b) => SESSION_STATES.indexOf(a.state) - SESSION_STATES.indexOf(b.state) || String(b.since).localeCompare(String(a.since)));
+}
+
+// One session in a space reads as a word, several as counts; what needs the
+// developer comes first. Nothing to show clears the token.
+export function spaceSummary(rows) {
+  const shown = rows.filter(row => GLYPHS[row.state]);
+  if (!shown.length) return null;
+  if (shown.length === 1) return `${GLYPHS[shown[0].state]} ${shown[0].state}`;
+  return SESSION_STATES.filter(state => GLYPHS[state]).flatMap(state => {
+    const count = shown.filter(row => row.state === state).length;
+    return count ? [`${GLYPHS[state]}${count}`] : [];
+  }).join(" ");
+}
+
+// How a company message ended (managed/continuation.mjs). A checklist left
+// open waits for the member to say what comes next.
+export function companyTurnEnd(end, text) {
+  if (end?.state === "failed") return ["failed", clip(`${end.role} agent: ${end.code}`, 160)];
+  if (end?.state === "cancelled") return ["paused", "Stopped by the member"];
+  if (end?.state === "midway") return ["paused", clip(String(text || "The checklist is not finished"), 160)];
+  return ["done", undefined];
+}
+
+// Only one session of a process is current: a company Terminal that enrolled
+// again replaces its session without always ending the old one.
+let currentInstance = null;
+
+export function sessionStatusExtension({ agentDir = piagentAgentDir(), herdr = null, send = sendHerdrRequest, now = Date.now, pid = process.pid, heartbeatMs = HEARTBEAT_MS, managed = null } = {}) {
+  return (pi) => {
+    const instance = {}, file = path.join(sessionStatusDir(agentDir), `${pid}.json`);
+    const space = herdr ? herdr.pane.split(":")[0] : null;
+    let started = false, state = "idle", message, since = new Date(now()).toISOString(), cwd, sessionId, prompts = 0, failure = null, settled = "idle", settledNote, unsubscribe, timer, sequence = now() * 1000;
+
+    const current = () => started && currentInstance === instance;
+    const nextSeq = () => { sequence = Math.max(sequence + 1, now() * 1000); return sequence; };
+    const spaceRequest = (workspaceId, summary) => ({ id: `${SPACE_SOURCE}:${nextSeq()}`, method: "workspace.report_metadata",
+      params: { workspace_id: workspaceId, source: SPACE_SOURCE, seq: sequence, ttl_ms: DEAD_AFTER_MS, tokens: { [SPACE_TOKEN]: summary } } });
+    // Every space of this Herdr, so a live session also corrects the row of one
+    // whose Terminal died. Another Herdr server numbers its spaces on its own.
+    const reportSpaces = async () => {
+      if (!herdr) return;
+      const rows = readSessions({ agentDir, now: now(), gateways: false }).filter(row => row.socket === herdr.socket);
+      for (const id of new Set([space, ...rows.map(row => row.workspace)])) {
+        await send(herdr.socket, spaceRequest(id, spaceSummary(rows.filter(row => row.workspace === id))));
+      }
+    };
+    const report = async () => {
+      if (!herdr) return;
+      await send(herdr.socket, { id: `${PANE_SOURCE}:${nextSeq()}`, method: "pane.report_metadata",
+        params: { pane_id: herdr.pane, source: PANE_SOURCE, seq: sequence, ttl_ms: DEAD_AFTER_MS, tokens: { [PANE_TOKEN]: message ? `${state}: ${clip(message, 40)}` : state } } });
+      await reportSpaces();
+    };
+    const write = () => {
+      try {
+        const name = pi.getSessionName?.();
+        writeAtomic(file, { schema_version: 1, id: sessionId ?? String(pid), source: "terminal", pid, state, ...(message ? { message } : {}),
+          project: cwd ? path.basename(cwd) : "", cwd, ...(name ? { title: clip(name, 80) } : {}),
+          ...(herdr ? { workspace: space, pane: herdr.pane, socket: herdr.socket } : {}), since, updated_at: new Date(now()).toISOString() });
+      } catch { /* the conversation never depends on this view */ }
+    };
+    const set = (next, note) => {
+      if (next === state && note === message) return;
+      if (next !== state) since = new Date(now()).toISOString();
+      state = next; message = note;
+      if (!current()) return;
+      write(); void report().catch(() => {});
+    };
+    const follow = (ctx) => {
+      cwd = ctx?.cwd ?? cwd;
+      try { sessionId = ctx?.sessionManager?.getSessionId?.() ?? sessionId; } catch { /* keep the last one */ }
+    };
+    // A dialog asks while a turn runs or between turns: the state under it comes back.
+    const settle = (next, note) => { settled = next; settledNote = note; if (!prompts) set(next, note); };
+
+    pi.on("session_start", async (_event, ctx) => {
+      currentInstance = instance; started = true; follow(ctx);
+      // The Terminal that held this pane before (a crash, `piagent reload`) is replaced.
+      if (herdr) for (const row of readJsonFiles(sessionStatusDir(agentDir))) {
+        if (row.value.pane === herdr.pane && row.value.pid !== pid && !liveRow(row.value, now())?.alive) fs.rmSync(row.file, { force: true });
+      }
+      failure = null; prompts = 0; settledNote = undefined;
+      settled = ctx?.isIdle?.() === false || managed?.()?.activePrompt ? "processing" : "idle";
+      // One company message is many rounds; only the turn's own end counts.
+      unsubscribe?.();
+      unsubscribe = managed?.()?.session?.subscribe?.(event => {
+        if (!current()) return;
+        if (event?.type === "managed_provider_retry") settle("processing", `Retrying ${event.attempt}/${event.of}: ${event.code}`);
+        if (event?.type === "managed_turn_end") settle(...companyTurnEnd(event.end, event.text));
+      });
+      state = settled; message = undefined; since = new Date(now()).toISOString();
+      write(); await report().catch(() => {});
+      clearInterval(timer);
+      timer = setInterval(() => { if (!current()) { clearInterval(timer); return; } write(); void report().catch(() => {}); }, heartbeatMs);
+      timer.unref?.();
+    });
+    pi.on("agent_start", (_event, ctx) => { follow(ctx); failure = null; if (settled !== "processing" || !managed?.()?.activePrompt) settle("processing"); });
+    pi.on("agent_end", (event) => { failure = failureOf(event?.messages); });
+    pi.on("agent_settled", (event, ctx) => {
+      if (ctx?.isIdle?.() !== true || managed?.()?.activePrompt) return;
+      if (event?.aborted) settle("paused", "Stopped by the member");
+      else if (failure) settle("failed", failure);
+      else settle("done");
+    });
+    pi.on("ui_prompt_start", (event) => { prompts += 1; set("paused", clip(String(event?.title || "Waiting for your answer"), 80)); });
+    pi.on("ui_prompt_end", () => {
+      prompts = Math.max(0, prompts - 1);
+      if (!prompts) set(settled, settledNote);
+    });
+    pi.on("session_shutdown", async () => {
+      clearInterval(timer); unsubscribe?.(); unsubscribe = undefined;
+      if (currentInstance !== instance) return;
+      started = false;
+      try { fs.rmSync(file, { force: true }); } catch { /* a later reader prunes it */ }
+      await reportSpaces().catch(() => {});
+    });
+  };
+}
+
+// `pi --mode rpc|json|print` also loads the package: only a Terminal someone
+// looks at is a session to follow.
+export function onlyInTerminal(pi) {
+  let terminal = false;
+  return {
+    ...pi,
+    getSessionName: () => pi.getSessionName?.(),
+    events: { on: (name, handler) => pi.events?.on?.(name, data => { if (terminal) return handler(data); }) },
+    on: (name, handler) => pi.on(name, (event, ctx) => {
+      if (name === "session_start") terminal = ctx?.mode === "tui";
+      if (terminal) return handler(event, ctx);
+    }),
+  };
+}
+
+// `piagent` itself. The launcher marks it; `piagent studio` registers its own
+// (scripts/piagent-studio.mjs), and a stock `pi` that loads the package stays out.
+export function registerTerminalSessionStatus(pi, env = process.env) {
+  if (env.PIAGENT_ACTIVE !== "1") return;
+  const terminal = onlyInTerminal(pi), herdr = herdrEnvironment(env);
+  sessionStatusExtension({ agentDir: piagentAgentDir(env), herdr })(terminal);
+  if (herdr) herdrReporterExtension(herdr, { source: "custom:piagent", resume: (_cwd, file) => (file ? ["piagent", "--session", file] : ["piagent"]) })(terminal);
+}