@tea-agent/loop-agent 0.1.0-fe-test.0

package/dist/worker/console/chat/pi-runtime.js

@@ -0,0 +1,2446 @@
+/**
+ * Operator Chat — Pi SDK runtime wrapper (plan W1 / M1).
+ *
+ * Wraps the Pi SDK's services-mode session API
+ * (createAgentSessionServices + createAgentSessionFromServices + SessionManager)
+ * into a small, testable surface that the Console HTTP layer can drive.
+ *
+ * Isolation guarantees (plan D4 / V12 / V14):
+ *   - Chat sessions are persisted to a DEDICATED sessionDir (not the user's
+ *     default ~/.pi/agent/sessions). Naming prefix `operator-chat-` makes them
+ *     auditable and cleanable (plan Q4 / Q8).
+ *   - The ResourceLoader uses the SDK's standard OPEN surface (ADR 0012):
+ *     user/project AGENTS.md context files, user (~/.pi/agent/skills/) and
+ *     project (.agents/skills/ init projection) skills, and user/project
+ *     extensions all load via the SDK DefaultResourceLoader; credential/model
+ *     plane is shared via the same agentDir auth.json/models.json.
+ *   - Active tools are pinned to the operator-chat surface at session create
+ *     AND re-pinned before each prompt (three-gate, design §7.5 / ADR 0011):
+ *     the FULL operator action set PLUS full Pi builtins
+ *     (read/write/edit/bash/grep/find/ls) and optional safe-*, PLUS extension
+ *     tools registered by user/project extensions (ADR 0012). Non-Pi write
+ *     channels (apply_patch/full-tools/shell/coding-chat) stay excluded.
+ *
+ * The actual SDK calls are injected via `PiSdkBindings` so this module is
+ * unit-testable without a live Pi install. Production bindings come from
+ * `createDefaultPiSdkBindings()`.
+ */
+import { createHash, randomBytes } from "node:crypto";
+import { access } from "node:fs/promises";
+import path from "node:path";
+import { extractAssistantContentBlocks, extractAssistantText, isAssistantSdkMessage, } from "./assistant-content.js";
+import { projectCompactSnapshot, } from "./chat-event-store.js";
+import { extractUsageSample } from "./usage.js";
+import { OPERATOR_CHAT_ALLOWED_TOOLS, authorizeOperatorChatTool, assertNoWriteToolInList, } from "./tools.js";
+import { createOperatorChatResourceLoader, } from "./resource-loader.js";
+import { applySkillAutoInvocationPreferences, isAutoInvocationEnabled, loadResourcePreferences, skillResourceId, } from "./resource-preferences-store.js";
+import { buildModelCallableToolSchemas } from "./tool-adapter.js";
+import { resolveDefaultChatModel, resolveLowChatModel, } from "./model-resolver.js";
+import { filterActiveInterviewTools } from "../interview/tools.js";
+import { RUNTIME_CONTEXT_TEXT_MAX, redactRuntimeText, } from "./runtime-context.js";
+/**
+ * Base system prompt fragment every General Operator Chat session receives.
+ *
+ * 2026-08-11 (ADR 0013): this is a SHORT runtime responsibility layer only.
+ * Project governance (operator-only policy, allowedPaths/forbiddenPaths,
+ * writer writeSet, taskKind routing, verification matrix, DAG recovery
+ * commands, closeout) lives in the loaded target-project AGENTS.md. The
+ * prompt below covers: Operator identity, the real tool surface (typed
+ * operator tools first + Pi tools, obey AGENTS.md), denied non-Pi runtimes,
+ * safe-* probes, init/init-upgrade fallback for uninitialized repos, DAG
+ * supervision with 60/90/120/180s adaptive polling
+ * (operationGet/status/dagReport/dagDoctor/operationWait), R2 recovery
+ * (dagReport → dagRerunPlan → dagRerun; ineligible → standaloneTaskRerun or
+ * workerTaskRetry, never dagResume) and G2 bounded writeSet auto-approval.
+ *
+ * The old Human Gate tutorial paragraphs (prepare + browser Human Gate,
+ * "confirmDagConfirmation is a human-only action", the long "Recovery default
+ * order" table) are REMOVED — bounded DAGs start and recover autonomously
+ * (AC-01: ≤ 2500 chars; 2498-slimming ratio retired 2026-08-18).
+ */
+export const OPERATOR_CHAT_SYSTEM_PROMPT_BASE = [
+    "You are General Operator Chat.",
+    "Use operator tools first (dagReport, dagRerunPlan, dagRerun). Pi read/write/edit/bash/grep/find/ls are available; obey repository AGENTS.md. apply_patch, full-tools, shell and coding-chat are denied. Prefer safe-read/safe-grep for probes.",
+    "No harness and asked to init: `loop-agent init instructions --repo-root .`, then `loop-agent init --repo-root . --profile full --merge`; verify with doctor, inspect and docs audit. Updates: `loop-agent init upgrade --repo-root . --json` until stable; `loop-agent init check-update` is read-only.",
+    "Long DAGs: prepareDagExecution → runDag → operationId. Never foreground-Bash task advance, tail/head pipes or nohup/Start-Process/start; do not end on accepted/queued/running or an operationId — NOT completion. Supervise operationGet/status/dagReport/dagDoctor/operationWait with 60s → 90s → 120s → 180s backoff; reset to 60s on state change; 30-60s re-checks when stall suspected. Every operationWait continuation MUST use afterSeq=previous nextSeq (prefer recommendedNextCall); never reuse an older cursor. Heartbeats are not meaningful progress.",
+    "On failure consume terminal runSummary first. If progress exists, wait; else dagReport then dagRerunPlan(fromNode=primaryFailure.nodeId); eligible → dagRerun (node rerun only: reruns the failed subgraph, keeps prior successes). If plan ineligible (unsafe-shell subgraph, binding/workspace drift): Worker Failed → workerTaskRetry; standalone → standaloneTaskRerun after contract adopt (regenerates the whole task, not node continue). Do not call dagResume. A run-failed task without an open gate is terminal: do not re-advance a run-failed task. Before run start, two identical lifecycleState/blocker/revision/DAG-hash observations mean no progress: stop and report after one bounded probe; never loop identical bash/read/grep. Auto-approve only bounded writeSet inside allowedPaths, outside forbiddenPaths, with structured verification.",
+    "Iterate toward the goal in bounded rounds: first summarize the previous round's error in one line (wrong fix, wrong node, or environment), fix its root cause — not the symptom — then rerun the failed node with a fresh plan. Never resubmit an unchanged fix; after two rounds failing the same way, stop and report evidence and remaining routes.",
+    "Continue until success, user stop, or no safe recovery remains; then stop and report failure/evidence. Never create a new task for a transient failure or replace repair-pi with direct edits.",
+].join("\n");
+/** Compose the inspectable system prompt actually injected into Operator Chat. */
+export function composeOperatorChatSystemPrompt(input) {
+    return [
+        OPERATOR_CHAT_SYSTEM_PROMPT_BASE,
+        ...(input.systemPromptSuffix?.trim()
+            ? [input.systemPromptSuffix.trim()]
+            : []),
+    ].join("\n\n");
+}
+/**
+ * Built-in SDK tool names registered for every Chat session (ADR 0011).
+ * Full Pi builtins: read/write/edit/bash/grep/find/ls. safe-* custom tools
+ * remain available in parallel for bounded sensitive probes.
+ */
+export const OPERATOR_CHAT_BUILTIN_EXPLORE_TOOLS = Object.freeze([
+    "read",
+    "write",
+    "edit",
+    "bash",
+    "grep",
+    "find",
+    "ls",
+]);
+/**
+ * Canonical active tool-set handed to setActiveToolsByName at every gate:
+ * every model-callable operator action (dynamic, from the registry) PLUS full
+ * Pi builtins (ADR 0011) PLUS safe explore custom tools (safe-read /
+ * safe-grep / git-status / git-diff). Non-Pi write channels (apply_patch /
+ * full-tools / shell / coding-chat) stay excluded.
+ */
+export const OPERATOR_CHAT_SAFE_EXPLORE_TOOL_IDS = Object.freeze([
+    "safe-read",
+    "safe-grep",
+    "git-status",
+    "git-diff",
+]);
+export function OPERATOR_CHAT_ACTIVE_TOOL_NAMES() {
+    return [
+        ...OPERATOR_CHAT_ALLOWED_TOOLS,
+        ...OPERATOR_CHAT_BUILTIN_EXPLORE_TOOLS,
+        ...OPERATOR_CHAT_SAFE_EXPLORE_TOOL_IDS,
+    ];
+}
+/**
+ * Non-Pi write / coding channels that must never be activated in Operator
+ * Chat even when a user/project extension registers them (ADR 0011 / 0012).
+ * Mirrors the NON_PI_WRITE_CHANNELS guard in tools.ts for the Gate 2 pin.
+ */
+const OPERATOR_CHAT_EXTENSION_DENIED_TOOL_IDS = new Set([
+    "apply_patch",
+    "apply-patch",
+    "full-tools",
+    "full_tools",
+    "coding-chat",
+    "coding_chat",
+    "shell",
+].map((t) => t.toLowerCase()));
+/**
+ * Gate 2 active-tool set for a live session (ADR 0012): the operator-chat
+ * baseline (operator actions + Pi builtins + safe explore) PLUS extension
+ * tools registered by user/project extensions. SDK setActiveToolsByName is
+ * REPLACEMENT-style, so extension tools would be disabled by the fixed
+ * baseline; this helper re-adds every registry tool that is not part of the
+ * baseline and not on the deny surface (apply_patch/full-tools/shell/
+ * coding-chat). Unknown/denied names are never activated; Gate 3 still
+ * re-authorizes every tool call per invocation.
+ */
+export function computeOperatorChatActiveToolNames(session) {
+    const baseline = OPERATOR_CHAT_ACTIVE_TOOL_NAMES();
+    if (!session?.getAllTools)
+        return baseline;
+    const baselineLower = new Set(baseline.map((t) => t.toLowerCase()));
+    const extras = [];
+    for (const tool of session.getAllTools()) {
+        const name = tool?.name;
+        if (!name || typeof name !== "string")
+            continue;
+        const lower = name.toLowerCase();
+        if (baselineLower.has(lower))
+            continue;
+        if (OPERATOR_CHAT_EXTENSION_DENIED_TOOL_IDS.has(lower))
+            continue;
+        extras.push(name);
+    }
+    return extras.length > 0 ? [...baseline, ...extras] : baseline;
+}
+const OPERATOR_CHAT_SESSION_EXCLUDE_TOOLS = Object.freeze([
+    "apply_patch",
+    "apply-patch",
+    "full-tools",
+    "full_tools",
+    "coding-chat",
+    "coding_chat",
+    "shell",
+]);
+function createConsoleExtensionBindings() {
+    return {
+        mode: "rpc",
+        onError: (error) => {
+            const message = error instanceof Error
+                ? error.message
+                : typeof error === "object" &&
+                    error &&
+                    "error" in error &&
+                    typeof error.error === "string"
+                    ? String(error.error)
+                    : String(error);
+            process.stderr.write(`[console] extension: ${message}\n`);
+        },
+        uiContext: {
+            select: async () => undefined,
+            confirm: async () => false,
+            input: async () => undefined,
+            editor: async () => undefined,
+            notify: () => undefined,
+            onTerminalInput: () => () => undefined,
+            setStatus: () => undefined,
+            setWorkingMessage: () => undefined,
+            setWorkingVisible: () => undefined,
+            setWorkingIndicator: () => undefined,
+            setHiddenThinkingLabel: () => undefined,
+            setWidget: () => undefined,
+            setFooter: () => undefined,
+            setHeader: () => undefined,
+            setTitle: () => undefined,
+            custom: async () => undefined,
+            pasteToEditor: () => undefined,
+            setEditorText: () => undefined,
+            getEditorText: () => "",
+            addAutocompleteProvider: () => undefined,
+            setEditorComponent: () => undefined,
+            getEditorComponent: () => undefined,
+        },
+    };
+}
+async function bindSessionExtensions(session) {
+    if (typeof session.bindExtensions !== "function")
+        return;
+    await session.bindExtensions(createConsoleExtensionBindings());
+}
+function pinOperatorChatTools(session) {
+    session.setActiveToolsByName(computeOperatorChatActiveToolNames(session));
+}
+/**
+ * Build Pi custom ToolDefinition objects for every whitelisted operator action.
+ * Each tool's execute() routes into the operator action dispatcher (Gate 3).
+ * Requires the `typebox` + `defineTool` packages (both bundled with the SDK).
+ */
+async function buildCustomOperatorTools(options) {
+    // typebox is a transitive dep of @earendil-works/pi-coding-agent; Node's
+    // resolver hoists to the SDK's nested copy. defineTool is re-exported by SDK.
+    const [{ Type }, { defineTool }] = await Promise.all([
+        import("typebox"),
+        import("@earendil-works/pi-coding-agent"),
+    ]);
+    const schemas = buildModelCallableToolSchemas();
+    const ctx = options.actionContext;
+    return schemas.map((schema) => {
+        // TypeBox schema is built dynamically; cast through unknown to the builder
+        // since Static<TParams> is structural and cannot be statically inferred here.
+        const parameters = Type.Object(schema.inputParams.reduce((acc, param) => {
+            // Carry the registry's param description into the tool schema so
+            // the model sees parameter semantics, not just names/types.
+            const desc = param.description?.trim()
+                ? { description: param.description }
+                : {};
+            let t;
+            switch (param.type) {
+                case "string":
+                    t = Type.String(desc);
+                    break;
+                case "boolean":
+                    t = Type.Boolean(desc);
+                    break;
+                case "number":
+                    t = Type.Number(desc);
+                    break;
+                case "array":
+                    t = Type.Array(Type.String({}), Object.keys(desc).length ? desc : {});
+                    break;
+                default:
+                    t = Type.Object({}, { additionalProperties: true });
+            }
+            acc[param.name] = param.required ? t : Type.Optional(t);
+            return acc;
+        }, {}), { additionalProperties: false });
+        return defineTool({
+            name: schema.toolId,
+            label: schema.toolId,
+            description: `${schema.description} (kind=${schema.kind}; cli: ${schema.cli})`,
+            promptSnippet: schema.description,
+            parameters: parameters,
+            async execute(toolCallId, params) {
+                const decision = authorizeOperatorChatTool(schema.toolId);
+                if (!decision.ok) {
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: JSON.stringify({
+                                    error: decision.message,
+                                    code: decision.code,
+                                }),
+                            },
+                        ],
+                        details: { error: decision.message, code: decision.code },
+                    };
+                }
+                // Defer require to avoid circular import at module load.
+                const { dispatchChatToolCall } = await import("./session-store.js");
+                const result = await dispatchChatToolCall(ctx, decision.toolId, params, toolCallId);
+                const payload = result.ok
+                    ? result.result
+                    : { error: result.message, code: result.errorCode };
+                return {
+                    content: [{ type: "text", text: JSON.stringify(payload) }],
+                    details: payload,
+                };
+            },
+        });
+    });
+}
+/**
+ * Build the safe explore custom tools (roadmap M0-A / G16): safe-read,
+ * safe-grep, gitStatus, gitDiff. These replace the bare SDK bash/read/grep so
+ * the model can probe the repo WITHOUT write escapes (echo redirect, tee,
+ * sed -i, node -e) and WITHOUT reading sensitive files (env files, key/pem,
+ * auth.json, sessions dir) — and every returned byte is secret-scrubbed
+ * before reaching the model context.
+ *
+ * gitStatus/gitDiff use a FIXED argv (typed, no shell) so they cannot be
+ * turned into an arbitrary-shell vector.
+ */
+async function buildExploreCustomTools(options) {
+    const [{ Type }, { defineTool }] = await Promise.all([
+        import("typebox"),
+        import("@earendil-works/pi-coding-agent"),
+    ]);
+    const { execFileSync } = await import("node:child_process");
+    const repoRoot = options.repoRoot;
+    const { safeReadFile, safeGrep, scrubSecrets } = await import("./explore-tools.js");
+    function safeGit(args) {
+        try {
+            const stdout = execFileSync("git", args, {
+                cwd: repoRoot,
+                encoding: "utf8",
+                // Fixed argv, no shell, bounded output.
+                maxBuffer: 512 * 1024,
+                timeout: 10_000,
+                windowsHide: true,
+            });
+            return { ok: true, stdout };
+        }
+        catch (e) {
+            return {
+                ok: false,
+                code: "GIT_FAILED",
+                message: e instanceof Error ? e.message : String(e),
+            };
+        }
+    }
+    const safeReadTool = defineTool({
+        name: "safe-read",
+        label: "safe-read",
+        description: "Read a repo-relative file with sensitive-file denylist (.env*/*.key/*.pem/.git/**/auth.json/sessions/**) and secret scrubbing. Absolute paths and .. are rejected.",
+        promptSnippet: "safe-read: read a repo file (safe; secrets scrubbed)",
+        parameters: Type.Object({
+            path: Type.String({ description: "repo-relative file path" }),
+        }, { additionalProperties: false }),
+        async execute(_toolCallId, params) {
+            const raw = String(params.path ?? "");
+            try {
+                const result = await safeReadFile(repoRoot, raw);
+                return {
+                    content: [{ type: "text", text: JSON.stringify(result) }],
+                    details: result,
+                };
+            }
+            catch (e) {
+                const err = e;
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify({
+                                error: err.message ?? String(e),
+                                code: err.code ?? "READ_FAILED",
+                            }),
+                        },
+                    ],
+                    details: {
+                        error: err.message ?? String(e),
+                        code: err.code ?? "READ_FAILED",
+                    },
+                };
+            }
+        },
+    });
+    const safeGrepTool = defineTool({
+        name: "safe-grep",
+        label: "safe-grep",
+        description: "Line search across the repo working tree with sensitive-file denylist and secret scrubbing. pattern is a JS regex source; optional glob filters paths.",
+        promptSnippet: "safe-grep: search repo files (safe; secrets scrubbed)",
+        parameters: Type.Object({
+            pattern: Type.String({ description: "regex source (no shell)" }),
+            caseInsensitive: Type.Optional(Type.Boolean()),
+            glob: Type.Optional(Type.String({ description: "optional glob filter e.g. *.ts" })),
+        }, { additionalProperties: false }),
+        async execute(_toolCallId, params) {
+            try {
+                const result = await safeGrep(repoRoot, String(params.pattern ?? ""), {
+                    caseInsensitive: Boolean(params.caseInsensitive),
+                    glob: params.glob ? String(params.glob) : undefined,
+                });
+                return {
+                    content: [{ type: "text", text: JSON.stringify(result) }],
+                    details: result,
+                };
+            }
+            catch (e) {
+                const err = e;
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify({
+                                error: err.message ?? String(e),
+                                code: err.code ?? "GREP_FAILED",
+                            }),
+                        },
+                    ],
+                    details: {
+                        error: err.message ?? String(e),
+                        code: err.code ?? "GREP_FAILED",
+                    },
+                };
+            }
+        },
+    });
+    const gitStatusTool = defineTool({
+        name: "git-status",
+        label: "git-status",
+        description: "Typed `git status --porcelain` (fixed argv, no shell). Returns scrubbed working-tree status.",
+        promptSnippet: "git-status: working tree status (read-only)",
+        parameters: Type.Object({}, { additionalProperties: false }),
+        async execute() {
+            const r = safeGit(["status", "--porcelain"]);
+            if (!r.ok) {
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify({ error: r.message, code: r.code }),
+                        },
+                    ],
+                    details: { error: r.message, code: r.code },
+                };
+            }
+            const { scrubbed, redactions } = scrubSecrets(r.stdout);
+            const payload = { status: scrubbed, redactions };
+            return {
+                content: [{ type: "text", text: JSON.stringify(payload) }],
+                details: payload,
+            };
+        },
+    });
+    const gitDiffTool = defineTool({
+        name: "git-diff",
+        label: "git-diff",
+        description: "Typed `git diff` (fixed argv: --stat or a single -- path; no shell). Returns scrubbed diff. path must be repo-relative and not sensitive.",
+        promptSnippet: "git-diff: diff (read-only, scrubbed)",
+        parameters: Type.Object({
+            path: Type.Optional(Type.String({
+                description: "optional repo-relative path to diff (default: whole tree --stat)",
+            })),
+        }, { additionalProperties: false }),
+        async execute(_toolCallId, params) {
+            let rawPath = params.path ? String(params.path) : undefined;
+            // If a path is supplied, validate it via the read-path guard so git diff
+            // cannot be aimed at sensitive files (.env* / auth.json / sessions).
+            if (rawPath) {
+                const { guardReadPath } = await import("./explore-tools.js");
+                const g = await guardReadPath(repoRoot, rawPath);
+                if (!g.ok) {
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: JSON.stringify({ error: g.message, code: g.code }),
+                            },
+                        ],
+                        details: { error: g.message, code: g.code },
+                    };
+                }
+                rawPath = g.repoRelative;
+            }
+            const args = rawPath ? ["diff", "--", rawPath] : ["diff", "--stat"];
+            const r = safeGit(args);
+            if (!r.ok) {
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify({ error: r.message, code: r.code }),
+                        },
+                    ],
+                    details: { error: r.message, code: r.code },
+                };
+            }
+            const { scrubbed, redactions } = scrubSecrets(r.stdout);
+            const payload = { diff: scrubbed, redactions };
+            return {
+                content: [{ type: "text", text: JSON.stringify(payload) }],
+                details: payload,
+            };
+        },
+    });
+    return [safeReadTool, safeGrepTool, gitStatusTool, gitDiffTool];
+}
+export const THINKING_LEVELS = [
+    "off",
+    "minimal",
+    "low",
+    "medium",
+    "high",
+    "xhigh",
+    "max",
+];
+/**
+ * Structured critical-failure error for snapshot projection (RF-02). Model
+ * enumeration or system prompt projection failures throw this so consuming
+ * routes can return 503 PI_RUNTIME_UNAVAILABLE instead of a fake-empty 200.
+ * Partial ResourceLoader / package-inventory failures are NOT critical — they
+ * keep the 200 snapshot and surface as structured diagnostics instead.
+ */
+export class RuntimeSnapshotUnavailableError extends Error {
+    code = "PI_RUNTIME_UNAVAILABLE";
+    constructor(message) {
+        super(message);
+        this.name = "RuntimeSnapshotUnavailableError";
+    }
+}
+/**
+ * Browser-safe projection of a live runtime snapshot (design §2.2 / RF-03).
+ *
+ * Every browser-visible string runs the shared secret-scrub chain
+ * (scrubSecrets + ghp_/Bearer redaction via redactRuntimeText) and a fixed
+ * per-field length limit: 200 (names/spec/source/origin), 400 (paths/errors/
+ * diagnostic messages), 600 (skill descriptions), 80 (package versions);
+ * truncation uses the fixed `…[truncated N chars …]` marker. The server-only
+ * `raw` prompt and the RAW-based `sha256`/`characters` pass through untouched,
+ * and real empty lists stay empty.
+ *
+ * Pure + deterministic and exported so the route harness reuses the exact
+ * production implementation (same code path as getRuntimeSnapshot).
+ */
+export function projectRuntimeSnapshot(input) {
+    const field = (value, max) => value === undefined ? undefined : redactRuntimeText(value, max);
+    const projectSkill = (skill) => ({
+        name: field(skill.name, 200) ?? "",
+        description: field(skill.description, 600) ?? "",
+        path: field(skill.path, 400) ?? "",
+        ...(skill.baseDir ? { baseDir: field(skill.baseDir, 400) } : {}),
+        scope: skill.scope,
+        source: field(skill.source, 200) ?? "",
+        resourceId: field(skill.resourceId, 200) ?? "",
+        autoInvocationEnabled: skill.autoInvocationEnabled,
+        diagnostics: skill.diagnostics.map((diag) => field(diag, 400) ?? ""),
+    });
+    const projectExtension = (ext) => ({
+        name: field(ext.name, 200) ?? "",
+        path: field(ext.path, 400) ?? "",
+        ...(ext.resolvedPath
+            ? { resolvedPath: field(ext.resolvedPath, 400) }
+            : {}),
+        source: field(ext.source, 200) ?? "",
+        scope: ext.scope,
+        ...(ext.origin ? { origin: field(ext.origin, 200) } : {}),
+        enabled: ext.enabled,
+        ...(ext.error ? { error: field(ext.error, 400) } : {}),
+    });
+    const projectPackage = (pkg) => ({
+        spec: field(pkg.spec, 200) ?? "",
+        scope: pkg.scope,
+        enabled: pkg.enabled,
+        ...(pkg.version ? { version: field(pkg.version, 80) } : {}),
+        ...(pkg.configuredVersion
+            ? { configuredVersion: field(pkg.configuredVersion, 80) }
+            : {}),
+        ...(pkg.packageName ? { packageName: field(pkg.packageName, 200) } : {}),
+        ...(pkg.path ? { path: field(pkg.path, 400) } : {}),
+        ...(pkg.installedPath ? { installedPath: field(pkg.installedPath, 400) } : {}),
+        ...(pkg.cwd ? { cwd: field(pkg.cwd, 400) } : {}),
+        resolved: pkg.resolved.map((resource) => ({
+            type: resource.type,
+            name: field(resource.name, 200) ?? "",
+            path: field(resource.path, 400) ?? "",
+            source: field(resource.source, 200) ?? "",
+            scope: resource.scope,
+        })),
+        diagnostics: pkg.diagnostics.map((diag) => field(diag, 400) ?? ""),
+    });
+    const projectMcpTool = (tool) => ({
+        name: field(tool.name, 200) ?? "",
+        description: field(tool.description, 600) ?? "",
+        ...(tool.server ? { server: field(tool.server, 200) } : {}),
+        source: field(tool.source, 200) ?? "",
+        scope: tool.scope,
+        ...(tool.path ? { path: field(tool.path, 400) } : {}),
+        active: tool.active,
+    });
+    const projectMcp = (mcp) => ({
+        servers: mcp.servers.map((server) => ({
+            name: field(server.name, 200) ?? "",
+            scope: server.scope,
+            status: server.status,
+            enabled: server.enabled,
+            ...(server.transport ? { transport: field(server.transport, 80) } : {}),
+            ...(server.command ? { command: field(server.command, 400) } : {}),
+            ...(server.url ? { url: field(server.url, 400) } : {}),
+            ...(server.configPath ? { configPath: field(server.configPath, 400) } : {}),
+            tools: server.tools.map(projectMcpTool),
+        })),
+        unassignedTools: mcp.unassignedTools.map(projectMcpTool),
+    });
+    const projectDiagnostic = (diag) => ({
+        type: diag.type,
+        ...(diag.code ? { code: diag.code } : {}),
+        message: field(diag.message, 400) ?? "",
+        ...(diag.path ? { path: field(diag.path, 400) } : {}),
+        ...(diag.retryable !== undefined
+            ? { retryable: diag.retryable }
+            : {}),
+    });
+    return {
+        sessionId: input.sessionId,
+        revision: input.revision,
+        loadedAt: input.loadedAt,
+        selection: {
+            ...(input.selection.model
+                ? {
+                    model: {
+                        provider: input.selection.model.provider,
+                        id: input.selection.model.id,
+                        ...(input.selection.model.name
+                            ? { name: field(input.selection.model.name, 200) }
+                            : {}),
+                    },
+                }
+                : {}),
+            thinkingSelection: input.selection.thinkingSelection,
+            ...(input.selection.effectiveThinkingLevel
+                ? { effectiveThinkingLevel: input.selection.effectiveThinkingLevel }
+                : {}),
+        },
+        models: input.models.map((model) => ({
+            provider: model.provider,
+            id: model.id,
+            ...(model.name ? { name: field(model.name, 200) } : {}),
+            ...(model.hasCredentials !== undefined
+                ? { hasCredentials: model.hasCredentials }
+                : {}),
+        })),
+        thinkingLevels: input.thinkingLevels.map((option) => ({ ...option })),
+        systemPrompt: {
+            ...(input.systemPrompt.raw !== undefined
+                ? { raw: input.systemPrompt.raw }
+                : {}),
+            text: redactRuntimeText(input.systemPrompt.text, RUNTIME_CONTEXT_TEXT_MAX),
+            sha256: input.systemPrompt.sha256,
+            characters: input.systemPrompt.characters,
+        },
+        activeTools: [...input.activeTools],
+        contextFiles: input.contextFiles.map((file) => ({
+            path: field(file.path, 400) ?? "",
+            characters: file.characters,
+        })),
+        skills: input.skills.map(projectSkill),
+        extensions: input.extensions.map(projectExtension),
+        packages: input.packages.map(projectPackage),
+        mcp: projectMcp(input.mcp ?? { servers: [], unassignedTools: [] }),
+        diagnostics: input.diagnostics.map(projectDiagnostic),
+        hasBash: input.hasBash,
+    };
+}
+export { extractAssistantContentBlocks, extractAssistantText, isAssistantSdkMessage };
+function readSessionManagerId(manager) {
+    if (!manager || typeof manager !== "object")
+        return undefined;
+    const record = manager;
+    if (typeof record.getSessionId === "function") {
+        try {
+            const value = record.getSessionId();
+            if (typeof value === "string" && value.trim())
+                return value;
+        }
+        catch {
+            // ignore
+        }
+    }
+    if (typeof record.sessionId === "string" && record.sessionId.trim()) {
+        return record.sessionId;
+    }
+    return undefined;
+}
+function readSessionManagerFile(manager) {
+    if (!manager || typeof manager !== "object")
+        return undefined;
+    const record = manager;
+    if (typeof record.getSessionFile === "function") {
+        try {
+            const value = record.getSessionFile();
+            if (typeof value === "string" && value.trim())
+                return value;
+        }
+        catch {
+            // ignore
+        }
+    }
+    if (typeof record.sessionFile === "string" && record.sessionFile.trim()) {
+        return record.sessionFile;
+    }
+    return undefined;
+}
+/** Structured materialization failure for dependent Chat endpoints. */
+export class PiSessionInitFailedError extends Error {
+    code = "PI_SESSION_INIT_FAILED";
+    constructor(message) {
+        super(message);
+        this.name = "PiSessionInitFailedError";
+    }
+}
+/**
+ * Console Pi runtime — holds Chat sessions and drives prompt() with three-gate
+ * tool enforcement. Session-per-sessionId; cross-request reuse via open().
+ */
+export class ConsolePiRuntime {
+    options;
+    loader;
+    sessions = new Map();
+    modelRuntimes = new Map();
+    sessionManagers = new Map();
+    /** Per-session SDK service scope (resourceLoader / settingsManager) used by the live runtime snapshot. */
+    serviceScopes = new Map();
+    /** Snapshot revision: bumped on create / reopen / model / thinking / reload. */
+    revisions = new Map();
+    /** RF-01: per-session reload in-flight lock (concurrent second call → PI_SESSION_BUSY). */
+    reloadInFlight = new Set();
+    /** Synchronous prompt ownership per session (admission before first await). */
+    promptOwners = new Set();
+    /** At most one detached automatic-title task per durable Console session. */
+    titleInFlight = new Set();
+    /** Composer thinking selection ("auto" = no explicit override). */
+    thinkingSelections = new Map();
+    mainlineLeaves = new Map();
+    /** Per-sessionId single-flight materialization (create fast-path / readiness fence). */
+    sessionInit = new Map();
+    /** Resolved model binding after materialization (create may return before this is known). */
+    sessionModels = new Map();
+    /** SessionIds disposed while materialization was still in flight. */
+    disposedSessions = new Set();
+    /** Session-less tool definition caches (no AgentSession state). */
+    operatorCustomToolsPromise;
+    exploreCustomToolsPromise;
+    bindings;
+    constructor(options) {
+        this.options = options;
+        this.loader = createOperatorChatResourceLoader();
+        this.bindings = options.bindings ?? createDefaultPiSdkBindings();
+    }
+    /** Absolute path for repo-scoped resource preferences (may be undefined in unit tests). */
+    get resourcePreferencesPath() {
+        return this.options.resourcePreferencesPath;
+    }
+    /**
+     * Load repo-scoped skill auto-invocation preferences (fail closed on malformed).
+     * Missing path / missing file → empty prefs (all skills auto-invocation default on).
+     */
+    async loadSkillAutoInvocationPreferences() {
+        const filePath = this.options.resourcePreferencesPath;
+        if (!filePath) {
+            const empty = { schemaVersion: 1, skills: {} };
+            this.cachedSkillPrefs = empty;
+            return empty;
+        }
+        const prefs = await loadResourcePreferences(filePath);
+        this.cachedSkillPrefs = prefs;
+        return prefs;
+    }
+    /**
+     * Build resourceLoaderOptions that inject skillsOverride from stored prefs.
+     * Skills remain in inventory; only disableModelInvocation is forced for
+     * auto-invocation-off preferences. Manual /skill:name is preserved.
+     *
+     * The override re-reads preferences on EVERY invocation so session.reload()
+     * after a PATCH sees the latest resource-preferences.json (not create-time
+     * closure state).
+     */
+    async buildResourceLoaderOptions(base = {}) {
+        return {
+            ...base,
+            skillsOverride: (current) => {
+                // Synchronous override surface: use last-known prefs via a sync
+                // fail-closed path. Prefer async cache filled by ensurePrefs.
+                const prefs = this.cachedSkillPrefs ?? {
+                    schemaVersion: 1,
+                    skills: {},
+                };
+                return {
+                    skills: applySkillAutoInvocationPreferences(current.skills, prefs),
+                    diagnostics: current.diagnostics,
+                };
+            },
+        };
+    }
+    /** Last successfully loaded skill prefs (sync override + snapshot projection). */
+    cachedSkillPrefs;
+    /** Refresh cached prefs before materialization / reload so override sees latest. */
+    async refreshSkillPrefsCache() {
+        const prefs = await this.loadSkillAutoInvocationPreferences();
+        this.cachedSkillPrefs = prefs;
+        return prefs;
+    }
+    /**
+     * Resolve a skill in the current session inventory by server-issued resourceId.
+     * Returns undefined when the id is unknown (caller maps to PI_SKILL_NOT_FOUND).
+     */
+    async findSkillByResourceId(sessionId, resourceId) {
+        const snapshot = await this.getRuntimeSnapshot(sessionId);
+        if (!snapshot)
+            return undefined;
+        const skill = snapshot.skills.find((entry) => entry.resourceId === resourceId);
+        if (!skill)
+            return undefined;
+        return {
+            resourceId: skill.resourceId,
+            name: skill.name,
+            path: skill.path,
+            autoInvocationEnabled: skill.autoInvocationEnabled,
+        };
+    }
+    get sessionDir() {
+        return this.options.sessionDir;
+    }
+    /** Resolve the Pi agent directory for bounded Console configuration APIs. */
+    async getAgentDir() {
+        return safeGetAgentDir(this.bindings);
+    }
+    async testConfiguredModel(model) {
+        const { services } = await this.bindings.createServices({
+            cwd: this.options.cwd,
+            agentDir: await this.getAgentDir(),
+        });
+        return {
+            available: Boolean(this.bindings.resolveModel({
+                modelRuntime: services.modelRuntime,
+                provider: model.provider,
+                modelId: model.modelId,
+            })),
+        };
+    }
+    /** Operator action context used by custom-tool dispatchers (Gate 3). */
+    get actionContext() {
+        return this.options.actionContext;
+    }
+    /**
+     * Resolve the Chat default model descriptor from harness.json
+     * executors.pi.MED + the SDK available-model list. Returns undefined when
+     * harness is unset or no provider surfaces the model. No hardcoded fallback.
+     *
+     * Prefer reusing an already-built modelRuntime (same services object as
+     * formal materialization) so create does not construct throwaway services.
+     */
+    async resolveDefaultModel(modelRuntime) {
+        let available;
+        try {
+            const runtime = modelRuntime ??
+                (await this.bindings.createServices({
+                    cwd: this.options.cwd,
+                    agentDir: await safeGetAgentDir(this.bindings),
+                })).services.modelRuntime;
+            available = this.bindings.listAvailableModels({
+                modelRuntime: runtime,
+            });
+        }
+        catch {
+            return undefined;
+        }
+        const descriptor = await resolveDefaultChatModel(this.options.cwd, available);
+        if (!descriptor)
+            return undefined;
+        return {
+            provider: descriptor.provider,
+            modelId: descriptor.modelId,
+        };
+    }
+    /**
+     * Fast create: durable SessionManager/JSONL shell first, then single-flight
+     * AgentSession materialization in the background. 201 may report
+     * `initializing: true`; dependent routes wait on the same promise.
+     */
+    async createSession(init) {
+        const sessionId = `operator-chat-${randomBytes(12).toString("hex")}`;
+        this.disposedSessions.delete(sessionId);
+        const sessionManager = await this.bindings.createSessionManager({
+            cwd: this.options.cwd,
+            sessionDir: this.options.sessionDir,
+            sessionId,
+        });
+        const sessionFile = readSessionManagerFile(sessionManager);
+        if (!sessionFile) {
+            throw new Error(`chat session shell missing sessionFile for ${sessionId}`);
+        }
+        this.sessionManagers.set(sessionId, sessionManager);
+        this.thinkingSelections.set(sessionId, "auto");
+        // Detached single-flight materialization; dependent routes await the same promise.
+        void this.startMaterialization(sessionId, {
+            sessionManager,
+            model: init?.model,
+            systemPromptSuffix: init?.systemPromptSuffix,
+            // Create path must resolve default model from the SAME services object
+            // used for formal materialization (no throwaway createServices).
+            resolveDefaultModel: !init?.model,
+        });
+        return {
+            sessionId,
+            sessionFile,
+            createdAt: new Date().toISOString(),
+            model: init?.model,
+            activeTools: OPERATOR_CHAT_ACTIVE_TOOL_NAMES(),
+            initializing: true,
+        };
+    }
+    /**
+     * Wait for single-flight materialization. Ready sessions resolve immediately;
+     * failed materialization throws PiSessionInitFailedError.
+     */
+    async ensureSessionReady(sessionId) {
+        const state = this.sessionInit.get(sessionId);
+        if (!state) {
+            if (this.sessions.has(sessionId))
+                return;
+            throw new Error(`chat session not found: ${sessionId}`);
+        }
+        if (state.status === "ready")
+            return;
+        if (state.status === "failed")
+            throw state.error;
+        await state.promise;
+        const next = this.sessionInit.get(sessionId);
+        if (next?.status === "failed")
+            throw next.error;
+        if (this.disposedSessions.has(sessionId) || !this.sessions.has(sessionId)) {
+            throw new Error(`chat session not found: ${sessionId}`);
+        }
+    }
+    startMaterialization(sessionId, init) {
+        const existing = this.sessionInit.get(sessionId);
+        if (existing?.status === "initializing")
+            return existing.promise;
+        if (existing?.status === "ready")
+            return Promise.resolve();
+        if (existing?.status === "failed")
+            return Promise.reject(existing.error);
+        const promise = this.materializeSession(sessionId, init)
+            .then(() => {
+            if (this.disposedSessions.has(sessionId)) {
+                // Late materialization after delete: never register ready state.
+                this.sessionInit.delete(sessionId);
+                return;
+            }
+            this.sessionInit.set(sessionId, { status: "ready" });
+        })
+            .catch((error) => {
+            const failed = new PiSessionInitFailedError(error instanceof Error ? error.message : String(error));
+            if (!this.disposedSessions.has(sessionId)) {
+                this.sessionInit.set(sessionId, { status: "failed", error: failed });
+            }
+            else {
+                this.sessionInit.delete(sessionId);
+            }
+            // Observe rejection so detached create path has no unhandled rejection.
+            process.stderr.write(`[console] chat session init failed (${sessionId}): ${failed.message}\n`);
+        });
+        this.sessionInit.set(sessionId, { status: "initializing", promise });
+        return promise;
+    }
+    async materializeSession(sessionId, init) {
+        if (this.disposedSessions.has(sessionId))
+            return;
+        const agentDir = await safeGetAgentDir(this.bindings);
+        const appendSystemPrompt = [
+            OPERATOR_CHAT_SYSTEM_PROMPT_BASE,
+            ...(init.systemPromptSuffix ? [init.systemPromptSuffix] : []),
+        ];
+        // Single services construction for formal materialization (+ optional
+        // default-model resolve from the same modelRuntime). Repo-scoped skill
+        // auto-invocation prefs inject skillsOverride without touching SKILL.md.
+        await this.refreshSkillPrefsCache().catch(() => undefined);
+        const { services } = await this.bindings.createServices({
+            cwd: this.options.cwd,
+            agentDir,
+            resourceLoaderOptions: await this.buildResourceLoaderOptions({
+                appendSystemPrompt,
+            }),
+        });
+        if (this.disposedSessions.has(sessionId))
+            return;
+        const modelRuntime = services.modelRuntime;
+        let model = init.model;
+        if (!model && init.resolveDefaultModel) {
+            model = await this.resolveDefaultModel(modelRuntime);
+        }
+        const resolvedModel = model
+            ? (this.bindings.resolveModel({
+                modelRuntime,
+                provider: model.provider,
+                modelId: model.modelId,
+            }) ?? undefined)
+            : undefined;
+        assertNoWriteToolInList(OPERATOR_CHAT_ALLOWED_TOOLS);
+        const customTools = await this.loadCustomTools();
+        if (this.disposedSessions.has(sessionId))
+            return;
+        // pi-web parity: do NOT pass `tools`. A closed allowlist becomes
+        // SDK allowedToolNames and filters extension MCP tools out of the
+        // registry before Gate 2 can re-add them. Operator/safe customTools
+        // still register via customTools; non-Pi write channels stay blocked
+        // by excludeTools. After create, bindExtensions emits session_start
+        // so MCP adapters can register, then pin the active set.
+        const { session } = await this.bindings.createSessionFromServices({
+            services,
+            sessionManager: init.sessionManager,
+            excludeTools: [...OPERATOR_CHAT_SESSION_EXCLUDE_TOOLS],
+            ...(customTools.length > 0 ? { customTools } : {}),
+            ...(resolvedModel ? { model: resolvedModel } : {}),
+        });
+        if (this.disposedSessions.has(sessionId)) {
+            try {
+                session.dispose();
+            }
+            catch {
+                // ignore late dispose cleanup
+            }
+            return;
+        }
+        await bindSessionExtensions(session);
+        pinOperatorChatTools(session);
+        // Register then re-check dispose race: a concurrent dispose must win.
+        this.sessions.set(sessionId, session);
+        this.sessionManagers.set(sessionId, init.sessionManager);
+        this.modelRuntimes.set(sessionId, modelRuntime);
+        this.sessionModels.set(sessionId, model);
+        this.serviceScopes.set(sessionId, {
+            resourceLoader: services.resourceLoader,
+            settingsManager: services.settingsManager,
+        });
+        this.revisions.set(sessionId, 1);
+        if (!this.thinkingSelections.has(sessionId)) {
+            this.thinkingSelections.set(sessionId, "auto");
+        }
+        if (this.disposedSessions.has(sessionId)) {
+            try {
+                session.dispose();
+            }
+            catch {
+                // ignore
+            }
+            this.sessions.delete(sessionId);
+            this.sessionManagers.delete(sessionId);
+            this.modelRuntimes.delete(sessionId);
+            this.sessionModels.delete(sessionId);
+            this.serviceScopes.delete(sessionId);
+            this.revisions.delete(sessionId);
+            this.thinkingSelections.delete(sessionId);
+        }
+    }
+    /** Cached session-less custom tool definitions (operator + explore). */
+    async loadCustomTools() {
+        const [operatorCustomTools, exploreCustomTools] = await Promise.all([
+            this.loadOperatorCustomTools(),
+            this.loadExploreCustomTools(),
+        ]);
+        return [...operatorCustomTools, ...exploreCustomTools];
+    }
+    loadOperatorCustomTools() {
+        if (!this.options.actionContext)
+            return Promise.resolve([]);
+        if (!this.operatorCustomToolsPromise) {
+            this.operatorCustomToolsPromise = buildCustomOperatorTools({
+                actionContext: this.options.actionContext,
+            }).catch((error) => {
+                process.stderr.write(`[console] chat custom-tools build failed: ${error instanceof Error ? error.message : String(error)}\n`);
+                // Allow a later create/reopen to retry after a transient failure.
+                this.operatorCustomToolsPromise = undefined;
+                return [];
+            });
+        }
+        return this.operatorCustomToolsPromise;
+    }
+    loadExploreCustomTools() {
+        if (!this.exploreCustomToolsPromise) {
+            this.exploreCustomToolsPromise = buildExploreCustomTools({
+                repoRoot: this.options.cwd,
+            }).catch((error) => {
+                process.stderr.write(`[console] chat explore-tools build failed: ${error instanceof Error ? error.message : String(error)}\n`);
+                this.exploreCustomToolsPromise = undefined;
+                return [];
+            });
+        }
+        return this.exploreCustomToolsPromise;
+    }
+    async forkSession(init) {
+        if (!this.bindings.forkSessionManager)
+            throw new Error("SESSION_FORK_UNSUPPORTED");
+        const sessionId = `operator-chat-${randomBytes(12).toString("hex")}`;
+        const sessionManager = await this.bindings.forkSessionManager({
+            sourcePath: init.sourceSessionFile,
+            targetCwd: this.options.cwd,
+            targetSessionDir: this.options.sessionDir,
+            targetSessionId: sessionId,
+        });
+        const built = await this.buildSessionWithServices({
+            sessionManager,
+            model: init.model,
+        });
+        built.session.setActiveToolsByName(computeOperatorChatActiveToolNames(built.session));
+        this.sessions.set(sessionId, built.session);
+        this.sessionManagers.set(sessionId, sessionManager);
+        this.modelRuntimes.set(sessionId, built.modelRuntime);
+        this.sessionModels.set(sessionId, init.model);
+        this.serviceScopes.set(sessionId, built.services);
+        this.revisions.set(sessionId, 1);
+        this.thinkingSelections.set(sessionId, "auto");
+        this.sessionInit.set(sessionId, { status: "ready" });
+        return {
+            sessionId,
+            sessionFile: built.session.sessionFile,
+            createdAt: new Date().toISOString(),
+            model: init.model,
+            activeTools: built.session.getActiveToolNames(),
+        };
+    }
+    async branchSession(input) {
+        const session = this.sessions.get(input.sessionId);
+        const manager = this.sessionManagers.get(input.sessionId);
+        if (!session || !manager)
+            throw new Error(`chat session not active: ${input.sessionId}`);
+        if (session.isStreaming === true || session.isIdle === false)
+            throw new Error("CHAT_TURN_ACTIVE");
+        if (!manager.getEntry?.(input.branchFromEntryId))
+            throw new Error("BRANCH_ENTRY_NOT_FOUND");
+        if (!this.mainlineLeaves.has(input.sessionId))
+            this.mainlineLeaves.set(input.sessionId, manager.getLeafId?.());
+        const entry = input.summary
+            ? manager.branchWithSummary?.(input.branchFromEntryId, input.summary)
+            : (manager.branch(input.branchFromEntryId), undefined);
+        return {
+            branchedFromEntryId: input.branchFromEntryId,
+            ...(entry?.id ? { branchSummaryEntryId: entry.id } : {}),
+        };
+    }
+    switchToMainline(sessionId) {
+        const manager = this.sessionManagers.get(sessionId);
+        if (!manager)
+            throw new Error(`chat session not active: ${sessionId}`);
+        manager.branch(this.mainlineLeaves.get(sessionId));
+        this.mainlineLeaves.delete(sessionId);
+    }
+    getBranchContext(sessionId) {
+        const manager = this.sessionManagers.get(sessionId);
+        if (!manager)
+            throw new Error(`chat session not active: ${sessionId}`);
+        return {
+            leafId: manager.getLeafId?.() ?? null,
+            entries: manager.getBranch?.() ?? [],
+        };
+    }
+    async listModels(sessionId) {
+        await this.ensureSessionReady(sessionId);
+        const modelRuntime = this.modelRuntimes.get(sessionId);
+        if (!this.sessions.has(sessionId) || !modelRuntime)
+            throw new Error(`chat session not active: ${sessionId}`);
+        return this.bindings.listAvailableModels({ modelRuntime });
+    }
+    async applyModel(sessionId, model) {
+        await this.ensureSessionReady(sessionId);
+        const session = this.sessions.get(sessionId);
+        const modelRuntime = this.modelRuntimes.get(sessionId);
+        if (!session || !modelRuntime)
+            throw new Error(`chat session not active: ${sessionId}`);
+        if (!session.setModel)
+            throw new Error("MODEL_SWITCH_UNSUPPORTED");
+        const resolved = this.bindings.resolveModel({
+            modelRuntime,
+            provider: model.provider,
+            modelId: model.modelId,
+        });
+        if (!resolved)
+            throw new Error("MODEL_NOT_AVAILABLE");
+        await session.setModel(resolved);
+        this.bumpRevision(sessionId);
+        return {
+            provider: session.model?.provider ?? model.provider,
+            modelId: session.model?.id ?? session.model?.modelId ?? model.modelId,
+        };
+    }
+    /**
+     * Apply a thinking-level selection. `auto` records the selection WITHOUT
+     * sending any explicit override (the SDK keeps its own default); an explicit
+     * level calls `session.setThinkingLevel`. Returns the effective value.
+     */
+    applyThinkingLevel(sessionId, level) {
+        const state = this.sessionInit.get(sessionId);
+        if (state?.status === "failed")
+            throw state.error;
+        if (state?.status === "initializing") {
+            throw new Error(`chat session not active: ${sessionId}`);
+        }
+        const session = this.sessions.get(sessionId);
+        if (!session)
+            throw new Error(`chat session not active: ${sessionId}`);
+        if (level === "auto") {
+            this.thinkingSelections.set(sessionId, "auto");
+            this.bumpRevision(sessionId);
+            return "auto";
+        }
+        if (!THINKING_LEVELS.includes(level) || !session.setThinkingLevel)
+            throw new Error("THINKING_LEVEL_UNSUPPORTED");
+        session.setThinkingLevel(level);
+        this.thinkingSelections.set(sessionId, level);
+        this.bumpRevision(sessionId);
+        return session.thinkingLevel ?? level;
+    }
+    getRuntimeSelection(sessionId) {
+        const session = this.sessions.get(sessionId);
+        if (!session)
+            return { activeTools: [] };
+        const stored = this.sessionModels.get(sessionId);
+        const provider = session.model?.provider ?? stored?.provider;
+        const modelId = session.model?.id ?? session.model?.modelId ?? stored?.modelId;
+        return {
+            ...(provider && modelId ? { model: { provider, modelId } } : {}),
+            ...(session.thinkingLevel
+                ? { thinkingLevel: session.thinkingLevel }
+                : {}),
+            activeTools: session.getActiveToolNames(),
+        };
+    }
+    bumpRevision(sessionId) {
+        this.revisions.set(sessionId, (this.revisions.get(sessionId) ?? 0) + 1);
+    }
+    /**
+     * Resolve the RAW system prompt actually injected into the Pi session
+     * (design §2.2 / AC-03). Fallback chain: agent.state.systemPrompt →
+     * session.systemPrompt getter → ResourceLoader.getSystemPrompt() → the
+     * composed operator-chat base prompt. Never returns empty.
+     */
+    async getRuntimeSystemPrompt(sessionId) {
+        await this.ensureSessionReady(sessionId).catch(() => undefined);
+        const session = this.sessions.get(sessionId);
+        if (!session)
+            return composeOperatorChatSystemPrompt({});
+        const fromState = session.state?.systemPrompt;
+        const fromGetter = session.systemPrompt;
+        const loader = this.serviceScopes.get(sessionId)?.resourceLoader;
+        return (fromState ||
+            fromGetter ||
+            loader?.getSystemPrompt?.() ||
+            composeOperatorChatSystemPrompt({}));
+    }
+    /**
+     * Read the RAW system prompt for the snapshot, converting any projection
+     * failure into the structured critical error (RF-02): a broken system prompt
+     * source must fail the whole snapshot with 503 PI_RUNTIME_UNAVAILABLE rather
+     * than silently fabricate prompt text.
+     */
+    async readRawSystemPrompt(sessionId) {
+        try {
+            return await this.getRuntimeSystemPrompt(sessionId);
+        }
+        catch (error) {
+            throw new RuntimeSnapshotUnavailableError(`system prompt projection failed: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    /**
+     * Official Pi session reload (AC-05 / AC-06). Rejects with a structured
+     * code while the session is busy (streaming / compacting / bash in flight /
+     * duplicate reload) — never aborts, never silently queues.
+     */
+    async reloadSession(sessionId) {
+        try {
+            await this.ensureSessionReady(sessionId);
+        }
+        catch (error) {
+            if (error instanceof PiSessionInitFailedError) {
+                return { ok: false, code: error.code, message: error.message };
+            }
+            return {
+                ok: false,
+                code: "PI_SESSION_NOT_FOUND",
+                message: error instanceof Error ? error.message : String(error),
+            };
+        }
+        const session = this.sessions.get(sessionId);
+        if (!session) {
+            return {
+                ok: false,
+                code: "PI_SESSION_NOT_FOUND",
+                message: `chat session not active: ${sessionId}`,
+            };
+        }
+        // RF2-03: the per-sessionId in-flight lock is checked FIRST — before the
+        // streaming/compacting/bash/support checks. JS runs check-then-add in one
+        // synchronous segment, so two concurrent calls cannot both pass; the lock
+        // is released in `finally` on BOTH the success and the error path, and
+        // different sessions never block each other. Priority matters: the first
+        // reload() may synchronously flip isIdle/isCompacting/isBashRunning/
+        // hasPendingBashMessages to busy, and a second concurrent call must still
+        // report the reload-in-flight busy (not the streaming/compacting one).
+        if (this.reloadInFlight.has(sessionId)) {
+            return {
+                ok: false,
+                code: "PI_SESSION_BUSY",
+                message: "session is busy (reload in flight); reload rejected without abort",
+            };
+        }
+        const busyReasons = [];
+        if (session.isStreaming === true || session.isIdle === false)
+            busyReasons.push("streaming");
+        if (session.isCompacting === true)
+            busyReasons.push("compacting");
+        if (session.isBashRunning === true)
+            busyReasons.push("bash running");
+        if (session.hasPendingBashMessages === true)
+            busyReasons.push("bash messages pending");
+        if (busyReasons.length > 0) {
+            return {
+                ok: false,
+                code: "PI_SESSION_BUSY",
+                message: `session is busy (${busyReasons.join(", ")}); reload rejected without abort`,
+            };
+        }
+        if (typeof session.reload !== "function") {
+            return {
+                ok: false,
+                code: "PI_RELOAD_FAILED",
+                message: "this Pi runtime does not support session.reload()",
+            };
+        }
+        this.reloadInFlight.add(sessionId);
+        try {
+            // Refresh prefs cache so skillsOverride applied during reload sees
+            // the latest resource-preferences.json written by PATCH.
+            await this.refreshSkillPrefsCache().catch(() => undefined);
+            await session.reload();
+        }
+        catch (error) {
+            return {
+                ok: false,
+                code: "PI_RELOAD_FAILED",
+                message: error instanceof Error ? error.message : String(error),
+            };
+        }
+        finally {
+            this.reloadInFlight.delete(sessionId);
+        }
+        this.bumpRevision(sessionId);
+        return { ok: true, revision: this.revisions.get(sessionId) ?? 0 };
+    }
+    /**
+     * Project the unified live runtime snapshot (design §2.2). The current Pi
+     * session is the single source of truth: real system prompt, real model /
+     * thinking selection (auto + effective), the session modelRuntime model
+     * list, and the session ResourceLoader inventories. Undefined when the
+     * session is not active — callers fail closed instead of fabricating data.
+     */
+    /**
+     * ConsolePiRuntime.listSlashCommands
+     * Browser-safe slash command projection for UI-11.
+     * Sources: current Session extension commands, prompt templates, skills.
+     * Never returns prompt/skill file bodies.
+     */
+    async listSlashCommands(sessionId) {
+        const scrub = (value) => {
+            const raw = String(value ?? "");
+            return raw
+                .replace(/\/Users\/[^\s]+/gi, "~")
+                .replace(/[A-Za-z]:\\Users\\[^\s]+/gi, "~")
+                .slice(0, 240);
+        };
+        // Fail soft at the HTTP layer: bubble readiness errors so routes can attach
+        // a compact warning while the UI keeps local Operator/Pi Web commands.
+        await this.ensureSessionReady(sessionId);
+        const session = this.sessions.get(sessionId);
+        if (!session)
+            return { commands: [] };
+        // Same-name conflict priority (AC-3): extension > skill > prompt.
+        // Enum order must not decide the winner — prompt-before-skill still loses.
+        const SOURCE_RANK = {
+            extension: 0,
+            skill: 1,
+            prompt: 2,
+        };
+        const byKey = new Map();
+        const sourceWarnings = [];
+        const push = (command, label, description, source) => {
+            const name = command.startsWith("/") ? command : `/${command}`;
+            const key = name.toLowerCase();
+            if (!key || key === "/")
+                return;
+            const next = {
+                command: name,
+                label: (label || name).slice(0, 80),
+                description: scrub(description),
+                source,
+            };
+            const existing = byKey.get(key);
+            if (!existing || SOURCE_RANK[source] < SOURCE_RANK[existing.source]) {
+                byKey.set(key, next);
+            }
+        };
+        try {
+            const cmds = session.extensionRunner?.getRegisteredCommands?.() ?? [];
+            for (const cmd of cmds) {
+                const name = cmd.invocationName || cmd.name;
+                if (!name)
+                    continue;
+                push(String(name), String(cmd.name || name), String(cmd.description || ""), "extension");
+            }
+        }
+        catch (error) {
+            // Source isolation: keep other sources; surface compact warning (AC-3).
+            sourceWarnings.push(`extension: ${scrub(error instanceof Error ? error.message : String(error))}`);
+        }
+        try {
+            // Enumerate prompts before skills on purpose: priority must still let skill win.
+            for (const tpl of session.promptTemplates ?? []) {
+                if (!tpl?.name)
+                    continue;
+                push(String(tpl.name), String(tpl.name), String(tpl.description || ""), "prompt");
+            }
+        }
+        catch (error) {
+            sourceWarnings.push(`prompt: ${scrub(error instanceof Error ? error.message : String(error))}`);
+        }
+        try {
+            const services = this.serviceScopes.get(sessionId);
+            const resourceLoader = services?.resourceLoader;
+            const skills = resourceLoader?.getSkills?.()?.skills ?? [];
+            for (const skill of skills) {
+                if (!skill?.name)
+                    continue;
+                const command = skill.name.startsWith("skill:")
+                    ? `/${skill.name}`
+                    : `/skill:${skill.name}`;
+                push(command, skill.name, String(skill.description || ""), "skill");
+            }
+        }
+        catch (error) {
+            sourceWarnings.push(`skill: ${scrub(error instanceof Error ? error.message : String(error))}`);
+        }
+        const warning = sourceWarnings.length > 0
+            ? sourceWarnings.join("; ").slice(0, 160)
+            : undefined;
+        return {
+            commands: [...byKey.values()],
+            ...(warning ? { warning } : {}),
+        };
+    }
+    async getRuntimeSnapshot(sessionId, options) {
+        try {
+            await this.ensureSessionReady(sessionId);
+        }
+        catch (error) {
+            if (error instanceof PiSessionInitFailedError)
+                throw error;
+            // Inactive / unknown session: fail closed with undefined (no fabricated snapshot).
+            return undefined;
+        }
+        const session = this.sessions.get(sessionId);
+        if (!session)
+            return undefined;
+        const services = this.serviceScopes.get(sessionId);
+        const modelRuntime = this.modelRuntimes.get(sessionId);
+        const resourceLoader = services?.resourceLoader;
+        const settingsManager = services?.settingsManager;
+        const thinkingSelection = this.thinkingSelections.get(sessionId) ?? "auto";
+        const effectiveThinkingLevel = session.thinkingLevel ??
+            settingsManager?.getDefaultThinkingLevel?.() ??
+            (thinkingSelection === "auto" ? undefined : thinkingSelection);
+        const rawSystemPrompt = await this.readRawSystemPrompt(sessionId);
+        // Models come from the session modelRuntime. A model-enumeration failure
+        // is a CRITICAL projection failure (RF-02): it throws
+        // RuntimeSnapshotUnavailableError so consuming routes return 503
+        // PI_RUNTIME_UNAVAILABLE — never a fabricated empty model list.
+        let models = [];
+        if (modelRuntime) {
+            try {
+                models = this.bindings
+                    .listAvailableModels({ modelRuntime })
+                    .map((entry) => ({
+                    provider: entry.provider,
+                    id: entry.id,
+                    ...(entry.name ? { name: entry.name } : {}),
+                    hasCredentials: entry.hasCredentials,
+                }));
+            }
+            catch (error) {
+                throw new RuntimeSnapshotUnavailableError(`model enumeration failed: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
+        // Thinking options: auto is always offered; explicit levels only when the
+        // runtime session supports setThinkingLevel (xhigh/max ship with the SDK
+        // and therefore surface only when this runtime provides them).
+        const supportedLevels = typeof session.setThinkingLevel === "function"
+            ? [...THINKING_LEVELS]
+            : [];
+        const thinkingLevels = [
+            { value: "auto" },
+            ...supportedLevels.map((value) => ({ value })),
+        ];
+        // Resource inventories from the session ResourceLoader (ADR 0012 open
+        // surface). Missing loader → real empty lists, never fabricated entries.
+        // Each subface is isolated (RF-02): a throwing subface keeps the other
+        // inventories AND surfaces a structured retryable diagnostic instead of
+        // silently dropping the whole resource projection.
+        const contextFiles = [];
+        const skills = [];
+        const extensions = [];
+        const diagnostics = [];
+        const resolvedResources = [];
+        const resourceFailure = (subface, error) => {
+            diagnostics.push({
+                type: "error",
+                code: "RESOURCE_LOAD_FAILED",
+                message: `${subface} inventory failed: ${error instanceof Error ? error.message : String(error)}`,
+                retryable: true,
+            });
+        };
+        if (resourceLoader) {
+            try {
+                const agentsFiles = resourceLoader.getAgentsFiles?.();
+                for (const file of agentsFiles?.agentsFiles ?? []) {
+                    if (!file.path)
+                        continue;
+                    contextFiles.push({
+                        path: file.path,
+                        characters: file.content?.length ?? 0,
+                    });
+                }
+            }
+            catch (error) {
+                resourceFailure("context files", error);
+            }
+            // Preferences are the source of truth for UI auto-invocation state;
+            // loader disableModelInvocation may also reflect frontmatter. Prefer
+            // explicit preference (default on) when projecting autoInvocationEnabled.
+            let skillPrefs = { schemaVersion: 1, skills: {} };
+            try {
+                skillPrefs = await this.loadSkillAutoInvocationPreferences();
+            }
+            catch (error) {
+                diagnostics.push({
+                    type: "error",
+                    code: "PI_RESOURCE_PREFERENCES_MALFORMED",
+                    message: error instanceof Error ? error.message : String(error),
+                    retryable: true,
+                });
+            }
+            try {
+                const skillsResult = resourceLoader.getSkills?.();
+                for (const skill of skillsResult?.skills ?? []) {
+                    const resourceId = skillResourceId({
+                        name: skill.name,
+                        filePath: skill.filePath,
+                    });
+                    // Preference off always means autoInvocationEnabled=false even if
+                    // loader already applied disableModelInvocation. Frontmatter-only
+                    // disable (no preference) also surfaces as autoInvocationEnabled=false.
+                    const prefEnabled = isAutoInvocationEnabled(skillPrefs, resourceId);
+                    const autoInvocationEnabled = prefEnabled && skill.disableModelInvocation !== true;
+                    skills.push({
+                        name: skill.name,
+                        description: skill.description ?? "",
+                        path: skill.filePath,
+                        ...(skill.baseDir ? { baseDir: skill.baseDir } : {}),
+                        scope: skill.sourceInfo?.scope ?? "unknown",
+                        source: skill.sourceInfo?.source ?? "",
+                        resourceId,
+                        autoInvocationEnabled,
+                        diagnostics: [],
+                    });
+                    resolvedResources.push({
+                        type: "skill",
+                        name: skill.name,
+                        path: skill.filePath,
+                        source: skill.sourceInfo?.source ?? "",
+                        scope: skill.sourceInfo?.scope ?? "unknown",
+                    });
+                }
+                for (const diag of skillsResult?.diagnostics ?? []) {
+                    if (!diag?.message)
+                        continue;
+                    diagnostics.push({
+                        type: diag.type ?? "warning",
+                        message: diag.message,
+                        ...(diag.path ? { path: diag.path } : {}),
+                    });
+                }
+            }
+            catch (error) {
+                resourceFailure("skills", error);
+            }
+            try {
+                const extResult = resourceLoader.getExtensions?.();
+                for (const ext of extResult?.extensions ?? []) {
+                    const path = ext.resolvedPath ?? ext.path ?? "";
+                    extensions.push({
+                        name: ext.sourceInfo?.source ?? ext.path ?? "extension",
+                        path,
+                        ...(ext.resolvedPath ? { resolvedPath: ext.resolvedPath } : {}),
+                        source: ext.sourceInfo?.source ?? "",
+                        scope: ext.sourceInfo?.scope ?? "unknown",
+                        ...(ext.sourceInfo?.origin ? { origin: ext.sourceInfo.origin } : {}),
+                        enabled: true,
+                    });
+                    resolvedResources.push({
+                        type: "extension",
+                        name: ext.sourceInfo?.source ?? ext.path ?? "extension",
+                        path,
+                        source: ext.sourceInfo?.source ?? "",
+                        scope: ext.sourceInfo?.scope ?? "unknown",
+                    });
+                }
+                for (const err of extResult?.errors ?? []) {
+                    if (!err?.error)
+                        continue;
+                    diagnostics.push({
+                        type: "error",
+                        message: err.error,
+                        ...(err.path ? { path: err.path } : {}),
+                    });
+                }
+            }
+            catch (error) {
+                resourceFailure("extensions", error);
+            }
+            try {
+                const promptsResult = resourceLoader.getPrompts?.();
+                for (const prompt of promptsResult?.prompts ?? []) {
+                    resolvedResources.push({
+                        type: "prompt",
+                        name: prompt.name,
+                        path: prompt.filePath,
+                        source: prompt.sourceInfo?.source ?? "",
+                        scope: prompt.sourceInfo?.scope ?? "unknown",
+                    });
+                }
+                for (const diag of promptsResult?.diagnostics ?? []) {
+                    if (!diag?.message)
+                        continue;
+                    diagnostics.push({
+                        type: diag.type ?? "warning",
+                        message: diag.message,
+                        ...(diag.path ? { path: diag.path } : {}),
+                    });
+                }
+            }
+            catch (error) {
+                resourceFailure("prompts", error);
+            }
+            try {
+                const themesResult = resourceLoader.getThemes?.();
+                for (const theme of themesResult?.themes ?? []) {
+                    if (!theme.path)
+                        continue;
+                    resolvedResources.push({
+                        type: "theme",
+                        name: theme.name ?? theme.path,
+                        path: theme.path,
+                        source: "",
+                        scope: "unknown",
+                    });
+                }
+                for (const diag of themesResult?.diagnostics ?? []) {
+                    if (!diag?.message)
+                        continue;
+                    diagnostics.push({
+                        type: diag.type ?? "warning",
+                        message: diag.message,
+                        ...(diag.path ? { path: diag.path } : {}),
+                    });
+                }
+            }
+            catch (error) {
+                resourceFailure("themes", error);
+            }
+        }
+        // Packages: Pi settings specs + resolved resource metadata. Fields the SDK
+        // does not expose stay absent (real missing, never fabricated). A
+        // readPackageInventory failure is a PARTIAL failure (RF-02): the snapshot
+        // stays 200 with a structured retryable diagnostic — never a silent
+        // fake-empty package list.
+        const { readPackageInventory } = await import("./pi-console-config.js");
+        let packages = [];
+        try {
+            packages = (await readPackageInventory(await safeGetAgentDir(this.bindings), this.options.cwd, resolvedResources));
+        }
+        catch (error) {
+            packages = [];
+            diagnostics.push({
+                type: "error",
+                code: "PACKAGE_INVENTORY_FAILED",
+                message: error instanceof Error ? error.message : String(error),
+                retryable: true,
+            });
+        }
+        const { readMcpInventory } = await import("./mcp-inventory.js");
+        let mcp = { servers: [], unassignedTools: [] };
+        try {
+            mcp = await readMcpInventory({
+                agentDir: await safeGetAgentDir(this.bindings),
+                cwd: this.options.cwd,
+                tools: session.getAllTools?.() ?? [],
+                activeToolNames: session.getActiveToolNames(),
+            });
+        }
+        catch (error) {
+            diagnostics.push({
+                type: "error",
+                code: "MCP_INVENTORY_FAILED",
+                message: error instanceof Error ? error.message : String(error),
+                retryable: true,
+            });
+        }
+        return projectRuntimeSnapshot({
+            sessionId,
+            revision: this.revisions.get(sessionId) ?? 0,
+            loadedAt: new Date().toISOString(),
+            selection: {
+                ...(session.model?.provider &&
+                    (session.model?.id ?? session.model?.modelId)
+                    ? {
+                        model: {
+                            provider: session.model.provider,
+                            id: session.model.id ?? session.model.modelId,
+                            ...(session.model.name ? { name: session.model.name } : {}),
+                        },
+                    }
+                    : {}),
+                thinkingSelection,
+                ...(effectiveThinkingLevel
+                    ? { effectiveThinkingLevel: effectiveThinkingLevel }
+                    : {}),
+            },
+            models,
+            thinkingLevels,
+            systemPrompt: {
+                ...(options?.includeRaw ? { raw: rawSystemPrompt } : {}),
+                // The RAW prompt flows into the projection: text is scrubbed +
+                // length-limited while sha256/characters stay RAW-based (design §2.2).
+                text: rawSystemPrompt,
+                sha256: createHash("sha256").update(rawSystemPrompt).digest("hex"),
+                characters: rawSystemPrompt.length,
+            },
+            activeTools: session.getActiveToolNames(),
+            contextFiles,
+            skills,
+            extensions,
+            packages,
+            mcp,
+            diagnostics,
+            hasBash: true,
+        });
+    }
+    /**
+     * Re-open a previously persisted Chat session after Console restart or
+     * browser refresh (roadmap M1-S04 / S05).
+     *
+     * Unlike `createSession`, this reuses the EXISTING Pi JSONL session file so
+     * the conversation history is preserved. The SDK's `SessionManager.open(path)`
+     * loads the file; we then rebuild the same services + pinned tool surface so
+     * the operator-chat three-gate policy still applies after a restart.
+     *
+     * Fail-closed contract: if `sessionFile` is missing, or the SDK cannot open
+     * it (file deleted/corrupt), returns an `{ ok: false, code }` result rather
+     * than silently creating a fresh empty session and losing prior context.
+     */
+    async reopenSession(init) {
+        const sessionId = init.sessionId;
+        // Wait for in-flight create materialization rather than racing reopen.
+        const initState = this.sessionInit.get(sessionId);
+        if (initState?.status === "initializing") {
+            try {
+                await initState.promise;
+            }
+            catch {
+                // failure recorded on sessionInit
+            }
+        }
+        const failed = this.sessionInit.get(sessionId);
+        if (failed?.status === "failed") {
+            return {
+                ok: false,
+                code: "PI_SESSION_INIT_FAILED",
+                message: failed.error.message,
+            };
+        }
+        // Already active in-memory: idempotent reopen is a no-op success.
+        if (this.sessions.has(sessionId)) {
+            return { ok: true, handle: await this.snapshotActive(sessionId) };
+        }
+        if (!init.sessionFile) {
+            return {
+                ok: false,
+                code: "NO_SESSION_FILE",
+                message: `cannot reopen chat session ${sessionId}: no persisted Pi session file`,
+            };
+        }
+        let sessionManager;
+        try {
+            sessionManager = await this.bindings.openSessionManager({
+                sessionFile: init.sessionFile,
+            });
+        }
+        catch (error) {
+            return {
+                ok: false,
+                code: "REOPEN_FAILED",
+                message: error instanceof Error ? error.message : String(error),
+            };
+        }
+        if (!sessionManager) {
+            return {
+                ok: false,
+                code: "REOPEN_FAILED",
+                message: `Pi session file missing or not openable: ${init.sessionFile}`,
+            };
+        }
+        const managerSessionId = readSessionManagerId(sessionManager);
+        if (managerSessionId && managerSessionId !== sessionId) {
+            return {
+                ok: false,
+                code: "REOPEN_FAILED",
+                message: `reopened Pi sessionId mismatch: expected ${sessionId}, got ${managerSessionId}`,
+            };
+        }
+        try {
+            const built = await this.buildSessionWithServices({
+                sessionManager,
+                model: init.model,
+                systemPromptSuffix: init.systemPromptSuffix,
+            });
+            const session = built.session;
+            // Prefer the SessionManager id (from the JSONL header). Some SDK
+            // builds expose a different agent-session UUID on `session.sessionId`
+            // even when the manager correctly reopened our operator-chat file —
+            // map by the durable Console sessionId in that case.
+            const reportedId = session.sessionId ?? managerSessionId;
+            if (reportedId &&
+                reportedId !== sessionId &&
+                managerSessionId !== sessionId) {
+                try {
+                    session.dispose();
+                }
+                catch {
+                    // ignore
+                }
+                return {
+                    ok: false,
+                    code: "REOPEN_FAILED",
+                    message: `reopened Pi sessionId mismatch: expected ${sessionId}, got ${reportedId}`,
+                };
+            }
+            session.setActiveToolsByName(computeOperatorChatActiveToolNames(session));
+            this.sessions.set(sessionId, session);
+            this.sessionManagers.set(sessionId, sessionManager);
+            this.modelRuntimes.set(sessionId, built.modelRuntime);
+            this.sessionModels.set(sessionId, init.model);
+            this.serviceScopes.set(sessionId, built.services);
+            this.revisions.set(sessionId, 1);
+            this.thinkingSelections.set(sessionId, "auto");
+            this.sessionInit.set(sessionId, { status: "ready" });
+            return {
+                ok: true,
+                handle: {
+                    sessionId,
+                    sessionFile: session.sessionFile ?? init.sessionFile,
+                    createdAt: new Date().toISOString(),
+                    model: init.model,
+                    activeTools: session.getActiveToolNames(),
+                },
+            };
+        }
+        catch (error) {
+            return {
+                ok: false,
+                code: "REOPEN_FAILED",
+                message: error instanceof Error ? error.message : String(error),
+            };
+        }
+    }
+    /** Build a handle for an already-active session (idempotent reopen path). */
+    async snapshotActive(sessionId) {
+        const session = this.sessions.get(sessionId);
+        const stored = this.sessionModels.get(sessionId);
+        const fromSession = session.model?.provider
+            ? {
+                provider: session.model.provider,
+                modelId: session.model.id ??
+                    session.model.modelId ??
+                    "",
+            }
+            : undefined;
+        const model = stored ??
+            (fromSession?.modelId ? fromSession : undefined);
+        return {
+            sessionId,
+            sessionFile: session.sessionFile,
+            createdAt: new Date().toISOString(),
+            model,
+            activeTools: session.getActiveToolNames(),
+        };
+    }
+    /**
+     * Shared services + pinned-tool materialization for reopen/fork paths.
+     * Create uses startMaterialization instead so the durable shell can return
+     * before AgentSession is ready. Tool definitions reuse runtime-level caches.
+     */
+    async buildSessionWithServices(init) {
+        const agentDir = await safeGetAgentDir(this.bindings);
+        const appendSystemPrompt = [
+            OPERATOR_CHAT_SYSTEM_PROMPT_BASE,
+            ...(init.systemPromptSuffix ? [init.systemPromptSuffix] : []),
+        ];
+        await this.refreshSkillPrefsCache().catch(() => undefined);
+        const { services } = await this.bindings.createServices({
+            cwd: this.options.cwd,
+            agentDir,
+            resourceLoaderOptions: await this.buildResourceLoaderOptions({
+                appendSystemPrompt,
+            }),
+        });
+        const modelRuntime = services.modelRuntime;
+        const resolvedModel = init.model
+            ? (this.bindings.resolveModel({
+                modelRuntime,
+                provider: init.model.provider,
+                modelId: init.model.modelId,
+            }) ?? undefined)
+            : undefined;
+        assertNoWriteToolInList(OPERATOR_CHAT_ALLOWED_TOOLS);
+        const customTools = await this.loadCustomTools();
+        const { session } = await this.bindings.createSessionFromServices({
+            services,
+            sessionManager: init.sessionManager,
+            excludeTools: [...OPERATOR_CHAT_SESSION_EXCLUDE_TOOLS],
+            ...(customTools.length > 0 ? { customTools } : {}),
+            ...(resolvedModel ? { model: resolvedModel } : {}),
+        });
+        await bindSessionExtensions(session);
+        pinOperatorChatTools(session);
+        return {
+            session,
+            modelRuntime,
+            services: {
+                resourceLoader: services.resourceLoader,
+                settingsManager: services.settingsManager,
+            },
+        };
+    }
+    /** Re-open a previously created session (cross-request). */
+    open(sessionId) {
+        return this.sessions.get(sessionId);
+    }
+    hasSession(sessionId) {
+        return this.sessions.has(sessionId);
+    }
+    /**
+     * Live runtime busy facts for /state reconcile. isPromptRunning is owned by
+     * this Console admission fence; other flags mirror the Pi session when present.
+     */
+    getSessionBusyFacts(sessionId) {
+        const session = this.sessions.get(sessionId);
+        const isPromptRunning = this.promptOwners.has(sessionId);
+        return {
+            isStreaming: session?.isStreaming === true || isPromptRunning,
+            isPromptRunning,
+            isCompacting: session?.isCompacting === true,
+            isBashRunning: session?.isBashRunning === true ||
+                session?.hasPendingBashMessages === true,
+        };
+    }
+    /**
+     * Send a prompt and stream events. Gate 3: each tool invocation is
+     * re-authorized by authorizeOperatorChatTool before the dispatcher runs it
+     * (the dispatcher is wired by the HTTP layer, see chat-session.ts).
+     *
+     * Prompt ownership is acquired synchronously before the first await so two
+     * concurrent prompts on the same Session cannot both enter the SDK path.
+     */
+    async prompt(sessionId, text, onEvent, options) {
+        // Synchronous admission fence — before any await.
+        if (this.promptOwners.has(sessionId)) {
+            throw new Error("CHAT_TURN_ACTIVE");
+        }
+        this.promptOwners.add(sessionId);
+        let unsub;
+        let abortPromise;
+        const onAbort = () => {
+            // M1 T08 / AC-R3-003: Stop must abort only the current turn, NEVER
+            // dispose the session. Await session.abort() so ownership settles
+            // after the SDK reports idle. When abort is unavailable, fail closed
+            // non-destructively — Session stays reusable; terminal closeout or
+            // /state reconcile still converges ownership.
+            const session = this.sessions.get(sessionId);
+            if (!session)
+                return;
+            try {
+                if (typeof session.abort === "function") {
+                    abortPromise = Promise.resolve(session.abort()).catch(() => undefined);
+                }
+                // else: do not call session.dispose() — Stop never destroys Session.
+            }
+            catch {
+                // ignore
+            }
+        };
+        try {
+            // AC-FIX-002: if Stop already fired before readiness, never start model work.
+            if (options?.signal?.aborted) {
+                return;
+            }
+            // First message while creating waits on the same materialization promise.
+            await this.ensureSessionReady(sessionId);
+            // Abort may land during readiness (or between readiness and prompt).
+            if (options?.signal?.aborted) {
+                return;
+            }
+            const session = this.sessions.get(sessionId);
+            if (!session) {
+                throw new Error(`chat session not found: ${sessionId}`);
+            }
+            // Gate 2 (re-pin before each turn): interview turns pass through the
+            // existing closed interview allow/deny registry. The next ordinary turn
+            // explicitly restores the normal Operator Chat set (baseline + extension
+            // tools, ADR 0012).
+            const requestedTools = OPERATOR_CHAT_ACTIVE_TOOL_NAMES();
+            const activeTools = options?.mode === "requirement-interview"
+                ? filterActiveInterviewTools(requestedTools).allowed
+                : computeOperatorChatActiveToolNames(session);
+            session.setActiveToolsByName(activeTools);
+            // Final pre-prompt fence: abort after tool pin must still skip session.prompt.
+            if (options?.signal?.aborted) {
+                return;
+            }
+            const emitContextUsage = () => {
+                try {
+                    const contextUsage = session.getSessionStats?.()?.contextUsage;
+                    if (!contextUsage)
+                        return;
+                    if (contextUsage.contextWindow <= 0 &&
+                        contextUsage.percent === null &&
+                        contextUsage.tokens === null) {
+                        return;
+                    }
+                    onEvent({
+                        type: "usage",
+                        sessionId,
+                        usage: {
+                            inputTokens: 0,
+                            outputTokens: 0,
+                            totalTokens: 0,
+                            contextUsage,
+                        },
+                    });
+                }
+                catch {
+                    // Stats getter is best-effort; never break the event stream.
+                }
+            };
+            emitContextUsage();
+            unsub = session.subscribe((event) => {
+                const mapped = mapSdkEvent(sessionId, event);
+                if (mapped)
+                    onEvent(mapped);
+                // Pi puts per-assistant-message usage on `message.usage` ({ input, output,
+                // cacheRead, cacheWrite, totalTokens, cost }). Emit on message_end so
+                // multi-step tool turns accumulate like pi-web SessionInfoBar; turn_end
+                // repeats the final message and must not double-count.
+                if (event.type === "message_end") {
+                    const usage = extractUsageSample(event);
+                    if (usage)
+                        onEvent({ type: "usage", sessionId, usage });
+                    emitContextUsage();
+                }
+                // Keep the context fill bar live through the turn (pi-web SessionInfoBar).
+                if (event.type === "agent_start" ||
+                    event.type === "agent_settled" ||
+                    event.type === "tool_execution_end") {
+                    emitContextUsage();
+                }
+            });
+            options?.signal?.addEventListener("abort", onAbort);
+            if (options?.signal?.aborted) {
+                onAbort();
+                if (abortPromise)
+                    await abortPromise.catch(() => undefined);
+                return;
+            }
+            try {
+                await session.prompt(text, options?.images?.length ? { images: options.images } : undefined);
+                // Wait until the session reports idle / not streaming. The SDK prompt()
+                // resolves when the agent turn completes, but post-turn continuation
+                // (auto-compaction / follow-up) may still be in flight. We poll isIdle.
+                // While polling we emit periodic heartbeat events so the SSE stream
+                // keeps proxies/browsers from timing out (no other data is flowing).
+                await waitForIdle(session, {
+                    signal: options?.signal,
+                    onHeartbeat: () => onEvent({ type: "heartbeat", sessionId }),
+                });
+                if (abortPromise)
+                    await abortPromise;
+                // User abort is closed out as Turn state `aborted`; do not publish a
+                // red ordinary error event for intentional Stop.
+                if (!options?.signal?.aborted) {
+                    onEvent({ type: "agent_settled", sessionId });
+                }
+            }
+            catch (error) {
+                if (abortPromise)
+                    await abortPromise.catch(() => undefined);
+                if (options?.signal?.aborted) {
+                    // User abort: swallow ordinary error publication (AC-FIX-003).
+                    return;
+                }
+                const message = error instanceof Error ? error.message : String(error);
+                onEvent({ type: "error", sessionId, message });
+                throw error;
+            }
+            finally {
+                options?.signal?.removeEventListener("abort", onAbort);
+                unsub?.();
+            }
+        }
+        finally {
+            this.promptOwners.delete(sessionId);
+        }
+    }
+    /** Generate exactly one title in an isolated in-memory, tool-less LOW session. */
+    async generateTitle(sessionId, firstUserText) {
+        if (this.titleInFlight.has(sessionId))
+            return undefined;
+        this.titleInFlight.add(sessionId);
+        let session;
+        let unsubscribe;
+        let timeout;
+        try {
+            const { services } = await this.bindings.createServices({
+                cwd: this.options.cwd,
+                agentDir: await safeGetAgentDir(this.bindings),
+                // The detached title worker has a closed title-only resource surface:
+                // no project/user context, extensions, skills, prompt templates, or
+                // themes. Its sole system prompt is deliberately minimal; never append
+                // the operator-chat prompt or any loaded resource text.
+                resourceLoaderOptions: {
+                    noContextFiles: true,
+                    noSkills: true,
+                    noExtensions: true,
+                    noPromptTemplates: true,
+                    noThemes: true,
+                    systemPrompt: "Generate one concise plain-text session title in the user's primary language. Return only the title.",
+                },
+            });
+            const low = await resolveLowChatModel(this.options.cwd, this.bindings.listAvailableModels({ modelRuntime: services.modelRuntime }));
+            if (!low)
+                return undefined;
+            const model = this.bindings.resolveModel({
+                modelRuntime: services.modelRuntime,
+                provider: low.provider,
+                modelId: low.modelId,
+            });
+            if (!model)
+                return undefined;
+            if (!this.bindings.createInMemorySessionManager)
+                return undefined;
+            const sessionManager = await this.bindings.createInMemorySessionManager({
+                cwd: this.options.cwd,
+            });
+            const created = await this.bindings.createSessionFromServices({
+                services,
+                sessionManager,
+                noTools: "all",
+                tools: [],
+                customTools: [],
+                model,
+            });
+            session = created.session;
+            let output = "";
+            unsubscribe = session.subscribe((event) => {
+                if (event.type === "message_end")
+                    output = extractAssistantText(event.message);
+            });
+            const controller = new AbortController();
+            timeout = setTimeout(() => controller.abort(), 10_000);
+            await Promise.race([
+                session.prompt(`User message:\n${firstUserText.slice(0, 1200)}`, { signal: controller.signal }),
+                new Promise((_, reject) => controller.signal.addEventListener("abort", () => reject(new Error("TITLE_TIMEOUT")), { once: true })),
+            ]);
+            return output;
+        }
+        catch {
+            return undefined;
+        }
+        finally {
+            if (timeout)
+                clearTimeout(timeout);
+            unsubscribe?.();
+            try {
+                await session?.abort?.();
+            }
+            catch { /* abort converges before disposal */ }
+            try {
+                session?.dispose();
+            }
+            catch { /* isolated title cleanup is best-effort */ }
+            this.titleInFlight.delete(sessionId);
+        }
+    }
+    /** Pi session_info mirror after durable automatic-title persistence.
+     * Callers own the detached catch boundary so synchronous throws and rejected
+     * mirror Promises are both observed without affecting durable Chat state. */
+    async setSessionName(sessionId, title) {
+        await this.sessions.get(sessionId)?.setSessionName?.(title);
+    }
+    async compact(sessionId, customInstructions) {
+        const session = this.sessions.get(sessionId);
+        if (!session)
+            throw new Error(`chat session not found: ${sessionId}`);
+        if (session.isStreaming === true || session.isIdle === false)
+            throw new Error("CHAT_TURN_ACTIVE");
+        if (typeof session.compact !== "function")
+            throw new Error("COMPACTION_UNSUPPORTED");
+        const result = await session.compact(customInstructions);
+        return projectCompactSnapshot(result ?? {});
+    }
+    dispose(sessionId) {
+        // Mark disposed first so a late materialization never registers ready.
+        this.disposedSessions.add(sessionId);
+        this.sessionInit.delete(sessionId);
+        const session = this.sessions.get(sessionId);
+        if (session) {
+            try {
+                session.dispose();
+            }
+            catch {
+                // ignore
+            }
+        }
+        this.sessions.delete(sessionId);
+        this.sessionManagers.delete(sessionId);
+        this.mainlineLeaves.delete(sessionId);
+        this.modelRuntimes.delete(sessionId);
+        this.sessionModels.delete(sessionId);
+        this.serviceScopes.delete(sessionId);
+        this.revisions.delete(sessionId);
+        this.thinkingSelections.delete(sessionId);
+        this.reloadInFlight.delete(sessionId);
+    }
+    disposeAll() {
+        for (const id of [...this.sessions.keys()])
+            this.dispose(id);
+    }
+}
+function mapAssistantMessageEvent(type, sessionId, message) {
+    const content = extractAssistantContentBlocks(message);
+    return {
+        type,
+        sessionId,
+        text: extractAssistantText(message),
+        ...(content.length > 0 ? { content } : {}),
+    };
+}
+function mapSdkEvent(sessionId, event) {
+    switch (event.type) {
+        case "agent_start":
+            return { type: "agent_start", sessionId };
+        case "agent_end":
+            return {
+                type: "agent_end",
+                sessionId,
+                willRetry: Boolean(event.willRetry),
+            };
+        case "message_update":
+            if (!isAssistantSdkMessage(event.message))
+                return undefined;
+            return mapAssistantMessageEvent("message_update", sessionId, event.message);
+        case "message_end":
+            if (!isAssistantSdkMessage(event.message))
+                return undefined;
+            return mapAssistantMessageEvent("message_end", sessionId, event.message);
+        case "turn_end":
+            // Usage is emitted from message_end (see prompt subscribe). turn_end
+            // carries the same final assistant message and would double-count.
+            return undefined;
+        case "tool_execution_start":
+            return {
+                type: "tool_call",
+                sessionId,
+                toolCallId: event.toolCallId,
+                toolName: event.toolName,
+                args: event.args,
+            };
+        case "tool_execution_end":
+            return {
+                type: "tool_result",
+                sessionId,
+                toolCallId: event.toolCallId,
+                toolName: event.toolName,
+                result: event.result,
+                isError: event.isError,
+            };
+        case "agent_settled":
+            return { type: "agent_settled", sessionId };
+        default:
+            return undefined;
+    }
+}
+async function waitForIdle(session, options) {
+    // Default 45s — shorter than the previous 120s so a stuck SDK session does
+    // not pin an HTTP connection for two full minutes. The SDK agent turn
+    // normally settles in seconds; 45s covers auto-compaction/follow-up tails
+    // while staying under typical proxy idle timeouts (60s).
+    const timeoutMs = options?.timeoutMs ?? 45_000;
+    const heartbeatIntervalMs = options?.heartbeatIntervalMs ?? 10_000;
+    const start = Date.now();
+    let lastHeartbeat = start;
+    // eslint-disable-next-line no-constant-condition
+    while (true) {
+        if (options?.signal?.aborted)
+            return;
+        if (session.isIdle === true)
+            return;
+        if (session.isStreaming === false)
+            return;
+        const now = Date.now();
+        if (now - start > timeoutMs)
+            return;
+        if (options?.onHeartbeat && now - lastHeartbeat >= heartbeatIntervalMs) {
+            lastHeartbeat = now;
+            try {
+                options.onHeartbeat();
+            }
+            catch {
+                // Heartbeat is best-effort; never let it break the wait loop.
+            }
+        }
+        await new Promise((r) => setTimeout(r, 50));
+    }
+}
+async function safeGetAgentDir(bindings) {
+    try {
+        return await bindings.getAgentDir();
+    }
+    catch {
+        // Fall back to a Console-app-data scoped agent dir so we never accidentally
+        // touch the user's real ~/.pi/agent config if getAgentDir throws.
+        return path.join(process.cwd(), ".harness", "console", "pi-agent-dir");
+    }
+}
+/**
+ * Cached SDK module loader. The pi-coding-agent package is ESM-only, so we
+ * must use dynamic import() (not require). Cached to avoid repeated imports.
+ */
+let cachedSdk;
+async function loadSdk() {
+    if (!cachedSdk) {
+        cachedSdk = import("@earendil-works/pi-coding-agent");
+    }
+    return cachedSdk;
+}
+/**
+ * Default production bindings backed by the real Pi SDK (services mode).
+ * Dynamically imported so the worker bundle does not hard-fail if the SDK is
+ * absent at module load (discovered lazily by pi-readiness instead).
+ */
+export function createDefaultPiSdkBindings() {
+    return {
+        getAgentDir: async () => {
+            const sdk = (await loadSdk());
+            return sdk.getAgentDir();
+        },
+        createServices: async (opts) => {
+            const sdk = (await loadSdk());
+            // createAgentSessionServices returns the full AgentSessionServices object
+            // directly (cwd/agentDir/modelRuntime/settingsManager/resourceLoader).
+            // Wrap it so our type contract is satisfied.
+            const result = await sdk.createAgentSessionServices({
+                cwd: opts.cwd,
+                agentDir: opts.agentDir,
+                resourceLoaderOptions: opts.resourceLoaderOptions,
+            });
+            return { services: result };
+        },
+        createSessionFromServices: async (opts) => {
+            const sdk = (await loadSdk());
+            return sdk.createAgentSessionFromServices({
+                services: opts.services,
+                sessionManager: opts.sessionManager,
+                ...(opts.tools ? { tools: opts.tools } : {}),
+                ...(opts.noTools ? { noTools: opts.noTools } : {}),
+                ...(opts.excludeTools ? { excludeTools: opts.excludeTools } : {}),
+                ...(opts.customTools ? { customTools: opts.customTools } : {}),
+                ...(opts.model ? { model: opts.model } : {}),
+            });
+        },
+        createSessionManager: async (opts) => {
+            const sdk = (await loadSdk());
+            return sdk.SessionManager.create(opts.cwd, opts.sessionDir, {
+                id: opts.sessionId,
+            });
+        },
+        createInMemorySessionManager: async (opts) => {
+            const sdk = (await loadSdk());
+            return sdk.SessionManager.inMemory(opts.cwd);
+        },
+        forkSessionManager: async (opts) => {
+            const sdk = (await loadSdk());
+            return sdk.SessionManager.forkFrom(opts.sourcePath, opts.targetCwd, opts.targetSessionDir, { id: opts.targetSessionId });
+        },
+        openSessionManager: async (opts) => {
+            const sdk = (await loadSdk());
+            try {
+                // Pi SessionManager.open(missingPath) does NOT throw — it creates a
+                // fresh in-memory session with a random UUID. That would reopen the
+                // wrong conversation under the durable Console sessionId. Fail closed
+                // before open when the persisted file is absent.
+                await access(opts.sessionFile);
+                return sdk.SessionManager.open(opts.sessionFile);
+            }
+            catch {
+                // Missing/corrupt session file — caller fails closed rather than
+                // silently creating a fresh session and losing prior context.
+                return undefined;
+            }
+        },
+        resolveModel: (opts) => {
+            const rt = opts.modelRuntime;
+            if (typeof rt?.getModel !== "function")
+                return undefined;
+            try {
+                return rt.getModel(opts.provider, opts.modelId);
+            }
+            catch {
+                return undefined;
+            }
+        },
+        listAvailableModels: (opts) => {
+            const rt = opts.modelRuntime;
+            const available = rt?.snapshot?.available ?? [];
+            const configured = rt?.snapshot?.configuredProviders;
+            const isConfigured = (provider) => configured instanceof Set ? configured.has(provider) : false;
+            return available.map((m) => ({
+                id: m.id,
+                name: m.name,
+                provider: m.provider,
+                hasCredentials: isConfigured(m.provider),
+            }));
+        },
+    };
+}
+/**
+ * Re-export the tool gate for the dispatcher layer so the per-tool-call gate
+ * (Gate 3) lives in exactly one place.
+ */
+export { authorizeOperatorChatTool, assertNoWriteToolInList, OPERATOR_CHAT_ALLOWED_TOOLS, };