@tea-agent/loop-agent 0.1.0-fe-test.0

package/dist/worker/console/chat/tool-adapter.js

@@ -0,0 +1,131 @@
+/**
+ * Operator Chat — operator action → Pi tool schema adapter (roadmap M0-C).
+ *
+ * The capabilities registry (src/shared/operator/capabilities.ts) is the
+ * SINGLE source of truth for each action's typed input schema AND its model
+ * policy (modelCallable / humanConfirmation). This adapter renders that
+ * registry into the descriptor shape the Pi model invokes; it no longer
+ * maintains a second hand-written INPUT_PARAMS table (that drift risk is gone).
+ *
+ * High-risk / long-running actions ARE mapped as tools (2026-07-25 widening),
+ * but the registry now declares their modelCallable policy:
+ *   - "always": model can invoke; dispatch runs server-side (2026-08-11:
+ *     runDag/dagRerun/standaloneTaskRerun/workerTaskRetry are autonomous —
+ *     runDag consumes a server-issued single-use execution receipt, and the
+ *     recovery actions pass server-side read-only run-facts checks).
+ *   - "prepare-only": model can invoke but the mutation needs a human-origin
+ *     confirmation (Night Scheduler mutation-gate faces).
+ *   - "never": the action is the human confirmation itself (confirmDagConfirmation)
+ *     and MUST NOT appear as a model-callable tool (M0-B / roadmap G03).
+ *
+ * The adapter does NOT register tools with the SDK directly — that is the
+ * session layer's job (chat/pi-runtime.ts). This keeps the adapter pure and
+ * unit-testable against the registry.
+ */
+import { buildOperatorCapabilitiesDocument } from "../../../shared/operator/capabilities.js";
+/**
+ * Executable mutation faces reserved for browser HumanGate routes.
+ *
+ * Derived from the capabilities registry: any action that still requires human
+ * confirmation (and is not itself the confirm step with modelCallable=never)
+ * must NOT be registered as a model-executable tool. The model may only call
+ * prepare helpers (prepareDagConfirmation / prepareMutationGate); the browser
+ * mutation gate + HMAC token perform the consuming dispatch.
+ *
+ * 2026-08-11: runDag / dagRerun / standaloneTaskRerun / workerTaskRetry are no
+ * longer gate-only (autonomous execution + run-facts checks) and drop out of
+ * this derived list automatically.
+ *
+ * `contractApply` is also gate-only even though its registry face remains
+ * `humanConfirmation: "conditional"` (assessment soft-gate for workspace UI);
+ * Chat executes it only via the contract-apply Human Gate route.
+ */
+const EXPLICIT_EXECUTABLE_GATE_ONLY = ["contractApply"];
+export function listExecutableGateOnlyActions() {
+    const derived = buildOperatorCapabilitiesDocument()
+        .actions.filter((action) => action.humanConfirmation === "required" &&
+        action.modelCallable !== "never")
+        .map((action) => action.action);
+    return [...new Set([...EXPLICIT_EXECUTABLE_GATE_ONLY, ...derived])].sort();
+}
+/** Frozen snapshot for tests / drift checks (recomputed from registry). */
+export const EXECUTABLE_GATE_ONLY_ACTIONS = Object.freeze(listExecutableGateOnlyActions());
+const EXECUTABLE_GATE_ONLY = new Set(EXECUTABLE_GATE_ONLY_ACTIONS);
+/**
+ * Build the FULL Chat tool schema set from the capabilities registry — every
+ * registry action, INCLUDING modelCallable="never" ones (e.g.
+ * confirmDagConfirmation). Used by internal audits / capability surfaces that
+ * need to see the complete registry. The session layer uses
+ * buildModelCallableToolSchemas() to render only model-callable tools.
+ */
+export function buildOperatorChatToolSchemas() {
+    const doc = buildOperatorCapabilitiesDocument();
+    const out = [];
+    for (const action of doc.actions) {
+        // Fail-closed: every registry action MUST carry inputParams. An action
+        // missing inputParams is a contract gap (the model could call it but we
+        // don't know which params its dispatcher reads). Throw at boot so the gap
+        // is caught in tests and never ships.
+        if (!Array.isArray(action.inputParams)) {
+            throw new Error(`Operator Chat tool schema gap: registry action "${action.action}" has no inputParams. Add inputParams (must match the dispatcher's paramsOf reads) in src/shared/operator/capabilities.ts.`);
+        }
+        out.push({
+            toolId: action.action,
+            action: action.action,
+            description: action.description,
+            cli: action.cli,
+            kind: action.kind,
+            inputParams: action.inputParams.map((p) => ({
+                name: p.name,
+                type: p.type,
+                required: p.required,
+                description: p.description,
+                ...(p.itemsType ? { itemsType: p.itemsType } : {}),
+            })),
+            modelCallable: action.modelCallable,
+            humanConfirmation: action.humanConfirmation,
+            ...(action.resultPolicy ? { resultPolicy: action.resultPolicy } : {}),
+        });
+    }
+    return out;
+}
+/**
+ * Build ONLY the model-callable tool schemas — i.e. exclude
+ * modelCallable="never" actions (roadmap M0-B / G03). This is the set the Pi
+ * session actually registers as custom tools: the human confirmation action
+ * (confirmDagConfirmation) is NOT a model tool; it can only be invoked by the
+ * browser mutation gate with a server-signed confirmation token.
+ */
+export function buildModelCallableToolSchemas() {
+    return buildOperatorChatToolSchemas().filter((s) => s.modelCallable !== "never" && !EXECUTABLE_GATE_ONLY.has(s.action));
+}
+/**
+ * Names of actions that MUST NOT be model-callable (roadmap G03 / G14).
+ * Derived from the registry so adding a "never" policy there is the only edit
+ * needed. Used by the three-gate tool whitelist to deny model invocation.
+ */
+export function modelForbiddenActions() {
+    return buildOperatorChatToolSchemas()
+        .filter((s) => s.modelCallable === "never" || EXECUTABLE_GATE_ONLY.has(s.action))
+        .map((s) => s.action);
+}
+/**
+ * Verify the adapter covers exactly the registry and nothing more.
+ * Used by boot/red-team checks (V15 — the full registry is schema'd).
+ */
+export function verifyOperatorChatToolSurface() {
+    const schemas = buildOperatorChatToolSchemas();
+    const doc = buildOperatorCapabilitiesDocument();
+    const covered = schemas.map((s) => s.action).sort();
+    const expected = doc.actions.map((a) => a.action).sort();
+    const coveredSet = new Set(covered);
+    const expectedSet = new Set(expected);
+    const missing = expected.filter((a) => !coveredSet.has(a));
+    const extra = covered.filter((a) => !expectedSet.has(a));
+    return {
+        ok: missing.length === 0 && extra.length === 0,
+        covered,
+        missing,
+        extra,
+    };
+}

package/dist/worker/console/chat/tool-preview.js

@@ -0,0 +1,247 @@
+/**
+ * Human-readable tool argument / result projection for Operator Chat (UI-04).
+ *
+ * Display-only: never mutates raw Pi ToolResult, session JSONL, or model context.
+ */
+const PREVIEW_KEYS = [
+    "command",
+    "query",
+    "operation",
+    "tool",
+    "server",
+    "symbol",
+    "path",
+    "file_path",
+    "filePath",
+    "pattern",
+    "glob",
+    "url",
+];
+const DEFAULT_PREVIEW_MAX = 120;
+const DEFAULT_RESULT_MAX = 800;
+function asRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return undefined;
+    return value;
+}
+function parseArgs(args) {
+    if (args === undefined || args === null)
+        return undefined;
+    if (typeof args === "string") {
+        const trimmed = args.trim();
+        if (!trimmed)
+            return undefined;
+        try {
+            return asRecord(JSON.parse(trimmed));
+        }
+        catch {
+            return undefined;
+        }
+    }
+    return asRecord(args);
+}
+function clampOneLine(value, maxLen) {
+    const s = value.replace(/\s+/g, " ").trim();
+    if (!s)
+        return "";
+    return s.length > maxLen ? `${s.slice(0, maxLen)}…` : s;
+}
+function fieldString(input, key) {
+    const value = input[key];
+    if (typeof value === "string" && value.trim())
+        return value.trim();
+    if (typeof value === "number" && Number.isFinite(value))
+        return String(value);
+    return undefined;
+}
+/** Tool-specific header adapters (display only). */
+function adapterPreview(toolName, input, maxLen) {
+    const name = (toolName ?? "").toLowerCase();
+    if (name === "bash" || name === "shell") {
+        const command = fieldString(input, "command");
+        return command ? clampOneLine(command, maxLen) : undefined;
+    }
+    if (name === "mcp" || name.startsWith("mcp_")) {
+        const server = fieldString(input, "server");
+        const tool = fieldString(input, "tool") ?? fieldString(input, "name");
+        const query = fieldString(input, "query");
+        if (server && tool)
+            return clampOneLine(`${server} · ${tool}`, maxLen);
+        if (tool)
+            return clampOneLine(tool, maxLen);
+        if (query)
+            return clampOneLine(query, maxLen);
+        if (server)
+            return clampOneLine(server, maxLen);
+        return undefined;
+    }
+    if (name === "lsp_navigation" || name.includes("lsp")) {
+        const parts = [
+            fieldString(input, "operation"),
+            fieldString(input, "symbol"),
+            fieldString(input, "path") ??
+                fieldString(input, "file_path") ??
+                fieldString(input, "filePath"),
+        ].filter(Boolean);
+        const line = fieldString(input, "line") ?? fieldString(input, "position");
+        if (parts.length === 0 && !line)
+            return undefined;
+        const base = parts.join(" · ");
+        return clampOneLine(line ? `${base}${base ? ":" : ""}${line}` : base, maxLen);
+    }
+    if (name === "symbol_search" || name.includes("symbol_search")) {
+        const query = fieldString(input, "query") ?? fieldString(input, "symbol");
+        return query ? clampOneLine(query, maxLen) : undefined;
+    }
+    if (name === "read" ||
+        name === "read_symbol" ||
+        name === "read_enclosing" ||
+        name.startsWith("read_")) {
+        const path = fieldString(input, "path") ??
+            fieldString(input, "file_path") ??
+            fieldString(input, "filePath");
+        const symbol = fieldString(input, "symbol");
+        const line = fieldString(input, "line");
+        if (!path && !symbol)
+            return undefined;
+        const bits = [path, symbol, line].filter(Boolean);
+        return clampOneLine(bits.join(" · "), maxLen);
+    }
+    // Family prefixes (pi-lens / codegraph) — generic field heuristic below.
+    return undefined;
+}
+/** One-line summary for a tool-call header; empty when nothing useful. */
+export function getToolPreview(args, options) {
+    const maxLen = options?.maxLen ?? DEFAULT_PREVIEW_MAX;
+    const input = parseArgs(args);
+    if (!input) {
+        if (typeof args === "string") {
+            const s = args.replace(/\s+/g, " ").trim();
+            if (!s || s === "{}")
+                return "";
+            return s.length > maxLen ? `${s.slice(0, maxLen)}…` : s;
+        }
+        return "";
+    }
+    const adapted = adapterPreview(options?.toolName, input, maxLen);
+    if (adapted)
+        return adapted;
+    for (const key of PREVIEW_KEYS) {
+        const value = input[key];
+        if (typeof value === "string" && value.trim()) {
+            return clampOneLine(value, maxLen);
+        }
+    }
+    const keys = Object.keys(input);
+    if (keys.length === 0)
+        return "";
+    const first = input[keys[0]];
+    const s = String(first ?? "").replace(/\s+/g, " ").trim();
+    if (!s)
+        return "";
+    return s.length > maxLen ? `${s.slice(0, maxLen)}…` : s;
+}
+/** Section labels for ToolCard expand body. */
+export function getToolSectionLabels(toolName) {
+    const name = (toolName ?? "").toLowerCase();
+    if (name === "bash" || name === "shell") {
+        return { argsLabel: "命令", resultLabel: "输出" };
+    }
+    if (name === "mcp" || name.startsWith("mcp_")) {
+        return { argsLabel: "参数", resultLabel: "结果" };
+    }
+    return { argsLabel: "入参", resultLabel: "结果" };
+}
+/**
+ * Extract human-readable text from a Pi ToolResult-like value or its
+ * already-serialized browser preview string.
+ */
+export function extractToolResultText(result) {
+    if (result === undefined || result === null)
+        return "";
+    if (typeof result === "string") {
+        const trimmed = result.trim();
+        if (!trimmed)
+            return "";
+        // Prefer unwrapping standard Pi ToolResult JSON shells.
+        if ((trimmed.startsWith("{") && trimmed.endsWith("}")) ||
+            (trimmed.startsWith("[") && trimmed.endsWith("]"))) {
+            try {
+                return extractToolResultText(JSON.parse(trimmed));
+            }
+            catch {
+                return result;
+            }
+        }
+        return result;
+    }
+    if (typeof result === "number" || typeof result === "boolean") {
+        return String(result);
+    }
+    const record = asRecord(result);
+    if (!record) {
+        try {
+            return JSON.stringify(result, null, 2);
+        }
+        catch {
+            return String(result);
+        }
+    }
+    // Standard Pi ToolResult: { content: [{ type: "text", text }] }
+    const content = record.content;
+    if (Array.isArray(content)) {
+        const texts = [];
+        for (const block of content) {
+            const item = asRecord(block);
+            if (!item)
+                continue;
+            if (item.type === "text" && typeof item.text === "string") {
+                texts.push(item.text);
+            }
+            else if (typeof item.text === "string") {
+                texts.push(item.text);
+            }
+        }
+        if (texts.length > 0)
+            return texts.join("\n");
+    }
+    if (typeof record.text === "string")
+        return record.text;
+    if (typeof record.output === "string")
+        return record.output;
+    if (typeof record.message === "string")
+        return record.message;
+    try {
+        return JSON.stringify(result, null, 2);
+    }
+    catch {
+        return String(result);
+    }
+}
+export function formatToolArgsDisplay(args) {
+    if (args === undefined || args === null)
+        return "";
+    try {
+        return typeof args === "string" ? args : JSON.stringify(args, null, 2);
+    }
+    catch {
+        return String(args);
+    }
+}
+export function truncateToolResult(text, options) {
+    if (text === undefined)
+        return { text: "", truncated: false };
+    const maxLen = options?.maxLen ?? DEFAULT_RESULT_MAX;
+    if (text.length <= maxLen)
+        return { text, truncated: false };
+    return { text: `${text.slice(0, maxLen)}…`, truncated: true };
+}
+export function toolCallDurationSeconds(createdAt, finishedAt) {
+    if (finishedAt === undefined ||
+        !Number.isFinite(createdAt) ||
+        !Number.isFinite(finishedAt)) {
+        return undefined;
+    }
+    const secs = Math.round((finishedAt - createdAt) / 1000);
+    return secs > 0 ? secs : undefined;
+}

package/dist/worker/console/chat/tools.js

@@ -0,0 +1,212 @@
+/**
+ * Operator Chat — tool policy (ADR 0011 UX-first full Pi tools).
+ *
+ * Operator Chat registers and activates full Pi builtins
+ * (read/write/edit/bash/grep/find/ls) plus model-callable operator actions and
+ * optional safe-* explore custom tools. Discipline is primarily soft
+ * (system prompt: prefer DAG paths). Hard denies remain for non-Pi
+ * write channels (apply_patch / full-tools / shell / coding-chat) and for
+ * modelCallable="never" actions (e.g. confirmDagConfirmation).
+ *
+ * 2026-08-11: runDag / dagRerun / standaloneTaskRerun / workerTaskRetry are
+ * model-callable (autonomous DAG execution); the browser Human Gate still
+ * covers Night Scheduler mutations, contractApply and confirmDagConfirmation.
+ *
+ * Interview / Official surfaces keep their own OFFICIAL_DENIED path; this
+ * module only filters Chat-side denial so Interview is not widened.
+ */
+import { buildOperatorCapabilitiesDocument } from "../../../shared/operator/capabilities.js";
+import { OFFICIAL_DENIED_TOOL_IDS } from "../resource-loader.js";
+import { EXECUTABLE_GATE_ONLY_ACTIONS } from "./tool-adapter.js";
+const EXECUTABLE_GATE_ONLY = new Set(EXECUTABLE_GATE_ONLY_ACTIONS);
+/**
+ * Actions the model MAY invoke. Derived from the registry but filtered by the
+ * modelCallable policy: modelCallable="never" actions (e.g. confirmDagConfirmation)
+ * are the human confirmation itself and MUST NOT be model-callable (roadmap
+ * M0-B / G03). They are never registered as Pi tools AND denied at the gate.
+ */
+export const OPERATOR_CHAT_ALLOWED_TOOLS = Object.freeze(buildOperatorCapabilitiesDocument()
+    .actions.filter((a) => a.modelCallable !== "never" && !EXECUTABLE_GATE_ONLY.has(a.action))
+    .map((a) => a.action));
+/**
+ * Operator actions that MUST NOT be model-callable (roadmap M0-B / G03).
+ * Derived from the registry's modelCallable="never" policy. These are the
+ * human confirmation actions (confirmDagConfirmation) — the model can only
+ * prepare them; the browser mutation gate executes the confirm with a
+ * server-signed confirmation token.
+ */
+export const OPERATOR_CHAT_MODEL_FORBIDDEN_ACTIONS = Object.freeze(buildOperatorCapabilitiesDocument()
+    .actions.filter((a) => a.modelCallable === "never" || EXECUTABLE_GATE_ONLY.has(a.action))
+    .map((a) => a.action));
+/**
+ * Operator actions denied by the legacy MVP boundary. Kept EMPTY since the
+ * owner decided (2026-07-25) that the full operator surface is Chat-callable.
+ * Retained (empty) so downstream guards referencing it keep compiling and
+ * stay defensive against future additions.
+ */
+export const OPERATOR_CHAT_DENIED_OPERATOR_ACTIONS = Object.freeze([]);
+/** Full Pi builtin explore / coding tools admitted by ADR 0011. */
+export const OPERATOR_CHAT_PI_BUILTIN_TOOLS = Object.freeze([
+    "read",
+    "write",
+    "edit",
+    "bash",
+    "grep",
+    "find",
+    "ls",
+]);
+const _PI_BUILTIN_ALLOW = new Set(OPERATOR_CHAT_PI_BUILTIN_TOOLS.map((t) => t.toLowerCase()));
+// Operator actions that OFFICIAL_DENIED_TOOL_IDS carries for Interview safety
+// but that the Chat now deliberately allows. Compare on a COMPACTED form
+// (strip - and _) because OFFICIAL lists both camelCase and snake_case.
+const _ALLOWED_OPERATOR_ACTIONS_COMPACT = new Set(OPERATOR_CHAT_ALLOWED_TOOLS.map((t) => t.toLowerCase().replace(/[-_]/g, "")));
+/**
+ * Tools denied for Operator Chat. Built from OFFICIAL_DENIED minus:
+ * - Pi builtins allowed by ADR 0011
+ * - model-callable operator actions
+ * Does NOT re-add bash/read/grep/edit/write.
+ */
+export const OPERATOR_CHAT_DENIED_TOOLS = Object.freeze([
+    ...new Set(OFFICIAL_DENIED_TOOL_IDS.filter((id) => {
+        const lower = id.toLowerCase();
+        if (_PI_BUILTIN_ALLOW.has(lower))
+            return false;
+        if (_ALLOWED_OPERATOR_ACTIONS_COMPACT.has(lower.replace(/[-_]/g, ""))) {
+            return false;
+        }
+        return true;
+    })),
+]);
+/**
+ * Operator actions denied by model policy (modelCallable="never"). These are
+ * human-only actions (the confirmation itself) — derived from the registry so
+ * adding a "never" policy there is the only edit needed. Kept separate from
+ * OPERATOR_CHAT_DENIED_OPERATOR_ACTIONS (legacy empty MVP boundary list) to
+ * preserve the two distinct concerns (model policy vs MVP mutation boundary).
+ */
+const DENIED_MODEL_POLICY = new Set(OPERATOR_CHAT_MODEL_FORBIDDEN_ACTIONS.map((a) => a.toLowerCase()));
+const ALLOWED = new Set(OPERATOR_CHAT_ALLOWED_TOOLS.map((t) => t.toLowerCase()));
+const DENIED_ACTIONS = new Set(OPERATOR_CHAT_DENIED_OPERATOR_ACTIONS.map((a) => a.toLowerCase()));
+const DENIED_TOOLS = new Set(OPERATOR_CHAT_DENIED_TOOLS.map((t) => t.toLowerCase()));
+/** Pi builtins are authorized without being operator registry actions. */
+const PI_BUILTIN_AUTHORIZED = new Set(OPERATOR_CHAT_PI_BUILTIN_TOOLS.map((t) => t.toLowerCase()));
+export function isOperatorChatToolAllowed(toolId) {
+    const id = toolId.trim().toLowerCase();
+    if (PI_BUILTIN_AUTHORIZED.has(id))
+        return true;
+    return ALLOWED.has(id);
+}
+export function isOperatorChatToolDenied(toolId) {
+    const id = toolId.trim().toLowerCase();
+    // Pi builtins are never denied under ADR 0011.
+    if (PI_BUILTIN_AUTHORIZED.has(id))
+        return false;
+    if (DENIED_TOOLS.has(id))
+        return true;
+    if (DENIED_ACTIONS.has(id))
+        return true;
+    // modelCallable="never" actions are always denied to the model (roadmap G03).
+    if (DENIED_MODEL_POLICY.has(id))
+        return true;
+    // normalize snake/camel/kebab
+    const compact = id.replace(/[-_]/g, "");
+    for (const d of DENIED_TOOLS) {
+        if (d.replace(/[-_]/g, "") === compact)
+            return true;
+    }
+    for (const d of DENIED_ACTIONS) {
+        if (d.replace(/[-_]/g, "") === compact)
+            return true;
+    }
+    for (const d of DENIED_MODEL_POLICY) {
+        if (d.replace(/[-_]/g, "") === compact)
+            return true;
+    }
+    return false;
+}
+/**
+ * Three-gate authorization (design §7.5): session create / setActiveTools /
+ * per-tool-call. Server-side only — UI hiding is insufficient.
+ */
+export function authorizeOperatorChatTool(toolId) {
+    const id = toolId.trim();
+    if (!id) {
+        return {
+            ok: false,
+            code: "tool-unknown",
+            toolId: id,
+            message: "empty tool id is not allowed in General Operator Chat",
+        };
+    }
+    if (isOperatorChatToolDenied(id)) {
+        return {
+            ok: false,
+            code: "tool-denied",
+            toolId: id,
+            message: `tool "${id}" is denied in General Operator Chat (no apply_patch/full-tools/shell/coding-chat; modelCallable=never still blocked)`,
+        };
+    }
+    if (!isOperatorChatToolAllowed(id)) {
+        return {
+            ok: false,
+            code: "tool-unknown",
+            toolId: id,
+            message: `tool "${id}" is not registered for General Operator Chat (new operator actions default to deny)`,
+        };
+    }
+    return { ok: true, toolId: id };
+}
+/**
+ * Filter a requested tool list against the Chat whitelist.
+ * Returns allowed + denied (for diagnostics / red-team evidence).
+ */
+export function filterOperatorChatTools(requested) {
+    const allowed = [];
+    const denied = [];
+    for (const toolId of requested) {
+        const decision = authorizeOperatorChatTool(toolId);
+        if (decision.ok)
+            allowed.push(decision.toolId);
+        else
+            denied.push(toolId);
+    }
+    return { allowed, denied };
+}
+/**
+ * Non-Pi write / coding channels that must never appear in Operator Chat.
+ * ADR 0011 allows Pi builtins read/write/edit/bash/grep/find/ls; this guard
+ * only blocks alternate coding surfaces (apply_patch, full-tools, shell,
+ * coding-chat).
+ */
+const NON_PI_WRITE_CHANNELS = [
+    "apply_patch",
+    "apply-patch",
+    "full-tools",
+    "full_tools",
+    "coding-chat",
+    "coding_chat",
+    "shell",
+];
+/**
+ * Assert that a requested tool set contains no prohibited non-Pi write
+ * channel. Pi builtins (including write/edit/bash) are allowed (ADR 0011).
+ */
+export function assertNoWriteToolInList(requested) {
+    const lower = new Set(requested.map((t) => t.trim().toLowerCase()));
+    for (const v of NON_PI_WRITE_CHANNELS) {
+        if (lower.has(v)) {
+            throw new Error(`non-Pi write channel "${v}" must not appear in Operator Chat tool list (ADR 0011)`);
+        }
+    }
+}
+/**
+ * Back-compat alias kept for callers that still reference the old name.
+ * @deprecated use {@link assertNoWriteToolInList}.
+ */
+export function assertNoBashInToolList(requested) {
+    assertNoWriteToolInList(requested);
+}
+/** Canonical sorted tool list to hand to setActiveToolsByName. */
+export function canonicalOperatorChatToolList() {
+    return [...OPERATOR_CHAT_ALLOWED_TOOLS].sort();
+}

package/dist/worker/console/chat/turn-execution-registry.js

@@ -0,0 +1,82 @@
+/**
+ * Session-scoped ownership of in-flight Chat Turn executions.
+ *
+ * Registry entries must exist before HTTP 202 is returned, and every
+ * completion path (success / abort / failure) must clear them in finally so
+ * durable active leases cannot outlive the owning process.
+ */
+function keyFor(sessionId, turnId) {
+    return `${sessionId}\0${turnId}`;
+}
+export function createChatTurnExecutionRegistry() {
+    const entries = new Map();
+    const bySession = new Map();
+    return {
+        register(input) {
+            const existingSession = bySession.get(input.sessionId);
+            if (existingSession && existingSession !== input.turnId) {
+                throw new Error(`CHAT_TURN_EXECUTION_ACTIVE: ${input.sessionId} already owns ${existingSession}`);
+            }
+            const key = keyFor(input.sessionId, input.turnId);
+            const prior = entries.get(key);
+            if (prior)
+                return prior;
+            let resolveCompletion;
+            const completion = new Promise((resolve) => {
+                resolveCompletion = resolve;
+            });
+            // Prevent unhandled rejection if nobody awaits.
+            void completion.catch(() => undefined);
+            const entry = {
+                sessionId: input.sessionId,
+                turnId: input.turnId,
+                clientRequestId: input.clientRequestId,
+                controller: input.controller ?? new AbortController(),
+                completion,
+                resolveCompletion,
+            };
+            entries.set(key, entry);
+            bySession.set(input.sessionId, input.turnId);
+            return entry;
+        },
+        get(sessionId, turnId) {
+            return entries.get(keyFor(sessionId, turnId));
+        },
+        getBySession(sessionId) {
+            const turnId = bySession.get(sessionId);
+            if (!turnId)
+                return undefined;
+            return entries.get(keyFor(sessionId, turnId));
+        },
+        clear(sessionId, turnId) {
+            const key = keyFor(sessionId, turnId);
+            entries.delete(key);
+            if (bySession.get(sessionId) === turnId)
+                bySession.delete(sessionId);
+        },
+        async waitForCompletion(sessionId, turnId, timeoutMs) {
+            const entry = entries.get(keyFor(sessionId, turnId));
+            if (!entry)
+                return { status: "missing" };
+            let timer;
+            try {
+                const outcome = await Promise.race([
+                    entry.completion.then((value) => ({ kind: "done", value })),
+                    new Promise((resolve) => {
+                        timer = setTimeout(() => resolve({ kind: "timeout" }), timeoutMs);
+                    }),
+                ]);
+                if (outcome.kind === "timeout")
+                    return { status: "timeout" };
+                return { status: "completed", outcome: outcome.value };
+            }
+            finally {
+                if (timer)
+                    clearTimeout(timer);
+            }
+        },
+        size() {
+            return entries.size;
+        },
+    };
+}