@tea-agent/loop-agent 0.22.0 → 0.23.1

package/dist/worker/console/chat/routes.js

@@ -0,0 +1,357 @@
+/**
+ * Operator Chat — HTTP route handlers (plan W7 / W8 backend).
+ *
+ * Routes (all under /api/operator/v1/chat):
+ *   POST /sessions              — create a new Chat session
+ *   GET  /sessions/:id          — fetch session metadata + messages
+ *   POST /sessions/:id/prompt   — SSE stream: send a prompt, stream events
+ *   GET  /sessions/:id/events   — SSE stream: (re)connect to live events
+ *   GET  /capabilities          — Chat tool surface + instruction skills
+ *   DELETE /sessions/:id        — dispose a Chat session
+ *
+ * Mutation routes go through the Console mutation gate (boot token + Origin).
+ * Read routes (GET capabilities / sessions) are open to loopback.
+ */
+import { OPERATOR_CHAT_ALLOWED_TOOLS, OPERATOR_CHAT_DENIED_TOOLS, OPERATOR_CHAT_DENIED_OPERATOR_ACTIONS, } from "./tools.js";
+import { OPERATOR_CHAT_ALLOWED_INSTRUCTION_SKILLS, composeInstructionSkillsPrompt, loadOperatorChatInstructionSkills, } from "./instruction-skills.js";
+import { buildOperatorChatToolSchemas } from "./tool-adapter.js";
+import { evaluateMutationGate, isMutationMethod, } from "../security.js";
+import { sendJson } from "../routes.js";
+import { openSseResponse, writeSseEvent, } from "../operation-sse.js";
+function writeChatSse(res, event) {
+    res.write(`event: ${event.kind}\n`);
+    res.write(`data: ${JSON.stringify(event)}\n\n`);
+}
+async function readJsonBody(req, maxBytes = 2 * 1024 * 1024) {
+    const chunks = [];
+    let total = 0;
+    for await (const chunk of req) {
+        const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        total += buf.length;
+        if (total > maxBytes) {
+            throw new Error(`request body exceeds ${maxBytes} bytes`);
+        }
+        chunks.push(buf);
+    }
+    if (chunks.length === 0)
+        return {};
+    const raw = Buffer.concat(chunks).toString("utf8");
+    if (!raw.trim())
+        return {};
+    return JSON.parse(raw);
+}
+function gateMutation(req, deps) {
+    const failure = evaluateMutationGate(req, {
+        bootToken: deps.bootToken.value,
+        confirmationToken: deps.bootToken.confirmationToken,
+        consoleOrigin: deps.getConsoleOrigin(),
+        allowNonLoopbackAccess: deps.allowNonLoopbackAccess,
+    });
+    if (failure) {
+        return {
+            ok: false,
+            status: failure.status,
+            code: failure.code,
+            message: failure.message,
+        };
+    }
+    return { ok: true };
+}
+export async function handleChatCapabilities(_req, res, deps) {
+    const toolSchemas = buildOperatorChatToolSchemas();
+    const skills = await loadOperatorChatInstructionSkills(deps.skillsDir);
+    sendJson(res, 200, {
+        ok: true,
+        schemaVersion: 1,
+        allowedTools: OPERATOR_CHAT_ALLOWED_TOOLS,
+        deniedTools: OPERATOR_CHAT_DENIED_TOOLS,
+        deniedOperatorActions: OPERATOR_CHAT_DENIED_OPERATOR_ACTIONS,
+        tools: toolSchemas,
+        instructionSkills: {
+            allowed: OPERATOR_CHAT_ALLOWED_INSTRUCTION_SKILLS,
+            loaded: skills.loaded.map((s) => ({
+                name: s.name,
+                description: s.description,
+                charCount: s.charCount,
+            })),
+            failures: skills.failures,
+            skipped: skills.skipped,
+            promptFragmentCharCount: composeInstructionSkillsPrompt(skills.loaded).length,
+        },
+        // bash is ALLOWED since the 2026-07-25 widening (read/explore tools
+        // enabled). File-WRITING tools (edit/write/apply_patch) stay excluded.
+        hasBash: true,
+    });
+}
+export async function handleCreateChatSession(req, res, deps) {
+    const gate = gateMutation(req, deps);
+    if (!gate.ok) {
+        sendJson(res, gate.status, {
+            ok: false,
+            error: { code: gate.code, message: gate.message },
+        });
+        return;
+    }
+    let body;
+    try {
+        body = await readJsonBody(req);
+    }
+    catch (error) {
+        sendJson(res, 400, {
+            ok: false,
+            error: {
+                code: "INVALID_INPUT",
+                message: error instanceof Error ? error.message : String(error),
+            },
+        });
+        return;
+    }
+    const provider = typeof body.modelProvider === "string" ? body.modelProvider : undefined;
+    const modelId = typeof body.modelId === "string" ? body.modelId : undefined;
+    try {
+        const handle = await deps.runtime.createSession({
+            ...(provider && modelId ? { model: { provider, modelId } } : {}),
+        });
+        await deps.store.create({
+            sessionId: handle.sessionId,
+            modelProvider: handle.model?.provider,
+            modelId: handle.model?.modelId,
+        });
+        sendJson(res, 201, {
+            ok: true,
+            sessionId: handle.sessionId,
+            sessionFile: handle.sessionFile,
+            model: handle.model,
+            activeTools: handle.activeTools,
+            hasBash: true,
+        });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        sendJson(res, 500, {
+            ok: false,
+            error: { code: "CHAT_SESSION_CREATE_FAILED", message },
+        });
+    }
+}
+export async function handleGetChatSession(_req, res, deps, sessionId) {
+    const record = await deps.store.get(sessionId);
+    if (!record) {
+        sendJson(res, 404, {
+            ok: false,
+            error: { code: "NOT_FOUND", message: `chat session not found: ${sessionId}` },
+        });
+        return;
+    }
+    sendJson(res, 200, { ok: true, session: record, hasBash: true });
+}
+export async function handleChatPrompt(req, res, deps, sessionId) {
+    const gate = gateMutation(req, deps);
+    if (!gate.ok) {
+        sendJson(res, gate.status, {
+            ok: false,
+            error: { code: gate.code, message: gate.message },
+        });
+        return;
+    }
+    let body;
+    try {
+        body = await readJsonBody(req);
+    }
+    catch (error) {
+        sendJson(res, 400, {
+            ok: false,
+            error: {
+                code: "INVALID_INPUT",
+                message: error instanceof Error ? error.message : String(error),
+            },
+        });
+        return;
+    }
+    const text = typeof body.text === "string" ? body.text.trim() : "";
+    if (!text) {
+        sendJson(res, 400, {
+            ok: false,
+            error: { code: "INVALID_INPUT", message: "text is required" },
+        });
+        return;
+    }
+    if (!deps.runtime.hasSession(sessionId)) {
+        sendJson(res, 404, {
+            ok: false,
+            error: { code: "NOT_FOUND", message: `chat session not active: ${sessionId}` },
+        });
+        return;
+    }
+    const actionContext = deps.runtime.actionContext;
+    if (!actionContext) {
+        sendJson(res, 503, {
+            ok: false,
+            error: {
+                code: "CHAT_NO_ACTION_CONTEXT",
+                message: "Chat runtime has no operator action context wired",
+            },
+        });
+        return;
+    }
+    // Stream events via SSE.
+    openSseResponse(res);
+    // Emit an immediate agent_start so the client shows a streaming state
+    // before the SDK emits its own agent_start (which we drop below to avoid
+    // a duplicate frame — P1.4).
+    writeChatSse(res, { kind: "agent_start", sessionId });
+    const ac = new AbortController();
+    let closed = false;
+    req.on("close", () => {
+        closed = true;
+        ac.abort();
+    });
+    // Lazily import to avoid circular module load.
+    const { runChatTurn } = await import("./session-store.js");
+    try {
+        await runChatTurn({
+            runtime: deps.runtime,
+            store: deps.store,
+            actionContext,
+            sessionId,
+            text,
+            signal: ac.signal,
+            onEvent: (event) => {
+                if (closed)
+                    return;
+                // agent_start was already emitted above for immediate client feedback;
+                // drop the SDK's duplicate to avoid a double frame (P1.4).
+                if (event.type === "agent_start")
+                    return;
+                // heartbeat is a keep-alive: write it as an SSE comment frame (":\n\n")
+                // which proxies/browsers treat as traffic but clients ignore as data.
+                if (event.type === "heartbeat") {
+                    if (!res.writableEnded)
+                        res.write(": heartbeat\n\n");
+                    return;
+                }
+                const sse = event.type === "tool_call"
+                    ? {
+                        kind: "tool_call",
+                        sessionId,
+                        toolCallId: event.toolCallId,
+                        toolName: event.toolName,
+                        args: event.args,
+                    }
+                    : event.type === "tool_result"
+                        ? {
+                            kind: "tool_result",
+                            sessionId,
+                            toolCallId: event.toolCallId,
+                            toolName: event.toolName,
+                            result: event.result,
+                            isError: event.isError,
+                        }
+                        : event.type === "error"
+                            ? { kind: "error", sessionId, message: event.message }
+                            : event.type === "agent_end"
+                                ? { kind: "agent_end", sessionId, willRetry: event.willRetry }
+                                : event.type === "agent_settled"
+                                    ? { kind: "agent_settled", sessionId }
+                                    : {
+                                        kind: event.type,
+                                        sessionId,
+                                        text: "text" in event ? event.text : "",
+                                    };
+                writeChatSse(res, sse);
+            },
+        });
+    }
+    catch (error) {
+        // runChatTurn should not reject (it catches runtime.prompt failures
+        // internally and returns {ok:false}), but a pre-prompt persistence failure
+        // (e.g. store.appendMessage for the user message) CAN throw after the SSE
+        // stream is already open. Surface it as an SSE error event so the client
+        // sees the failure instead of a hanging connection.
+        if (!closed) {
+            writeChatSse(res, {
+                kind: "error",
+                sessionId,
+                message: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+    finally {
+        // Guarantee the SSE stream is terminated regardless of outcome so the
+        // connection never hangs (regression: previously a rejected promise left
+        // res open and the client waited indefinitely).
+        if (!closed && !res.writableEnded) {
+            res.end();
+        }
+    }
+}
+export async function handleDeleteChatSession(req, res, deps, sessionId) {
+    const gate = gateMutation(req, deps);
+    if (!gate.ok) {
+        sendJson(res, gate.status, {
+            ok: false,
+            error: { code: gate.code, message: gate.message },
+        });
+        return;
+    }
+    deps.runtime.dispose(sessionId);
+    sendJson(res, 200, { ok: true, sessionId, disposed: true });
+}
+/**
+ * Dispatch a chat HTTP request. Returns true if handled.
+ * Mounted under /api/operator/v1/chat/*.
+ */
+export async function handleChatRequest(req, res, deps, pathname) {
+    if (!deps)
+        return false;
+    if (!pathname.startsWith("/api/operator/v1/chat/"))
+        return false;
+    const method = (req.method ?? "GET").toUpperCase();
+    const url = new URL(req.url ?? "/", "http://localhost");
+    if (method === "GET" && pathname === "/api/operator/v1/chat/capabilities") {
+        await handleChatCapabilities(req, res, deps);
+        return true;
+    }
+    const sessionPrompt = pathname.match(/^\/api\/operator\/v1\/chat\/sessions\/([^/]+)\/prompt$/);
+    if (method === "POST" && sessionPrompt) {
+        await handleChatPrompt(req, res, deps, decodeURIComponent(sessionPrompt[1]));
+        return true;
+    }
+    const sessionEvents = pathname.match(/^\/api\/operator\/v1\/chat\/sessions\/([^/]+)\/events$/);
+    if (method === "GET" && sessionEvents) {
+        // MVP: events are delivered inline during prompt SSE. A separate GET
+        // events stream is reserved for degraded-state recovery (V13); for now
+        // we return the persisted session snapshot so a reconnecting client can
+        // re-render history.
+        await handleGetChatSession(req, res, deps, decodeURIComponent(sessionEvents[1]));
+        return true;
+    }
+    const sessionMatch = pathname.match(/^\/api\/operator\/v1\/chat\/sessions\/([^/]+)$/);
+    if (sessionMatch) {
+        const id = decodeURIComponent(sessionMatch[1]);
+        if (method === "GET") {
+            await handleGetChatSession(req, res, deps, id);
+            return true;
+        }
+        if (method === "DELETE") {
+            await handleDeleteChatSession(req, res, deps, id);
+            return true;
+        }
+    }
+    if (method === "POST" && pathname === "/api/operator/v1/chat/sessions") {
+        await handleCreateChatSession(req, res, deps);
+        return true;
+    }
+    if (isMutationMethod(method)) {
+        // Already gated above for known routes; unknown mutation routes 404.
+        sendJson(res, 404, {
+            ok: false,
+            error: { code: "NOT_FOUND", message: `unknown chat route: ${pathname}` },
+        });
+        return true;
+    }
+    sendJson(res, 404, { ok: false, error: { code: "NOT_FOUND", message: `unknown chat route: ${pathname}` } });
+    return true;
+}
+// Re-export for route wiring; writeSseEvent kept for parity with operation-sse.
+void writeSseEvent;

package/dist/worker/console/chat/session-store.js

@@ -0,0 +1,238 @@
+/**
+ * Operator Chat — session store + tool dispatcher (plan W7 / W5).
+ *
+ * Owns:
+ *   - Chat session metadata persistence (app-data/chats)
+ *   - Tool-call dispatch from the Pi runtime into the operator action layer
+ *     (Gate 3 per-call authorization)
+ *   - History record (for degraded-mode replay, V13)
+ *
+ * The dispatcher is the SINGLE place where a Chat tool invocation becomes an
+ * operator action call. Every invocation is re-authorized here.
+ */
+import path from "node:path";
+import { readJsonIfExists, writeSecureJson, } from "../app-data.js";
+import { dispatchOperatorAction } from "../operator-actions.js";
+import { authorizeOperatorChatTool } from "./tools.js";
+function recordPath(appData, sessionId) {
+    return path.join(appData.chats, `${sessionId}.json`);
+}
+export class ChatSessionStore {
+    appData;
+    /**
+     * Per-session write lock. Each mutating op chains onto the previous one so
+     * concurrent appendMessage / recordToolInvocation calls do not lose updates
+     * via last-write-wins on the same JSON record.
+     */
+    writeChains = new Map();
+    constructor(appData) {
+        this.appData = appData;
+    }
+    async get(sessionId) {
+        return readJsonIfExists(recordPath(this.appData, sessionId));
+    }
+    /** Serialize a mutating op per session. */
+    serialize(sessionId, op) {
+        const prev = this.writeChains.get(sessionId) ?? Promise.resolve();
+        const next = prev.then(op, op);
+        // Keep the chain reference for the next serializer; swallow this op's
+        // rejection so it never breaks the chain (callers still see the result).
+        this.writeChains.set(sessionId, next.then(() => undefined, () => undefined));
+        return next;
+    }
+    async create(input) {
+        return this.serialize(input.sessionId, async () => {
+            const now = new Date().toISOString();
+            const record = {
+                schemaVersion: 1,
+                sessionId: input.sessionId,
+                createdAt: now,
+                updatedAt: now,
+                modelProvider: input.modelProvider,
+                modelId: input.modelId,
+                messages: [],
+                toolInvocations: [],
+            };
+            await writeSecureJson(recordPath(this.appData, input.sessionId), record);
+            return record;
+        });
+    }
+    async appendMessage(sessionId, message) {
+        return this.serialize(sessionId, async () => {
+            const record = await this.get(sessionId);
+            if (!record)
+                throw new Error(`chat session not found: ${sessionId}`);
+            const stored = {
+                ...message,
+                id: `m_${record.messages.length + 1}_${Math.random().toString(36).slice(2, 8)}`,
+                at: new Date().toISOString(),
+            };
+            record.messages.push(stored);
+            record.updatedAt = stored.at;
+            await writeSecureJson(recordPath(this.appData, sessionId), record);
+            return stored;
+        });
+    }
+    async recordToolInvocation(sessionId, entry) {
+        await this.serialize(sessionId, async () => {
+            const record = await this.get(sessionId);
+            if (!record)
+                return;
+            record.toolInvocations.push({ ...entry, at: new Date().toISOString() });
+            record.updatedAt = new Date().toISOString();
+            await writeSecureJson(recordPath(this.appData, sessionId), record);
+        });
+    }
+}
+/**
+ * Dispatch a Chat tool invocation into the operator action layer.
+ *
+ * Gate 3 (per-call): authorizeOperatorChatTool is re-checked here. Even if a
+ * malicious or drifted session somehow requested a denied tool, this gate
+ * refuses before any operator action runs (V12 / V15).
+ *
+ * High-risk actions (contractApply / runDag / etc.) are NOT registered as
+ * tools, so they never reach here; but we still deny defensively.
+ */
+export async function dispatchChatToolCall(ctx, toolName, args, clientRequestId) {
+    const decision = authorizeOperatorChatTool(toolName);
+    if (!decision.ok) {
+        return {
+            ok: false,
+            toolName,
+            errorCode: decision.code,
+            message: decision.message,
+        };
+    }
+    const result = await dispatchOperatorAction(ctx, {
+        action: decision.toolId,
+        actionParams: args,
+        clientRequestId,
+    });
+    if (result.kind === "accepted") {
+        // Long-running is not in the whitelist, but accepted ops (none currently)
+        // surface a pointer rather than inline data.
+        return {
+            ok: true,
+            toolName: decision.toolId,
+            result: {
+                operationId: result.body.operationId,
+                state: result.body.state,
+                note: "operation accepted; poll /api/operator/v1/operations/:id",
+            },
+        };
+    }
+    const body = result.body;
+    const ok = body.ok === true;
+    if (ok) {
+        return {
+            ok: true,
+            toolName: decision.toolId,
+            result: body.result ?? body,
+        };
+    }
+    const error = body.error ?? {};
+    return {
+        ok: false,
+        toolName: decision.toolId,
+        errorCode: typeof error.code === "string" ? error.code : "INTERNAL_ERROR",
+        message: typeof error.message === "string"
+            ? error.message
+            : `operator action ${decision.toolId} failed`,
+    };
+}
+/**
+ * Drive one full Chat turn: persist the user message, run the Pi prompt, and
+ * surface events to the caller (SSE). Tool-call events are dispatched through
+ * dispatchChatToolCall (Gate 3). The assistant's final message is persisted.
+ *
+ * The dispatcher wiring (connecting the Pi session's tool registry to
+ * dispatchChatToolCall) is performed by the runtime's customTools binding,
+ * configured at session-create time by chat-session.ts. This helper is the
+ * orchestrator the HTTP route calls.
+ */
+export async function runChatTurn(options) {
+    const { runtime, store, sessionId, text } = options;
+    if (!runtime.hasSession(sessionId)) {
+        return {
+            ok: false,
+            error: {
+                code: "NOT_FOUND",
+                message: `chat session not active: ${sessionId}`,
+            },
+        };
+    }
+    await store.appendMessage(sessionId, { role: "user", text });
+    let turnError;
+    // Collect persistence promises so runChatTurn does not resolve before the
+    // chat history / audit trail is durably written (also makes the outcome
+    // observable to tests and to a reconnecting client reading the record).
+    const pending = [];
+    try {
+        await runtime.prompt(sessionId, text, (event) => {
+            options.onEvent?.(event);
+            switch (event.type) {
+                case "message_update":
+                case "message_end":
+                    if (event.type === "message_end") {
+                        pending.push(store.appendMessage(sessionId, {
+                            role: "assistant",
+                            text: event.text,
+                        }));
+                    }
+                    break;
+                case "tool_call":
+                    // Forwarded to the caller (SSE) for UI feedback. The actual tool
+                    // execution happens in the SDK's customTools[].execute(), which
+                    // routes to dispatchChatToolCall (Gate 3). Do NOT dispatch here —
+                    // that would double-execute every tool call (P0.2).
+                    break;
+                case "tool_result": {
+                    // tool_execution_end carries the real result of the tool call.
+                    // Persist exactly once (the tool message + audit trail). This is
+                    // the single point of record for tool outcomes (P0.2).
+                    const resultText = safeStringifyResult(event.result);
+                    // ChatSessionStore serializes writes per session, so these two calls
+                    // are safe to fire concurrently — neither clobbers the other.
+                    pending.push(store.appendMessage(sessionId, {
+                        role: "tool",
+                        text: resultText,
+                        toolCallId: event.toolCallId,
+                        toolName: event.toolName,
+                        isError: event.isError,
+                    }));
+                    pending.push(store.recordToolInvocation(sessionId, {
+                        toolCallId: event.toolCallId,
+                        toolName: event.toolName,
+                        ok: !event.isError,
+                    }));
+                    break;
+                }
+                case "error":
+                    turnError = { code: "CHAT_TURN_ERROR", message: event.message };
+                    break;
+            }
+        }, { signal: options.signal });
+    }
+    catch (error) {
+        await Promise.allSettled(pending);
+        const message = error instanceof Error ? error.message : String(error);
+        return { ok: false, error: { code: "CHAT_TURN_FAILED", message } };
+    }
+    await Promise.allSettled(pending);
+    return { ok: !turnError, error: turnError };
+}
+/**
+ * Stringify a tool result for persistence. Bounds the stored text length so a
+ * huge operator-action payload (e.g. a full dagReport) cannot bloat the chat
+ * history record.
+ */
+function safeStringifyResult(result) {
+    try {
+        const str = JSON.stringify(result ?? {});
+        return str.length > 4000 ? `${str.slice(0, 4000)}…[truncated]` : str;
+    }
+    catch {
+        return String(result);
+    }
+}