@tea-agent/loop-agent 0.22.0 → 0.24.0

package/dist/worker/console/chat/runtime-context.js

@@ -0,0 +1,24 @@
+import { createHash } from "node:crypto";
+import { scrubSecrets } from "./explore-tools.js";
+function summary(text, max = 320) {
+    if (!text)
+        return undefined;
+    return scrubSecrets(text).scrubbed
+        .replace(/\bghp_[A-Za-z0-9]{20,}\b/g, "[REDACTED]")
+        .replace(/\bBearer\s+[A-Za-z0-9._~+/=-]{16,}/gi, "Bearer [REDACTED]")
+        .slice(0, max);
+}
+export function projectRuntimeContext(input) {
+    return {
+        readOnly: true,
+        systemPrompt: {
+            hash: createHash("sha256").update(input.systemPrompt).digest("hex"),
+            summary: summary(input.systemPrompt),
+        },
+        skills: input.skills.map((skill) => ({ ...skill, description: summary(skill.description, 200) ?? "" })),
+        resources: { mode: "closed", noContextFiles: true, noSkills: true, noExtensions: true, hasBash: false, activeToolCount: input.activeTools.length },
+        model: input.model,
+        thinkingLevel: input.thinkingLevel,
+        suffix: input.systemPromptSuffix ? { present: true, summary: summary(input.systemPromptSuffix) } : { present: false },
+    };
+}

package/dist/worker/console/chat/runtime-selection.js

@@ -0,0 +1,37 @@
+/**
+ * Pure runtime-selection helpers shared by the Operator Chat UI and tests.
+ *
+ * These functions encode the merge/match semantics between persisted session
+ * runtime state (model + thinking level) and the read-only runtime context
+ * snapshot. They are intentionally side-effect-free so they can be unit-tested
+ * in a plain Node environment (the React component owns the network race
+ * guards; these helpers only define what "matches" and "merged" mean).
+ */
+/** Format a model reference for `<option value>` keys and equality checks. */
+export function formatModelRef(provider, modelId) {
+    return `${provider}/${modelId}`;
+}
+/** Normalize a server record into the optional model/thinking patch fields. */
+export function runtimeSelectionFromRecord(record) {
+    return {
+        ...(record.modelProvider && record.modelId
+            ? { model: { provider: record.modelProvider, modelId: record.modelId } }
+            : {}),
+        ...(record.thinkingLevel ? { thinkingLevel: record.thinkingLevel } : {}),
+    };
+}
+/** Merge a patch onto a session, preferring patch values and keeping the id. */
+export function mergeSessionRuntime(current, patch) {
+    return {
+        ...current,
+        model: patch.model ?? current.model,
+        thinkingLevel: patch.thinkingLevel ?? current.thinkingLevel,
+    };
+}
+/** True when `current` already carries the values in `patch`. */
+export function sessionRuntimeMatches(current, patch) {
+    const next = mergeSessionRuntime(current, patch);
+    return (next.model?.provider === current.model?.provider &&
+        next.model?.modelId === current.model?.modelId &&
+        next.thinkingLevel === current.thinkingLevel);
+}

package/dist/worker/console/chat/session-store.js

@@ -0,0 +1,437 @@
+/**
+ * Operator Chat — session store + tool dispatcher (plan W7 / W5).
+ *
+ * Owns:
+ *   - Chat session metadata persistence (app-data/chats)
+ *   - Tool-call dispatch from the Pi runtime into the operator action layer
+ *     (Gate 3 per-call authorization)
+ *   - History record (for degraded-mode replay, V13)
+ *
+ * The dispatcher is the SINGLE place where a Chat tool invocation becomes an
+ * operator action call. Every invocation is re-authorized here.
+ */
+import path from "node:path";
+import { readdir, rm } from "node:fs/promises";
+import { readJsonIfExists, writeSecureJson, } from "../app-data.js";
+import { dispatchOperatorAction } from "../operator-actions.js";
+import { authorizeOperatorChatTool } from "./tools.js";
+import { projectOperationForChat } from "./chat-event-store.js";
+import { scrubSecrets } from "./explore-tools.js";
+function recordPath(appData, sessionId) {
+    return path.join(appData.chats, `${sessionId}.json`);
+}
+export class ChatSessionStore {
+    appData;
+    /**
+     * Per-session write lock. Each mutating op chains onto the previous one so
+     * concurrent appendMessage / recordToolInvocation calls do not lose updates
+     * via last-write-wins on the same JSON record.
+     */
+    writeChains = new Map();
+    constructor(appData) {
+        this.appData = appData;
+    }
+    /** Read + migrate legacy V1 records into the V2 in-memory shape. */
+    async get(sessionId) {
+        const raw = await readJsonIfExists(recordPath(this.appData, sessionId));
+        if (!raw || raw.sessionId !== sessionId)
+            return undefined;
+        return {
+            schemaVersion: 2,
+            sessionId,
+            repoFingerprint: raw.repoFingerprint ?? this.appData.fingerprint,
+            repoRootDisplay: raw.repoRootDisplay ?? this.appData.repoRoot,
+            state: raw.state === "archived" ? "archived" : "active",
+            ...(typeof raw.title === "string" ? { title: raw.title } : {}),
+            ...(typeof raw.sessionFile === "string" ? { sessionFile: raw.sessionFile } : {}),
+            createdAt: raw.createdAt ?? new Date(0).toISOString(),
+            updatedAt: raw.updatedAt ?? raw.createdAt ?? new Date(0).toISOString(),
+            ...(typeof raw.modelProvider === "string" ? { modelProvider: raw.modelProvider } : {}),
+            ...(typeof raw.modelId === "string" ? { modelId: raw.modelId } : {}),
+            ...(typeof raw.thinkingLevel === "string" ? { thinkingLevel: raw.thinkingLevel } : {}),
+            messages: Array.isArray(raw.messages) ? raw.messages : [],
+            toolInvocations: Array.isArray(raw.toolInvocations) ? raw.toolInvocations : [],
+        };
+    }
+    async listMessages(sessionId, options = {}) {
+        const record = await this.get(sessionId);
+        if (!record)
+            throw new Error(`chat session not found: ${sessionId}`);
+        const limit = Math.max(1, Math.min(50, Math.floor(options.limit ?? 30)));
+        const beforeIndex = options.beforeId
+            ? record.messages.findIndex((message) => message.id === options.beforeId)
+            : record.messages.length;
+        const end = beforeIndex < 0 ? record.messages.length : beforeIndex;
+        const start = Math.max(0, end - limit);
+        const messages = record.messages.slice(start, end);
+        return {
+            messages,
+            hasMore: start > 0,
+            ...(messages[0] ? { nextCursor: messages[0].id } : {}),
+        };
+    }
+    /** List repo-bound sessions, newest first. Deleted records are absent. */
+    async list(options) {
+        let names;
+        try {
+            names = await readdir(this.appData.chats);
+        }
+        catch {
+            return [];
+        }
+        const records = await Promise.all(names
+            .filter((name) => name.endsWith(".json"))
+            .map((name) => this.get(name.slice(0, -".json".length))));
+        return records
+            .filter((record) => Boolean(record) && (options?.includeArchived || record.state === "active"))
+            .sort((a, b) => b.updatedAt.localeCompare(a.updatedAt));
+    }
+    /** Serialize a mutating op per session. */
+    serialize(sessionId, op) {
+        const prev = this.writeChains.get(sessionId) ?? Promise.resolve();
+        const next = prev.then(op, op);
+        // Keep the chain reference for the next serializer; swallow this op's
+        // rejection so it never breaks the chain (callers still see the result).
+        this.writeChains.set(sessionId, next.then(() => undefined, () => undefined));
+        return next;
+    }
+    async create(input) {
+        return this.serialize(input.sessionId, async () => {
+            const now = new Date().toISOString();
+            const record = {
+                schemaVersion: 2,
+                sessionId: input.sessionId,
+                repoFingerprint: this.appData.fingerprint,
+                repoRootDisplay: this.appData.repoRoot,
+                state: "active",
+                ...(input.sessionFile ? { sessionFile: input.sessionFile } : {}),
+                createdAt: now,
+                updatedAt: now,
+                modelProvider: input.modelProvider,
+                modelId: input.modelId,
+                messages: [],
+                toolInvocations: [],
+            };
+            await writeSecureJson(recordPath(this.appData, input.sessionId), record);
+            return record;
+        });
+    }
+    async forkFrom(input) {
+        const source = await this.get(input.sourceSessionId);
+        if (!source)
+            throw new Error(`chat session not found: ${input.sourceSessionId}`);
+        return this.serialize(input.targetSessionId, async () => {
+            const now = new Date().toISOString();
+            const record = {
+                ...source,
+                sessionId: input.targetSessionId,
+                state: "active",
+                ...(input.targetSessionFile ? { sessionFile: input.targetSessionFile } : { sessionFile: undefined }),
+                createdAt: now,
+                updatedAt: now,
+                messages: structuredClone(source.messages),
+                toolInvocations: structuredClone(source.toolInvocations),
+            };
+            await writeSecureJson(recordPath(this.appData, input.targetSessionId), record);
+            return record;
+        });
+    }
+    async rename(sessionId, title) {
+        return this.serialize(sessionId, async () => {
+            const record = await this.get(sessionId);
+            if (!record)
+                throw new Error(`chat session not found: ${sessionId}`);
+            record.title = title.trim().slice(0, 160) || undefined;
+            record.updatedAt = new Date().toISOString();
+            await writeSecureJson(recordPath(this.appData, sessionId), record);
+            return record;
+        });
+    }
+    async setRuntimeSelection(sessionId, selection) {
+        return this.serialize(sessionId, async () => {
+            const record = await this.get(sessionId);
+            if (!record)
+                throw new Error(`chat session not found: ${sessionId}`);
+            if (selection.modelProvider !== undefined)
+                record.modelProvider = selection.modelProvider;
+            if (selection.modelId !== undefined)
+                record.modelId = selection.modelId;
+            if (selection.thinkingLevel !== undefined)
+                record.thinkingLevel = selection.thinkingLevel;
+            record.updatedAt = new Date().toISOString();
+            await writeSecureJson(recordPath(this.appData, sessionId), record);
+            return record;
+        });
+    }
+    async setState(sessionId, state) {
+        return this.serialize(sessionId, async () => {
+            const record = await this.get(sessionId);
+            if (!record)
+                throw new Error(`chat session not found: ${sessionId}`);
+            record.state = state;
+            record.updatedAt = new Date().toISOString();
+            await writeSecureJson(recordPath(this.appData, sessionId), record);
+            return record;
+        });
+    }
+    async remove(sessionId) {
+        return this.serialize(sessionId, async () => {
+            const record = await this.get(sessionId);
+            if (!record)
+                return false;
+            await rm(recordPath(this.appData, sessionId), { force: true });
+            return true;
+        });
+    }
+    async appendMessage(sessionId, message) {
+        return this.serialize(sessionId, async () => {
+            const record = await this.get(sessionId);
+            if (!record)
+                throw new Error(`chat session not found: ${sessionId}`);
+            const stored = {
+                ...message,
+                id: `m_${record.messages.length + 1}_${Math.random().toString(36).slice(2, 8)}`,
+                at: new Date().toISOString(),
+            };
+            record.messages.push(stored);
+            record.updatedAt = stored.at;
+            await writeSecureJson(recordPath(this.appData, sessionId), record);
+            return stored;
+        });
+    }
+    async recordToolInvocation(sessionId, entry) {
+        await this.serialize(sessionId, async () => {
+            const record = await this.get(sessionId);
+            if (!record)
+                return;
+            record.toolInvocations.push({ ...entry, at: new Date().toISOString() });
+            record.updatedAt = new Date().toISOString();
+            await writeSecureJson(recordPath(this.appData, sessionId), record);
+        });
+    }
+}
+/**
+ * Dispatch a Chat tool invocation into the operator action layer.
+ *
+ * Gate 3 (per-call): authorizeOperatorChatTool is re-checked here. Even if a
+ * malicious or drifted session somehow requested a denied tool, this gate
+ * refuses before any operator action runs (V12 / V15).
+ *
+ * High-risk actions (contractApply / runDag / etc.) are NOT registered as
+ * tools, so they never reach here; but we still deny defensively.
+ */
+function redactHumanGateToken(value) {
+    const clone = structuredClone(value);
+    const confirmation = clone.confirmation;
+    if (confirmation && typeof confirmation === "object") {
+        delete confirmation.humanGateToken;
+        delete confirmation.dagBytesPath;
+    }
+    delete clone.humanGateToken;
+    return clone;
+}
+export async function dispatchChatToolCall(ctx, toolName, args, clientRequestId) {
+    const decision = authorizeOperatorChatTool(toolName);
+    if (!decision.ok) {
+        return {
+            ok: false,
+            toolName,
+            errorCode: decision.code,
+            message: decision.message,
+        };
+    }
+    const result = await dispatchOperatorAction(ctx, {
+        action: decision.toolId,
+        actionParams: args,
+        clientRequestId,
+    });
+    if (result.kind === "accepted") {
+        const canonical = await ctx.operations.get(result.body.operationId);
+        return {
+            ok: true,
+            toolName: decision.toolId,
+            result: {
+                schemaVersion: 1,
+                accepted: true,
+                operationId: result.body.operationId,
+                state: result.body.state,
+                action: result.body.action,
+                ...(canonical ? { operation: projectOperationForChat(canonical) } : {}),
+                note: "operation accepted; a durable Chat operation reference will follow canonical status",
+            },
+        };
+    }
+    const body = result.body;
+    const ok = body.ok === true;
+    if (ok) {
+        const raw = body.result ?? body;
+        return {
+            ok: true,
+            toolName: decision.toolId,
+            result: decision.toolId === "prepareDagConfirmation" || decision.toolId === "prepareMutationGate"
+                ? redactHumanGateToken(raw)
+                : raw,
+        };
+    }
+    const error = body.error ?? {};
+    return {
+        ok: false,
+        toolName: decision.toolId,
+        errorCode: typeof error.code === "string" ? error.code : "INTERNAL_ERROR",
+        message: typeof error.message === "string"
+            ? error.message
+            : `operator action ${decision.toolId} failed`,
+    };
+}
+/**
+ * Drive one full Chat turn: persist the user message, run the Pi prompt, and
+ * surface events to the caller (SSE). Tool-call events are dispatched through
+ * dispatchChatToolCall (Gate 3). The assistant's final message is persisted.
+ *
+ * The dispatcher wiring (connecting the Pi session's tool registry to
+ * dispatchChatToolCall) is performed by the runtime's customTools binding,
+ * configured at session-create time by chat-session.ts. This helper is the
+ * orchestrator the HTTP route calls.
+ */
+export async function runChatTurn(options) {
+    const { runtime, store, sessionId, text } = options;
+    if (!runtime.hasSession(sessionId)) {
+        return {
+            ok: false,
+            error: {
+                code: "NOT_FOUND",
+                message: `chat session not active: ${sessionId}`,
+            },
+        };
+    }
+    await store.appendMessage(sessionId, { role: "user", text });
+    let turnError;
+    // Collect persistence promises so runChatTurn does not resolve before the
+    // chat history / audit trail is durably written (also makes the outcome
+    // observable to tests and to a reconnecting client reading the record).
+    const pending = [];
+    let settledEvent;
+    try {
+        await runtime.prompt(sessionId, text, (event) => {
+            if (event.type === "agent_settled") {
+                // The durable operation-ref linker may perform an async canonical
+                // operation read. Hold settled until those writes finish so replay
+                // never observes agent_settled before its accepted operation ref.
+                settledEvent = event;
+            }
+            else {
+                options.onEvent?.(event);
+            }
+            switch (event.type) {
+                case "message_update":
+                case "message_end":
+                    if (event.type === "message_end") {
+                        pending.push(store.appendMessage(sessionId, {
+                            role: "assistant",
+                            text: event.text,
+                        }));
+                    }
+                    break;
+                case "tool_call":
+                    // Forwarded to the caller (SSE) for UI feedback. The actual tool
+                    // execution happens in the SDK's customTools[].execute(), which
+                    // routes to dispatchChatToolCall (Gate 3). Do NOT dispatch here —
+                    // that would double-execute every tool call (P0.2).
+                    break;
+                case "tool_result": {
+                    const acceptedOperationId = acceptedOperationIdFromResult(event.toolName, event.result);
+                    if (acceptedOperationId && options.onOperationAccepted) {
+                        pending.push(Promise.resolve(options.onOperationAccepted({
+                            sessionId,
+                            toolCallId: event.toolCallId,
+                            toolName: event.toolName,
+                            operationId: acceptedOperationId,
+                        })));
+                    }
+                    // tool_execution_end carries the real result of the tool call.
+                    // Persist exactly once (the tool message + audit trail). This is
+                    // the single point of record for tool outcomes (P0.2).
+                    const resultText = safeStringifyResult(event.result);
+                    // ChatSessionStore serializes writes per session, so these two calls
+                    // are safe to fire concurrently — neither clobbers the other.
+                    pending.push(store.appendMessage(sessionId, {
+                        role: "tool",
+                        text: resultText,
+                        toolCallId: event.toolCallId,
+                        toolName: event.toolName,
+                        isError: event.isError,
+                    }));
+                    pending.push(store.recordToolInvocation(sessionId, {
+                        toolCallId: event.toolCallId,
+                        toolName: event.toolName,
+                        ok: !event.isError,
+                    }));
+                    break;
+                }
+                case "error":
+                    turnError = { code: "CHAT_TURN_ERROR", message: event.message };
+                    break;
+            }
+        }, { signal: options.signal, images: options.images });
+    }
+    catch (error) {
+        await Promise.allSettled(pending);
+        const message = error instanceof Error ? error.message : String(error);
+        return { ok: false, error: { code: "CHAT_TURN_FAILED", message } };
+    }
+    await Promise.allSettled(pending);
+    if (settledEvent)
+        options.onEvent?.(settledEvent);
+    return { ok: !turnError, error: turnError };
+}
+/**
+ * Stringify a tool result for persistence. Bounds the stored text length so a
+ * huge operator-action payload (e.g. a full dagReport) cannot bloat the chat
+ * history record.
+ */
+function acceptedOperationIdFromResult(toolName, result) {
+    const candidates = [result];
+    if (result && typeof result === "object") {
+        const record = result;
+        candidates.push(record.details);
+        if (Array.isArray(record.content)) {
+            for (const item of record.content) {
+                if (!item || typeof item !== "object")
+                    continue;
+                const text = item.text;
+                if (typeof text !== "string" || text.length > 16_000)
+                    continue;
+                try {
+                    candidates.push(JSON.parse(text));
+                }
+                catch {
+                    // Only the controlled JSON tool-result envelope is accepted.
+                }
+            }
+        }
+    }
+    for (const candidate of candidates) {
+        if (!candidate || typeof candidate !== "object")
+            continue;
+        const accepted = candidate;
+        if (accepted.schemaVersion === 1 &&
+            accepted.accepted === true &&
+            accepted.action === toolName &&
+            typeof accepted.operationId === "string" &&
+            accepted.operationId.trim()) {
+            return accepted.operationId.trim();
+        }
+    }
+    return undefined;
+}
+function safeStringifyResult(result) {
+    try {
+        const raw = JSON.stringify(result ?? {});
+        const { scrubbed } = scrubSecrets(raw);
+        return scrubbed.length > 4000 ? `${scrubbed.slice(0, 4000)}…[truncated]` : scrubbed;
+    }
+    catch {
+        const { scrubbed } = scrubSecrets(String(result));
+        return scrubbed.length > 4000 ? `${scrubbed.slice(0, 4000)}…[truncated]` : scrubbed;
+    }
+}

package/dist/worker/console/chat/shortcuts.js

@@ -0,0 +1,15 @@
+export const SHORTCUTS = [
+    { command: "/task", label: "Task context", description: "查看当前任务、Draft 与 assessment", action: "focus-panel:task" },
+    { command: "/contract", label: "Contract", description: "查看 contract diff 与 apply gate", action: "focus-panel:contract" },
+    { command: "/dag", label: "DAG", description: "查看 DAG spine、确认与运行状态", action: "focus-panel:dag" },
+    { command: "/interview", label: "Interview", description: "打开 Requirement Interview", action: "focus:interview" },
+    { command: "/help", label: "Shortcuts", description: "显示可用 shortcut", action: "show-help" },
+];
+/** Pure navigation/display resolver. It deliberately has no mutation decisions. */
+export function resolveShortcut(input) {
+    const token = input.trim().split(/\s+/, 1)[0]?.toLowerCase();
+    if (!token?.startsWith("/"))
+        return undefined;
+    const found = SHORTCUTS.find((shortcut) => shortcut.command === token);
+    return found ? { command: found.command, action: found.action } : { command: token, action: "unknown" };
+}

package/dist/worker/console/chat/tool-adapter.js

@@ -0,0 +1,125 @@
+/**
+ * Operator Chat — operator action → Pi tool schema adapter (roadmap M0-C).
+ *
+ * The capabilities registry (src/shared/operator/capabilities.ts) is the
+ * SINGLE source of truth for each action's typed input schema AND its model
+ * policy (modelCallable / humanConfirmation). This adapter renders that
+ * registry into the descriptor shape the Pi model invokes; it no longer
+ * maintains a second hand-written INPUT_PARAMS table (that drift risk is gone).
+ *
+ * High-risk / long-running actions ARE mapped as tools (2026-07-25 widening),
+ * but the registry now declares their modelCallable policy:
+ *   - "always": model can invoke; dispatch runs server-side.
+ *   - "prepare-only": model can invoke but the mutation needs a human-origin
+ *     confirmation (e.g. runDag needs a confirmationId consumed by a human
+ *     confirm via the browser mutation gate — M0-B).
+ *   - "never": the action is the human confirmation itself (confirmDagConfirmation)
+ *     and MUST NOT appear as a model-callable tool (M0-B / roadmap G03).
+ *
+ * The adapter does NOT register tools with the SDK directly — that is the
+ * session layer's job (chat/pi-runtime.ts). This keeps the adapter pure and
+ * unit-testable against the registry.
+ */
+import { buildOperatorCapabilitiesDocument } from "../../../shared/operator/capabilities.js";
+/**
+ * Executable mutation faces reserved for browser HumanGate routes.
+ *
+ * Derived from the capabilities registry: any action that still requires human
+ * confirmation (and is not itself the confirm step with modelCallable=never)
+ * must NOT be registered as a model-executable tool. The model may only call
+ * prepare helpers (prepareDagConfirmation / prepareMutationGate); the browser
+ * mutation gate + HMAC token perform the consuming dispatch.
+ *
+ * `contractApply` is also gate-only even though its registry face remains
+ * `humanConfirmation: "conditional"` (assessment soft-gate for workspace UI);
+ * Chat executes it only via the contract-apply Human Gate route.
+ */
+const EXPLICIT_EXECUTABLE_GATE_ONLY = ["contractApply"];
+export function listExecutableGateOnlyActions() {
+    const derived = buildOperatorCapabilitiesDocument()
+        .actions.filter((action) => action.humanConfirmation === "required" &&
+        action.modelCallable !== "never")
+        .map((action) => action.action);
+    return [...new Set([...EXPLICIT_EXECUTABLE_GATE_ONLY, ...derived])].sort();
+}
+/** Frozen snapshot for tests / drift checks (recomputed from registry). */
+export const EXECUTABLE_GATE_ONLY_ACTIONS = Object.freeze(listExecutableGateOnlyActions());
+const EXECUTABLE_GATE_ONLY = new Set(EXECUTABLE_GATE_ONLY_ACTIONS);
+/**
+ * Build the FULL Chat tool schema set from the capabilities registry — every
+ * registry action, INCLUDING modelCallable="never" ones (e.g.
+ * confirmDagConfirmation). Used by internal audits / capability surfaces that
+ * need to see the complete registry. The session layer uses
+ * buildModelCallableToolSchemas() to render only model-callable tools.
+ */
+export function buildOperatorChatToolSchemas() {
+    const doc = buildOperatorCapabilitiesDocument();
+    const out = [];
+    for (const action of doc.actions) {
+        // Fail-closed: every registry action MUST carry inputParams. An action
+        // missing inputParams is a contract gap (the model could call it but we
+        // don't know which params its dispatcher reads). Throw at boot so the gap
+        // is caught in tests and never ships.
+        if (!Array.isArray(action.inputParams)) {
+            throw new Error(`Operator Chat tool schema gap: registry action "${action.action}" has no inputParams. Add inputParams (must match the dispatcher's paramsOf reads) in src/shared/operator/capabilities.ts.`);
+        }
+        out.push({
+            toolId: action.action,
+            action: action.action,
+            description: action.description,
+            cli: action.cli,
+            kind: action.kind,
+            inputParams: action.inputParams.map((p) => ({
+                name: p.name,
+                type: p.type,
+                required: p.required,
+                description: p.description,
+                ...(p.itemsType ? { itemsType: p.itemsType } : {}),
+            })),
+            modelCallable: action.modelCallable,
+            humanConfirmation: action.humanConfirmation,
+            ...(action.resultPolicy ? { resultPolicy: action.resultPolicy } : {}),
+        });
+    }
+    return out;
+}
+/**
+ * Build ONLY the model-callable tool schemas — i.e. exclude
+ * modelCallable="never" actions (roadmap M0-B / G03). This is the set the Pi
+ * session actually registers as custom tools: the human confirmation action
+ * (confirmDagConfirmation) is NOT a model tool; it can only be invoked by the
+ * browser mutation gate with a server-signed confirmation token.
+ */
+export function buildModelCallableToolSchemas() {
+    return buildOperatorChatToolSchemas().filter((s) => s.modelCallable !== "never" && !EXECUTABLE_GATE_ONLY.has(s.action));
+}
+/**
+ * Names of actions that MUST NOT be model-callable (roadmap G03 / G14).
+ * Derived from the registry so adding a "never" policy there is the only edit
+ * needed. Used by the three-gate tool whitelist to deny model invocation.
+ */
+export function modelForbiddenActions() {
+    return buildOperatorChatToolSchemas()
+        .filter((s) => s.modelCallable === "never" || EXECUTABLE_GATE_ONLY.has(s.action))
+        .map((s) => s.action);
+}
+/**
+ * Verify the adapter covers exactly the registry and nothing more.
+ * Used by boot/red-team checks (V15 — the full registry is schema'd).
+ */
+export function verifyOperatorChatToolSurface() {
+    const schemas = buildOperatorChatToolSchemas();
+    const doc = buildOperatorCapabilitiesDocument();
+    const covered = schemas.map((s) => s.action).sort();
+    const expected = doc.actions.map((a) => a.action).sort();
+    const coveredSet = new Set(covered);
+    const expectedSet = new Set(expected);
+    const missing = expected.filter((a) => !coveredSet.has(a));
+    const extra = covered.filter((a) => !expectedSet.has(a));
+    return {
+        ok: missing.length === 0 && extra.length === 0,
+        covered,
+        missing,
+        extra,
+    };
+}