@tea-agent/loop-agent 0.23.1 → 0.24.0

package/dist/worker/console/chat/tool-adapter.js

@@ -1,230 +1,117 @@
 /**
- * Operator Chat — operator action → Pi tool schema adapter (plan W5 / W12).
+ * Operator Chat — operator action → Pi tool schema adapter (roadmap M0-C).
  *
- * Maps the FULL operator action surface (every action in the capabilities
- * registry — read, mutation, and long-running — derived dynamically) into
- * tool-schema descriptors the Pi model can invoke. Each descriptor carries:
- *   - toolId (canonical action name)
- *   - description (from capabilities registry)
- *   - inputParams (the parameters the model may supply; MUST match the
- *     dispatcher's paramsOf reads — see INPUT_PARAMS contract note)
+ * The capabilities registry (src/shared/operator/capabilities.ts) is the
+ * SINGLE source of truth for each action's typed input schema AND its model
+ * policy (modelCallable / humanConfirmation). This adapter renders that
+ * registry into the descriptor shape the Pi model invokes; it no longer
+ * maintains a second hand-written INPUT_PARAMS table (that drift risk is gone).
  *
- * High-risk / long-running actions ARE mapped as tools (2026-07-25 widening).
- * They still fail closed at dispatch time without their prepared receipt.
+ * High-risk / long-running actions ARE mapped as tools (2026-07-25 widening),
+ * but the registry now declares their modelCallable policy:
+ *   - "always": model can invoke; dispatch runs server-side.
+ *   - "prepare-only": model can invoke but the mutation needs a human-origin
+ *     confirmation (e.g. runDag needs a confirmationId consumed by a human
+ *     confirm via the browser mutation gate — M0-B).
+ *   - "never": the action is the human confirmation itself (confirmDagConfirmation)
+ *     and MUST NOT appear as a model-callable tool (M0-B / roadmap G03).
  *
  * The adapter does NOT register tools with the SDK directly — that is the
  * session layer's job (chat/pi-runtime.ts). This keeps the adapter pure and
  * unit-testable against the registry.
  */
 import { buildOperatorCapabilitiesDocument } from "../../../shared/operator/capabilities.js";
-import { OPERATOR_CHAT_ALLOWED_TOOLS, authorizeOperatorChatTool, } from "./tools.js";
 /**
- * Minimal input parameter specs per action. Only the parameters the model is
- * allowed to supply are listed; the dispatch layer fills the rest (repoRoot,
- * operatorSessionId, request identity / clientRequestId — note the dispatcher
- * reads `req.clientRequestId`, not `p.clientRequestId`, so the model MUST NOT
- * be asked for it). Kept intentionally small to avoid over-permissive tool
- * surfaces.
+ * Executable mutation faces reserved for browser HumanGate routes.
  *
- * CONTRACT SOURCE OF TRUTH: each entry here MUST match the fields the
- * dispatcher in operator-actions.ts actually reads from `p` (paramsOf). The
- * `verifyOperatorChatToolSurfaceMatchesDispatcher` test pins this. Adding a
- * new operator action to the registry WITHOUT an entry here is a build-time
- * failure (fail-closed dynamic discovery) — see buildOperatorChatToolSchemas.
+ * Derived from the capabilities registry: any action that still requires human
+ * confirmation (and is not itself the confirm step with modelCallable=never)
+ * must NOT be registered as a model-executable tool. The model may only call
+ * prepare helpers (prepareDagConfirmation / prepareMutationGate); the browser
+ * mutation gate + HMAC token perform the consuming dispatch.
+ *
+ * `contractApply` is also gate-only even though its registry face remains
+ * `humanConfirmation: "conditional"` (assessment soft-gate for workspace UI);
+ * Chat executes it only via the contract-apply Human Gate route.
  */
-const INPUT_PARAMS = {
-    operatorCapabilities: [],
-    inspect: [],
-    doctor: [],
-    contractShow: [
-        { name: "taskId", type: "string", required: true, description: "task id" },
-    ],
-    // contractValidate / contractDiff: dispatcher reads draftJson/inputText
-    // (a JSON string staged to a file), NOT a `draft` object. The model may
-    // pass a stored-draft taskId with NO draftJson to validate the saved draft.
-    contractValidate: [
-        { name: "taskId", type: "string", required: true, description: "task id" },
-        {
-            name: "draftJson",
-            type: "string",
-            required: false,
-            description: "TaskContractDraftV1 serialized as a JSON string. When omitted, the dispatcher validates the task's currently-saved Console draft.",
-        },
-    ],
-    contractDiff: [
-        { name: "taskId", type: "string", required: true, description: "task id" },
-        {
-            name: "draftJson",
-            type: "string",
-            required: false,
-            description: "TaskContractDraftV1 serialized as a JSON string to diff against the saved draft. When omitted, diffs the saved draft.",
-        },
-    ],
-    sourceInstructions: [
-        { name: "taskId", type: "string", required: true, description: "task id" },
-    ],
-    prepareDagConfirmation: [
-        { name: "taskId", type: "string", required: true, description: "task id" },
-    ],
-    observeLink: [
-        {
-            name: "taskId",
-            type: "string",
-            required: false,
-            description: "task id (optional, one of taskId/dagRunId/featureId)",
-        },
-        {
-            name: "dagRunId",
-            type: "string",
-            required: false,
-            description: "dag run id",
-        },
-        {
-            name: "featureId",
-            type: "string",
-            required: false,
-            description: "feature id",
-        },
-    ],
-    statsContext: [],
-    dagReport: [
-        {
-            name: "runId",
-            type: "string",
-            required: true,
-            description: "dag run id",
-        },
-    ],
-    status: [
-        { name: "taskId", type: "string", required: true, description: "task id" },
-    ],
-    spineCheck: [
-        { name: "taskId", type: "string", required: true, description: "task id" },
-    ],
-    dagValidate: [
-        {
-            name: "dagPath",
-            type: "string",
-            required: true,
-            description: "path to DAG json",
-        },
-    ],
-    dagRerunPlan: [
-        {
-            name: "runId",
-            type: "string",
-            required: true,
-            description: "dag run id",
-        },
-        {
-            name: "fromNode",
-            type: "string",
-            required: true,
-            description: "node id to rerun from",
-        },
-    ],
-    // high-risk mutation — formerly human-confirmation-only
-    importPrd: [
-        { name: "taskId", type: "string", required: true, description: "task id" },
-        { name: "content", type: "string", required: true, description: "PRD markdown content" },
-    ],
-    contractApply: [
-        { name: "taskId", type: "string", required: true, description: "task id" },
-        { name: "assessmentId", type: "string", required: false, description: "assessment id binding (defaults to the draft's bound assessment)" },
-        { name: "expectedRevision", type: "string", required: false, description: "expected contract revision (defaults to live observed)" },
-        { name: "expectedObservedHash", type: "string", required: false, description: "expected observed hash (defaults to live observed)" },
-    ],
-    confirmDagConfirmation: [
-        { name: "confirmationId", type: "string", required: true, description: "confirmation id from prepareDagConfirmation" },
-        { name: "challenges", type: "array", required: true, itemsType: "string", description: "all challenge answers" },
-    ],
-    workerTaskRetry: [
-        { name: "taskId", type: "string", required: true, description: "task id" },
-        { name: "featureId", type: "string", required: false, description: "feature id (canonical retry carries Feature identity; passed to the CLI as --feature-id when present)" },
-        { name: "reason", type: "string", required: true, description: "retry reason" },
-    ],
-    // long-running execution — formerly human-confirmation-only
-    dagRunTask: [
-        { name: "taskId", type: "string", required: true, description: "task id to run as a DAG" },
-        { name: "profile", type: "string", required: false, description: "DAG profile (defaults to auto)" },
-    ],
-    runDag: [
-        { name: "confirmationId", type: "string", required: true, description: "confirmation id (from prepareDagConfirmation) — raw dag path is never accepted from the model" },
-    ],
-    dagRerun: [
-        { name: "runId", type: "string", required: true, description: "dag run id" },
-        { name: "fromNode", type: "string", required: true, description: "node id to rerun from" },
-        { name: "planHash", type: "string", required: true, description: "rerun plan hash" },
-        { name: "reason", type: "string", required: true, description: "rerun reason" },
-    ],
-    standaloneTaskRerun: [
-        { name: "runId", type: "string", required: true, description: "dag run id" },
-        { name: "reason", type: "string", required: true, description: "rerun reason" },
-    ],
-    newTask: [
-        { name: "taskId", type: "string", required: true, description: "task id" },
-        { name: "title", type: "string", required: false, description: "task title (defaults to taskId)" },
-    ],
-    contractDraftSave: [
-        { name: "taskId", type: "string", required: false, description: "task id (defaults to draft.taskId)" },
-        {
-            name: "draft",
-            type: "object",
-            required: true,
-            description: "TaskContractDraftV1 object",
-        },
-    ],
-};
+const EXPLICIT_EXECUTABLE_GATE_ONLY = ["contractApply"];
+export function listExecutableGateOnlyActions() {
+    const derived = buildOperatorCapabilitiesDocument()
+        .actions.filter((action) => action.humanConfirmation === "required" &&
+        action.modelCallable !== "never")
+        .map((action) => action.action);
+    return [...new Set([...EXPLICIT_EXECUTABLE_GATE_ONLY, ...derived])].sort();
+}
+/** Frozen snapshot for tests / drift checks (recomputed from registry). */
+export const EXECUTABLE_GATE_ONLY_ACTIONS = Object.freeze(listExecutableGateOnlyActions());
+const EXECUTABLE_GATE_ONLY = new Set(EXECUTABLE_GATE_ONLY_ACTIONS);
 /**
- * Build the full Chat tool schema set from the capabilities registry.
- *
- * FAIL-CLOSED dynamic discovery: every whitelisted action MUST have an entry
- * in INPUT_PARAMS. An action present in the registry (and thus allowed by the
- * dynamic allowlist) but missing an INPUT_PARAMS entry is a CONTRACT GAP — it
- * means we don't know which params its dispatcher reads, so exposing it as a
- * zero-param tool would be a silent schema degradation (the model could call
- * it but couldn't supply required fields). Instead we throw at boot so the
- * gap is caught in tests and never ships. Diagnostics list the offending
- * actions so adding a registry action is a one-line INPUT_PARAMS update.
+ * Build the FULL Chat tool schema set from the capabilities registry — every
+ * registry action, INCLUDING modelCallable="never" ones (e.g.
+ * confirmDagConfirmation). Used by internal audits / capability surfaces that
+ * need to see the complete registry. The session layer uses
+ * buildModelCallableToolSchemas() to render only model-callable tools.
  */
 export function buildOperatorChatToolSchemas() {
     const doc = buildOperatorCapabilitiesDocument();
     const out = [];
-    const unschemaed = [];
     for (const action of doc.actions) {
-        const decision = authorizeOperatorChatTool(action.action);
-        if (!decision.ok)
-            continue;
-        const params = INPUT_PARAMS[action.action];
-        if (!params) {
-            // Fail-closed: an allowed action without a schema entry is a contract
-            // gap, not a zero-param tool. Collect then throw so boot/red-team tests
-            // surface it loudly.
-            unschemaed.push(action.action);
-            continue;
+        // Fail-closed: every registry action MUST carry inputParams. An action
+        // missing inputParams is a contract gap (the model could call it but we
+        // don't know which params its dispatcher reads). Throw at boot so the gap
+        // is caught in tests and never ships.
+        if (!Array.isArray(action.inputParams)) {
+            throw new Error(`Operator Chat tool schema gap: registry action "${action.action}" has no inputParams. Add inputParams (must match the dispatcher's paramsOf reads) in src/shared/operator/capabilities.ts.`);
         }
         out.push({
-            toolId: decision.toolId,
+            toolId: action.action,
             action: action.action,
             description: action.description,
             cli: action.cli,
             kind: action.kind,
-            inputParams: params,
+            inputParams: action.inputParams.map((p) => ({
+                name: p.name,
+                type: p.type,
+                required: p.required,
+                description: p.description,
+                ...(p.itemsType ? { itemsType: p.itemsType } : {}),
+            })),
+            modelCallable: action.modelCallable,
+            humanConfirmation: action.humanConfirmation,
+            ...(action.resultPolicy ? { resultPolicy: action.resultPolicy } : {}),
         });
     }
-    if (unschemaed.length > 0) {
-        throw new Error(`Operator Chat tool schema gap: allowed operator actions lack an INPUT_PARAMS entry: ${unschemaed.sort().join(", ")}. Add each to INPUT_PARAMS in tool-adapter.ts (must match the dispatcher's paramsOf reads).`);
-    }
     return out;
 }
 /**
- * Verify the adapter covers exactly the allowlist and nothing more.
- * Used by boot/red-team checks (V15 — the surface equals the registry).
+ * Build ONLY the model-callable tool schemas — i.e. exclude
+ * modelCallable="never" actions (roadmap M0-B / G03). This is the set the Pi
+ * session actually registers as custom tools: the human confirmation action
+ * (confirmDagConfirmation) is NOT a model tool; it can only be invoked by the
+ * browser mutation gate with a server-signed confirmation token.
+ */
+export function buildModelCallableToolSchemas() {
+    return buildOperatorChatToolSchemas().filter((s) => s.modelCallable !== "never" && !EXECUTABLE_GATE_ONLY.has(s.action));
+}
+/**
+ * Names of actions that MUST NOT be model-callable (roadmap G03 / G14).
+ * Derived from the registry so adding a "never" policy there is the only edit
+ * needed. Used by the three-gate tool whitelist to deny model invocation.
+ */
+export function modelForbiddenActions() {
+    return buildOperatorChatToolSchemas()
+        .filter((s) => s.modelCallable === "never" || EXECUTABLE_GATE_ONLY.has(s.action))
+        .map((s) => s.action);
+}
+/**
+ * Verify the adapter covers exactly the registry and nothing more.
+ * Used by boot/red-team checks (V15 — the full registry is schema'd).
  */
 export function verifyOperatorChatToolSurface() {
     const schemas = buildOperatorChatToolSchemas();
+    const doc = buildOperatorCapabilitiesDocument();
     const covered = schemas.map((s) => s.action).sort();
-    const expected = [...OPERATOR_CHAT_ALLOWED_TOOLS].sort();
+    const expected = doc.actions.map((a) => a.action).sort();
     const coveredSet = new Set(covered);
     const expectedSet = new Set(expected);
     const missing = expected.filter((a) => !coveredSet.has(a));

package/dist/worker/console/chat/tools.js

@@ -1,31 +1,39 @@
 /**
- * Operator Chat — tool whitelist (design §7.5 / plan D3, widened 2026-07-25).
+ * Operator Chat — closed tool whitelist (design §7.5 / roadmap M0).
  *
- * The General Operator Chat exposes the loop-agent runtime's FULL structured
- * operator surface as Pi tools, plus the built-in read/explore tools
- * (bash / read / grep / find / ls) so the model can probe the repo. It still
- * forbids file-WRITING coding tools (edit / write / apply_patch / full-tools /
- * shell / coding-chat) — those can never be activated.
+ * The Chat exposes the model-callable structured operator surface. Repository
+ * exploration is deliberately limited to safe-read/safe-grep/git-status/
+ * git-diff plus built-in find/ls; the bare SDK bash/read/grep tools are denied
+ * because they bypass the M0-A write and sensitive-data boundaries.
  *
- * DYNAMIC DISCOVERY: the allowed operator-action list is derived directly from
- * the capabilities registry (`buildOperatorCapabilitiesDocument()`), NOT
- * hard-coded. When runtime adds a new operator action to the registry, it
- * appears here automatically — zero code sync, and the previous
- * "whitelist/registry drift" risk (old plan D3 W5 constraint) is eliminated.
- * The only hand-maintained list is the DENY list of file-writing tools.
- *
- * bash is ALLOWED but bare (no command filter). The residual risk that bash
- * can still write files via `echo >` / `tee` / `sed -i` is accepted by the
- * owner and documented in the exec-plan Open Questions Q9. A future
- * command-filter layer can close that gap without changing this contract.
+ * Dynamic discovery derives model-callable operator actions directly from the
+ * capabilities registry. Explicit denial remains the defense-in-depth layer:
+ * a future resource-loader or SDK drift cannot reactivate removed coding or
+ * explore tools merely by changing the active-tool list.
  */
 import { buildOperatorCapabilitiesDocument } from "../../../shared/operator/capabilities.js";
 import { OFFICIAL_DENIED_TOOL_IDS } from "../resource-loader.js";
+import { EXECUTABLE_GATE_ONLY_ACTIONS } from "./tool-adapter.js";
+const EXECUTABLE_GATE_ONLY = new Set(EXECUTABLE_GATE_ONLY_ACTIONS);
+/**
+ * Actions the model MAY invoke. Derived from the registry but filtered by the
+ * modelCallable policy: modelCallable="never" actions (e.g. confirmDagConfirmation)
+ * are the human confirmation itself and MUST NOT be model-callable (roadmap
+ * M0-B / G03). They are never registered as Pi tools AND denied at the gate.
+ */
+export const OPERATOR_CHAT_ALLOWED_TOOLS = Object.freeze(buildOperatorCapabilitiesDocument()
+    .actions.filter((a) => a.modelCallable !== "never" && !EXECUTABLE_GATE_ONLY.has(a.action))
+    .map((a) => a.action));
 /**
- * All operator actions registered in the capabilities registry are exposed as
- * Chat tools. Derived dynamically so new actions appear automatically.
+ * Operator actions that MUST NOT be model-callable (roadmap M0-B / G03).
+ * Derived from the registry's modelCallable="never" policy. These are the
+ * human confirmation actions (confirmDagConfirmation) — the model can only
+ * prepare them; the browser mutation gate executes the confirm with a
+ * server-signed confirmation token.
  */
-export const OPERATOR_CHAT_ALLOWED_TOOLS = Object.freeze(buildOperatorCapabilitiesDocument().actions.map((a) => a.action));
+export const OPERATOR_CHAT_MODEL_FORBIDDEN_ACTIONS = Object.freeze(buildOperatorCapabilitiesDocument()
+    .actions.filter((a) => a.modelCallable === "never" || EXECUTABLE_GATE_ONLY.has(a.action))
+    .map((a) => a.action));
 /**
  * Operator actions denied by the legacy MVP boundary. Kept EMPTY since the
  * owner decided (2026-07-25) that the full operator surface is Chat-callable.
@@ -33,31 +41,40 @@ export const OPERATOR_CHAT_ALLOWED_TOOLS = Object.freeze(buildOperatorCapabiliti
  * stay defensive against future additions.
  */
 export const OPERATOR_CHAT_DENIED_OPERATOR_ACTIONS = Object.freeze([]);
-// Coding / generic tool ids that must never appear in a Chat session.
-// File-WRITING coding tools are forbidden (edit/write/apply_patch/full-tools/
-// coding-chat/shell). bash / read / grep / find / ls are intentionally
-// ALLOWED (owner decision 2026-07-25 — the Chat must be able to probe the
-// repo and run read-only commands). We therefore build the deny list from
-// OFFICIAL_DENIED_TOOL_IDS and then explicitly UN-deny BOTH the explore
-// tools AND the high-risk operator actions (contractApply / runDag / dagRerun
-// / etc. are now Chat-callable per the widening — OFFICIAL_DENIED_TOOL_IDS
-// listed them as a defense against accidental activation in the Interview
-// flow, but the Chat deliberately exposes the full operator surface).
-const _EXPLORE_TOOLS = new Set(["bash", "read", "grep", "find", "ls"]);
+// Coding / generic tool ids that must never appear in a Chat session. M0-A
+// removes bare bash (write-via-redirect) and SDK read/grep (no sensitive-file
+// boundary); find/ls remain the only SDK explore builtins. Safe content probes
+// are custom tools, not generic SDK tools.
+const _ALLOWED_SDK_EXPLORE_TOOLS = new Set(["find", "ls"]);
+const _REMOVED_SDK_EXPLORE_TOOLS = ["bash", "read", "grep"];
 // Operator actions that OFFICIAL_DENIED_TOOL_IDS carries for Interview safety
 // but that the Chat now deliberately allows. We compare on a COMPACTED form
 // (strip - and _) because OFFICIAL lists both camelCase (`contractApply`) and
 // snake_case (`contract_apply`) variants, and authorize() also normalizes —
 // leaving any variant in would re-deny the action via normalization.
 const _ALLOWED_OPERATOR_ACTIONS_COMPACT = new Set(OPERATOR_CHAT_ALLOWED_TOOLS.map((t) => t.toLowerCase().replace(/[-_]/g, "")));
-export const OPERATOR_CHAT_DENIED_TOOLS = Object.freeze(OFFICIAL_DENIED_TOOL_IDS.filter((id) => {
-    const lower = id.toLowerCase();
-    if (_EXPLORE_TOOLS.has(lower))
-        return false;
-    if (_ALLOWED_OPERATOR_ACTIONS_COMPACT.has(lower.replace(/[-_]/g, "")))
-        return false;
-    return true;
-}));
+export const OPERATOR_CHAT_DENIED_TOOLS = Object.freeze([
+    ...new Set([
+        ...OFFICIAL_DENIED_TOOL_IDS.filter((id) => {
+            const lower = id.toLowerCase();
+            if (_ALLOWED_SDK_EXPLORE_TOOLS.has(lower))
+                return false;
+            if (_ALLOWED_OPERATOR_ACTIONS_COMPACT.has(lower.replace(/[-_]/g, ""))) {
+                return false;
+            }
+            return true;
+        }),
+        ..._REMOVED_SDK_EXPLORE_TOOLS,
+    ]),
+]);
+/**
+ * Operator actions denied by model policy (modelCallable="never"). These are
+ * human-only actions (the confirmation itself) — derived from the registry so
+ * adding a "never" policy there is the only edit needed. Kept separate from
+ * OPERATOR_CHAT_DENIED_OPERATOR_ACTIONS (legacy empty MVP boundary list) to
+ * preserve the two distinct concerns (model policy vs MVP mutation boundary).
+ */
+const DENIED_MODEL_POLICY = new Set(OPERATOR_CHAT_MODEL_FORBIDDEN_ACTIONS.map((a) => a.toLowerCase()));
 const ALLOWED = new Set(OPERATOR_CHAT_ALLOWED_TOOLS.map((t) => t.toLowerCase()));
 const DENIED_ACTIONS = new Set(OPERATOR_CHAT_DENIED_OPERATOR_ACTIONS.map((a) => a.toLowerCase()));
 const DENIED_TOOLS = new Set(OPERATOR_CHAT_DENIED_TOOLS.map((t) => t.toLowerCase()));
@@ -70,6 +87,9 @@ export function isOperatorChatToolDenied(toolId) {
         return true;
     if (DENIED_ACTIONS.has(id))
         return true;
+    // modelCallable="never" actions are always denied to the model (roadmap G03).
+    if (DENIED_MODEL_POLICY.has(id))
+        return true;
     // normalize snake/camel/kebab
     const compact = id.replace(/[-_]/g, "");
     for (const d of DENIED_TOOLS) {
@@ -80,6 +100,10 @@ export function isOperatorChatToolDenied(toolId) {
         if (d.replace(/[-_]/g, "") === compact)
             return true;
     }
+    for (const d of DENIED_MODEL_POLICY) {
+        if (d.replace(/[-_]/g, "") === compact)
+            return true;
+    }
     return false;
 }
 /**
@@ -101,7 +125,7 @@ export function authorizeOperatorChatTool(toolId) {
             ok: false,
             code: "tool-denied",
             toolId: id,
-            message: `tool "${id}" is denied in General Operator Chat (no edit/write/apply_patch/full-tools/shell/coding-chat)`,
+            message: `tool "${id}" is denied in General Operator Chat (no bash/read/grep/edit/write/apply_patch/full-tools/shell/coding-chat)`,
         };
     }
     if (!isOperatorChatToolAllowed(id)) {
@@ -131,12 +155,9 @@ export function filterOperatorChatTools(requested) {
     return { allowed, denied };
 }
 /**
- * Assert that a full requested tool set contains NO file-writing coding tool.
- * Used by red-team / boot checks (V12 — closed coding surface). Note: bash is
- * intentionally ALLOWED since the 2026-07-25 widening (owner decision); this
- * guard now only blocks tools whose PRIMARY purpose is editing files
- * (edit/write/apply_patch/full-tools/shell). The residual write-via-bash risk
- * (`echo >` / `tee`) is documented in exec-plan Open Questions Q9.
+ * Assert that a requested tool set contains no prohibited coding or removed
+ * SDK explore tool. Used by red-team / boot checks (V12 / M0-A). bash is
+ * explicitly forbidden: accepting it would recreate the redirect write escape.
  */
 export function assertNoWriteToolInList(requested) {
     const writeVariants = [
@@ -149,6 +170,9 @@ export function assertNoWriteToolInList(requested) {
         "coding-chat",
         "coding_chat",
         "shell",
+        "bash",
+        "read",
+        "grep",
     ];
     const lower = new Set(requested.map((t) => t.trim().toLowerCase()));
     for (const v of writeVariants) {
@@ -158,8 +182,8 @@ export function assertNoWriteToolInList(requested) {
     }
 }
 /**
- * Back-compat alias kept for callers that still reference the old name. Now
- * asserts absence of file-writing tools (bash is allowed post-widening).
+ * Back-compat alias kept for callers that still reference the old name. It
+ * also rejects removed SDK explore tools, including bash.
  * @deprecated use {@link assertNoWriteToolInList}.
  */
 export function assertNoBashInToolList(requested) {

package/dist/worker/console/chat/usage.js

@@ -0,0 +1,37 @@
+function record(value) {
+    return value && typeof value === "object" ? value : undefined;
+}
+function numberAt(source, keys) {
+    for (const key of keys)
+        if (typeof source[key] === "number" && Number.isFinite(source[key]))
+            return Math.max(0, source[key]);
+    return undefined;
+}
+export function extractUsageSample(value) {
+    const event = record(value);
+    if (!event)
+        return undefined;
+    const message = record(event.message);
+    const source = record(event.usage) ?? record(message?.usage) ?? record(event.tokenUsage);
+    if (!source)
+        return undefined;
+    const inputTokens = numberAt(source, ["input_tokens", "inputTokens", "prompt_tokens", "promptTokens"]);
+    const outputTokens = numberAt(source, ["output_tokens", "outputTokens", "completion_tokens", "completionTokens"]);
+    const totalTokens = numberAt(source, ["total_tokens", "totalTokens"]) ?? (inputTokens !== undefined || outputTokens !== undefined ? (inputTokens ?? 0) + (outputTokens ?? 0) : undefined);
+    if (inputTokens === undefined && outputTokens === undefined && totalTokens === undefined)
+        return undefined;
+    const responseKey = [event.responseId, message?.id, source.responseId].find((item) => typeof item === "string");
+    return { inputTokens, outputTokens, totalTokens, ...(responseKey ? { responseKey } : {}) };
+}
+export function aggregateUsage(samples) {
+    const keyed = new Map();
+    const anonymous = [];
+    for (const sample of samples)
+        sample.responseKey ? keyed.set(sample.responseKey, sample) : anonymous.push(sample);
+    const selected = [...keyed.values(), ...anonymous];
+    return selected.reduce((sum, sample) => ({
+        inputTokens: sum.inputTokens + (sample.inputTokens ?? 0), outputTokens: sum.outputTokens + (sample.outputTokens ?? 0), totalTokens: sum.totalTokens + (sample.totalTokens ?? ((sample.inputTokens ?? 0) + (sample.outputTokens ?? 0))),
+        cost: sample.cost === undefined ? sum.cost : (sum.cost ?? 0) + sample.cost,
+        estimated: Boolean(sum.estimated || sample.estimated),
+    }), { inputTokens: 0, outputTokens: 0, totalTokens: 0 });
+}

package/dist/worker/console/chat/workspace-landing.js

@@ -0,0 +1,56 @@
+export const ACTIVE_CHAT_SESSION_STORAGE_KEY = "loop-console.operator-chat.active-session.v1";
+export const DEFAULT_LANDING_STORAGE_KEY = "loop-console.operator-chat.default-landing.v1";
+function configuredLanding(value) {
+    const normalized = value?.trim().toLowerCase();
+    if (normalized === "chat")
+        return "chat";
+    if (normalized === "tasks")
+        return "tasks";
+    return undefined;
+}
+function configuredWorkspace(value) {
+    const normalized = value?.trim().toLowerCase();
+    if (normalized === "chat" || normalized === "tasks" || normalized === "recovery")
+        return normalized;
+    return undefined;
+}
+function workspaceFromLocation(location) {
+    if (!location)
+        return undefined;
+    const query = new URLSearchParams(location.search);
+    const queryValue = configuredLanding(query.get("landing") ?? query.get("workspace"));
+    if (queryValue)
+        return queryValue;
+    const hash = location.hash.startsWith("#") ? location.hash.slice(1) : location.hash;
+    return configuredLanding(new URLSearchParams(hash).get("workspace"));
+}
+export function resolveDefaultLanding(input) {
+    return workspaceFromLocation(input.location) ??
+        configuredLanding(input.storage?.getItem(DEFAULT_LANDING_STORAGE_KEY)) ??
+        configuredLanding(input.env) ??
+        "tasks";
+}
+export function buildWorkspaceHref(workspace, params = {}) {
+    const query = new URLSearchParams({ workspace });
+    for (const [key, value] of Object.entries(params)) {
+        if (value?.trim())
+            query.set(key, value.trim());
+    }
+    return `/?${query.toString()}`;
+}
+export function parseWorkspaceHref(location) {
+    const query = new URLSearchParams(location.search);
+    const hash = location.hash.startsWith("#") ? location.hash.slice(1) : location.hash;
+    const hashQuery = new URLSearchParams(hash);
+    const workspace = configuredWorkspace(query.get("workspace") ?? query.get("landing") ?? hashQuery.get("workspace"));
+    if (!workspace)
+        return null;
+    const read = (key) => query.get(key)?.trim() || undefined;
+    return {
+        workspace,
+        ...(read("taskId") ? { taskId: read("taskId") } : {}),
+        ...(read("dagRunId") ? { dagRunId: read("dagRunId") } : {}),
+        ...(read("fromNodeId") ? { fromNodeId: read("fromNodeId") } : {}),
+        ...(read("featureId") ? { featureId: read("featureId") } : {}),
+    };
+}