@tea-agent/loop-agent 0.23.1 → 0.24.1

package/dist/worker/console/chat/pi-runtime.js

@@ -24,12 +24,15 @@
  * `createDefaultPiSdkBindings()`.
  */
 import { randomBytes } from "node:crypto";
+import { projectCompactSnapshot } from "./chat-event-store.js";
 import path from "node:path";
+import { extractUsageSample } from "./usage.js";
 import { OPERATOR_CHAT_ALLOWED_TOOLS, authorizeOperatorChatTool, assertNoWriteToolInList, } from "./tools.js";
 import { createOperatorChatResourceLoader, } from "./resource-loader.js";
-import { loadOperatorChatInstructionSkills, composeInstructionSkillsPrompt, } from "./instruction-skills.js";
-import { buildOperatorChatToolSchemas } from "./tool-adapter.js";
+import { loadOperatorChatInstructionSkills, composeInstructionSkillsPrompt, OPERATOR_CHAT_ALLOWED_INSTRUCTION_SKILLS, } from "./instruction-skills.js";
+import { buildModelCallableToolSchemas } from "./tool-adapter.js";
 import { resolveDefaultChatModel, } from "./model-resolver.js";
+import { filterActiveInterviewTools } from "../interview/tools.js";
 /**
  * Base system prompt fragment every General Operator Chat session receives.
  *
@@ -47,34 +50,47 @@ import { resolveDefaultChatModel, } from "./model-resolver.js";
 const OPERATOR_CHAT_SYSTEM_PROMPT_BASE = [
     "You are the General Operator Chat for loop-agent / agent-worker.",
     "You are an OPERATOR: you orchestrate and inspect via the registered operator_* tools. You are NOT an implementer.",
-    "Tool surface: you have the built-in read/explore tools (bash, read, grep, find, ls) to probe the repo, AND the full set of operator_* tools (all registered operator actions, including high-risk mutations such as contractApply / runDag / dagRerun / standaloneTaskRerun / workerTaskRetry / importPrd / confirmDagConfirmation / dagRunTask).",
-    "You do NOT have edit / write / apply_patch / full-tools / shell / coding-chat — file-WRITING is still gated behind the DAG path. All canonical writes still go through DAG implement-pi / repair-pi, never via this chat. The residual write-via-bash-redirect risk (`echo >` / `tee`) is an accepted documented residual.",
-    "High-risk mutations are now callable as tools, but each still requires its prepared receipt (e.g. contractApply needs a fresh complete assessment; runDag needs a confirmationId from prepareDagConfirmation; dagRerun needs a planHash). When a high-risk action fails on missing prepared state, use read-only tools (status, doctor, dagReport, inspect, contractShow) to diagnose, then tell the user to prepare the receipt via the human-confirmation page if needed.",
-    "Prefer read-only tools (status, doctor, dagReport, inspect, contractShow) to diagnose before acting.",
+    "Tool surface: you have safe read-only explore tools (safe-read, safe-grep, git-status, git-diff, find, ls) to probe the repo, AND the model-callable operator_* tools. bash is NOT available (it was removed to close a write-via-redirect escape); use safe-read / safe-grep / git-status / git-diff instead.",
+    "safe-read / safe-grep enforce a repo-relative path boundary, a sensitive-file denylist (.env* / *.key / *.pem / .git/** / auth.json / sessions/**) and secret scrubbing. Do not attempt to read those files via any other path.",
+    "You do NOT have edit / write / apply_patch / full-tools / shell / coding-chat — file-WRITING is gated behind the DAG path. All canonical writes still go through DAG implement-pi / repair-pi, never via this chat.",
+    "High-risk mutations are not model-executable tools. Prepare contract via interview then apply via contractApply, prepare DAG runs via prepareDagConfirmation, prepare other mutations via prepareMutationGate, then confirm in the browser Human Gate. When a high-risk action (contractApply / runDag / dagRerun / etc.) fails on missing prepared state, use read-only tools (status, doctor, dagReport, inspect, contractShow, safe-read, safe-grep) to diagnose.",
+    "You cannot self-confirm a DAG run: confirmDagConfirmation is a human-only action (executed by the browser with a server-signed confirmation token). You may only prepare it via prepareDagConfirmation; the user must confirm in the UI.",
+    "Prefer read-only tools (status, doctor, dagReport, inspect, contractShow, safe-read, safe-grep, git-status) to diagnose before acting.",
 ].join("\n");
 /**
  * Built-in SDK read/explore tool names registered for every Chat session.
  *
- * These MUST be passed as `tools:` to createSessionFromServices (Gate 1) so the
- * SDK actually registers grep/find/ls — its default builtin set is only
- * read/bash/edit/write. Excluding edit/write via excludeTools then leaves
- * exactly bash/read/grep/find/ls as the builtin surface.
+ * M0-A (roadmap §14 工作块 A): bash is REMOVED — it could write files via
+ * `echo >` / `tee` / `sed -i` / `node -e writeFile`, bypassing the DAG write
+ * boundary. The residual read-only repo probing is served by the custom
+ * safe-read / safe-grep / find / ls tools (see buildExploreCustomTools) which
+ * enforce a repo-relative path boundary, a sensitive-file denylist, and
+ * secret scrubbing on the returned content. edit/write/... stay excluded.
  */
 export const OPERATOR_CHAT_BUILTIN_EXPLORE_TOOLS = Object.freeze([
-    "bash",
-    "read",
-    "grep",
     "find",
     "ls",
 ]);
 /**
  * Canonical active tool-set handed to setActiveToolsByName at every gate:
- * every operator action (dynamic, from the registry) PLUS the built-in
- * explore tools. File-WRITING coding tools (edit/write/...) are never here —
- * they are excluded at the registry level and thus cannot be activated.
+ * every model-callable operator action (dynamic, from the registry) PLUS the
+ * built-in explore tools (find/ls) PLUS the safe explore custom tools
+ * (safe-read / safe-grep / git-status / git-diff). bash is NOT here (M0-A).
+ * File-WRITING coding tools (edit/write/...) are never here — they are
+ * excluded at the registry level and thus cannot be activated.
  */
+export const OPERATOR_CHAT_SAFE_EXPLORE_TOOL_IDS = Object.freeze([
+    "safe-read",
+    "safe-grep",
+    "git-status",
+    "git-diff",
+]);
 export function OPERATOR_CHAT_ACTIVE_TOOL_NAMES() {
-    return [...OPERATOR_CHAT_ALLOWED_TOOLS, ...OPERATOR_CHAT_BUILTIN_EXPLORE_TOOLS];
+    return [
+        ...OPERATOR_CHAT_ALLOWED_TOOLS,
+        ...OPERATOR_CHAT_BUILTIN_EXPLORE_TOOLS,
+        ...OPERATOR_CHAT_SAFE_EXPLORE_TOOL_IDS,
+    ];
 }
 /**
  * Build Pi custom ToolDefinition objects for every whitelisted operator action.
@@ -88,7 +104,7 @@ async function buildCustomOperatorTools(options) {
         import("typebox"),
         import("@earendil-works/pi-coding-agent"),
     ]);
-    const schemas = buildOperatorChatToolSchemas();
+    const schemas = buildModelCallableToolSchemas();
     const ctx = options.actionContext;
     return schemas.map((schema) => {
         // TypeBox schema is built dynamically; cast through unknown to the builder
@@ -146,6 +162,185 @@ async function buildCustomOperatorTools(options) {
         });
     });
 }
+/**
+ * Build the safe explore custom tools (roadmap M0-A / G16): safe-read,
+ * safe-grep, gitStatus, gitDiff. These replace the bare SDK bash/read/grep so
+ * the model can probe the repo WITHOUT write escapes (echo redirect, tee,
+ * sed -i, node -e) and WITHOUT reading sensitive files (env files, key/pem,
+ * auth.json, sessions dir) — and every returned byte is secret-scrubbed
+ * before reaching the model context.
+ *
+ * gitStatus/gitDiff use a FIXED argv (typed, no shell) so they cannot be
+ * turned into an arbitrary-shell vector.
+ */
+async function buildExploreCustomTools(options) {
+    const [{ Type }, { defineTool }] = await Promise.all([
+        import("typebox"),
+        import("@earendil-works/pi-coding-agent"),
+    ]);
+    const { execFileSync } = await import("node:child_process");
+    const repoRoot = options.repoRoot;
+    const { safeReadFile, safeGrep, scrubSecrets } = await import("./explore-tools.js");
+    function safeGit(args) {
+        try {
+            const stdout = execFileSync("git", args, {
+                cwd: repoRoot,
+                encoding: "utf8",
+                // Fixed argv, no shell, bounded output.
+                maxBuffer: 512 * 1024,
+                timeout: 10_000,
+                windowsHide: true,
+            });
+            return { ok: true, stdout };
+        }
+        catch (e) {
+            return {
+                ok: false,
+                code: "GIT_FAILED",
+                message: e instanceof Error ? e.message : String(e),
+            };
+        }
+    }
+    const safeReadTool = defineTool({
+        name: "safe-read",
+        label: "safe-read",
+        description: "Read a repo-relative file with sensitive-file denylist (.env*/*.key/*.pem/.git/**/auth.json/sessions/**) and secret scrubbing. Absolute paths and .. are rejected.",
+        promptSnippet: "safe-read: read a repo file (safe; secrets scrubbed)",
+        parameters: Type.Object({
+            path: Type.String({ description: "repo-relative file path" }),
+        }, { additionalProperties: false }),
+        async execute(_toolCallId, params) {
+            const raw = String(params.path ?? "");
+            try {
+                const result = await safeReadFile(repoRoot, raw);
+                return {
+                    content: [{ type: "text", text: JSON.stringify(result) }],
+                    details: result,
+                };
+            }
+            catch (e) {
+                const err = e;
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify({
+                                error: err.message ?? String(e),
+                                code: err.code ?? "READ_FAILED",
+                            }),
+                        },
+                    ],
+                    details: { error: err.message ?? String(e), code: err.code ?? "READ_FAILED" },
+                };
+            }
+        },
+    });
+    const safeGrepTool = defineTool({
+        name: "safe-grep",
+        label: "safe-grep",
+        description: "Line search across the repo working tree with sensitive-file denylist and secret scrubbing. pattern is a JS regex source; optional glob filters paths.",
+        promptSnippet: "safe-grep: search repo files (safe; secrets scrubbed)",
+        parameters: Type.Object({
+            pattern: Type.String({ description: "regex source (no shell)" }),
+            caseInsensitive: Type.Optional(Type.Boolean()),
+            glob: Type.Optional(Type.String({ description: "optional glob filter e.g. *.ts" })),
+        }, { additionalProperties: false }),
+        async execute(_toolCallId, params) {
+            try {
+                const result = await safeGrep(repoRoot, String(params.pattern ?? ""), {
+                    caseInsensitive: Boolean(params.caseInsensitive),
+                    glob: params.glob ? String(params.glob) : undefined,
+                });
+                return {
+                    content: [{ type: "text", text: JSON.stringify(result) }],
+                    details: result,
+                };
+            }
+            catch (e) {
+                const err = e;
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify({
+                                error: err.message ?? String(e),
+                                code: err.code ?? "GREP_FAILED",
+                            }),
+                        },
+                    ],
+                    details: { error: err.message ?? String(e), code: err.code ?? "GREP_FAILED" },
+                };
+            }
+        },
+    });
+    const gitStatusTool = defineTool({
+        name: "git-status",
+        label: "git-status",
+        description: "Typed `git status --porcelain` (fixed argv, no shell). Returns scrubbed working-tree status.",
+        promptSnippet: "git-status: working tree status (read-only)",
+        parameters: Type.Object({}, { additionalProperties: false }),
+        async execute() {
+            const r = safeGit(["status", "--porcelain"]);
+            if (!r.ok) {
+                return {
+                    content: [{ type: "text", text: JSON.stringify({ error: r.message, code: r.code }) }],
+                    details: { error: r.message, code: r.code },
+                };
+            }
+            const { scrubbed, redactions } = scrubSecrets(r.stdout);
+            const payload = { status: scrubbed, redactions };
+            return {
+                content: [{ type: "text", text: JSON.stringify(payload) }],
+                details: payload,
+            };
+        },
+    });
+    const gitDiffTool = defineTool({
+        name: "git-diff",
+        label: "git-diff",
+        description: "Typed `git diff` (fixed argv: --stat or a single -- path; no shell). Returns scrubbed diff. path must be repo-relative and not sensitive.",
+        promptSnippet: "git-diff: diff (read-only, scrubbed)",
+        parameters: Type.Object({
+            path: Type.Optional(Type.String({ description: "optional repo-relative path to diff (default: whole tree --stat)" })),
+        }, { additionalProperties: false }),
+        async execute(_toolCallId, params) {
+            let rawPath = params.path ? String(params.path) : undefined;
+            // If a path is supplied, validate it via the read-path guard so git diff
+            // cannot be aimed at sensitive files (.env* / auth.json / sessions).
+            if (rawPath) {
+                const { guardReadPath } = await import("./explore-tools.js");
+                const g = await guardReadPath(repoRoot, rawPath);
+                if (!g.ok) {
+                    return {
+                        content: [
+                            { type: "text", text: JSON.stringify({ error: g.message, code: g.code }) },
+                        ],
+                        details: { error: g.message, code: g.code },
+                    };
+                }
+                rawPath = g.repoRelative;
+            }
+            const args = rawPath
+                ? ["diff", "--", rawPath]
+                : ["diff", "--stat"];
+            const r = safeGit(args);
+            if (!r.ok) {
+                return {
+                    content: [{ type: "text", text: JSON.stringify({ error: r.message, code: r.code }) }],
+                    details: { error: r.message, code: r.code },
+                };
+            }
+            const { scrubbed, redactions } = scrubSecrets(r.stdout);
+            const payload = { diff: scrubbed, redactions };
+            return {
+                content: [{ type: "text", text: JSON.stringify(payload) }],
+                details: payload,
+            };
+        },
+    });
+    return [safeReadTool, safeGrepTool, gitStatusTool, gitDiffTool];
+}
+export const THINKING_LEVELS = ["off", "minimal", "low", "medium", "high", "xhigh", "max"];
 /**
  * Extract the latest assistant text fragment from an SDK message object.
  * Tolerant of multiple message shapes the SDK emits.
@@ -176,7 +371,11 @@ export class ConsolePiRuntime {
     options;
     loader;
     sessions = new Map();
+    modelRuntimes = new Map();
+    sessionManagers = new Map();
+    mainlineLeaves = new Map();
     bindings;
+    disabledInstructionSkills = new Set();
     constructor(options) {
         this.options = options;
         this.loader = createOperatorChatResourceLoader();
@@ -186,6 +385,17 @@ export class ConsolePiRuntime {
     get sessionDir() {
         return this.options.sessionDir;
     }
+    /** Resolve the Pi agent directory for bounded Console configuration APIs. */
+    async getAgentDir() {
+        return safeGetAgentDir(this.bindings);
+    }
+    async testConfiguredModel(model) {
+        const { services } = await this.bindings.createServices({ cwd: this.options.cwd, agentDir: await this.getAgentDir() });
+        return { available: Boolean(this.bindings.resolveModel({ modelRuntime: services.modelRuntime, provider: model.provider, modelId: model.modelId })) };
+    }
+    setDisabledInstructionSkills(names) {
+        this.disabledInstructionSkills = new Set(names);
+    }
     /** Operator action context used by custom-tool dispatchers (Gate 3). */
     get actionContext() {
         return this.options.actionContext;
@@ -227,7 +437,7 @@ export class ConsolePiRuntime {
      */
     async composeSystemPromptSkills() {
         try {
-            const result = await loadOperatorChatInstructionSkills(this.options.skillsDir);
+            const result = await loadOperatorChatInstructionSkills(this.options.skillsDir, OPERATOR_CHAT_ALLOWED_INSTRUCTION_SKILLS.filter((name) => !this.disabledInstructionSkills.has(name)));
             return composeInstructionSkillsPrompt(result.loaded);
         }
         catch (error) {
@@ -297,10 +507,10 @@ export class ConsolePiRuntime {
         assertNoWriteToolInList(OPERATOR_CHAT_ALLOWED_TOOLS);
         // Build custom Pi tools that route whitelisted operator actions into
         // the dispatcher (Gate 3 lives inside each tool's execute()).
-        let customTools;
+        let operatorCustomTools = [];
         if (this.options.actionContext) {
             try {
-                customTools = await buildCustomOperatorTools({
+                operatorCustomTools = await buildCustomOperatorTools({
                     actionContext: this.options.actionContext,
                 });
             }
@@ -311,26 +521,37 @@ export class ConsolePiRuntime {
                 process.stderr.write(`[console] chat custom-tools build failed: ${error instanceof Error ? error.message : String(error)}\n`);
             }
         }
-        // Tool surface (2026-07-25 widening):
-        //   - ALL operator actions are registered as customTools (full runtime
-        //     capability surface — derived dynamically from the registry).
-        //   - Built-in read/explore tools (bash/read/grep/find/ls) are registered
+        // M0-A: also register the safe explore tools (safe-read / safe-grep /
+        // git-status / git-diff) so the model can probe the repo without bash.
+        let exploreCustomTools = [];
+        try {
+            exploreCustomTools = await buildExploreCustomTools({
+                repoRoot: this.options.cwd,
+            });
+        }
+        catch (error) {
+            process.stderr.write(`[console] chat explore-tools build failed: ${error instanceof Error ? error.message : String(error)}\n`);
+        }
+        const customTools = [...operatorCustomTools, ...exploreCustomTools];
+        // Tool surface (roadmap M0):
+        //   - ALL model-callable operator actions are registered as customTools.
+        //   - Safe explore tools (safe-read / safe-grep / git-status / git-diff)
+        //     are also registered as customTools (bash is GONE — M0-A removes
+        //     the write-via-redirect escape).
+        //   - Built-in find/ls are registered by passing `tools:` (Gate 1). The
+        //     default builtin read/bash/edit/write are EXCLUDED: read/bash/grep
+        //     are replaced by the safe custom versions above; edit/write stay
+        //     excluded (file-writing never activated).
         //     by passing `tools: OPERATOR_CHAT_BUILTIN_EXPLORE_TOOLS` (Gate 1).
         //     This is REQUIRED: the SDK's default builtin set is only
         //     `read, bash, edit, write` (grep/find/ls are NOT default builtins —
         //     see SDK CreateAgentSessionOptions.tools docs). Without `tools`, the
-        //     later setActiveToolsByName(["grep","find","ls"]) would silently
-        //     no-op because those tools would not exist in the registry.
-        //   - We then exclude edit/write so the only file-WRITING path is gone.
-        //   - bash is bare (no command filter); the residual write-via-redirect
-        //     risk is accepted (exec-plan Q9).
         const { session } = await this.bindings.createSessionFromServices({
             services,
             sessionManager,
-            // Explicitly register the explore-tool builtin set (Gate 1). This is
-            // what makes grep/find/ls actually available — the SDK default builtin
-            // set is only read/bash/edit/write. Combined with excludeTools below,
-            // the effective registry = explore tools + customTools (operator actions).
+            // Explicitly register the explore-tool builtin set (Gate 1): find/ls.
+            // The default builtin read/bash/edit/write are EXCLUDED below; read/
+            // grep/bash are replaced by the safe customTools (M0-A).
             tools: [...OPERATOR_CHAT_BUILTIN_EXPLORE_TOOLS],
             excludeTools: [
                 "edit",
@@ -342,6 +563,14 @@ export class ConsolePiRuntime {
                 "coding-chat",
                 "coding_chat",
                 "shell",
+                // M0-A: bash is removed entirely (write-via-redirect escape). The
+                // model gets safe-read / safe-grep custom tools instead.
+                "bash",
+                // M0-A: built-in read/grep are replaced by custom safe-read/safe-grep
+                // that enforce a repo-relative boundary, a sensitive-file denylist,
+                // and secret scrubbing (roadmap G16).
+                "read",
+                "grep",
             ],
             ...(customTools && customTools.length > 0
                 ? { customTools }
@@ -353,6 +582,8 @@ export class ConsolePiRuntime {
         // File-writing tools are excluded above and thus cannot appear here.
         session.setActiveToolsByName(OPERATOR_CHAT_ACTIVE_TOOL_NAMES());
         this.sessions.set(sessionId, session);
+        this.sessionManagers.set(sessionId, sessionManager);
+        this.modelRuntimes.set(sessionId, modelRuntime);
         return {
             sessionId,
             sessionFile: session.sessionFile,
@@ -361,6 +592,268 @@ export class ConsolePiRuntime {
             activeTools: session.getActiveToolNames(),
         };
     }
+    async forkSession(init) {
+        if (!this.bindings.forkSessionManager)
+            throw new Error("SESSION_FORK_UNSUPPORTED");
+        const sessionId = `operator-chat-${randomBytes(12).toString("hex")}`;
+        const sessionManager = await this.bindings.forkSessionManager({
+            sourcePath: init.sourceSessionFile,
+            targetCwd: this.options.cwd,
+            targetSessionDir: this.options.sessionDir,
+            targetSessionId: sessionId,
+        });
+        const built = await this.buildSessionWithServices({ sessionManager, model: init.model });
+        built.session.setActiveToolsByName(OPERATOR_CHAT_ACTIVE_TOOL_NAMES());
+        this.sessions.set(sessionId, built.session);
+        this.sessionManagers.set(sessionId, sessionManager);
+        this.modelRuntimes.set(sessionId, built.modelRuntime);
+        return { sessionId, sessionFile: built.session.sessionFile, createdAt: new Date().toISOString(), model: init.model, activeTools: built.session.getActiveToolNames() };
+    }
+    async branchSession(input) {
+        const session = this.sessions.get(input.sessionId);
+        const manager = this.sessionManagers.get(input.sessionId);
+        if (!session || !manager)
+            throw new Error(`chat session not active: ${input.sessionId}`);
+        if (session.isStreaming === true || session.isIdle === false)
+            throw new Error("CHAT_TURN_ACTIVE");
+        if (!manager.getEntry?.(input.branchFromEntryId))
+            throw new Error("BRANCH_ENTRY_NOT_FOUND");
+        if (!this.mainlineLeaves.has(input.sessionId))
+            this.mainlineLeaves.set(input.sessionId, manager.getLeafId?.());
+        const entry = input.summary
+            ? manager.branchWithSummary?.(input.branchFromEntryId, input.summary)
+            : (manager.branch(input.branchFromEntryId), undefined);
+        return { branchedFromEntryId: input.branchFromEntryId, ...(entry?.id ? { branchSummaryEntryId: entry.id } : {}) };
+    }
+    switchToMainline(sessionId) {
+        const manager = this.sessionManagers.get(sessionId);
+        if (!manager)
+            throw new Error(`chat session not active: ${sessionId}`);
+        manager.branch(this.mainlineLeaves.get(sessionId));
+        this.mainlineLeaves.delete(sessionId);
+    }
+    getBranchContext(sessionId) {
+        const manager = this.sessionManagers.get(sessionId);
+        if (!manager)
+            throw new Error(`chat session not active: ${sessionId}`);
+        return { leafId: manager.getLeafId?.() ?? null, entries: manager.getBranch?.() ?? [] };
+    }
+    async listModels(sessionId) {
+        const modelRuntime = this.modelRuntimes.get(sessionId);
+        if (!this.sessions.has(sessionId) || !modelRuntime)
+            throw new Error(`chat session not active: ${sessionId}`);
+        return this.bindings.listAvailableModels({ modelRuntime });
+    }
+    async applyModel(sessionId, model) {
+        const session = this.sessions.get(sessionId);
+        const modelRuntime = this.modelRuntimes.get(sessionId);
+        if (!session || !modelRuntime)
+            throw new Error(`chat session not active: ${sessionId}`);
+        if (!session.setModel)
+            throw new Error("MODEL_SWITCH_UNSUPPORTED");
+        const resolved = this.bindings.resolveModel({ modelRuntime, provider: model.provider, modelId: model.modelId });
+        if (!resolved)
+            throw new Error("MODEL_NOT_AVAILABLE");
+        await session.setModel(resolved);
+        return { provider: session.model?.provider ?? model.provider, modelId: session.model?.id ?? session.model?.modelId ?? model.modelId };
+    }
+    applyThinkingLevel(sessionId, level) {
+        const session = this.sessions.get(sessionId);
+        if (!session)
+            throw new Error(`chat session not active: ${sessionId}`);
+        if (!THINKING_LEVELS.includes(level) || !session.setThinkingLevel)
+            throw new Error("THINKING_LEVEL_UNSUPPORTED");
+        session.setThinkingLevel(level);
+        return session.thinkingLevel ?? level;
+    }
+    getRuntimeSelection(sessionId) {
+        const session = this.sessions.get(sessionId);
+        if (!session)
+            return { activeTools: [] };
+        const provider = session.model?.provider;
+        const modelId = session.model?.id ?? session.model?.modelId;
+        return { ...(provider && modelId ? { model: { provider, modelId } } : {}), ...(session.thinkingLevel ? { thinkingLevel: session.thinkingLevel } : {}), activeTools: session.getActiveToolNames() };
+    }
+    /**
+     * Re-open a previously persisted Chat session after Console restart or
+     * browser refresh (roadmap M1-S04 / S05).
+     *
+     * Unlike `createSession`, this reuses the EXISTING Pi JSONL session file so
+     * the conversation history is preserved. The SDK's `SessionManager.open(path)`
+     * loads the file; we then rebuild the same services + pinned tool surface so
+     * the operator-chat three-gate policy still applies after a restart.
+     *
+     * Fail-closed contract: if `sessionFile` is missing, or the SDK cannot open
+     * it (file deleted/corrupt), returns an `{ ok: false, code }` result rather
+     * than silently creating a fresh empty session and losing prior context.
+     */
+    async reopenSession(init) {
+        const sessionId = init.sessionId;
+        // Already active in-memory: idempotent reopen is a no-op success.
+        if (this.sessions.has(sessionId)) {
+            return { ok: true, handle: await this.snapshotActive(sessionId) };
+        }
+        if (!init.sessionFile) {
+            return {
+                ok: false,
+                code: "NO_SESSION_FILE",
+                message: `cannot reopen chat session ${sessionId}: no persisted Pi session file`,
+            };
+        }
+        let sessionManager;
+        try {
+            sessionManager = await this.bindings.openSessionManager({
+                sessionFile: init.sessionFile,
+            });
+        }
+        catch (error) {
+            return {
+                ok: false,
+                code: "REOPEN_FAILED",
+                message: error instanceof Error ? error.message : String(error),
+            };
+        }
+        if (!sessionManager) {
+            return {
+                ok: false,
+                code: "REOPEN_FAILED",
+                message: `Pi session file not openable: ${init.sessionFile}`,
+            };
+        }
+        try {
+            const built = await this.buildSessionWithServices({
+                sessionManager,
+                model: init.model,
+                systemPromptSuffix: init.systemPromptSuffix,
+            });
+            const session = built.session;
+            // The reopened session MUST report the SAME sessionId as the durable
+            // record, otherwise we'd be serving a different conversation under a
+            // stale id. Mismatch is a fail-closed reopen failure.
+            if (session.sessionId !== sessionId) {
+                try {
+                    session.dispose();
+                }
+                catch {
+                    // ignore
+                }
+                return {
+                    ok: false,
+                    code: "REOPEN_FAILED",
+                    message: `reopened Pi sessionId mismatch: expected ${sessionId}, got ${session.sessionId}`,
+                };
+            }
+            session.setActiveToolsByName(OPERATOR_CHAT_ACTIVE_TOOL_NAMES());
+            this.sessions.set(sessionId, session);
+            this.sessionManagers.set(sessionId, sessionManager);
+            this.modelRuntimes.set(sessionId, built.modelRuntime);
+            return {
+                ok: true,
+                handle: {
+                    sessionId,
+                    sessionFile: session.sessionFile ?? init.sessionFile,
+                    createdAt: new Date().toISOString(),
+                    model: init.model,
+                    activeTools: session.getActiveToolNames(),
+                },
+            };
+        }
+        catch (error) {
+            return {
+                ok: false,
+                code: "REOPEN_FAILED",
+                message: error instanceof Error ? error.message : String(error),
+            };
+        }
+    }
+    /** Build a handle for an already-active session (idempotent reopen path). */
+    async snapshotActive(sessionId) {
+        const session = this.sessions.get(sessionId);
+        return {
+            sessionId,
+            sessionFile: session.sessionFile,
+            createdAt: new Date().toISOString(),
+            model: undefined,
+            activeTools: session.getActiveToolNames(),
+        };
+    }
+    /**
+     * Shared services + pinned-tool materialization for both createSession and
+     * reopenSession. Loads closed-surface services, resolves the model, builds
+     * the operator + safe explore customTools, and calls the SDK with the same
+     * excludeTools / tools policy (M0-A three-gate).
+     */
+    async buildSessionWithServices(init) {
+        const agentDir = await safeGetAgentDir(this.bindings);
+        const skillFragment = await this.composeSystemPromptSkills();
+        const appendSystemPrompt = [
+            OPERATOR_CHAT_SYSTEM_PROMPT_BASE,
+            ...(skillFragment ? [skillFragment] : []),
+            ...(init.systemPromptSuffix ? [init.systemPromptSuffix] : []),
+        ];
+        const { services } = await this.bindings.createServices({
+            cwd: this.options.cwd,
+            agentDir,
+            resourceLoaderOptions: {
+                noContextFiles: true,
+                noSkills: true,
+                noExtensions: true,
+                appendSystemPrompt,
+            },
+        });
+        const modelRuntime = services.modelRuntime;
+        const resolvedModel = init.model
+            ? (this.bindings.resolveModel({
+                modelRuntime,
+                provider: init.model.provider,
+                modelId: init.model.modelId,
+            }) ?? undefined)
+            : undefined;
+        assertNoWriteToolInList(OPERATOR_CHAT_ALLOWED_TOOLS);
+        let operatorCustomTools = [];
+        if (this.options.actionContext) {
+            try {
+                operatorCustomTools = await buildCustomOperatorTools({
+                    actionContext: this.options.actionContext,
+                });
+            }
+            catch (error) {
+                process.stderr.write(`[console] chat custom-tools build failed: ${error instanceof Error ? error.message : String(error)}\n`);
+            }
+        }
+        let exploreCustomTools = [];
+        try {
+            exploreCustomTools = await buildExploreCustomTools({
+                repoRoot: this.options.cwd,
+            });
+        }
+        catch (error) {
+            process.stderr.write(`[console] chat explore-tools build failed: ${error instanceof Error ? error.message : String(error)}\n`);
+        }
+        const customTools = [...operatorCustomTools, ...exploreCustomTools];
+        const { session } = await this.bindings.createSessionFromServices({
+            services,
+            sessionManager: init.sessionManager,
+            tools: [...OPERATOR_CHAT_BUILTIN_EXPLORE_TOOLS],
+            excludeTools: [
+                "edit",
+                "write",
+                "apply_patch",
+                "apply-patch",
+                "full-tools",
+                "full_tools",
+                "coding-chat",
+                "coding_chat",
+                "shell",
+                "bash",
+                "read",
+                "grep",
+            ],
+            ...(customTools && customTools.length > 0 ? { customTools } : {}),
+            ...(resolvedModel ? { model: resolvedModel } : {}),
+        });
+        return { session, modelRuntime };
+    }
     /** Re-open a previously created session (cross-request). */
     open(sessionId) {
         return this.sessions.get(sessionId);
@@ -378,16 +871,32 @@ export class ConsolePiRuntime {
         if (!session) {
             throw new Error(`chat session not found: ${sessionId}`);
         }
-        // Gate 2 (re-pin before each turn): defend against any mid-session drift.
-        session.setActiveToolsByName(OPERATOR_CHAT_ACTIVE_TOOL_NAMES());
+        // Gate 2 (re-pin before each turn): interview turns pass through the
+        // existing closed interview allow/deny registry. The next ordinary turn
+        // explicitly restores the normal Operator Chat set.
+        const requestedTools = OPERATOR_CHAT_ACTIVE_TOOL_NAMES();
+        const activeTools = options?.mode === "requirement-interview"
+            ? filterActiveInterviewTools(requestedTools).allowed
+            : requestedTools;
+        session.setActiveToolsByName(activeTools);
         const unsub = session.subscribe((event) => {
             const mapped = mapSdkEvent(sessionId, event);
             if (mapped)
                 onEvent(mapped);
         });
         const onAbort = () => {
+            // M1 T08: Stop must abort only the current turn, NOT dispose the
+            // session. SDK AgentSession.abort() aborts the current operation and
+            // waits for the agent to become idle, keeping the session reusable for
+            // the next turn. Only fall back to dispose if the session has no abort()
+            // (e.g. a minimal stub), since a stuck turn should not leak forever.
             try {
-                session.dispose();
+                if (typeof session.abort === "function") {
+                    void session.abort();
+                }
+                else {
+                    session.dispose();
+                }
             }
             catch {
                 // ignore
@@ -395,7 +904,7 @@ export class ConsolePiRuntime {
         };
         options?.signal?.addEventListener("abort", onAbort);
         try {
-            await session.prompt(text);
+            await session.prompt(text, options?.images?.length ? { images: options.images } : undefined);
             // Wait until the session reports idle / not streaming. The SDK prompt()
             // resolves when the agent turn completes, but post-turn continuation
             // (auto-compaction / follow-up) may still be in flight. We poll isIdle.
@@ -417,6 +926,17 @@ export class ConsolePiRuntime {
             unsub();
         }
     }
+    async compact(sessionId, customInstructions) {
+        const session = this.sessions.get(sessionId);
+        if (!session)
+            throw new Error(`chat session not found: ${sessionId}`);
+        if (session.isStreaming === true || session.isIdle === false)
+            throw new Error("CHAT_TURN_ACTIVE");
+        if (typeof session.compact !== "function")
+            throw new Error("COMPACTION_UNSUPPORTED");
+        const result = await session.compact(customInstructions);
+        return projectCompactSnapshot(result ?? {});
+    }
     dispose(sessionId) {
         const session = this.sessions.get(sessionId);
         if (session) {
@@ -427,6 +947,9 @@ export class ConsolePiRuntime {
                 // ignore
             }
             this.sessions.delete(sessionId);
+            this.sessionManagers.delete(sessionId);
+            this.mainlineLeaves.delete(sessionId);
+            this.modelRuntimes.delete(sessionId);
         }
     }
     disposeAll() {
@@ -451,11 +974,11 @@ function mapSdkEvent(sessionId, event) {
                 text: extractAssistantText(event.message),
             };
         case "message_end":
-            return {
-                type: "message_end",
-                sessionId,
-                text: extractAssistantText(event.message),
-            };
+            return { type: "message_end", sessionId, text: extractAssistantText(event.message) };
+        case "turn_end": {
+            const usage = extractUsageSample(event);
+            return usage ? { type: "usage", sessionId, usage } : undefined;
+        }
         case "tool_execution_start":
             return {
                 type: "tool_call",
@@ -573,6 +1096,21 @@ export function createDefaultPiSdkBindings() {
                 id: opts.sessionId,
             });
         },
+        forkSessionManager: async (opts) => {
+            const sdk = (await loadSdk());
+            return sdk.SessionManager.forkFrom(opts.sourcePath, opts.targetCwd, opts.targetSessionDir, { id: opts.targetSessionId });
+        },
+        openSessionManager: async (opts) => {
+            const sdk = (await loadSdk());
+            try {
+                return sdk.SessionManager.open(opts.sessionFile);
+            }
+            catch {
+                // Missing/corrupt session file — caller fails closed rather than
+                // silently creating a fresh session and losing prior context.
+                return undefined;
+            }
+        },
         resolveModel: (opts) => {
             const rt = opts.modelRuntime;
             if (typeof rt?.getModel !== "function")