@tea-agent/loop-agent 0.28.13 → 0.29.0

package/dist/executors/shell-executor.js

@@ -30,6 +30,7 @@ import { materializeBackendTestExecutionContract } from "../workflows/dag/backen
 import { analyzeBackendTestCaseCoverage, analyzeBackendTestMarkdownPytestCorrespondence, materializeBackendTestCaseManifestFromFacts, } from "../workflows/dag/backend-test-case-coverage-analysis.js";
 import { materializeBackendTestResultFromPytestHtml, materializeBackendTestResultFromRunDir, parsePytestHtmlReport, } from "../workflows/dag/backend-test-result-contract.js";
 import { collectBackendTestHumanCaseCatalog, collectBackendTestMappedPytestScripts, resolveBackendTestMappedPytestScripts, collectJacocoCoverage, hasBlockingBackendMarkdownSafetyFindings, inspectBackendTestEnvironment, requiredBackendMarkdownCaseAcIds, renderBackendTestFacts, renderBackendTestHtml, renderBackendTestL5Dashboard, redactBackendTestOutput, validateBackendMarkdownCases, validateBackendMarkdownTraceability, writeRunReport, } from "../workflows/dag/backend-test-markdown-workflow.js";
+import { applyDeterministicScenarioParamRepairs, assessBackendScenarioParamConsistency, classifyBackendTestFailureWithScenarioParam, readBackendScenarioParamFacts, renderBackendTestFailureAnalysis, writeBackendScenarioParamArtifacts, writeScenarioParamRepairAudit, } from "../workflows/dag/backend-test-scenario-param.js";
 import { assessBackendPytestCollection, assessMissingBackendPytestScripts, assertBackendPytestCollectionFresh, buildBackendPytestAssetInventory, materializeEffectiveBackendPytestCollection, readBackendPytestCollectionFacts, writeBackendPytestCollectionArtifacts, } from "../workflows/dag/backend-test-pytest-collection.js";
 import { computeL5ReportMetrics } from "../workflows/dag/l5-report-metrics.js";
 import { buildBackendTestCanonicalResultFromInitialShellSnippet, materializeBackendTestClassification, } from "../workflows/dag/backend-test-classification-contract.js";
@@ -768,6 +769,77 @@ async function executeBackendTestPipeline(input, meta) {
                     durationMs: Date.now() - started,
                 };
             }
+            // Scenario-param consistency (P1): assess -> deterministic repair <=1 -> reassess final.
+            try {
+                const initialAssessment = await assessBackendScenarioParamConsistency({
+                    workspaceRoot: input.cwd,
+                    phase: "initial",
+                    repairAttempt: 0,
+                    strictScenarioParamGate: Boolean((meta.spec.globalConstraints ?? []).some((item) => /strictScenarioParamGate\s*=\s*true/i.test(item))),
+                });
+                const initialArtifacts = await writeBackendScenarioParamArtifacts({
+                    runDir: meta.runDir,
+                    facts: initialAssessment.facts,
+                    markdown: initialAssessment.markdown,
+                });
+                outputs.push(`scenarioParamInitial=${initialArtifacts.reportPath}`, `scenarioParamInitialFacts=${initialArtifacts.factsPath}`);
+                let finalFacts = initialAssessment.facts;
+                let finalMarkdown = initialAssessment.markdown;
+                if (initialAssessment.facts.repairEligible) {
+                    const repair = await applyDeterministicScenarioParamRepairs({
+                        workspaceRoot: input.cwd,
+                        facts: initialAssessment.facts,
+                    });
+                    const auditPath = await writeScenarioParamRepairAudit({
+                        runDir: meta.runDir,
+                        audit: repair.audit,
+                        changedFiles: repair.changedFiles,
+                    });
+                    outputs.push(`scenarioParamRepairAudit=${auditPath}`, `scenarioParamRepaired=${repair.repaired.join(",") || "(none)"}`);
+                    const reassessment = await assessBackendScenarioParamConsistency({
+                        workspaceRoot: input.cwd,
+                        phase: "final",
+                        repairAttempt: 1,
+                        strictScenarioParamGate: initialAssessment.facts.strictScenarioParamGate,
+                    });
+                    finalFacts = reassessment.facts;
+                    finalMarkdown = reassessment.markdown;
+                }
+                else {
+                    finalFacts = {
+                        ...initialAssessment.facts,
+                        phase: "final",
+                        repairAttempt: 0,
+                        repairEligible: false,
+                    };
+                    finalMarkdown = initialAssessment.markdown.replace("Phase: initial", "Phase: final");
+                }
+                const finalArtifacts = await writeBackendScenarioParamArtifacts({
+                    runDir: meta.runDir,
+                    facts: finalFacts,
+                    markdown: finalMarkdown,
+                });
+                outputs.push(`scenarioParamFinal=${finalArtifacts.reportPath}`, `scenarioParamFinalFacts=${finalArtifacts.factsPath}`, `scenarioParamMismatch=${finalFacts.summary.mismatchCount}`, finalMarkdown);
+                if (finalFacts.strictScenarioParamGate &&
+                    finalFacts.summary.mismatchCount > 0) {
+                    return {
+                        ok: false,
+                        stdout: outputs.join("\n\n"),
+                        stderr: "backend-test strict scenario-param gate blocked residual MISMATCH before execute",
+                        failureCategory: "invalid-output",
+                        durationMs: Date.now() - started,
+                    };
+                }
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                const report = "# Backend Test Scenario-Param Consistency\n\n## Status\n\nUNAVAILABLE\n\n## Findings\n\n- Scenario-param analysis crashed: " +
+                    message +
+                    "\n";
+                const reportPath = await writeRunReport(meta.runDir, "backend-test-scenario-param-consistency.md", report);
+                outputs.push(`scenarioParam=${reportPath}`, report);
+                // Advisory by default: do not fail the node on scenario-param infrastructure errors.
+            }
         }
         else if (pipeline === "markdown-manifest") {
             const sourceBinding = meta.spec.sourceBinding;
@@ -989,6 +1061,69 @@ async function executeBackendTestPipeline(input, meta) {
             });
             const markdownPath = await writeRunReport(meta.runDir, "backend-test.md", facts);
             const factsPath = await writeRunReport(meta.runDir, "backend-test-facts.md", facts);
+            // Structured failure analysis report (P2); emitted even when there are zero failures.
+            let scenarioParamFinalStatus = "UNAVAILABLE";
+            let scenarioParamRepairAttempt = 0;
+            const scenarioParamStatusByToken = new Map();
+            try {
+                const scenarioFacts = await readBackendScenarioParamFacts(path.join(meta.runDir, "contracts", "backend-test-scenario-param-consistency-facts.json"));
+                scenarioParamFinalStatus =
+                    scenarioFacts.summary.mismatchCount > 0 ? "FAIL" : "PASS";
+                scenarioParamRepairAttempt = scenarioFacts.repairAttempt;
+                for (const entry of scenarioFacts.entries) {
+                    scenarioParamStatusByToken.set(entry.caseId, entry.status);
+                    scenarioParamStatusByToken.set(entry.tpId, entry.status);
+                }
+            }
+            catch {
+                // optional facts
+            }
+            const failureCases = parsed.cases.filter((item) => item.status === "failure" || item.status === "error");
+            const failureAnalysisMarkdown = renderBackendTestFailureAnalysis({
+                generatedAt: new Date().toISOString(),
+                htmlReportPath: "reports/backend-test.html",
+                total: parsed.tests,
+                passed: parsed.passed,
+                failed: parsed.failed + parsed.errors,
+                durationLabel: `${parsed.durationMs ?? 0}ms`,
+                environmentSummary: await readFile(path.join(reportsDir, "backend-test-environment.md"), "utf8").catch(() => "unavailable"),
+                scenarioParamFinalStatus,
+                repairAttempt: scenarioParamRepairAttempt,
+                failures: failureCases.map((result) => {
+                    const caseMatch = result.name.match(/\bBE-[A-Z0-9_-]+-\d{2,3}\b/);
+                    const tpMatch = result.name.match(/\bTP-[A-Z0-9-]+\b/);
+                    const caseId = caseMatch?.[0] ?? result.name;
+                    const scenarioParamStatus = (tpMatch && scenarioParamStatusByToken.get(tpMatch[0])) ||
+                        scenarioParamStatusByToken.get(caseId);
+                    const evidence = [result.message, result.details]
+                        .filter(Boolean)
+                        .join("\n");
+                    const statusMatch = /assert\s+(\d{3})\s*==\s*(\d{3})/i.exec(evidence) ||
+                        /expected[^\d]*(\d{3})[\s\S]{0,40}actual[^\d]*(\d{3})/i.exec(evidence);
+                    return {
+                        name: result.name,
+                        caseId,
+                        scenario: cases.find((item) => item.id === caseId)?.scenario ??
+                            cases.find((item) => item.id === caseId)?.title ??
+                            result.name,
+                        expectedCode: statusMatch?.[2] ?? statusMatch?.[1],
+                        actualCode: statusMatch?.[1] ?? statusMatch?.[2],
+                        message: result.message || result.status,
+                        scriptPath: result.classname,
+                        durationLabel: result.durationMs !== undefined
+                            ? `${result.durationMs}ms`
+                            : undefined,
+                        scenarioParamStatus,
+                        classification: classifyBackendTestFailureWithScenarioParam({
+                            message: result.message || "",
+                            details: result.details,
+                            scenarioParamStatus,
+                        }),
+                    };
+                }),
+            });
+            const failureAnalysisPath = await writeRunReport(meta.runDir, "backend-test-failure-analysis.md", failureAnalysisMarkdown);
+            outputs.push(`failureAnalysis=${failureAnalysisPath}`);
             // Deterministic L-5 dashboard: machine-computed metrics (not Pi-generated).
             // manifest is produced by an upstream finalize node; tolerate its absence
             // so a minimal DAG without manifest still gets a degraded dashboard.

package/dist/worker/console/app-data.js

@@ -1,5 +1,5 @@
 import { createHash, randomBytes } from "node:crypto";
-import { chmodSync, existsSync, lstatSync, mkdirSync, renameSync, writeFileSync, } from "node:fs";
+import { chmodSync, existsSync, lstatSync, mkdirSync, renameSync, rmSync, writeFileSync, } from "node:fs";
 import { readFile, readdir, rename, rm, writeFile } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
@@ -100,6 +100,98 @@ export function assertSafeAppDataPath(baseDir, candidate) {
     }
     return resolved;
 }
+const WINDOWS_REPLACE_RETRY_DELAYS_MS = [10, 25, 50, 100, 200, 400];
+const WINDOWS_REPLACE_RETRY_CODES = new Set([
+    "EACCES",
+    "EBUSY",
+    "EEXIST",
+    "EPERM",
+]);
+/**
+ * Atomically replace `resolved` with `tmp`.
+ * On Windows, destination locks (AV / indexer / concurrent writers) often yield
+ * EPERM/EEXIST on rename — retry, then fall back to unlink+rename.
+ */
+export async function replaceFileWithRetry(tmp, resolved, deps = {}) {
+    const doRename = deps.rename ?? rename;
+    const doRm = deps.rm ?? rm;
+    const platform = deps.platform ?? process.platform;
+    const sleep = deps.sleep ??
+        ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    let lastError;
+    for (let attempt = 0;; attempt += 1) {
+        try {
+            await doRename(tmp, resolved);
+            return;
+        }
+        catch (error) {
+            lastError = error;
+            const code = error.code ?? "";
+            const delay = WINDOWS_REPLACE_RETRY_DELAYS_MS[attempt];
+            if (platform !== "win32" ||
+                !WINDOWS_REPLACE_RETRY_CODES.has(code) ||
+                delay === undefined) {
+                break;
+            }
+            await sleep(delay);
+        }
+    }
+    if (platform === "win32") {
+        const code = lastError?.code ?? "";
+        if (WINDOWS_REPLACE_RETRY_CODES.has(code)) {
+            try {
+                await doRm(resolved, { force: true });
+                await doRename(tmp, resolved);
+                return;
+            }
+            catch (fallbackError) {
+                throw lastError ?? fallbackError;
+            }
+        }
+    }
+    throw lastError instanceof Error
+        ? lastError
+        : new Error(String(lastError ?? "replaceFileWithRetry failed"));
+}
+function replaceFileWithRetrySync(tmp, resolved) {
+    let lastError;
+    for (let attempt = 0;; attempt += 1) {
+        try {
+            renameSync(tmp, resolved);
+            return;
+        }
+        catch (error) {
+            lastError = error;
+            const code = error.code ?? "";
+            const delay = WINDOWS_REPLACE_RETRY_DELAYS_MS[attempt];
+            if (process.platform !== "win32" ||
+                !WINDOWS_REPLACE_RETRY_CODES.has(code) ||
+                delay === undefined) {
+                break;
+            }
+            const end = Date.now() + delay;
+            while (Date.now() < end) {
+                /* busy-wait: sync path used only for small boot/SSE writes */
+            }
+        }
+    }
+    if (process.platform === "win32") {
+        const code = lastError?.code ?? "";
+        if (WINDOWS_REPLACE_RETRY_CODES.has(code)) {
+            try {
+                rmSync(resolved, { force: true });
+                renameSync(tmp, resolved);
+                return;
+            }
+            catch (fallbackError) {
+                throw lastError ?? fallbackError;
+            }
+        }
+    }
+    throw lastError instanceof Error
+        ? lastError
+        : new Error(String(lastError ?? "replaceFileWithRetrySync failed"));
+}
 export async function writeSecureJson(filePath, value) {
     const dir = path.dirname(filePath);
     ensureSecureDir(dir);
@@ -108,12 +200,18 @@ export async function writeSecureJson(filePath, value) {
     const body = `${JSON.stringify(value, null, 2)}\n`;
     await writeFile(tmp, body, { encoding: "utf8", mode: 0o600 });
     try {
-        chmodSync(tmp, 0o600);
+        try {
+            chmodSync(tmp, 0o600);
+        }
+        catch {
+            // best-effort
+        }
+        await replaceFileWithRetry(tmp, resolved);
     }
-    catch {
-        // best-effort
+    catch (error) {
+        await rm(tmp, { force: true }).catch(() => undefined);
+        throw error;
     }
-    await rename(tmp, resolved);
     try {
         chmodSync(resolved, 0o600);
     }
@@ -182,10 +280,33 @@ export function writeSecureJsonSync(filePath, value) {
     const dir = path.dirname(filePath);
     ensureSecureDir(dir);
     const resolved = assertSafeAppDataPath(dir, filePath);
-    const tmp = `${resolved}.${process.pid}.tmp`;
-    writeFileSync(tmp, `${JSON.stringify(value, null, 2)}\n`, {
-        encoding: "utf8",
-        mode: 0o600,
-    });
-    renameSync(tmp, resolved);
+    const tmp = `${resolved}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
+    try {
+        writeFileSync(tmp, `${JSON.stringify(value, null, 2)}\n`, {
+            encoding: "utf8",
+            mode: 0o600,
+        });
+        try {
+            chmodSync(tmp, 0o600);
+        }
+        catch {
+            // best-effort
+        }
+        replaceFileWithRetrySync(tmp, resolved);
+    }
+    catch (error) {
+        try {
+            rmSync(tmp, { force: true });
+        }
+        catch {
+            // best-effort cleanup
+        }
+        throw error;
+    }
+    try {
+        chmodSync(resolved, 0o600);
+    }
+    catch {
+        // best-effort
+    }
 }

package/dist/worker/console/chat/pi-runtime.js

@@ -13,11 +13,10 @@
  *     (noContextFiles / closed surface); credential/model plane is shared via
  *     the same agentDir auth.json/models.json.
  *   - Active tools are pinned to the operator-chat surface at session create
- *     AND re-pinned before each prompt (three-gate, design §7.5): the FULL
- *     operator action set (dynamic, from the registry) PLUS the built-in
- *     read/explore tools (bash/read/grep/find/ls). File-WRITING coding tools
- *     (edit/write/apply_patch/full-tools/shell/coding-chat) are excluded from
- *     the SDK registry and can never be activated (2026-07-25 widening).
+ *     AND re-pinned before each prompt (three-gate, design §7.5 / ADR 0011):
+ *     the FULL operator action set PLUS full Pi builtins
+ *     (read/write/edit/bash/grep/find/ls) and optional safe-*. Non-Pi write
+ *     channels (apply_patch/full-tools/shell/coding-chat) stay excluded.
  *
  * The actual SDK calls are injected via `PiSdkBindings` so this module is
  * unit-testable without a live Pi install. Production bindings come from
@@ -49,35 +48,34 @@ import { filterActiveInterviewTools } from "../interview/tools.js";
  */
 const OPERATOR_CHAT_SYSTEM_PROMPT_BASE = [
     "You are the General Operator Chat for loop-agent / agent-worker.",
-    "You are an OPERATOR: you orchestrate and inspect via the registered operator_* tools. You are NOT an implementer.",
-    "Tool surface: you have safe read-only explore tools (safe-read, safe-grep, git-status, git-diff, find, ls) to probe the repo, AND the model-callable operator_* tools. bash is NOT available (it was removed to close a write-via-redirect escape); use safe-read / safe-grep / git-status / git-diff instead.",
-    "safe-read / safe-grep enforce a repo-relative path boundary, a sensitive-file denylist (.env* / *.key / *.pem / .git/** / auth.json / sessions/**) and secret scrubbing. Do not attempt to read those files via any other path.",
-    "You do NOT have edit / write / apply_patch / full-tools / shell / coding-chat — file-WRITING is gated behind the DAG path. All canonical writes still go through DAG implement-pi / repair-pi, never via this chat.",
-    "High-risk mutations are not model-executable tools. Prepare contract via interview then apply via contractApply, prepare DAG runs via prepareDagConfirmation, prepare other mutations via prepareMutationGate, then confirm in the browser Human Gate. When a high-risk action (contractApply / runDag / dagRerun / etc.) fails on missing prepared state, use read-only tools (status, doctor, dagReport, inspect, contractShow, safe-read, safe-grep) to diagnose.",
+    "You are an OPERATOR first: orchestrate and inspect via operator_* tools, and you also have full Pi repository tools (read, write, edit, bash, grep, find, ls) plus optional safe-read/safe-grep/git-status/git-diff.",
+    "Capability honesty (ADR 0011): read/write/edit/bash ARE available. Prefer governed loop-agent / Agent DAG paths (implement-pi / repair-pi) and Human Gate for large refactors, public contracts, credentials, or production-risk changes — treat direct write/edit/bash as soft-disciplined, not as a second DAG kernel.",
+    "safe-read / safe-grep enforce a repo-relative path boundary, a sensitive-file denylist (.env* / *.key / *.pem / .git/** / auth.json / sessions/**) and secret scrubbing. Prefer them for sensitive probes; avoid dumping secrets via raw read/bash.",
+    "You do NOT have apply_patch / full-tools / shell / coding-chat as alternate coding runtimes — those non-Pi channels stay denied.",
+    "High-risk mutations still use prepare + browser Human Gate. Prepare contract via interview then apply via contractApply, prepare DAG runs via prepareDagConfirmation, prepare other mutations via prepareMutationGate, then confirm in the browser Human Gate. When a high-risk action (contractApply / runDag / dagRerun / etc.) fails on missing prepared state, diagnose with status/doctor/dagReport/inspect/contractShow/read/safe-read/safe-grep.",
     "You cannot self-confirm a DAG run: confirmDagConfirmation is a human-only action (executed by the browser with a server-signed confirmation token). You may only prepare it via prepareDagConfirmation; the user must confirm in the UI.",
-    "Prefer read-only tools (status, doctor, dagReport, inspect, contractShow, safe-read, safe-grep, git-status) to diagnose before acting.",
+    "Prefer read-only diagnosis (status, doctor, dagReport, inspect, contractShow, read, safe-read, safe-grep, git-status) before mutating.",
 ].join("\n");
 /**
- * Built-in SDK read/explore tool names registered for every Chat session.
- *
- * M0-A (roadmap §14 工作块 A): bash is REMOVED — it could write files via
- * `echo >` / `tee` / `sed -i` / `node -e writeFile`, bypassing the DAG write
- * boundary. The residual read-only repo probing is served by the custom
- * safe-read / safe-grep / find / ls tools (see buildExploreCustomTools) which
- * enforce a repo-relative path boundary, a sensitive-file denylist, and
- * secret scrubbing on the returned content. edit/write/... stay excluded.
+ * Built-in SDK tool names registered for every Chat session (ADR 0011).
+ * Full Pi builtins: read/write/edit/bash/grep/find/ls. safe-* custom tools
+ * remain available in parallel for bounded sensitive probes.
  */
 export const OPERATOR_CHAT_BUILTIN_EXPLORE_TOOLS = Object.freeze([
+    "read",
+    "write",
+    "edit",
+    "bash",
+    "grep",
     "find",
     "ls",
 ]);
 /**
  * Canonical active tool-set handed to setActiveToolsByName at every gate:
- * every model-callable operator action (dynamic, from the registry) PLUS the
- * built-in explore tools (find/ls) PLUS the safe explore custom tools
- * (safe-read / safe-grep / git-status / git-diff). bash is NOT here (M0-A).
- * File-WRITING coding tools (edit/write/...) are never here — they are
- * excluded at the registry level and thus cannot be activated.
+ * every model-callable operator action (dynamic, from the registry) PLUS full
+ * Pi builtins (ADR 0011) PLUS safe explore custom tools (safe-read /
+ * safe-grep / git-status / git-diff). Non-Pi write channels (apply_patch /
+ * full-tools / shell / coding-chat) stay excluded.
  */
 export const OPERATOR_CHAT_SAFE_EXPLORE_TOOL_IDS = Object.freeze([
     "safe-read",
@@ -549,13 +547,10 @@ export class ConsolePiRuntime {
         const { session } = await this.bindings.createSessionFromServices({
             services,
             sessionManager,
-            // Explicitly register the explore-tool builtin set (Gate 1): find/ls.
-            // The default builtin read/bash/edit/write are EXCLUDED below; read/
-            // grep/bash are replaced by the safe customTools (M0-A).
+            // Gate 1 (ADR 0011): full Pi builtins registered; only non-Pi write
+            // channels excluded (apply_patch / full-tools / shell / coding-chat).
             tools: [...OPERATOR_CHAT_BUILTIN_EXPLORE_TOOLS],
             excludeTools: [
-                "edit",
-                "write",
                 "apply_patch",
                 "apply-patch",
                 "full-tools",
@@ -563,14 +558,6 @@ export class ConsolePiRuntime {
                 "coding-chat",
                 "coding_chat",
                 "shell",
-                // M0-A: bash is removed entirely (write-via-redirect escape). The
-                // model gets safe-read / safe-grep custom tools instead.
-                "bash",
-                // M0-A: built-in read/grep are replaced by custom safe-read/safe-grep
-                // that enforce a repo-relative boundary, a sensitive-file denylist,
-                // and secret scrubbing (roadmap G16).
-                "read",
-                "grep",
             ],
             ...(customTools && customTools.length > 0
                 ? { customTools }
@@ -836,8 +823,6 @@ export class ConsolePiRuntime {
             sessionManager: init.sessionManager,
             tools: [...OPERATOR_CHAT_BUILTIN_EXPLORE_TOOLS],
             excludeTools: [
-                "edit",
-                "write",
                 "apply_patch",
                 "apply-patch",
                 "full-tools",
@@ -845,9 +830,6 @@ export class ConsolePiRuntime {
                 "coding-chat",
                 "coding_chat",
                 "shell",
-                "bash",
-                "read",
-                "grep",
             ],
             ...(customTools && customTools.length > 0 ? { customTools } : {}),
             ...(resolvedModel ? { model: resolvedModel } : {}),

package/dist/worker/console/chat/resource-loader.js

@@ -1,14 +1,11 @@
 /**
- * Operator Chat — closed ResourceLoader contract (design §7.5 / V12 / plan W3).
+ * Operator Chat — ResourceLoader contract (ADR 0011 full Pi tools).
  *
- * M0-A (roadmap §14 工作块 A): the bare bash/read/grep built-ins are GONE.
- * The Chat session now exposes safe explore custom tools (safe-read /
- * safe-grep / git-status / git-diff) which enforce a repo-relative boundary,
- * a sensitive-file denylist, and secret scrubbing — plus find/ls. The full
- * model-callable operator action set is still allowed; the only denied tools
- * are file-WRITING coding tools (edit/write/apply_patch/full-tools/shell/
- * coding-chat) AND bash/read/grep (replaced by the safe versions). hasBash is
- * therefore false: there is no shell escape.
+ * Declares the operator-chat surface for capabilities reporting and red-team
+ * checks: full Pi builtins (read/write/edit/bash/grep/find/ls), model-callable
+ * operator actions, and optional safe-* explore tools. hasBash is true.
+ * Non-Pi write channels (apply_patch / full-tools / shell / coding-chat) remain
+ * denied. Interview/Official loaders are unchanged.
  *
  * Note: this adapter is NOT the SDK's own ResourceLoader (that is
  * DefaultResourceLoader, created inside createAgentSessionServices with
@@ -17,13 +14,12 @@
  * The three-gate authorization (authorizeOperatorChatTool) is the actual
  * enforcement; this adapter describes what that gate admits.
  */
-import { OPERATOR_CHAT_ALLOWED_TOOLS, OPERATOR_CHAT_DENIED_TOOLS, OPERATOR_CHAT_DENIED_OPERATOR_ACTIONS, authorizeOperatorChatTool, filterOperatorChatTools, assertNoWriteToolInList, } from "./tools.js";
-/** Built-in explore tool names that are ALLOWED in every Chat session (M0-A). */
+import { OPERATOR_CHAT_ALLOWED_TOOLS, OPERATOR_CHAT_DENIED_TOOLS, OPERATOR_CHAT_DENIED_OPERATOR_ACTIONS, OPERATOR_CHAT_PI_BUILTIN_TOOLS, authorizeOperatorChatTool, filterOperatorChatTools, assertNoWriteToolInList, } from "./tools.js";
+/** Built-in Pi tool names allowed in every Chat session (ADR 0011). */
 export const OPERATOR_CHAT_BUILTIN_EXPLORE_TOOL_IDS = Object.freeze([
-    "find",
-    "ls",
+    ...OPERATOR_CHAT_PI_BUILTIN_TOOLS,
 ]);
-/** Safe explore custom tool names (M0-A). */
+/** Safe explore custom tool names (optional parallel surface). */
 export const OPERATOR_CHAT_SAFE_EXPLORE_TOOL_IDS = Object.freeze([
     "safe-read",
     "safe-grep",
@@ -41,11 +37,6 @@ export function createOperatorChatResourceLoader() {
         safeExploreToolIds: OPERATOR_CHAT_SAFE_EXPLORE_TOOL_IDS,
         listTools: () => OPERATOR_CHAT_ALLOWED_TOOLS,
         tryActivateTool: (toolId) => {
-            // Explore tools (bash/read/grep/find/ls) are run by the SDK's built-in
-            // tool registry, not by the operator dispatcher. tryActivateTool only
-            // classifies operator actions here, but it must NOT deny an explore
-            // tool — that would contradict the real session. Deny only write tools
-            // and report unknowns.
             const explore = OPERATOR_CHAT_BUILTIN_EXPLORE_TOOL_IDS.includes(toolId);
             if (explore) {
                 return { ok: true, toolId };
@@ -62,6 +53,6 @@ export function createOperatorChatResourceLoader() {
             return { active: [...active], denied };
         },
         allowsEnvToolRestore: false,
-        hasBash: false,
+        hasBash: true,
     };
 }

package/dist/worker/console/chat/routes.js

@@ -176,9 +176,8 @@ export async function handleChatCapabilities(_req, res, deps) {
             skipped: skills.skipped,
             promptFragmentCharCount: composeInstructionSkillsPrompt(skills.loaded).length,
         },
-        // M0-A: bare bash is removed; safe-read/safe-grep enforce the repo and
-        // secret boundaries instead.
-        hasBash: false,
+        // ADR 0011: full Pi tools including bash are default-active.
+        hasBash: true,
     });
 }
 export async function handleCreateChatSession(req, res, deps) {
@@ -236,7 +235,7 @@ export async function handleCreateChatSession(req, res, deps) {
             sessionFile: handle.sessionFile,
             model: handle.model,
             activeTools: handle.activeTools,
-            hasBash: false,
+            hasBash: true,
         });
     }
     catch (error) {
@@ -342,7 +341,7 @@ export async function handleGetChatSession(_req, res, deps, sessionId) {
             composerDraft,
             activeTurnId: deps.events.getActiveTurn(sessionId)?.turnId,
         },
-        hasBash: false,
+        hasBash: true,
         lastEventId: lastEvent?.eventId ?? null,
         lastEventSeq: lastEvent?.seq ?? 0,
     });
@@ -356,7 +355,7 @@ export async function handleListChatSessions(_req, res, deps) {
             ...session,
             activeTurnId: deps.events.getActiveTurn(session.sessionId)?.turnId,
         })),
-        hasBash: false,
+        hasBash: true,
     });
 }
 export async function handlePatchChatSession(req, res, deps, sessionId) {
@@ -395,7 +394,7 @@ export async function handleReopenChatSession(req, res, deps, sessionId) {
         return;
     }
     if (deps.runtime.hasSession(sessionId)) {
-        sendJson(res, 200, { ok: true, sessionId, reopened: false, alreadyActive: true, hasBash: false });
+        sendJson(res, 200, { ok: true, sessionId, reopened: false, alreadyActive: true, hasBash: true });
         return;
     }
     const result = await deps.runtime.reopenSession({
@@ -416,7 +415,7 @@ export async function handleReopenChatSession(req, res, deps, sessionId) {
         sessionFile: result.handle.sessionFile,
         model: result.handle.model,
         activeTools: result.handle.activeTools,
-        hasBash: false,
+        hasBash: true,
     });
 }
 export async function handleChatPrompt(req, res, deps, sessionId) {

package/dist/worker/console/chat/runtime-context.js

@@ -16,7 +16,7 @@ export function projectRuntimeContext(input) {
             summary: summary(input.systemPrompt),
         },
         skills: input.skills.map((skill) => ({ ...skill, description: summary(skill.description, 200) ?? "" })),
-        resources: { mode: "closed", noContextFiles: true, noSkills: true, noExtensions: true, hasBash: false, activeToolCount: input.activeTools.length },
+        resources: { mode: "closed", noContextFiles: true, noSkills: true, noExtensions: true, hasBash: true, activeToolCount: input.activeTools.length },
         model: input.model,
         thinkingLevel: input.thinkingLevel,
         suffix: input.systemPromptSuffix ? { present: true, summary: summary(input.systemPromptSuffix) } : { present: false },