@tea-agent/loop-agent 0.28.13 → 0.29.0

package/dist/worker/console/chat/tools.js

@@ -1,15 +1,15 @@
 /**
- * Operator Chat — closed tool whitelist (design §7.5 / roadmap M0).
+ * Operator Chat — tool policy (ADR 0011 UX-first full Pi tools).
  *
- * The Chat exposes the model-callable structured operator surface. Repository
- * exploration is deliberately limited to safe-read/safe-grep/git-status/
- * git-diff plus built-in find/ls; the bare SDK bash/read/grep tools are denied
- * because they bypass the M0-A write and sensitive-data boundaries.
+ * Operator Chat registers and activates full Pi builtins
+ * (read/write/edit/bash/grep/find/ls) plus model-callable operator actions and
+ * optional safe-* explore custom tools. Discipline is primarily soft
+ * (system prompt: prefer DAG / Human Gate). Hard denies remain for non-Pi
+ * write channels (apply_patch / full-tools / shell / coding-chat) and for
+ * modelCallable="never" actions (e.g. confirmDagConfirmation).
  *
- * Dynamic discovery derives model-callable operator actions directly from the
- * capabilities registry. Explicit denial remains the defense-in-depth layer:
- * a future resource-loader or SDK drift cannot reactivate removed coding or
- * explore tools merely by changing the active-tool list.
+ * Interview / Official surfaces keep their own OFFICIAL_DENIED path; this
+ * module only filters Chat-side denial so Interview is not widened.
  */
 import { buildOperatorCapabilitiesDocument } from "../../../shared/operator/capabilities.js";
 import { OFFICIAL_DENIED_TOOL_IDS } from "../resource-loader.js";
@@ -41,31 +41,37 @@ export const OPERATOR_CHAT_MODEL_FORBIDDEN_ACTIONS = Object.freeze(buildOperator
  * stay defensive against future additions.
  */
 export const OPERATOR_CHAT_DENIED_OPERATOR_ACTIONS = Object.freeze([]);
-// Coding / generic tool ids that must never appear in a Chat session. M0-A
-// removes bare bash (write-via-redirect) and SDK read/grep (no sensitive-file
-// boundary); find/ls remain the only SDK explore builtins. Safe content probes
-// are custom tools, not generic SDK tools.
-const _ALLOWED_SDK_EXPLORE_TOOLS = new Set(["find", "ls"]);
-const _REMOVED_SDK_EXPLORE_TOOLS = ["bash", "read", "grep"];
+/** Full Pi builtin explore / coding tools admitted by ADR 0011. */
+export const OPERATOR_CHAT_PI_BUILTIN_TOOLS = Object.freeze([
+    "read",
+    "write",
+    "edit",
+    "bash",
+    "grep",
+    "find",
+    "ls",
+]);
+const _PI_BUILTIN_ALLOW = new Set(OPERATOR_CHAT_PI_BUILTIN_TOOLS.map((t) => t.toLowerCase()));
 // Operator actions that OFFICIAL_DENIED_TOOL_IDS carries for Interview safety
-// but that the Chat now deliberately allows. We compare on a COMPACTED form
-// (strip - and _) because OFFICIAL lists both camelCase (`contractApply`) and
-// snake_case (`contract_apply`) variants, and authorize() also normalizes —
-// leaving any variant in would re-deny the action via normalization.
+// but that the Chat now deliberately allows. Compare on a COMPACTED form
+// (strip - and _) because OFFICIAL lists both camelCase and snake_case.
 const _ALLOWED_OPERATOR_ACTIONS_COMPACT = new Set(OPERATOR_CHAT_ALLOWED_TOOLS.map((t) => t.toLowerCase().replace(/[-_]/g, "")));
+/**
+ * Tools denied for Operator Chat. Built from OFFICIAL_DENIED minus:
+ * - Pi builtins allowed by ADR 0011
+ * - model-callable operator actions
+ * Does NOT re-add bash/read/grep/edit/write.
+ */
 export const OPERATOR_CHAT_DENIED_TOOLS = Object.freeze([
-    ...new Set([
-        ...OFFICIAL_DENIED_TOOL_IDS.filter((id) => {
-            const lower = id.toLowerCase();
-            if (_ALLOWED_SDK_EXPLORE_TOOLS.has(lower))
-                return false;
-            if (_ALLOWED_OPERATOR_ACTIONS_COMPACT.has(lower.replace(/[-_]/g, ""))) {
-                return false;
-            }
-            return true;
-        }),
-        ..._REMOVED_SDK_EXPLORE_TOOLS,
-    ]),
+    ...new Set(OFFICIAL_DENIED_TOOL_IDS.filter((id) => {
+        const lower = id.toLowerCase();
+        if (_PI_BUILTIN_ALLOW.has(lower))
+            return false;
+        if (_ALLOWED_OPERATOR_ACTIONS_COMPACT.has(lower.replace(/[-_]/g, ""))) {
+            return false;
+        }
+        return true;
+    })),
 ]);
 /**
  * Operator actions denied by model policy (modelCallable="never"). These are
@@ -78,11 +84,19 @@ const DENIED_MODEL_POLICY = new Set(OPERATOR_CHAT_MODEL_FORBIDDEN_ACTIONS.map((a
 const ALLOWED = new Set(OPERATOR_CHAT_ALLOWED_TOOLS.map((t) => t.toLowerCase()));
 const DENIED_ACTIONS = new Set(OPERATOR_CHAT_DENIED_OPERATOR_ACTIONS.map((a) => a.toLowerCase()));
 const DENIED_TOOLS = new Set(OPERATOR_CHAT_DENIED_TOOLS.map((t) => t.toLowerCase()));
+/** Pi builtins are authorized without being operator registry actions. */
+const PI_BUILTIN_AUTHORIZED = new Set(OPERATOR_CHAT_PI_BUILTIN_TOOLS.map((t) => t.toLowerCase()));
 export function isOperatorChatToolAllowed(toolId) {
-    return ALLOWED.has(toolId.trim().toLowerCase());
+    const id = toolId.trim().toLowerCase();
+    if (PI_BUILTIN_AUTHORIZED.has(id))
+        return true;
+    return ALLOWED.has(id);
 }
 export function isOperatorChatToolDenied(toolId) {
     const id = toolId.trim().toLowerCase();
+    // Pi builtins are never denied under ADR 0011.
+    if (PI_BUILTIN_AUTHORIZED.has(id))
+        return false;
     if (DENIED_TOOLS.has(id))
         return true;
     if (DENIED_ACTIONS.has(id))
@@ -125,7 +139,7 @@ export function authorizeOperatorChatTool(toolId) {
             ok: false,
             code: "tool-denied",
             toolId: id,
-            message: `tool "${id}" is denied in General Operator Chat (no bash/read/grep/edit/write/apply_patch/full-tools/shell/coding-chat)`,
+            message: `tool "${id}" is denied in General Operator Chat (no apply_patch/full-tools/shell/coding-chat; modelCallable=never still blocked)`,
         };
     }
     if (!isOperatorChatToolAllowed(id)) {
@@ -155,35 +169,34 @@ export function filterOperatorChatTools(requested) {
     return { allowed, denied };
 }
 /**
- * Assert that a requested tool set contains no prohibited coding or removed
- * SDK explore tool. Used by red-team / boot checks (V12 / M0-A). bash is
- * explicitly forbidden: accepting it would recreate the redirect write escape.
+ * Non-Pi write / coding channels that must never appear in Operator Chat.
+ * ADR 0011 allows Pi builtins read/write/edit/bash/grep/find/ls; this guard
+ * only blocks alternate coding surfaces (apply_patch, full-tools, shell,
+ * coding-chat).
+ */
+const NON_PI_WRITE_CHANNELS = [
+    "apply_patch",
+    "apply-patch",
+    "full-tools",
+    "full_tools",
+    "coding-chat",
+    "coding_chat",
+    "shell",
+];
+/**
+ * Assert that a requested tool set contains no prohibited non-Pi write
+ * channel. Pi builtins (including write/edit/bash) are allowed (ADR 0011).
  */
 export function assertNoWriteToolInList(requested) {
-    const writeVariants = [
-        "edit",
-        "write",
-        "apply_patch",
-        "apply-patch",
-        "full-tools",
-        "full_tools",
-        "coding-chat",
-        "coding_chat",
-        "shell",
-        "bash",
-        "read",
-        "grep",
-    ];
     const lower = new Set(requested.map((t) => t.trim().toLowerCase()));
-    for (const v of writeVariants) {
+    for (const v of NON_PI_WRITE_CHANNELS) {
         if (lower.has(v)) {
-            throw new Error(`file-writing tool "${v}" must not appear in Operator Chat tool list (V12 closed coding surface)`);
+            throw new Error(`non-Pi write channel "${v}" must not appear in Operator Chat tool list (ADR 0011)`);
         }
     }
 }
 /**
- * Back-compat alias kept for callers that still reference the old name. It
- * also rejects removed SDK explore tools, including bash.
+ * Back-compat alias kept for callers that still reference the old name.
  * @deprecated use {@link assertNoWriteToolInList}.
  */
 export function assertNoBashInToolList(requested) {

package/dist/worker/console/operation-runner.js

@@ -34,6 +34,7 @@ export async function runOperation(operationId, deps) {
             ? deps.client.runExternal(op.externalCommand, cliArgs, options)
             : deps.client.run(cliArgs, options));
     let finished;
+    let spawnUpdate = Promise.resolve();
     try {
         const result = await run(args, {
             cwd: deps.repoRoot,
@@ -41,10 +42,21 @@ export async function runOperation(operationId, deps) {
             expectJson: true,
             timeoutMs: deps.defaultTimeoutMs,
             onSpawn: (info) => {
-                void deps.store.update(operationId, {
+                // Chain onto the per-operation write lock; never fire-and-forget a
+                // rejected update (unhandled rejection can crash Console on Windows).
+                spawnUpdate = deps.store
+                    .update(operationId, {
                     state: "running",
                     pid: info.pid,
                     processStartIdentity: info.startedAt,
+                })
+                    .catch((error) => {
+                    const message = error instanceof Error ? error.message : String(error);
+                    deps.events.append(operationId, {
+                        at: new Date().toISOString(),
+                        kind: "error",
+                        message: `failed to persist running state: ${message}`,
+                    });
                 });
                 stateEvent(deps.events, op, "running", `pid=${info.pid ?? "?"}`);
             },
@@ -63,9 +75,11 @@ export async function runOperation(operationId, deps) {
                 });
             },
         });
+        await spawnUpdate;
         finished = await finalizeFromWorkerResult(operationId, result, deps);
     }
     catch (error) {
+        await spawnUpdate.catch(() => undefined);
         // Cannot prove CLI exit classification → needs-reconcile (not Cancel)
         finished = await deps.store.update(operationId, {
             state: "needs-reconcile",

package/dist/worker/console/operation-store.js

@@ -17,73 +17,94 @@ export function newOperationId() {
 }
 export class OperationStore {
     appData;
+    /**
+     * Per-key write lock. Concurrent update/save/create on the same operation
+     * or clientRequestId must not race rename() into the same JSON path
+     * (Windows EPERM) or last-write-wins lost patches.
+     */
+    writeChains = new Map();
     constructor(appData) {
         this.appData = appData;
     }
+    serialize(key, op) {
+        const prev = this.writeChains.get(key) ?? Promise.resolve();
+        const next = prev.then(op, op);
+        this.writeChains.set(key, next.then(() => undefined, () => undefined));
+        return next;
+    }
     async create(input) {
         const clientRequestId = input.clientRequestId.trim();
         if (!clientRequestId) {
             throw new Error("clientRequestId is required for mutation operations");
         }
         const payloadHash = computeActionPayloadHash(input.action, input.actionParams);
-        const indexPath = requestIndexFile(this.appData, clientRequestId);
-        const existingIndex = await readJsonIfExists(indexPath);
-        if (existingIndex) {
-            const existing = await this.get(existingIndex.operationId);
-            if (existing) {
-                if (existing.payloadHash === payloadHash) {
-                    return { kind: "idempotent", operation: existing };
+        return this.serialize(`req:${clientRequestId}`, async () => {
+            const indexPath = requestIndexFile(this.appData, clientRequestId);
+            const existingIndex = await readJsonIfExists(indexPath);
+            if (existingIndex) {
+                const existing = await this.get(existingIndex.operationId);
+                if (existing) {
+                    if (existing.payloadHash === payloadHash) {
+                        return { kind: "idempotent", operation: existing };
+                    }
+                    return {
+                        kind: "conflict",
+                        code: "REQUEST_ID_REUSE_CONFLICT",
+                        message: `clientRequestId ${clientRequestId} was reused with a different payload`,
+                        existing,
+                    };
                 }
-                return {
-                    kind: "conflict",
-                    code: "REQUEST_ID_REUSE_CONFLICT",
-                    message: `clientRequestId ${clientRequestId} was reused with a different payload`,
-                    existing,
-                };
             }
-        }
-        const operationId = newOperationId();
-        const now = new Date().toISOString();
-        const operation = {
-            schemaVersion: 1,
-            operationId,
-            clientRequestId,
-            action: input.action,
-            actionParams: input.actionParams,
-            payloadHash,
-            state: "queued",
-            createdAt: now,
-            taskId: input.taskId,
-            cliArgs: input.cliArgs,
-            ...(input.externalCommand ? { externalCommand: input.externalCommand } : {}),
-        };
-        await writeSecureJson(operationFile(this.appData, operationId), operation);
-        await writeSecureJson(indexPath, { operationId, payloadHash });
-        return { kind: "created", operation };
+            const operationId = newOperationId();
+            const now = new Date().toISOString();
+            const operation = {
+                schemaVersion: 1,
+                operationId,
+                clientRequestId,
+                action: input.action,
+                actionParams: input.actionParams,
+                payloadHash,
+                state: "queued",
+                createdAt: now,
+                taskId: input.taskId,
+                cliArgs: input.cliArgs,
+                ...(input.externalCommand
+                    ? { externalCommand: input.externalCommand }
+                    : {}),
+            };
+            await writeSecureJson(operationFile(this.appData, operationId), operation);
+            await writeSecureJson(indexPath, { operationId, payloadHash });
+            return { kind: "created", operation };
+        });
     }
     async get(operationId) {
         return readJsonIfExists(operationFile(this.appData, operationId));
     }
     async save(operation) {
-        await writeSecureJson(operationFile(this.appData, operation.operationId), operation);
-        return operation;
+        return this.serialize(operation.operationId, async () => {
+            await writeSecureJson(operationFile(this.appData, operation.operationId), operation);
+            return operation;
+        });
     }
     async update(operationId, patch) {
-        const current = await this.get(operationId);
-        if (!current) {
-            throw new Error(`operation not found: ${operationId}`);
-        }
-        const next = {
-            ...current,
-            ...patch,
-            operationId: current.operationId,
-            schemaVersion: 1,
-            clientRequestId: current.clientRequestId,
-            payloadHash: current.payloadHash,
-            action: current.action,
-            createdAt: current.createdAt,
-        };
-        return this.save(next);
+        return this.serialize(operationId, async () => {
+            const current = await this.get(operationId);
+            if (!current) {
+                throw new Error(`operation not found: ${operationId}`);
+            }
+            const next = {
+                ...current,
+                ...patch,
+                operationId: current.operationId,
+                schemaVersion: 1,
+                clientRequestId: current.clientRequestId,
+                payloadHash: current.payloadHash,
+                action: current.action,
+                createdAt: current.createdAt,
+            };
+            await writeSecureJson(operationFile(this.appData, operationId), next);
+            return next;
+        });
     }
     async list() {
         const files = await listJsonFiles(this.appData.operations);

package/dist/worker/console/operator-actions.js

@@ -72,6 +72,49 @@ function readWriteSetGateToken(reviewPacket) {
     const token = reviewPacket.writeSetGateToken;
     return typeof token === "string" && token.includes(":") ? token : undefined;
 }
+/**
+ * Prefer structured stdout JSON failure semantics (findings / message) over bare
+ * `exit N` when stderr is empty — spine audit and similar read CLIs write details
+ * to stdout JSON and exit non-zero with empty stderr.
+ */
+function summarizeReadCliFailure(result) {
+    const fromJson = summarizeJsonFailure(result.json);
+    if (fromJson)
+        return fromJson;
+    const stderr = (result.stderr ?? "").trim();
+    if (stderr)
+        return stderr;
+    return `exit ${result.exitCode}`;
+}
+function summarizeJsonFailure(json) {
+    if (!json || typeof json !== "object")
+        return undefined;
+    const raw = json;
+    if (Array.isArray(raw.findings)) {
+        const messages = raw.findings
+            .map((finding) => {
+            if (!finding || typeof finding !== "object")
+                return "";
+            const message = finding.message;
+            return typeof message === "string" ? message.trim() : "";
+        })
+            .filter(Boolean);
+        if (messages.length > 0) {
+            const head = messages.slice(0, 6).join("; ");
+            return messages.length > 6 ? `${head}…` : head;
+        }
+    }
+    const nestedError = raw.error;
+    if (nestedError && typeof nestedError === "object") {
+        const message = nestedError.message;
+        if (typeof message === "string" && message.trim())
+            return message.trim();
+    }
+    if (typeof raw.message === "string" && raw.message.trim()) {
+        return raw.message.trim();
+    }
+    return undefined;
+}
 async function runReadCli(ctx, args, command) {
     const run = ctx.runCommand ?? ((a, o) => ctx.client.run(a, o));
     try {
@@ -124,11 +167,24 @@ async function runReadCli(ctx, args, command) {
                 raw: result.json,
             });
         }
+        const message = summarizeReadCliFailure(result);
+        if (result.json && typeof result.json === "object") {
+            return buildOperatorResult({
+                command,
+                ok: false,
+                outcome: "rejected",
+                result: result.json,
+                error: {
+                    code: "INTERNAL_ERROR",
+                    message,
+                },
+            });
+        }
         return operatorFailed({
             command,
             outcome: "rejected",
             code: "INTERNAL_ERROR",
-            message: result.stderr || `exit ${result.exitCode}`,
+            message,
         });
     }
     catch (error) {