@tea-agent/loop-agent 0.28.13 → 0.29.1

package/dist/worker/console/app-data.js

@@ -1,5 +1,5 @@
 import { createHash, randomBytes } from "node:crypto";
-import { chmodSync, existsSync, lstatSync, mkdirSync, renameSync, writeFileSync, } from "node:fs";
+import { chmodSync, existsSync, lstatSync, mkdirSync, renameSync, rmSync, writeFileSync, } from "node:fs";
 import { readFile, readdir, rename, rm, writeFile } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
@@ -100,6 +100,98 @@ export function assertSafeAppDataPath(baseDir, candidate) {
     }
     return resolved;
 }
+const WINDOWS_REPLACE_RETRY_DELAYS_MS = [10, 25, 50, 100, 200, 400];
+const WINDOWS_REPLACE_RETRY_CODES = new Set([
+    "EACCES",
+    "EBUSY",
+    "EEXIST",
+    "EPERM",
+]);
+/**
+ * Atomically replace `resolved` with `tmp`.
+ * On Windows, destination locks (AV / indexer / concurrent writers) often yield
+ * EPERM/EEXIST on rename — retry, then fall back to unlink+rename.
+ */
+export async function replaceFileWithRetry(tmp, resolved, deps = {}) {
+    const doRename = deps.rename ?? rename;
+    const doRm = deps.rm ?? rm;
+    const platform = deps.platform ?? process.platform;
+    const sleep = deps.sleep ??
+        ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    let lastError;
+    for (let attempt = 0;; attempt += 1) {
+        try {
+            await doRename(tmp, resolved);
+            return;
+        }
+        catch (error) {
+            lastError = error;
+            const code = error.code ?? "";
+            const delay = WINDOWS_REPLACE_RETRY_DELAYS_MS[attempt];
+            if (platform !== "win32" ||
+                !WINDOWS_REPLACE_RETRY_CODES.has(code) ||
+                delay === undefined) {
+                break;
+            }
+            await sleep(delay);
+        }
+    }
+    if (platform === "win32") {
+        const code = lastError?.code ?? "";
+        if (WINDOWS_REPLACE_RETRY_CODES.has(code)) {
+            try {
+                await doRm(resolved, { force: true });
+                await doRename(tmp, resolved);
+                return;
+            }
+            catch (fallbackError) {
+                throw lastError ?? fallbackError;
+            }
+        }
+    }
+    throw lastError instanceof Error
+        ? lastError
+        : new Error(String(lastError ?? "replaceFileWithRetry failed"));
+}
+function replaceFileWithRetrySync(tmp, resolved) {
+    let lastError;
+    for (let attempt = 0;; attempt += 1) {
+        try {
+            renameSync(tmp, resolved);
+            return;
+        }
+        catch (error) {
+            lastError = error;
+            const code = error.code ?? "";
+            const delay = WINDOWS_REPLACE_RETRY_DELAYS_MS[attempt];
+            if (process.platform !== "win32" ||
+                !WINDOWS_REPLACE_RETRY_CODES.has(code) ||
+                delay === undefined) {
+                break;
+            }
+            const end = Date.now() + delay;
+            while (Date.now() < end) {
+                /* busy-wait: sync path used only for small boot/SSE writes */
+            }
+        }
+    }
+    if (process.platform === "win32") {
+        const code = lastError?.code ?? "";
+        if (WINDOWS_REPLACE_RETRY_CODES.has(code)) {
+            try {
+                rmSync(resolved, { force: true });
+                renameSync(tmp, resolved);
+                return;
+            }
+            catch (fallbackError) {
+                throw lastError ?? fallbackError;
+            }
+        }
+    }
+    throw lastError instanceof Error
+        ? lastError
+        : new Error(String(lastError ?? "replaceFileWithRetrySync failed"));
+}
 export async function writeSecureJson(filePath, value) {
     const dir = path.dirname(filePath);
     ensureSecureDir(dir);
@@ -108,12 +200,18 @@ export async function writeSecureJson(filePath, value) {
     const body = `${JSON.stringify(value, null, 2)}\n`;
     await writeFile(tmp, body, { encoding: "utf8", mode: 0o600 });
     try {
-        chmodSync(tmp, 0o600);
+        try {
+            chmodSync(tmp, 0o600);
+        }
+        catch {
+            // best-effort
+        }
+        await replaceFileWithRetry(tmp, resolved);
     }
-    catch {
-        // best-effort
+    catch (error) {
+        await rm(tmp, { force: true }).catch(() => undefined);
+        throw error;
     }
-    await rename(tmp, resolved);
     try {
         chmodSync(resolved, 0o600);
     }
@@ -182,10 +280,33 @@ export function writeSecureJsonSync(filePath, value) {
     const dir = path.dirname(filePath);
     ensureSecureDir(dir);
     const resolved = assertSafeAppDataPath(dir, filePath);
-    const tmp = `${resolved}.${process.pid}.tmp`;
-    writeFileSync(tmp, `${JSON.stringify(value, null, 2)}\n`, {
-        encoding: "utf8",
-        mode: 0o600,
-    });
-    renameSync(tmp, resolved);
+    const tmp = `${resolved}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
+    try {
+        writeFileSync(tmp, `${JSON.stringify(value, null, 2)}\n`, {
+            encoding: "utf8",
+            mode: 0o600,
+        });
+        try {
+            chmodSync(tmp, 0o600);
+        }
+        catch {
+            // best-effort
+        }
+        replaceFileWithRetrySync(tmp, resolved);
+    }
+    catch (error) {
+        try {
+            rmSync(tmp, { force: true });
+        }
+        catch {
+            // best-effort cleanup
+        }
+        throw error;
+    }
+    try {
+        chmodSync(resolved, 0o600);
+    }
+    catch {
+        // best-effort
+    }
 }

package/dist/worker/console/chat/pi-runtime.js

@@ -13,11 +13,10 @@
  *     (noContextFiles / closed surface); credential/model plane is shared via
  *     the same agentDir auth.json/models.json.
  *   - Active tools are pinned to the operator-chat surface at session create
- *     AND re-pinned before each prompt (three-gate, design §7.5): the FULL
- *     operator action set (dynamic, from the registry) PLUS the built-in
- *     read/explore tools (bash/read/grep/find/ls). File-WRITING coding tools
- *     (edit/write/apply_patch/full-tools/shell/coding-chat) are excluded from
- *     the SDK registry and can never be activated (2026-07-25 widening).
+ *     AND re-pinned before each prompt (three-gate, design §7.5 / ADR 0011):
+ *     the FULL operator action set PLUS full Pi builtins
+ *     (read/write/edit/bash/grep/find/ls) and optional safe-*. Non-Pi write
+ *     channels (apply_patch/full-tools/shell/coding-chat) stay excluded.
  *
  * The actual SDK calls are injected via `PiSdkBindings` so this module is
  * unit-testable without a live Pi install. Production bindings come from
@@ -49,35 +48,34 @@ import { filterActiveInterviewTools } from "../interview/tools.js";
  */
 const OPERATOR_CHAT_SYSTEM_PROMPT_BASE = [
     "You are the General Operator Chat for loop-agent / agent-worker.",
-    "You are an OPERATOR: you orchestrate and inspect via the registered operator_* tools. You are NOT an implementer.",
-    "Tool surface: you have safe read-only explore tools (safe-read, safe-grep, git-status, git-diff, find, ls) to probe the repo, AND the model-callable operator_* tools. bash is NOT available (it was removed to close a write-via-redirect escape); use safe-read / safe-grep / git-status / git-diff instead.",
-    "safe-read / safe-grep enforce a repo-relative path boundary, a sensitive-file denylist (.env* / *.key / *.pem / .git/** / auth.json / sessions/**) and secret scrubbing. Do not attempt to read those files via any other path.",
-    "You do NOT have edit / write / apply_patch / full-tools / shell / coding-chat — file-WRITING is gated behind the DAG path. All canonical writes still go through DAG implement-pi / repair-pi, never via this chat.",
-    "High-risk mutations are not model-executable tools. Prepare contract via interview then apply via contractApply, prepare DAG runs via prepareDagConfirmation, prepare other mutations via prepareMutationGate, then confirm in the browser Human Gate. When a high-risk action (contractApply / runDag / dagRerun / etc.) fails on missing prepared state, use read-only tools (status, doctor, dagReport, inspect, contractShow, safe-read, safe-grep) to diagnose.",
+    "You are an OPERATOR first: orchestrate and inspect via operator_* tools, and you also have full Pi repository tools (read, write, edit, bash, grep, find, ls) plus optional safe-read/safe-grep/git-status/git-diff.",
+    "Capability honesty (ADR 0011): read/write/edit/bash ARE available. Prefer governed loop-agent / Agent DAG paths (implement-pi / repair-pi) and Human Gate for large refactors, public contracts, credentials, or production-risk changes — treat direct write/edit/bash as soft-disciplined, not as a second DAG kernel.",
+    "safe-read / safe-grep enforce a repo-relative path boundary, a sensitive-file denylist (.env* / *.key / *.pem / .git/** / auth.json / sessions/**) and secret scrubbing. Prefer them for sensitive probes; avoid dumping secrets via raw read/bash.",
+    "You do NOT have apply_patch / full-tools / shell / coding-chat as alternate coding runtimes — those non-Pi channels stay denied.",
+    "High-risk mutations still use prepare + browser Human Gate. Prepare contract via interview then apply via contractApply, prepare DAG runs via prepareDagConfirmation, prepare other mutations via prepareMutationGate, then confirm in the browser Human Gate. When a high-risk action (contractApply / runDag / dagRerun / etc.) fails on missing prepared state, diagnose with status/doctor/dagReport/inspect/contractShow/read/safe-read/safe-grep.",
     "You cannot self-confirm a DAG run: confirmDagConfirmation is a human-only action (executed by the browser with a server-signed confirmation token). You may only prepare it via prepareDagConfirmation; the user must confirm in the UI.",
-    "Prefer read-only tools (status, doctor, dagReport, inspect, contractShow, safe-read, safe-grep, git-status) to diagnose before acting.",
+    "Prefer read-only diagnosis (status, doctor, dagReport, inspect, contractShow, read, safe-read, safe-grep, git-status) before mutating.",
 ].join("\n");
 /**
- * Built-in SDK read/explore tool names registered for every Chat session.
- *
- * M0-A (roadmap §14 工作块 A): bash is REMOVED — it could write files via
- * `echo >` / `tee` / `sed -i` / `node -e writeFile`, bypassing the DAG write
- * boundary. The residual read-only repo probing is served by the custom
- * safe-read / safe-grep / find / ls tools (see buildExploreCustomTools) which
- * enforce a repo-relative path boundary, a sensitive-file denylist, and
- * secret scrubbing on the returned content. edit/write/... stay excluded.
+ * Built-in SDK tool names registered for every Chat session (ADR 0011).
+ * Full Pi builtins: read/write/edit/bash/grep/find/ls. safe-* custom tools
+ * remain available in parallel for bounded sensitive probes.
  */
 export const OPERATOR_CHAT_BUILTIN_EXPLORE_TOOLS = Object.freeze([
+    "read",
+    "write",
+    "edit",
+    "bash",
+    "grep",
     "find",
     "ls",
 ]);
 /**
  * Canonical active tool-set handed to setActiveToolsByName at every gate:
- * every model-callable operator action (dynamic, from the registry) PLUS the
- * built-in explore tools (find/ls) PLUS the safe explore custom tools
- * (safe-read / safe-grep / git-status / git-diff). bash is NOT here (M0-A).
- * File-WRITING coding tools (edit/write/...) are never here — they are
- * excluded at the registry level and thus cannot be activated.
+ * every model-callable operator action (dynamic, from the registry) PLUS full
+ * Pi builtins (ADR 0011) PLUS safe explore custom tools (safe-read /
+ * safe-grep / git-status / git-diff). Non-Pi write channels (apply_patch /
+ * full-tools / shell / coding-chat) stay excluded.
  */
 export const OPERATOR_CHAT_SAFE_EXPLORE_TOOL_IDS = Object.freeze([
     "safe-read",
@@ -549,13 +547,10 @@ export class ConsolePiRuntime {
         const { session } = await this.bindings.createSessionFromServices({
             services,
             sessionManager,
-            // Explicitly register the explore-tool builtin set (Gate 1): find/ls.
-            // The default builtin read/bash/edit/write are EXCLUDED below; read/
-            // grep/bash are replaced by the safe customTools (M0-A).
+            // Gate 1 (ADR 0011): full Pi builtins registered; only non-Pi write
+            // channels excluded (apply_patch / full-tools / shell / coding-chat).
             tools: [...OPERATOR_CHAT_BUILTIN_EXPLORE_TOOLS],
             excludeTools: [
-                "edit",
-                "write",
                 "apply_patch",
                 "apply-patch",
                 "full-tools",
@@ -563,14 +558,6 @@ export class ConsolePiRuntime {
                 "coding-chat",
                 "coding_chat",
                 "shell",
-                // M0-A: bash is removed entirely (write-via-redirect escape). The
-                // model gets safe-read / safe-grep custom tools instead.
-                "bash",
-                // M0-A: built-in read/grep are replaced by custom safe-read/safe-grep
-                // that enforce a repo-relative boundary, a sensitive-file denylist,
-                // and secret scrubbing (roadmap G16).
-                "read",
-                "grep",
             ],
             ...(customTools && customTools.length > 0
                 ? { customTools }
@@ -836,8 +823,6 @@ export class ConsolePiRuntime {
             sessionManager: init.sessionManager,
             tools: [...OPERATOR_CHAT_BUILTIN_EXPLORE_TOOLS],
             excludeTools: [
-                "edit",
-                "write",
                 "apply_patch",
                 "apply-patch",
                 "full-tools",
@@ -845,9 +830,6 @@ export class ConsolePiRuntime {
                 "coding-chat",
                 "coding_chat",
                 "shell",
-                "bash",
-                "read",
-                "grep",
             ],
             ...(customTools && customTools.length > 0 ? { customTools } : {}),
             ...(resolvedModel ? { model: resolvedModel } : {}),

package/dist/worker/console/chat/resource-loader.js

@@ -1,14 +1,11 @@
 /**
- * Operator Chat — closed ResourceLoader contract (design §7.5 / V12 / plan W3).
+ * Operator Chat — ResourceLoader contract (ADR 0011 full Pi tools).
  *
- * M0-A (roadmap §14 工作块 A): the bare bash/read/grep built-ins are GONE.
- * The Chat session now exposes safe explore custom tools (safe-read /
- * safe-grep / git-status / git-diff) which enforce a repo-relative boundary,
- * a sensitive-file denylist, and secret scrubbing — plus find/ls. The full
- * model-callable operator action set is still allowed; the only denied tools
- * are file-WRITING coding tools (edit/write/apply_patch/full-tools/shell/
- * coding-chat) AND bash/read/grep (replaced by the safe versions). hasBash is
- * therefore false: there is no shell escape.
+ * Declares the operator-chat surface for capabilities reporting and red-team
+ * checks: full Pi builtins (read/write/edit/bash/grep/find/ls), model-callable
+ * operator actions, and optional safe-* explore tools. hasBash is true.
+ * Non-Pi write channels (apply_patch / full-tools / shell / coding-chat) remain
+ * denied. Interview/Official loaders are unchanged.
  *
  * Note: this adapter is NOT the SDK's own ResourceLoader (that is
  * DefaultResourceLoader, created inside createAgentSessionServices with
@@ -17,13 +14,12 @@
  * The three-gate authorization (authorizeOperatorChatTool) is the actual
  * enforcement; this adapter describes what that gate admits.
  */
-import { OPERATOR_CHAT_ALLOWED_TOOLS, OPERATOR_CHAT_DENIED_TOOLS, OPERATOR_CHAT_DENIED_OPERATOR_ACTIONS, authorizeOperatorChatTool, filterOperatorChatTools, assertNoWriteToolInList, } from "./tools.js";
-/** Built-in explore tool names that are ALLOWED in every Chat session (M0-A). */
+import { OPERATOR_CHAT_ALLOWED_TOOLS, OPERATOR_CHAT_DENIED_TOOLS, OPERATOR_CHAT_DENIED_OPERATOR_ACTIONS, OPERATOR_CHAT_PI_BUILTIN_TOOLS, authorizeOperatorChatTool, filterOperatorChatTools, assertNoWriteToolInList, } from "./tools.js";
+/** Built-in Pi tool names allowed in every Chat session (ADR 0011). */
 export const OPERATOR_CHAT_BUILTIN_EXPLORE_TOOL_IDS = Object.freeze([
-    "find",
-    "ls",
+    ...OPERATOR_CHAT_PI_BUILTIN_TOOLS,
 ]);
-/** Safe explore custom tool names (M0-A). */
+/** Safe explore custom tool names (optional parallel surface). */
 export const OPERATOR_CHAT_SAFE_EXPLORE_TOOL_IDS = Object.freeze([
     "safe-read",
     "safe-grep",
@@ -41,11 +37,6 @@ export function createOperatorChatResourceLoader() {
         safeExploreToolIds: OPERATOR_CHAT_SAFE_EXPLORE_TOOL_IDS,
         listTools: () => OPERATOR_CHAT_ALLOWED_TOOLS,
         tryActivateTool: (toolId) => {
-            // Explore tools (bash/read/grep/find/ls) are run by the SDK's built-in
-            // tool registry, not by the operator dispatcher. tryActivateTool only
-            // classifies operator actions here, but it must NOT deny an explore
-            // tool — that would contradict the real session. Deny only write tools
-            // and report unknowns.
             const explore = OPERATOR_CHAT_BUILTIN_EXPLORE_TOOL_IDS.includes(toolId);
             if (explore) {
                 return { ok: true, toolId };
@@ -62,6 +53,6 @@ export function createOperatorChatResourceLoader() {
             return { active: [...active], denied };
         },
         allowsEnvToolRestore: false,
-        hasBash: false,
+        hasBash: true,
     };
 }

package/dist/worker/console/chat/routes.js

@@ -176,9 +176,8 @@ export async function handleChatCapabilities(_req, res, deps) {
             skipped: skills.skipped,
             promptFragmentCharCount: composeInstructionSkillsPrompt(skills.loaded).length,
         },
-        // M0-A: bare bash is removed; safe-read/safe-grep enforce the repo and
-        // secret boundaries instead.
-        hasBash: false,
+        // ADR 0011: full Pi tools including bash are default-active.
+        hasBash: true,
     });
 }
 export async function handleCreateChatSession(req, res, deps) {
@@ -236,7 +235,7 @@ export async function handleCreateChatSession(req, res, deps) {
             sessionFile: handle.sessionFile,
             model: handle.model,
             activeTools: handle.activeTools,
-            hasBash: false,
+            hasBash: true,
         });
     }
     catch (error) {
@@ -342,7 +341,7 @@ export async function handleGetChatSession(_req, res, deps, sessionId) {
             composerDraft,
             activeTurnId: deps.events.getActiveTurn(sessionId)?.turnId,
         },
-        hasBash: false,
+        hasBash: true,
         lastEventId: lastEvent?.eventId ?? null,
         lastEventSeq: lastEvent?.seq ?? 0,
     });
@@ -356,7 +355,7 @@ export async function handleListChatSessions(_req, res, deps) {
             ...session,
             activeTurnId: deps.events.getActiveTurn(session.sessionId)?.turnId,
         })),
-        hasBash: false,
+        hasBash: true,
     });
 }
 export async function handlePatchChatSession(req, res, deps, sessionId) {
@@ -395,7 +394,7 @@ export async function handleReopenChatSession(req, res, deps, sessionId) {
         return;
     }
     if (deps.runtime.hasSession(sessionId)) {
-        sendJson(res, 200, { ok: true, sessionId, reopened: false, alreadyActive: true, hasBash: false });
+        sendJson(res, 200, { ok: true, sessionId, reopened: false, alreadyActive: true, hasBash: true });
         return;
     }
     const result = await deps.runtime.reopenSession({
@@ -416,7 +415,7 @@ export async function handleReopenChatSession(req, res, deps, sessionId) {
         sessionFile: result.handle.sessionFile,
         model: result.handle.model,
         activeTools: result.handle.activeTools,
-        hasBash: false,
+        hasBash: true,
     });
 }
 export async function handleChatPrompt(req, res, deps, sessionId) {

package/dist/worker/console/chat/runtime-context.js

@@ -16,7 +16,7 @@ export function projectRuntimeContext(input) {
             summary: summary(input.systemPrompt),
         },
         skills: input.skills.map((skill) => ({ ...skill, description: summary(skill.description, 200) ?? "" })),
-        resources: { mode: "closed", noContextFiles: true, noSkills: true, noExtensions: true, hasBash: false, activeToolCount: input.activeTools.length },
+        resources: { mode: "closed", noContextFiles: true, noSkills: true, noExtensions: true, hasBash: true, activeToolCount: input.activeTools.length },
         model: input.model,
         thinkingLevel: input.thinkingLevel,
         suffix: input.systemPromptSuffix ? { present: true, summary: summary(input.systemPromptSuffix) } : { present: false },

package/dist/worker/console/chat/tools.js

@@ -1,15 +1,15 @@
 /**
- * Operator Chat — closed tool whitelist (design §7.5 / roadmap M0).
+ * Operator Chat — tool policy (ADR 0011 UX-first full Pi tools).
  *
- * The Chat exposes the model-callable structured operator surface. Repository
- * exploration is deliberately limited to safe-read/safe-grep/git-status/
- * git-diff plus built-in find/ls; the bare SDK bash/read/grep tools are denied
- * because they bypass the M0-A write and sensitive-data boundaries.
+ * Operator Chat registers and activates full Pi builtins
+ * (read/write/edit/bash/grep/find/ls) plus model-callable operator actions and
+ * optional safe-* explore custom tools. Discipline is primarily soft
+ * (system prompt: prefer DAG / Human Gate). Hard denies remain for non-Pi
+ * write channels (apply_patch / full-tools / shell / coding-chat) and for
+ * modelCallable="never" actions (e.g. confirmDagConfirmation).
  *
- * Dynamic discovery derives model-callable operator actions directly from the
- * capabilities registry. Explicit denial remains the defense-in-depth layer:
- * a future resource-loader or SDK drift cannot reactivate removed coding or
- * explore tools merely by changing the active-tool list.
+ * Interview / Official surfaces keep their own OFFICIAL_DENIED path; this
+ * module only filters Chat-side denial so Interview is not widened.
  */
 import { buildOperatorCapabilitiesDocument } from "../../../shared/operator/capabilities.js";
 import { OFFICIAL_DENIED_TOOL_IDS } from "../resource-loader.js";
@@ -41,31 +41,37 @@ export const OPERATOR_CHAT_MODEL_FORBIDDEN_ACTIONS = Object.freeze(buildOperator
  * stay defensive against future additions.
  */
 export const OPERATOR_CHAT_DENIED_OPERATOR_ACTIONS = Object.freeze([]);
-// Coding / generic tool ids that must never appear in a Chat session. M0-A
-// removes bare bash (write-via-redirect) and SDK read/grep (no sensitive-file
-// boundary); find/ls remain the only SDK explore builtins. Safe content probes
-// are custom tools, not generic SDK tools.
-const _ALLOWED_SDK_EXPLORE_TOOLS = new Set(["find", "ls"]);
-const _REMOVED_SDK_EXPLORE_TOOLS = ["bash", "read", "grep"];
+/** Full Pi builtin explore / coding tools admitted by ADR 0011. */
+export const OPERATOR_CHAT_PI_BUILTIN_TOOLS = Object.freeze([
+    "read",
+    "write",
+    "edit",
+    "bash",
+    "grep",
+    "find",
+    "ls",
+]);
+const _PI_BUILTIN_ALLOW = new Set(OPERATOR_CHAT_PI_BUILTIN_TOOLS.map((t) => t.toLowerCase()));
 // Operator actions that OFFICIAL_DENIED_TOOL_IDS carries for Interview safety
-// but that the Chat now deliberately allows. We compare on a COMPACTED form
-// (strip - and _) because OFFICIAL lists both camelCase (`contractApply`) and
-// snake_case (`contract_apply`) variants, and authorize() also normalizes —
-// leaving any variant in would re-deny the action via normalization.
+// but that the Chat now deliberately allows. Compare on a COMPACTED form
+// (strip - and _) because OFFICIAL lists both camelCase and snake_case.
 const _ALLOWED_OPERATOR_ACTIONS_COMPACT = new Set(OPERATOR_CHAT_ALLOWED_TOOLS.map((t) => t.toLowerCase().replace(/[-_]/g, "")));
+/**
+ * Tools denied for Operator Chat. Built from OFFICIAL_DENIED minus:
+ * - Pi builtins allowed by ADR 0011
+ * - model-callable operator actions
+ * Does NOT re-add bash/read/grep/edit/write.
+ */
 export const OPERATOR_CHAT_DENIED_TOOLS = Object.freeze([
-    ...new Set([
-        ...OFFICIAL_DENIED_TOOL_IDS.filter((id) => {
-            const lower = id.toLowerCase();
-            if (_ALLOWED_SDK_EXPLORE_TOOLS.has(lower))
-                return false;
-            if (_ALLOWED_OPERATOR_ACTIONS_COMPACT.has(lower.replace(/[-_]/g, ""))) {
-                return false;
-            }
-            return true;
-        }),
-        ..._REMOVED_SDK_EXPLORE_TOOLS,
-    ]),
+    ...new Set(OFFICIAL_DENIED_TOOL_IDS.filter((id) => {
+        const lower = id.toLowerCase();
+        if (_PI_BUILTIN_ALLOW.has(lower))
+            return false;
+        if (_ALLOWED_OPERATOR_ACTIONS_COMPACT.has(lower.replace(/[-_]/g, ""))) {
+            return false;
+        }
+        return true;
+    })),
 ]);
 /**
  * Operator actions denied by model policy (modelCallable="never"). These are
@@ -78,11 +84,19 @@ const DENIED_MODEL_POLICY = new Set(OPERATOR_CHAT_MODEL_FORBIDDEN_ACTIONS.map((a
 const ALLOWED = new Set(OPERATOR_CHAT_ALLOWED_TOOLS.map((t) => t.toLowerCase()));
 const DENIED_ACTIONS = new Set(OPERATOR_CHAT_DENIED_OPERATOR_ACTIONS.map((a) => a.toLowerCase()));
 const DENIED_TOOLS = new Set(OPERATOR_CHAT_DENIED_TOOLS.map((t) => t.toLowerCase()));
+/** Pi builtins are authorized without being operator registry actions. */
+const PI_BUILTIN_AUTHORIZED = new Set(OPERATOR_CHAT_PI_BUILTIN_TOOLS.map((t) => t.toLowerCase()));
 export function isOperatorChatToolAllowed(toolId) {
-    return ALLOWED.has(toolId.trim().toLowerCase());
+    const id = toolId.trim().toLowerCase();
+    if (PI_BUILTIN_AUTHORIZED.has(id))
+        return true;
+    return ALLOWED.has(id);
 }
 export function isOperatorChatToolDenied(toolId) {
     const id = toolId.trim().toLowerCase();
+    // Pi builtins are never denied under ADR 0011.
+    if (PI_BUILTIN_AUTHORIZED.has(id))
+        return false;
     if (DENIED_TOOLS.has(id))
         return true;
     if (DENIED_ACTIONS.has(id))
@@ -125,7 +139,7 @@ export function authorizeOperatorChatTool(toolId) {
             ok: false,
             code: "tool-denied",
             toolId: id,
-            message: `tool "${id}" is denied in General Operator Chat (no bash/read/grep/edit/write/apply_patch/full-tools/shell/coding-chat)`,
+            message: `tool "${id}" is denied in General Operator Chat (no apply_patch/full-tools/shell/coding-chat; modelCallable=never still blocked)`,
         };
     }
     if (!isOperatorChatToolAllowed(id)) {
@@ -155,35 +169,34 @@ export function filterOperatorChatTools(requested) {
     return { allowed, denied };
 }
 /**
- * Assert that a requested tool set contains no prohibited coding or removed
- * SDK explore tool. Used by red-team / boot checks (V12 / M0-A). bash is
- * explicitly forbidden: accepting it would recreate the redirect write escape.
+ * Non-Pi write / coding channels that must never appear in Operator Chat.
+ * ADR 0011 allows Pi builtins read/write/edit/bash/grep/find/ls; this guard
+ * only blocks alternate coding surfaces (apply_patch, full-tools, shell,
+ * coding-chat).
+ */
+const NON_PI_WRITE_CHANNELS = [
+    "apply_patch",
+    "apply-patch",
+    "full-tools",
+    "full_tools",
+    "coding-chat",
+    "coding_chat",
+    "shell",
+];
+/**
+ * Assert that a requested tool set contains no prohibited non-Pi write
+ * channel. Pi builtins (including write/edit/bash) are allowed (ADR 0011).
  */
 export function assertNoWriteToolInList(requested) {
-    const writeVariants = [
-        "edit",
-        "write",
-        "apply_patch",
-        "apply-patch",
-        "full-tools",
-        "full_tools",
-        "coding-chat",
-        "coding_chat",
-        "shell",
-        "bash",
-        "read",
-        "grep",
-    ];
     const lower = new Set(requested.map((t) => t.trim().toLowerCase()));
-    for (const v of writeVariants) {
+    for (const v of NON_PI_WRITE_CHANNELS) {
         if (lower.has(v)) {
-            throw new Error(`file-writing tool "${v}" must not appear in Operator Chat tool list (V12 closed coding surface)`);
+            throw new Error(`non-Pi write channel "${v}" must not appear in Operator Chat tool list (ADR 0011)`);
         }
     }
 }
 /**
- * Back-compat alias kept for callers that still reference the old name. It
- * also rejects removed SDK explore tools, including bash.
+ * Back-compat alias kept for callers that still reference the old name.
  * @deprecated use {@link assertNoWriteToolInList}.
  */
 export function assertNoBashInToolList(requested) {

package/dist/worker/console/operation-runner.js

@@ -34,6 +34,7 @@ export async function runOperation(operationId, deps) {
             ? deps.client.runExternal(op.externalCommand, cliArgs, options)
             : deps.client.run(cliArgs, options));
     let finished;
+    let spawnUpdate = Promise.resolve();
     try {
         const result = await run(args, {
             cwd: deps.repoRoot,
@@ -41,10 +42,21 @@ export async function runOperation(operationId, deps) {
             expectJson: true,
             timeoutMs: deps.defaultTimeoutMs,
             onSpawn: (info) => {
-                void deps.store.update(operationId, {
+                // Chain onto the per-operation write lock; never fire-and-forget a
+                // rejected update (unhandled rejection can crash Console on Windows).
+                spawnUpdate = deps.store
+                    .update(operationId, {
                     state: "running",
                     pid: info.pid,
                     processStartIdentity: info.startedAt,
+                })
+                    .catch((error) => {
+                    const message = error instanceof Error ? error.message : String(error);
+                    deps.events.append(operationId, {
+                        at: new Date().toISOString(),
+                        kind: "error",
+                        message: `failed to persist running state: ${message}`,
+                    });
                 });
                 stateEvent(deps.events, op, "running", `pid=${info.pid ?? "?"}`);
             },
@@ -63,9 +75,11 @@ export async function runOperation(operationId, deps) {
                 });
             },
         });
+        await spawnUpdate;
         finished = await finalizeFromWorkerResult(operationId, result, deps);
     }
     catch (error) {
+        await spawnUpdate.catch(() => undefined);
         // Cannot prove CLI exit classification → needs-reconcile (not Cancel)
         finished = await deps.store.update(operationId, {
             state: "needs-reconcile",