@tea-agent/loop-agent 0.33.5 → 0.33.6

package/dist/worker/console/chat/chat-event-store.js

@@ -169,7 +169,69 @@ export function projectOperationEventSummary(event) {
             .digest("hex"),
     };
 }
+/** Conservative per-event byte contribution (compact JSON length × UTF-8/pretty scale). */
+function byteHint(value) {
+    return JSON.stringify(value).length * BYTE_GATE_SCALE;
+}
+function recomputeApproxBytes(ring) {
+    let total = BYTE_GATE_SLACK;
+    for (const event of ring.events)
+        total += byteHint(event);
+    for (const turn of ring.turns)
+        total += byteHint(turn);
+    ring.approxBytes = total;
+}
+/**
+ * D3 eviction priority: drop the single oldest candidate — text updates
+ * (`message_update`) first, structural events second, and `message_end` (the
+ * terminal full-text event) absolutely last. Falls back to the oldest event
+ * (legacy `shift()` order) when only `message_end` remain.
+ */
+function dropOneByPriority(ring) {
+    const events = ring.events;
+    if (events.length === 0)
+        return undefined;
+    const textIndex = events.findIndex((event) => event.kind === "message_update");
+    if (textIndex !== -1)
+        return events.splice(textIndex, 1)[0];
+    const structuralIndex = events.findIndex((event) => event.kind !== "message_end");
+    if (structuralIndex !== -1)
+        return events.splice(structuralIndex, 1)[0];
+    return events.shift();
+}
+/**
+ * D2 coalescing decision: merge an incoming `message_update` into the ring tail
+ * only when the tail is also a same-turn `message_update` and the update landed
+ * inside the coalescing window. Structural events close the window implicitly
+ * (their presence makes the tail check fail), so an
+ * update → tool_call → update sequence never merges across the tool boundary.
+ * `partial.at` (when present) drives the clock so tests can inject window
+ * boundaries deterministically without fake timers.
+ */
+function shouldCoalesce(ring, turnId, partial) {
+    if (partial.kind !== "message_update")
+        return false;
+    const tail = ring.events.at(-1);
+    if (!tail || tail.kind !== "message_update")
+        return false;
+    if (tail.turnId !== turnId)
+        return false;
+    const nowMs = partial.at ? Date.parse(partial.at) : Date.now();
+    if (Number.isNaN(nowMs))
+        return false;
+    return nowMs - Date.parse(tail.at) <= ring.coalesceWindowMs;
+}
 const DEFAULT_MAX_EVENTS = 2000;
+/** Mirrors pi-web's bounded-ring orientation (2000 events / 10 MiB). */
+const DEFAULT_MAX_BYTES = 10 * 1024 * 1024;
+/** Same-turn `message_update` events inside this window coalesce into one persisted event. */
+const DEFAULT_COALESCE_WINDOW_MS = 100;
+/** Conservative per-event scale for the byte pre-check gate (UTF-8 multibyte ≤ 4 bytes/char × pretty-print expansion). */
+const BYTE_GATE_SCALE = 12;
+/** Fixed envelope slack (schema keys, turnCount, nextSeq, minSeq, turns) for the byte pre-check gate. */
+const BYTE_GATE_SLACK = 8192;
+/** Legacy epoch for event files written before M5.1 (no epoch field). */
+const LEGACY_EPOCH = "legacy";
 /** Make a sessionId safe to use as a filename component. */
 function safeSessionId(sessionId) {
     return sessionId.replace(/[^a-zA-Z0-9._-]+/g, "_").slice(0, 180);
@@ -292,6 +354,9 @@ export function createChatOperationLinker(options) {
 }
 export function createChatEventStore(options) {
     const maxEvents = options?.maxEventsPerSession ?? DEFAULT_MAX_EVENTS;
+    const maxBytes = options?.maxBytesPerSession ?? DEFAULT_MAX_BYTES;
+    const coalesceWindowMs = options?.coalesceWindowMs ?? DEFAULT_COALESCE_WINDOW_MS;
+    const eventEpoch = options?.epoch?.trim() || LEGACY_EPOCH;
     const persistenceDir = options?.appData?.chatEvents
         ? path.resolve(options.appData.chatEvents)
         : undefined;
@@ -307,6 +372,12 @@ export function createChatEventStore(options) {
             ? path.join(persistenceDir, `${safeSessionId(sessionId)}.json`)
             : undefined;
     }
+    function eventIdFor(sessionId, seq) {
+        // Preserve the pre-M5.1 test/file surface for stores that did not opt in.
+        return eventEpoch === LEGACY_EPOCH
+            ? `${sessionId}:${seq}`
+            : `${eventEpoch}:${seq}`;
+    }
     function loadRing(sessionId) {
         const file = persistedPath(sessionId);
         if (!file || !existsSync(file))
@@ -318,26 +389,41 @@ export function createChatEventStore(options) {
                 !Array.isArray(parsed.events)) {
                 throw new Error("invalid persisted chat event ring");
             }
-            const events = parsed.events.slice(-maxEvents);
+            // Persisted events are derived recovery facts. On a new Console boot we
+            // deliberately remap their ids into this store's generation namespace;
+            // clients with an old epoch then reconcile rather than cross generations.
+            const events = parsed.events
+                .slice(-maxEvents)
+                .map((event) => ({
+                ...event,
+                eventId: eventIdFor(sessionId, event.seq),
+            }));
             const turns = Array.isArray(parsed.turns) ? parsed.turns : [];
             turnCounts.set(sessionId, parsed.turnCount ?? 0);
-            return {
+            const ring = {
                 events,
                 turns,
                 nextSeq: Math.max(parsed.nextSeq, (events[events.length - 1]?.seq ?? 0) + 1),
                 minSeq: events[0]?.seq ?? parsed.minSeq ?? 1,
                 maxEvents,
+                maxBytes,
+                coalesceWindowMs,
+                approxBytes: 0,
+                epoch: eventEpoch,
             };
+            recomputeApproxBytes(ring);
+            // R6: re-check the bounds after a restart — a persisted file may exceed the
+            // current limits if it was written by an older config or hand-edited.
+            enforceBounds(sessionId, ring);
+            return ring;
         }
         catch (error) {
             throw new Error(`invalid persisted chat events ${file}: ${error instanceof Error ? error.message : String(error)}`);
         }
     }
-    function persist(sessionId, ring) {
-        const file = persistedPath(sessionId);
-        if (!file)
-            return;
-        writeSecureJsonSync(file, {
+    /** The exact payload written to disk (single source of truth for D4 byte accounting). */
+    function ringPayload(sessionId, ring) {
+        return {
             schemaVersion: 1,
             sessionId,
             turnCount: turnCounts.get(sessionId) ?? 0,
@@ -345,7 +431,48 @@ export function createChatEventStore(options) {
             events: ring.events,
             nextSeq: ring.nextSeq,
             minSeq: ring.minSeq,
-        });
+            epoch: ring.epoch,
+        };
+    }
+    /** Serialized exactly as `writeSecureJsonSync` writes it, so byte accounting
+     *  (D4) and the on-disk bytes use the same formatting. */
+    function serializeRingForPersist(sessionId, ring) {
+        return `${JSON.stringify(ringPayload(sessionId, ring), null, 2)}\n`;
+    }
+    function bytesOfRing(sessionId, ring) {
+        return Buffer.byteLength(serializeRingForPersist(sessionId, ring), "utf8");
+    }
+    /**
+     * Enforce the `maxEvents + maxBytes` dual bound (D3/D4). maxEvents first
+     * (count), then bytes against the real serialized payload; every drop removes
+     * the oldest eviction candidate by priority. The byte loop is bounded because
+     * each iteration removes an event and stops on an empty ring. A conservative
+     * pre-check skips the exact serialization for small rings (keeps the frequent
+     * per-token append path O(1)-ish).
+     */
+    function enforceBounds(sessionId, ring) {
+        while (ring.events.length > ring.maxEvents) {
+            const dropped = dropOneByPriority(ring);
+            if (dropped)
+                ring.approxBytes -= byteHint(dropped);
+        }
+        if (ring.events.length > 0 && ring.approxBytes > ring.maxBytes) {
+            while (ring.events.length > 0 &&
+                bytesOfRing(sessionId, ring) > ring.maxBytes) {
+                const dropped = dropOneByPriority(ring);
+                if (dropped)
+                    ring.approxBytes -= byteHint(dropped);
+            }
+        }
+        if (ring.events.length > 0) {
+            ring.minSeq = ring.events[0].seq;
+        }
+    }
+    function persist(sessionId, ring) {
+        const file = persistedPath(sessionId);
+        if (!file)
+            return;
+        writeSecureJsonSync(file, ringPayload(sessionId, ring));
     }
     function ringFor(sessionId) {
         let ring = rings.get(sessionId);
@@ -356,6 +483,10 @@ export function createChatEventStore(options) {
                 nextSeq: 1,
                 minSeq: 1,
                 maxEvents,
+                maxBytes,
+                coalesceWindowMs,
+                approxBytes: BYTE_GATE_SLACK,
+                epoch: eventEpoch,
             };
             rings.set(sessionId, ring);
         }
@@ -407,6 +538,7 @@ export function createChatEventStore(options) {
                 createdAt: now,
             };
             ring.turns.push(turn);
+            ring.approxBytes += byteHint(turn);
             persist(sessionId, ring);
             return { ok: true, turn };
         },
@@ -416,6 +548,7 @@ export function createChatEventStore(options) {
             if (!turn)
                 return undefined;
             turn.state = state;
+            const before = JSON.stringify(turn).length;
             if (state === "running" && !turn.startedAt)
                 turn.startedAt = new Date().toISOString();
             if (state === "settled" || state === "aborted" || state === "failed") {
@@ -423,6 +556,8 @@ export function createChatEventStore(options) {
             }
             if (error)
                 turn.error = error;
+            ring.approxBytes +=
+                (JSON.stringify(turn).length - before) * BYTE_GATE_SCALE;
             persist(sessionId, ring);
             return { ...turn };
         },
@@ -443,49 +578,79 @@ export function createChatEventStore(options) {
         },
         append(sessionId, turnId, partial) {
             const ring = ringFor(sessionId);
+            // D1: every append (coalesced or not) consumes a fresh live seq so the
+            // live stream stays fully dense (AC-006); the persisted ring may collapse
+            // text updates, but nextSeq is always persisted alongside it so a restart
+            // never re-issues a seq a live client already saw.
             const seq = ring.nextSeq++;
-            const event = {
+            const at = partial.at ?? new Date().toISOString();
+            const live = {
                 schemaVersion: 1,
-                eventId: `${sessionId}:${seq}`,
+                eventId: eventIdFor(sessionId, seq),
                 sessionId,
                 seq,
                 turnId,
-                at: partial.at ?? new Date().toISOString(),
+                at,
                 kind: partial.kind,
                 data: partial.data,
             };
-            ring.events.push(event);
-            while (ring.events.length > ring.maxEvents) {
-                const dropped = ring.events.shift();
-                if (dropped)
-                    ring.minSeq = dropped.seq + 1;
+            if (shouldCoalesce(ring, turnId, partial)) {
+                // AC-001: same-turn in-window text update replaces the persisted tail in
+                // place (keeping its original seq/eventId/turnId); only the text and `at`
+                // slide forward. The fresh live event is still returned/broadcast below.
+                const tail = ring.events.at(-1);
+                const before = JSON.stringify(tail).length;
+                tail.data = live.data;
+                tail.at = live.at;
+                ring.approxBytes +=
+                    (JSON.stringify(tail).length - before) * BYTE_GATE_SCALE;
             }
-            if (ring.events.length > 0) {
-                ring.minSeq = ring.events[0].seq;
+            else {
+                ring.events.push(live);
+                ring.approxBytes += byteHint(live);
             }
+            enforceBounds(sessionId, ring);
             persist(sessionId, ring);
             const subs = subscribers.get(sessionId);
             if (subs) {
                 for (const fn of subs) {
                     try {
-                        fn(event);
+                        fn(live);
                     }
                     catch {
                         // a subscriber throwing must never break the append path
                     }
                 }
             }
-            return event;
+            return live;
         },
-        listFrom(sessionId, afterSeq) {
+        listFrom(sessionId, cursor) {
             const ring = rings.get(sessionId) ?? loadRing(sessionId);
             if (!ring)
-                return { events: [] };
+                return { events: [], epoch: eventEpoch };
             rings.set(sessionId, ring);
-            if (ring.events.length > 0 && afterSeq + 1 < ring.minSeq) {
-                return { error: "CURSOR_EXPIRED", minSeq: ring.minSeq };
+            const normalized = typeof cursor === "number" ? { seq: cursor, epoch: null } : cursor;
+            if (normalized.epoch && normalized.epoch !== ring.epoch) {
+                return {
+                    error: "CURSOR_EPOCH_MISMATCH",
+                    minSeq: ring.minSeq,
+                    epoch: ring.epoch,
+                };
             }
-            return { events: ring.events.filter((e) => e.seq > afterSeq) };
+            if (ring.events.length > 0 && normalized.seq + 1 < ring.minSeq) {
+                return {
+                    error: "CURSOR_EXPIRED",
+                    minSeq: ring.minSeq,
+                    epoch: ring.epoch,
+                };
+            }
+            return {
+                events: ring.events.filter((event) => event.seq > normalized.seq),
+                epoch: ring.epoch,
+            };
+        },
+        epoch(sessionId) {
+            return ringFor(sessionId).epoch;
         },
         snapshot(sessionId) {
             const ring = rings.get(sessionId) ?? loadRing(sessionId);

package/dist/worker/console/chat/pi-console-config.js

@@ -1,8 +1,6 @@
 import { createHash, randomBytes } from "node:crypto";
 import { open, readFile, rename, writeFile } from "node:fs/promises";
 import path from "node:path";
-import { readJsonIfExists, writeSecureJson } from "../app-data.js";
-import { OPERATOR_CHAT_ALLOWED_INSTRUCTION_SKILLS } from "./instruction-skills.js";
 const revision = (raw) => createHash("sha256").update(raw).digest("hex");
 export async function readModelsConfig(agentDir) {
     let raw = "{}";
@@ -110,26 +108,219 @@ export async function patchModelsConfig(agentDir, input) {
     await rename(tmp, file);
     return readModelsConfig(agentDir);
 }
-const preferencesFile = (appData) => path.join(appData.chats, ".instruction-skill-preferences.json");
-export async function readSkillPreferences(appData) {
-    const value = await readJsonIfExists(preferencesFile(appData));
-    return (value?.disabledNames ?? []).filter((name) => OPERATOR_CHAT_ALLOWED_INSTRUCTION_SKILLS.includes(name));
+/** Max bytes of a package.json we are willing to read (read-only, bounded). */
+export const MAX_PACKAGE_JSON_BYTES = 64 * 1024;
+/** Max directory levels walked upward from an owned resolved resource path. */
+export const MAX_PACKAGE_JSON_WALK_DEPTH = 24;
+/**
+ * One npm-style range token: optional comparator/v-prefix followed by an
+ * exact/x-form version, a wildcard, or a prerelease/build suffix. Accepts
+ * >=2.0.0, <3.0.0, ^2.1.0, ~1.2.3, ~1, 1.2, 1.x, 1.2.x, 1.2.3-beta.1+build.5, *.
+ */
+const SPEC_RANGE_TOKEN = "(?:>=|<=|[<>=~^*v])?(?:\\d+(?:\\.(?:\\d+|x|X)){0,2}(?:-[0-9A-Za-z.-]+)?(?:\\+[0-9A-Za-z.-]+)?|\\*|x|X)";
+/** Whitespace-separated comparator list, e.g. ">=2.0.0 <3.0.0". */
+const SPEC_RANGE = new RegExp(`^${SPEC_RANGE_TOKEN}(?:\\s+${SPEC_RANGE_TOKEN})*$`);
+/**
+ * Installed-side grammar: an EXACT semver with optional prerelease and build
+ * metadata (1.2.3, 1.2.3-beta.1, 1.2.3+build.5, 1.2.3-beta.1+build.5). Ranges
+ * and partial shapes (*, 1.x, ~1, 1.2) are rejected with a field diagnostic.
+ */
+const INSTALLED_VERSION = /^v?\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+/**
+ * Try to derive the explicit version/range from an npm-style spec — verbatim
+ * projection, zero resolution and zero install (AC-RF-1). Git/URL shapes
+ * (containing /, #, :// or git+) never project a configuredVersion.
+ */
+function versionFromSpec(spec) {
+    // npm:name@1.2.3 / name@^1.2 / @scope/name@1.2.3 — never guess on git/url specs.
+    const match = spec.match(/^(?:npm:)?(@?[^@/\s]+(?:\/[^@\s]+)?)@(.+)$/);
+    if (!match)
+        return undefined;
+    const version = match[2];
+    if (/[\/#:]|git\+/.test(version))
+        return undefined;
+    return SPEC_RANGE.test(version) ? version : undefined;
 }
-export async function writeSkillPreferences(appData, disabledNames) {
-    const allowed = new Set(OPERATOR_CHAT_ALLOWED_INSTRUCTION_SKILLS);
-    if (disabledNames.some((name) => !allowed.has(name)))
-        throw Object.assign(new Error("preferences contain a non-allowed skill"), {
-            code: "INVALID_INPUT",
-            status: 400,
-        });
-    const normalized = [...new Set(disabledNames)].sort();
-    await writeSecureJson(preferencesFile(appData), {
-        schemaVersion: 1,
-        disabledNames: normalized,
-    });
-    return normalized;
+/**
+ * Bounded read of a package.json: open + single read capped at
+ * MAX_PACKAGE_JSON_BYTES+1 so an oversized file is detected without
+ * buffering the whole file, then JSON.parse with root-object validation.
+ */
+async function readPackageJsonBounded(file) {
+    let handle;
+    try {
+        handle = await open(file, "r");
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === "ENOENT")
+            return { ok: false, missing: true, diagnostic: "" };
+        return {
+            ok: false,
+            diagnostic: `PACKAGE_JSON_READ_FAILED: ${file} (${error instanceof Error ? error.message : String(error)})`,
+        };
+    }
+    try {
+        const buffer = Buffer.alloc(MAX_PACKAGE_JSON_BYTES + 1);
+        const { bytesRead } = await handle.read(buffer, 0, buffer.length, 0);
+        if (bytesRead > MAX_PACKAGE_JSON_BYTES) {
+            return {
+                ok: false,
+                diagnostic: `PACKAGE_JSON_TOO_LARGE: ${file} (exceeds ${MAX_PACKAGE_JSON_BYTES} bytes)`,
+            };
+        }
+        const raw = buffer.subarray(0, bytesRead).toString("utf8");
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch (error) {
+            return {
+                ok: false,
+                diagnostic: `PACKAGE_JSON_INVALID: ${file} (${error instanceof Error ? error.message : String(error)})`,
+            };
+        }
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+            return {
+                ok: false,
+                diagnostic: `PACKAGE_JSON_INVALID: ${file} (root must be a JSON object)`,
+            };
+        }
+        const record = parsed;
+        return { ok: true, value: { name: record.name, version: record.version } };
+    }
+    finally {
+        await handle.close().catch(() => { });
+    }
+}
+/**
+ * Owning npm package root for a resolved entry directory: the deepest
+ * ancestor BELOW the nearest node_modules directory (scoped:
+ * node_modules/@scope/<pkg>). Returns undefined when the entry is not inside
+ * any node_modules boundary — readOwnedPackageJson then degrades with
+ * PACKAGE_JSON_NOT_FOUND instead of walking to an ancestor manifest.
+ */
+function packageBoundaryRoot(startDir) {
+    let dir = startDir;
+    for (let depth = 0; depth < MAX_PACKAGE_JSON_WALK_DEPTH; depth += 1) {
+        if (path.basename(dir) === "node_modules") {
+            const segments = path
+                .relative(dir, startDir)
+                .split(path.sep)
+                .filter((segment) => segment.length > 0);
+            if (segments.length === 0)
+                return dir;
+            if (segments[0].startsWith("@") && segments.length >= 2) {
+                return path.join(dir, segments[0], segments[1]);
+            }
+            return path.join(dir, segments[0]);
+        }
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            return undefined;
+        dir = parent;
+    }
+    return undefined;
+}
+/**
+ * Walk UP from an owned resolved resource path (bounded, separator-normalized)
+ * to the NEAREST package.json within the owning npm package boundary and
+ * project its validated metadata. The walk NEVER crosses the package root
+ * (node_modules/<pkg> or node_modules/@scope/<pkg>): a missing manifest there
+ * yields PACKAGE_JSON_NOT_FOUND instead of mis-attributing an ancestor
+ * workspace manifest (AC-RF-3). Missing name/version fields yield per-field
+ * PACKAGE_JSON_FIELD_INVALID diagnostics and suppress the whole metadata trio
+ * (AC-RF-4). Corrupt / oversized / invalid-field reads stop at that nearest
+ * package.json with a per-package diagnostic. Empty paths never probe the
+ * filesystem.
+ */
+async function readOwnedPackageJson(entryPath) {
+    if (!entryPath)
+        return { ok: false, diagnostics: [] };
+    const normalized = entryPath.replace(/[\\/]+/g, path.sep);
+    const startDir = path.dirname(normalized);
+    const boundaryRoot = packageBoundaryRoot(startDir);
+    if (boundaryRoot === undefined) {
+        // No legal node_modules/<pkg> or node_modules/@scope/<pkg> boundary:
+        // never walk to (or accept) an ancestor manifest (AC-B1/AC-B2).
+        return {
+            ok: false,
+            diagnostics: [
+                `PACKAGE_JSON_NOT_FOUND: ${startDir} (resolved resource is not inside a legal node_modules package boundary)`,
+            ],
+        };
+    }
+    let dir = startDir;
+    for (let depth = 0; depth < MAX_PACKAGE_JSON_WALK_DEPTH; depth += 1) {
+        const file = path.join(dir, "package.json");
+        const read = await readPackageJsonBounded(file);
+        if (read.ok) {
+            const { name, version } = read.value;
+            const meta = { installedPath: dir };
+            const fieldDiagnostics = [];
+            if (name === undefined) {
+                fieldDiagnostics.push(`PACKAGE_JSON_FIELD_INVALID: ${file} (missing name)`);
+            }
+            else if (typeof name !== "string" ||
+                name.trim().length === 0 ||
+                name.length > 214) {
+                fieldDiagnostics.push(`PACKAGE_JSON_FIELD_INVALID: ${file} (name must be a non-empty string ≤ 214 chars)`);
+            }
+            else {
+                meta.packageName = name;
+            }
+            if (version === undefined) {
+                fieldDiagnostics.push(`PACKAGE_JSON_FIELD_INVALID: ${file} (missing version)`);
+            }
+            else if (typeof version !== "string" || !INSTALLED_VERSION.test(version)) {
+                // Type + format validation only: the browser projection (80-char limit)
+                // is the single truncation authority for versions (AC-8 reuse chain).
+                fieldDiagnostics.push(`PACKAGE_JSON_FIELD_INVALID: ${file} (version must be an exact semver string)`);
+            }
+            else {
+                meta.version = version;
+            }
+            if (name === undefined || version === undefined) {
+                // A manifest missing a required field cannot prove package ownership:
+                // none of packageName/version/installedPath is projected (AC-RF-4).
+                return { ok: false, diagnostics: fieldDiagnostics };
+            }
+            return {
+                ok: true,
+                meta,
+                ...(fieldDiagnostics.length > 0
+                    ? { diagnostics: fieldDiagnostics }
+                    : {}),
+            };
+        }
+        // Missing file (ENOENT): keep walking up the owned chain, but never past
+        // the owning package root. Any other read/parse failure means the nearest
+        // package.json IS the package boundary — degrade only this package and
+        // stop (AC-5).
+        if (read.missing !== true) {
+            return { ok: false, diagnostics: [read.diagnostic] };
+        }
+        if (boundaryRoot !== undefined && dir === boundaryRoot) {
+            return {
+                ok: false,
+                diagnostics: [
+                    `PACKAGE_JSON_NOT_FOUND: ${dir} (no package.json within the owning npm package boundary)`,
+                ],
+            };
+        }
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return {
+        ok: false,
+        diagnostics: [
+            `PACKAGE_JSON_NOT_FOUND: ${startDir} (no package.json on the resolved resource chain)`,
+        ],
+    };
 }
-export async function readPackageInventory(agentDir, repoRoot) {
+export async function readPackageInventory(agentDir, repoRoot, resolved) {
     const read = async (file) => {
         try {
             const parsed = JSON.parse(await readFile(file, "utf8"));
@@ -141,18 +332,45 @@ export async function readPackageInventory(agentDir, repoRoot) {
     };
     const global = await read(path.join(agentDir, "settings.json"));
     const project = await read(path.join(repoRoot, ".pi", "settings.json"));
-    return [
-        ...global.map((spec) => ({
-            spec,
-            scope: "global",
-            enabled: true,
-            resourceCount: 0,
-        })),
-        ...project.map((spec) => ({
+    const specs = [
+        ...global.map((spec) => ({ spec, scope: "global" })),
+        ...project.map((spec) => ({ spec, scope: "project" })),
+    ];
+    const entries = [];
+    for (const { spec, scope } of specs) {
+        // A resource belongs to this package when its source matches the spec
+        // exactly or ends with it (e.g. package subpath sources).
+        const owned = (resolved ?? []).filter((item) => item.source === spec || item.source.endsWith(`/${spec}`));
+        const diagnostics = owned
+            .map((item) => item.scope === "temporary" ? `temporary scope: ${item.path}` : "")
+            .filter(Boolean);
+        // No owned resources → no filesystem probing at all (AC-1): the optional
+        // metadata fields stay absent and only the always-projected cwd is added.
+        const meta = owned.length > 0 && owned[0]?.path
+            ? await readOwnedPackageJson(owned[0].path)
+            : { ok: true, meta: undefined, diagnostics: [] };
+        if (meta.diagnostics)
+            diagnostics.push(...meta.diagnostics);
+        entries.push({
             spec,
-            scope: "project",
+            scope,
             enabled: true,
-            resourceCount: 0,
-        })),
-    ];
+            cwd: repoRoot,
+            ...(versionFromSpec(spec)
+                ? { configuredVersion: versionFromSpec(spec) }
+                : {}),
+            ...(meta.ok && meta.meta?.packageName
+                ? { packageName: meta.meta.packageName }
+                : {}),
+            ...(meta.ok && meta.meta?.version ? { version: meta.meta.version } : {}),
+            ...(meta.ok && meta.meta?.installedPath
+                ? { installedPath: meta.meta.installedPath }
+                : {}),
+            ...(owned[0]?.path ? { path: owned[0].path } : {}),
+            resolved: owned,
+            resourceCount: owned.length,
+            diagnostics,
+        });
+    }
+    return entries;
 }