@tea-agent/loop-agent 0.33.5 → 0.33.6

package/dist/worker/console/chat/pi-runtime.js

@@ -9,60 +9,64 @@
  *   - Chat sessions are persisted to a DEDICATED sessionDir (not the user's
  *     default ~/.pi/agent/sessions). Naming prefix `operator-chat-` makes them
  *     auditable and cleanable (plan Q4 / Q8).
- *   - The ResourceLoader is configured to NOT auto-load user extensions/skills
- *     (noContextFiles / closed surface); credential/model plane is shared via
- *     the same agentDir auth.json/models.json.
+ *   - The ResourceLoader uses the SDK's standard OPEN surface (ADR 0012):
+ *     user/project AGENTS.md context files, user (~/.pi/agent/skills/) and
+ *     project (.agents/skills/ init projection) skills, and user/project
+ *     extensions all load via the SDK DefaultResourceLoader; credential/model
+ *     plane is shared via the same agentDir auth.json/models.json.
  *   - Active tools are pinned to the operator-chat surface at session create
  *     AND re-pinned before each prompt (three-gate, design §7.5 / ADR 0011):
  *     the FULL operator action set PLUS full Pi builtins
- *     (read/write/edit/bash/grep/find/ls) and optional safe-*. Non-Pi write
+ *     (read/write/edit/bash/grep/find/ls) and optional safe-*, PLUS extension
+ *     tools registered by user/project extensions (ADR 0012). Non-Pi write
  *     channels (apply_patch/full-tools/shell/coding-chat) stay excluded.
  *
  * The actual SDK calls are injected via `PiSdkBindings` so this module is
  * unit-testable without a live Pi install. Production bindings come from
  * `createDefaultPiSdkBindings()`.
  */
-import { randomBytes } from "node:crypto";
+import { createHash, randomBytes } from "node:crypto";
 import { access } from "node:fs/promises";
 import path from "node:path";
 import { projectCompactSnapshot, } from "./chat-event-store.js";
 import { extractUsageSample } from "./usage.js";
 import { OPERATOR_CHAT_ALLOWED_TOOLS, authorizeOperatorChatTool, assertNoWriteToolInList, } from "./tools.js";
 import { createOperatorChatResourceLoader, } from "./resource-loader.js";
-import { loadOperatorChatInstructionSkills, composeInstructionSkillsPrompt, OPERATOR_CHAT_ALLOWED_INSTRUCTION_SKILLS, } from "./instruction-skills.js";
 import { buildModelCallableToolSchemas } from "./tool-adapter.js";
 import { resolveDefaultChatModel, } from "./model-resolver.js";
 import { filterActiveInterviewTools } from "../interview/tools.js";
+import { RUNTIME_CONTEXT_TEXT_MAX, redactRuntimeText, } from "./runtime-context.js";
 /**
  * Base system prompt fragment every General Operator Chat session receives.
  *
- * Establishes the operator-vs-implementer role boundary (ADR 0005 D2) and the
- * current tool surface contract (2026-07-25 widening): the Chat exposes the
- * FULL operator action surface (all registry actions, including high-risk
- * mutations like contractApply / runDag / dagRerun) PLUS the built-in
- * read/explore tools (bash / read / grep / find / ls). The ONLY thing still
- * forbidden is direct file-WRITING via coding tools (edit / write /
- * apply_patch / full-tools / shell / coding-chat) — those are excluded from
- * the SDK registry entirely and can never be activated.
+ * 2026-08-11 (ADR 0013): this is a SHORT runtime responsibility layer only.
+ * Project governance (operator-only policy, allowedPaths/forbiddenPaths,
+ * writer writeSet, taskKind routing, verification matrix, DAG recovery
+ * commands, closeout) lives in the loaded target-project AGENTS.md. The
+ * prompt below covers: Operator identity, the real tool surface (operator_*
+ * first + Pi tools, obey AGENTS.md), denied non-Pi runtimes, safe-* probes,
+ * init/init-upgrade fallback for uninitialized repos, DAG supervision with
+ * 15/30/60s adaptive polling (operationGet/status/dagReport/dagDoctor), R2
+ * recovery (fresh eligible dagRerunPlan → dagRerun; ineligible → same-task
+ * rerun/advance, resume, Worker retry) and G2 bounded writeSet auto-approval.
  *
- * Instruction skills are appended AFTER this as read-only context (plan D1).
+ * The old Human Gate tutorial paragraphs (prepare + browser Human Gate,
+ * "confirmDagConfirmation is a human-only action", the long "Recovery default
+ * order" table) are REMOVED — bounded DAGs start and recover autonomously
+ * (AC-01: ≤ 1900 chars and ≤ 80% of the 2498-char baseline).
  */
 export const OPERATOR_CHAT_SYSTEM_PROMPT_BASE = [
     "You are the General Operator Chat for loop-agent / agent-worker.",
-    "You are an OPERATOR first: orchestrate and inspect via operator_* tools, and you also have full Pi repository tools (read, write, edit, bash, grep, find, ls) plus optional safe-read/safe-grep/git-status/git-diff.",
-    "Capability honesty (ADR 0011): read/write/edit/bash ARE available. Prefer governed loop-agent / Agent DAG paths (implement-pi / repair-pi) and Human Gate for large refactors, public contracts, credentials, or production-risk changes — treat direct write/edit/bash as soft-disciplined, not as a second DAG kernel.",
-    "safe-read / safe-grep enforce a repo-relative path boundary, a sensitive-file denylist (.env* / *.key / *.pem / .git/** / auth.json / sessions/**) and secret scrubbing. Prefer them for sensitive probes; avoid dumping secrets via raw read/bash.",
-    "You do NOT have apply_patch / full-tools / shell / coding-chat as alternate coding runtimes — those non-Pi channels stay denied.",
-    "High-risk mutations still use prepare + browser Human Gate. Prepare contract via interview then apply via contractApply, prepare DAG runs via prepareDagConfirmation, prepare other mutations via prepareMutationGate, then confirm in the browser Human Gate. When a high-risk action (contractApply / runDag / dagRerun / etc.) fails on missing prepared state, diagnose with status/doctor/dagReport/inspect/contractShow/read/safe-read/safe-grep.",
-    "You cannot self-confirm a DAG run: confirmDagConfirmation is a human-only action (executed by the browser with a server-signed confirmation token). You may only prepare it via prepareDagConfirmation; the user must confirm in the UI.",
-    "Prefer read-only diagnosis (status, doctor, dagReport, inspect, contractShow, read, safe-read, safe-grep, git-status) before mutating.",
-    "Recovery default order (save tokens/time; do NOT open a new task-id for provider flake): (1) dagReport/doctor/status — read primaryFailure.nodeId + primaryRecovery; (2) for completed failed|partial_failed standalone runs prefer dagRerunPlan then prepareMutationGate/dagRerun from the failed or safe upstream node (plan → planHash → human gate); (3) paused → approve path / resume, never treat resume as failure retry; (4) only when plan is ineligible (writer/decision/fingerprint) or contract/source truly changed: standaloneTaskRerun or same-task task advance — never invent a fresh task-id without cause; (5) Worker-owned failures use workerTaskRetry, not dagRerun. Never use direct write/edit as a substitute for repair-pi.",
+    "Operate through operator_* tools first. Pi read/write/edit/bash/grep/find/ls are available, but obey the loaded repository AGENTS.md. apply_patch, full-tools, shell, and coding-chat are denied alternate runtimes. Prefer safe-read/safe-grep for sensitive probes.",
+    "If a repository has no loop-agent harness and the user requests initialization, run `loop-agent init instructions --repo-root .` then `loop-agent init --repo-root . --profile full --merge`; finish the generated setup, init doctor, inspect, docs audit, and quick verification. For updates use `loop-agent init upgrade --repo-root . --json` until stable; use init check-update only for an explicitly read-only request.",
+    "After a DAG is started or accepted, do not end on accepted/queued/running or an operationId. Supervise it to a terminal outcome. Poll operationGet, task status, dagReport, and dagDoctor after about 15 seconds on start/change, every 30 seconds during progress, and every 60 seconds after 3 minutes unchanged. Report only meaningful node/rank changes, review/verify/closeout, recovery, liveness concerns, and terminal outcomes.",
+    "On failure read primaryFailure, primaryRecovery, and doctor evidence. If meaningful progress exists, wait. Otherwise use a fresh eligible dagRerunPlan and rerun its safe node; when ineligible follow AGENTS.md/runtime recovery for same-task rerun/advance, resume, or Worker retry. Auto-approve only a bounded writeSet inside allowedPaths, outside forbiddenPaths, without broad/destructive risk, and with structured verification.",
+    "Continue until success, user stop, or no safe eligible recovery remains because limits, bindings, auth/quota recovery, or required external authorization are exhausted. Never create a new task for a transient failure or replace repair-pi with direct edits.",
 ].join("\n");
 /** Compose the inspectable system prompt actually injected into Operator Chat. */
 export function composeOperatorChatSystemPrompt(input) {
     return [
         OPERATOR_CHAT_SYSTEM_PROMPT_BASE,
-        ...(input.skillFragment?.trim() ? [input.skillFragment.trim()] : []),
         ...(input.systemPromptSuffix?.trim()
             ? [input.systemPromptSuffix.trim()]
             : []),
@@ -102,6 +106,49 @@ export function OPERATOR_CHAT_ACTIVE_TOOL_NAMES() {
         ...OPERATOR_CHAT_SAFE_EXPLORE_TOOL_IDS,
     ];
 }
+/**
+ * Non-Pi write / coding channels that must never be activated in Operator
+ * Chat even when a user/project extension registers them (ADR 0011 / 0012).
+ * Mirrors the NON_PI_WRITE_CHANNELS guard in tools.ts for the Gate 2 pin.
+ */
+const OPERATOR_CHAT_EXTENSION_DENIED_TOOL_IDS = new Set([
+    "apply_patch",
+    "apply-patch",
+    "full-tools",
+    "full_tools",
+    "coding-chat",
+    "coding_chat",
+    "shell",
+].map((t) => t.toLowerCase()));
+/**
+ * Gate 2 active-tool set for a live session (ADR 0012): the operator-chat
+ * baseline (operator actions + Pi builtins + safe explore) PLUS extension
+ * tools registered by user/project extensions. SDK setActiveToolsByName is
+ * REPLACEMENT-style, so extension tools would be disabled by the fixed
+ * baseline; this helper re-adds every registry tool that is not part of the
+ * baseline and not on the deny surface (apply_patch/full-tools/shell/
+ * coding-chat). Unknown/denied names are never activated; Gate 3 still
+ * re-authorizes every tool call per invocation.
+ */
+export function computeOperatorChatActiveToolNames(session) {
+    const baseline = OPERATOR_CHAT_ACTIVE_TOOL_NAMES();
+    if (!session?.getAllTools)
+        return baseline;
+    const baselineLower = new Set(baseline.map((t) => t.toLowerCase()));
+    const extras = [];
+    for (const tool of session.getAllTools()) {
+        const name = tool?.name;
+        if (!name || typeof name !== "string")
+            continue;
+        const lower = name.toLowerCase();
+        if (baselineLower.has(lower))
+            continue;
+        if (OPERATOR_CHAT_EXTENSION_DENIED_TOOL_IDS.has(lower))
+            continue;
+        extras.push(name);
+    }
+    return extras.length > 0 ? [...baseline, ...extras] : baseline;
+}
 /**
  * Build Pi custom ToolDefinition objects for every whitelisted operator action.
  * Each tool's execute() routes into the operator action dispatcher (Gate 3).
@@ -382,6 +429,138 @@ export const THINKING_LEVELS = [
     "xhigh",
     "max",
 ];
+/**
+ * Structured critical-failure error for snapshot projection (RF-02). Model
+ * enumeration or system prompt projection failures throw this so consuming
+ * routes can return 503 PI_RUNTIME_UNAVAILABLE instead of a fake-empty 200.
+ * Partial ResourceLoader / package-inventory failures are NOT critical — they
+ * keep the 200 snapshot and surface as structured diagnostics instead.
+ */
+export class RuntimeSnapshotUnavailableError extends Error {
+    code = "PI_RUNTIME_UNAVAILABLE";
+    constructor(message) {
+        super(message);
+        this.name = "RuntimeSnapshotUnavailableError";
+    }
+}
+/**
+ * Browser-safe projection of a live runtime snapshot (design §2.2 / RF-03).
+ *
+ * Every browser-visible string runs the shared secret-scrub chain
+ * (scrubSecrets + ghp_/Bearer redaction via redactRuntimeText) and a fixed
+ * per-field length limit: 200 (names/spec/source/origin), 400 (paths/errors/
+ * diagnostic messages), 600 (skill descriptions), 80 (package versions);
+ * truncation uses the fixed `…[truncated N chars …]` marker. The server-only
+ * `raw` prompt and the RAW-based `sha256`/`characters` pass through untouched,
+ * and real empty lists stay empty.
+ *
+ * Pure + deterministic and exported so the route harness reuses the exact
+ * production implementation (same code path as getRuntimeSnapshot).
+ */
+export function projectRuntimeSnapshot(input) {
+    const field = (value, max) => value === undefined ? undefined : redactRuntimeText(value, max);
+    const projectSkill = (skill) => ({
+        name: field(skill.name, 200) ?? "",
+        description: field(skill.description, 600) ?? "",
+        path: field(skill.path, 400) ?? "",
+        ...(skill.baseDir ? { baseDir: field(skill.baseDir, 400) } : {}),
+        scope: skill.scope,
+        source: field(skill.source, 200) ?? "",
+        enabled: skill.enabled,
+        diagnostics: skill.diagnostics.map((diag) => field(diag, 400) ?? ""),
+    });
+    const projectExtension = (ext) => ({
+        name: field(ext.name, 200) ?? "",
+        path: field(ext.path, 400) ?? "",
+        ...(ext.resolvedPath
+            ? { resolvedPath: field(ext.resolvedPath, 400) }
+            : {}),
+        source: field(ext.source, 200) ?? "",
+        scope: ext.scope,
+        ...(ext.origin ? { origin: field(ext.origin, 200) } : {}),
+        enabled: ext.enabled,
+        ...(ext.error ? { error: field(ext.error, 400) } : {}),
+    });
+    const projectPackage = (pkg) => ({
+        spec: field(pkg.spec, 200) ?? "",
+        scope: pkg.scope,
+        enabled: pkg.enabled,
+        ...(pkg.version ? { version: field(pkg.version, 80) } : {}),
+        ...(pkg.configuredVersion
+            ? { configuredVersion: field(pkg.configuredVersion, 80) }
+            : {}),
+        ...(pkg.packageName ? { packageName: field(pkg.packageName, 200) } : {}),
+        ...(pkg.path ? { path: field(pkg.path, 400) } : {}),
+        ...(pkg.installedPath ? { installedPath: field(pkg.installedPath, 400) } : {}),
+        ...(pkg.cwd ? { cwd: field(pkg.cwd, 400) } : {}),
+        resolved: pkg.resolved.map((resource) => ({
+            type: resource.type,
+            name: field(resource.name, 200) ?? "",
+            path: field(resource.path, 400) ?? "",
+            source: field(resource.source, 200) ?? "",
+            scope: resource.scope,
+        })),
+        diagnostics: pkg.diagnostics.map((diag) => field(diag, 400) ?? ""),
+    });
+    const projectDiagnostic = (diag) => ({
+        type: diag.type,
+        ...(diag.code ? { code: diag.code } : {}),
+        message: field(diag.message, 400) ?? "",
+        ...(diag.path ? { path: field(diag.path, 400) } : {}),
+        ...(diag.retryable !== undefined
+            ? { retryable: diag.retryable }
+            : {}),
+    });
+    return {
+        sessionId: input.sessionId,
+        revision: input.revision,
+        loadedAt: input.loadedAt,
+        selection: {
+            ...(input.selection.model
+                ? {
+                    model: {
+                        provider: input.selection.model.provider,
+                        id: input.selection.model.id,
+                        ...(input.selection.model.name
+                            ? { name: field(input.selection.model.name, 200) }
+                            : {}),
+                    },
+                }
+                : {}),
+            thinkingSelection: input.selection.thinkingSelection,
+            ...(input.selection.effectiveThinkingLevel
+                ? { effectiveThinkingLevel: input.selection.effectiveThinkingLevel }
+                : {}),
+        },
+        models: input.models.map((model) => ({
+            provider: model.provider,
+            id: model.id,
+            ...(model.name ? { name: field(model.name, 200) } : {}),
+            ...(model.hasCredentials !== undefined
+                ? { hasCredentials: model.hasCredentials }
+                : {}),
+        })),
+        thinkingLevels: input.thinkingLevels.map((option) => ({ ...option })),
+        systemPrompt: {
+            ...(input.systemPrompt.raw !== undefined
+                ? { raw: input.systemPrompt.raw }
+                : {}),
+            text: redactRuntimeText(input.systemPrompt.text, RUNTIME_CONTEXT_TEXT_MAX),
+            sha256: input.systemPrompt.sha256,
+            characters: input.systemPrompt.characters,
+        },
+        activeTools: [...input.activeTools],
+        contextFiles: input.contextFiles.map((file) => ({
+            path: field(file.path, 400) ?? "",
+            characters: file.characters,
+        })),
+        skills: input.skills.map(projectSkill),
+        extensions: input.extensions.map(projectExtension),
+        packages: input.packages.map(projectPackage),
+        diagnostics: input.diagnostics.map(projectDiagnostic),
+        hasBash: input.hasBash,
+    };
+}
 /**
  * Extract the latest assistant text fragment from an SDK message object.
  * Tolerant of multiple message shapes the SDK emits.
@@ -433,9 +612,16 @@ export class ConsolePiRuntime {
     sessions = new Map();
     modelRuntimes = new Map();
     sessionManagers = new Map();
+    /** Per-session SDK service scope (resourceLoader / settingsManager) used by the live runtime snapshot. */
+    serviceScopes = new Map();
+    /** Snapshot revision: bumped on create / reopen / model / thinking / reload. */
+    revisions = new Map();
+    /** RF-01: per-session reload in-flight lock (concurrent second call → PI_SESSION_BUSY). */
+    reloadInFlight = new Set();
+    /** Composer thinking selection ("auto" = no explicit override). */
+    thinkingSelections = new Map();
     mainlineLeaves = new Map();
     bindings;
-    disabledInstructionSkills = new Set();
     constructor(options) {
         this.options = options;
         this.loader = createOperatorChatResourceLoader();
@@ -461,9 +647,6 @@ export class ConsolePiRuntime {
             })),
         };
     }
-    setDisabledInstructionSkills(names) {
-        this.disabledInstructionSkills = new Set(names);
-    }
     /** Operator action context used by custom-tool dispatchers (Gate 3). */
     get actionContext() {
         return this.options.actionContext;
@@ -497,22 +680,6 @@ export class ConsolePiRuntime {
             modelId: descriptor.modelId,
         };
     }
-    /**
-     * Load the operator-context instruction skills (plan D1) and compose the
-     * read-only methodology fragment for the Chat system prompt. Returns an
-     * empty string when no skills load (e.g. skills dir missing) so the
-     * session still boots — skills are context, not a hard dependency.
-     */
-    async composeSystemPromptSkills() {
-        try {
-            const result = await loadOperatorChatInstructionSkills(this.options.skillsDir, OPERATOR_CHAT_ALLOWED_INSTRUCTION_SKILLS.filter((name) => !this.disabledInstructionSkills.has(name)));
-            return composeInstructionSkillsPrompt(result.loaded);
-        }
-        catch (error) {
-            process.stderr.write(`[console] chat instruction-skills load failed: ${error instanceof Error ? error.message : String(error)}\n`);
-            return "";
-        }
-    }
     /** Create a new isolated Chat session pinned to the operator-chat tool set. */
     async createSession(init) {
         const sessionId = `operator-chat-${randomBytes(12).toString("hex")}`;
@@ -528,28 +695,18 @@ export class ConsolePiRuntime {
         }
         // Final fallback only when nothing resolved: let the SDK pick its default
         // (we do NOT hardcode a provider here).
-        // Load operator-context instruction skills (plan D1) and compose the
-        // read-only methodology fragment injected into the Chat system prompt.
-        // Skills are NEVER registered as executable tools (D1 hard rule).
-        const skillFragment = await this.composeSystemPromptSkills();
+        // Standard open resource surface (ADR 0012): the SDK DefaultResourceLoader
+        // loads user/project AGENTS.md context files, skills (~/.pi/agent/skills/
+        // + .agents/skills/ init projection) and user/project extensions. Only
+        // appendSystemPrompt carries the operator-chat system prompt.
         const appendSystemPrompt = [
             OPERATOR_CHAT_SYSTEM_PROMPT_BASE,
-            ...(skillFragment ? [skillFragment] : []),
             ...(init?.systemPromptSuffix ? [init.systemPromptSuffix] : []),
         ];
         const { services } = await this.bindings.createServices({
             cwd: this.options.cwd,
             agentDir,
             resourceLoaderOptions: {
-                // Closed surface: do not load user/project extensions, skills,
-                // AGENTS.md, context files. The Chat tool surface is fixed by
-                // the whitelist, not by filesystem discovery.
-                noContextFiles: true,
-                noSkills: true,
-                noExtensions: true,
-                // Inject the audited instruction skills as READ-ONLY context
-                // (plan D1). appendSystemPrompt is the SDK's documented entry
-                // point for adding system-prompt text without enabling tools.
                 appendSystemPrompt,
             },
         });
@@ -633,12 +790,19 @@ export class ConsolePiRuntime {
             ...(resolvedModel ? { model: resolvedModel } : {}),
         });
         // Gate 2: re-pin active tools (defensive — some SDK paths may seed
-        // defaults). Active set = all operator actions + built-in explore tools.
-        // File-writing tools are excluded above and thus cannot appear here.
-        session.setActiveToolsByName(OPERATOR_CHAT_ACTIVE_TOOL_NAMES());
+        // defaults). Active set = operator baseline + built-in explore tools +
+        // extension tools registered by user/project extensions (ADR 0012).
+        // Non-Pi write channels are excluded above and cannot appear here.
+        session.setActiveToolsByName(computeOperatorChatActiveToolNames(session));
         this.sessions.set(sessionId, session);
         this.sessionManagers.set(sessionId, sessionManager);
         this.modelRuntimes.set(sessionId, modelRuntime);
+        this.serviceScopes.set(sessionId, {
+            resourceLoader: services.resourceLoader,
+            settingsManager: services.settingsManager,
+        });
+        this.revisions.set(sessionId, 1);
+        this.thinkingSelections.set(sessionId, "auto");
         return {
             sessionId,
             sessionFile: session.sessionFile,
@@ -661,10 +825,13 @@ export class ConsolePiRuntime {
             sessionManager,
             model: init.model,
         });
-        built.session.setActiveToolsByName(OPERATOR_CHAT_ACTIVE_TOOL_NAMES());
+        built.session.setActiveToolsByName(computeOperatorChatActiveToolNames(built.session));
         this.sessions.set(sessionId, built.session);
         this.sessionManagers.set(sessionId, sessionManager);
         this.modelRuntimes.set(sessionId, built.modelRuntime);
+        this.serviceScopes.set(sessionId, built.services);
+        this.revisions.set(sessionId, 1);
+        this.thinkingSelections.set(sessionId, "auto");
         return {
             sessionId,
             sessionFile: built.session.sessionFile,
@@ -729,18 +896,31 @@ export class ConsolePiRuntime {
         if (!resolved)
             throw new Error("MODEL_NOT_AVAILABLE");
         await session.setModel(resolved);
+        this.bumpRevision(sessionId);
         return {
             provider: session.model?.provider ?? model.provider,
             modelId: session.model?.id ?? session.model?.modelId ?? model.modelId,
         };
     }
+    /**
+     * Apply a thinking-level selection. `auto` records the selection WITHOUT
+     * sending any explicit override (the SDK keeps its own default); an explicit
+     * level calls `session.setThinkingLevel`. Returns the effective value.
+     */
     applyThinkingLevel(sessionId, level) {
         const session = this.sessions.get(sessionId);
         if (!session)
             throw new Error(`chat session not active: ${sessionId}`);
+        if (level === "auto") {
+            this.thinkingSelections.set(sessionId, "auto");
+            this.bumpRevision(sessionId);
+            return "auto";
+        }
         if (!THINKING_LEVELS.includes(level) || !session.setThinkingLevel)
             throw new Error("THINKING_LEVEL_UNSUPPORTED");
         session.setThinkingLevel(level);
+        this.thinkingSelections.set(sessionId, level);
+        this.bumpRevision(sessionId);
         return session.thinkingLevel ?? level;
     }
     getRuntimeSelection(sessionId) {
@@ -757,6 +937,370 @@ export class ConsolePiRuntime {
             activeTools: session.getActiveToolNames(),
         };
     }
+    bumpRevision(sessionId) {
+        this.revisions.set(sessionId, (this.revisions.get(sessionId) ?? 0) + 1);
+    }
+    /**
+     * Resolve the RAW system prompt actually injected into the Pi session
+     * (design §2.2 / AC-03). Fallback chain: agent.state.systemPrompt →
+     * session.systemPrompt getter → ResourceLoader.getSystemPrompt() → the
+     * composed operator-chat base prompt. Never returns empty.
+     */
+    async getRuntimeSystemPrompt(sessionId) {
+        const session = this.sessions.get(sessionId);
+        if (!session)
+            return composeOperatorChatSystemPrompt({});
+        const fromState = session.state?.systemPrompt;
+        const fromGetter = session.systemPrompt;
+        const loader = this.serviceScopes.get(sessionId)?.resourceLoader;
+        return (fromState ||
+            fromGetter ||
+            loader?.getSystemPrompt?.() ||
+            composeOperatorChatSystemPrompt({}));
+    }
+    /**
+     * Read the RAW system prompt for the snapshot, converting any projection
+     * failure into the structured critical error (RF-02): a broken system prompt
+     * source must fail the whole snapshot with 503 PI_RUNTIME_UNAVAILABLE rather
+     * than silently fabricate prompt text.
+     */
+    async readRawSystemPrompt(sessionId) {
+        try {
+            return await this.getRuntimeSystemPrompt(sessionId);
+        }
+        catch (error) {
+            throw new RuntimeSnapshotUnavailableError(`system prompt projection failed: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    /**
+     * Official Pi session reload (AC-05 / AC-06). Rejects with a structured
+     * code while the session is busy (streaming / compacting / bash in flight /
+     * duplicate reload) — never aborts, never silently queues.
+     */
+    async reloadSession(sessionId) {
+        const session = this.sessions.get(sessionId);
+        if (!session) {
+            return {
+                ok: false,
+                code: "PI_SESSION_NOT_FOUND",
+                message: `chat session not active: ${sessionId}`,
+            };
+        }
+        // RF2-03: the per-sessionId in-flight lock is checked FIRST — before the
+        // streaming/compacting/bash/support checks. JS runs check-then-add in one
+        // synchronous segment, so two concurrent calls cannot both pass; the lock
+        // is released in `finally` on BOTH the success and the error path, and
+        // different sessions never block each other. Priority matters: the first
+        // reload() may synchronously flip isIdle/isCompacting/isBashRunning/
+        // hasPendingBashMessages to busy, and a second concurrent call must still
+        // report the reload-in-flight busy (not the streaming/compacting one).
+        if (this.reloadInFlight.has(sessionId)) {
+            return {
+                ok: false,
+                code: "PI_SESSION_BUSY",
+                message: "session is busy (reload in flight); reload rejected without abort",
+            };
+        }
+        const busyReasons = [];
+        if (session.isStreaming === true || session.isIdle === false)
+            busyReasons.push("streaming");
+        if (session.isCompacting === true)
+            busyReasons.push("compacting");
+        if (session.isBashRunning === true)
+            busyReasons.push("bash running");
+        if (session.hasPendingBashMessages === true)
+            busyReasons.push("bash messages pending");
+        if (busyReasons.length > 0) {
+            return {
+                ok: false,
+                code: "PI_SESSION_BUSY",
+                message: `session is busy (${busyReasons.join(", ")}); reload rejected without abort`,
+            };
+        }
+        if (typeof session.reload !== "function") {
+            return {
+                ok: false,
+                code: "PI_RELOAD_FAILED",
+                message: "this Pi runtime does not support session.reload()",
+            };
+        }
+        this.reloadInFlight.add(sessionId);
+        try {
+            await session.reload();
+        }
+        catch (error) {
+            return {
+                ok: false,
+                code: "PI_RELOAD_FAILED",
+                message: error instanceof Error ? error.message : String(error),
+            };
+        }
+        finally {
+            this.reloadInFlight.delete(sessionId);
+        }
+        this.bumpRevision(sessionId);
+        return { ok: true, revision: this.revisions.get(sessionId) ?? 0 };
+    }
+    /**
+     * Project the unified live runtime snapshot (design §2.2). The current Pi
+     * session is the single source of truth: real system prompt, real model /
+     * thinking selection (auto + effective), the session modelRuntime model
+     * list, and the session ResourceLoader inventories. Undefined when the
+     * session is not active — callers fail closed instead of fabricating data.
+     */
+    async getRuntimeSnapshot(sessionId, options) {
+        const session = this.sessions.get(sessionId);
+        if (!session)
+            return undefined;
+        const services = this.serviceScopes.get(sessionId);
+        const modelRuntime = this.modelRuntimes.get(sessionId);
+        const resourceLoader = services?.resourceLoader;
+        const settingsManager = services?.settingsManager;
+        const thinkingSelection = this.thinkingSelections.get(sessionId) ?? "auto";
+        const effectiveThinkingLevel = session.thinkingLevel ??
+            settingsManager?.getDefaultThinkingLevel?.() ??
+            (thinkingSelection === "auto" ? undefined : thinkingSelection);
+        const rawSystemPrompt = await this.readRawSystemPrompt(sessionId);
+        // Models come from the session modelRuntime. A model-enumeration failure
+        // is a CRITICAL projection failure (RF-02): it throws
+        // RuntimeSnapshotUnavailableError so consuming routes return 503
+        // PI_RUNTIME_UNAVAILABLE — never a fabricated empty model list.
+        let models = [];
+        if (modelRuntime) {
+            try {
+                models = this.bindings
+                    .listAvailableModels({ modelRuntime })
+                    .map((entry) => ({
+                    provider: entry.provider,
+                    id: entry.id,
+                    ...(entry.name ? { name: entry.name } : {}),
+                    hasCredentials: entry.hasCredentials,
+                }));
+            }
+            catch (error) {
+                throw new RuntimeSnapshotUnavailableError(`model enumeration failed: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
+        // Thinking options: auto is always offered; explicit levels only when the
+        // runtime session supports setThinkingLevel (xhigh/max ship with the SDK
+        // and therefore surface only when this runtime provides them).
+        const supportedLevels = typeof session.setThinkingLevel === "function"
+            ? [...THINKING_LEVELS]
+            : [];
+        const thinkingLevels = [
+            { value: "auto" },
+            ...supportedLevels.map((value) => ({ value })),
+        ];
+        // Resource inventories from the session ResourceLoader (ADR 0012 open
+        // surface). Missing loader → real empty lists, never fabricated entries.
+        // Each subface is isolated (RF-02): a throwing subface keeps the other
+        // inventories AND surfaces a structured retryable diagnostic instead of
+        // silently dropping the whole resource projection.
+        const contextFiles = [];
+        const skills = [];
+        const extensions = [];
+        const diagnostics = [];
+        let resolvedResources = [];
+        const resourceFailure = (subface, error) => {
+            diagnostics.push({
+                type: "error",
+                code: "RESOURCE_LOAD_FAILED",
+                message: `${subface} inventory failed: ${error instanceof Error ? error.message : String(error)}`,
+                retryable: true,
+            });
+        };
+        if (resourceLoader) {
+            try {
+                const agentsFiles = resourceLoader.getAgentsFiles?.();
+                for (const file of agentsFiles?.agentsFiles ?? []) {
+                    if (!file.path)
+                        continue;
+                    contextFiles.push({
+                        path: file.path,
+                        characters: file.content?.length ?? 0,
+                    });
+                }
+            }
+            catch (error) {
+                resourceFailure("context files", error);
+            }
+            try {
+                const skillsResult = resourceLoader.getSkills?.();
+                for (const skill of skillsResult?.skills ?? []) {
+                    skills.push({
+                        name: skill.name,
+                        description: skill.description ?? "",
+                        path: skill.filePath,
+                        ...(skill.baseDir ? { baseDir: skill.baseDir } : {}),
+                        scope: skill.sourceInfo?.scope ?? "unknown",
+                        source: skill.sourceInfo?.source ?? "",
+                        enabled: !skill.disableModelInvocation,
+                        diagnostics: [],
+                    });
+                    resolvedResources.push({
+                        type: "skill",
+                        name: skill.name,
+                        path: skill.filePath,
+                        source: skill.sourceInfo?.source ?? "",
+                        scope: skill.sourceInfo?.scope ?? "unknown",
+                    });
+                }
+                for (const diag of skillsResult?.diagnostics ?? []) {
+                    if (!diag?.message)
+                        continue;
+                    diagnostics.push({
+                        type: diag.type ?? "warning",
+                        message: diag.message,
+                        ...(diag.path ? { path: diag.path } : {}),
+                    });
+                }
+            }
+            catch (error) {
+                resourceFailure("skills", error);
+            }
+            try {
+                const extResult = resourceLoader.getExtensions?.();
+                for (const ext of extResult?.extensions ?? []) {
+                    const path = ext.resolvedPath ?? ext.path ?? "";
+                    extensions.push({
+                        name: ext.sourceInfo?.source ?? ext.path ?? "extension",
+                        path,
+                        ...(ext.resolvedPath ? { resolvedPath: ext.resolvedPath } : {}),
+                        source: ext.sourceInfo?.source ?? "",
+                        scope: ext.sourceInfo?.scope ?? "unknown",
+                        ...(ext.sourceInfo?.origin ? { origin: ext.sourceInfo.origin } : {}),
+                        enabled: true,
+                    });
+                    resolvedResources.push({
+                        type: "extension",
+                        name: ext.sourceInfo?.source ?? ext.path ?? "extension",
+                        path,
+                        source: ext.sourceInfo?.source ?? "",
+                        scope: ext.sourceInfo?.scope ?? "unknown",
+                    });
+                }
+                for (const err of extResult?.errors ?? []) {
+                    if (!err?.error)
+                        continue;
+                    diagnostics.push({
+                        type: "error",
+                        message: err.error,
+                        ...(err.path ? { path: err.path } : {}),
+                    });
+                }
+            }
+            catch (error) {
+                resourceFailure("extensions", error);
+            }
+            try {
+                const promptsResult = resourceLoader.getPrompts?.();
+                for (const prompt of promptsResult?.prompts ?? []) {
+                    resolvedResources.push({
+                        type: "prompt",
+                        name: prompt.name,
+                        path: prompt.filePath,
+                        source: prompt.sourceInfo?.source ?? "",
+                        scope: prompt.sourceInfo?.scope ?? "unknown",
+                    });
+                }
+                for (const diag of promptsResult?.diagnostics ?? []) {
+                    if (!diag?.message)
+                        continue;
+                    diagnostics.push({
+                        type: diag.type ?? "warning",
+                        message: diag.message,
+                        ...(diag.path ? { path: diag.path } : {}),
+                    });
+                }
+            }
+            catch (error) {
+                resourceFailure("prompts", error);
+            }
+            try {
+                const themesResult = resourceLoader.getThemes?.();
+                for (const theme of themesResult?.themes ?? []) {
+                    if (!theme.path)
+                        continue;
+                    resolvedResources.push({
+                        type: "theme",
+                        name: theme.name ?? theme.path,
+                        path: theme.path,
+                        source: "",
+                        scope: "unknown",
+                    });
+                }
+                for (const diag of themesResult?.diagnostics ?? []) {
+                    if (!diag?.message)
+                        continue;
+                    diagnostics.push({
+                        type: diag.type ?? "warning",
+                        message: diag.message,
+                        ...(diag.path ? { path: diag.path } : {}),
+                    });
+                }
+            }
+            catch (error) {
+                resourceFailure("themes", error);
+            }
+        }
+        // Packages: Pi settings specs + resolved resource metadata. Fields the SDK
+        // does not expose stay absent (real missing, never fabricated). A
+        // readPackageInventory failure is a PARTIAL failure (RF-02): the snapshot
+        // stays 200 with a structured retryable diagnostic — never a silent
+        // fake-empty package list.
+        const { readPackageInventory } = await import("./pi-console-config.js");
+        let packages = [];
+        try {
+            packages = (await readPackageInventory(await safeGetAgentDir(this.bindings), this.options.cwd, resolvedResources));
+        }
+        catch (error) {
+            packages = [];
+            diagnostics.push({
+                type: "error",
+                code: "PACKAGE_INVENTORY_FAILED",
+                message: error instanceof Error ? error.message : String(error),
+                retryable: true,
+            });
+        }
+        return projectRuntimeSnapshot({
+            sessionId,
+            revision: this.revisions.get(sessionId) ?? 0,
+            loadedAt: new Date().toISOString(),
+            selection: {
+                ...(session.model?.provider &&
+                    (session.model?.id ?? session.model?.modelId)
+                    ? {
+                        model: {
+                            provider: session.model.provider,
+                            id: session.model.id ?? session.model.modelId,
+                            ...(session.model.name ? { name: session.model.name } : {}),
+                        },
+                    }
+                    : {}),
+                thinkingSelection,
+                ...(effectiveThinkingLevel
+                    ? { effectiveThinkingLevel: effectiveThinkingLevel }
+                    : {}),
+            },
+            models,
+            thinkingLevels,
+            systemPrompt: {
+                ...(options?.includeRaw ? { raw: rawSystemPrompt } : {}),
+                // The RAW prompt flows into the projection: text is scrubbed +
+                // length-limited while sha256/characters stay RAW-based (design §2.2).
+                text: rawSystemPrompt,
+                sha256: createHash("sha256").update(rawSystemPrompt).digest("hex"),
+                characters: rawSystemPrompt.length,
+            },
+            activeTools: session.getActiveToolNames(),
+            contextFiles,
+            skills,
+            extensions,
+            packages,
+            diagnostics,
+            hasBash: true,
+        });
+    }
     /**
      * Re-open a previously persisted Chat session after Console restart or
      * browser refresh (roadmap M1-S04 / S05).
@@ -838,10 +1382,13 @@ export class ConsolePiRuntime {
                     message: `reopened Pi sessionId mismatch: expected ${sessionId}, got ${reportedId}`,
                 };
             }
-            session.setActiveToolsByName(OPERATOR_CHAT_ACTIVE_TOOL_NAMES());
+            session.setActiveToolsByName(computeOperatorChatActiveToolNames(session));
             this.sessions.set(sessionId, session);
             this.sessionManagers.set(sessionId, sessionManager);
             this.modelRuntimes.set(sessionId, built.modelRuntime);
+            this.serviceScopes.set(sessionId, built.services);
+            this.revisions.set(sessionId, 1);
+            this.thinkingSelections.set(sessionId, "auto");
             return {
                 ok: true,
                 handle: {
@@ -880,19 +1427,14 @@ export class ConsolePiRuntime {
      */
     async buildSessionWithServices(init) {
         const agentDir = await safeGetAgentDir(this.bindings);
-        const skillFragment = await this.composeSystemPromptSkills();
         const appendSystemPrompt = [
             OPERATOR_CHAT_SYSTEM_PROMPT_BASE,
-            ...(skillFragment ? [skillFragment] : []),
             ...(init.systemPromptSuffix ? [init.systemPromptSuffix] : []),
         ];
         const { services } = await this.bindings.createServices({
             cwd: this.options.cwd,
             agentDir,
             resourceLoaderOptions: {
-                noContextFiles: true,
-                noSkills: true,
-                noExtensions: true,
                 appendSystemPrompt,
             },
         });
@@ -942,7 +1484,14 @@ export class ConsolePiRuntime {
             ...(customTools && customTools.length > 0 ? { customTools } : {}),
             ...(resolvedModel ? { model: resolvedModel } : {}),
         });
-        return { session, modelRuntime };
+        return {
+            session,
+            modelRuntime,
+            services: {
+                resourceLoader: services.resourceLoader,
+                settingsManager: services.settingsManager,
+            },
+        };
     }
     /** Re-open a previously created session (cross-request). */
     open(sessionId) {
@@ -963,11 +1512,12 @@ export class ConsolePiRuntime {
         }
         // Gate 2 (re-pin before each turn): interview turns pass through the
         // existing closed interview allow/deny registry. The next ordinary turn
-        // explicitly restores the normal Operator Chat set.
+        // explicitly restores the normal Operator Chat set (baseline + extension
+        // tools, ADR 0012).
         const requestedTools = OPERATOR_CHAT_ACTIVE_TOOL_NAMES();
         const activeTools = options?.mode === "requirement-interview"
             ? filterActiveInterviewTools(requestedTools).allowed
-            : requestedTools;
+            : computeOperatorChatActiveToolNames(session);
         session.setActiveToolsByName(activeTools);
         const unsub = session.subscribe((event) => {
             const mapped = mapSdkEvent(sessionId, event);
@@ -1049,6 +1599,10 @@ export class ConsolePiRuntime {
             this.sessionManagers.delete(sessionId);
             this.mainlineLeaves.delete(sessionId);
             this.modelRuntimes.delete(sessionId);
+            this.serviceScopes.delete(sessionId);
+            this.revisions.delete(sessionId);
+            this.thinkingSelections.delete(sessionId);
+            this.reloadInFlight.delete(sessionId);
         }
     }
     disposeAll() {