@tea-agent/loop-agent 0.33.6 → 0.33.7-beta.1

package/dist/worker/console/chat/chat-event-store.js

@@ -169,69 +169,7 @@ export function projectOperationEventSummary(event) {
             .digest("hex"),
     };
 }
-/** Conservative per-event byte contribution (compact JSON length × UTF-8/pretty scale). */
-function byteHint(value) {
-    return JSON.stringify(value).length * BYTE_GATE_SCALE;
-}
-function recomputeApproxBytes(ring) {
-    let total = BYTE_GATE_SLACK;
-    for (const event of ring.events)
-        total += byteHint(event);
-    for (const turn of ring.turns)
-        total += byteHint(turn);
-    ring.approxBytes = total;
-}
-/**
- * D3 eviction priority: drop the single oldest candidate — text updates
- * (`message_update`) first, structural events second, and `message_end` (the
- * terminal full-text event) absolutely last. Falls back to the oldest event
- * (legacy `shift()` order) when only `message_end` remain.
- */
-function dropOneByPriority(ring) {
-    const events = ring.events;
-    if (events.length === 0)
-        return undefined;
-    const textIndex = events.findIndex((event) => event.kind === "message_update");
-    if (textIndex !== -1)
-        return events.splice(textIndex, 1)[0];
-    const structuralIndex = events.findIndex((event) => event.kind !== "message_end");
-    if (structuralIndex !== -1)
-        return events.splice(structuralIndex, 1)[0];
-    return events.shift();
-}
-/**
- * D2 coalescing decision: merge an incoming `message_update` into the ring tail
- * only when the tail is also a same-turn `message_update` and the update landed
- * inside the coalescing window. Structural events close the window implicitly
- * (their presence makes the tail check fail), so an
- * update → tool_call → update sequence never merges across the tool boundary.
- * `partial.at` (when present) drives the clock so tests can inject window
- * boundaries deterministically without fake timers.
- */
-function shouldCoalesce(ring, turnId, partial) {
-    if (partial.kind !== "message_update")
-        return false;
-    const tail = ring.events.at(-1);
-    if (!tail || tail.kind !== "message_update")
-        return false;
-    if (tail.turnId !== turnId)
-        return false;
-    const nowMs = partial.at ? Date.parse(partial.at) : Date.now();
-    if (Number.isNaN(nowMs))
-        return false;
-    return nowMs - Date.parse(tail.at) <= ring.coalesceWindowMs;
-}
 const DEFAULT_MAX_EVENTS = 2000;
-/** Mirrors pi-web's bounded-ring orientation (2000 events / 10 MiB). */
-const DEFAULT_MAX_BYTES = 10 * 1024 * 1024;
-/** Same-turn `message_update` events inside this window coalesce into one persisted event. */
-const DEFAULT_COALESCE_WINDOW_MS = 100;
-/** Conservative per-event scale for the byte pre-check gate (UTF-8 multibyte ≤ 4 bytes/char × pretty-print expansion). */
-const BYTE_GATE_SCALE = 12;
-/** Fixed envelope slack (schema keys, turnCount, nextSeq, minSeq, turns) for the byte pre-check gate. */
-const BYTE_GATE_SLACK = 8192;
-/** Legacy epoch for event files written before M5.1 (no epoch field). */
-const LEGACY_EPOCH = "legacy";
 /** Make a sessionId safe to use as a filename component. */
 function safeSessionId(sessionId) {
     return sessionId.replace(/[^a-zA-Z0-9._-]+/g, "_").slice(0, 180);
@@ -354,9 +292,6 @@ export function createChatOperationLinker(options) {
 }
 export function createChatEventStore(options) {
     const maxEvents = options?.maxEventsPerSession ?? DEFAULT_MAX_EVENTS;
-    const maxBytes = options?.maxBytesPerSession ?? DEFAULT_MAX_BYTES;
-    const coalesceWindowMs = options?.coalesceWindowMs ?? DEFAULT_COALESCE_WINDOW_MS;
-    const eventEpoch = options?.epoch?.trim() || LEGACY_EPOCH;
     const persistenceDir = options?.appData?.chatEvents
         ? path.resolve(options.appData.chatEvents)
         : undefined;
@@ -372,12 +307,6 @@ export function createChatEventStore(options) {
             ? path.join(persistenceDir, `${safeSessionId(sessionId)}.json`)
             : undefined;
     }
-    function eventIdFor(sessionId, seq) {
-        // Preserve the pre-M5.1 test/file surface for stores that did not opt in.
-        return eventEpoch === LEGACY_EPOCH
-            ? `${sessionId}:${seq}`
-            : `${eventEpoch}:${seq}`;
-    }
     function loadRing(sessionId) {
         const file = persistedPath(sessionId);
         if (!file || !existsSync(file))
@@ -389,41 +318,26 @@ export function createChatEventStore(options) {
                 !Array.isArray(parsed.events)) {
                 throw new Error("invalid persisted chat event ring");
             }
-            // Persisted events are derived recovery facts. On a new Console boot we
-            // deliberately remap their ids into this store's generation namespace;
-            // clients with an old epoch then reconcile rather than cross generations.
-            const events = parsed.events
-                .slice(-maxEvents)
-                .map((event) => ({
-                ...event,
-                eventId: eventIdFor(sessionId, event.seq),
-            }));
+            const events = parsed.events.slice(-maxEvents);
             const turns = Array.isArray(parsed.turns) ? parsed.turns : [];
             turnCounts.set(sessionId, parsed.turnCount ?? 0);
-            const ring = {
+            return {
                 events,
                 turns,
                 nextSeq: Math.max(parsed.nextSeq, (events[events.length - 1]?.seq ?? 0) + 1),
                 minSeq: events[0]?.seq ?? parsed.minSeq ?? 1,
                 maxEvents,
-                maxBytes,
-                coalesceWindowMs,
-                approxBytes: 0,
-                epoch: eventEpoch,
             };
-            recomputeApproxBytes(ring);
-            // R6: re-check the bounds after a restart — a persisted file may exceed the
-            // current limits if it was written by an older config or hand-edited.
-            enforceBounds(sessionId, ring);
-            return ring;
         }
         catch (error) {
             throw new Error(`invalid persisted chat events ${file}: ${error instanceof Error ? error.message : String(error)}`);
         }
     }
-    /** The exact payload written to disk (single source of truth for D4 byte accounting). */
-    function ringPayload(sessionId, ring) {
-        return {
+    function persist(sessionId, ring) {
+        const file = persistedPath(sessionId);
+        if (!file)
+            return;
+        writeSecureJsonSync(file, {
             schemaVersion: 1,
             sessionId,
             turnCount: turnCounts.get(sessionId) ?? 0,
@@ -431,48 +345,7 @@ export function createChatEventStore(options) {
             events: ring.events,
             nextSeq: ring.nextSeq,
             minSeq: ring.minSeq,
-            epoch: ring.epoch,
-        };
-    }
-    /** Serialized exactly as `writeSecureJsonSync` writes it, so byte accounting
-     *  (D4) and the on-disk bytes use the same formatting. */
-    function serializeRingForPersist(sessionId, ring) {
-        return `${JSON.stringify(ringPayload(sessionId, ring), null, 2)}\n`;
-    }
-    function bytesOfRing(sessionId, ring) {
-        return Buffer.byteLength(serializeRingForPersist(sessionId, ring), "utf8");
-    }
-    /**
-     * Enforce the `maxEvents + maxBytes` dual bound (D3/D4). maxEvents first
-     * (count), then bytes against the real serialized payload; every drop removes
-     * the oldest eviction candidate by priority. The byte loop is bounded because
-     * each iteration removes an event and stops on an empty ring. A conservative
-     * pre-check skips the exact serialization for small rings (keeps the frequent
-     * per-token append path O(1)-ish).
-     */
-    function enforceBounds(sessionId, ring) {
-        while (ring.events.length > ring.maxEvents) {
-            const dropped = dropOneByPriority(ring);
-            if (dropped)
-                ring.approxBytes -= byteHint(dropped);
-        }
-        if (ring.events.length > 0 && ring.approxBytes > ring.maxBytes) {
-            while (ring.events.length > 0 &&
-                bytesOfRing(sessionId, ring) > ring.maxBytes) {
-                const dropped = dropOneByPriority(ring);
-                if (dropped)
-                    ring.approxBytes -= byteHint(dropped);
-            }
-        }
-        if (ring.events.length > 0) {
-            ring.minSeq = ring.events[0].seq;
-        }
-    }
-    function persist(sessionId, ring) {
-        const file = persistedPath(sessionId);
-        if (!file)
-            return;
-        writeSecureJsonSync(file, ringPayload(sessionId, ring));
+        });
     }
     function ringFor(sessionId) {
         let ring = rings.get(sessionId);
@@ -483,10 +356,6 @@ export function createChatEventStore(options) {
                 nextSeq: 1,
                 minSeq: 1,
                 maxEvents,
-                maxBytes,
-                coalesceWindowMs,
-                approxBytes: BYTE_GATE_SLACK,
-                epoch: eventEpoch,
             };
             rings.set(sessionId, ring);
         }
@@ -538,7 +407,6 @@ export function createChatEventStore(options) {
                 createdAt: now,
             };
             ring.turns.push(turn);
-            ring.approxBytes += byteHint(turn);
             persist(sessionId, ring);
             return { ok: true, turn };
         },
@@ -548,7 +416,6 @@ export function createChatEventStore(options) {
             if (!turn)
                 return undefined;
             turn.state = state;
-            const before = JSON.stringify(turn).length;
             if (state === "running" && !turn.startedAt)
                 turn.startedAt = new Date().toISOString();
             if (state === "settled" || state === "aborted" || state === "failed") {
@@ -556,8 +423,6 @@ export function createChatEventStore(options) {
             }
             if (error)
                 turn.error = error;
-            ring.approxBytes +=
-                (JSON.stringify(turn).length - before) * BYTE_GATE_SCALE;
             persist(sessionId, ring);
             return { ...turn };
         },
@@ -578,79 +443,49 @@ export function createChatEventStore(options) {
         },
         append(sessionId, turnId, partial) {
             const ring = ringFor(sessionId);
-            // D1: every append (coalesced or not) consumes a fresh live seq so the
-            // live stream stays fully dense (AC-006); the persisted ring may collapse
-            // text updates, but nextSeq is always persisted alongside it so a restart
-            // never re-issues a seq a live client already saw.
             const seq = ring.nextSeq++;
-            const at = partial.at ?? new Date().toISOString();
-            const live = {
+            const event = {
                 schemaVersion: 1,
-                eventId: eventIdFor(sessionId, seq),
+                eventId: `${sessionId}:${seq}`,
                 sessionId,
                 seq,
                 turnId,
-                at,
+                at: partial.at ?? new Date().toISOString(),
                 kind: partial.kind,
                 data: partial.data,
             };
-            if (shouldCoalesce(ring, turnId, partial)) {
-                // AC-001: same-turn in-window text update replaces the persisted tail in
-                // place (keeping its original seq/eventId/turnId); only the text and `at`
-                // slide forward. The fresh live event is still returned/broadcast below.
-                const tail = ring.events.at(-1);
-                const before = JSON.stringify(tail).length;
-                tail.data = live.data;
-                tail.at = live.at;
-                ring.approxBytes +=
-                    (JSON.stringify(tail).length - before) * BYTE_GATE_SCALE;
+            ring.events.push(event);
+            while (ring.events.length > ring.maxEvents) {
+                const dropped = ring.events.shift();
+                if (dropped)
+                    ring.minSeq = dropped.seq + 1;
             }
-            else {
-                ring.events.push(live);
-                ring.approxBytes += byteHint(live);
+            if (ring.events.length > 0) {
+                ring.minSeq = ring.events[0].seq;
             }
-            enforceBounds(sessionId, ring);
             persist(sessionId, ring);
             const subs = subscribers.get(sessionId);
             if (subs) {
                 for (const fn of subs) {
                     try {
-                        fn(live);
+                        fn(event);
                     }
                     catch {
                         // a subscriber throwing must never break the append path
                     }
                 }
             }
-            return live;
+            return event;
         },
-        listFrom(sessionId, cursor) {
+        listFrom(sessionId, afterSeq) {
             const ring = rings.get(sessionId) ?? loadRing(sessionId);
             if (!ring)
-                return { events: [], epoch: eventEpoch };
+                return { events: [] };
             rings.set(sessionId, ring);
-            const normalized = typeof cursor === "number" ? { seq: cursor, epoch: null } : cursor;
-            if (normalized.epoch && normalized.epoch !== ring.epoch) {
-                return {
-                    error: "CURSOR_EPOCH_MISMATCH",
-                    minSeq: ring.minSeq,
-                    epoch: ring.epoch,
-                };
+            if (ring.events.length > 0 && afterSeq + 1 < ring.minSeq) {
+                return { error: "CURSOR_EXPIRED", minSeq: ring.minSeq };
             }
-            if (ring.events.length > 0 && normalized.seq + 1 < ring.minSeq) {
-                return {
-                    error: "CURSOR_EXPIRED",
-                    minSeq: ring.minSeq,
-                    epoch: ring.epoch,
-                };
-            }
-            return {
-                events: ring.events.filter((event) => event.seq > normalized.seq),
-                epoch: ring.epoch,
-            };
-        },
-        epoch(sessionId) {
-            return ringFor(sessionId).epoch;
+            return { events: ring.events.filter((e) => e.seq > afterSeq) };
         },
         snapshot(sessionId) {
             const ring = rings.get(sessionId) ?? loadRing(sessionId);

package/dist/worker/console/chat/instruction-skills.js

@@ -0,0 +1,217 @@
+/**
+ * Operator Chat — instruction skills whitelist (design §7.5 / plan D1).
+ *
+ * Hard rules (plan D1):
+ * - skills are READ-ONLY text context injected into the Chat system prompt;
+ * - skills are NEVER registered as executable tools;
+ * - the whitelist is a COMPILE-TIME constant (no runtime dir scan, no env override);
+ * - arbitrary pi extension / package tool / user-level ~/.pi/agent skill is
+ *   never discovered or loaded (V12);
+ * - project `.agents/skills/` (init projection) is NOT injected (prevents
+ *   target-repo injecting write instructions).
+ *
+ * Only the loop-agent repo's own audited skills are eligible. Workflow-specific
+ * skills are conditional on taskKind/workflow and loaded on demand (not in MVP
+ * operator-context default set).
+ */
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+/**
+ * Operator-context instruction skills (plan D1, "operator-context 允许").
+ * These are read-only methodology skills. Loaded as text context for every
+ * Chat session by default.
+ *
+ * MUST stay a compile-time constant. Adding a skill requires an ADR / plan note.
+ */
+export const OPERATOR_CHAT_ALLOWED_INSTRUCTION_SKILLS = Object.freeze([
+    "grill-me",
+    "systematic-debugging",
+    "code-review-core",
+    "codebase-scout",
+    "verification-before-completion",
+    "requesting-code-review",
+    "analyze-product-requirements",
+    "analyze-product-dependencies",
+    "using-git-worktrees",
+]);
+/**
+ * Meta / governance skills that must NEVER be injected into Chat context
+ * (plan D1 "元 / 治理 skill"). Injecting these would let Chat rewrite its own
+ * governance. Listed explicitly so accidental allowlist edits are caught.
+ */
+export const OPERATOR_CHAT_DENIED_INSTRUCTION_SKILLS = Object.freeze([
+    "loop-agent",
+    "agent-worker",
+    "init-capability-evolution",
+    "ai-engineering-context",
+    "grill-with-docs",
+]);
+/**
+ * Workflow-specific skills (plan D1 "workflow-specific 允许（条件）").
+ * Only injected when the corresponding taskKind / workflow is active.
+ * NOT loaded by default in MVP Chat.
+ */
+export const OPERATOR_CHAT_WORKFLOW_CONDITIONAL_SKILLS = Object.freeze([
+    "frontend-implementation",
+    "frontend-review",
+    "frontend-verification",
+    "frontend-design-review",
+    "test-driven-development",
+    "webapp-testing",
+    "playwright-cli",
+    "playwright-cli-case-generator",
+    "browser-tools",
+]);
+const ALLOWED = new Set(OPERATOR_CHAT_ALLOWED_INSTRUCTION_SKILLS.map((s) => s.toLowerCase()));
+const DENIED = new Set(OPERATOR_CHAT_DENIED_INSTRUCTION_SKILLS.map((s) => s.toLowerCase()));
+const CONDITIONAL = new Set(OPERATOR_CHAT_WORKFLOW_CONDITIONAL_SKILLS.map((s) => s.toLowerCase()));
+export function isOperatorChatInstructionSkillAllowed(name) {
+    return ALLOWED.has(name.trim().toLowerCase());
+}
+export function isOperatorChatInstructionSkillDenied(name) {
+    return DENIED.has(name.trim().toLowerCase());
+}
+export function isOperatorChatInstructionSkillConditional(name) {
+    return CONDITIONAL.has(name.trim().toLowerCase());
+}
+export function classifyInstructionSkill(name, options) {
+    const n = name.trim().toLowerCase();
+    if (DENIED.has(n)) {
+        return { ok: false, reason: "denied-governance", name };
+    }
+    if (ALLOWED.has(n)) {
+        return { ok: true, kind: "operator-context", name };
+    }
+    if (CONDITIONAL.has(n)) {
+        const active = options?.activeWorkflowSkills ?? [];
+        const activeLower = new Set(active.map((s) => s.toLowerCase()));
+        if (activeLower.has(n)) {
+            // Conditional skill is allowed only when explicitly activated by workflow.
+            // For MVP, conditional skills are not auto-injected; callers must opt in.
+            return { ok: false, reason: "conditional-not-active", name };
+        }
+        return { ok: false, reason: "conditional-not-active", name };
+    }
+    return { ok: false, reason: "unknown", name };
+}
+/**
+ * Parse a SKILL.md frontmatter description (first `description:` line) and
+ * return the body text (frontmatter stripped). Tolerant of missing frontmatter.
+ */
+export function parseSkillFrontmatter(raw) {
+    let description = "";
+    let bodyText = raw;
+    const hasFrontmatter = raw.trimStart().startsWith("---");
+    if (hasFrontmatter) {
+        const lines = raw.split(/\r?\n/);
+        // find closing ---
+        let closeIdx = -1;
+        for (let i = 1; i < lines.length; i++) {
+            if (lines[i].trim() === "---") {
+                closeIdx = i;
+                break;
+            }
+        }
+        if (closeIdx > 0) {
+            const fm = lines.slice(1, closeIdx).join("\n");
+            bodyText = lines.slice(closeIdx + 1).join("\n").trim();
+            const descMatch = fm.match(/^description:\s*(.+)$/m);
+            if (descMatch) {
+                description = descMatch[1].trim().replace(/^["']|["']$/g, "");
+            }
+        }
+    }
+    else {
+        bodyText = raw.trim();
+    }
+    return { description, bodyText };
+}
+/**
+ * Load the operator-context instruction skills from the loop-agent repo's own
+ * `skills/` directory and return their text bodies for system-prompt injection.
+ *
+ * Security: only names in OPERATOR_CHAT_ALLOWED_INSTRUCTION_SKILLS are read;
+ * any other path is rejected before filesystem access (safe-side).
+ *
+ * @param skillsDir absolute path to the loop-agent repo `skills/` directory
+ *                  (source repo / npm pack asset, NOT target project `.agents/skills/`).
+ * @param names     override list (tests); defaults to the full allowlist.
+ */
+export async function loadOperatorChatInstructionSkills(skillsDir, names) {
+    const selected = names ?? OPERATOR_CHAT_ALLOWED_INSTRUCTION_SKILLS;
+    const loaded = [];
+    const failures = [];
+    const skipped = [];
+    for (const rawName of selected) {
+        const name = rawName.trim();
+        if (!isOperatorChatInstructionSkillAllowed(name)) {
+            skipped.push(name);
+            continue;
+        }
+        // Defense in depth: reject path traversal / governance skills even if
+        // an attacker managed to mutate the allowlist at runtime.
+        if (isOperatorChatInstructionSkillDenied(name)) {
+            skipped.push(name);
+            continue;
+        }
+        const skillPath = path.join(skillsDir, name, "SKILL.md");
+        const resolved = path.resolve(skillPath);
+        const resolvedSkillsDir = path.resolve(skillsDir);
+        if (!resolved.startsWith(resolvedSkillsDir + path.sep)) {
+            failures.push({
+                name,
+                message: "path escapes skills directory",
+            });
+            continue;
+        }
+        try {
+            const raw = await readFile(resolved, "utf8");
+            const { description, bodyText } = parseSkillFrontmatter(raw);
+            loaded.push({
+                name,
+                description,
+                bodyText,
+                charCount: bodyText.length,
+            });
+        }
+        catch (error) {
+            failures.push({
+                name,
+                message: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+    return { loaded, failures, skipped };
+}
+/** Hard cap on total injected instruction-skill chars (token budget guard). */
+export const OPERATOR_CHAT_INSTRUCTION_CHAR_BUDGET = 24_000;
+/**
+ * Compose the system-prompt fragment listing loaded instruction skills.
+ * Each skill is rendered as a bounded text block. If total chars exceed the
+ * budget, later skills are truncated (operator-context set is small enough
+ * that truncation should not trigger in practice, but the cap is enforced).
+ */
+export function composeInstructionSkillsPrompt(skills, budget = OPERATOR_CHAT_INSTRUCTION_CHAR_BUDGET) {
+    if (skills.length === 0)
+        return "";
+    const lines = [
+        "## Operator methodology context (read-only instruction skills)",
+        "",
+        "These skills are READ-ONLY context. You may reference their methodology when reasoning, but you CANNOT execute them. All actions must go through the registered operator tools.",
+        "",
+    ];
+    let used = 0;
+    for (const skill of skills) {
+        const header = `\n### ${skill.name}${skill.description ? ` — ${skill.description}` : ""}\n`;
+        const remaining = budget - used - header.length;
+        if (remaining <= 0) {
+            lines.push(`_[${skill.name}: omitted, char budget exhausted]_`);
+            break;
+        }
+        const slice = skill.bodyText.slice(0, Math.max(0, remaining));
+        lines.push(header);
+        lines.push(slice);
+        used += header.length + slice.length;
+    }
+    return lines.join("\n");
+}