@tea-agent/loop-agent 0.33.6 → 0.33.7-beta.1

package/dist/worker/console/chat/pi-runtime.js

@@ -9,64 +9,60 @@
  *   - Chat sessions are persisted to a DEDICATED sessionDir (not the user's
  *     default ~/.pi/agent/sessions). Naming prefix `operator-chat-` makes them
  *     auditable and cleanable (plan Q4 / Q8).
- *   - The ResourceLoader uses the SDK's standard OPEN surface (ADR 0012):
- *     user/project AGENTS.md context files, user (~/.pi/agent/skills/) and
- *     project (.agents/skills/ init projection) skills, and user/project
- *     extensions all load via the SDK DefaultResourceLoader; credential/model
- *     plane is shared via the same agentDir auth.json/models.json.
+ *   - The ResourceLoader is configured to NOT auto-load user extensions/skills
+ *     (noContextFiles / closed surface); credential/model plane is shared via
+ *     the same agentDir auth.json/models.json.
  *   - Active tools are pinned to the operator-chat surface at session create
  *     AND re-pinned before each prompt (three-gate, design §7.5 / ADR 0011):
  *     the FULL operator action set PLUS full Pi builtins
- *     (read/write/edit/bash/grep/find/ls) and optional safe-*, PLUS extension
- *     tools registered by user/project extensions (ADR 0012). Non-Pi write
+ *     (read/write/edit/bash/grep/find/ls) and optional safe-*. Non-Pi write
  *     channels (apply_patch/full-tools/shell/coding-chat) stay excluded.
  *
  * The actual SDK calls are injected via `PiSdkBindings` so this module is
  * unit-testable without a live Pi install. Production bindings come from
  * `createDefaultPiSdkBindings()`.
  */
-import { createHash, randomBytes } from "node:crypto";
+import { randomBytes } from "node:crypto";
 import { access } from "node:fs/promises";
 import path from "node:path";
 import { projectCompactSnapshot, } from "./chat-event-store.js";
 import { extractUsageSample } from "./usage.js";
 import { OPERATOR_CHAT_ALLOWED_TOOLS, authorizeOperatorChatTool, assertNoWriteToolInList, } from "./tools.js";
 import { createOperatorChatResourceLoader, } from "./resource-loader.js";
+import { loadOperatorChatInstructionSkills, composeInstructionSkillsPrompt, OPERATOR_CHAT_ALLOWED_INSTRUCTION_SKILLS, } from "./instruction-skills.js";
 import { buildModelCallableToolSchemas } from "./tool-adapter.js";
 import { resolveDefaultChatModel, } from "./model-resolver.js";
 import { filterActiveInterviewTools } from "../interview/tools.js";
-import { RUNTIME_CONTEXT_TEXT_MAX, redactRuntimeText, } from "./runtime-context.js";
 /**
  * Base system prompt fragment every General Operator Chat session receives.
  *
- * 2026-08-11 (ADR 0013): this is a SHORT runtime responsibility layer only.
- * Project governance (operator-only policy, allowedPaths/forbiddenPaths,
- * writer writeSet, taskKind routing, verification matrix, DAG recovery
- * commands, closeout) lives in the loaded target-project AGENTS.md. The
- * prompt below covers: Operator identity, the real tool surface (operator_*
- * first + Pi tools, obey AGENTS.md), denied non-Pi runtimes, safe-* probes,
- * init/init-upgrade fallback for uninitialized repos, DAG supervision with
- * 15/30/60s adaptive polling (operationGet/status/dagReport/dagDoctor), R2
- * recovery (fresh eligible dagRerunPlan → dagRerun; ineligible → same-task
- * rerun/advance, resume, Worker retry) and G2 bounded writeSet auto-approval.
+ * Establishes the operator-vs-implementer role boundary (ADR 0005 D2) and the
+ * current tool surface contract (2026-07-25 widening): the Chat exposes the
+ * FULL operator action surface (all registry actions, including high-risk
+ * mutations like contractApply / runDag / dagRerun) PLUS the built-in
+ * read/explore tools (bash / read / grep / find / ls). The ONLY thing still
+ * forbidden is direct file-WRITING via coding tools (edit / write /
+ * apply_patch / full-tools / shell / coding-chat) — those are excluded from
+ * the SDK registry entirely and can never be activated.
  *
- * The old Human Gate tutorial paragraphs (prepare + browser Human Gate,
- * "confirmDagConfirmation is a human-only action", the long "Recovery default
- * order" table) are REMOVED — bounded DAGs start and recover autonomously
- * (AC-01: ≤ 1900 chars and ≤ 80% of the 2498-char baseline).
+ * Instruction skills are appended AFTER this as read-only context (plan D1).
  */
 export const OPERATOR_CHAT_SYSTEM_PROMPT_BASE = [
     "You are the General Operator Chat for loop-agent / agent-worker.",
-    "Operate through operator_* tools first. Pi read/write/edit/bash/grep/find/ls are available, but obey the loaded repository AGENTS.md. apply_patch, full-tools, shell, and coding-chat are denied alternate runtimes. Prefer safe-read/safe-grep for sensitive probes.",
-    "If a repository has no loop-agent harness and the user requests initialization, run `loop-agent init instructions --repo-root .` then `loop-agent init --repo-root . --profile full --merge`; finish the generated setup, init doctor, inspect, docs audit, and quick verification. For updates use `loop-agent init upgrade --repo-root . --json` until stable; use init check-update only for an explicitly read-only request.",
-    "After a DAG is started or accepted, do not end on accepted/queued/running or an operationId. Supervise it to a terminal outcome. Poll operationGet, task status, dagReport, and dagDoctor after about 15 seconds on start/change, every 30 seconds during progress, and every 60 seconds after 3 minutes unchanged. Report only meaningful node/rank changes, review/verify/closeout, recovery, liveness concerns, and terminal outcomes.",
-    "On failure read primaryFailure, primaryRecovery, and doctor evidence. If meaningful progress exists, wait. Otherwise use a fresh eligible dagRerunPlan and rerun its safe node; when ineligible follow AGENTS.md/runtime recovery for same-task rerun/advance, resume, or Worker retry. Auto-approve only a bounded writeSet inside allowedPaths, outside forbiddenPaths, without broad/destructive risk, and with structured verification.",
-    "Continue until success, user stop, or no safe eligible recovery remains because limits, bindings, auth/quota recovery, or required external authorization are exhausted. Never create a new task for a transient failure or replace repair-pi with direct edits.",
+    "You are an OPERATOR first: orchestrate and inspect via operator_* tools, and you also have full Pi repository tools (read, write, edit, bash, grep, find, ls) plus optional safe-read/safe-grep/git-status/git-diff.",
+    "Capability honesty (ADR 0011): read/write/edit/bash ARE available. Prefer governed loop-agent / Agent DAG paths (implement-pi / repair-pi) and Human Gate for large refactors, public contracts, credentials, or production-risk changes — treat direct write/edit/bash as soft-disciplined, not as a second DAG kernel.",
+    "safe-read / safe-grep enforce a repo-relative path boundary, a sensitive-file denylist (.env* / *.key / *.pem / .git/** / auth.json / sessions/**) and secret scrubbing. Prefer them for sensitive probes; avoid dumping secrets via raw read/bash.",
+    "You do NOT have apply_patch / full-tools / shell / coding-chat as alternate coding runtimes — those non-Pi channels stay denied.",
+    "High-risk mutations still use prepare + browser Human Gate. Prepare contract via interview then apply via contractApply, prepare DAG runs via prepareDagConfirmation, prepare other mutations via prepareMutationGate, then confirm in the browser Human Gate. When a high-risk action (contractApply / runDag / dagRerun / etc.) fails on missing prepared state, diagnose with status/doctor/dagReport/inspect/contractShow/read/safe-read/safe-grep.",
+    "You cannot self-confirm a DAG run: confirmDagConfirmation is a human-only action (executed by the browser with a server-signed confirmation token). You may only prepare it via prepareDagConfirmation; the user must confirm in the UI.",
+    "Prefer read-only diagnosis (status, doctor, dagReport, inspect, contractShow, read, safe-read, safe-grep, git-status) before mutating.",
+    "Recovery default order (save tokens/time; do NOT open a new task-id for provider flake): (1) dagReport/doctor/status — read primaryFailure.nodeId + primaryRecovery; (2) for completed failed|partial_failed standalone runs prefer dagRerunPlan then prepareMutationGate/dagRerun from the failed or safe upstream node (plan → planHash → human gate); (3) paused → approve path / resume, never treat resume as failure retry; (4) only when plan is ineligible (writer/decision/fingerprint) or contract/source truly changed: standaloneTaskRerun or same-task task advance — never invent a fresh task-id without cause; (5) Worker-owned failures use workerTaskRetry, not dagRerun. Never use direct write/edit as a substitute for repair-pi.",
 ].join("\n");
 /** Compose the inspectable system prompt actually injected into Operator Chat. */
 export function composeOperatorChatSystemPrompt(input) {
     return [
         OPERATOR_CHAT_SYSTEM_PROMPT_BASE,
+        ...(input.skillFragment?.trim() ? [input.skillFragment.trim()] : []),
         ...(input.systemPromptSuffix?.trim()
             ? [input.systemPromptSuffix.trim()]
             : []),
@@ -106,49 +102,6 @@ export function OPERATOR_CHAT_ACTIVE_TOOL_NAMES() {
         ...OPERATOR_CHAT_SAFE_EXPLORE_TOOL_IDS,
     ];
 }
-/**
- * Non-Pi write / coding channels that must never be activated in Operator
- * Chat even when a user/project extension registers them (ADR 0011 / 0012).
- * Mirrors the NON_PI_WRITE_CHANNELS guard in tools.ts for the Gate 2 pin.
- */
-const OPERATOR_CHAT_EXTENSION_DENIED_TOOL_IDS = new Set([
-    "apply_patch",
-    "apply-patch",
-    "full-tools",
-    "full_tools",
-    "coding-chat",
-    "coding_chat",
-    "shell",
-].map((t) => t.toLowerCase()));
-/**
- * Gate 2 active-tool set for a live session (ADR 0012): the operator-chat
- * baseline (operator actions + Pi builtins + safe explore) PLUS extension
- * tools registered by user/project extensions. SDK setActiveToolsByName is
- * REPLACEMENT-style, so extension tools would be disabled by the fixed
- * baseline; this helper re-adds every registry tool that is not part of the
- * baseline and not on the deny surface (apply_patch/full-tools/shell/
- * coding-chat). Unknown/denied names are never activated; Gate 3 still
- * re-authorizes every tool call per invocation.
- */
-export function computeOperatorChatActiveToolNames(session) {
-    const baseline = OPERATOR_CHAT_ACTIVE_TOOL_NAMES();
-    if (!session?.getAllTools)
-        return baseline;
-    const baselineLower = new Set(baseline.map((t) => t.toLowerCase()));
-    const extras = [];
-    for (const tool of session.getAllTools()) {
-        const name = tool?.name;
-        if (!name || typeof name !== "string")
-            continue;
-        const lower = name.toLowerCase();
-        if (baselineLower.has(lower))
-            continue;
-        if (OPERATOR_CHAT_EXTENSION_DENIED_TOOL_IDS.has(lower))
-            continue;
-        extras.push(name);
-    }
-    return extras.length > 0 ? [...baseline, ...extras] : baseline;
-}
 /**
  * Build Pi custom ToolDefinition objects for every whitelisted operator action.
  * Each tool's execute() routes into the operator action dispatcher (Gate 3).
@@ -429,138 +382,6 @@ export const THINKING_LEVELS = [
     "xhigh",
     "max",
 ];
-/**
- * Structured critical-failure error for snapshot projection (RF-02). Model
- * enumeration or system prompt projection failures throw this so consuming
- * routes can return 503 PI_RUNTIME_UNAVAILABLE instead of a fake-empty 200.
- * Partial ResourceLoader / package-inventory failures are NOT critical — they
- * keep the 200 snapshot and surface as structured diagnostics instead.
- */
-export class RuntimeSnapshotUnavailableError extends Error {
-    code = "PI_RUNTIME_UNAVAILABLE";
-    constructor(message) {
-        super(message);
-        this.name = "RuntimeSnapshotUnavailableError";
-    }
-}
-/**
- * Browser-safe projection of a live runtime snapshot (design §2.2 / RF-03).
- *
- * Every browser-visible string runs the shared secret-scrub chain
- * (scrubSecrets + ghp_/Bearer redaction via redactRuntimeText) and a fixed
- * per-field length limit: 200 (names/spec/source/origin), 400 (paths/errors/
- * diagnostic messages), 600 (skill descriptions), 80 (package versions);
- * truncation uses the fixed `…[truncated N chars …]` marker. The server-only
- * `raw` prompt and the RAW-based `sha256`/`characters` pass through untouched,
- * and real empty lists stay empty.
- *
- * Pure + deterministic and exported so the route harness reuses the exact
- * production implementation (same code path as getRuntimeSnapshot).
- */
-export function projectRuntimeSnapshot(input) {
-    const field = (value, max) => value === undefined ? undefined : redactRuntimeText(value, max);
-    const projectSkill = (skill) => ({
-        name: field(skill.name, 200) ?? "",
-        description: field(skill.description, 600) ?? "",
-        path: field(skill.path, 400) ?? "",
-        ...(skill.baseDir ? { baseDir: field(skill.baseDir, 400) } : {}),
-        scope: skill.scope,
-        source: field(skill.source, 200) ?? "",
-        enabled: skill.enabled,
-        diagnostics: skill.diagnostics.map((diag) => field(diag, 400) ?? ""),
-    });
-    const projectExtension = (ext) => ({
-        name: field(ext.name, 200) ?? "",
-        path: field(ext.path, 400) ?? "",
-        ...(ext.resolvedPath
-            ? { resolvedPath: field(ext.resolvedPath, 400) }
-            : {}),
-        source: field(ext.source, 200) ?? "",
-        scope: ext.scope,
-        ...(ext.origin ? { origin: field(ext.origin, 200) } : {}),
-        enabled: ext.enabled,
-        ...(ext.error ? { error: field(ext.error, 400) } : {}),
-    });
-    const projectPackage = (pkg) => ({
-        spec: field(pkg.spec, 200) ?? "",
-        scope: pkg.scope,
-        enabled: pkg.enabled,
-        ...(pkg.version ? { version: field(pkg.version, 80) } : {}),
-        ...(pkg.configuredVersion
-            ? { configuredVersion: field(pkg.configuredVersion, 80) }
-            : {}),
-        ...(pkg.packageName ? { packageName: field(pkg.packageName, 200) } : {}),
-        ...(pkg.path ? { path: field(pkg.path, 400) } : {}),
-        ...(pkg.installedPath ? { installedPath: field(pkg.installedPath, 400) } : {}),
-        ...(pkg.cwd ? { cwd: field(pkg.cwd, 400) } : {}),
-        resolved: pkg.resolved.map((resource) => ({
-            type: resource.type,
-            name: field(resource.name, 200) ?? "",
-            path: field(resource.path, 400) ?? "",
-            source: field(resource.source, 200) ?? "",
-            scope: resource.scope,
-        })),
-        diagnostics: pkg.diagnostics.map((diag) => field(diag, 400) ?? ""),
-    });
-    const projectDiagnostic = (diag) => ({
-        type: diag.type,
-        ...(diag.code ? { code: diag.code } : {}),
-        message: field(diag.message, 400) ?? "",
-        ...(diag.path ? { path: field(diag.path, 400) } : {}),
-        ...(diag.retryable !== undefined
-            ? { retryable: diag.retryable }
-            : {}),
-    });
-    return {
-        sessionId: input.sessionId,
-        revision: input.revision,
-        loadedAt: input.loadedAt,
-        selection: {
-            ...(input.selection.model
-                ? {
-                    model: {
-                        provider: input.selection.model.provider,
-                        id: input.selection.model.id,
-                        ...(input.selection.model.name
-                            ? { name: field(input.selection.model.name, 200) }
-                            : {}),
-                    },
-                }
-                : {}),
-            thinkingSelection: input.selection.thinkingSelection,
-            ...(input.selection.effectiveThinkingLevel
-                ? { effectiveThinkingLevel: input.selection.effectiveThinkingLevel }
-                : {}),
-        },
-        models: input.models.map((model) => ({
-            provider: model.provider,
-            id: model.id,
-            ...(model.name ? { name: field(model.name, 200) } : {}),
-            ...(model.hasCredentials !== undefined
-                ? { hasCredentials: model.hasCredentials }
-                : {}),
-        })),
-        thinkingLevels: input.thinkingLevels.map((option) => ({ ...option })),
-        systemPrompt: {
-            ...(input.systemPrompt.raw !== undefined
-                ? { raw: input.systemPrompt.raw }
-                : {}),
-            text: redactRuntimeText(input.systemPrompt.text, RUNTIME_CONTEXT_TEXT_MAX),
-            sha256: input.systemPrompt.sha256,
-            characters: input.systemPrompt.characters,
-        },
-        activeTools: [...input.activeTools],
-        contextFiles: input.contextFiles.map((file) => ({
-            path: field(file.path, 400) ?? "",
-            characters: file.characters,
-        })),
-        skills: input.skills.map(projectSkill),
-        extensions: input.extensions.map(projectExtension),
-        packages: input.packages.map(projectPackage),
-        diagnostics: input.diagnostics.map(projectDiagnostic),
-        hasBash: input.hasBash,
-    };
-}
 /**
  * Extract the latest assistant text fragment from an SDK message object.
  * Tolerant of multiple message shapes the SDK emits.
@@ -612,16 +433,9 @@ export class ConsolePiRuntime {
     sessions = new Map();
     modelRuntimes = new Map();
     sessionManagers = new Map();
-    /** Per-session SDK service scope (resourceLoader / settingsManager) used by the live runtime snapshot. */
-    serviceScopes = new Map();
-    /** Snapshot revision: bumped on create / reopen / model / thinking / reload. */
-    revisions = new Map();
-    /** RF-01: per-session reload in-flight lock (concurrent second call → PI_SESSION_BUSY). */
-    reloadInFlight = new Set();
-    /** Composer thinking selection ("auto" = no explicit override). */
-    thinkingSelections = new Map();
     mainlineLeaves = new Map();
     bindings;
+    disabledInstructionSkills = new Set();
     constructor(options) {
         this.options = options;
         this.loader = createOperatorChatResourceLoader();
@@ -647,6 +461,9 @@ export class ConsolePiRuntime {
             })),
         };
     }
+    setDisabledInstructionSkills(names) {
+        this.disabledInstructionSkills = new Set(names);
+    }
     /** Operator action context used by custom-tool dispatchers (Gate 3). */
     get actionContext() {
         return this.options.actionContext;
@@ -680,6 +497,22 @@ export class ConsolePiRuntime {
             modelId: descriptor.modelId,
         };
     }
+    /**
+     * Load the operator-context instruction skills (plan D1) and compose the
+     * read-only methodology fragment for the Chat system prompt. Returns an
+     * empty string when no skills load (e.g. skills dir missing) so the
+     * session still boots — skills are context, not a hard dependency.
+     */
+    async composeSystemPromptSkills() {
+        try {
+            const result = await loadOperatorChatInstructionSkills(this.options.skillsDir, OPERATOR_CHAT_ALLOWED_INSTRUCTION_SKILLS.filter((name) => !this.disabledInstructionSkills.has(name)));
+            return composeInstructionSkillsPrompt(result.loaded);
+        }
+        catch (error) {
+            process.stderr.write(`[console] chat instruction-skills load failed: ${error instanceof Error ? error.message : String(error)}\n`);
+            return "";
+        }
+    }
     /** Create a new isolated Chat session pinned to the operator-chat tool set. */
     async createSession(init) {
         const sessionId = `operator-chat-${randomBytes(12).toString("hex")}`;
@@ -695,18 +528,28 @@ export class ConsolePiRuntime {
         }
         // Final fallback only when nothing resolved: let the SDK pick its default
         // (we do NOT hardcode a provider here).
-        // Standard open resource surface (ADR 0012): the SDK DefaultResourceLoader
-        // loads user/project AGENTS.md context files, skills (~/.pi/agent/skills/
-        // + .agents/skills/ init projection) and user/project extensions. Only
-        // appendSystemPrompt carries the operator-chat system prompt.
+        // Load operator-context instruction skills (plan D1) and compose the
+        // read-only methodology fragment injected into the Chat system prompt.
+        // Skills are NEVER registered as executable tools (D1 hard rule).
+        const skillFragment = await this.composeSystemPromptSkills();
         const appendSystemPrompt = [
             OPERATOR_CHAT_SYSTEM_PROMPT_BASE,
+            ...(skillFragment ? [skillFragment] : []),
             ...(init?.systemPromptSuffix ? [init.systemPromptSuffix] : []),
         ];
         const { services } = await this.bindings.createServices({
             cwd: this.options.cwd,
             agentDir,
             resourceLoaderOptions: {
+                // Closed surface: do not load user/project extensions, skills,
+                // AGENTS.md, context files. The Chat tool surface is fixed by
+                // the whitelist, not by filesystem discovery.
+                noContextFiles: true,
+                noSkills: true,
+                noExtensions: true,
+                // Inject the audited instruction skills as READ-ONLY context
+                // (plan D1). appendSystemPrompt is the SDK's documented entry
+                // point for adding system-prompt text without enabling tools.
                 appendSystemPrompt,
             },
         });
@@ -790,19 +633,12 @@ export class ConsolePiRuntime {
             ...(resolvedModel ? { model: resolvedModel } : {}),
         });
         // Gate 2: re-pin active tools (defensive — some SDK paths may seed
-        // defaults). Active set = operator baseline + built-in explore tools +
-        // extension tools registered by user/project extensions (ADR 0012).
-        // Non-Pi write channels are excluded above and cannot appear here.
-        session.setActiveToolsByName(computeOperatorChatActiveToolNames(session));
+        // defaults). Active set = all operator actions + built-in explore tools.
+        // File-writing tools are excluded above and thus cannot appear here.
+        session.setActiveToolsByName(OPERATOR_CHAT_ACTIVE_TOOL_NAMES());
         this.sessions.set(sessionId, session);
         this.sessionManagers.set(sessionId, sessionManager);
         this.modelRuntimes.set(sessionId, modelRuntime);
-        this.serviceScopes.set(sessionId, {
-            resourceLoader: services.resourceLoader,
-            settingsManager: services.settingsManager,
-        });
-        this.revisions.set(sessionId, 1);
-        this.thinkingSelections.set(sessionId, "auto");
         return {
             sessionId,
             sessionFile: session.sessionFile,
@@ -825,13 +661,10 @@ export class ConsolePiRuntime {
             sessionManager,
             model: init.model,
         });
-        built.session.setActiveToolsByName(computeOperatorChatActiveToolNames(built.session));
+        built.session.setActiveToolsByName(OPERATOR_CHAT_ACTIVE_TOOL_NAMES());
         this.sessions.set(sessionId, built.session);
         this.sessionManagers.set(sessionId, sessionManager);
         this.modelRuntimes.set(sessionId, built.modelRuntime);
-        this.serviceScopes.set(sessionId, built.services);
-        this.revisions.set(sessionId, 1);
-        this.thinkingSelections.set(sessionId, "auto");
         return {
             sessionId,
             sessionFile: built.session.sessionFile,
@@ -896,31 +729,18 @@ export class ConsolePiRuntime {
         if (!resolved)
             throw new Error("MODEL_NOT_AVAILABLE");
         await session.setModel(resolved);
-        this.bumpRevision(sessionId);
         return {
             provider: session.model?.provider ?? model.provider,
             modelId: session.model?.id ?? session.model?.modelId ?? model.modelId,
         };
     }
-    /**
-     * Apply a thinking-level selection. `auto` records the selection WITHOUT
-     * sending any explicit override (the SDK keeps its own default); an explicit
-     * level calls `session.setThinkingLevel`. Returns the effective value.
-     */
     applyThinkingLevel(sessionId, level) {
         const session = this.sessions.get(sessionId);
         if (!session)
             throw new Error(`chat session not active: ${sessionId}`);
-        if (level === "auto") {
-            this.thinkingSelections.set(sessionId, "auto");
-            this.bumpRevision(sessionId);
-            return "auto";
-        }
         if (!THINKING_LEVELS.includes(level) || !session.setThinkingLevel)
             throw new Error("THINKING_LEVEL_UNSUPPORTED");
         session.setThinkingLevel(level);
-        this.thinkingSelections.set(sessionId, level);
-        this.bumpRevision(sessionId);
         return session.thinkingLevel ?? level;
     }
     getRuntimeSelection(sessionId) {
@@ -937,370 +757,6 @@ export class ConsolePiRuntime {
             activeTools: session.getActiveToolNames(),
         };
     }
-    bumpRevision(sessionId) {
-        this.revisions.set(sessionId, (this.revisions.get(sessionId) ?? 0) + 1);
-    }
-    /**
-     * Resolve the RAW system prompt actually injected into the Pi session
-     * (design §2.2 / AC-03). Fallback chain: agent.state.systemPrompt →
-     * session.systemPrompt getter → ResourceLoader.getSystemPrompt() → the
-     * composed operator-chat base prompt. Never returns empty.
-     */
-    async getRuntimeSystemPrompt(sessionId) {
-        const session = this.sessions.get(sessionId);
-        if (!session)
-            return composeOperatorChatSystemPrompt({});
-        const fromState = session.state?.systemPrompt;
-        const fromGetter = session.systemPrompt;
-        const loader = this.serviceScopes.get(sessionId)?.resourceLoader;
-        return (fromState ||
-            fromGetter ||
-            loader?.getSystemPrompt?.() ||
-            composeOperatorChatSystemPrompt({}));
-    }
-    /**
-     * Read the RAW system prompt for the snapshot, converting any projection
-     * failure into the structured critical error (RF-02): a broken system prompt
-     * source must fail the whole snapshot with 503 PI_RUNTIME_UNAVAILABLE rather
-     * than silently fabricate prompt text.
-     */
-    async readRawSystemPrompt(sessionId) {
-        try {
-            return await this.getRuntimeSystemPrompt(sessionId);
-        }
-        catch (error) {
-            throw new RuntimeSnapshotUnavailableError(`system prompt projection failed: ${error instanceof Error ? error.message : String(error)}`);
-        }
-    }
-    /**
-     * Official Pi session reload (AC-05 / AC-06). Rejects with a structured
-     * code while the session is busy (streaming / compacting / bash in flight /
-     * duplicate reload) — never aborts, never silently queues.
-     */
-    async reloadSession(sessionId) {
-        const session = this.sessions.get(sessionId);
-        if (!session) {
-            return {
-                ok: false,
-                code: "PI_SESSION_NOT_FOUND",
-                message: `chat session not active: ${sessionId}`,
-            };
-        }
-        // RF2-03: the per-sessionId in-flight lock is checked FIRST — before the
-        // streaming/compacting/bash/support checks. JS runs check-then-add in one
-        // synchronous segment, so two concurrent calls cannot both pass; the lock
-        // is released in `finally` on BOTH the success and the error path, and
-        // different sessions never block each other. Priority matters: the first
-        // reload() may synchronously flip isIdle/isCompacting/isBashRunning/
-        // hasPendingBashMessages to busy, and a second concurrent call must still
-        // report the reload-in-flight busy (not the streaming/compacting one).
-        if (this.reloadInFlight.has(sessionId)) {
-            return {
-                ok: false,
-                code: "PI_SESSION_BUSY",
-                message: "session is busy (reload in flight); reload rejected without abort",
-            };
-        }
-        const busyReasons = [];
-        if (session.isStreaming === true || session.isIdle === false)
-            busyReasons.push("streaming");
-        if (session.isCompacting === true)
-            busyReasons.push("compacting");
-        if (session.isBashRunning === true)
-            busyReasons.push("bash running");
-        if (session.hasPendingBashMessages === true)
-            busyReasons.push("bash messages pending");
-        if (busyReasons.length > 0) {
-            return {
-                ok: false,
-                code: "PI_SESSION_BUSY",
-                message: `session is busy (${busyReasons.join(", ")}); reload rejected without abort`,
-            };
-        }
-        if (typeof session.reload !== "function") {
-            return {
-                ok: false,
-                code: "PI_RELOAD_FAILED",
-                message: "this Pi runtime does not support session.reload()",
-            };
-        }
-        this.reloadInFlight.add(sessionId);
-        try {
-            await session.reload();
-        }
-        catch (error) {
-            return {
-                ok: false,
-                code: "PI_RELOAD_FAILED",
-                message: error instanceof Error ? error.message : String(error),
-            };
-        }
-        finally {
-            this.reloadInFlight.delete(sessionId);
-        }
-        this.bumpRevision(sessionId);
-        return { ok: true, revision: this.revisions.get(sessionId) ?? 0 };
-    }
-    /**
-     * Project the unified live runtime snapshot (design §2.2). The current Pi
-     * session is the single source of truth: real system prompt, real model /
-     * thinking selection (auto + effective), the session modelRuntime model
-     * list, and the session ResourceLoader inventories. Undefined when the
-     * session is not active — callers fail closed instead of fabricating data.
-     */
-    async getRuntimeSnapshot(sessionId, options) {
-        const session = this.sessions.get(sessionId);
-        if (!session)
-            return undefined;
-        const services = this.serviceScopes.get(sessionId);
-        const modelRuntime = this.modelRuntimes.get(sessionId);
-        const resourceLoader = services?.resourceLoader;
-        const settingsManager = services?.settingsManager;
-        const thinkingSelection = this.thinkingSelections.get(sessionId) ?? "auto";
-        const effectiveThinkingLevel = session.thinkingLevel ??
-            settingsManager?.getDefaultThinkingLevel?.() ??
-            (thinkingSelection === "auto" ? undefined : thinkingSelection);
-        const rawSystemPrompt = await this.readRawSystemPrompt(sessionId);
-        // Models come from the session modelRuntime. A model-enumeration failure
-        // is a CRITICAL projection failure (RF-02): it throws
-        // RuntimeSnapshotUnavailableError so consuming routes return 503
-        // PI_RUNTIME_UNAVAILABLE — never a fabricated empty model list.
-        let models = [];
-        if (modelRuntime) {
-            try {
-                models = this.bindings
-                    .listAvailableModels({ modelRuntime })
-                    .map((entry) => ({
-                    provider: entry.provider,
-                    id: entry.id,
-                    ...(entry.name ? { name: entry.name } : {}),
-                    hasCredentials: entry.hasCredentials,
-                }));
-            }
-            catch (error) {
-                throw new RuntimeSnapshotUnavailableError(`model enumeration failed: ${error instanceof Error ? error.message : String(error)}`);
-            }
-        }
-        // Thinking options: auto is always offered; explicit levels only when the
-        // runtime session supports setThinkingLevel (xhigh/max ship with the SDK
-        // and therefore surface only when this runtime provides them).
-        const supportedLevels = typeof session.setThinkingLevel === "function"
-            ? [...THINKING_LEVELS]
-            : [];
-        const thinkingLevels = [
-            { value: "auto" },
-            ...supportedLevels.map((value) => ({ value })),
-        ];
-        // Resource inventories from the session ResourceLoader (ADR 0012 open
-        // surface). Missing loader → real empty lists, never fabricated entries.
-        // Each subface is isolated (RF-02): a throwing subface keeps the other
-        // inventories AND surfaces a structured retryable diagnostic instead of
-        // silently dropping the whole resource projection.
-        const contextFiles = [];
-        const skills = [];
-        const extensions = [];
-        const diagnostics = [];
-        let resolvedResources = [];
-        const resourceFailure = (subface, error) => {
-            diagnostics.push({
-                type: "error",
-                code: "RESOURCE_LOAD_FAILED",
-                message: `${subface} inventory failed: ${error instanceof Error ? error.message : String(error)}`,
-                retryable: true,
-            });
-        };
-        if (resourceLoader) {
-            try {
-                const agentsFiles = resourceLoader.getAgentsFiles?.();
-                for (const file of agentsFiles?.agentsFiles ?? []) {
-                    if (!file.path)
-                        continue;
-                    contextFiles.push({
-                        path: file.path,
-                        characters: file.content?.length ?? 0,
-                    });
-                }
-            }
-            catch (error) {
-                resourceFailure("context files", error);
-            }
-            try {
-                const skillsResult = resourceLoader.getSkills?.();
-                for (const skill of skillsResult?.skills ?? []) {
-                    skills.push({
-                        name: skill.name,
-                        description: skill.description ?? "",
-                        path: skill.filePath,
-                        ...(skill.baseDir ? { baseDir: skill.baseDir } : {}),
-                        scope: skill.sourceInfo?.scope ?? "unknown",
-                        source: skill.sourceInfo?.source ?? "",
-                        enabled: !skill.disableModelInvocation,
-                        diagnostics: [],
-                    });
-                    resolvedResources.push({
-                        type: "skill",
-                        name: skill.name,
-                        path: skill.filePath,
-                        source: skill.sourceInfo?.source ?? "",
-                        scope: skill.sourceInfo?.scope ?? "unknown",
-                    });
-                }
-                for (const diag of skillsResult?.diagnostics ?? []) {
-                    if (!diag?.message)
-                        continue;
-                    diagnostics.push({
-                        type: diag.type ?? "warning",
-                        message: diag.message,
-                        ...(diag.path ? { path: diag.path } : {}),
-                    });
-                }
-            }
-            catch (error) {
-                resourceFailure("skills", error);
-            }
-            try {
-                const extResult = resourceLoader.getExtensions?.();
-                for (const ext of extResult?.extensions ?? []) {
-                    const path = ext.resolvedPath ?? ext.path ?? "";
-                    extensions.push({
-                        name: ext.sourceInfo?.source ?? ext.path ?? "extension",
-                        path,
-                        ...(ext.resolvedPath ? { resolvedPath: ext.resolvedPath } : {}),
-                        source: ext.sourceInfo?.source ?? "",
-                        scope: ext.sourceInfo?.scope ?? "unknown",
-                        ...(ext.sourceInfo?.origin ? { origin: ext.sourceInfo.origin } : {}),
-                        enabled: true,
-                    });
-                    resolvedResources.push({
-                        type: "extension",
-                        name: ext.sourceInfo?.source ?? ext.path ?? "extension",
-                        path,
-                        source: ext.sourceInfo?.source ?? "",
-                        scope: ext.sourceInfo?.scope ?? "unknown",
-                    });
-                }
-                for (const err of extResult?.errors ?? []) {
-                    if (!err?.error)
-                        continue;
-                    diagnostics.push({
-                        type: "error",
-                        message: err.error,
-                        ...(err.path ? { path: err.path } : {}),
-                    });
-                }
-            }
-            catch (error) {
-                resourceFailure("extensions", error);
-            }
-            try {
-                const promptsResult = resourceLoader.getPrompts?.();
-                for (const prompt of promptsResult?.prompts ?? []) {
-                    resolvedResources.push({
-                        type: "prompt",
-                        name: prompt.name,
-                        path: prompt.filePath,
-                        source: prompt.sourceInfo?.source ?? "",
-                        scope: prompt.sourceInfo?.scope ?? "unknown",
-                    });
-                }
-                for (const diag of promptsResult?.diagnostics ?? []) {
-                    if (!diag?.message)
-                        continue;
-                    diagnostics.push({
-                        type: diag.type ?? "warning",
-                        message: diag.message,
-                        ...(diag.path ? { path: diag.path } : {}),
-                    });
-                }
-            }
-            catch (error) {
-                resourceFailure("prompts", error);
-            }
-            try {
-                const themesResult = resourceLoader.getThemes?.();
-                for (const theme of themesResult?.themes ?? []) {
-                    if (!theme.path)
-                        continue;
-                    resolvedResources.push({
-                        type: "theme",
-                        name: theme.name ?? theme.path,
-                        path: theme.path,
-                        source: "",
-                        scope: "unknown",
-                    });
-                }
-                for (const diag of themesResult?.diagnostics ?? []) {
-                    if (!diag?.message)
-                        continue;
-                    diagnostics.push({
-                        type: diag.type ?? "warning",
-                        message: diag.message,
-                        ...(diag.path ? { path: diag.path } : {}),
-                    });
-                }
-            }
-            catch (error) {
-                resourceFailure("themes", error);
-            }
-        }
-        // Packages: Pi settings specs + resolved resource metadata. Fields the SDK
-        // does not expose stay absent (real missing, never fabricated). A
-        // readPackageInventory failure is a PARTIAL failure (RF-02): the snapshot
-        // stays 200 with a structured retryable diagnostic — never a silent
-        // fake-empty package list.
-        const { readPackageInventory } = await import("./pi-console-config.js");
-        let packages = [];
-        try {
-            packages = (await readPackageInventory(await safeGetAgentDir(this.bindings), this.options.cwd, resolvedResources));
-        }
-        catch (error) {
-            packages = [];
-            diagnostics.push({
-                type: "error",
-                code: "PACKAGE_INVENTORY_FAILED",
-                message: error instanceof Error ? error.message : String(error),
-                retryable: true,
-            });
-        }
-        return projectRuntimeSnapshot({
-            sessionId,
-            revision: this.revisions.get(sessionId) ?? 0,
-            loadedAt: new Date().toISOString(),
-            selection: {
-                ...(session.model?.provider &&
-                    (session.model?.id ?? session.model?.modelId)
-                    ? {
-                        model: {
-                            provider: session.model.provider,
-                            id: session.model.id ?? session.model.modelId,
-                            ...(session.model.name ? { name: session.model.name } : {}),
-                        },
-                    }
-                    : {}),
-                thinkingSelection,
-                ...(effectiveThinkingLevel
-                    ? { effectiveThinkingLevel: effectiveThinkingLevel }
-                    : {}),
-            },
-            models,
-            thinkingLevels,
-            systemPrompt: {
-                ...(options?.includeRaw ? { raw: rawSystemPrompt } : {}),
-                // The RAW prompt flows into the projection: text is scrubbed +
-                // length-limited while sha256/characters stay RAW-based (design §2.2).
-                text: rawSystemPrompt,
-                sha256: createHash("sha256").update(rawSystemPrompt).digest("hex"),
-                characters: rawSystemPrompt.length,
-            },
-            activeTools: session.getActiveToolNames(),
-            contextFiles,
-            skills,
-            extensions,
-            packages,
-            diagnostics,
-            hasBash: true,
-        });
-    }
     /**
      * Re-open a previously persisted Chat session after Console restart or
      * browser refresh (roadmap M1-S04 / S05).
@@ -1382,13 +838,10 @@ export class ConsolePiRuntime {
                     message: `reopened Pi sessionId mismatch: expected ${sessionId}, got ${reportedId}`,
                 };
             }
-            session.setActiveToolsByName(computeOperatorChatActiveToolNames(session));
+            session.setActiveToolsByName(OPERATOR_CHAT_ACTIVE_TOOL_NAMES());
             this.sessions.set(sessionId, session);
             this.sessionManagers.set(sessionId, sessionManager);
             this.modelRuntimes.set(sessionId, built.modelRuntime);
-            this.serviceScopes.set(sessionId, built.services);
-            this.revisions.set(sessionId, 1);
-            this.thinkingSelections.set(sessionId, "auto");
             return {
                 ok: true,
                 handle: {
@@ -1427,14 +880,19 @@ export class ConsolePiRuntime {
      */
     async buildSessionWithServices(init) {
         const agentDir = await safeGetAgentDir(this.bindings);
+        const skillFragment = await this.composeSystemPromptSkills();
         const appendSystemPrompt = [
             OPERATOR_CHAT_SYSTEM_PROMPT_BASE,
+            ...(skillFragment ? [skillFragment] : []),
             ...(init.systemPromptSuffix ? [init.systemPromptSuffix] : []),
         ];
         const { services } = await this.bindings.createServices({
             cwd: this.options.cwd,
             agentDir,
             resourceLoaderOptions: {
+                noContextFiles: true,
+                noSkills: true,
+                noExtensions: true,
                 appendSystemPrompt,
             },
         });
@@ -1484,14 +942,7 @@ export class ConsolePiRuntime {
             ...(customTools && customTools.length > 0 ? { customTools } : {}),
             ...(resolvedModel ? { model: resolvedModel } : {}),
         });
-        return {
-            session,
-            modelRuntime,
-            services: {
-                resourceLoader: services.resourceLoader,
-                settingsManager: services.settingsManager,
-            },
-        };
+        return { session, modelRuntime };
     }
     /** Re-open a previously created session (cross-request). */
     open(sessionId) {
@@ -1512,12 +963,11 @@ export class ConsolePiRuntime {
         }
         // Gate 2 (re-pin before each turn): interview turns pass through the
         // existing closed interview allow/deny registry. The next ordinary turn
-        // explicitly restores the normal Operator Chat set (baseline + extension
-        // tools, ADR 0012).
+        // explicitly restores the normal Operator Chat set.
         const requestedTools = OPERATOR_CHAT_ACTIVE_TOOL_NAMES();
         const activeTools = options?.mode === "requirement-interview"
             ? filterActiveInterviewTools(requestedTools).allowed
-            : computeOperatorChatActiveToolNames(session);
+            : requestedTools;
         session.setActiveToolsByName(activeTools);
         const unsub = session.subscribe((event) => {
             const mapped = mapSdkEvent(sessionId, event);
@@ -1599,10 +1049,6 @@ export class ConsolePiRuntime {
             this.sessionManagers.delete(sessionId);
             this.mainlineLeaves.delete(sessionId);
             this.modelRuntimes.delete(sessionId);
-            this.serviceScopes.delete(sessionId);
-            this.revisions.delete(sessionId);
-            this.thinkingSelections.delete(sessionId);
-            this.reloadInFlight.delete(sessionId);
         }
     }
     disposeAll() {