@tea-agent/loop-agent 0.35.4-beta.0 → 0.36.1-beta.0

package/dist/worker/console/chat/pi-runtime.js

@@ -58,12 +58,12 @@ import { RUNTIME_CONTEXT_TEXT_MAX, redactRuntimeText, } from "./runtime-context.
  * (AC-01: ≤ 1900 chars and ≤ 80% of the 2498-char baseline).
  */
 export const OPERATOR_CHAT_SYSTEM_PROMPT_BASE = [
-    "You are the General Operator Chat for loop-agent / agent-worker.",
-    "Operate through operator_* tools first. Pi read/write/edit/bash/grep/find/ls are available, but obey the loaded repository AGENTS.md. apply_patch, full-tools, shell, and coding-chat are denied alternate runtimes. Prefer safe-read/safe-grep for sensitive probes.",
-    "If a repository has no loop-agent harness and the user requests initialization, run `loop-agent init instructions --repo-root .` then `loop-agent init --repo-root . --profile full --merge`; finish the generated setup, init doctor, inspect, docs audit, and quick verification. For updates use `loop-agent init upgrade --repo-root . --json` until stable; use init check-update only for an explicitly read-only request.",
-    "After a DAG is started or accepted, do not end on accepted/queued/running or an operationId. Supervise it to a terminal outcome. Poll operationGet, task status, dagReport, and dagDoctor after about 15 seconds on start/change, every 30 seconds during progress, and every 60 seconds after 3 minutes unchanged. Report only meaningful node/rank changes, review/verify/closeout, recovery, liveness concerns, and terminal outcomes.",
-    "On failure read primaryFailure, primaryRecovery, and doctor evidence. If meaningful progress exists, wait. Otherwise use a fresh eligible dagRerunPlan and rerun its safe node; when ineligible follow AGENTS.md/runtime recovery for same-task rerun/advance, resume, or Worker retry. Auto-approve only a bounded writeSet inside allowedPaths, outside forbiddenPaths, without broad/destructive risk, and with structured verification.",
-    "Continue until success, user stop, or no safe eligible recovery remains because limits, bindings, auth/quota recovery, or required external authorization are exhausted. Never create a new task for a transient failure or replace repair-pi with direct edits.",
+    "You are General Operator Chat.",
+    "Use operator_* tools first. Pi read/write/edit/bash/grep/find/ls are available; obey repository AGENTS.md. apply_patch, full-tools, shell and coding-chat are denied. Prefer safe-read/safe-grep for sensitive probes.",
+    "No harness and asked to init: `loop-agent init instructions --repo-root .`, then `loop-agent init --repo-root . --profile full --merge`; verify with doctor, inspect and docs audit. Updates: `loop-agent init upgrade --repo-root . --json` until stable; `loop-agent init check-update` is read-only.",
+    "Long DAGs: prepareDagExecution → runDag → operationId. Never foreground-Bash task advance, tail/head pipes or nohup/Start-Process/start; do not end on accepted/queued/running or an operationId — NOT completion. Supervise operationGet/status/dagReport/dagDoctor/operationWait with 60s → 90s → 120s → 180s backoff; reset to 60s on state change; 30-60s re-checks when stall suspected. Every operationWait continuation MUST use afterSeq=previous nextSeq (prefer recommendedNextCall); never reuse an older cursor. Heartbeats are not meaningful progress.",
+    "On failure consume terminal runSummary first. If progress exists, wait; else use a fresh dagRerunPlan; when ineligible use same-task rerun/advance, resume, or Worker retry. A run-failed task without an open gate is terminal: do not re-advance a run-failed task. Before run start, two identical lifecycleState/blocker/revision/DAG-hash observations mean no progress: stop and report after one bounded probe; never loop identical bash/read/grep. Auto-approve only bounded writeSet inside allowedPaths, outside forbiddenPaths, with structured verification.",
+    "Continue until success, user stop, or no safe recovery remains; then stop and report failure/evidence. Never create a new task for a transient failure or replace repair-pi with direct edits.",
 ].join("\n");
 /** Compose the inspectable system prompt actually injected into Operator Chat. */
 export function composeOperatorChatSystemPrompt(input) {
@@ -678,13 +678,12 @@ export class ConsolePiRuntime {
      * closure state).
      */
     async buildResourceLoaderOptions(base = {}) {
-        const runtime = this;
         return {
             ...base,
             skillsOverride: (current) => {
                 // Synchronous override surface: use last-known prefs via a sync
                 // fail-closed path. Prefer async cache filled by ensurePrefs.
-                const prefs = runtime.cachedSkillPrefs ?? {
+                const prefs = this.cachedSkillPrefs ?? {
                     schemaVersion: 1,
                     skills: {},
                 };
@@ -904,10 +903,27 @@ export class ConsolePiRuntime {
         const customTools = await this.loadCustomTools();
         if (this.disposedSessions.has(sessionId))
             return;
+        // The SDK filters BOTH built-in tools and customTools against
+        // `tools` (allowed-tool names) inside _refreshToolRegistry:
+        //   isAllowedTool = (!allowedToolNames || allowedToolNames.has(name))
+        //                    && !excludedToolNames.has(name)
+        // Passing only OPERATOR_CHAT_BUILTIN_EXPLORE_TOOLS here silently dropped
+        // every custom operator tool (prepareDagExecution / runDag /
+        // operationWait / safe-read / git-status / ...) from the registry, so the
+        // model could only ever see bash/read/write/edit/grep/find/ls. The
+        // allowlist must cover the full tool surface that is later activated via
+        // setActiveToolsByName(computeOperatorChatActiveToolNames(session)) —
+        // operator actions + built-in explore tools + safe explore tools.
+        // Hard write/coding channels stay blocked via excludeTools below (they
+        // are removed even when present in the allowed list).
         const { session } = await this.bindings.createSessionFromServices({
             services,
             sessionManager: init.sessionManager,
-            tools: [...OPERATOR_CHAT_BUILTIN_EXPLORE_TOOLS],
+            tools: [
+                ...OPERATOR_CHAT_BUILTIN_EXPLORE_TOOLS,
+                ...OPERATOR_CHAT_ALLOWED_TOOLS,
+                ...OPERATOR_CHAT_SAFE_EXPLORE_TOOL_IDS,
+            ],
             excludeTools: [
                 "apply_patch",
                 "apply-patch",
@@ -1260,6 +1276,7 @@ export class ConsolePiRuntime {
      * session is not active — callers fail closed instead of fabricating data.
      */
     /**
+     * ConsolePiRuntime.listSlashCommands
      * Browser-safe slash command projection for UI-11.
      * Sources: current Session extension commands, prompt templates, skills.
      * Never returns prompt/skill file bodies.
@@ -1272,29 +1289,36 @@ export class ConsolePiRuntime {
                 .replace(/[A-Za-z]:\\Users\\[^\s]+/gi, "~")
                 .slice(0, 240);
         };
-        try {
-            await this.ensureSessionReady(sessionId);
-        }
-        catch {
-            return [];
-        }
+        // Fail soft at the HTTP layer: bubble readiness errors so routes can attach
+        // a compact warning while the UI keeps local Operator/Pi Web commands.
+        await this.ensureSessionReady(sessionId);
         const session = this.sessions.get(sessionId);
         if (!session)
-            return [];
-        const out = [];
-        const seen = new Set();
+            return { commands: [] };
+        // Same-name conflict priority (AC-3): extension > skill > prompt.
+        // Enum order must not decide the winner — prompt-before-skill still loses.
+        const SOURCE_RANK = {
+            extension: 0,
+            skill: 1,
+            prompt: 2,
+        };
+        const byKey = new Map();
+        const sourceWarnings = [];
         const push = (command, label, description, source) => {
             const name = command.startsWith("/") ? command : `/${command}`;
             const key = name.toLowerCase();
-            if (!key || key === "/" || seen.has(key))
+            if (!key || key === "/")
                 return;
-            seen.add(key);
-            out.push({
+            const next = {
                 command: name,
                 label: (label || name).slice(0, 80),
                 description: scrub(description),
                 source,
-            });
+            };
+            const existing = byKey.get(key);
+            if (!existing || SOURCE_RANK[source] < SOURCE_RANK[existing.source]) {
+                byKey.set(key, next);
+            }
         };
         try {
             const cmds = session.extensionRunner?.getRegisteredCommands?.() ?? [];
@@ -1305,18 +1329,20 @@ export class ConsolePiRuntime {
                 push(String(name), String(cmd.name || name), String(cmd.description || ""), "extension");
             }
         }
-        catch {
-            // non-blocking
+        catch (error) {
+            // Source isolation: keep other sources; surface compact warning (AC-3).
+            sourceWarnings.push(`extension: ${scrub(error instanceof Error ? error.message : String(error))}`);
         }
         try {
+            // Enumerate prompts before skills on purpose: priority must still let skill win.
             for (const tpl of session.promptTemplates ?? []) {
                 if (!tpl?.name)
                     continue;
                 push(String(tpl.name), String(tpl.name), String(tpl.description || ""), "prompt");
             }
         }
-        catch {
-            // non-blocking
+        catch (error) {
+            sourceWarnings.push(`prompt: ${scrub(error instanceof Error ? error.message : String(error))}`);
         }
         try {
             const services = this.serviceScopes.get(sessionId);
@@ -1331,10 +1357,16 @@ export class ConsolePiRuntime {
                 push(command, skill.name, String(skill.description || ""), "skill");
             }
         }
-        catch {
-            // non-blocking
+        catch (error) {
+            sourceWarnings.push(`skill: ${scrub(error instanceof Error ? error.message : String(error))}`);
         }
-        return out;
+        const warning = sourceWarnings.length > 0
+            ? sourceWarnings.join("; ").slice(0, 160)
+            : undefined;
+        return {
+            commands: [...byKey.values()],
+            ...(warning ? { warning } : {}),
+        };
     }
     async getRuntimeSnapshot(sessionId, options) {
         try {
@@ -1801,10 +1833,17 @@ export class ConsolePiRuntime {
             : undefined;
         assertNoWriteToolInList(OPERATOR_CHAT_ALLOWED_TOOLS);
         const customTools = await this.loadCustomTools();
+        // Same allowlist rationale as materializeSession: the SDK filters
+        // customTools against `tools`, so the allowed names must cover the full
+        // operator + explore surface or every custom tool is silently dropped.
         const { session } = await this.bindings.createSessionFromServices({
             services,
             sessionManager: init.sessionManager,
-            tools: [...OPERATOR_CHAT_BUILTIN_EXPLORE_TOOLS],
+            tools: [
+                ...OPERATOR_CHAT_BUILTIN_EXPLORE_TOOLS,
+                ...OPERATOR_CHAT_ALLOWED_TOOLS,
+                ...OPERATOR_CHAT_SAFE_EXPLORE_TOOL_IDS,
+            ],
             excludeTools: [
                 "apply_patch",
                 "apply-patch",

package/dist/worker/console/chat/routes.js

@@ -1650,14 +1650,24 @@ async function handleChatFiles(res, deps, sessionId, query) {
 }
 export async function handleChatCommands(res, deps, sessionId) {
     try {
-        const commands = typeof deps.runtime.listSlashCommands === "function"
+        const listed = typeof deps.runtime.listSlashCommands === "function"
             ? await deps.runtime.listSlashCommands(sessionId)
-            : [];
+            : { commands: [] };
+        // Partial single-source failures keep successful commands + compact warning (AC-3).
+        const commands = listed.commands ?? [];
+        const warning = typeof listed.warning === "string" && listed.warning.trim()
+            ? listed.warning.trim().slice(0, 160)
+            : undefined;
         res.statusCode = 200;
         res.setHeader("content-type", "application/json; charset=utf-8");
-        res.end(JSON.stringify({ ok: true, commands }));
+        res.end(JSON.stringify({
+            ok: true,
+            commands,
+            ...(warning ? { warning } : {}),
+        }));
     }
     catch (error) {
+        // Whole-list / readiness failures stay fail-soft with empty commands + warning.
         res.statusCode = 200;
         res.setHeader("content-type", "application/json; charset=utf-8");
         res.end(JSON.stringify({
@@ -2804,8 +2814,21 @@ export async function handleChatCompact(req, res, deps, sessionId) {
             return;
         }
     }
+    let body = {};
+    try {
+        body = await readJsonBody(req);
+    }
+    catch {
+        sendJson(res, 400, {
+            ok: false,
+            error: { code: "INVALID_INPUT", message: "invalid json body" },
+        });
+        return;
+    }
+    const rawInstructions = typeof body.instructions === "string" ? body.instructions : undefined;
+    const customInstructions = rawInstructions?.trim() || undefined;
     try {
-        const snapshot = await deps.runtime.compact(sessionId);
+        const snapshot = await deps.runtime.compact(sessionId, customInstructions);
         const event = deps.events.append(sessionId, deps.events.latestTurnId(sessionId) ?? `${sessionId}:compact`, { kind: "compact", data: snapshot });
         sendJson(res, 200, { ok: true, snapshot, eventId: event.eventId });
     }