@tea-agent/loop-agent 0.40.0-next.9 → 0.41.0-beta.1

package/dist/worker/console/routes.js

@@ -1,13 +1,22 @@
+import { createHash, randomBytes } from "node:crypto";
 import { existsSync } from "node:fs";
-import { readFile } from "node:fs/promises";
+import { readFile, rm } from "node:fs/promises";
 import path from "node:path";
 import { dispatchOperatorAction } from "./operator-actions.js";
 import { openSseResponse, parseLastEventId, writeSseEvent, } from "./operation-sse.js";
 import { probePiReadiness } from "./pi-readiness.js";
 import { buildOperatorSurfaceHealthV1 } from "./operator-surface-health.js";
 import { ROUTES } from "../observe/routes.js";
-import { evaluateMutationGate, injectConfirmationTokenScript, isMutationMethod, } from "./security.js";
+import { evaluateProtectedDownloadGate, evaluateMutationGate, injectConfirmationTokenScript, isMutationMethod, } from "./security.js";
 import { listDagRunsForRecovery } from "./resolve-dag-run-for-task.js";
+import { writeArtifactRevisionUpload } from "../../infrastructure/console/artifact-revision-store.js";
+import { ensureSecureDir } from "../../infrastructure/console/app-data.js";
+import { acquireContextExportLease, createContextExport, releaseContextExportLease, } from "../../infrastructure/console/context-export-store.js";
+import { acceptOperation } from "./operator-actions.js";
+import { recordContextTransferDiagnostic, recordContextTransferEvent, } from "./context-transfer-diagnostics.js";
+import { isDagRerunPromptOverrideEnabled } from "../../shared/dag-prompt-override.js";
+import { beginWorkerContinuation, resolveWorkerContinuationAuthority, settleWorkerContinuation, } from "../continuation/worker-continuation.js";
+import { installPiPlugin, listPiPluginVersions, listPiPlugins, uninstallPiPlugin, } from "./pi-plugins.js";
 import { pickNativeWorkspaceDirectory } from "./native-directory-picker.js";
 export function sendJson(res, status, body, extraHeaders) {
     const payload = JSON.stringify(body);
@@ -148,7 +157,516 @@ async function handleSessionPing(req, res, ctx) {
 export const INSPECT_MUTATION_ALLOWED_ACTIONS = new Set([
     "dagRerunPlan",
     "dagRerun",
+    "contextExport",
+    "artifactRevisionStage",
+    "artifactRevisionPlan",
+    "artifactRevisionExecute",
 ]);
+function evaluateConsoleCapability(req, ctx) {
+    const common = {
+        consoleOrigin: ctx.getConsoleOrigin(),
+        allowNonLoopbackAccess: ctx.allowNonLoopbackAccess === true,
+    };
+    const general = evaluateMutationGate(req, {
+        ...common,
+        cookieName: ctx.bootToken.cookieName,
+        bootToken: ctx.bootToken.value,
+        confirmationToken: ctx.bootToken.confirmationToken,
+    });
+    if (!general || !ctx.inspectBootToken)
+        return general;
+    return evaluateMutationGate(req, {
+        ...common,
+        cookieName: ctx.inspectBootToken.cookieName,
+        bootToken: ctx.inspectBootToken.value,
+        confirmationToken: ctx.inspectBootToken.confirmationToken,
+    });
+}
+function evaluateConsoleDownloadCapability(req, ctx) {
+    const common = {
+        consoleOrigin: ctx.getConsoleOrigin(),
+        allowNonLoopbackAccess: ctx.allowNonLoopbackAccess === true,
+    };
+    const general = evaluateProtectedDownloadGate(req, {
+        ...common,
+        cookieName: ctx.bootToken.cookieName,
+        bootToken: ctx.bootToken.value,
+        confirmationToken: ctx.bootToken.confirmationToken,
+    });
+    if (!general || !ctx.inspectBootToken)
+        return general;
+    return evaluateProtectedDownloadGate(req, {
+        ...common,
+        cookieName: ctx.inspectBootToken.cookieName,
+        bootToken: ctx.inspectBootToken.value,
+        confirmationToken: ctx.inspectBootToken.confirmationToken,
+    });
+}
+async function acceptContextExportOperation(input) {
+    const operator = input.ctx.operator;
+    const clientRequestId = input.clientRequestId?.trim();
+    if (!clientRequestId) {
+        return {
+            status: 400,
+            body: { ok: false, error: { code: "INVALID_INPUT", message: "clientRequestId is required" } },
+        };
+    }
+    const runId = typeof input.actionParams.runId === "string" ? input.actionParams.runId.trim() : "";
+    const nodeId = typeof input.actionParams.nodeId === "string" ? input.actionParams.nodeId.trim() : "";
+    const attempt = Number(input.actionParams.attempt ?? 1);
+    const profile = input.actionParams.profile === "raw" ? "raw" : "redacted";
+    const target = ["generic", "pi-session", "pi-handoff", "readable"].includes(String(input.actionParams.target))
+        ? input.actionParams.target
+        : "generic";
+    if (!runId || !nodeId || !Number.isInteger(attempt) || attempt < 1) {
+        return {
+            status: 400,
+            body: { ok: false, error: { code: "INVALID_INPUT", message: "runId, nodeId and positive attempt are required" } },
+        };
+    }
+    if (profile === "raw" && input.actionParams.rawAcknowledged !== true) {
+        return {
+            status: 400,
+            body: { ok: false, error: { code: "RAW_EXPORT_ACKNOWLEDGEMENT_REQUIRED", message: "raw export requires explicit acknowledgement" } },
+        };
+    }
+    const created = await operator.operations.create({
+        clientRequestId,
+        action: "contextExport",
+        actionParams: { runId, nodeId, attempt, profile, target, rawAcknowledged: profile === "raw" },
+    });
+    if (created.kind === "conflict") {
+        return {
+            status: 409,
+            body: { ok: false, error: { code: created.code, message: created.message } },
+        };
+    }
+    if (created.kind === "created") {
+        void recordContextTransferEvent({
+            appData: operator.actionContext.appData,
+            event: "context_export.planned",
+            fields: {
+                runId,
+                nodeId,
+                profile,
+                target,
+                operationId: created.operation.operationId,
+            },
+        }).catch(() => undefined);
+        queueMicrotask(() => {
+            void (async () => {
+                const startedAt = Date.now();
+                await operator.operations.update(created.operation.operationId, {
+                    state: "running",
+                    startedAt: new Date().toISOString(),
+                });
+                try {
+                    const appData = operator.actionContext.appData;
+                    if (!appData.contextExports)
+                        throw new Error("console context export root unavailable");
+                    ensureSecureDir(appData.contextExports);
+                    const incomingPath = path.join(appData.contextExports, `${randomBytes(16).toString("hex")}.incoming.zip`);
+                    await rm(incomingPath, { force: true });
+                    try {
+                        const kernel = await runKernelCommand({
+                            ctx: input.ctx,
+                            args: [
+                                "dag", "context", "export",
+                                "--run-id", runId,
+                                "--node-id", nodeId,
+                                "--attempt", String(attempt),
+                                "--target", target,
+                                "--redaction", profile,
+                                ...(profile === "raw" ? ["--acknowledge-sensitive-data"] : []),
+                                "--output", incomingPath,
+                                "--json",
+                            ],
+                        });
+                        const payload = (kernel.json ?? {});
+                        if (!kernel.ok || !payload.bundleId || !payload.bundleSha256) {
+                            throw new Error(kernelFailureMessage(kernel));
+                        }
+                        const zipBytes = await readFile(incomingPath);
+                        const exported = await createContextExport({
+                            appData,
+                            bundle: {
+                                zipBytes,
+                                manifest: {
+                                    bundleId: payload.bundleId,
+                                    bundleSha256: payload.bundleSha256,
+                                    profile,
+                                    target,
+                                },
+                            },
+                        });
+                        await recordContextTransferDiagnostic({
+                            appData: operator.actionContext.appData,
+                            event: "context-bundle.generate",
+                            dimensions: {
+                                outcome: "succeeded",
+                                target,
+                                profile,
+                                bytes: exported.bytes,
+                                durationMs: Date.now() - startedAt,
+                            },
+                        }).catch(() => undefined);
+                        await recordContextTransferEvent({
+                            appData: operator.actionContext.appData,
+                            event: "context_export.ready",
+                            fields: {
+                                runId,
+                                nodeId,
+                                exportId: exported.exportId,
+                                profile,
+                                target,
+                                bytes: exported.bytes,
+                                durationMs: Date.now() - startedAt,
+                                operationId: created.operation.operationId,
+                            },
+                        }).catch(() => undefined);
+                        await operator.operations.update(created.operation.operationId, {
+                            state: "succeeded",
+                            finishedAt: new Date().toISOString(),
+                            result: {
+                                ok: true,
+                                exportId: exported.exportId,
+                                bundleId: exported.bundleId,
+                                bundleSha256: exported.bundleSha256,
+                                bytes: exported.bytes,
+                                expiresAt: exported.expiresAt,
+                                downloadUrl: `/api/operator/v1/context-exports/${exported.exportId}/download`,
+                            },
+                        });
+                    }
+                    finally {
+                        await rm(incomingPath, { force: true }).catch(() => undefined);
+                    }
+                }
+                catch (error) {
+                    await recordContextTransferDiagnostic({
+                        appData: operator.actionContext.appData,
+                        event: "context-bundle.generate",
+                        dimensions: {
+                            outcome: "failed",
+                            target,
+                            profile,
+                            reasonCode: "CONTEXT_EXPORT_FAILED",
+                            durationMs: Date.now() - startedAt,
+                        },
+                    }).catch(() => undefined);
+                    await recordContextTransferEvent({
+                        appData: operator.actionContext.appData,
+                        event: "context_export.failed",
+                        fields: {
+                            runId,
+                            nodeId,
+                            profile,
+                            target,
+                            reasonCode: "CONTEXT_EXPORT_FAILED",
+                            durationMs: Date.now() - startedAt,
+                            operationId: created.operation.operationId,
+                        },
+                    }).catch(() => undefined);
+                    await operator.operations.update(created.operation.operationId, {
+                        state: "failed",
+                        finishedAt: new Date().toISOString(),
+                        errorCode: "CONTEXT_EXPORT_FAILED",
+                        errorMessage: error instanceof Error ? error.message : String(error),
+                    });
+                }
+            })();
+        });
+    }
+    return {
+        status: 202,
+        body: {
+            operationId: created.operation.operationId,
+            state: created.operation.state,
+            clientRequestId: created.operation.clientRequestId,
+            action: created.operation.action,
+        },
+    };
+}
+async function runKernelCommand(input) {
+    const actionContext = input.ctx.operator.actionContext;
+    const run = actionContext.runCommand ??
+        ((args, options) => actionContext.client.run(args, options));
+    return (await run(input.args, {
+        cwd: actionContext.repoRoot,
+        artifactName: `kernel-${input.args.filter((arg) => !arg.startsWith("--")).slice(0, 3).join("-").replace(/\s+/g, "-")}`,
+        expectJson: true,
+        env: { ...process.env, LOOP_CONSOLE_APP_DATA: actionContext.appData.root },
+    }));
+}
+function kernelFailureMessage(result) {
+    const stderr = result.stderr.trim();
+    if (stderr) {
+        const lastLine = stderr.split("\n").filter(Boolean).pop() ?? stderr;
+        return lastLine.slice(0, 300);
+    }
+    const stdout = result.stdout.trim();
+    if (stdout)
+        return stdout.slice(0, 300);
+    return `kernel command failed with exit code ${result.exitCode}`;
+}
+function decodeBoundedBase64(value) {
+    if (typeof value !== "string" || value.length === 0 || value.length > 14_000_000) {
+        throw new Error("candidateBase64 is required and exceeds no more than 10 MiB decoded");
+    }
+    if (!/^[A-Za-z0-9+/]*={0,2}$/.test(value) || value.length % 4 !== 0) {
+        throw new Error("candidateBase64 is invalid");
+    }
+    const bytes = Buffer.from(value, "base64");
+    if (bytes.byteLength > 10 * 1024 * 1024)
+        throw new Error("candidate exceeds 10 MiB");
+    return bytes;
+}
+function revisionProjection(revision) {
+    if (!revision)
+        return undefined;
+    return {
+        revisionId: revision.revisionId,
+        state: revision.state,
+        parent: revision.parent,
+        candidate: {
+            sha256: revision.candidate.sha256,
+            bytes: revision.candidate.bytes,
+            mediaType: revision.candidate.mediaType,
+            uploadedAt: revision.candidate.uploadedAt,
+        },
+        validation: revision.validation,
+        diff: {
+            kind: revision.diff.kind,
+            summary: revision.diff.summary,
+            truncated: revision.diff.truncated,
+        },
+        expiresAt: revision.expiresAt,
+    };
+}
+async function acceptArtifactRevisionOperation(input) {
+    const operator = input.ctx.operator;
+    const clientRequestId = input.clientRequestId?.trim();
+    if (!clientRequestId) {
+        return { status: 400, body: { ok: false, error: { code: "INVALID_INPUT", message: "clientRequestId is required" } } };
+    }
+    let candidateBytes;
+    try {
+        if (input.action === "artifactRevisionStage") {
+            candidateBytes = decodeBoundedBase64(input.actionParams.candidateBase64);
+        }
+    }
+    catch (error) {
+        return { status: 400, body: { ok: false, error: { code: "INVALID_INPUT", message: error instanceof Error ? error.message : String(error) } } };
+    }
+    const runId = typeof input.actionParams.runId === "string" ? input.actionParams.runId.trim() : "";
+    const nodeId = typeof input.actionParams.nodeId === "string" ? input.actionParams.nodeId.trim() : "";
+    const artifactId = typeof input.actionParams.artifactId === "string" ? input.actionParams.artifactId.trim() : "";
+    const revisionId = typeof input.actionParams.revisionId === "string" ? input.actionParams.revisionId.trim() : "";
+    const planHash = typeof input.actionParams.planHash === "string" ? input.actionParams.planHash.trim() : "";
+    const reason = typeof input.actionParams.reason === "string" ? input.actionParams.reason.trim() : "";
+    const mediaType = typeof input.actionParams.mediaType === "string" ? input.actionParams.mediaType.trim() : "";
+    if (!runId || !artifactId || (input.action === "artifactRevisionStage" && (!nodeId || !mediaType))) {
+        return { status: 400, body: { ok: false, error: { code: "INVALID_INPUT", message: "runId, artifactId, nodeId and mediaType are required" } } };
+    }
+    if (input.action !== "artifactRevisionStage" && !revisionId) {
+        return { status: 400, body: { ok: false, error: { code: "INVALID_INPUT", message: "revisionId is required" } } };
+    }
+    if (input.action === "artifactRevisionExecute" && (!planHash || !reason)) {
+        return { status: 400, body: { ok: false, error: { code: "INVALID_INPUT", message: "planHash and reason are required" } } };
+    }
+    let workerContinuation;
+    if (input.action !== "artifactRevisionStage") {
+        try {
+            workerContinuation = await resolveWorkerContinuationAuthority({
+                repoRoot: input.ctx.repoRoot,
+                parentDagRunId: runId,
+                revisionId,
+                allowActiveRevision: input.action === "artifactRevisionExecute",
+            });
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            return {
+                status: 422,
+                body: {
+                    ok: false,
+                    error: {
+                        code: "WORKER_CONTINUATION_AUTHORITY_MISMATCH",
+                        message,
+                    },
+                },
+            };
+        }
+    }
+    const safeActionParams = {
+        runId,
+        artifactId,
+        ...(nodeId ? { nodeId } : {}),
+        ...(revisionId ? { revisionId } : {}),
+        ...(planHash ? { planHash } : {}),
+        ...(reason ? { reason } : {}),
+        ...(mediaType ? { mediaType } : {}),
+        ...(candidateBytes
+            ? { candidateSha256: createHash("sha256").update(candidateBytes).digest("hex"), candidateBytes: candidateBytes.byteLength }
+            : {}),
+        ...(workerContinuation
+            ? { workerContinuation: workerContinuation.authority }
+            : {}),
+    };
+    const appData = operator.actionContext.appData;
+    if (!appData.artifactRevisions) {
+        return { status: 503, body: { ok: false, error: { code: "INTERNAL_ERROR", message: "console artifact revision root unavailable" } } };
+    }
+    let cliArgs;
+    if (input.action === "artifactRevisionStage") {
+        const candidateSha256 = safeActionParams.candidateSha256;
+        cliArgs = [
+            "dag", "artifact", "revision", "stage",
+            "--run-id", runId,
+            "--node-id", nodeId,
+            "--artifact-id", artifactId,
+            "--candidate-upload", candidateSha256,
+            "--request-id", `console-${clientRequestId}`,
+            "--json",
+        ];
+    }
+    else if (input.action === "artifactRevisionPlan") {
+        cliArgs = [
+            "dag", "rerun",
+            "--run-id", runId,
+            "--artifact-revision", revisionId,
+            "--plan", "--json",
+        ];
+    }
+    else {
+        cliArgs = [
+            "dag", "rerun",
+            "--run-id", runId,
+            "--artifact-revision", revisionId,
+            "--plan-hash", planHash,
+            "--request-id", `console-${clientRequestId}`,
+            "--reason", reason,
+            "--json",
+        ];
+    }
+    if (workerContinuation) {
+        cliArgs.push("--worker-continuation", JSON.stringify(workerContinuation.authority));
+    }
+    let admittedOperationId;
+    const accepted = await acceptOperation(operator.actionContext, {
+        action: input.action,
+        actionParams: safeActionParams,
+        clientRequestId,
+        cliArgs,
+        ...(input.action === "artifactRevisionStage" ||
+            (input.action === "artifactRevisionExecute" && workerContinuation)
+            ? {
+                prepare: async () => {
+                    if (input.action === "artifactRevisionStage") {
+                        await writeArtifactRevisionUpload({
+                            appData,
+                            candidateSha256: safeActionParams.candidateSha256,
+                            candidateBytes: candidateBytes,
+                        });
+                    }
+                    else if (workerContinuation && admittedOperationId) {
+                        await operator.actionContext.operations.update(admittedOperationId, { dagRunId: workerContinuation.authority.childWorkerRunId });
+                        await beginWorkerContinuation({
+                            repoRoot: input.ctx.repoRoot,
+                            resolved: workerContinuation,
+                            operationId: admittedOperationId,
+                            client: operator.actionContext.client,
+                        });
+                    }
+                    else {
+                        throw new Error("Worker continuation operation identity is unavailable");
+                    }
+                },
+                prepareFailure: (error) => {
+                    const message = error instanceof Error ? error.message : String(error);
+                    if (input.action === "artifactRevisionExecute") {
+                        const conflict = message.includes("attempt-lease-conflict") || message.includes("state-conflict");
+                        return {
+                            status: conflict ? 409 : 422,
+                            errorCode: conflict
+                                ? "WORKER_CONTINUATION_LEASE_CONFLICT"
+                                : "WORKER_CONTINUATION_AUTHORITY_MISMATCH",
+                            body: {
+                                ok: false,
+                                error: {
+                                    code: conflict
+                                        ? "WORKER_CONTINUATION_LEASE_CONFLICT"
+                                        : "WORKER_CONTINUATION_AUTHORITY_MISMATCH",
+                                    message,
+                                },
+                            },
+                        };
+                    }
+                    const stableCode = [
+                        "ARTIFACT_REVISION_QUOTA_EXCEEDED",
+                        "ARTIFACT_REVISION_DRIFT",
+                        "ARTIFACT_REVISION_PATH_INVALID",
+                    ].find((code) => message.startsWith(code));
+                    void recordContextTransferEvent({
+                        appData,
+                        event: "artifact_revision.rejected",
+                        fields: {
+                            runId,
+                            nodeId,
+                            reasonCode: stableCode ?? "INVALID_INPUT",
+                        },
+                    }).catch(() => undefined);
+                    return {
+                        status: stableCode ? 422 : 400,
+                        errorCode: stableCode ?? "INVALID_INPUT",
+                        body: { ok: false, error: { code: stableCode ?? "INVALID_INPUT", message } },
+                    };
+                },
+            }
+            : {}),
+        onAdmitted: (operation) => {
+            admittedOperationId = operation.operationId;
+            if (input.action === "artifactRevisionStage") {
+                return recordContextTransferEvent({
+                    appData,
+                    event: "artifact_revision.upload_started",
+                    fields: {
+                        runId,
+                        nodeId,
+                        operationId: operation.operationId,
+                    },
+                }).catch(() => undefined);
+            }
+            if (input.action === "artifactRevisionExecute") {
+                return recordContextTransferEvent({
+                    appData,
+                    event: "artifact_rerun.execute_requested",
+                    fields: {
+                        runId,
+                        revisionId,
+                        operationId: operation.operationId,
+                    },
+                }).catch(() => undefined);
+            }
+            return undefined;
+        },
+        ...(input.action === "artifactRevisionExecute" && workerContinuation
+            ? {
+                beforeTerminal: (operation, state, info) => settleWorkerContinuation({
+                    repoRoot: input.ctx.repoRoot,
+                    resolved: workerContinuation,
+                    operation,
+                    state,
+                    info,
+                }),
+            }
+            : {}),
+    });
+    if (accepted.kind === "error") {
+        return { status: accepted.status, body: accepted.body };
+    }
+    return { status: accepted.status, body: accepted.body };
+}
 async function handleCreateOperation(req, res, ctx) {
     if (!ctx.operator) {
         sendJson(res, 503, {
@@ -194,7 +712,7 @@ async function handleCreateOperation(req, res, ctx) {
     }
     let body;
     try {
-        body = (await readJsonBody(req));
+        body = (await readJsonBody(req, 15 * 1024 * 1024));
     }
     catch (error) {
         sendJson(res, 400, {
@@ -221,6 +739,27 @@ async function handleCreateOperation(req, res, ctx) {
         });
         return;
     }
+    if (action === "contextExport") {
+        const accepted = await acceptContextExportOperation({
+            ctx,
+            actionParams,
+            clientRequestId,
+        });
+        sendJson(res, accepted.status, accepted.body);
+        return;
+    }
+    if (action === "artifactRevisionStage" ||
+        action === "artifactRevisionPlan" ||
+        action === "artifactRevisionExecute") {
+        const accepted = await acceptArtifactRevisionOperation({
+            ctx,
+            action,
+            actionParams,
+            clientRequestId,
+        });
+        sendJson(res, accepted.status, accepted.body);
+        return;
+    }
     const result = await dispatchOperatorAction(ctx.operator.actionContext, {
         action,
         actionParams,
@@ -364,6 +903,34 @@ async function handleOperationEvents(req, res, ctx, operationId) {
  * Path-escape-safe static file serve for Console SPA.
  * Sets boot capability cookie on HTML responses.
  */
+/**
+ * Inject the general Console confirmation token into HTML, and additionally
+ * the scoped inspect mutation token when the experimental prompt-override
+ * switch is enabled and inspect credentials are available. The standalone
+ * /inspect/ document canonicalizes into the Console SPA (/#/inspect...), so
+ * the SPA must carry the scoped inspect token for the export/rerun tab to be
+ * rendered by the mounted inspect workspace.
+ */
+function injectScopedInspectTokens(raw, ctx) {
+    let content = injectConfirmationTokenScript(raw, ctx.bootToken.confirmationToken);
+    if (isDagRerunPromptOverrideEnabled() && ctx.inspectBootToken) {
+        content = injectConfirmationTokenScript(content, ctx.inspectBootToken.confirmationToken, "__INSPECT_MUTATION_TOKEN__");
+    }
+    return content;
+}
+/**
+ * HTML response Set-Cookie headers for the Console SPA. The general boot
+ * cookie is always set; when the experimental prompt-override switch is
+ * enabled the scoped inspect cookie is set alongside so the hosted inspect
+ * workspace (mounted inside the SPA) can authenticate its allowlisted
+ * mutation requests.
+ */
+function scopedSetCookieHeaders(ctx) {
+    if (isDagRerunPromptOverrideEnabled() && ctx.inspectBootToken) {
+        return [ctx.bootToken.setCookieHeader, ctx.inspectBootToken.setCookieHeader];
+    }
+    return ctx.bootToken.setCookieHeader;
+}
 export async function serveConsoleStatic(req, res, ctx) {
     const url = new URL(req.url ?? "/", "http://localhost");
     let pathname = decodeURIComponent(url.pathname);
@@ -382,11 +949,14 @@ export async function serveConsoleStatic(req, res, ctx) {
         // SPA fallback for non-file routes
         const indexPath = path.join(resolvedStatic, "index.html");
         if (existsSync(indexPath) && !pathname.includes(".")) {
-            const html = injectConfirmationTokenScript(await readFile(indexPath), ctx.bootToken.confirmationToken);
+            const html = injectScopedInspectTokens(await readFile(indexPath), ctx);
             res.writeHead(200, {
                 "Content-Type": "text/html; charset=utf-8",
                 "Content-Length": html.byteLength,
-                "Set-Cookie": ctx.bootToken.setCookieHeader,
+                // Boot capability tokens are baked into the document; a cached
+                // page from a previous Console process makes every mutation 403.
+                "Cache-Control": "no-store",
+                "Set-Cookie": scopedSetCookieHeaders(ctx),
             });
             res.end(html);
             return;
@@ -397,14 +967,15 @@ export async function serveConsoleStatic(req, res, ctx) {
     const raw = await readFile(resolvedFile);
     const contentType = contentTypeFor(pathname);
     const content = contentType.startsWith("text/html")
-        ? injectConfirmationTokenScript(raw, ctx.bootToken.confirmationToken)
+        ? injectScopedInspectTokens(raw, ctx)
         : raw;
     const headers = {
         "Content-Type": contentType,
         "Content-Length": content.byteLength,
     };
     if (contentType.startsWith("text/html")) {
-        headers["Set-Cookie"] = ctx.bootToken.setCookieHeader;
+        headers["Cache-Control"] = "no-store";
+        headers["Set-Cookie"] = scopedSetCookieHeaders(ctx);
     }
     res.writeHead(200, headers);
     res.end(content);
@@ -462,6 +1033,95 @@ async function handleNightAuxTickerPost(req, res, ctx) {
     const status = ticker.setEnabled(body.enabled);
     sendJson(res, 200, { ok: true, ticker: status });
 }
+async function handlePiPluginInstall(req, res) {
+    let body;
+    try {
+        body = (await readJsonBody(req));
+    }
+    catch (error) {
+        sendJson(res, 400, {
+            ok: false,
+            error: {
+                code: "INVALID_INPUT",
+                message: error instanceof Error ? error.message : String(error),
+            },
+        });
+        return;
+    }
+    const name = typeof body.name === "string" ? body.name.trim() : "";
+    if (!name) {
+        sendJson(res, 400, {
+            ok: false,
+            error: { code: "INVALID_INPUT", message: "missing package name" },
+        });
+        return;
+    }
+    const version = typeof body.version === "string" ? body.version.trim() : undefined;
+    try {
+        const result = await installPiPlugin(name, version);
+        if (!result.ok) {
+            sendJson(res, 400, {
+                ok: false,
+                error: { code: "INSTALL_FAILED", message: result.error },
+            });
+            return;
+        }
+        sendJson(res, 200, { ok: true });
+    }
+    catch (error) {
+        sendJson(res, 500, {
+            ok: false,
+            error: {
+                code: "INTERNAL_ERROR",
+                message: error instanceof Error ? error.message : String(error),
+            },
+        });
+    }
+}
+async function handlePiPluginUninstall(req, res) {
+    let body;
+    try {
+        body = (await readJsonBody(req));
+    }
+    catch (error) {
+        sendJson(res, 400, {
+            ok: false,
+            error: {
+                code: "INVALID_INPUT",
+                message: error instanceof Error ? error.message : String(error),
+            },
+        });
+        return;
+    }
+    const name = typeof body.name === "string" ? body.name.trim() : "";
+    if (!name) {
+        sendJson(res, 400, {
+            ok: false,
+            error: { code: "INVALID_INPUT", message: "missing package name" },
+        });
+        return;
+    }
+    try {
+        const result = await uninstallPiPlugin(name);
+        if (!result.ok) {
+            sendJson(res, 400, {
+                ok: false,
+                error: { code: "UNINSTALL_FAILED", message: result.error },
+            });
+            return;
+        }
+        sendJson(res, 200, { ok: true });
+    }
+    catch (error) {
+        sendJson(res, 500, {
+            ok: false,
+            error: {
+                code: "INTERNAL_ERROR",
+                message: error instanceof Error ? error.message : String(error),
+            },
+        });
+    }
+}
 export async function handleConsoleOperatorRequest(req, res, ctx) {
     const method = (req.method ?? "GET").toUpperCase();
     const url = new URL(req.url ?? "/", "http://localhost");
@@ -491,10 +1151,79 @@ export async function handleConsoleOperatorRequest(req, res, ctx) {
         await handleListOperations(req, res, ctx);
         return true;
     }
+    const contextDownloadMatch = pathname.match(/^\/api\/operator\/v1\/context-exports\/([a-f0-9]{32})\/download$/);
+    if (method === "GET" && contextDownloadMatch) {
+        if (!ctx.operator) {
+            sendJson(res, 503, { ok: false, error: { code: "INTERNAL_ERROR", message: "operator runtime unavailable" } });
+            return true;
+        }
+        const failure = evaluateConsoleDownloadCapability(req, ctx);
+        if (failure) {
+            sendJson(res, failure.status, { ok: false, error: { code: failure.code, message: failure.message } });
+            return true;
+        }
+        try {
+            const exportId = contextDownloadMatch[1];
+            const leased = await acquireContextExportLease({
+                appData: ctx.operator.actionContext.appData,
+                exportId,
+            });
+            res.writeHead(200, {
+                "Content-Type": "application/zip",
+                "Content-Length": leased.bytes.byteLength,
+                "Content-Disposition": `attachment; filename="context-${leased.record.bundleId}.zip"`,
+                "Cache-Control": "no-store",
+                "X-Content-Type-Options": "nosniff",
+            });
+            res.end(leased.bytes);
+            await releaseContextExportLease({
+                appData: ctx.operator.actionContext.appData,
+                exportId,
+                leaseId: leased.leaseId,
+            }).catch(() => undefined);
+        }
+        catch (error) {
+            if (res.headersSent)
+                return true;
+            sendJson(res, 404, {
+                ok: false,
+                error: { code: "CONTEXT_EXPORT_UNAVAILABLE", message: error instanceof Error ? error.message : String(error) },
+            });
+        }
+        return true;
+    }
     if (method === "GET" && pathname === "/api/operator/v1/night-aux-ticker") {
         await handleNightAuxTickerGet(req, res, ctx);
         return true;
     }
+    if (method === "GET" && pathname === "/api/operator/v1/pi-plugins") {
+        sendJson(res, 200, { ok: true, data: listPiPlugins() });
+        return true;
+    }
+    if (method === "GET" &&
+        pathname === "/api/operator/v1/pi-plugins/versions") {
+        const name = url.searchParams.get("name")?.trim() ?? "";
+        if (!name) {
+            sendJson(res, 400, {
+                ok: false,
+                error: { code: "INVALID_INPUT", message: "missing name" },
+            });
+            return true;
+        }
+        const result = await listPiPluginVersions(name);
+        if (!result.ok) {
+            sendJson(res, 400, {
+                ok: false,
+                error: { code: "FETCH_FAILED", message: result.error },
+            });
+            return true;
+        }
+        sendJson(res, 200, {
+            ok: true,
+            data: { versions: result.versions, latest: result.latest },
+        });
+        return true;
+    }
     const opMatch = pathname.match(/^\/api\/operator\/v1\/operations\/([^/]+)(?:\/(events))?$/);
     if (opMatch) {
         const operationId = decodeURIComponent(opMatch[1]);
@@ -526,6 +1255,14 @@ export async function handleConsoleOperatorRequest(req, res, ctx) {
             await handleNightAuxTickerPost(req, res, ctx);
             return true;
         }
+        if (method === "POST" && pathname === "/api/operator/v1/pi-plugins/install") {
+            await handlePiPluginInstall(req, res);
+            return true;
+        }
+        if (method === "POST" && pathname === "/api/operator/v1/pi-plugins/uninstall") {
+            await handlePiPluginUninstall(req, res);
+            return true;
+        }
         // Allow other operator POSTs only under known routes; unknown → 404
         sendJson(res, 404, {
             ok: false,
@@ -587,9 +1324,11 @@ function pendingReadinessSummary(inspectReady) {
  *   POST   /api/operator/v1/workspaces/pick        — host native folder chooser
  *   POST   /api/operator/v1/workspaces             — body { "name": "<label>",
  *                                                     "directoryPath": "<dir>" }
+ *   PATCH  /api/operator/v1/workspaces/:workspaceId — body { "beforeWorkspaceId":
+ *                                                     "<id>" | null }
  *   DELETE /api/operator/v1/workspaces/:workspaceId — soft remove (restore on re-add)
  *
- * POST/DELETE are mutations and pass the Console mutation gate. GET carries no
+ * POST/PATCH/DELETE are mutations and pass the Console mutation gate. GET carries no
  * workspace selection parameter.
  *
  * AC-006 (2026-08-23): GET is NON-BLOCKING — registry + process-level
@@ -598,8 +1337,53 @@ function pendingReadinessSummary(inspectReady) {
  * requests. A hanging probe can never delay the 200 list.
  */
 export async function handleWorkspaceRoutes(req, res, registry, deps, url, pathname, method, readinessDeps) {
+    if (method === "GET" &&
+        pathname === "/api/operator/v1/workspaces/events") {
+        res.writeHead(200, {
+            "Content-Type": "text/event-stream; charset=utf-8",
+            "Cache-Control": "no-cache, no-transform",
+            Connection: "keep-alive",
+            "X-Accel-Buffering": "no",
+        });
+        const sendRevision = (event, revision) => {
+            if (res.destroyed || res.writableEnded)
+                return;
+            res.write(`id: ${revision}\nevent: ${event}\ndata: ${JSON.stringify({ schemaVersion: 1, revision })}\n\n`);
+        };
+        let baselineSent = false;
+        let pendingRevision = 0;
+        const unsubscribe = registry.subscribe((revision) => {
+            if (!baselineSent)
+                pendingRevision = Math.max(pendingRevision, revision);
+            else
+                sendRevision("workspace_registry_changed", revision);
+        });
+        const initial = await registry.snapshotVisible();
+        sendRevision("workspace_registry_ready", initial.revision);
+        baselineSent = true;
+        if (pendingRevision > initial.revision) {
+            sendRevision("workspace_registry_changed", pendingRevision);
+        }
+        const heartbeat = setInterval(() => {
+            if (!res.destroyed && !res.writableEnded)
+                res.write(": keepalive\n\n");
+        }, 15_000);
+        heartbeat.unref();
+        let closed = false;
+        const close = () => {
+            if (closed)
+                return;
+            closed = true;
+            clearInterval(heartbeat);
+            unsubscribe();
+        };
+        req.once("aborted", close);
+        res.once("close", close);
+        return;
+    }
     if (method === "GET" && pathname === "/api/operator/v1/workspaces") {
-        const records = await registry.listVisible();
+        const snapshot = await registry.snapshotVisible();
+        const records = snapshot.workspaces;
         const inspectReady = readinessDeps.inspectReady;
         const readinessCache = readinessDeps.readinessCache ?? defaultWorkspaceReadinessCache;
         const workspaces = records.map((record) => {
@@ -611,6 +1395,7 @@ export async function handleWorkspaceRoutes(req, res, registry, deps, url, pathn
                 repoFingerprint: record.repoFingerprint,
                 createdAt: record.createdAt,
                 lastAccessedAt: record.lastAccessedAt,
+                sessionIds: record.sessionIds,
                 readiness: cached
                     ? {
                         state: cached.state,
@@ -622,7 +1407,8 @@ export async function handleWorkspaceRoutes(req, res, registry, deps, url, pathn
         // Respond FIRST, then refresh readiness in the background (AC-006).
         sendJson(res, 200, {
             ok: true,
-            schemaVersion: 1,
+            schemaVersion: 2,
+            revision: snapshot.revision,
             workspaces,
         });
         void Promise.all(records.map(async (record) => {
@@ -789,8 +1575,73 @@ export async function handleWorkspaceRoutes(req, res, registry, deps, url, pathn
         });
         return;
     }
-    const removeMatch = pathname.match(/^\/api\/operator\/v1\/workspaces\/([^/]+)$/);
-    if (method === "DELETE" && removeMatch) {
+    const workspaceMatch = pathname.match(/^\/api\/operator\/v1\/workspaces\/([^/]+)$/);
+    if (method === "PATCH" && workspaceMatch) {
+        const failure = evaluateMutationGate(req, {
+            cookieName: deps.bootToken.cookieName,
+            bootToken: deps.bootToken.value,
+            confirmationToken: deps.bootToken.confirmationToken,
+            consoleOrigin: deps.getConsoleOrigin(),
+            allowNonLoopbackAccess: deps.allowNonLoopbackAccess,
+        });
+        if (failure) {
+            sendJson(res, failure.status, {
+                ok: false,
+                error: { code: failure.code, message: failure.message },
+            });
+            return;
+        }
+        let body;
+        try {
+            body = (await readJsonBody(req));
+        }
+        catch (error) {
+            sendJson(res, 400, {
+                ok: false,
+                error: {
+                    code: "INVALID_INPUT",
+                    message: error instanceof Error ? error.message : String(error),
+                },
+            });
+            return;
+        }
+        if (body.beforeWorkspaceId !== null &&
+            typeof body.beforeWorkspaceId !== "string") {
+            sendJson(res, 400, {
+                ok: false,
+                error: {
+                    code: "INVALID_INPUT",
+                    message: "beforeWorkspaceId must be a workspace id or null",
+                },
+            });
+            return;
+        }
+        const workspaceId = decodeURIComponent(workspaceMatch[1]);
+        const beforeWorkspaceId = typeof body.beforeWorkspaceId === "string"
+            ? body.beforeWorkspaceId
+            : null;
+        const reordered = await registry.insertBefore(workspaceId, beforeWorkspaceId);
+        if (!reordered.ok) {
+            sendJson(res, 404, {
+                ok: false,
+                error: {
+                    code: reordered.code,
+                    message: reordered.code === "ANCHOR_NOT_FOUND"
+                        ? `unknown workspace anchor: ${beforeWorkspaceId}`
+                        : `unknown workspace: ${workspaceId}`,
+                },
+            });
+            return;
+        }
+        sendJson(res, 200, {
+            ok: true,
+            workspaceId,
+            beforeWorkspaceId,
+            changed: reordered.changed,
+        });
+        return;
+    }
+    if (method === "DELETE" && workspaceMatch) {
         const failure = evaluateMutationGate(req, {
             cookieName: deps.bootToken.cookieName,
             bootToken: deps.bootToken.value,
@@ -805,7 +1656,7 @@ export async function handleWorkspaceRoutes(req, res, registry, deps, url, pathn
             });
             return;
         }
-        const workspaceId = decodeURIComponent(removeMatch[1]);
+        const workspaceId = decodeURIComponent(workspaceMatch[1]);
         const removed = await registry.remove(workspaceId);
         if (!removed) {
             sendJson(res, 404, {