@tea-agent/loop-agent 0.41.1-beta.0 → 0.41.1

package/dist/task/source-prepare/fragment-inventory.js

@@ -175,11 +175,8 @@ export function splitDocumentIntoFragments(doc) {
         const explicitSectionAc = matchExplicitAcHeading(lastHeadingSegment);
         const sectionKind = classifySectionHeading(section.headingPath);
         const effectiveKind = explicitSectionAc ? "acceptance" : sectionKind;
-        // V4 显式 AC 标题行已在下方入口 emit（explicitSectionAc 分支）；正文循环
-        // 必须从标题行的下一行开始，否则同一标题行会被正文循环的 heading 分支
-        // 再次 emit，产生结构性 duplicate（每个 AC 标题式片段出现两次）。
         const bodyStart = section.headingPath
-            ? section.startLine + 1
+            ? section.startLine + (explicitSectionAc ? 0 : 1)
             : section.startLine;
         const bodyEnd = section.endLine;
         const bodyLines = lines.slice(Math.max(0, bodyStart - 1), Math.min(bodyEnd, lines.length));
@@ -441,17 +438,14 @@ export function buildFragmentInventory(input) {
             disposition = "non-goal";
         }
         else {
-            // Non-goal/constraint/acceptance/objective sections are classified
-            // above. An "other" section (背景 / 概述 / 说明 …) is contextual
-            // description, not an executable requirement: even when it mentions
-            // implementation verbs ("需要", "渲染", "组件"), it must not be
-            // promoted to a high-risk unresolved executable fragment — that
-            // blocks PRDs whose 背景 prose happens to use such words (merge
-            // regression: "需要一个小组件" was flagged executable via 需要).
-            // Explicit AC ids are already handled by the branches above, so
-            // this branch is always contextual.
-            disposition = "context-only";
-            reason = "context-only fragment; excluded from canonical requirement coverage";
+            const executable = EXECUTABLE_HINT_RE.test(text);
+            disposition = executable ? "unresolved" : "context-only";
+            if (disposition === "unresolved") {
+                reason = "executable fragment outside recognized requirement/acceptance section";
+            }
+            else {
+                reason = "context-only fragment; excluded from canonical requirement coverage";
+            }
         }
         const priorId = seenText.get(text);
         if (priorId) {

package/dist/task/source-prepare/prepare.js

@@ -5,9 +5,6 @@ import { ContractMutationError, applyTaskContract, logicalRevisionForState, obse
 import { TASK_CONTRACT_DRAFT_SCHEMA_VERSION } from "../contract/constants.js";
 import { getTaskContractPaths } from "../contract/paths.js";
 import { loadTaskConfig } from "../runtime.js";
-import { discoverFrontendProjectCapability, resolveFrontendSpecRootAliases, } from "../frontend-project-capability.js";
-import { classifyTaskDemand } from "../task-demand-routing.js";
-import { DEFAULT_FRONTEND_SPEC_ROOTS, extractDeclaredFrontendSpecRoots, } from "../../shared/openspec-spec.js";
 import { buildPrepareDraft } from "./build-draft.js";
 import { hasBlockingGaps, hasBlockingRisks, isFreshLegacyUnversioned, listPrepareGaps, appendLedgerGaps, } from "./completeness.js";
 import { detectProductArtifactMeta, isIntakeSoftGapCode, } from "./artifact-meta.js";
@@ -684,7 +681,7 @@ export async function prepareTaskSource(input) {
             facts = importedFacts ?? mergedSupplemental;
         }
     }
-    let built = buildPrepareDraft({
+    const built = buildPrepareDraft({
         taskId,
         existingTaskConfig,
         baseDraft,
@@ -692,91 +689,6 @@ export async function prepareTaskSource(input) {
         flags: input.flags,
         references,
     });
-    // Resolve an implicit frontend workflow before the first managed contract is
-    // projected. Explicit taskKind (including explicit standard) remains a hard
-    // contract; only a standard task with strong source/path/project evidence may
-    // be promoted here. This keeps task.json, contract.json, and the first DAG
-    // generation on the same workflow without a later hash-changing re-projection.
-    if (built.draft.taskKind === "standard" &&
-        !built.draft.taskKindExplicit) {
-        const routingRequirement = [
-            ...(sourceIntegrity?.documents ?? [])
-                .map((document) => document.content)
-                .filter((content) => Boolean(content?.trim())),
-            ...(input.intent.kind === "facts" && input.intent.text
-                ? [input.intent.text]
-                : []),
-            built.draft.requirement.objective,
-            ...built.draft.requirement.scope,
-            ...built.draft.requirement.acceptanceCriteria.map((item) => item.text),
-        ].join("\n");
-        let frontendProject;
-        try {
-            frontendProject = await discoverFrontendProjectCapability(repoRoot);
-        }
-        catch {
-            // Capability discovery is advisory for routing. A failed probe must not
-            // turn an otherwise valid standard contract preparation into an error.
-        }
-        const classification = classifyTaskDemand({
-            title: built.draft.title,
-            requirementMarkdown: routingRequirement,
-            allowedPaths: built.draft.constraints.allowedPaths,
-            frontendProject: frontendProject
-                ? {
-                    framework: frontendProject.framework,
-                    evidencePaths: frontendProject.evidencePaths,
-                }
-                : undefined,
-        });
-        if (classification.kind === "frontend") {
-            built = buildPrepareDraft({
-                taskId,
-                existingTaskConfig,
-                baseDraft,
-                facts,
-                flags: {
-                    ...input.flags,
-                    taskKind: "frontend-implementation",
-                },
-                references,
-            });
-        }
-    }
-    // A user can explicitly name a non-default normative directory in the task
-    // prompt (for example “规范目录 `design-system`”). Freeze that root into
-    // the managed task config before the DAG exists; normal DAG selection consumes
-    // the already-resolved task kind instead of mutating task.json later.
-    if (built.draft.taskKind === "frontend-implementation") {
-        // An imported PRD is materialized under sourceIntegrity rather than copied
-        // into intent.text. Use both inputs so a `--prd` invocation can declare a
-        // task-owned spec root just like supplemental free-form text can.
-        const sourceText = [
-            ...(sourceIntegrity?.documents ?? []).flatMap((document) => document.content ? [document.content] : []),
-            ...(input.intent.kind === "facts" && input.intent.text
-                ? [input.intent.text]
-                : []),
-        ].join("\n");
-        const inferredRoots = extractDeclaredFrontendSpecRoots(sourceText);
-        if (inferredRoots.length > 0) {
-            const current = existingTaskConfig?.frontendOpenspec;
-            const configuredRoots = current?.specRoots ?? [...DEFAULT_FRONTEND_SPEC_ROOTS];
-            // Include roots declared by this source before resolving physical-target
-            // aliases. A newly declared root may itself be a symlink (for example
-            // `project-specs -> .../ai_doc`), so resolving aliases against only the
-            // previous config cannot map `ai_doc/rules.md` back to project-specs.
-            const provisionalRoots = [
-                ...new Set([...configuredRoots, ...inferredRoots]),
-            ].sort();
-            const aliases = await resolveFrontendSpecRootAliases(repoRoot, provisionalRoots);
-            const aliasMap = new Map(aliases.map(({ alias, logicalRoot }) => [alias, logicalRoot]));
-            built.draft.frontendOpenspec = {
-                policy: current?.policy ?? "cited",
-                specRoots: [...new Set([...configuredRoots, ...inferredRoots.map((root) => aliasMap.get(root) ?? root)])].sort(),
-                requiredReadPaths: current?.requiredReadPaths ?? [],
-            };
-        }
-    }
     const { gaps, risks } = listPrepareGaps({
         draft: built.draft,
         state,

package/dist/task/source-prepare/semantic-intake.js

@@ -457,12 +457,8 @@ async function buildPrompt(input) {
         "Do NOT invent product behavior that is not supported by the documents.",
         "You MAY recommend an optional engineering block when the repo layout hint supports it:",
         "- allowedPaths / forbiddenPaths as minimal precise globs (e.g. source/packages/**/*.test.ts)",
-        "- verifyCommands as real package scripts (e.g. pnpm -C source test); when acceptance criteria name a specific test file to run (e.g. 定向 vitest（test/.../xxx.test.ts）), emit the corresponding targeted command as its own entry (e.g. npx vitest run test/.../xxx.test.ts) instead of only the full-suite script — targeted commands are what a frontend implementation plan maps to behavior verification targets",
-        "- taskKind when clearly implied, choosing from {standard / frontend-implementation / frontend-test / backend-test / knowledge-sync}:",
-        "  - frontend-implementation: the deliverable is a frontend component/page/UI feature (even when it ships with its own tests)",
-        "  - frontend-test: the deliverable is a browser/UI automation test suite for EXISTING functionality (no implementation work)",
-        "  - backend-test: pytest/backend test suite; standard: general repo implementation",
-        "  A task that IMPLEMENTS a component and adds tests for it is frontend-implementation, never frontend-test.",
+        "- verifyCommands as real package scripts (e.g. pnpm -C source test)",
+        "- taskKind when clearly implied (backend-test / frontend-test / standard / …)",
         "Prefer smallest correct write boundary; do not invent product paths that are not in the layout hint.",
         "Do NOT rewrite or suggest editing the original PRD files.",
         "Prefer explicit text; use provenance derived for rephrasing; use inferred only when clearly implied — if you must invent ACs, leave acceptanceCriteria empty so the system can stop for clarification.",

package/dist/task/source-references.js

@@ -22,18 +22,6 @@ function slugifyName(value) {
         .replace(/-{2,}/g, "-");
     return slug || "requirement";
 }
-/** Stable identity of a manifest document for change detection. Timestamps and
- * byte sizes are excluded: identical content re-imported later must not appear
- * "changed" (the canonical hash includes manifest bytes). */
-function documentIdentity(doc) {
-    return `${doc.role}|${doc.name}|${doc.materializedPath}|${doc.sha256}`;
-}
-function sameDocumentSet(left, right) {
-    if (left.length !== right.length)
-        return false;
-    const rightIds = new Set(right.map(documentIdentity));
-    return left.every((doc) => rightIds.has(documentIdentity(doc)));
-}
 function ensureUniqueReferenceName(existing, baseName, extension) {
     const used = new Set(existing);
     const candidate = `${baseName}${extension}`;
@@ -161,19 +149,10 @@ export async function importPrdDocument(input) {
     const documents = [...(existingManifest?.documents ?? [])].filter((entry) => entry.materializedPath !== materializedRelativePath);
     documents.push(document);
     documents.sort((left, right) => left.materializedPath.localeCompare(right.materializedPath));
-    // Keep `updatedAt` stable across re-imports of the same content: the
-    // canonical contract hash includes the manifest bytes, so a fresh
-    // timestamp on every identical re-import would make the observed
-    // canonical hash drift and fail task verification. Only bump it when the
-    // document set actually changed (a new/changed materialized file).
-    const documentSetChanged = !existingManifest ||
-        !sameDocumentSet(existingManifest.documents, documents);
     const manifest = {
         schemaVersion: 1,
         taskId: input.taskId,
-        updatedAt: documentSetChanged
-            ? importedAt
-            : (existingManifest?.updatedAt ?? importedAt),
+        updatedAt: importedAt,
         documents,
     };
     await writeSourceManifest(paths.sourceDir, manifest);

package/dist/worker/console/chat/chat-ui-policy.js

@@ -19,7 +19,9 @@ export function shouldPlayCompletionSound(input) {
 export function copyTextForMessage(input) {
     return input.code ?? input.text;
 }
-/** Empty sandbox means scripts, same-origin access, navigation and popups are denied. */
+/** Project HTML may run its own UI scripts, but remains an opaque origin with
+ * forms, popups and top-level navigation denied by omission. */
+export const HTML_PREVIEW_SANDBOX = "allow-scripts";
 export function previewSandbox() {
-    return { sandbox: "" };
+    return { sandbox: HTML_PREVIEW_SANDBOX };
 }

package/dist/worker/console/chat/pi-runtime.js

@@ -26,7 +26,7 @@
  * `createDefaultPiSdkBindings()`.
  */
 import { createHash, randomBytes } from "node:crypto";
-import { access } from "node:fs/promises";
+import { access, stat } from "node:fs/promises";
 import path from "node:path";
 import { extractAssistantContentBlocks, extractAssistantText, isAssistantSdkMessage, } from "./assistant-content.js";
 import { parseProviderError, } from "./provider-error.js";
@@ -67,10 +67,11 @@ export const OPERATOR_CHAT_SYSTEM_PROMPT_BASE = [
     "You are General Operator Chat.",
     "Use operator tools first (dagReport, dagRerunPlan, dagRerun). Pi read/write/edit/bash/grep/find/ls are available; obey repository AGENTS.md. apply_patch, full-tools, shell and coding-chat are denied. Prefer safe-read/safe-grep for probes.",
     "No harness and asked to init: `loop-agent init instructions --repo-root .`, then `loop-agent init --repo-root . --profile full --merge`; verify with doctor, inspect and docs audit. Updates: `loop-agent init upgrade --repo-root . --json` until stable; `loop-agent init check-update` is read-only.",
-    "Long DAGs: prepareDagExecution → runDag → operationId. Never foreground-Bash task advance, tail/head pipes or nohup/Start-Process/start; do not end on accepted/queued/running or an operationId — NOT completion. Supervise operationGet/status/dagReport/dagDoctor/operationWait with 60s → 90s → 120s → 180s backoff; reset to 60s on state change; 30-60s re-checks when stall suspected. Every operationWait continuation MUST use afterSeq=previous nextSeq (recommendedNextCall); never reuse older cursors. Heartbeats: not meaningful progress. Run id 20260829-slug ≠ task id 2026-08-29-slug.",
-    "On failure consume terminal runSummary first. If progress exists, wait; else dagReport then dagRerunPlan(fromNode=primaryFailure.nodeId); eligible → dagRerun (node rerun only: reruns the failed subgraph, keeps prior successes). If plan ineligible (unsafe-shell subgraph, binding/workspace drift): Worker Failed → workerTaskRetry; standalone → standaloneTaskRerun after contract adopt (regenerates the whole task, not node continue). Do not call dagResume. Run-failed task without open gate is terminal: do not re-advance a run-failed task. Before run start, two identical lifecycleState/blocker/revision/DAG-hash observations mean no progress: stop and report after one bounded probe; never loop identical bash/read/grep. Auto-approve only bounded writeSet inside allowedPaths, outside forbiddenPaths, with structured verification.",
+    "Long DAGs: prepareDagExecution → runDag → operationId. Never foreground-Bash task advance, tail/head pipes or nohup/Start-Process/start; do not end on accepted/queued/running or an operationId — NOT completion. Supervise operationGet/status/dagReport/dagDoctor/operationWait at 60s → 90s → 120s → 180s; reset to 60s on state change; 30-60s re-checks when stall suspected. operationWait MUST use afterSeq=previous nextSeq (recommendedNextCall). Heartbeats: not meaningful progress. Run id ≠ task id.",
+    "Failure: terminal runSummary first. With progress wait; else dagRerunPlan(fromNode=primaryFailure.nodeId); eligible → dagRerun: reruns the failed subgraph, keeps prior successes. Ineligible: Worker → workerTaskRetry; standalone → standaloneTaskRerun after contract adopt (regenerates the whole task, not node continue). Do not call dagResume; do not re-advance a run-failed task. Pre-run identical state twice: stop and report; never loop identical bash/read/grep. Approve only bounded writeSet inside allowedPaths, outside forbiddenPaths, with structured verification.",
     "Iterate toward the goal in bounded rounds: first summarize the previous round's error in one line, fix its root cause — not the symptom — then rerun the failed node with a fresh plan. Never resubmit an unchanged fix; after two rounds failing the same way, stop and report evidence and remaining routes.",
     "Continue until success, user stop, or no safe recovery remains; then stop and report failure/evidence. Never create a new task for a transient failure or replace repair-pi with direct edits.",
+    "Narrate long-DAG progress briefly at start, meaningful phase changes/findings, verification failure/recovery, prolonged quiet and terminal state: say what finished and what is next. Never narrate unchanged operationWait polls or heartbeats, or claim beyond structured facts.",
 ].join("\n");
 /** Compose the inspectable system prompt actually injected into Operator Chat. */
 export function composeOperatorChatSystemPrompt(input) {
@@ -930,6 +931,44 @@ export class PiSessionInitFailedError extends Error {
         this.name = "PiSessionInitFailedError";
     }
 }
+async function readModelConfigFileVersion(filePath) {
+    try {
+        const value = await stat(filePath, { bigint: true });
+        return {
+            exists: true,
+            dev: value.dev,
+            ino: value.ino,
+            size: value.size,
+            mtimeNs: value.mtimeNs,
+            ctimeNs: value.ctimeNs,
+        };
+    }
+    catch (error) {
+        if (error !== null &&
+            typeof error === "object" &&
+            "code" in error &&
+            error.code === "ENOENT") {
+            return { exists: false };
+        }
+        throw new Error("MODEL_CONFIG_CHECK_FAILED");
+    }
+}
+function sameModelConfigFileVersion(left, right) {
+    if (!left.exists || !right.exists)
+        return left.exists === right.exists;
+    return (left.dev === right.dev &&
+        left.ino === right.ino &&
+        left.size === right.size &&
+        left.mtimeNs === right.mtimeNs &&
+        left.ctimeNs === right.ctimeNs);
+}
+async function captureModelConfigFile(agentDir) {
+    const filePath = path.join(agentDir, "models.json");
+    return {
+        path: filePath,
+        version: await readModelConfigFileVersion(filePath),
+    };
+}
 /**
  * Console Pi runtime — holds Chat sessions and drives prompt() with three-gate
  * tool enforcement. Session-per-sessionId; cross-request reuse via open().
@@ -939,6 +978,8 @@ export class ConsolePiRuntime {
     loader;
     sessions = new Map();
     modelRuntimes = new Map();
+    /** Non-sensitive models.json metadata used to avoid reparsing unchanged config. */
+    modelConfigFiles = new Map();
     sessionManagers = new Map();
     /** Per-session SDK service scope (resourceLoader / settingsManager) used by the live runtime snapshot. */
     serviceScopes = new Map();
@@ -948,6 +989,8 @@ export class ConsolePiRuntime {
     reloadInFlight = new Set();
     /** Synchronous prompt ownership per session (admission before first await). */
     promptOwners = new Set();
+    /** Steering requests accepted by the SDK but not yet consumed into Pi context. */
+    pendingSteering = new Map();
     /** At most one detached automatic-title task per durable Console session. */
     titleInFlight = new Set();
     /** Composer thinking selection ("auto" = no explicit override). */
@@ -1340,6 +1383,9 @@ export class ConsolePiRuntime {
         if (this.disposedSessions.has(sessionId))
             return;
         const agentDir = await safeGetAgentDir(this.bindings);
+        // Capture before services parse models.json. A concurrent edit can therefore
+        // cause at most one harmless extra refresh, never a missed next-turn refresh.
+        const modelConfigFile = await captureModelConfigFile(agentDir);
         const appendSystemPrompt = [
             OPERATOR_CHAT_SYSTEM_PROMPT_BASE,
             ...(init.systemPromptSuffix ? [init.systemPromptSuffix] : []),
@@ -1399,6 +1445,7 @@ export class ConsolePiRuntime {
         this.sessions.set(sessionId, session);
         this.sessionManagers.set(sessionId, init.sessionManager);
         this.modelRuntimes.set(sessionId, modelRuntime);
+        this.modelConfigFiles.set(sessionId, modelConfigFile);
         this.sessionModels.set(sessionId, model);
         this.serviceScopes.set(sessionId, {
             resourceLoader: services.resourceLoader,
@@ -1419,6 +1466,7 @@ export class ConsolePiRuntime {
             this.sessions.delete(sessionId);
             this.sessionManagers.delete(sessionId);
             this.modelRuntimes.delete(sessionId);
+            this.modelConfigFiles.delete(sessionId);
             this.sessionModels.delete(sessionId);
             this.serviceScopes.delete(sessionId);
             this.revisions.delete(sessionId);
@@ -1497,6 +1545,7 @@ export class ConsolePiRuntime {
         this.sessions.set(sessionId, built.session);
         this.sessionManagers.set(sessionId, sessionManager);
         this.modelRuntimes.set(sessionId, built.modelRuntime);
+        this.modelConfigFiles.set(sessionId, built.modelConfigFile);
         this.sessionModels.set(sessionId, init.model);
         this.serviceScopes.set(sessionId, built.services);
         this.revisions.set(sessionId, 1);
@@ -1568,11 +1617,69 @@ export class ConsolePiRuntime {
         if (!resolved)
             throw new Error("MODEL_NOT_AVAILABLE");
         await session.setModel(resolved);
-        this.bumpRevision(sessionId);
-        return {
+        const applied = {
             provider: session.model?.provider ?? model.provider,
             modelId: session.model?.id ?? session.model?.modelId ?? model.modelId,
         };
+        this.sessionModels.set(sessionId, applied);
+        this.bumpRevision(sessionId);
+        return applied;
+    }
+    async refreshModelConfiguration(sessionId, mode) {
+        const session = this.sessions.get(sessionId);
+        const modelRuntime = this.modelRuntimes.get(sessionId);
+        const configFile = this.modelConfigFiles.get(sessionId);
+        if (!session || !modelRuntime || !configFile) {
+            throw new Error(`chat session not active: ${sessionId}`);
+        }
+        const nextVersion = await readModelConfigFileVersion(configFile.path);
+        if (mode === "if-changed" &&
+            sameModelConfigFileVersion(configFile.version, nextVersion)) {
+            return false;
+        }
+        if (typeof modelRuntime.refresh !== "function") {
+            throw new Error("MODEL_CONFIG_REFRESH_UNSUPPORTED");
+        }
+        const stored = this.sessionModels.get(sessionId);
+        const provider = session.model?.provider ?? stored?.provider;
+        const modelId = session.model?.id ?? session.model?.modelId ?? stored?.modelId;
+        try {
+            await modelRuntime.refresh({ allowNetwork: false });
+            if (typeof modelRuntime.getError === "function" && modelRuntime.getError()) {
+                throw new Error("MODEL_CONFIG_REFRESH_FAILED");
+            }
+            if (provider && modelId) {
+                if (typeof session.setModel !== "function") {
+                    throw new Error("MODEL_CONFIG_REBIND_UNSUPPORTED");
+                }
+                const resolved = this.bindings.resolveModel({
+                    modelRuntime,
+                    provider,
+                    modelId,
+                });
+                if (!resolved) {
+                    throw new Error("MODEL_NOT_AVAILABLE_AFTER_CONFIG_REFRESH");
+                }
+                await session.setModel(resolved);
+                this.sessionModels.set(sessionId, { provider, modelId });
+            }
+        }
+        catch (error) {
+            if (error instanceof Error &&
+                (error.message === "MODEL_CONFIG_REBIND_UNSUPPORTED" ||
+                    error.message === "MODEL_NOT_AVAILABLE_AFTER_CONFIG_REFRESH")) {
+                throw error;
+            }
+            // Do not surface SDK/config error text: it may contain credential material.
+            throw new Error("MODEL_CONFIG_REFRESH_FAILED");
+        }
+        if (this.disposedSessions.has(sessionId) ||
+            this.sessions.get(sessionId) !== session) {
+            throw new Error(`chat session not active: ${sessionId}`);
+        }
+        configFile.version = nextVersion;
+        this.bumpRevision(sessionId);
+        return true;
     }
     /**
      * Apply a thinking-level selection. `auto` records the selection WITHOUT
@@ -1695,6 +1802,8 @@ export class ConsolePiRuntime {
             };
         }
         const busyReasons = [];
+        if (this.promptOwners.has(sessionId))
+            busyReasons.push("prompt in flight");
         if (session.isStreaming === true || session.isIdle === false)
             busyReasons.push("streaming");
         if (session.isCompacting === true)
@@ -1726,6 +1835,7 @@ export class ConsolePiRuntime {
             const services = this.serviceScopes.get(sessionId);
             if (services)
                 this.applySessionCompactionOverride(sessionId, services, session);
+            await this.refreshModelConfiguration(sessionId, "force");
         }
         catch (error) {
             return {
@@ -1737,7 +1847,6 @@ export class ConsolePiRuntime {
         finally {
             this.reloadInFlight.delete(sessionId);
         }
-        this.bumpRevision(sessionId);
         // Reload replaces the effective resource/session context. Persisted Goal
         // remains visible, but continuation authorization must be renewed by user.
         this.options.goalRegistry?.disarm(sessionId);
@@ -2256,6 +2365,7 @@ export class ConsolePiRuntime {
             this.sessions.set(sessionId, session);
             this.sessionManagers.set(sessionId, sessionManager);
             this.modelRuntimes.set(sessionId, built.modelRuntime);
+            this.modelConfigFiles.set(sessionId, built.modelConfigFile);
             this.sessionModels.set(sessionId, init.model);
             this.serviceScopes.set(sessionId, built.services);
             this.revisions.set(sessionId, 1);
@@ -2309,6 +2419,7 @@ export class ConsolePiRuntime {
      */
     async buildSessionWithServices(init) {
         const agentDir = await safeGetAgentDir(this.bindings);
+        const modelConfigFile = await captureModelConfigFile(agentDir);
         const appendSystemPrompt = [
             OPERATOR_CHAT_SYSTEM_PROMPT_BASE,
             ...(init.systemPromptSuffix ? [init.systemPromptSuffix] : []),
@@ -2342,6 +2453,7 @@ export class ConsolePiRuntime {
         return {
             session,
             modelRuntime,
+            modelConfigFile,
             services: {
                 resourceLoader: services.resourceLoader,
                 settingsManager: services.settingsManager,
@@ -2353,14 +2465,31 @@ export class ConsolePiRuntime {
         return this.sessions.get(sessionId);
     }
     /** Inject one queued message into the currently running Pi turn. */
-    async steer(sessionId, text, images) {
+    async steer(sessionId, clientRequestId, text, images) {
         const session = this.sessions.get(sessionId);
         if (!session || !this.promptOwners.has(sessionId) || session.isStreaming === false) {
             throw new Error("CHAT_TURN_NOT_ACTIVE");
         }
         if (typeof session.steer !== "function")
             throw new Error("CHAT_STEER_UNAVAILABLE");
-        await session.steer(text, images);
+        const pending = this.pendingSteering.get(sessionId) ?? [];
+        const identity = { clientRequestId, text };
+        pending.push(identity);
+        this.pendingSteering.set(sessionId, pending);
+        try {
+            await session.steer(text, images);
+        }
+        catch (error) {
+            const current = this.pendingSteering.get(sessionId);
+            if (current) {
+                const index = current.indexOf(identity);
+                if (index >= 0)
+                    current.splice(index, 1);
+                if (current.length === 0)
+                    this.pendingSteering.delete(sessionId);
+            }
+            throw error;
+        }
     }
     hasSession(sessionId) {
         return this.sessions.has(sessionId);
@@ -2396,12 +2525,13 @@ export class ConsolePiRuntime {
      */
     async prompt(sessionId, text, onEvent, options) {
         // Synchronous admission fence — before any await.
-        if (this.promptOwners.has(sessionId)) {
+        if (this.promptOwners.has(sessionId) || this.reloadInFlight.has(sessionId)) {
             throw new Error("CHAT_TURN_ACTIVE");
         }
         this.promptOwners.add(sessionId);
         let unsub;
         let abortPromise;
+        let initialUserMessageStarted = false;
         const onAbort = () => {
             // M1 T08 / AC-R3-003: Stop must abort only the current turn, NEVER
             // dispose the session. Await session.abort() so ownership settles
@@ -2458,6 +2588,11 @@ export class ConsolePiRuntime {
             if (options?.signal?.aborted) {
                 return;
             }
+            await this.refreshModelConfiguration(sessionId, "if-changed");
+            // Stop may arrive while stat/refresh/rebind is in flight.
+            if (options?.signal?.aborted) {
+                return;
+            }
             const emitContextUsage = () => {
                 try {
                     const contextUsage = session.getSessionStats?.()?.contextUsage;
@@ -2499,6 +2634,27 @@ export class ConsolePiRuntime {
             };
             unsub = session.subscribe((event) => {
                 const observedAt = Date.now();
+                if (event.type === "message_start" && isUserSdkMessage(event.message)) {
+                    if (!initialUserMessageStarted) {
+                        // The first user message_start belongs to session.prompt(text), not
+                        // to a steering request that may have raced with prompt startup.
+                        initialUserMessageStarted = true;
+                    }
+                    else {
+                        const pending = this.pendingSteering.get(sessionId);
+                        const accepted = pending?.shift();
+                        if (pending?.length === 0)
+                            this.pendingSteering.delete(sessionId);
+                        if (accepted) {
+                            onEvent({
+                                type: "steering_accepted",
+                                sessionId,
+                                clientRequestId: accepted.clientRequestId,
+                                text: accepted.text,
+                            });
+                        }
+                    }
+                }
                 if (event.type === "compaction_start") {
                     activeCompaction = {
                         compactionId: newCompactionId(sessionId),
@@ -2637,6 +2793,10 @@ export class ConsolePiRuntime {
         finally {
             if (this.options.questionRegistry)
                 this.options.questionRegistry.clearTurn(sessionId);
+            // Unconsumed durable DeferredTurns remain dispatching and are recovered by
+            // the route layer after this active Turn closes. Never carry their volatile
+            // identities into a later prompt.
+            this.pendingSteering.delete(sessionId);
             this.promptOwners.delete(sessionId);
         }
     }
@@ -2758,11 +2918,13 @@ export class ConsolePiRuntime {
         this.sessionManagers.delete(sessionId);
         this.mainlineLeaves.delete(sessionId);
         this.modelRuntimes.delete(sessionId);
+        this.modelConfigFiles.delete(sessionId);
         this.sessionModels.delete(sessionId);
         this.serviceScopes.delete(sessionId);
         this.revisions.delete(sessionId);
         this.thinkingSelections.delete(sessionId);
         this.reloadInFlight.delete(sessionId);
+        this.pendingSteering.delete(sessionId);
     }
     disposeAll() {
         for (const id of [...this.sessions.keys()])
@@ -2795,6 +2957,11 @@ function mapAssistantMessageEvent(type, sessionId, message) {
         ...(content.length > 0 ? { content } : {}),
     };
 }
+function isUserSdkMessage(message) {
+    return Boolean(message &&
+        typeof message === "object" &&
+        message.role === "user");
+}
 function mapSdkEvent(sessionId, event, compactionId) {
     switch (event.type) {
         case "agent_start":

package/dist/worker/console/chat/repo-browser.js

@@ -9,6 +9,9 @@ const TREE_LIMIT = 500;
 export const TEXT_PREVIEW_LIMIT = 512 * 1024;
 /** Full-file ceiling for the sandboxed HTML preview route and its assets. */
 export const HTML_PREVIEW_ASSET_LIMIT = 20 * 1024 * 1024;
+/** Self-contained HTML exports commonly embed data and can be much larger than
+ * an individual image/script asset. Keep a separate, still-bounded ceiling. */
+export const HTML_PREVIEW_DOCUMENT_LIMIT = 64 * 1024 * 1024;
 export const REPO_HTML_PREVIEW_ROUTE_PREFIX = "/api/operator/v1/chat/repo/html/";
 const SKIP_DIRS = new Set([
     ".git",
@@ -190,8 +193,12 @@ export async function readRepoHtmlAsset(repoRoot, rawPath) {
             const info = await handle.stat();
             if (!info.isFile())
                 throw new RepoBrowserError(400, "NOT_A_FILE", "path is not a regular file");
-            if (info.size > HTML_PREVIEW_ASSET_LIMIT)
-                throw new RepoBrowserError(413, "TOO_LARGE", `file exceeds ${HTML_PREVIEW_ASSET_LIMIT} byte HTML preview limit`);
+            const contentType = repoHtmlAssetContentType(guard.repoRelative);
+            const limit = contentType.startsWith("text/html")
+                ? HTML_PREVIEW_DOCUMENT_LIMIT
+                : HTML_PREVIEW_ASSET_LIMIT;
+            if (info.size > limit)
+                throw new RepoBrowserError(413, "TOO_LARGE", `file exceeds ${limit} byte HTML preview limit`);
             const rechecked = await guardReadPath(repoRoot, rawPath);
             if (!rechecked.ok)
                 throw new RepoBrowserError(403, guardedCode(rechecked.code), "file path changed while it was being opened");
@@ -202,7 +209,7 @@ export async function readRepoHtmlAsset(repoRoot, rawPath) {
                 throw new RepoBrowserError(403, "OUT_OF_REPO", "file identity changed while it was being opened");
             return {
                 body: await handle.readFile(),
-                contentType: repoHtmlAssetContentType(guard.repoRelative),
+                contentType,
                 bytes: info.size,
             };
         }