@tea-agent/loop-agent 0.42.0-next.1 → 0.42.0-next.10

package/dist/worker/console/chat/pi-runtime.js

@@ -26,7 +26,7 @@
  * `createDefaultPiSdkBindings()`.
  */
 import { createHash, randomBytes } from "node:crypto";
-import { access } from "node:fs/promises";
+import { access, mkdir, rm, stat, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { extractAssistantContentBlocks, extractAssistantText, isAssistantSdkMessage, } from "./assistant-content.js";
 import { parseProviderError, } from "./provider-error.js";
@@ -43,6 +43,7 @@ import { filterActiveInterviewTools } from "../interview/tools.js";
 import { RUNTIME_CONTEXT_TEXT_MAX, redactRuntimeText, } from "./runtime-context.js";
 import { buildTodoContinuationContext, } from "./todos.js";
 import { buildGoalContinuationContext, } from "./goals.js";
+import { injectWizardLocalHeaders, } from "./sdd-data-alignment.js";
 /**
  * Base system prompt fragment every General Operator Chat session receives.
  *
@@ -298,6 +299,24 @@ export function createGoalCompactionContextExtension(options) {
         },
     };
 }
+export function createWizardLocalHeadersExtension(options) {
+    return {
+        name: "operator-chat-wizard-local-headers",
+        hidden: true,
+        factory: (api) => {
+            api.on("before_provider_headers", async (rawEvent, context) => {
+                if (!context || !rawEvent.headers || typeof rawEvent.headers !== "object")
+                    return;
+                await injectWizardLocalHeaders({
+                    headers: rawEvent.headers,
+                    context,
+                    sessionId: options.sessionId,
+                    service: options.service,
+                });
+            });
+        },
+    };
+}
 /**
  * Build Pi custom ToolDefinition objects for every whitelisted operator action.
  * Each tool's execute() routes into the operator action dispatcher (Gate 3).
@@ -931,6 +950,44 @@ export class PiSessionInitFailedError extends Error {
         this.name = "PiSessionInitFailedError";
     }
 }
+async function readModelConfigFileVersion(filePath) {
+    try {
+        const value = await stat(filePath, { bigint: true });
+        return {
+            exists: true,
+            dev: value.dev,
+            ino: value.ino,
+            size: value.size,
+            mtimeNs: value.mtimeNs,
+            ctimeNs: value.ctimeNs,
+        };
+    }
+    catch (error) {
+        if (error !== null &&
+            typeof error === "object" &&
+            "code" in error &&
+            error.code === "ENOENT") {
+            return { exists: false };
+        }
+        throw new Error("MODEL_CONFIG_CHECK_FAILED");
+    }
+}
+function sameModelConfigFileVersion(left, right) {
+    if (!left.exists || !right.exists)
+        return left.exists === right.exists;
+    return (left.dev === right.dev &&
+        left.ino === right.ino &&
+        left.size === right.size &&
+        left.mtimeNs === right.mtimeNs &&
+        left.ctimeNs === right.ctimeNs);
+}
+async function captureModelConfigFile(agentDir) {
+    const filePath = path.join(agentDir, "models.json");
+    return {
+        path: filePath,
+        version: await readModelConfigFileVersion(filePath),
+    };
+}
 /**
  * Console Pi runtime — holds Chat sessions and drives prompt() with three-gate
  * tool enforcement. Session-per-sessionId; cross-request reuse via open().
@@ -940,6 +997,8 @@ export class ConsolePiRuntime {
     loader;
     sessions = new Map();
     modelRuntimes = new Map();
+    /** Non-sensitive models.json metadata used to avoid reparsing unchanged config. */
+    modelConfigFiles = new Map();
     sessionManagers = new Map();
     /** Per-session SDK service scope (resourceLoader / settingsManager) used by the live runtime snapshot. */
     serviceScopes = new Map();
@@ -949,6 +1008,8 @@ export class ConsolePiRuntime {
     reloadInFlight = new Set();
     /** Synchronous prompt ownership per session (admission before first await). */
     promptOwners = new Set();
+    /** Steering requests accepted by the SDK but not yet consumed into Pi context. */
+    pendingSteering = new Map();
     /** At most one detached automatic-title task per durable Console session. */
     titleInFlight = new Set();
     /** Composer thinking selection ("auto" = no explicit override). */
@@ -1019,10 +1080,17 @@ export class ConsolePiRuntime {
                 registry: this.options.goalRegistry,
             })
             : undefined;
+        const wizardLocalHeadersExtension = sessionId && this.options.sddDataAlignment
+            ? createWizardLocalHeadersExtension({
+                sessionId,
+                service: this.options.sddDataAlignment,
+            })
+            : undefined;
         const extraFactories = [
             todoContextExtension,
             goalContextExtension,
             pressureExtension,
+            wizardLocalHeadersExtension,
         ].filter((item) => Boolean(item));
         return {
             ...base,
@@ -1263,6 +1331,15 @@ export class ConsolePiRuntime {
         if (!sessionFile) {
             throw new Error(`chat session shell missing sessionFile for ${sessionId}`);
         }
+        // Pi's SessionManager.create deliberately postpones writing a JSONL until
+        // an assistant response. Materialize a valid header now, otherwise Console
+        // could persist a path that disappears on a restart before first reply.
+        await this.bindings.materializeSessionShell({
+            sessionManager,
+            sessionId,
+            sessionFile,
+            cwd: this.options.cwd,
+        });
         this.sessionManagers.set(sessionId, sessionManager);
         this.thinkingSelections.set(sessionId, "auto");
         // Detached single-flight materialization; dependent routes await the same promise.
@@ -1341,6 +1418,9 @@ export class ConsolePiRuntime {
         if (this.disposedSessions.has(sessionId))
             return;
         const agentDir = await safeGetAgentDir(this.bindings);
+        // Capture before services parse models.json. A concurrent edit can therefore
+        // cause at most one harmless extra refresh, never a missed next-turn refresh.
+        const modelConfigFile = await captureModelConfigFile(agentDir);
         const appendSystemPrompt = [
             OPERATOR_CHAT_SYSTEM_PROMPT_BASE,
             ...(init.systemPromptSuffix ? [init.systemPromptSuffix] : []),
@@ -1400,6 +1480,7 @@ export class ConsolePiRuntime {
         this.sessions.set(sessionId, session);
         this.sessionManagers.set(sessionId, init.sessionManager);
         this.modelRuntimes.set(sessionId, modelRuntime);
+        this.modelConfigFiles.set(sessionId, modelConfigFile);
         this.sessionModels.set(sessionId, model);
         this.serviceScopes.set(sessionId, {
             resourceLoader: services.resourceLoader,
@@ -1420,6 +1501,7 @@ export class ConsolePiRuntime {
             this.sessions.delete(sessionId);
             this.sessionManagers.delete(sessionId);
             this.modelRuntimes.delete(sessionId);
+            this.modelConfigFiles.delete(sessionId);
             this.sessionModels.delete(sessionId);
             this.serviceScopes.delete(sessionId);
             this.revisions.delete(sessionId);
@@ -1498,6 +1580,7 @@ export class ConsolePiRuntime {
         this.sessions.set(sessionId, built.session);
         this.sessionManagers.set(sessionId, sessionManager);
         this.modelRuntimes.set(sessionId, built.modelRuntime);
+        this.modelConfigFiles.set(sessionId, built.modelConfigFile);
         this.sessionModels.set(sessionId, init.model);
         this.serviceScopes.set(sessionId, built.services);
         this.revisions.set(sessionId, 1);
@@ -1569,11 +1652,69 @@ export class ConsolePiRuntime {
         if (!resolved)
             throw new Error("MODEL_NOT_AVAILABLE");
         await session.setModel(resolved);
-        this.bumpRevision(sessionId);
-        return {
+        const applied = {
             provider: session.model?.provider ?? model.provider,
             modelId: session.model?.id ?? session.model?.modelId ?? model.modelId,
         };
+        this.sessionModels.set(sessionId, applied);
+        this.bumpRevision(sessionId);
+        return applied;
+    }
+    async refreshModelConfiguration(sessionId, mode) {
+        const session = this.sessions.get(sessionId);
+        const modelRuntime = this.modelRuntimes.get(sessionId);
+        const configFile = this.modelConfigFiles.get(sessionId);
+        if (!session || !modelRuntime || !configFile) {
+            throw new Error(`chat session not active: ${sessionId}`);
+        }
+        const nextVersion = await readModelConfigFileVersion(configFile.path);
+        if (mode === "if-changed" &&
+            sameModelConfigFileVersion(configFile.version, nextVersion)) {
+            return false;
+        }
+        if (typeof modelRuntime.refresh !== "function") {
+            throw new Error("MODEL_CONFIG_REFRESH_UNSUPPORTED");
+        }
+        const stored = this.sessionModels.get(sessionId);
+        const provider = session.model?.provider ?? stored?.provider;
+        const modelId = session.model?.id ?? session.model?.modelId ?? stored?.modelId;
+        try {
+            await modelRuntime.refresh({ allowNetwork: false });
+            if (typeof modelRuntime.getError === "function" && modelRuntime.getError()) {
+                throw new Error("MODEL_CONFIG_REFRESH_FAILED");
+            }
+            if (provider && modelId) {
+                if (typeof session.setModel !== "function") {
+                    throw new Error("MODEL_CONFIG_REBIND_UNSUPPORTED");
+                }
+                const resolved = this.bindings.resolveModel({
+                    modelRuntime,
+                    provider,
+                    modelId,
+                });
+                if (!resolved) {
+                    throw new Error("MODEL_NOT_AVAILABLE_AFTER_CONFIG_REFRESH");
+                }
+                await session.setModel(resolved);
+                this.sessionModels.set(sessionId, { provider, modelId });
+            }
+        }
+        catch (error) {
+            if (error instanceof Error &&
+                (error.message === "MODEL_CONFIG_REBIND_UNSUPPORTED" ||
+                    error.message === "MODEL_NOT_AVAILABLE_AFTER_CONFIG_REFRESH")) {
+                throw error;
+            }
+            // Do not surface SDK/config error text: it may contain credential material.
+            throw new Error("MODEL_CONFIG_REFRESH_FAILED");
+        }
+        if (this.disposedSessions.has(sessionId) ||
+            this.sessions.get(sessionId) !== session) {
+            throw new Error(`chat session not active: ${sessionId}`);
+        }
+        configFile.version = nextVersion;
+        this.bumpRevision(sessionId);
+        return true;
     }
     /**
      * Apply a thinking-level selection. `auto` records the selection WITHOUT
@@ -1696,6 +1837,8 @@ export class ConsolePiRuntime {
             };
         }
         const busyReasons = [];
+        if (this.promptOwners.has(sessionId))
+            busyReasons.push("prompt in flight");
         if (session.isStreaming === true || session.isIdle === false)
             busyReasons.push("streaming");
         if (session.isCompacting === true)
@@ -1727,6 +1870,7 @@ export class ConsolePiRuntime {
             const services = this.serviceScopes.get(sessionId);
             if (services)
                 this.applySessionCompactionOverride(sessionId, services, session);
+            await this.refreshModelConfiguration(sessionId, "force");
         }
         catch (error) {
             return {
@@ -1738,7 +1882,6 @@ export class ConsolePiRuntime {
         finally {
             this.reloadInFlight.delete(sessionId);
         }
-        this.bumpRevision(sessionId);
         // Reload replaces the effective resource/session context. Persisted Goal
         // remains visible, but continuation authorization must be renewed by user.
         this.options.goalRegistry?.disarm(sessionId);
@@ -2204,6 +2347,16 @@ export class ConsolePiRuntime {
             });
         }
         catch (error) {
+            const code = error && typeof error === "object" && "code" in error
+                ? String(error.code ?? "")
+                : "";
+            if (code === "SESSION_FILE_MISSING" || code === "ENOENT") {
+                return {
+                    ok: false,
+                    code: "NO_SESSION_FILE",
+                    message: `Pi session file missing or not openable: ${init.sessionFile}`,
+                };
+            }
             return {
                 ok: false,
                 code: "REOPEN_FAILED",
@@ -2257,6 +2410,7 @@ export class ConsolePiRuntime {
             this.sessions.set(sessionId, session);
             this.sessionManagers.set(sessionId, sessionManager);
             this.modelRuntimes.set(sessionId, built.modelRuntime);
+            this.modelConfigFiles.set(sessionId, built.modelConfigFile);
             this.sessionModels.set(sessionId, init.model);
             this.serviceScopes.set(sessionId, built.services);
             this.revisions.set(sessionId, 1);
@@ -2310,6 +2464,7 @@ export class ConsolePiRuntime {
      */
     async buildSessionWithServices(init) {
         const agentDir = await safeGetAgentDir(this.bindings);
+        const modelConfigFile = await captureModelConfigFile(agentDir);
         const appendSystemPrompt = [
             OPERATOR_CHAT_SYSTEM_PROMPT_BASE,
             ...(init.systemPromptSuffix ? [init.systemPromptSuffix] : []),
@@ -2343,6 +2498,7 @@ export class ConsolePiRuntime {
         return {
             session,
             modelRuntime,
+            modelConfigFile,
             services: {
                 resourceLoader: services.resourceLoader,
                 settingsManager: services.settingsManager,
@@ -2354,14 +2510,31 @@ export class ConsolePiRuntime {
         return this.sessions.get(sessionId);
     }
     /** Inject one queued message into the currently running Pi turn. */
-    async steer(sessionId, text, images) {
+    async steer(sessionId, clientRequestId, text, images) {
         const session = this.sessions.get(sessionId);
         if (!session || !this.promptOwners.has(sessionId) || session.isStreaming === false) {
             throw new Error("CHAT_TURN_NOT_ACTIVE");
         }
         if (typeof session.steer !== "function")
             throw new Error("CHAT_STEER_UNAVAILABLE");
-        await session.steer(text, images);
+        const pending = this.pendingSteering.get(sessionId) ?? [];
+        const identity = { clientRequestId, text };
+        pending.push(identity);
+        this.pendingSteering.set(sessionId, pending);
+        try {
+            await session.steer(text, images);
+        }
+        catch (error) {
+            const current = this.pendingSteering.get(sessionId);
+            if (current) {
+                const index = current.indexOf(identity);
+                if (index >= 0)
+                    current.splice(index, 1);
+                if (current.length === 0)
+                    this.pendingSteering.delete(sessionId);
+            }
+            throw error;
+        }
     }
     hasSession(sessionId) {
         return this.sessions.has(sessionId);
@@ -2397,12 +2570,13 @@ export class ConsolePiRuntime {
      */
     async prompt(sessionId, text, onEvent, options) {
         // Synchronous admission fence — before any await.
-        if (this.promptOwners.has(sessionId)) {
+        if (this.promptOwners.has(sessionId) || this.reloadInFlight.has(sessionId)) {
             throw new Error("CHAT_TURN_ACTIVE");
         }
         this.promptOwners.add(sessionId);
         let unsub;
         let abortPromise;
+        let initialUserMessageStarted = false;
         const onAbort = () => {
             // M1 T08 / AC-R3-003: Stop must abort only the current turn, NEVER
             // dispose the session. Await session.abort() so ownership settles
@@ -2459,6 +2633,11 @@ export class ConsolePiRuntime {
             if (options?.signal?.aborted) {
                 return;
             }
+            await this.refreshModelConfiguration(sessionId, "if-changed");
+            // Stop may arrive while stat/refresh/rebind is in flight.
+            if (options?.signal?.aborted) {
+                return;
+            }
             const emitContextUsage = () => {
                 try {
                     const contextUsage = session.getSessionStats?.()?.contextUsage;
@@ -2500,6 +2679,27 @@ export class ConsolePiRuntime {
             };
             unsub = session.subscribe((event) => {
                 const observedAt = Date.now();
+                if (event.type === "message_start" && isUserSdkMessage(event.message)) {
+                    if (!initialUserMessageStarted) {
+                        // The first user message_start belongs to session.prompt(text), not
+                        // to a steering request that may have raced with prompt startup.
+                        initialUserMessageStarted = true;
+                    }
+                    else {
+                        const pending = this.pendingSteering.get(sessionId);
+                        const accepted = pending?.shift();
+                        if (pending?.length === 0)
+                            this.pendingSteering.delete(sessionId);
+                        if (accepted) {
+                            onEvent({
+                                type: "steering_accepted",
+                                sessionId,
+                                clientRequestId: accepted.clientRequestId,
+                                text: accepted.text,
+                            });
+                        }
+                    }
+                }
                 if (event.type === "compaction_start") {
                     activeCompaction = {
                         compactionId: newCompactionId(sessionId),
@@ -2638,6 +2838,10 @@ export class ConsolePiRuntime {
         finally {
             if (this.options.questionRegistry)
                 this.options.questionRegistry.clearTurn(sessionId);
+            // Unconsumed durable DeferredTurns remain dispatching and are recovered by
+            // the route layer after this active Turn closes. Never carry their volatile
+            // identities into a later prompt.
+            this.pendingSteering.delete(sessionId);
             this.promptOwners.delete(sessionId);
         }
     }
@@ -2759,11 +2963,13 @@ export class ConsolePiRuntime {
         this.sessionManagers.delete(sessionId);
         this.mainlineLeaves.delete(sessionId);
         this.modelRuntimes.delete(sessionId);
+        this.modelConfigFiles.delete(sessionId);
         this.sessionModels.delete(sessionId);
         this.serviceScopes.delete(sessionId);
         this.revisions.delete(sessionId);
         this.thinkingSelections.delete(sessionId);
         this.reloadInFlight.delete(sessionId);
+        this.pendingSteering.delete(sessionId);
     }
     disposeAll() {
         for (const id of [...this.sessions.keys()])
@@ -2796,6 +3002,11 @@ function mapAssistantMessageEvent(type, sessionId, message) {
         ...(content.length > 0 ? { content } : {}),
     };
 }
+function isUserSdkMessage(message) {
+    return Boolean(message &&
+        typeof message === "object" &&
+        message.role === "user");
+}
 function mapSdkEvent(sessionId, event, compactionId) {
     switch (event.type) {
         case "agent_start":
@@ -2981,6 +3192,36 @@ export function createDefaultPiSdkBindings() {
                 id: opts.sessionId,
             });
         },
+        materializeSessionShell: async (opts) => {
+            const sdk = (await loadSdk());
+            const manager = opts.sessionManager;
+            if (typeof manager.setSessionFile !== "function") {
+                throw new Error("Pi SessionManager cannot materialize a session file");
+            }
+            let created = false;
+            try {
+                await mkdir(path.dirname(opts.sessionFile), { recursive: true });
+                // Match Pi's documented session header. Rebinding through the public
+                // SessionManager API marks it flushed, so Pi appends the first user
+                // entry instead of trying to create the already-present file later.
+                await writeFile(opts.sessionFile, `${JSON.stringify({
+                    type: "session",
+                    version: typeof sdk.CURRENT_SESSION_VERSION === "number"
+                        ? sdk.CURRENT_SESSION_VERSION
+                        : 3,
+                    id: opts.sessionId,
+                    timestamp: new Date().toISOString(),
+                    cwd: opts.cwd,
+                })}\n`, { encoding: "utf8", flag: "wx", mode: 0o600 });
+                created = true;
+                manager.setSessionFile(opts.sessionFile);
+            }
+            catch (error) {
+                if (created)
+                    await rm(opts.sessionFile, { force: true }).catch(() => undefined);
+                throw error;
+            }
+        },
         createInMemorySessionManager: async (opts) => {
             const sdk = (await loadSdk());
             return sdk.SessionManager.inMemory(opts.cwd);
@@ -2997,13 +3238,19 @@ export function createDefaultPiSdkBindings() {
                 // wrong conversation under the durable Console sessionId. Fail closed
                 // before open when the persisted file is absent.
                 await access(opts.sessionFile);
-                return sdk.SessionManager.open(opts.sessionFile);
             }
-            catch {
-                // Missing/corrupt session file — caller fails closed rather than
-                // silently creating a fresh session and losing prior context.
+            catch (error) {
+                const code = error && typeof error === "object" && "code" in error
+                    ? String(error.code ?? "")
+                    : "";
+                if (code === "ENOENT") {
+                    throw Object.assign(new Error(`SESSION_FILE_MISSING: ${opts.sessionFile}`), { code: "SESSION_FILE_MISSING", cause: error });
+                }
+                // File exists but is unreadable (permissions / I/O) — caller maps
+                // undefined to 503 rather than silently creating a fresh session.
                 return undefined;
             }
+            return sdk.SessionManager.open(opts.sessionFile);
         },
         resolveModel: (opts) => {
             const rt = opts.modelRuntime;

package/dist/worker/console/chat/repo-browser.js

@@ -9,6 +9,9 @@ const TREE_LIMIT = 500;
 export const TEXT_PREVIEW_LIMIT = 512 * 1024;
 /** Full-file ceiling for the sandboxed HTML preview route and its assets. */
 export const HTML_PREVIEW_ASSET_LIMIT = 20 * 1024 * 1024;
+/** Self-contained HTML exports commonly embed data and can be much larger than
+ * an individual image/script asset. Keep a separate, still-bounded ceiling. */
+export const HTML_PREVIEW_DOCUMENT_LIMIT = 64 * 1024 * 1024;
 export const REPO_HTML_PREVIEW_ROUTE_PREFIX = "/api/operator/v1/chat/repo/html/";
 const SKIP_DIRS = new Set([
     ".git",
@@ -190,8 +193,12 @@ export async function readRepoHtmlAsset(repoRoot, rawPath) {
             const info = await handle.stat();
             if (!info.isFile())
                 throw new RepoBrowserError(400, "NOT_A_FILE", "path is not a regular file");
-            if (info.size > HTML_PREVIEW_ASSET_LIMIT)
-                throw new RepoBrowserError(413, "TOO_LARGE", `file exceeds ${HTML_PREVIEW_ASSET_LIMIT} byte HTML preview limit`);
+            const contentType = repoHtmlAssetContentType(guard.repoRelative);
+            const limit = contentType.startsWith("text/html")
+                ? HTML_PREVIEW_DOCUMENT_LIMIT
+                : HTML_PREVIEW_ASSET_LIMIT;
+            if (info.size > limit)
+                throw new RepoBrowserError(413, "TOO_LARGE", `file exceeds ${limit} byte HTML preview limit`);
             const rechecked = await guardReadPath(repoRoot, rawPath);
             if (!rechecked.ok)
                 throw new RepoBrowserError(403, guardedCode(rechecked.code), "file path changed while it was being opened");
@@ -202,7 +209,7 @@ export async function readRepoHtmlAsset(repoRoot, rawPath) {
                 throw new RepoBrowserError(403, "OUT_OF_REPO", "file identity changed while it was being opened");
             return {
                 body: await handle.readFile(),
-                contentType: repoHtmlAssetContentType(guard.repoRelative),
+                contentType,
                 bytes: info.size,
             };
         }