@tea-agent/loop-agent 0.43.0-next.17 → 0.43.0-next.3

package/dist/worker/console/chat/pi-runtime.js

@@ -26,38 +26,25 @@
  * `createDefaultPiSdkBindings()`.
  */
 import { createHash, randomBytes } from "node:crypto";
-import { stat } from "node:fs/promises";
+import { access, mkdir, rm, stat, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { extractAssistantContentBlocks, extractAssistantText, isAssistantSdkMessage, } from "./assistant-content.js";
 import { parseProviderError, } from "./provider-error.js";
 import { projectCompactSnapshot, } from "./chat-event-store.js";
 import { extractUsageSample } from "./usage.js";
-import { OPERATOR_CHAT_ALLOWED_TOOLS, authorizeOperatorChatTool, assertNoWriteToolInList, } from "./tools.js";
-import { authorizeChatSessionTool, DEFAULT_CONSOLE_CHAT_SESSION_MODE, chatActiveToolBaseline, composeChatSystemPrompt, composeChatSystemPromptParts, computeChatActiveToolNames, shouldLoadWorkflowBusinessTools, } from "./session-mode.js";
+import { OPERATOR_CHAT_ALLOWED_TOOLS, OPERATOR_CHAT_BUILTIN_CUSTOM_TOOLS, authorizeOperatorChatTool, assertNoWriteToolInList, } from "./tools.js";
 import { buildAgentCustomTool, ExploreOrchestrator, } from "./subagents/index.js";
 import { createOperatorChatResourceLoader, } from "./resource-loader.js";
-import { applySkillAutoInvocationPreferences, loadResourcePreferences, } from "./resource-preferences-store.js";
-import { applyProcessRetryOverride, } from "../../../shared/pi-retry-settings.js";
+import { applySkillAutoInvocationPreferences, isAutoInvocationEnabled, loadResourcePreferences, skillResourceId, } from "./resource-preferences-store.js";
+import { buildModelCallableToolSchemas } from "./tool-adapter.js";
 import { applyProcessCompactionOverride, createCompactionController, createContextPressureExtension, createSiftBridgeState, housekeepSiftStash, isConsoleSiftEnabled, parseCompactionPolicy, parseSiftBridgeConfig, projectPromptPressure, deriveEffectiveWindow, projectSafeTelemetry, emptyContextPressureCounters, } from "../../../shared/pi-context-pressure/index.js";
 import { incrementCounter as incrementPressureCounter } from "../../../shared/pi-context-pressure/telemetry.js";
 import { resolveDefaultChatModel, resolveLowChatModel, } from "./model-resolver.js";
 import { filterActiveInterviewTools } from "../interview/tools.js";
-import { redactRuntimeText } from "./runtime-context.js";
-import { BrowserAutomationService } from "./browser-automation.js";
+import { RUNTIME_CONTEXT_TEXT_MAX, redactRuntimeText, } from "./runtime-context.js";
 import { buildTodoContinuationContext, } from "./todos.js";
-import { buildPersistentTerminalTools } from "./terminal-tools.js";
-import { buildScmTools } from "./scm-tools.js";
 import { buildGoalContinuationContext, } from "./goals.js";
 import { injectWizardLocalHeaders, } from "./sdd-data-alignment.js";
-import { buildCustomOperatorTools } from "./pi-runtime/custom-tools/operator-tools.js";
-import { buildBrowserTools } from "./pi-runtime/custom-tools/browser-tools.js";
-import { buildAskUserQuestionTool } from "./pi-runtime/custom-tools/ask-user-question.js";
-import { buildTodoWriteTool } from "./pi-runtime/custom-tools/todo-write.js";
-import { buildGoalTools } from "./pi-runtime/custom-tools/goal-tools.js";
-import { buildExploreCustomTools } from "./pi-runtime/custom-tools/explore-tools.js";
-import { THINKING_LEVELS, RuntimeSnapshotUnavailableError, } from "./pi-runtime/inspection-types.js";
-import { collectRuntimeInventories, collectSlashCommands, projectRuntimeSnapshot, } from "./pi-runtime/inspection.js";
-import { createDefaultPiSdkBindings, safeGetAgentDir, } from "./pi-runtime/sdk-bindings.js";
 /**
  * Base system prompt fragment every General Operator Chat session receives.
  *
@@ -80,7 +67,7 @@ import { createDefaultPiSdkBindings, safeGetAgentDir, } from "./pi-runtime/sdk-b
  */
 export const OPERATOR_CHAT_SYSTEM_PROMPT_BASE = [
     "You are General Operator Chat.",
-    "Use operator tools first (dagReport, dagRerunPlan, dagRerun). Pi read/write/edit/bash/grep/find/ls are available; obey repository AGENTS.md. apply_patch, full-tools, shell and coding-chat are denied. Prefer safe-read/safe-grep for probes. Browser_* drives the visible Browser panel only (static http(s), no workspace edits/scripts).",
+    "Use operator tools first (dagReport, dagRerunPlan, dagRerun). Pi read/write/edit/bash/grep/find/ls are available; obey repository AGENTS.md. apply_patch, full-tools, shell and coding-chat are denied. Prefer safe-read/safe-grep for probes.",
     "No harness and asked to init: `loop-agent init instructions --repo-root .`, then `loop-agent init --repo-root . --profile full --merge`; verify with doctor, inspect and docs audit. Updates: `loop-agent init upgrade --repo-root . --json` until stable; `loop-agent init check-update` is read-only.",
     "Long DAGs: prepareDagExecution → runDag → operationId. Never foreground-Bash task advance, tail/head pipes or nohup/Start-Process/start; do not end on accepted/queued/running or an operationId — NOT completion. Supervise operationGet/status/dagReport/dagDoctor/operationWait at 60s → 90s → 120s → 180s; reset to 60s on state change; 30-60s re-checks when stall suspected. operationWait MUST use afterSeq=previous nextSeq (recommendedNextCall). Heartbeats: not meaningful progress. Run id ≠ task id.",
     "Failure: terminal runSummary first. With progress wait; else dagRerunPlan(fromNode=primaryFailure.nodeId); eligible → dagRerun: reruns the failed subgraph, keeps prior successes. Ineligible: Worker → workerTaskRetry; standalone → standaloneTaskRerun after contract adopt (regenerates the whole task, not node continue). Do not call dagResume; do not re-advance a run-failed task. Pre-run identical state twice: stop and report; never loop identical bash/read/grep. Approve only bounded writeSet inside allowedPaths, outside forbiddenPaths, with structured verification.",
@@ -88,6 +75,15 @@ export const OPERATOR_CHAT_SYSTEM_PROMPT_BASE = [
     "Continue until success, user stop, or no safe recovery remains; then stop and report failure/evidence. Never create a new task for a transient failure or replace repair-pi with direct edits.",
     "Narrate long-DAG progress briefly at start, meaningful phase changes/findings, verification failure/recovery, prolonged quiet and terminal state: say what finished and what is next. Never narrate unchanged operationWait polls or heartbeats, or claim beyond structured facts.",
 ].join("\n");
+/** Compose the inspectable system prompt actually injected into Operator Chat. */
+export function composeOperatorChatSystemPrompt(input) {
+    return [
+        OPERATOR_CHAT_SYSTEM_PROMPT_BASE,
+        ...(input.systemPromptSuffix?.trim()
+            ? [input.systemPromptSuffix.trim()]
+            : []),
+    ].join("\n\n");
+}
 /**
  * Built-in SDK tool names registered for every Chat session (ADR 0011).
  * Full Pi builtins: read/write/edit/bash/grep/find/ls. safe-* custom tools
@@ -116,8 +112,27 @@ export const OPERATOR_CHAT_SAFE_EXPLORE_TOOL_IDS = Object.freeze([
     "git-diff",
 ]);
 export function OPERATOR_CHAT_ACTIVE_TOOL_NAMES() {
-    return chatActiveToolBaseline("workflow");
+    return [
+        ...OPERATOR_CHAT_ALLOWED_TOOLS,
+        ...OPERATOR_CHAT_BUILTIN_EXPLORE_TOOLS,
+        ...OPERATOR_CHAT_SAFE_EXPLORE_TOOL_IDS,
+        ...OPERATOR_CHAT_BUILTIN_CUSTOM_TOOLS,
+    ];
 }
+/**
+ * Non-Pi write / coding channels that must never be activated in Operator
+ * Chat even when a user/project extension registers them (ADR 0011 / 0012).
+ * Mirrors the NON_PI_WRITE_CHANNELS guard in tools.ts for the Gate 2 pin.
+ */
+const OPERATOR_CHAT_EXTENSION_DENIED_TOOL_IDS = new Set([
+    "apply_patch",
+    "apply-patch",
+    "full-tools",
+    "full_tools",
+    "coding-chat",
+    "coding_chat",
+    "shell",
+].map((t) => t.toLowerCase()));
 /**
  * Gate 2 active-tool set for a live session (ADR 0012): the operator-chat
  * baseline (operator actions + Pi builtins + safe explore) PLUS extension
@@ -128,8 +143,24 @@ export function OPERATOR_CHAT_ACTIVE_TOOL_NAMES() {
  * coding-chat). Unknown/denied names are never activated; Gate 3 still
  * re-authorizes every tool call per invocation.
  */
-export function computeOperatorChatActiveToolNames(session, sessionMode = DEFAULT_CONSOLE_CHAT_SESSION_MODE) {
-    return computeChatActiveToolNames(session, sessionMode);
+export function computeOperatorChatActiveToolNames(session) {
+    const baseline = OPERATOR_CHAT_ACTIVE_TOOL_NAMES();
+    if (!session?.getAllTools)
+        return baseline;
+    const baselineLower = new Set(baseline.map((t) => t.toLowerCase()));
+    const extras = [];
+    for (const tool of session.getAllTools()) {
+        const name = tool?.name;
+        if (!name || typeof name !== "string")
+            continue;
+        const lower = name.toLowerCase();
+        if (baselineLower.has(lower))
+            continue;
+        if (OPERATOR_CHAT_EXTENSION_DENIED_TOOL_IDS.has(lower))
+            continue;
+        extras.push(name);
+    }
+    return extras.length > 0 ? [...baseline, ...extras] : baseline;
 }
 const OPERATOR_CHAT_SESSION_EXCLUDE_TOOLS = Object.freeze([
     "apply_patch",
@@ -185,8 +216,8 @@ async function bindSessionExtensions(session) {
         return;
     await session.bindExtensions(createConsoleExtensionBindings());
 }
-function pinOperatorChatTools(session, sessionMode = DEFAULT_CONSOLE_CHAT_SESSION_MODE) {
-    session.setActiveToolsByName(computeChatActiveToolNames(session, sessionMode));
+function pinOperatorChatTools(session) {
+    session.setActiveToolsByName(computeOperatorChatActiveToolNames(session));
 }
 /**
  * Pi has no hook result that merely appends instructions to its built-in
@@ -288,8 +319,592 @@ export function createWizardLocalHeadersExtension(options) {
         },
     };
 }
-export { THINKING_LEVELS, RuntimeSnapshotUnavailableError, projectRuntimeSnapshot, };
-export { createDefaultPiSdkBindings } from "./pi-runtime/sdk-bindings.js";
+/**
+ * Build Pi custom ToolDefinition objects for every whitelisted operator action.
+ * Each tool's execute() routes into the operator action dispatcher (Gate 3).
+ * Requires the `typebox` + `defineTool` packages (both bundled with the SDK).
+ */
+async function buildCustomOperatorTools(options) {
+    // typebox is a transitive dep of @earendil-works/pi-coding-agent; Node's
+    // resolver hoists to the SDK's nested copy. defineTool is re-exported by SDK.
+    const [{ Type }, { defineTool }] = await Promise.all([
+        import("typebox"),
+        import("@earendil-works/pi-coding-agent"),
+    ]);
+    const schemas = buildModelCallableToolSchemas();
+    const ctx = options.actionContext;
+    return schemas.map((schema) => {
+        // TypeBox schema is built dynamically; cast through unknown to the builder
+        // since Static<TParams> is structural and cannot be statically inferred here.
+        const parameters = Type.Object(schema.inputParams.reduce((acc, param) => {
+            // Carry the registry's param description into the tool schema so
+            // the model sees parameter semantics, not just names/types.
+            const desc = param.description?.trim()
+                ? { description: param.description }
+                : {};
+            let t;
+            switch (param.type) {
+                case "string":
+                    t = Type.String(desc);
+                    break;
+                case "boolean":
+                    t = Type.Boolean(desc);
+                    break;
+                case "number":
+                    t = Type.Number(desc);
+                    break;
+                case "array":
+                    t = Type.Array(Type.String({}), Object.keys(desc).length ? desc : {});
+                    break;
+                default:
+                    t = Type.Object({}, { additionalProperties: true });
+            }
+            acc[param.name] = param.required ? t : Type.Optional(t);
+            return acc;
+        }, {}), { additionalProperties: false });
+        return defineTool({
+            name: schema.toolId,
+            label: schema.toolId,
+            description: `${schema.description} (kind=${schema.kind}; cli: ${schema.cli})`,
+            promptSnippet: schema.description,
+            parameters: parameters,
+            async execute(toolCallId, params) {
+                const decision = authorizeOperatorChatTool(schema.toolId);
+                if (!decision.ok) {
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: JSON.stringify({
+                                    error: decision.message,
+                                    code: decision.code,
+                                }),
+                            },
+                        ],
+                        details: { error: decision.message, code: decision.code },
+                    };
+                }
+                // Defer require to avoid circular import at module load.
+                const { dispatchChatToolCall } = await import("./session-store.js");
+                const result = await dispatchChatToolCall(ctx, decision.toolId, params, toolCallId);
+                const payload = result.ok
+                    ? result.result
+                    : { error: result.message, code: result.errorCode };
+                return {
+                    content: [{ type: "text", text: JSON.stringify(payload) }],
+                    details: payload,
+                };
+            },
+        });
+    });
+}
+const ASK_USER_QUESTION_DESCRIPTION = "Ask the user concise questions when a confirmation, choice, or missing detail is required before proceeding. " +
+    "The tool pauses until the user answers. Use it instead of writing questions as ordinary assistant text. " +
+    "Send one or more questions with stable ids; recommended options should be first and end with (Recommended).";
+async function buildAskUserQuestionTool(options) {
+    const [{ Type }, { defineTool }] = await Promise.all([
+        import("typebox"),
+        import("@earendil-works/pi-coding-agent"),
+    ]);
+    return defineTool({
+        name: "ask_user_question",
+        label: "Ask user",
+        description: ASK_USER_QUESTION_DESCRIPTION,
+        promptSnippet: ASK_USER_QUESTION_DESCRIPTION,
+        parameters: Type.Object({
+            questions: Type.Array(Type.Object({
+                id: Type.String({ description: "Stable question id echoed in the answer." }),
+                question: Type.String({ description: "Specific user-facing question." }),
+                header: Type.Optional(Type.String({ description: "Optional short heading." })),
+                detail: Type.Optional(Type.String({ description: "Optional Markdown context shown below the question." })),
+                options: Type.Optional(Type.Array(Type.Object({
+                    label: Type.String({ description: "Short user-facing option label." }),
+                    description: Type.Optional(Type.String({ description: "One sentence explaining impact or tradeoff." })),
+                }, { additionalProperties: false }))),
+                multi_select: Type.Optional(Type.Boolean({ description: "Allow more than one option." })),
+            }, { additionalProperties: false }), { minItems: 1, maxItems: 20 }),
+        }, { additionalProperties: false }),
+        async execute(toolCallId, params, signal) {
+            const answer = await options.registry.ask({
+                sessionId: options.sessionId,
+                toolCallId,
+                questions: params.questions,
+                signal,
+            });
+            return {
+                content: [{ type: "text", text: JSON.stringify(answer) }],
+                details: answer,
+            };
+        },
+    });
+}
+const TODO_WRITE_DESCRIPTION = "Record and update a structured task list for the current work. Send the ENTIRE list every call — it REPLACES the previous list (no partial updates, no per-item edits). Before starting multi-step work, add one todo per concrete step. Keep at least one todo `in_progress` while work remains. Mark a todo `completed` immediately when it is done (do not batch completions) and resend the full list as progress or DAG state advances. Skip the list for simple Q&A, read-only lookups, and single-step tasks. Use it for multi-step implementation and whenever you prepare, run, or supervise a DAG — call `todo_write` before entering the DAG tool chain. Phrase DAG todos as user-facing phases users can understand, not copies of internal DAG nodes. Statuses: `pending` / `in_progress` / `completed`.";
+async function buildTodoWriteTool(options) {
+    const [{ Type }, { defineTool }] = await Promise.all([
+        import("typebox"),
+        import("@earendil-works/pi-coding-agent"),
+    ]);
+    return defineTool({
+        name: "todo_write",
+        label: "Update todo list",
+        description: TODO_WRITE_DESCRIPTION,
+        promptSnippet: TODO_WRITE_DESCRIPTION,
+        parameters: Type.Object({
+            todos: Type.Array(Type.Object({
+                content: Type.String({ description: "Short imperative task description." }),
+                status: Type.Union([
+                    Type.Literal("pending"),
+                    Type.Literal("in_progress"),
+                    Type.Literal("completed"),
+                ]),
+            }, { additionalProperties: false })),
+        }, { additionalProperties: false }),
+        async execute(toolCallId, params) {
+            const result = options.registry.write(options.sessionId, toolCallId, params.todos);
+            return {
+                content: [{ type: "text", text: JSON.stringify(result) }],
+                details: result,
+            };
+        },
+    });
+}
+const GET_GOAL_DESCRIPTION = "Read the current session's durable cross-turn Goal, including revision, status, round limit, and whether this Console process is authorized to continue it.";
+const CREATE_GOAL_DESCRIPTION = "Create a durable cross-turn Goal only when the user explicitly asks to start or create a Goal. Never silently upgrade an ordinary request. A session may have only one unfinished Goal.";
+const UPDATE_GOAL_DESCRIPTION = "Finish or block the current durable Goal using its exact goalId and revision. Set complete only when the objective is genuinely achieved and no required work remains. Set blocked only when safe progress cannot continue; include the blocker.";
+async function buildGoalTools(options) {
+    const [{ Type }, { defineTool }] = await Promise.all([
+        import("typebox"),
+        import("@earendil-works/pi-coding-agent"),
+    ]);
+    const textResult = (value) => ({
+        content: [{ type: "text", text: JSON.stringify(value) }],
+        details: value,
+    });
+    return [
+        defineTool({
+            name: "get_goal",
+            label: "Get goal",
+            description: GET_GOAL_DESCRIPTION,
+            promptSnippet: GET_GOAL_DESCRIPTION,
+            parameters: Type.Object({}, { additionalProperties: false }),
+            async execute() {
+                return textResult({ goal: options.registry.get(options.sessionId) });
+            },
+        }),
+        defineTool({
+            name: "create_goal",
+            label: "Create goal",
+            description: CREATE_GOAL_DESCRIPTION,
+            promptSnippet: CREATE_GOAL_DESCRIPTION,
+            parameters: Type.Object({
+                objective: Type.String({
+                    description: "Concrete final objective and completion standard explicitly requested by the user.",
+                }),
+            }, { additionalProperties: false }),
+            async execute(_toolCallId, params) {
+                if (!options.registry.consumeModelCreateGrant(options.sessionId)) {
+                    return textResult({
+                        ok: false,
+                        code: "GOAL_EXPLICIT_REQUEST_REQUIRED",
+                        message: "create_goal requires an explicit user request to create or start a Goal",
+                    });
+                }
+                return textResult(options.registry.create({
+                    sessionId: options.sessionId,
+                    objective: params.objective,
+                }));
+            },
+        }),
+        defineTool({
+            name: "update_goal",
+            label: "Update goal",
+            description: UPDATE_GOAL_DESCRIPTION,
+            promptSnippet: UPDATE_GOAL_DESCRIPTION,
+            parameters: Type.Object({
+                goalId: Type.String(),
+                revision: Type.Number({ minimum: 1 }),
+                status: Type.Union([
+                    Type.Literal("complete"),
+                    Type.Literal("blocked"),
+                ]),
+                blocker: Type.Optional(Type.String()),
+            }, { additionalProperties: false }),
+            async execute(_toolCallId, params) {
+                return textResult(options.registry.update({
+                    sessionId: options.sessionId,
+                    goalId: params.goalId,
+                    expectedRevision: params.revision,
+                    phase: params.status,
+                    blocker: params.blocker,
+                    arm: false,
+                }));
+            },
+        }),
+    ];
+}
+/**
+ * Build the safe explore custom tools (roadmap M0-A / G16): safe-read,
+ * safe-grep, gitStatus, gitDiff. These replace the bare SDK bash/read/grep so
+ * the model can probe the repo WITHOUT write escapes (echo redirect, tee,
+ * sed -i, node -e) and WITHOUT reading sensitive files (env files, key/pem,
+ * auth.json, sessions dir) — and every returned byte is secret-scrubbed
+ * before reaching the model context.
+ *
+ * gitStatus/gitDiff use a FIXED argv (typed, no shell) so they cannot be
+ * turned into an arbitrary-shell vector.
+ */
+async function buildExploreCustomTools(options) {
+    const [{ Type }, { defineTool }] = await Promise.all([
+        import("typebox"),
+        import("@earendil-works/pi-coding-agent"),
+    ]);
+    const { execFileSync } = await import("node:child_process");
+    const repoRoot = options.repoRoot;
+    const { safeReadFile, safeGrep, scrubSecrets } = await import("./explore-tools.js");
+    function safeGit(args) {
+        try {
+            const stdout = execFileSync("git", args, {
+                cwd: repoRoot,
+                encoding: "utf8",
+                // Fixed argv, no shell, bounded output.
+                maxBuffer: 512 * 1024,
+                timeout: 10_000,
+                windowsHide: true,
+            });
+            return { ok: true, stdout };
+        }
+        catch (e) {
+            return {
+                ok: false,
+                code: "GIT_FAILED",
+                message: e instanceof Error ? e.message : String(e),
+            };
+        }
+    }
+    const safeReadTool = defineTool({
+        name: "safe-read",
+        label: "safe-read",
+        description: "Read a repo-relative file with sensitive-file denylist (.env*/*.key/*.pem/.git/**/auth.json/sessions/**) and secret scrubbing. Absolute paths and .. are rejected.",
+        promptSnippet: "safe-read: read a repo file (safe; secrets scrubbed)",
+        parameters: Type.Object({
+            path: Type.String({ description: "repo-relative file path" }),
+        }, { additionalProperties: false }),
+        async execute(_toolCallId, params) {
+            const raw = String(params.path ?? "");
+            try {
+                const result = await safeReadFile(repoRoot, raw);
+                return {
+                    content: [{ type: "text", text: JSON.stringify(result) }],
+                    details: result,
+                };
+            }
+            catch (e) {
+                const err = e;
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify({
+                                error: err.message ?? String(e),
+                                code: err.code ?? "READ_FAILED",
+                            }),
+                        },
+                    ],
+                    details: {
+                        error: err.message ?? String(e),
+                        code: err.code ?? "READ_FAILED",
+                    },
+                };
+            }
+        },
+    });
+    const safeGrepTool = defineTool({
+        name: "safe-grep",
+        label: "safe-grep",
+        description: "Line search across the repo working tree with sensitive-file denylist and secret scrubbing. pattern is a JS regex source; optional glob filters paths.",
+        promptSnippet: "safe-grep: search repo files (safe; secrets scrubbed)",
+        parameters: Type.Object({
+            pattern: Type.String({ description: "regex source (no shell)" }),
+            caseInsensitive: Type.Optional(Type.Boolean()),
+            glob: Type.Optional(Type.String({ description: "optional glob filter e.g. *.ts" })),
+        }, { additionalProperties: false }),
+        async execute(_toolCallId, params) {
+            try {
+                const result = await safeGrep(repoRoot, String(params.pattern ?? ""), {
+                    caseInsensitive: Boolean(params.caseInsensitive),
+                    glob: params.glob ? String(params.glob) : undefined,
+                });
+                return {
+                    content: [{ type: "text", text: JSON.stringify(result) }],
+                    details: result,
+                };
+            }
+            catch (e) {
+                const err = e;
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify({
+                                error: err.message ?? String(e),
+                                code: err.code ?? "GREP_FAILED",
+                            }),
+                        },
+                    ],
+                    details: {
+                        error: err.message ?? String(e),
+                        code: err.code ?? "GREP_FAILED",
+                    },
+                };
+            }
+        },
+    });
+    const gitStatusTool = defineTool({
+        name: "git-status",
+        label: "git-status",
+        description: "Typed `git status --porcelain` (fixed argv, no shell). Returns scrubbed working-tree status.",
+        promptSnippet: "git-status: working tree status (read-only)",
+        parameters: Type.Object({}, { additionalProperties: false }),
+        async execute() {
+            const r = safeGit(["status", "--porcelain"]);
+            if (!r.ok) {
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify({ error: r.message, code: r.code }),
+                        },
+                    ],
+                    details: { error: r.message, code: r.code },
+                };
+            }
+            const { scrubbed, redactions } = scrubSecrets(r.stdout);
+            const payload = { status: scrubbed, redactions };
+            return {
+                content: [{ type: "text", text: JSON.stringify(payload) }],
+                details: payload,
+            };
+        },
+    });
+    const gitDiffTool = defineTool({
+        name: "git-diff",
+        label: "git-diff",
+        description: "Typed `git diff` (fixed argv: --stat or a single -- path; no shell). Returns scrubbed diff. path must be repo-relative and not sensitive.",
+        promptSnippet: "git-diff: diff (read-only, scrubbed)",
+        parameters: Type.Object({
+            path: Type.Optional(Type.String({
+                description: "optional repo-relative path to diff (default: whole tree --stat)",
+            })),
+        }, { additionalProperties: false }),
+        async execute(_toolCallId, params) {
+            let rawPath = params.path ? String(params.path) : undefined;
+            // If a path is supplied, validate it via the read-path guard so git diff
+            // cannot be aimed at sensitive files (.env* / auth.json / sessions).
+            if (rawPath) {
+                const { guardReadPath } = await import("./explore-tools.js");
+                const g = await guardReadPath(repoRoot, rawPath);
+                if (!g.ok) {
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: JSON.stringify({ error: g.message, code: g.code }),
+                            },
+                        ],
+                        details: { error: g.message, code: g.code },
+                    };
+                }
+                rawPath = g.repoRelative;
+            }
+            const args = rawPath ? ["diff", "--", rawPath] : ["diff", "--stat"];
+            const r = safeGit(args);
+            if (!r.ok) {
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify({ error: r.message, code: r.code }),
+                        },
+                    ],
+                    details: { error: r.message, code: r.code },
+                };
+            }
+            const { scrubbed, redactions } = scrubSecrets(r.stdout);
+            const payload = { diff: scrubbed, redactions };
+            return {
+                content: [{ type: "text", text: JSON.stringify(payload) }],
+                details: payload,
+            };
+        },
+    });
+    return [safeReadTool, safeGrepTool, gitStatusTool, gitDiffTool];
+}
+export const THINKING_LEVELS = [
+    "off",
+    "minimal",
+    "low",
+    "medium",
+    "high",
+    "xhigh",
+    "max",
+];
+/**
+ * Structured critical-failure error for snapshot projection (RF-02). Model
+ * enumeration or system prompt projection failures throw this so consuming
+ * routes can return 503 PI_RUNTIME_UNAVAILABLE instead of a fake-empty 200.
+ * Partial ResourceLoader / package-inventory failures are NOT critical — they
+ * keep the 200 snapshot and surface as structured diagnostics instead.
+ */
+export class RuntimeSnapshotUnavailableError extends Error {
+    code = "PI_RUNTIME_UNAVAILABLE";
+    constructor(message) {
+        super(message);
+        this.name = "RuntimeSnapshotUnavailableError";
+    }
+}
+/**
+ * Browser-safe projection of a live runtime snapshot (design §2.2 / RF-03).
+ *
+ * Every browser-visible string runs the shared secret-scrub chain
+ * (scrubSecrets + ghp_/Bearer redaction via redactRuntimeText) and a fixed
+ * per-field length limit: 200 (names/spec/source/origin), 400 (paths/errors/
+ * diagnostic messages), 600 (skill descriptions), 80 (package versions);
+ * truncation uses the fixed `…[truncated N chars …]` marker. The server-only
+ * `raw` prompt and the RAW-based `sha256`/`characters` pass through untouched,
+ * and real empty lists stay empty.
+ *
+ * Pure + deterministic and exported so the route harness reuses the exact
+ * production implementation (same code path as getRuntimeSnapshot).
+ */
+export function projectRuntimeSnapshot(input) {
+    const field = (value, max) => value === undefined ? undefined : redactRuntimeText(value, max);
+    const projectSkill = (skill) => ({
+        name: field(skill.name, 200) ?? "",
+        description: field(skill.description, 600) ?? "",
+        path: field(skill.path, 400) ?? "",
+        ...(skill.baseDir ? { baseDir: field(skill.baseDir, 400) } : {}),
+        scope: skill.scope,
+        source: field(skill.source, 200) ?? "",
+        resourceId: field(skill.resourceId, 200) ?? "",
+        autoInvocationEnabled: skill.autoInvocationEnabled,
+        diagnostics: skill.diagnostics.map((diag) => field(diag, 400) ?? ""),
+    });
+    const projectExtension = (ext) => ({
+        name: field(ext.name, 200) ?? "",
+        path: field(ext.path, 400) ?? "",
+        ...(ext.resolvedPath
+            ? { resolvedPath: field(ext.resolvedPath, 400) }
+            : {}),
+        source: field(ext.source, 200) ?? "",
+        scope: ext.scope,
+        ...(ext.origin ? { origin: field(ext.origin, 200) } : {}),
+        enabled: ext.enabled,
+        ...(ext.error ? { error: field(ext.error, 400) } : {}),
+    });
+    const projectPackage = (pkg) => ({
+        spec: field(pkg.spec, 200) ?? "",
+        scope: pkg.scope,
+        enabled: pkg.enabled,
+        ...(pkg.version ? { version: field(pkg.version, 80) } : {}),
+        ...(pkg.configuredVersion
+            ? { configuredVersion: field(pkg.configuredVersion, 80) }
+            : {}),
+        ...(pkg.packageName ? { packageName: field(pkg.packageName, 200) } : {}),
+        ...(pkg.path ? { path: field(pkg.path, 400) } : {}),
+        ...(pkg.installedPath ? { installedPath: field(pkg.installedPath, 400) } : {}),
+        ...(pkg.cwd ? { cwd: field(pkg.cwd, 400) } : {}),
+        resolved: pkg.resolved.map((resource) => ({
+            type: resource.type,
+            name: field(resource.name, 200) ?? "",
+            path: field(resource.path, 400) ?? "",
+            source: field(resource.source, 200) ?? "",
+            scope: resource.scope,
+        })),
+        diagnostics: pkg.diagnostics.map((diag) => field(diag, 400) ?? ""),
+    });
+    const projectMcpTool = (tool) => ({
+        name: field(tool.name, 200) ?? "",
+        description: field(tool.description, 600) ?? "",
+        ...(tool.server ? { server: field(tool.server, 200) } : {}),
+        source: field(tool.source, 200) ?? "",
+        scope: tool.scope,
+        ...(tool.path ? { path: field(tool.path, 400) } : {}),
+        active: tool.active,
+    });
+    const projectMcp = (mcp) => ({
+        servers: mcp.servers.map((server) => ({
+            name: field(server.name, 200) ?? "",
+            scope: server.scope,
+            status: server.status,
+            enabled: server.enabled,
+            ...(server.transport ? { transport: field(server.transport, 80) } : {}),
+            ...(server.command ? { command: field(server.command, 400) } : {}),
+            ...(server.url ? { url: field(server.url, 400) } : {}),
+            ...(server.configPath ? { configPath: field(server.configPath, 400) } : {}),
+            tools: server.tools.map(projectMcpTool),
+        })),
+        unassignedTools: mcp.unassignedTools.map(projectMcpTool),
+    });
+    const projectDiagnostic = (diag) => ({
+        type: diag.type,
+        ...(diag.code ? { code: diag.code } : {}),
+        message: field(diag.message, 400) ?? "",
+        ...(diag.path ? { path: field(diag.path, 400) } : {}),
+        ...(diag.retryable !== undefined
+            ? { retryable: diag.retryable }
+            : {}),
+    });
+    return {
+        sessionId: input.sessionId,
+        revision: input.revision,
+        loadedAt: input.loadedAt,
+        selection: {
+            ...(input.selection.model
+                ? {
+                    model: {
+                        provider: input.selection.model.provider,
+                        id: input.selection.model.id,
+                        ...(input.selection.model.name
+                            ? { name: field(input.selection.model.name, 200) }
+                            : {}),
+                    },
+                }
+                : {}),
+            thinkingSelection: input.selection.thinkingSelection,
+            ...(input.selection.effectiveThinkingLevel
+                ? { effectiveThinkingLevel: input.selection.effectiveThinkingLevel }
+                : {}),
+        },
+        models: input.models.map((model) => ({
+            provider: model.provider,
+            id: model.id,
+            ...(model.name ? { name: field(model.name, 200) } : {}),
+            ...(model.hasCredentials !== undefined
+                ? { hasCredentials: model.hasCredentials }
+                : {}),
+        })),
+        thinkingLevels: input.thinkingLevels.map((option) => ({ ...option })),
+        systemPrompt: {
+            ...(input.systemPrompt.raw !== undefined
+                ? { raw: input.systemPrompt.raw }
+                : {}),
+            text: redactRuntimeText(input.systemPrompt.text, RUNTIME_CONTEXT_TEXT_MAX),
+            sha256: input.systemPrompt.sha256,
+            characters: input.systemPrompt.characters,
+        },
+        activeTools: [...input.activeTools],
+        contextFiles: input.contextFiles.map((file) => ({
+            path: field(file.path, 400) ?? "",
+            characters: file.characters,
+        })),
+        skills: input.skills.map(projectSkill),
+        extensions: input.extensions.map(projectExtension),
+        packages: input.packages.map(projectPackage),
+        mcp: projectMcp(input.mcp ?? { servers: [], unassignedTools: [] }),
+        diagnostics: input.diagnostics.map(projectDiagnostic),
+        hasBash: input.hasBash,
+    };
+}
 export { extractAssistantContentBlocks, extractAssistantText, isAssistantSdkMessage };
 function readSessionManagerId(manager) {
     if (!manager || typeof manager !== "object")
@@ -406,23 +1021,19 @@ export class ConsolePiRuntime {
     sessionInit = new Map();
     /** Resolved model binding after materialization (create may return before this is known). */
     sessionModels = new Map();
-    /** Durable session mode; record is the source of truth, this is the live handle cache. */
-    sessionModes = new Map();
     /** SessionIds disposed while materialization was still in flight. */
     disposedSessions = new Set();
     compactionControllers = new Map();
     siftStates = new Map();
     /** Session-less tool definition caches (no AgentSession state). */
-    operatorCustomToolsByMode = new Map();
+    operatorCustomToolsPromise;
     exploreCustomToolsPromise;
     exploreOrchestrator;
     bindings;
-    browserAutomation;
     constructor(options) {
         this.options = options;
         this.loader = createOperatorChatResourceLoader();
         this.bindings = options.bindings ?? createDefaultPiSdkBindings();
-        this.browserAutomation = options.browserAutomation ?? new BrowserAutomationService();
         this.exploreOrchestrator = new ExploreOrchestrator({
             cwd: this.options.cwd,
             bindings: this.bindings,
@@ -443,9 +1054,6 @@ export class ConsolePiRuntime {
             },
         });
     }
-    async syncAimaxAuthToken() {
-        await this.options.sddDataAlignment?.auth?.getToken();
-    }
     /** Absolute path for repo-scoped resource preferences (may be undefined in unit tests). */
     get resourcePreferencesPath() {
         return this.options.resourcePreferencesPath;
@@ -474,15 +1082,6 @@ export class ConsolePiRuntime {
      * after a PATCH sees the latest resource-preferences.json (not create-time
      * closure state).
      */
-    sessionModeOf(sessionId) {
-        if (!sessionId)
-            return DEFAULT_CONSOLE_CHAT_SESSION_MODE;
-        return this.sessionModes.get(sessionId) ?? DEFAULT_CONSOLE_CHAT_SESSION_MODE;
-    }
-    rememberSessionMode(sessionId, sessionMode = DEFAULT_CONSOLE_CHAT_SESSION_MODE) {
-        this.sessionModes.set(sessionId, sessionMode);
-        return sessionMode;
-    }
     async buildResourceLoaderOptions(base = {}, sessionId) {
         const inheritedFactories = Array.isArray(base.extensionFactories)
             ? base.extensionFactories
@@ -582,11 +1181,9 @@ export class ConsolePiRuntime {
             policy,
             controller: this.getCompactionController(sessionId),
             sift,
-            normalizeTransientProviderErrors: true,
         });
     }
-    applySessionRecoveryOverrides(sessionId, services, session) {
-        applyProcessRetryOverride(services?.settingsManager);
+    applySessionCompactionOverride(sessionId, services, session) {
         const manager = services?.settingsManager;
         const window = session?.getSessionStats?.()?.contextUsage?.contextWindow;
         applyProcessCompactionOverride(manager, {
@@ -604,7 +1201,7 @@ export class ConsolePiRuntime {
         const window = stats?.contextUsage?.contextWindow;
         const tokens = stats?.contextUsage?.tokens;
         if (typeof window === "number" && window > 0) {
-            this.applySessionRecoveryOverrides(sessionId, this.serviceScopes.get(sessionId) ?? {}, session);
+            this.applySessionCompactionOverride(sessionId, this.serviceScopes.get(sessionId) ?? {}, session);
         }
         const projection = projectPromptPressure({
             currentContextTokens: tokens,
@@ -744,10 +1341,8 @@ export class ConsolePiRuntime {
      * `initializing: true`; dependent routes wait on the same promise.
      */
     async createSession(init) {
-        await this.syncAimaxAuthToken();
         const sessionId = `operator-chat-${randomBytes(12).toString("hex")}`;
         this.disposedSessions.delete(sessionId);
-        const sessionMode = this.rememberSessionMode(sessionId, init?.sessionMode ?? DEFAULT_CONSOLE_CHAT_SESSION_MODE);
         const sessionManager = await this.bindings.createSessionManager({
             cwd: this.options.cwd,
             sessionDir: this.options.sessionDir,
@@ -773,7 +1368,6 @@ export class ConsolePiRuntime {
             sessionManager,
             model: init?.model,
             systemPromptSuffix: init?.systemPromptSuffix,
-            sessionMode,
             // Create path must resolve default model from the SAME services object
             // used for formal materialization (no throwaway createServices).
             resolveDefaultModel: !init?.model,
@@ -783,8 +1377,7 @@ export class ConsolePiRuntime {
             sessionFile,
             createdAt: new Date().toISOString(),
             model: init?.model,
-            activeTools: chatActiveToolBaseline(sessionMode),
-            sessionMode,
+            activeTools: OPERATOR_CHAT_ACTIVE_TOOL_NAMES(),
             initializing: true,
         };
     }
@@ -842,33 +1435,28 @@ export class ConsolePiRuntime {
         this.sessionInit.set(sessionId, { status: "initializing", promise });
         return promise;
     }
-    /**
-     * Shared session preparation for create/reopen/fork: config capture, prompt
-     * composition, resource loading, model resolution, tool assembly, SDK session
-     * create, extension bind, tool pin, compaction override. Lifecycle maps stay
-     * owned by the caller.
-     */
-    async prepareLiveSession(init) {
-        const aborted = () => Boolean(init.abortIfDisposed && this.disposedSessions.has(init.sessionId));
-        if (aborted())
-            return undefined;
+    async materializeSession(sessionId, init) {
+        if (this.disposedSessions.has(sessionId))
+            return;
         const agentDir = await safeGetAgentDir(this.bindings);
         // Capture before services parse models.json. A concurrent edit can therefore
         // cause at most one harmless extra refresh, never a missed next-turn refresh.
         const modelConfigFile = await captureModelConfigFile(agentDir);
-        const appendSystemPrompt = composeChatSystemPromptParts({
-            sessionMode: init.sessionMode,
-            workflowPrompt: OPERATOR_CHAT_SYSTEM_PROMPT_BASE,
-            systemPromptSuffix: init.systemPromptSuffix,
-        });
+        const appendSystemPrompt = [
+            OPERATOR_CHAT_SYSTEM_PROMPT_BASE,
+            ...(init.systemPromptSuffix ? [init.systemPromptSuffix] : []),
+        ];
+        // Single services construction for formal materialization (+ optional
+        // default-model resolve from the same modelRuntime). Repo-scoped skill
+        // auto-invocation prefs inject skillsOverride without touching SKILL.md.
         await this.refreshSkillPrefsCache().catch(() => undefined);
         const { services } = await this.bindings.createServices({
             cwd: this.options.cwd,
             agentDir,
-            resourceLoaderOptions: await this.buildResourceLoaderOptions({ appendSystemPrompt }, init.sessionId),
+            resourceLoaderOptions: await this.buildResourceLoaderOptions({ appendSystemPrompt }, sessionId),
         });
-        if (aborted())
-            return undefined;
+        if (this.disposedSessions.has(sessionId))
+            return;
         const modelRuntime = services.modelRuntime;
         let model = init.model;
         if (!model && init.resolveDefaultModel) {
@@ -882,9 +1470,9 @@ export class ConsolePiRuntime {
             }) ?? undefined)
             : undefined;
         assertNoWriteToolInList(OPERATOR_CHAT_ALLOWED_TOOLS);
-        const customTools = await this.loadCustomTools(init.sessionId);
-        if (aborted())
-            return undefined;
+        const customTools = await this.loadCustomTools(sessionId);
+        if (this.disposedSessions.has(sessionId))
+            return;
         // pi-web parity: do NOT pass `tools`. A closed allowlist becomes
         // SDK allowedToolNames and filters extension MCP tools out of the
         // registry before Gate 2 can re-add them. Operator/safe customTools
@@ -898,59 +1486,35 @@ export class ConsolePiRuntime {
             ...(customTools.length > 0 ? { customTools } : {}),
             ...(resolvedModel ? { model: resolvedModel } : {}),
         });
-        if (aborted()) {
+        if (this.disposedSessions.has(sessionId)) {
             try {
                 session.dispose();
             }
             catch {
                 // ignore late dispose cleanup
             }
-            return undefined;
+            return;
         }
         await bindSessionExtensions(session);
-        pinOperatorChatTools(session, init.sessionMode);
-        this.applySessionRecoveryOverrides(init.sessionId, services, session);
-        return {
-            session,
-            modelRuntime,
-            modelConfigFile,
-            model,
-            services: {
-                resourceLoader: services.resourceLoader,
-                settingsManager: services.settingsManager,
-            },
-        };
-    }
-    async materializeSession(sessionId, init) {
-        if (this.disposedSessions.has(sessionId))
-            return;
-        await this.syncAimaxAuthToken();
-        const sessionMode = this.rememberSessionMode(sessionId, init.sessionMode ?? this.sessionModeOf(sessionId));
-        const prepared = await this.prepareLiveSession({
-            sessionId,
-            sessionManager: init.sessionManager,
-            model: init.model,
-            systemPromptSuffix: init.systemPromptSuffix,
-            sessionMode,
-            resolveDefaultModel: init.resolveDefaultModel,
-            abortIfDisposed: true,
-        });
-        if (!prepared)
-            return;
+        pinOperatorChatTools(session);
         // Register then re-check dispose race: a concurrent dispose must win.
-        this.sessions.set(sessionId, prepared.session);
+        this.sessions.set(sessionId, session);
         this.sessionManagers.set(sessionId, init.sessionManager);
-        this.modelRuntimes.set(sessionId, prepared.modelRuntime);
-        this.modelConfigFiles.set(sessionId, prepared.modelConfigFile);
-        this.sessionModels.set(sessionId, prepared.model);
-        this.serviceScopes.set(sessionId, prepared.services);
+        this.modelRuntimes.set(sessionId, modelRuntime);
+        this.modelConfigFiles.set(sessionId, modelConfigFile);
+        this.sessionModels.set(sessionId, model);
+        this.serviceScopes.set(sessionId, {
+            resourceLoader: services.resourceLoader,
+            settingsManager: services.settingsManager,
+        });
+        this.applySessionCompactionOverride(sessionId, services, session);
         this.revisions.set(sessionId, 1);
         if (!this.thinkingSelections.has(sessionId)) {
             this.thinkingSelections.set(sessionId, "auto");
         }
         if (this.disposedSessions.has(sessionId)) {
             try {
-                prepared.session.dispose();
+                session.dispose();
             }
             catch {
                 // ignore
@@ -960,7 +1524,6 @@ export class ConsolePiRuntime {
             this.modelRuntimes.delete(sessionId);
             this.modelConfigFiles.delete(sessionId);
             this.sessionModels.delete(sessionId);
-            this.sessionModes.delete(sessionId);
             this.serviceScopes.delete(sessionId);
             this.revisions.delete(sessionId);
             this.thinkingSelections.delete(sessionId);
@@ -968,17 +1531,10 @@ export class ConsolePiRuntime {
     }
     /** Cached session-less custom tool definitions (operator + explore). */
     async loadCustomTools(sessionId) {
-        const sessionMode = this.sessionModeOf(sessionId);
-        const loadWorkflowTools = shouldLoadWorkflowBusinessTools(sessionMode);
         const [operatorCustomTools, exploreCustomTools] = await Promise.all([
-            loadWorkflowTools
-                ? this.loadOperatorCustomTools(sessionMode)
-                : Promise.resolve([]),
+            this.loadOperatorCustomTools(),
             this.loadExploreCustomTools(),
         ]);
-        const browserTools = await buildBrowserTools({
-            automation: this.browserAutomation,
-        });
         const questionTool = this.options.questionRegistry
             ? await buildAskUserQuestionTool({
                 sessionId,
@@ -986,31 +1542,11 @@ export class ConsolePiRuntime {
             })
             : undefined;
         const todoTool = this.options.todoRegistry
-            ? await buildTodoWriteTool({
-                sessionId,
-                registry: this.options.todoRegistry,
-                sessionMode,
-            })
+            ? await buildTodoWriteTool({ sessionId, registry: this.options.todoRegistry })
             : undefined;
         const goalTools = this.options.goalRegistry
             ? await buildGoalTools({ sessionId, registry: this.options.goalRegistry })
             : [];
-        const terminalTools = this.options.terminalRegistry
-            ? await buildPersistentTerminalTools({
-                ownerSessionId: sessionId,
-                registry: this.options.terminalRegistry,
-                defaultCwd: this.options.cwd,
-            }).catch((error) => {
-                process.stderr.write(`[console] chat terminal-tools build failed: ${error instanceof Error ? error.message : String(error)}\n`);
-                return [];
-            })
-            : [];
-        const scmTools = this.options.scmService
-            ? await buildScmTools({ scm: this.options.scmService }).catch((error) => {
-                process.stderr.write(`[console] chat scm-tools build failed: ${error instanceof Error ? error.message : String(error)}\n`);
-                return [];
-            })
-            : [];
         const agentTool = await buildAgentCustomTool({
             parentSessionId: sessionId,
             orchestrator: this.exploreOrchestrator,
@@ -1035,29 +1571,23 @@ export class ConsolePiRuntime {
             ...(questionTool ? [questionTool] : []),
             ...(todoTool ? [todoTool] : []),
             ...goalTools,
-            ...terminalTools,
-            ...scmTools,
-            ...browserTools,
             ...(agentTool ? [agentTool] : []),
         ];
     }
-    loadOperatorCustomTools(sessionMode) {
+    loadOperatorCustomTools() {
         if (!this.options.actionContext)
             return Promise.resolve([]);
-        const cached = this.operatorCustomToolsByMode.get(sessionMode);
-        if (cached)
-            return cached;
-        const promise = buildCustomOperatorTools({
-            actionContext: this.options.actionContext,
-            sessionMode,
-        }).catch((error) => {
-            process.stderr.write(`[console] chat custom-tools build failed: ${error instanceof Error ? error.message : String(error)}\n`);
-            // Allow a later create/reopen to retry after a transient failure.
-            this.operatorCustomToolsByMode.delete(sessionMode);
-            return [];
-        });
-        this.operatorCustomToolsByMode.set(sessionMode, promise);
-        return promise;
+        if (!this.operatorCustomToolsPromise) {
+            this.operatorCustomToolsPromise = buildCustomOperatorTools({
+                actionContext: this.options.actionContext,
+            }).catch((error) => {
+                process.stderr.write(`[console] chat custom-tools build failed: ${error instanceof Error ? error.message : String(error)}\n`);
+                // Allow a later create/reopen to retry after a transient failure.
+                this.operatorCustomToolsPromise = undefined;
+                return [];
+            });
+        }
+        return this.operatorCustomToolsPromise;
     }
     loadExploreCustomTools() {
         if (!this.exploreCustomToolsPromise) {
@@ -1075,7 +1605,6 @@ export class ConsolePiRuntime {
         if (!this.bindings.forkSessionManager)
             throw new Error("SESSION_FORK_UNSUPPORTED");
         const sessionId = `operator-chat-${randomBytes(12).toString("hex")}`;
-        const sessionMode = this.rememberSessionMode(sessionId, init.sessionMode ?? DEFAULT_CONSOLE_CHAT_SESSION_MODE);
         const sessionManager = await this.bindings.forkSessionManager({
             sourcePath: init.sourceSessionFile,
             targetCwd: this.options.cwd,
@@ -1086,8 +1615,8 @@ export class ConsolePiRuntime {
             sessionId,
             sessionManager,
             model: init.model,
-            sessionMode,
         });
+        built.session.setActiveToolsByName(computeOperatorChatActiveToolNames(built.session));
         this.sessions.set(sessionId, built.session);
         this.sessionManagers.set(sessionId, sessionManager);
         this.modelRuntimes.set(sessionId, built.modelRuntime);
@@ -1103,7 +1632,6 @@ export class ConsolePiRuntime {
             createdAt: new Date().toISOString(),
             model: init.model,
             activeTools: built.session.getActiveToolNames(),
-            sessionMode,
         };
     }
     async branchSession(input) {
@@ -1282,22 +1810,15 @@ export class ConsolePiRuntime {
     async getRuntimeSystemPrompt(sessionId) {
         await this.ensureSessionReady(sessionId).catch(() => undefined);
         const session = this.sessions.get(sessionId);
-        if (!session) {
-            return composeChatSystemPrompt({
-                sessionMode: this.sessionModeOf(sessionId),
-                workflowPrompt: OPERATOR_CHAT_SYSTEM_PROMPT_BASE,
-            });
-        }
+        if (!session)
+            return composeOperatorChatSystemPrompt({});
         const fromState = session.state?.systemPrompt;
         const fromGetter = session.systemPrompt;
         const loader = this.serviceScopes.get(sessionId)?.resourceLoader;
         return (fromState ||
             fromGetter ||
             loader?.getSystemPrompt?.() ||
-            composeChatSystemPrompt({
-                sessionMode: this.sessionModeOf(sessionId),
-                workflowPrompt: OPERATOR_CHAT_SYSTEM_PROMPT_BASE,
-            }));
+            composeOperatorChatSystemPrompt({}));
     }
     /**
      * Read the RAW system prompt for the snapshot, converting any projection
@@ -1388,9 +1909,8 @@ export class ConsolePiRuntime {
             await session.reload();
             const services = this.serviceScopes.get(sessionId);
             if (services)
-                this.applySessionRecoveryOverrides(sessionId, services, session);
+                this.applySessionCompactionOverride(sessionId, services, session);
             await this.refreshModelConfiguration(sessionId, "force");
-            pinOperatorChatTools(session, this.sessionModeOf(sessionId));
         }
         catch (error) {
             return {
@@ -1421,14 +1941,91 @@ export class ConsolePiRuntime {
      * Never returns prompt/skill file bodies.
      */
     async listSlashCommands(sessionId) {
+        const scrub = (value) => {
+            const raw = String(value ?? "");
+            return raw
+                .replace(/\/Users\/[^\s]+/gi, "~")
+                .replace(/[A-Za-z]:\\Users\\[^\s]+/gi, "~")
+                .slice(0, 240);
+        };
         // Fail soft at the HTTP layer: bubble readiness errors so routes can attach
         // a compact warning while the UI keeps local Operator/Pi Web commands.
         await this.ensureSessionReady(sessionId);
         const session = this.sessions.get(sessionId);
         if (!session)
             return { commands: [] };
-        const resourceLoader = this.serviceScopes.get(sessionId)?.resourceLoader;
-        return collectSlashCommands({ session, resourceLoader });
+        // Same-name conflict priority (AC-3): extension > skill > prompt.
+        // Enum order must not decide the winner — prompt-before-skill still loses.
+        const SOURCE_RANK = {
+            extension: 0,
+            skill: 1,
+            prompt: 2,
+        };
+        const byKey = new Map();
+        const sourceWarnings = [];
+        const push = (command, label, description, source) => {
+            const name = command.startsWith("/") ? command : `/${command}`;
+            const key = name.toLowerCase();
+            if (!key || key === "/")
+                return;
+            const next = {
+                command: name,
+                label: (label || name).slice(0, 80),
+                description: scrub(description),
+                source,
+            };
+            const existing = byKey.get(key);
+            if (!existing || SOURCE_RANK[source] < SOURCE_RANK[existing.source]) {
+                byKey.set(key, next);
+            }
+        };
+        try {
+            const cmds = session.extensionRunner?.getRegisteredCommands?.() ?? [];
+            for (const cmd of cmds) {
+                const name = cmd.invocationName || cmd.name;
+                if (!name)
+                    continue;
+                push(String(name), String(cmd.name || name), String(cmd.description || ""), "extension");
+            }
+        }
+        catch (error) {
+            // Source isolation: keep other sources; surface compact warning (AC-3).
+            sourceWarnings.push(`extension: ${scrub(error instanceof Error ? error.message : String(error))}`);
+        }
+        try {
+            // Enumerate prompts before skills on purpose: priority must still let skill win.
+            for (const tpl of session.promptTemplates ?? []) {
+                if (!tpl?.name)
+                    continue;
+                push(String(tpl.name), String(tpl.name), String(tpl.description || ""), "prompt");
+            }
+        }
+        catch (error) {
+            sourceWarnings.push(`prompt: ${scrub(error instanceof Error ? error.message : String(error))}`);
+        }
+        try {
+            const services = this.serviceScopes.get(sessionId);
+            const resourceLoader = services?.resourceLoader;
+            const skills = resourceLoader?.getSkills?.()?.skills ?? [];
+            for (const skill of skills) {
+                if (!skill?.name)
+                    continue;
+                const command = skill.name.startsWith("skill:")
+                    ? `/${skill.name}`
+                    : `/skill:${skill.name}`;
+                push(command, skill.name, String(skill.description || ""), "skill");
+            }
+        }
+        catch (error) {
+            sourceWarnings.push(`skill: ${scrub(error instanceof Error ? error.message : String(error))}`);
+        }
+        const warning = sourceWarnings.length > 0
+            ? sourceWarnings.join("; ").slice(0, 160)
+            : undefined;
+        return {
+            commands: [...byKey.values()],
+            ...(warning ? { warning } : {}),
+        };
     }
     async getRuntimeSnapshot(sessionId, options) {
         try {
@@ -1472,6 +2069,9 @@ export class ConsolePiRuntime {
                 throw new RuntimeSnapshotUnavailableError(`model enumeration failed: ${error instanceof Error ? error.message : String(error)}`);
             }
         }
+        // Thinking options: auto is always offered; explicit levels only when the
+        // runtime session supports setThinkingLevel (xhigh/max ship with the SDK
+        // and therefore surface only when this runtime provides them).
         const supportedLevels = typeof session.setThinkingLevel === "function"
             ? [...THINKING_LEVELS]
             : [];
@@ -1479,25 +2079,220 @@ export class ConsolePiRuntime {
             { value: "auto" },
             ...supportedLevels.map((value) => ({ value })),
         ];
-        let skillPrefs = { schemaVersion: 1, skills: {} };
-        let skillPrefsError;
+        // Resource inventories from the session ResourceLoader (ADR 0012 open
+        // surface). Missing loader → real empty lists, never fabricated entries.
+        // Each subface is isolated (RF-02): a throwing subface keeps the other
+        // inventories AND surfaces a structured retryable diagnostic instead of
+        // silently dropping the whole resource projection.
+        const contextFiles = [];
+        const skills = [];
+        const extensions = [];
+        const diagnostics = [];
+        const resolvedResources = [];
+        const resourceFailure = (subface, error) => {
+            diagnostics.push({
+                type: "error",
+                code: "RESOURCE_LOAD_FAILED",
+                message: `${subface} inventory failed: ${error instanceof Error ? error.message : String(error)}`,
+                retryable: true,
+            });
+        };
         if (resourceLoader) {
+            try {
+                const agentsFiles = resourceLoader.getAgentsFiles?.();
+                for (const file of agentsFiles?.agentsFiles ?? []) {
+                    if (!file.path)
+                        continue;
+                    contextFiles.push({
+                        path: file.path,
+                        characters: file.content?.length ?? 0,
+                    });
+                }
+            }
+            catch (error) {
+                resourceFailure("context files", error);
+            }
+            // Preferences are the source of truth for UI auto-invocation state;
+            // loader disableModelInvocation may also reflect frontmatter. Prefer
+            // explicit preference (default on) when projecting autoInvocationEnabled.
+            let skillPrefs = { schemaVersion: 1, skills: {} };
             try {
                 skillPrefs = await this.loadSkillAutoInvocationPreferences();
             }
             catch (error) {
-                skillPrefsError = error;
+                diagnostics.push({
+                    type: "error",
+                    code: "PI_RESOURCE_PREFERENCES_MALFORMED",
+                    message: error instanceof Error ? error.message : String(error),
+                    retryable: true,
+                });
+            }
+            try {
+                const skillsResult = resourceLoader.getSkills?.();
+                for (const skill of skillsResult?.skills ?? []) {
+                    const resourceId = skillResourceId({
+                        name: skill.name,
+                        filePath: skill.filePath,
+                    });
+                    // Preference off always means autoInvocationEnabled=false even if
+                    // loader already applied disableModelInvocation. Frontmatter-only
+                    // disable (no preference) also surfaces as autoInvocationEnabled=false.
+                    const prefEnabled = isAutoInvocationEnabled(skillPrefs, resourceId);
+                    const autoInvocationEnabled = prefEnabled && skill.disableModelInvocation !== true;
+                    skills.push({
+                        name: skill.name,
+                        description: skill.description ?? "",
+                        path: skill.filePath,
+                        ...(skill.baseDir ? { baseDir: skill.baseDir } : {}),
+                        scope: skill.sourceInfo?.scope ?? "unknown",
+                        source: skill.sourceInfo?.source ?? "",
+                        resourceId,
+                        autoInvocationEnabled,
+                        diagnostics: [],
+                    });
+                    resolvedResources.push({
+                        type: "skill",
+                        name: skill.name,
+                        path: skill.filePath,
+                        source: skill.sourceInfo?.source ?? "",
+                        scope: skill.sourceInfo?.scope ?? "unknown",
+                    });
+                }
+                for (const diag of skillsResult?.diagnostics ?? []) {
+                    if (!diag?.message)
+                        continue;
+                    diagnostics.push({
+                        type: diag.type ?? "warning",
+                        message: diag.message,
+                        ...(diag.path ? { path: diag.path } : {}),
+                    });
+                }
+            }
+            catch (error) {
+                resourceFailure("skills", error);
+            }
+            try {
+                const extResult = resourceLoader.getExtensions?.();
+                for (const ext of extResult?.extensions ?? []) {
+                    const path = ext.resolvedPath ?? ext.path ?? "";
+                    extensions.push({
+                        name: ext.sourceInfo?.source ?? ext.path ?? "extension",
+                        path,
+                        ...(ext.resolvedPath ? { resolvedPath: ext.resolvedPath } : {}),
+                        source: ext.sourceInfo?.source ?? "",
+                        scope: ext.sourceInfo?.scope ?? "unknown",
+                        ...(ext.sourceInfo?.origin ? { origin: ext.sourceInfo.origin } : {}),
+                        enabled: true,
+                    });
+                    resolvedResources.push({
+                        type: "extension",
+                        name: ext.sourceInfo?.source ?? ext.path ?? "extension",
+                        path,
+                        source: ext.sourceInfo?.source ?? "",
+                        scope: ext.sourceInfo?.scope ?? "unknown",
+                    });
+                }
+                for (const err of extResult?.errors ?? []) {
+                    if (!err?.error)
+                        continue;
+                    diagnostics.push({
+                        type: "error",
+                        message: err.error,
+                        ...(err.path ? { path: err.path } : {}),
+                    });
+                }
+            }
+            catch (error) {
+                resourceFailure("extensions", error);
+            }
+            try {
+                const promptsResult = resourceLoader.getPrompts?.();
+                for (const prompt of promptsResult?.prompts ?? []) {
+                    resolvedResources.push({
+                        type: "prompt",
+                        name: prompt.name,
+                        path: prompt.filePath,
+                        source: prompt.sourceInfo?.source ?? "",
+                        scope: prompt.sourceInfo?.scope ?? "unknown",
+                    });
+                }
+                for (const diag of promptsResult?.diagnostics ?? []) {
+                    if (!diag?.message)
+                        continue;
+                    diagnostics.push({
+                        type: diag.type ?? "warning",
+                        message: diag.message,
+                        ...(diag.path ? { path: diag.path } : {}),
+                    });
+                }
+            }
+            catch (error) {
+                resourceFailure("prompts", error);
+            }
+            try {
+                const themesResult = resourceLoader.getThemes?.();
+                for (const theme of themesResult?.themes ?? []) {
+                    if (!theme.path)
+                        continue;
+                    resolvedResources.push({
+                        type: "theme",
+                        name: theme.name ?? theme.path,
+                        path: theme.path,
+                        source: "",
+                        scope: "unknown",
+                    });
+                }
+                for (const diag of themesResult?.diagnostics ?? []) {
+                    if (!diag?.message)
+                        continue;
+                    diagnostics.push({
+                        type: diag.type ?? "warning",
+                        message: diag.message,
+                        ...(diag.path ? { path: diag.path } : {}),
+                    });
+                }
+            }
+            catch (error) {
+                resourceFailure("themes", error);
             }
         }
-        const inventories = await collectRuntimeInventories({
-            resourceLoader,
-            skillPrefs,
-            skillPrefsError,
-            agentDir: await safeGetAgentDir(this.bindings),
-            cwd: this.options.cwd,
-            tools: session.getAllTools?.() ?? [],
-            activeToolNames: session.getActiveToolNames(),
-        });
+        // Packages: Pi settings specs + resolved resource metadata. Fields the SDK
+        // does not expose stay absent (real missing, never fabricated). A
+        // readPackageInventory failure is a PARTIAL failure (RF-02): the snapshot
+        // stays 200 with a structured retryable diagnostic — never a silent
+        // fake-empty package list.
+        const { readPackageInventory } = await import("./pi-console-config.js");
+        let packages = [];
+        try {
+            packages = (await readPackageInventory(await safeGetAgentDir(this.bindings), this.options.cwd, resolvedResources));
+        }
+        catch (error) {
+            packages = [];
+            diagnostics.push({
+                type: "error",
+                code: "PACKAGE_INVENTORY_FAILED",
+                message: error instanceof Error ? error.message : String(error),
+                retryable: true,
+            });
+        }
+        const { readMcpInventory } = await import("./mcp-inventory.js");
+        let mcp = { servers: [], unassignedTools: [] };
+        try {
+            mcp = await readMcpInventory({
+                agentDir: await safeGetAgentDir(this.bindings),
+                cwd: this.options.cwd,
+                tools: session.getAllTools?.() ?? [],
+                activeToolNames: session.getActiveToolNames(),
+            });
+        }
+        catch (error) {
+            diagnostics.push({
+                type: "error",
+                code: "MCP_INVENTORY_FAILED",
+                message: error instanceof Error ? error.message : String(error),
+                retryable: true,
+            });
+        }
         return projectRuntimeSnapshot({
             sessionId,
             revision: this.revisions.get(sessionId) ?? 0,
@@ -1522,17 +2317,19 @@ export class ConsolePiRuntime {
             thinkingLevels,
             systemPrompt: {
                 ...(options?.includeRaw ? { raw: rawSystemPrompt } : {}),
+                // The RAW prompt flows into the projection: text is scrubbed +
+                // length-limited while sha256/characters stay RAW-based (design §2.2).
                 text: rawSystemPrompt,
                 sha256: createHash("sha256").update(rawSystemPrompt).digest("hex"),
                 characters: rawSystemPrompt.length,
             },
             activeTools: session.getActiveToolNames(),
-            contextFiles: inventories.contextFiles,
-            skills: inventories.skills,
-            extensions: inventories.extensions,
-            packages: inventories.packages,
-            mcp: inventories.mcp,
-            diagnostics: inventories.diagnostics,
+            contextFiles,
+            skills,
+            extensions,
+            packages,
+            mcp,
+            diagnostics,
             hasBash: true,
         });
     }
@@ -1550,9 +2347,7 @@ export class ConsolePiRuntime {
      * than silently creating a fresh empty session and losing prior context.
      */
     async reopenSession(init) {
-        await this.syncAimaxAuthToken();
         const sessionId = init.sessionId;
-        const sessionMode = this.rememberSessionMode(sessionId, init.sessionMode ?? this.sessionModeOf(sessionId));
         // Wait for in-flight create materialization rather than racing reopen.
         const initState = this.sessionInit.get(sessionId);
         if (initState?.status === "initializing") {
@@ -1629,7 +2424,6 @@ export class ConsolePiRuntime {
                 sessionManager,
                 model: init.model,
                 systemPromptSuffix: init.systemPromptSuffix,
-                sessionMode,
             });
             const session = built.session;
             // Prefer the SessionManager id (from the JSONL header). Some SDK
@@ -1652,6 +2446,7 @@ export class ConsolePiRuntime {
                     message: `reopened Pi sessionId mismatch: expected ${sessionId}, got ${reportedId}`,
                 };
             }
+            session.setActiveToolsByName(computeOperatorChatActiveToolNames(session));
             this.sessions.set(sessionId, session);
             this.sessionManagers.set(sessionId, sessionManager);
             this.modelRuntimes.set(sessionId, built.modelRuntime);
@@ -1669,7 +2464,6 @@ export class ConsolePiRuntime {
                     createdAt: new Date().toISOString(),
                     model: init.model,
                     activeTools: session.getActiveToolNames(),
-                    sessionMode,
                 },
             };
         }
@@ -1701,7 +2495,6 @@ export class ConsolePiRuntime {
             createdAt: new Date().toISOString(),
             model,
             activeTools: session.getActiveToolNames(),
-            sessionMode: this.sessionModeOf(sessionId),
         };
     }
     /**
@@ -1710,22 +2503,46 @@ export class ConsolePiRuntime {
      * before AgentSession is ready. Tool definitions reuse runtime-level caches.
      */
     async buildSessionWithServices(init) {
-        const sessionMode = this.rememberSessionMode(init.sessionId, init.sessionMode ?? this.sessionModeOf(init.sessionId));
-        const prepared = await this.prepareLiveSession({
-            sessionId: init.sessionId,
+        const agentDir = await safeGetAgentDir(this.bindings);
+        const modelConfigFile = await captureModelConfigFile(agentDir);
+        const appendSystemPrompt = [
+            OPERATOR_CHAT_SYSTEM_PROMPT_BASE,
+            ...(init.systemPromptSuffix ? [init.systemPromptSuffix] : []),
+        ];
+        await this.refreshSkillPrefsCache().catch(() => undefined);
+        const { services } = await this.bindings.createServices({
+            cwd: this.options.cwd,
+            agentDir,
+            resourceLoaderOptions: await this.buildResourceLoaderOptions({ appendSystemPrompt }, init.sessionId),
+        });
+        const modelRuntime = services.modelRuntime;
+        const resolvedModel = init.model
+            ? (this.bindings.resolveModel({
+                modelRuntime,
+                provider: init.model.provider,
+                modelId: init.model.modelId,
+            }) ?? undefined)
+            : undefined;
+        assertNoWriteToolInList(OPERATOR_CHAT_ALLOWED_TOOLS);
+        const customTools = await this.loadCustomTools(init.sessionId);
+        const { session } = await this.bindings.createSessionFromServices({
+            services,
             sessionManager: init.sessionManager,
-            model: init.model,
-            systemPromptSuffix: init.systemPromptSuffix,
-            sessionMode,
+            excludeTools: [...OPERATOR_CHAT_SESSION_EXCLUDE_TOOLS],
+            ...(customTools.length > 0 ? { customTools } : {}),
+            ...(resolvedModel ? { model: resolvedModel } : {}),
         });
-        if (!prepared) {
-            throw new Error(`chat session preparation aborted: ${init.sessionId}`);
-        }
+        await bindSessionExtensions(session);
+        pinOperatorChatTools(session);
+        this.applySessionCompactionOverride(init.sessionId, services, session);
         return {
-            session: prepared.session,
-            modelRuntime: prepared.modelRuntime,
-            modelConfigFile: prepared.modelConfigFile,
-            services: prepared.services,
+            session,
+            modelRuntime,
+            modelConfigFile,
+            services: {
+                resourceLoader: services.resourceLoader,
+                settingsManager: services.settingsManager,
+            },
         };
     }
     /** Re-open a previously created session (cross-request). */
@@ -1785,7 +2602,7 @@ export class ConsolePiRuntime {
     }
     /**
      * Send a prompt and stream events. Gate 3: each tool invocation is
-     * re-authorized by authorizeChatSessionTool(mode) before the dispatcher runs it
+     * re-authorized by authorizeOperatorChatTool before the dispatcher runs it
      * (the dispatcher is wired by the HTTP layer, see chat-session.ts).
      *
      * Prompt ownership is acquired synchronously before the first await so two
@@ -1848,11 +2665,10 @@ export class ConsolePiRuntime {
             // existing closed interview allow/deny registry. The next ordinary turn
             // explicitly restores the normal Operator Chat set (baseline + extension
             // tools, ADR 0012).
-            const sessionMode = this.sessionModeOf(sessionId);
-            const requestedTools = chatActiveToolBaseline(sessionMode);
-            const activeTools = options?.mode === "requirement-interview" && sessionMode === "workflow"
+            const requestedTools = OPERATOR_CHAT_ACTIVE_TOOL_NAMES();
+            const activeTools = options?.mode === "requirement-interview"
                 ? filterActiveInterviewTools(requestedTools).allowed
-                : computeChatActiveToolNames(session, sessionMode);
+                : computeOperatorChatActiveToolNames(session);
             session.setActiveToolsByName(activeTools);
             // Final pre-prompt fence: abort after tool pin must still skip session.prompt.
             if (options?.signal?.aborted) {
@@ -2190,7 +3006,6 @@ export class ConsolePiRuntime {
         this.modelRuntimes.delete(sessionId);
         this.modelConfigFiles.delete(sessionId);
         this.sessionModels.delete(sessionId);
-        this.sessionModes.delete(sessionId);
         this.serviceScopes.delete(sessionId);
         this.revisions.delete(sessionId);
         this.thinkingSelections.delete(sessionId);
@@ -2358,9 +3173,155 @@ async function waitForIdle(session, options) {
         await new Promise((r) => setTimeout(r, 50));
     }
 }
+async function safeGetAgentDir(bindings) {
+    try {
+        return await bindings.getAgentDir();
+    }
+    catch {
+        // Fall back to a Console-app-data scoped agent dir so we never accidentally
+        // touch the user's real ~/.pi/agent config if getAgentDir throws.
+        return path.join(process.cwd(), ".harness", "console", "pi-agent-dir");
+    }
+}
+/**
+ * Cached SDK module loader. The pi-coding-agent package is ESM-only, so we
+ * must use dynamic import() (not require). Cached to avoid repeated imports.
+ */
+let cachedSdk;
+async function loadSdk() {
+    if (!cachedSdk) {
+        cachedSdk = import("@earendil-works/pi-coding-agent");
+    }
+    return cachedSdk;
+}
+/**
+ * Default production bindings backed by the real Pi SDK (services mode).
+ * Dynamically imported so the worker bundle does not hard-fail if the SDK is
+ * absent at module load (discovered lazily by pi-readiness instead).
+ */
+export function createDefaultPiSdkBindings() {
+    return {
+        getAgentDir: async () => {
+            const sdk = (await loadSdk());
+            return sdk.getAgentDir();
+        },
+        createServices: async (opts) => {
+            const sdk = (await loadSdk());
+            // createAgentSessionServices returns the full AgentSessionServices object
+            // directly (cwd/agentDir/modelRuntime/settingsManager/resourceLoader).
+            // Wrap it so our type contract is satisfied.
+            const result = await sdk.createAgentSessionServices({
+                cwd: opts.cwd,
+                agentDir: opts.agentDir,
+                resourceLoaderOptions: opts.resourceLoaderOptions,
+            });
+            return { services: result };
+        },
+        createSessionFromServices: async (opts) => {
+            const sdk = (await loadSdk());
+            return sdk.createAgentSessionFromServices({
+                services: opts.services,
+                sessionManager: opts.sessionManager,
+                ...(opts.tools ? { tools: opts.tools } : {}),
+                ...(opts.noTools ? { noTools: opts.noTools } : {}),
+                ...(opts.excludeTools ? { excludeTools: opts.excludeTools } : {}),
+                ...(opts.customTools ? { customTools: opts.customTools } : {}),
+                ...(opts.model ? { model: opts.model } : {}),
+            });
+        },
+        createSessionManager: async (opts) => {
+            const sdk = (await loadSdk());
+            return sdk.SessionManager.create(opts.cwd, opts.sessionDir, {
+                id: opts.sessionId,
+            });
+        },
+        materializeSessionShell: async (opts) => {
+            const sdk = (await loadSdk());
+            const manager = opts.sessionManager;
+            if (typeof manager.setSessionFile !== "function") {
+                throw new Error("Pi SessionManager cannot materialize a session file");
+            }
+            let created = false;
+            try {
+                await mkdir(path.dirname(opts.sessionFile), { recursive: true });
+                // Match Pi's documented session header. Rebinding through the public
+                // SessionManager API marks it flushed, so Pi appends the first user
+                // entry instead of trying to create the already-present file later.
+                await writeFile(opts.sessionFile, `${JSON.stringify({
+                    type: "session",
+                    version: typeof sdk.CURRENT_SESSION_VERSION === "number"
+                        ? sdk.CURRENT_SESSION_VERSION
+                        : 3,
+                    id: opts.sessionId,
+                    timestamp: new Date().toISOString(),
+                    cwd: opts.cwd,
+                })}\n`, { encoding: "utf8", flag: "wx", mode: 0o600 });
+                created = true;
+                manager.setSessionFile(opts.sessionFile);
+            }
+            catch (error) {
+                if (created)
+                    await rm(opts.sessionFile, { force: true }).catch(() => undefined);
+                throw error;
+            }
+        },
+        createInMemorySessionManager: async (opts) => {
+            const sdk = (await loadSdk());
+            return sdk.SessionManager.inMemory(opts.cwd);
+        },
+        forkSessionManager: async (opts) => {
+            const sdk = (await loadSdk());
+            return sdk.SessionManager.forkFrom(opts.sourcePath, opts.targetCwd, opts.targetSessionDir, { id: opts.targetSessionId });
+        },
+        openSessionManager: async (opts) => {
+            const sdk = (await loadSdk());
+            try {
+                // Pi SessionManager.open(missingPath) does NOT throw — it creates a
+                // fresh in-memory session with a random UUID. That would reopen the
+                // wrong conversation under the durable Console sessionId. Fail closed
+                // before open when the persisted file is absent.
+                await access(opts.sessionFile);
+            }
+            catch (error) {
+                const code = error && typeof error === "object" && "code" in error
+                    ? String(error.code ?? "")
+                    : "";
+                if (code === "ENOENT") {
+                    throw Object.assign(new Error(`SESSION_FILE_MISSING: ${opts.sessionFile}`), { code: "SESSION_FILE_MISSING", cause: error });
+                }
+                // File exists but is unreadable (permissions / I/O) — caller maps
+                // undefined to 503 rather than silently creating a fresh session.
+                return undefined;
+            }
+            return sdk.SessionManager.open(opts.sessionFile);
+        },
+        resolveModel: (opts) => {
+            const rt = opts.modelRuntime;
+            if (typeof rt?.getModel !== "function")
+                return undefined;
+            try {
+                return rt.getModel(opts.provider, opts.modelId);
+            }
+            catch {
+                return undefined;
+            }
+        },
+        listAvailableModels: (opts) => {
+            const rt = opts.modelRuntime;
+            const available = rt?.snapshot?.available ?? [];
+            const configured = rt?.snapshot?.configuredProviders;
+            const isConfigured = (provider) => configured instanceof Set ? configured.has(provider) : false;
+            return available.map((m) => ({
+                id: m.id,
+                name: m.name,
+                provider: m.provider,
+                hasCredentials: isConfigured(m.provider),
+            }));
+        },
+    };
+}
 /**
- * Re-export the tool gates for the dispatcher layer so the per-tool-call gate
- * (Gate 3) lives in exactly one place. authorizeChatSessionTool is the
- * mode-aware gate; the legacy name stays for workflow-only callers.
+ * Re-export the tool gate for the dispatcher layer so the per-tool-call gate
+ * (Gate 3) lives in exactly one place.
  */
-export { authorizeChatSessionTool, authorizeOperatorChatTool, assertNoWriteToolInList, OPERATOR_CHAT_ALLOWED_TOOLS, };
+export { authorizeOperatorChatTool, assertNoWriteToolInList, OPERATOR_CHAT_ALLOWED_TOOLS, };