@tea-agent/loop-agent 0.43.0-next.18 → 0.43.0-next.19

package/dist/worker/console/chat/pi-runtime.js

@@ -37,6 +37,7 @@ import { authorizeChatSessionTool, DEFAULT_CONSOLE_CHAT_SESSION_MODE, chatActive
 import { buildAgentCustomTool, ExploreOrchestrator, } from "./subagents/index.js";
 import { createOperatorChatResourceLoader, } from "./resource-loader.js";
 import { applySkillAutoInvocationPreferences, loadResourcePreferences, } from "./resource-preferences-store.js";
+import { buildPiModeLoopIsolationOptions } from "./pi-mode-loop-isolation.js";
 import { applyProcessRetryOverride, } from "../../../shared/pi-retry-settings.js";
 import { applyProcessCompactionOverride, createCompactionController, createContextPressureExtension, createSiftBridgeState, housekeepSiftStash, isConsoleSiftEnabled, parseCompactionPolicy, parseSiftBridgeConfig, projectPromptPressure, deriveEffectiveWindow, projectSafeTelemetry, emptyContextPressureCounters, } from "../../../shared/pi-context-pressure/index.js";
 import { incrementCounter as incrementPressureCounter } from "../../../shared/pi-context-pressure/telemetry.js";
@@ -49,6 +50,8 @@ import { buildPersistentTerminalTools } from "./terminal-tools.js";
 import { buildScmTools } from "./scm-tools.js";
 import { buildGoalContinuationContext, } from "./goals.js";
 import { injectWizardLocalHeaders, } from "./sdd-data-alignment.js";
+import { buildScheduledGoalTools } from "./pi-runtime/custom-tools/scheduled-goal-tools.js";
+import { WorkflowToolExposure, configuredToolExposure, isScheduledBookingTurn, pinScheduledBookingTurnTools, } from "./pi-runtime/progressive-tools.js";
 import { buildCustomOperatorTools } from "./pi-runtime/custom-tools/operator-tools.js";
 import { buildBrowserTools } from "./pi-runtime/custom-tools/browser-tools.js";
 import { buildAskUserQuestionTool } from "./pi-runtime/custom-tools/ask-user-question.js";
@@ -80,13 +83,14 @@ import { createDefaultPiSdkBindings, safeGetAgentDir, } from "./pi-runtime/sdk-b
  */
 export const OPERATOR_CHAT_SYSTEM_PROMPT_BASE = [
     "You are General Operator Chat.",
-    "Use operator tools first (dagReport, dagRerunPlan, dagRerun). Pi read/write/edit/bash/grep/find/ls are available; obey repository AGENTS.md. apply_patch, full-tools, shell and coding-chat are denied. Prefer safe-read/safe-grep for probes. Browser_* drives the visible Browser panel only (static http(s), no workspace edits/scripts).",
+    "For workflow requests use operator tools; discover missing capabilities via operatorCapabilities(target). Obey AGENTS.md. Deny apply_patch/full-tools/shell/coding-chat; probe with safe-read/safe-grep. Browser_*: visible Browser panel only (static http(s), no workspace edits/scripts).",
     "No harness and asked to init: `loop-agent init instructions --repo-root .`, then `loop-agent init --repo-root . --profile full --merge`; verify with doctor, inspect and docs audit. Updates: `loop-agent init upgrade --repo-root . --json` until stable; `loop-agent init check-update` is read-only.",
+    "Scheduled intent takes precedence over task content: prepareScheduledTask first; no curl/HTTP probes or tests; never perform the scheduled work now. Only a planned goalId means booked; never self-confirm.",
     "Long DAGs: prepareDagExecution → runDag → operationId. Never foreground-Bash task advance, tail/head pipes or nohup/Start-Process/start; do not end on accepted/queued/running or an operationId — NOT completion. Supervise operationGet/status/dagReport/dagDoctor/operationWait at 60s → 90s → 120s → 180s; reset to 60s on state change; 30-60s re-checks when stall suspected. operationWait MUST use afterSeq=previous nextSeq (recommendedNextCall). Heartbeats: not meaningful progress. Run id ≠ task id.",
-    "Failure: terminal runSummary first. With progress wait; else dagRerunPlan(fromNode=primaryFailure.nodeId); eligible → dagRerun: reruns the failed subgraph, keeps prior successes. Ineligible: Worker → workerTaskRetry; standalone → standaloneTaskRerun after contract adopt (regenerates the whole task, not node continue). Do not call dagResume; do not re-advance a run-failed task. Pre-run identical state twice: stop and report; never loop identical bash/read/grep. Approve only bounded writeSet inside allowedPaths, outside forbiddenPaths, with structured verification.",
-    "Iterate toward the goal in bounded rounds: first summarize the previous round's error in one line, fix its root cause — not the symptom — then rerun the failed node with a fresh plan. Never resubmit an unchanged fix; after two rounds failing the same way, stop and report evidence and remaining routes.",
-    "Continue until success, user stop, or no safe recovery remains; then stop and report failure/evidence. Never create a new task for a transient failure or replace repair-pi with direct edits.",
-    "Narrate long-DAG progress briefly at start, meaningful phase changes/findings, verification failure/recovery, prolonged quiet and terminal state: say what finished and what is next. Never narrate unchanged operationWait polls or heartbeats, or claim beyond structured facts.",
+    "Failure: dagReport(runId) → terminal runSummary. With progress wait; else dagRerunPlan(fromNode=primaryFailure.nodeId); eligible → dagRerun: reruns the failed subgraph, keeps prior successes. Ineligible: Worker → workerTaskRetry; standalone → standaloneTaskRerun after contract adopt (regenerates the whole task, not node continue). No dagResume or re-advance of run-failed tasks. Pre-run identical state twice: stop and report; never loop identical bash/read/grep. Approve only bounded writeSet inside allowedPaths, outside forbiddenPaths, with structured verification.",
+    "Each bounded round: summarize the previous round's error in one line, fix its root cause — not the symptom — then rerun the failed node with a fresh plan. Never resubmit an unchanged fix; after two rounds failing the same way, stop and report evidence and remaining routes.",
+    "Continue until success, user stop, or no safe recovery remains. Never create a new task for a transient failure or replace repair-pi with direct edits.",
+    "Report start, meaningful phase changes, failures, prolonged quiet and completion: what finished and what is next. Never narrate unchanged operationWait polls or heartbeats.",
 ].join("\n");
 /**
  * Built-in SDK tool names registered for every Chat session (ADR 0011).
@@ -387,6 +391,7 @@ export class ConsolePiRuntime {
     /** Non-sensitive models.json metadata used to avoid reparsing unchanged config. */
     modelConfigFiles = new Map();
     sessionManagers = new Map();
+    toolExposures = new Map();
     /** Per-session SDK service scope (resourceLoader / settingsManager) used by the live runtime snapshot. */
     serviceScopes = new Map();
     /** Snapshot revision: bumped on create / reopen / model / thinking / reload. */
@@ -489,7 +494,7 @@ export class ConsolePiRuntime {
         this.sessionModes.set(sessionId, sessionMode);
         return sessionMode;
     }
-    async buildResourceLoaderOptions(base = {}, sessionId) {
+    async buildResourceLoaderOptions(base = {}, sessionId, sessionMode = DEFAULT_CONSOLE_CHAT_SESSION_MODE) {
         const inheritedFactories = Array.isArray(base.extensionFactories)
             ? base.extensionFactories
             : [];
@@ -520,6 +525,7 @@ export class ConsolePiRuntime {
             pressureExtension,
             wizardLocalHeadersExtension,
         ].filter((item) => Boolean(item));
+        const piMode = sessionMode === "pi";
         return {
             ...base,
             ...(extraFactories.length > 0
@@ -527,18 +533,23 @@ export class ConsolePiRuntime {
                     extensionFactories: [...inheritedFactories, ...extraFactories],
                 }
                 : {}),
-            skillsOverride: (current) => {
+            ...buildPiModeLoopIsolationOptions({
+                enabled: piMode,
+                cwd: this.options.cwd,
                 // Synchronous override surface: use last-known prefs via a sync
                 // fail-closed path. Prefer async cache filled by ensurePrefs.
-                const prefs = this.cachedSkillPrefs ?? {
-                    schemaVersion: 1,
-                    skills: {},
-                };
-                return {
-                    skills: applySkillAutoInvocationPreferences(current.skills, prefs),
-                    diagnostics: current.diagnostics,
-                };
-            },
+                readPreferences: () => this.cachedSkillPrefs,
+                skillsOverride: (current) => {
+                    const prefs = this.cachedSkillPrefs ?? {
+                        schemaVersion: 1,
+                        skills: {},
+                    };
+                    return {
+                        skills: applySkillAutoInvocationPreferences(current.skills, prefs),
+                        diagnostics: current.diagnostics,
+                    };
+                },
+            }),
         };
     }
     /** Last successfully loaded skill prefs (sync override + snapshot projection). */
@@ -858,6 +869,9 @@ export class ConsolePiRuntime {
         const aborted = () => Boolean(init.abortIfDisposed && this.disposedSessions.has(init.sessionId));
         if (aborted())
             return undefined;
+        if (init.sessionMode === "workflow" && this.options.actionContext) {
+            this.toolExposures.set(init.sessionId, new WorkflowToolExposure(init.sessionManager, this.options.toolExposure ?? configuredToolExposure(process.env.CONSOLE_CHAT_TOOL_EXPOSURE)));
+        }
         const agentDir = await safeGetAgentDir(this.bindings);
         // Capture before services parse models.json. A concurrent edit can therefore
         // cause at most one harmless extra refresh, never a missed next-turn refresh.
@@ -871,7 +885,7 @@ export class ConsolePiRuntime {
         const { services } = await this.bindings.createServices({
             cwd: this.options.cwd,
             agentDir,
-            resourceLoaderOptions: await this.buildResourceLoaderOptions({ appendSystemPrompt }, init.sessionId),
+            resourceLoaderOptions: await this.buildResourceLoaderOptions({ appendSystemPrompt }, init.sessionId, init.sessionMode),
         });
         if (aborted())
             return undefined;
@@ -913,8 +927,19 @@ export class ConsolePiRuntime {
             }
             return undefined;
         }
-        await bindSessionExtensions(session);
-        pinOperatorChatTools(session, init.sessionMode);
+        try {
+            await bindSessionExtensions(session);
+            this.pinSessionTools(init.sessionId, session);
+        }
+        catch (error) {
+            try {
+                session.dispose();
+            }
+            finally {
+                this.toolExposures.delete(init.sessionId);
+            }
+            throw error;
+        }
         this.applySessionRecoveryOverrides(init.sessionId, services, session);
         return {
             session,
@@ -963,6 +988,7 @@ export class ConsolePiRuntime {
             }
             this.sessions.delete(sessionId);
             this.sessionManagers.delete(sessionId);
+            this.toolExposures.delete(sessionId);
             this.modelRuntimes.delete(sessionId);
             this.modelConfigFiles.delete(sessionId);
             this.sessionModels.delete(sessionId);
@@ -972,6 +998,20 @@ export class ConsolePiRuntime {
             this.thinkingSelections.delete(sessionId);
         }
     }
+    pinSessionTools(sessionId, session, interview = false) {
+        const exposure = this.toolExposures.get(sessionId);
+        if (exposure) {
+            exposure.pin(session, interview);
+            return;
+        }
+        if (interview) {
+            session.setActiveToolsByName(filterActiveInterviewTools(chatActiveToolBaseline(this.sessionModeOf(sessionId))).allowed);
+        }
+        else
+            pinOperatorChatTools(session, this.sessionModeOf(sessionId));
+    }
+    /** Read-only rollout diagnostics; no model parameters or host identities. */
+    getToolExposure(sessionId) { return this.toolExposures.get(sessionId)?.snapshot; }
     /** Cached session-less custom tool definitions (operator + explore). */
     async loadCustomTools(sessionId) {
         const sessionMode = this.sessionModeOf(sessionId);
@@ -982,6 +1022,8 @@ export class ConsolePiRuntime {
                 : Promise.resolve([]),
             this.loadExploreCustomTools(),
         ]);
+        const scheduledGoalTools = loadWorkflowTools && this.options.actionContext
+            ? await buildScheduledGoalTools({ sessionId, actionContext: this.options.actionContext }) : [];
         const browserTools = await buildBrowserTools({
             automation: this.browserAutomation,
         });
@@ -1035,8 +1077,14 @@ export class ConsolePiRuntime {
             process.stderr.write(`[console] chat Agent tool build failed: ${error instanceof Error ? error.message : String(error)}\n`);
             return undefined;
         });
+        const exposure = this.toolExposures.get(sessionId);
+        const fullCapabilities = operatorCustomTools.find(tool => tool.name === "operatorCapabilities");
+        // Always session-bound: a branch can restore progressive after full fallback.
+        const discovery = exposure?.buildTool(fullCapabilities);
         return [
-            ...operatorCustomTools,
+            ...operatorCustomTools.filter(tool => !discovery || tool.name !== "operatorCapabilities"),
+            ...(discovery ? [discovery] : []),
+            ...scheduledGoalTools,
             ...exploreCustomTools,
             ...(questionTool ? [questionTool] : []),
             ...(todoTool ? [todoTool] : []),
@@ -1126,6 +1174,7 @@ export class ConsolePiRuntime {
         const entry = input.summary
             ? manager.branchWithSummary?.(input.branchFromEntryId, input.summary)
             : (manager.branch(input.branchFromEntryId), undefined);
+        this.pinSessionTools(input.sessionId, session);
         return {
             branchedFromEntryId: input.branchFromEntryId,
             ...(entry?.id ? { branchSummaryEntryId: entry.id } : {}),
@@ -1137,6 +1186,9 @@ export class ConsolePiRuntime {
             throw new Error(`chat session not active: ${sessionId}`);
         manager.branch(this.mainlineLeaves.get(sessionId));
         this.mainlineLeaves.delete(sessionId);
+        const session = this.sessions.get(sessionId);
+        if (session)
+            this.pinSessionTools(sessionId, session);
     }
     getBranchContext(sessionId) {
         const manager = this.sessionManagers.get(sessionId);
@@ -1396,7 +1448,7 @@ export class ConsolePiRuntime {
             if (services)
                 this.applySessionRecoveryOverrides(sessionId, services, session);
             await this.refreshModelConfiguration(sessionId, "force");
-            pinOperatorChatTools(session, this.sessionModeOf(sessionId));
+            this.pinSessionTools(sessionId, session);
         }
         catch (error) {
             return {
@@ -1538,7 +1590,14 @@ export class ConsolePiRuntime {
             extensions: inventories.extensions,
             packages: inventories.packages,
             mcp: inventories.mcp,
-            diagnostics: inventories.diagnostics,
+            diagnostics: [
+                ...inventories.diagnostics,
+                ...(this.toolExposures.has(sessionId) ? [{
+                        type: "info",
+                        code: "WORKFLOW_TOOL_EXPOSURE",
+                        message: JSON.stringify(this.toolExposures.get(sessionId).snapshot),
+                    }] : []),
+            ],
             hasBash: true,
         });
     }
@@ -1855,11 +1914,10 @@ export class ConsolePiRuntime {
             // explicitly restores the normal Operator Chat set (baseline + extension
             // tools, ADR 0012).
             const sessionMode = this.sessionModeOf(sessionId);
-            const requestedTools = chatActiveToolBaseline(sessionMode);
-            const activeTools = options?.mode === "requirement-interview" && sessionMode === "workflow"
-                ? filterActiveInterviewTools(requestedTools).allowed
-                : computeChatActiveToolNames(session, sessionMode);
-            session.setActiveToolsByName(activeTools);
+            this.pinSessionTools(sessionId, session, options?.mode === "requirement-interview" && sessionMode === "workflow");
+            if (sessionMode === "workflow" && isScheduledBookingTurn(text)) {
+                pinScheduledBookingTurnTools(session);
+            }
             // Final pre-prompt fence: abort after tool pin must still skip session.prompt.
             if (options?.signal?.aborted) {
                 return;
@@ -2192,6 +2250,7 @@ export class ConsolePiRuntime {
         }
         this.sessions.delete(sessionId);
         this.sessionManagers.delete(sessionId);
+        this.toolExposures.delete(sessionId);
         this.mainlineLeaves.delete(sessionId);
         this.modelRuntimes.delete(sessionId);
         this.modelConfigFiles.delete(sessionId);

package/dist/worker/console/chat/routes.js

@@ -134,6 +134,16 @@ export function projectStoredMessagesWithEventOrder(messages, events) {
             if (event.kind !== expectedKind)
                 continue;
             const data = event.data;
+            // Exact alignment wins: since 2026-09-13 message_end frames carry the
+            // durable assistant message id, so restore matches by id, never by
+            // text (duplicate assistant texts would mis-align within a turn).
+            if (typeof data.messageId === "string" && data.messageId) {
+                if (data.messageId === message.id) {
+                    assistantCursor = index + 1;
+                    return event;
+                }
+                continue;
+            }
             const eventText = typeof data.text === "string"
                 ? data.text
                 : typeof data.message === "string"
@@ -271,6 +281,15 @@ function turnEventToStorePartial(event) {
                     text: String(event.text ?? ""),
                     ...(content ? { content } : {}),
                     ...(timing ? { timing } : {}),
+                    // Durable assistant message id (2026-09-13): the session
+                    // store persists message_end BEFORE framing, so a reconnecting
+                    // client and the restore projection can align on this id
+                    // instead of matching text within a time window.
+                    ...(typeof event.messageId ===
+                        "string" &&
+                        event.messageId
+                        ? { messageId: event.messageId }
+                        : {}),
                 },
             };
         }

package/dist/worker/console/chat/scheduled-goal-booking.js

@@ -0,0 +1,59 @@
+import { z } from "zod";
+import { prepareScheduledGoalDraft } from "../../scheduler/scheduled-goal-dispatch.js";
+import { scheduledGoalDraftSchema } from "../../scheduler/scheduled-goal-types.js";
+import { scheduledGoalHash } from "../../scheduler/scheduled-goal-store.js";
+import { readScheduledGoalResult } from "../../scheduler/scheduled-goal-recovery.js";
+export const scheduledGoalBookingSchema = scheduledGoalDraftSchema.omit({ prepared: true, controllerRef: true }).extend({ chatSessionRef: z.string().regex(/^[a-zA-Z0-9_-]+$/) });
+export const scheduledGoalConfirmationSchema = z.object({
+    goalId: z.string().min(1), stateVersion: z.number().int().positive(),
+    envelopeHash: z.string().regex(/^[a-f0-9]{64}$/),
+}).strict();
+/** Only non-capability fields are returned to Chat/browser. */
+export function projectScheduledGoalBooking(goal) {
+    const { prepared: _prepared, controllerRef, ...scope } = goal.frozen;
+    return {
+        goalId: goal.goalId, stateVersion: goal.stateVersion, goalRevision: goal.goalRevision,
+        envelopeHash: goal.envelopeHash, state: goal.state, scope, controllerRef,
+        confirmationRequired: goal.state === "planned",
+    };
+}
+/** Preparation is not authorization, even when the clock is already due. */
+export async function prepareScheduledGoalBooking(input, deps, resolveFinalTime) {
+    const parsed = scheduledGoalBookingSchema.parse(input);
+    const session = await deps.sessions.get(parsed.chatSessionRef);
+    if (!session || session.state !== "active")
+        throw new Error("booking requires an active Chat session");
+    const admitted = await prepareScheduledGoalDraft(parsed, deps.client);
+    // High-level relative time starts after slow strict admission, not before it.
+    const frozen = resolveFinalTime ? scheduledGoalDraftSchema.parse({ ...admitted, time: resolveFinalTime() }) : admitted;
+    const existing = (await deps.goals.list()).find((goal) => goal.frozen.managedTaskId === frozen.managedTaskId && goal.state === "planned" &&
+        scheduledGoalHash(goal.frozen) === scheduledGoalHash(frozen));
+    const goal = existing ?? await deps.goals.createDraft(frozen);
+    return projectScheduledGoalBooking(goal);
+}
+export async function confirmScheduledGoalBooking(input, deps, human) {
+    // Provenance is supplied by the authenticated route, never parsed from model input.
+    if (human.source !== "human-ui" || !human.requestId?.trim())
+        throw new Error("human confirmation required");
+    const parsed = scheduledGoalConfirmationSchema.parse(input);
+    const goal = await deps.goals.get(parsed.goalId);
+    if (goal.approval?.approvalRef === human.requestId && goal.approval.envelopeHash === parsed.envelopeHash &&
+        goal.approval.approvedVersion === parsed.stateVersion)
+        return projectScheduledGoalBooking(goal);
+    const session = await deps.sessions.get(goal.frozen.chatSessionRef);
+    if (!session || session.state !== "active")
+        throw new Error("booking requires an active Chat session");
+    if (goal.envelopeHash !== parsed.envelopeHash || goal.stateVersion !== parsed.stateVersion || goal.state !== "planned")
+        throw new Error("booking confirmation binding mismatch");
+    // Revalidate controller, strict gate, Task and scope immediately before approval.
+    const { prepared: _prepared, controllerRef: _controller, ...scope } = goal.frozen;
+    const fresh = await prepareScheduledGoalDraft(scope, deps.client);
+    if (scheduledGoalHash(fresh) !== scheduledGoalHash(goal.frozen))
+        throw new Error("booking preparation drift");
+    const approved = await deps.goals.approve(goal.goalId, parsed.stateVersion, parsed.envelopeHash, human.requestId);
+    return projectScheduledGoalBooking(approved);
+}
+export async function getScheduledGoalBooking(goalId, goals) {
+    const goal = await goals.get(goalId);
+    return { ...projectScheduledGoalBooking(goal), result: await readScheduledGoalResult(goalId, goals) };
+}

package/dist/worker/console/chat/scheduled-goal-delivery.js

@@ -0,0 +1,27 @@
+import { scheduledGoalDeliveryKey } from "../../scheduler/scheduled-goal-store.js";
+/** The durable Chat record deduplicates a retry after ledger acknowledgement is lost.
+ * A missing Chat never gets recreated. The goal remains available through its ledger.
+ */
+export async function deliverScheduledGoalResult(goal, goals, sessions) {
+    const key = scheduledGoalDeliveryKey(goal);
+    if (goal.deliveryKey === key && goal.deliveryState === "delivered")
+        return;
+    const evidence = goal.evidence.at(-1);
+    const states = {
+        accepted: "已验收", cancelled: "已取消", blocked: "已停止", budget_exhausted: "预算用尽", unknown: "需要核对",
+        failed: "未通过", pending: "待处理", stale: "证据已失效", succeeded: "通过",
+    };
+    const label = (value) => states[value] ?? value;
+    const text = [
+        `预约目标：${goal.frozen.originalGoal}`,
+        `目标状态：${label(goal.state)}；验收：${label(goal.acceptanceState)}。已执行 ${goal.intents.length} 轮。`,
+        ...(goal.reasonCode ? ["停止原因与需要核对的运行记录，可在本会话的预约面板查看。"] : []),
+        ...(evidence ? evidence.assessment.criteria.map((ac) => {
+            const criterion = goal.frozen.acceptance.criteria.find((item) => item.acId === ac.acId);
+            return `${ac.acId} · ${criterion?.description ?? ac.acId}：${label(ac.status)}${ac.exitCode !== 0 ? `（退出码 ${ac.exitCode ?? "未知"}）` : ""}。`;
+        }) : []),
+        `预约编号：${goal.goalId}。证据和历史保留在预约面板；删除会话不会删除运行事实。`,
+    ].join("\n\n");
+    const delivered = await sessions.appendScheduledGoalResult(goal.frozen.chatSessionRef, key, text);
+    await goals.recordDelivery(goal.goalId, key, delivered ? "delivered" : "unavailable");
+}

package/dist/worker/console/chat/scheduled-goal-request.js

@@ -0,0 +1,190 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { mkdir, open, readFile, realpath, rename, unlink, writeFile } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+import path from "node:path";
+import { z } from "zod";
+import { getTaskPaths } from "../../../task/runtime.js";
+import { scheduledGoalDraftSchema, scheduledGoalTimeSchema } from "../../scheduler/scheduled-goal-types.js";
+import { resolveScheduledGoalTime } from "../../scheduler/scheduled-goal-time.js";
+import { ScheduledGoalStore, scheduledGoalHash } from "../../scheduler/scheduled-goal-store.js";
+import { captureScheduledGoalTree } from "../../scheduler/scheduled-goal-evidence.js";
+import { getScheduledGoalBooking, prepareScheduledGoalBooking } from "./scheduled-goal-booking.js";
+const execFileAsync = promisify(execFile);
+const protectedPaths = [".harness/**", "node_modules/**", ".git/**"];
+const relativePath = z.string().trim().min(1).max(500).refine((value) => !path.isAbsolute(value) && !/^[A-Za-z]:/.test(value) && !value.includes("\\") &&
+    !value.split("/").some((part) => part === ".." || part === "." || part === "") && !value.startsWith("-"), "use a relative repository path without traversal");
+const scheduleSchema = z.object({
+    delayMinutes: z.number().positive().max(525600).optional().describe("Delay AFTER preparation finishes; use for '3 minutes later'. The confirmation card shows the resulting exact time."),
+    localAt: z.string().regex(/^\d{4}-\d{2}-\d{2}[ T]\d{2}:\d{2}$/).optional().describe("Explicit local date/time YYYY-MM-DD HH:mm; never silently move a past date."),
+    timezone: z.string().min(1).optional().describe("IANA timezone, e.g. Asia/Shanghai for Beijing. Defaults to the Console host timezone."),
+    fold: z.enum(["earlier", "later"]).optional(),
+    allowedHours: z.array(z.string()).optional().describe("Local allowed windows; default [] means all day."),
+    startGraceMinutes: z.number().positive().max(1440).optional(),
+    maxDurationMinutes: z.number().positive().max(1440).optional(),
+}).strict().refine((value) => (value.delayMinutes !== undefined) !== (value.localAt !== undefined), "choose exactly one of delayMinutes or localAt");
+/** The model supplies business meaning, never runtime identity or authorization. */
+export const scheduledTaskRequestSchema = z.object({
+    originalGoal: z.string().trim().min(1).max(24000).describe("Faithfully preserve the complete user goal and constraints. Do not add unrequested failure cases, mocks, filenames or acceptance obligations; preserve real-service testing requirements."),
+    workflow: scheduledGoalDraftSchema.shape.workflow,
+    allowedPaths: z.array(relativePath).min(1).max(100).describe("Business outputs in the CURRENT project directory. For a read-only inspection, allow only a report such as scheduled-report.md, never .harness/."),
+    forbiddenPaths: z.array(relativePath).max(100).optional(),
+    acceptance: scheduledGoalDraftSchema.shape.acceptance.describe("Use minimal independent executable checks with AC-1, AC-2 IDs. Each command must exit nonzero on failure. For backend-test, acceptance must only inspect the finished run and must never invoke pytest. Prefer an existing read-only verification command or test -s report.md. Do not invent extra requirements, language-specific grep checks, shell pipelines, command substitution, redirects or compound shell statements. The host already enforces write scope."),
+    budget: scheduledGoalDraftSchema.shape.budget.optional().describe("Omit for ordinary tasks: defaults to one DAG run, one goal attempt and one supervisor call. maxTurns counts goal attempts, NOT model tool calls; maxSupervisorCalls does NOT count polling. Always displayed before confirmation."),
+    schedule: scheduleSchema,
+}).strict();
+export function resolveScheduledTaskTime(input, now) {
+    const schedule = scheduleSchema.parse(input);
+    const timezone = schedule.timezone ?? Intl.DateTimeFormat().resolvedOptions().timeZone;
+    const executeAtUtc = schedule.localAt
+        ? resolveScheduledGoalTime({ localAt: schedule.localAt, timezone, fold: schedule.fold })
+        : new Date(now.getTime() + schedule.delayMinutes * 60000).toISOString();
+    if (Date.parse(executeAtUtc) <= now.getTime())
+        throw new Error("requested time is in the past; provide a new future time (不会自动顺延)");
+    const latestStart = Date.parse(executeAtUtc) + (schedule.startGraceMinutes ?? 15) * 60000;
+    const stop = latestStart + (schedule.maxDurationMinutes ?? 60) * 60000;
+    return scheduledGoalTimeSchema.parse({ executeAtUtc, latestStartUtc: new Date(latestStart).toISOString(),
+        stopAtUtc: new Date(stop).toISOString(), expiresAt: new Date(stop).toISOString(), timezone,
+        allowedHours: schedule.allowedHours ?? [], misfirePolicy: "run-immediately" });
+}
+const git = async (cwd, ...args) => (await execFileAsync("git", ["-C", cwd, ...args], { encoding: "utf8", timeout: 30000, maxBuffer: 4 * 1024 * 1024 })).stdout.trim();
+const sameSet = (a, b) => JSON.stringify([...new Set(a)].sort()) === JSON.stringify([...new Set(b)].sort());
+function assertScheduledAcceptanceDoesNotRepeatBackendTests(request) {
+    if (request.workflow !== "backend-test")
+        return;
+    const repeated = request.acceptance.criteria.find((criterion) => /(?:^|\s)(?:python(?:3)?\s+-m\s+)?pytest\b/i.test(criterion.command));
+    if (repeated)
+        throw new Error(`backend-test acceptance must not invoke pytest; ${repeated.acId} must inspect the completed run instead`);
+}
+/** Synchronous PREPARATION only. CLI calls are bounded and NEVER approve a DAG.
+ * A durable exclusive request marker prevents retries from creating duplicate Tasks
+ * or overwriting imported source. Unknown interrupted preparation is not reclaimed.
+ */
+export async function prepareScheduledTask(input, deps) {
+    const request = scheduledTaskRequestSchema.parse(input);
+    assertScheduledAcceptanceDoesNotRepeatBackendTests(request);
+    for (const ref of request.allowedPaths) {
+        if (/^(?:\.harness|\.git|node_modules)(?:\/|$)/.test(ref) || ref.includes("*") && !/^[\w.-]+\//.test(ref))
+            throw new Error(`protected or unbounded output path ${ref}; use an ordinary bounded report/output path, never runtime directories`);
+    }
+    if (!/^[a-zA-Z0-9_-]+$/.test(deps.sessionId) || (await deps.sessions.get(deps.sessionId))?.state !== "active")
+        throw new Error("preparation requires an active bound Chat session");
+    const identity = deps.client.getIdentity();
+    if (!identity)
+        throw new Error("preparation requires a pinned controller");
+    const repoRoot = await realpath(deps.repoRoot);
+    const now = deps.now ?? (() => new Date());
+    const key = scheduledGoalHash({ repoRoot, sessionId: deps.sessionId, request });
+    // Keep generated paths compact: runtimes/extensions may encode the whole cwd
+    // into one filename. The full hash below still verifies receipt identity.
+    const directory = path.join(deps.preparationRoot, key.slice(0, 24));
+    const recordPath = path.join(directory, "preparation.json");
+    const goals = new ScheduledGoalStore(repoRoot);
+    const existing = await readFile(recordPath, "utf8").then((text) => JSON.parse(text)).catch((error) => {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw error;
+    });
+    if (existing) {
+        if (existing.version !== 1 || existing.requestHash !== key)
+            throw new Error("preparation record binding mismatch");
+        if (existing.goalId)
+            return getScheduledGoalBooking(existing.goalId, goals);
+        // Covers a crash after the goal ledger commit but before the local receipt.
+        const committed = (await goals.list()).find((goal) => goal.frozen.managedTaskId === existing.taskId && goal.frozen.chatSessionRef === deps.sessionId);
+        if (committed)
+            return getScheduledGoalBooking(committed.goalId, goals);
+        throw new Error(`previous preparation ${existing.stage}: ${existing.error ?? "still running or interrupted; do not duplicate or edit its artifacts"}; evidence: ${recordPath}`);
+    }
+    // Replays return their durable result even after the requested time has passed.
+    // New requests validate time before creating artifacts; relative time is also
+    // resolved after preparation so preparation cannot consume the delay.
+    resolveScheduledTaskTime(request.schedule, now());
+    // Check before creating a Task or receipt; never clean or reset the user's workspace.
+    const base = await git(repoRoot, "rev-parse", "HEAD");
+    const initial = await captureScheduledGoalTree(repoRoot, base, request.allowedPaths, protectedPaths);
+    if (initial.changedPaths.length)
+        throw new Error(`current workspace has uncommitted changes: ${initial.changedPaths.slice(0, 10).join(", ")}. Resolve them before booking; do not automatically commit, stash or reset user changes.`);
+    await mkdir(directory, { recursive: true, mode: 0o700 });
+    const lockPath = path.join(directory, "preparing.lock");
+    const lock = await open(lockPath, "wx", 0o600).catch((error) => {
+        if (error.code === "EEXIST")
+            throw new Error("preparation already running; do not duplicate or take over");
+        throw error;
+    });
+    const record = { version: 1, requestHash: key, stage: "workspace", taskId: `scheduled-${key.slice(0, 24)}`, worktree: repoRoot };
+    const persist = async () => {
+        const temporary = `${recordPath}.${randomUUID()}.tmp`;
+        await writeFile(temporary, JSON.stringify(record, null, 2), { mode: 0o600 });
+        await rename(temporary, recordPath);
+    };
+    let started = false;
+    try {
+        // Recheck after acquiring the lock: another request may have finished between
+        // our initial read and lock acquisition.
+        const raced = await readFile(recordPath, "utf8").catch((e) => { if (e.code === "ENOENT")
+            return undefined; throw e; });
+        if (raced)
+            throw new Error("preparation changed concurrently; retry reading the existing request");
+        started = true;
+        await persist();
+        const forbiddenPaths = [...new Set([...protectedPaths, ...(request.forbiddenPaths ?? [])])];
+        const prdPath = path.join(directory, "request.md");
+        const prd = ["# Scheduled task", "## Goal", request.originalGoal,
+            "## Execution context", `Execution and all outputs: current project directory ${record.worktree}.`,
+            "Inspect this project directly. Write only the authorized outputs here; for read-only inspection, write only the requested report. Implementation changes remain in this directory for the user to review. Do not create another worktree, copy outputs elsewhere, or reset/stash existing changes. The confirmed Git base must remain unchanged until execution finishes.",
+            "## Acceptance criteria", ...request.acceptance.criteria.map((ac) => `- ${ac.acId}: ${ac.description}\n  Verification: ${ac.command}`),
+            "## Boundaries", `Workflow: ${request.workflow}; policy: ${request.acceptance.policy}.`,
+            `Allowed outputs: ${JSON.stringify(request.allowedPaths)}. Forbidden outputs: ${JSON.stringify(forbiddenPaths)}.`,
+            "Never modify imported requirements, .harness runtime, dependencies, Git history or configuration. No push, merge or publication. The host delivers the final result to the original Chat; do not implement a second delivery/scheduling mechanism.",
+            "## Verification", ...request.acceptance.criteria.map((ac) => ac.command), ""].join("\n\n");
+        await writeFile(prdPath, prd, { flag: "wx", mode: 0o600 });
+        const boundary = request.allowedPaths.flatMap((ref) => ["--allowed-path", ref])
+            .concat(forbiddenPaths.flatMap((ref) => ["--forbidden-path", ref]))
+            .concat(request.acceptance.criteria.flatMap((ac) => ["--verify", `${ac.acId}:${ac.command}`]));
+        for (let step = 0; step < 2; step++) {
+            record.stage = step === 0 ? "task-import" : "task-prepare";
+            await persist();
+            const args = ["task", "advance", record.taskId, ...(step === 0 ? ["Scheduled task", "--prd", prdPath] : []),
+                "--task-kind", request.workflow, ...boundary, "--json"];
+            const result = await deps.client.run(args, { cwd: record.worktree, artifactName: `${record.taskId}-${step}`, expectJson: true, timeoutMs: 300000 });
+            if (!result.ok || result.exitCode !== 0 || result.timedOut) {
+                const detail = JSON.stringify(result.json ?? result.stderr ?? "no CLI evidence").slice(0, 6000);
+                throw new Error(`${record.stage} failed: ${detail}. Correct the request and re-import through this tool; never edit source/references or runtime files.`);
+            }
+            const envelope = result.json;
+            if (envelope?.ok !== true)
+                throw new Error(`${record.stage}: missing successful CLI envelope`);
+            if (envelope.result?.lifecycleState === "awaiting-write-set-approval")
+                break;
+        }
+        record.stage = "booking";
+        await persist();
+        // Freeze actual strict-prepared path ordering/default restrictions. Never adopt
+        // a broader allowed set or drop a caller restriction to make admission pass.
+        const config = z.object({ taskKind: z.string(), allowedPaths: z.array(z.string()), forbiddenPaths: z.array(z.string()) }).parse(JSON.parse(await readFile(getTaskPaths(record.worktree, record.taskId).taskConfigPath, "utf8")));
+        if (config.taskKind !== request.workflow || !sameSet(config.allowedPaths, request.allowedPaths) || forbiddenPaths.some((ref) => !config.forbiddenPaths.includes(ref)))
+            throw new Error("prepared task scope differs from request; refusing to widen scope");
+        if (deps.client.getIdentity()?.packageFingerprint.value !== identity.packageFingerprint.value)
+            throw new Error("controller changed during preparation");
+        const booking = await prepareScheduledGoalBooking({ managedTaskId: record.taskId, originalGoal: request.originalGoal,
+            chatSessionRef: deps.sessionId, workflow: request.workflow, worktreeRef: record.worktree, frozenBase: base,
+            allowedPaths: config.allowedPaths, forbiddenPaths: config.forbiddenPaths, acceptance: request.acceptance,
+            budget: request.budget ?? { maxTurns: 1, maxDagRuns: 1, maxSupervisorCalls: 1 }, time: resolveScheduledTaskTime(request.schedule, now()),
+        }, { goals, client: deps.client, sessions: deps.sessions }, () => resolveScheduledTaskTime(request.schedule, now()));
+        record.goalId = booking.goalId;
+        record.stage = "planned";
+        await persist();
+        return booking;
+    }
+    catch (error) {
+        record.error = error instanceof Error ? error.message : String(error);
+        if (started)
+            await persist();
+        throw new Error(`Scheduled task preparation stopped at ${record.stage}: ${record.error}`);
+    }
+    finally {
+        await lock.close();
+        await unlink(lockPath);
+    }
+}

package/dist/worker/console/chat/session-mode.js

@@ -135,8 +135,10 @@ export function chatActiveToolBaseline(sessionMode) {
  * not re-add operator actions via the extras pass (Goal tools are shared and
  * part of the Pi baseline since 2026-09-10).
  */
-export function computeChatActiveToolNames(session, sessionMode) {
-    const baseline = chatActiveToolBaseline(sessionMode);
+export function computeChatActiveToolNames(session, sessionMode, exposedWorkflowTools) {
+    const exposure = sessionMode === "workflow" && exposedWorkflowTools
+        ? new Set(exposedWorkflowTools.map(name => name.toLowerCase())) : undefined;
+    const baseline = chatActiveToolBaseline(sessionMode).filter(name => !exposure || !WORKFLOW_OPERATOR_TOOL_IDS.has(name.toLowerCase()) || exposure.has(name.toLowerCase()));
     if (!session?.getAllTools)
         return baseline;
     const baselineLower = new Set(baseline.map((name) => name.toLowerCase()));
@@ -148,10 +150,12 @@ export function computeChatActiveToolNames(session, sessionMode) {
         const lower = name.toLowerCase();
         if (baselineLower.has(lower))
             continue;
-        if (CHAT_EXTENSION_DENIED_TOOL_IDS.has(lower))
+        if (CHAT_EXTENSION_DENIED_TOOL_IDS.has(lower) || isOperatorChatToolDenied(name))
             continue;
         if (sessionMode === "pi" && WORKFLOW_OPERATOR_TOOL_IDS.has(lower))
             continue;
+        if (exposure && WORKFLOW_OPERATOR_TOOL_IDS.has(lower) && !exposure.has(lower))
+            continue;
         extras.push(name);
     }
     return extras.length > 0 ? [...baseline, ...extras] : baseline;