@tea-agent/loop-agent 0.43.0-next.3 → 0.43.0-next.5

package/dist/worker/console/chat/scm-service.js

@@ -0,0 +1,253 @@
+/**
+ * Operator Chat — source control service (DSH-style SCM).
+ *
+ * Workspace-scoped git operations shared by the Console UI panel and the
+ * model-facing tools:
+ *   - status: porcelain + branch + ahead/behind, parsed into typed changes
+ *   - diff:   working tree / staged, per-path or whole tree (bounded)
+ *   - stage / unstage / discard (path-scoped)
+ *   - commit (message required), log (bounded), branch list/switch/create
+ *   - push / pull (remote ops, explicit user/model intent only)
+ *
+ * All git invocations are fixed-argv execFile (no shell), bounded output and
+ * timeout, scoped to the workspace repoRoot. Failures return typed errors
+ * instead of throwing raw.
+ */
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+const execFileAsync = promisify(execFile);
+const GIT_TIMEOUT_MS = 20_000;
+const MAX_OUTPUT_CHARS = 200_000;
+function gitEnv() {
+    return {
+        ...process.env,
+        // Deterministic porcelain output regardless of user locale config.
+        GIT_PAGER: "cat",
+        LC_ALL: "C",
+    };
+}
+export class ScmService {
+    repoRoot;
+    constructor(repoRoot) {
+        this.repoRoot = repoRoot;
+    }
+    async git(args, opts) {
+        try {
+            const { stdout } = await execFileAsync("git", args, {
+                cwd: this.repoRoot,
+                encoding: "utf8",
+                maxBuffer: 4 * 1024 * 1024,
+                timeout: opts?.timeoutMs ?? GIT_TIMEOUT_MS,
+                windowsHide: true,
+                env: gitEnv(),
+            });
+            const cap = opts?.maxOutputChars ?? MAX_OUTPUT_CHARS;
+            return { ok: true, stdout: stdout.length > cap ? stdout.slice(0, cap) : stdout };
+        }
+        catch (e) {
+            const err = e;
+            return {
+                ok: false,
+                code: err.killed ? "GIT_TIMEOUT" : "GIT_FAILED",
+                message: err.killed
+                    ? `git ${args[0]} timed out`
+                    : err.message ?? String(e),
+                stderr: typeof err.stderr === "string" ? err.stderr.slice(0, 2000) : undefined,
+            };
+        }
+    }
+    /** `git rev-parse --is-inside-work-tree` — cheap repo probe. */
+    async isRepo() {
+        const r = await this.git(["rev-parse", "--is-inside-work-tree"], { timeoutMs: 5_000 });
+        return r.ok && r.stdout.trim() === "true";
+    }
+    async status() {
+        // -uall: expand untracked directories to individual files (VS Code style);
+        // renames surface as R rows (with fromPath) only when git's rename
+        // detection is active, which is the default for status since git 2.9.
+        const porcelain = await this.git([
+            "status", "--porcelain=v1", "-z", "--branch", "-uall",
+        ]);
+        if (!porcelain.ok)
+            return porcelain;
+        const changes = [];
+        // porcelain v1 -z: NUL-separated fields. Header is
+        // "## branch...upstream [ahead N, behind M]"; status rows "XY path";
+        // rename/copy rows "XY newpath" followed by a bare "oldpath" field.
+        const fields = porcelain.stdout.split("\0").filter((s) => s !== "");
+        let branch = "";
+        let upstream;
+        let ahead;
+        let behind;
+        for (const field of fields) {
+            if (field.startsWith("## ")) {
+                const header = field.slice(3);
+                const track = header.split(/\s+/)[0] ?? "";
+                const dot = track.indexOf("...");
+                if (dot >= 0) {
+                    branch = track.slice(0, dot);
+                    upstream = track.slice(dot + 3);
+                }
+                else {
+                    branch = track;
+                }
+                const aheadM = /\[ahead (\d+)/.exec(header);
+                const behindM = /behind (\d+)\]/.exec(header);
+                if (aheadM)
+                    ahead = Number(aheadM[1]);
+                if (behindM)
+                    behind = Number(behindM[1]);
+                continue;
+            }
+            if (field.startsWith("#"))
+                continue;
+            // Bare path field: from-path of the previous rename/copy row.
+            const prev = changes[changes.length - 1];
+            if (prev && prev.xy.match(/[RC]/) && !prev.fromPath && !/^[ MADRCU?!]{1,2} /.test(field)) {
+                prev.fromPath = field;
+                continue;
+            }
+            const xy = field.slice(0, 2);
+            const path = field.slice(3);
+            changes.push({
+                path,
+                xy,
+                staged: xy[0] !== " " && xy[0] !== "?" && xy[0] !== "!",
+                unstaged: xy[1] !== " " && xy[1] !== "?",
+                untracked: xy === "??",
+            });
+        }
+        const head = await this.git(["rev-parse", "--short", "HEAD"], { timeoutMs: 5_000 });
+        return {
+            ok: true,
+            repoRoot: this.repoRoot,
+            branch,
+            head: head.ok ? head.stdout.trim() : "",
+            upstream,
+            ahead,
+            behind,
+            changes,
+            stagedCount: changes.filter((c) => c.staged).length,
+            unstagedCount: changes.filter((c) => c.unstaged).length,
+            untrackedCount: changes.filter((c) => c.untracked).length,
+        };
+    }
+    /** Unified diff for one path (or whole tree when path omitted). */
+    async diff(options) {
+        const args = ["diff"];
+        if (options.staged)
+            args.push("--cached");
+        args.push(`-U${options.contextLines ?? 3}`);
+        if (options.path) {
+            args.push("--", options.path);
+        }
+        else {
+            args.push("--stat");
+        }
+        const r = await this.git(args);
+        if (!r.ok)
+            return r;
+        return { ok: true, diff: r.stdout };
+    }
+    /** Stage paths (`git add --` / `git add -A --` for "."). */
+    async stage(paths, all = false) {
+        if (!all && paths.length === 0) {
+            return { ok: false, code: "NO_PATHS", message: "stage requires paths or all=true" };
+        }
+        const args = ["add"];
+        if (all) {
+            args.push("-A");
+        }
+        else {
+            args.push("--");
+            args.push(...paths);
+        }
+        return this.git(args);
+    }
+    /** Unstage paths (`git reset HEAD --`). */
+    async unstage(paths) {
+        if (paths.length === 0) {
+            return { ok: false, code: "NO_PATHS", message: "unstage requires paths" };
+        }
+        return this.git(["reset", "HEAD", "--", ...paths]);
+    }
+    /** Discard worktree changes for paths (`git checkout --`). DANGEROUS. */
+    async discard(paths) {
+        if (paths.length === 0) {
+            return { ok: false, code: "NO_PATHS", message: "discard requires paths" };
+        }
+        return this.git(["checkout", "--", ...paths]);
+    }
+    async commit(message) {
+        const trimmed = message.trim();
+        if (!trimmed) {
+            return { ok: false, code: "EMPTY_MESSAGE", message: "commit message required" };
+        }
+        const r = await this.git(["commit", "-m", trimmed]);
+        if (!r.ok)
+            return r;
+        const sha = await this.git(["rev-parse", "--short", "HEAD"], { timeoutMs: 5_000 });
+        return { ok: true, commit: sha.ok ? sha.stdout.trim() : "" };
+    }
+    async log(limit = 30) {
+        const r = await this.git([
+            "log",
+            `--max-count=${limit}`,
+            "--pretty=format:%H\u0001%h\u0001%s\u0001%an\u0001%aI\u0001%D",
+        ]);
+        if (!r.ok)
+            return r;
+        const commits = [];
+        for (const line of r.stdout.split("\n")) {
+            if (!line.trim())
+                continue;
+            const [sha, short, subject, author, date, refs] = line.split("\u0001");
+            if (!sha)
+                continue;
+            commits.push({
+                sha: short ?? sha,
+                subject: subject ?? "",
+                author: author ?? "",
+                date: date ?? "",
+                refs: refs?.trim() || undefined,
+            });
+        }
+        return { ok: true, commits };
+    }
+    async branchList() {
+        const r = await this.git(["branch", "--list", "--format=%(HEAD)%02%(refname:short)"]);
+        if (!r.ok)
+            return r;
+        const branches = [];
+        for (const line of r.stdout.split("\n")) {
+            if (!line.trim())
+                continue;
+            const [headMark, name] = line.split("\x02");
+            if (!name)
+                continue;
+            branches.push({ name: name.trim(), current: headMark?.trim() === "*" });
+        }
+        const current = branches.find((b) => b.current)?.name ?? "";
+        return { ok: true, current, branches };
+    }
+    async branchCreate(name) {
+        if (!/^[\w.\-/]+$/.test(name)) {
+            return { ok: false, code: "INVALID_NAME", message: `invalid branch name: ${name}` };
+        }
+        return this.git(["checkout", "-b", name]);
+    }
+    async branchSwitch(name) {
+        if (!/^[\w.\-/]+$/.test(name)) {
+            return { ok: false, code: "INVALID_NAME", message: `invalid branch name: ${name}` };
+        }
+        return this.git(["checkout", name]);
+    }
+    async push() {
+        const r = await this.git(["push"], { timeoutMs: 120_000 });
+        return r.ok ? { ok: true, output: r.stdout } : r;
+    }
+    async pull() {
+        const r = await this.git(["pull", "--no-edit"], { timeoutMs: 120_000 });
+        return r.ok ? { ok: true, output: r.stdout } : r;
+    }
+}

package/dist/worker/console/chat/scm-tools.js

@@ -0,0 +1,111 @@
+/**
+ * Operator Chat — model-facing source control tool (DSH-style SCM).
+ *
+ * Registers `scm` (single tool, multi-action) so the model can inspect and
+ * drive git in the workspace repo: status / diff / stage / unstage / commit /
+ * log / branch / push / pull. Read actions are cheap and safe; write actions
+ * (commit/push) are the model's explicit intent, mirroring DSH's SCM tool.
+ *
+ * All operations go through ScmService (fixed-argv git, no shell, bounded),
+ * scoped to the workspace repoRoot.
+ */
+const TOOL_DESCRIPTION = "Inspect and drive git source control in the workspace repo. " +
+    "Actions: 'status' (branch + working-tree changes), 'diff' (one path or whole tree; staged=1 for the index), " +
+    "'stage'/'unstage' (paths array; all=true stages everything), 'discard' (DESTRUCTIVE: revert worktree changes of paths), " +
+    "'commit' (message required), 'log' (recent commits), 'branch' (list; name+create to create/switch), 'push', 'pull'. " +
+    "Use status/diff before proposing commits; prefer committing focused changesets. push/pull contact the remote — call them only when the user asks.";
+export async function buildScmTools(deps) {
+    const [{ Type }, { defineTool }] = await Promise.all([
+        import("typebox"),
+        import("@earendil-works/pi-coding-agent"),
+    ]);
+    function result(body) {
+        return { content: [{ type: "text", text: JSON.stringify(body) }], details: body };
+    }
+    function errText(e) {
+        return JSON.stringify({ ok: false, code: e.code, message: e.message, ...(e.stderr ? { stderr: e.stderr } : {}) });
+    }
+    const tool = defineTool({
+        name: "scm",
+        label: "SCM",
+        description: TOOL_DESCRIPTION,
+        promptSnippet: "scm: git source control (status/diff/stage/unstage/discard/commit/log/branch/push/pull) for the workspace repo.",
+        parameters: Type.Object({
+            action: Type.Union([
+                Type.Literal("status"),
+                Type.Literal("diff"),
+                Type.Literal("stage"),
+                Type.Literal("unstage"),
+                Type.Literal("discard"),
+                Type.Literal("commit"),
+                Type.Literal("log"),
+                Type.Literal("branch"),
+                Type.Literal("push"),
+                Type.Literal("pull"),
+            ], { description: "Which git operation to run." }),
+            path: Type.Optional(Type.String({ description: "For diff: repo-relative path (default whole tree --stat)." })),
+            staged: Type.Optional(Type.Boolean({ description: "For diff: diff the staging area (index) instead of the worktree." })),
+            paths: Type.Optional(Type.Array(Type.String(), { description: "For stage/unstage/discard: repo-relative paths." })),
+            all: Type.Optional(Type.Boolean({ description: "For stage: stage all changes (git add -A)." })),
+            message: Type.Optional(Type.String({ description: "For commit: commit message (required)." })),
+            limit: Type.Optional(Type.Number({ description: "For log: max commits (default 30)." })),
+            name: Type.Optional(Type.String({ description: "For branch: branch name to create or switch to." })),
+            create: Type.Optional(Type.Boolean({ description: "For branch: create the branch instead of switching." })),
+        }, { additionalProperties: false }),
+        async execute(_toolCallId, params) {
+            const paths = Array.isArray(params.paths) ? params.paths.slice(0, 500) : [];
+            switch (params.action) {
+                case "status":
+                    return result(await deps.scm.status());
+                case "diff": {
+                    const r = await deps.scm.diff({
+                        ...(params.path ? { path: params.path } : {}),
+                        ...(params.staged ? { staged: true } : {}),
+                    });
+                    return r.ok ? result(r) : result({ error: errText(r) });
+                }
+                case "stage": {
+                    const r = params.all === true ? await deps.scm.stage([], true) : await deps.scm.stage(paths);
+                    return r.ok ? result({ ok: true, staged: params.all === true ? "all" : paths }) : result({ error: errText(r) });
+                }
+                case "unstage": {
+                    const r = await deps.scm.unstage(paths);
+                    return r.ok ? result({ ok: true, unstaged: paths }) : result({ error: errText(r) });
+                }
+                case "discard": {
+                    const r = await deps.scm.discard(paths);
+                    return r.ok ? result({ ok: true, discarded: paths }) : result({ error: errText(r) });
+                }
+                case "commit": {
+                    const r = await deps.scm.commit(params.message ?? "");
+                    return r.ok ? result(r) : result({ error: errText(r) });
+                }
+                case "log": {
+                    const r = await deps.scm.log(params.limit ?? 30);
+                    return r.ok ? result(r) : result({ error: errText(r) });
+                }
+                case "branch": {
+                    if (params.name) {
+                        const r = params.create === true
+                            ? await deps.scm.branchCreate(params.name)
+                            : await deps.scm.branchSwitch(params.name);
+                        return r.ok ? result({ ok: true, ...(params.create === true ? { created: params.name } : { switched: params.name }) }) : result({ error: errText(r) });
+                    }
+                    const r = await deps.scm.branchList();
+                    return r.ok ? result(r) : result({ error: errText(r) });
+                }
+                case "push": {
+                    const r = await deps.scm.push();
+                    return r.ok ? result(r) : result({ error: errText(r) });
+                }
+                case "pull": {
+                    const r = await deps.scm.pull();
+                    return r.ok ? result(r) : result({ error: errText(r) });
+                }
+                default:
+                    return result({ error: `unknown action: ${params.action}` });
+            }
+        },
+    });
+    return [tool];
+}

package/dist/worker/console/chat/sdd-data-alignment.js

@@ -1,4 +1,4 @@
-import { randomBytes } from "node:crypto";
+import { createDecipheriv, randomBytes } from "node:crypto";
 import { readFile, stat } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
@@ -10,8 +10,49 @@ export const SDD_SKILL_NAMES = [
 /** Backward-compatible name for callers that need a stable representative value. */
 export const SDD_DEFAULT_SKILL_NAME = "SDD-implementation-test-review";
 export const SDD_TELEMETRY_URL = "https://wizard-ai.paic.com.cn/code_pilot/api/skill-usage-log";
-export const SDD_TELEMETRY_SIGN = "52aad0c09e6b46818a11ee702d6fe0ba";
+/** SM4 key hex; also the SDD telemetry `ws-sign` value. */
+export const DEFAULT_AI_MA_PUB_SALT_KEY = "52aad0c09e6b46818a11ee702d6fe0ba";
+export const SDD_TELEMETRY_SIGN = DEFAULT_AI_MA_PUB_SALT_KEY;
+export const AIMAX_AUTH_TOKEN_ENV = "AIMAX_AUTH_TOKEN";
 export const WIZARD_LOCAL_DEFAULT_USER_AGENT = "Builder/OpenCode ai-sdk/provider-utils/4.0.21 runtime/bun/1.3.11";
+const SM4_V1_PREFIX = "sm4:v1:";
+/** Decode a plaintext ticket or `sm4:v1:` ciphertext. Unknown prefixes and crypto errors fail closed. */
+export function decodeAimaxAuthToken(raw, keyHex = DEFAULT_AI_MA_PUB_SALT_KEY) {
+    const candidate = raw.trim();
+    if (!candidate)
+        return undefined;
+    if (!candidate.startsWith("sm4:"))
+        return candidate;
+    if (!candidate.startsWith(SM4_V1_PREFIX))
+        return undefined;
+    const hex = candidate.slice(SM4_V1_PREFIX.length);
+    if (!hex || hex.length % 2 !== 0 || /[^0-9a-fA-F]/.test(hex))
+        return undefined;
+    const key = Buffer.from(keyHex.trim(), "hex");
+    if (key.length !== 16)
+        return undefined;
+    try {
+        const encrypted = Buffer.from(hex, "hex");
+        if (encrypted.length === 0 || encrypted.length % 16 !== 0)
+            return undefined;
+        const decipher = createDecipheriv("sm4-ecb", key, null);
+        decipher.setAutoPadding(true);
+        const plain = Buffer.concat([decipher.update(encrypted), decipher.final()])
+            .toString("utf8")
+            .trim();
+        return plain || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Set or delete `AIMAX_AUTH_TOKEN`. Empty string is treated as absent. */
+export function syncAimaxAuthTokenEnv(env, token) {
+    if (token)
+        env[AIMAX_AUTH_TOKEN_ENV] = token;
+    else
+        delete env[AIMAX_AUTH_TOKEN_ENV];
+}
 function sameAuthFileVersion(left, right) {
     if (!left.exists || !right.exists)
         return left.exists === right.exists;
@@ -21,9 +62,22 @@ function sameAuthFileVersion(left, right) {
 /** Reads ~/.aima-go/auth.json with metadata-based parse caching and fail-closed semantics. */
 export class AimaxAuthReader {
     authFile;
+    env;
     cached;
-    constructor(authFile = path.join(os.homedir(), ".aima-go", "auth.json")) {
+    constructor(authFile = path.join(os.homedir(), ".aima-go", "auth.json"), env = process.env) {
         this.authFile = authFile;
+        this.env = env;
+    }
+    resolveKeyHex() {
+        const injected = typeof this.env.AI_MA_PUB_SALT_KEY === "string" ? this.env.AI_MA_PUB_SALT_KEY.trim() : "";
+        if (injected)
+            return injected;
+        const host = process.env.AI_MA_PUB_SALT_KEY?.trim();
+        return host || DEFAULT_AI_MA_PUB_SALT_KEY;
+    }
+    finish(token) {
+        syncAimaxAuthTokenEnv(this.env, token);
+        return token;
     }
     async getToken() {
         let version;
@@ -34,22 +88,24 @@ export class AimaxAuthReader {
         }
         catch {
             this.cached = { version: { exists: false } };
-            return undefined;
+            return this.finish(undefined);
+        }
+        if (this.cached && sameAuthFileVersion(this.cached.version, version)) {
+            return this.finish(this.cached.token);
         }
-        if (this.cached && sameAuthFileVersion(this.cached.version, version))
-            return this.cached.token;
         let token;
         try {
             const parsed = JSON.parse(await readFile(this.authFile, "utf8"));
             const candidate = parsed["aimax-auth-token"];
-            if (typeof candidate === "string" && candidate.trim())
-                token = candidate;
+            if (typeof candidate === "string" && candidate.trim()) {
+                token = decodeAimaxAuthToken(candidate, this.resolveKeyHex());
+            }
         }
         catch {
             // Malformed or unreadable files are intentionally ineligible.
         }
         this.cached = { version, ...(token ? { token } : {}) };
-        return token;
+        return this.finish(token);
     }
     async isEligible() {
         return Boolean(await this.getToken());

package/dist/worker/console/chat/session-catalog.js

@@ -36,6 +36,7 @@ export class ChatSessionCatalog {
             deferredTurns: projectDeferredTurnSummaries(record.deferredTurns ?? []),
             isBlank: isBlankChatSession(record),
             ...(workspaceId ? { workspaceId } : {}),
+            sessionMode: record.sessionMode,
         });
     }
     remove(sessionId) {

package/dist/worker/console/chat/session-mode-view.js

@@ -0,0 +1,48 @@
+/**
+ * Browser-safe session-mode types and copy.
+ *
+ * Keep this module free of Node/runtime tool policy so the Console UI
+ * bundle can import it without pulling operator registries.
+ */
+export const CONSOLE_CHAT_SESSION_MODES = ["workflow", "pi"];
+export const DEFAULT_CONSOLE_CHAT_SESSION_MODE = "workflow";
+export const SESSION_MODE_COPY = {
+    workflow: {
+        id: "workflow",
+        label: "工作流",
+        shortLabel: "工作流",
+        description: "规划并推进工作流",
+        createLabel: "新建工作流会话",
+        bannerTitle: "工作流",
+        bannerBody: "用自然语言编排 loop-agent / agent-worker 的全部能力。这是 Operator 面：默认具备完整 Pi 工具与受策略约束的 operator action。软约束：大改与高风险变更优先走受治 DAG。",
+        landingTitle: "开始一段新的对话",
+        landingBody: "用自然语言编排 loop-agent：查询状态、诊断问题、创建与恢复任务。可先点选下方建议，或选择工作流 / Pi 模式新建会话。",
+        emptyTitle: "今天想推进什么？",
+        emptyBody: "会话已就绪。点选建议快速开场，或在下方输入框直接描述目标。业务写入仍经受治理 DAG。",
+    },
+    pi: {
+        id: "pi",
+        label: "Pi",
+        shortLabel: "Pi",
+        description: "保留压缩与 Explore，直接协作编码",
+        createLabel: "新建 Pi 会话",
+        bannerTitle: "Pi",
+        bannerBody: "保留 Console 压缩与 Explore，直接协作编码。不注入工作流业务指令、业务工具或 Goal 驱动。",
+        landingTitle: "开始一段 Pi 协作",
+        landingBody: "Pi 模式保留压缩、Explore、认证与 SDD 接入，取消工作流业务注入。适合有人监督的直接编码与调试。",
+        emptyTitle: "直接协作编码",
+        emptyBody: "会话已就绪。使用 Pi 工具读写仓库；Explore 负责只读深挖。本会话不加载任务 / DAG 工作流工具。",
+    },
+};
+/** Slash actions that only exist in workflow sessions. Browser-safe: pure
+ *  string constants, no runtime/tool policy imports. */
+export const WORKFLOW_EXCLUSIVE_SLASH_ACTIONS = Object.freeze([
+    "focus-panel:task",
+    "focus-panel:contract",
+    "focus-panel:dag",
+    "focus:interview",
+    "goal",
+]);
+export function isWorkflowExclusiveSlashAction(action) {
+    return WORKFLOW_EXCLUSIVE_SLASH_ACTIONS.includes(action);
+}