@tea-agent/loop-agent 0.43.0-next.3 → 0.43.0-next.5

package/dist/worker/console/chat/session-mode.js

@@ -0,0 +1,218 @@
+/**
+ * Console Chat session modes (workflow | pi).
+ *
+ * sessionMode is a durable session identity, independent of per-turn
+ * operator | requirement-interview and of UI layout mode. Record is the
+ * source of truth; runtime, catalog, list/detail and the browser cache
+ * all project this field.
+ */
+import { OPERATOR_CHAT_ALLOWED_TOOLS, OPERATOR_CHAT_BUILTIN_CUSTOM_TOOLS, OPERATOR_CHAT_PI_BUILTIN_TOOLS, authorizeOperatorChatTool, isOperatorChatToolDenied, } from "./tools.js";
+import { OPERATOR_CHAT_AGENT_TOOL_NAME } from "./subagents/types.js";
+import { CONSOLE_CHAT_SESSION_MODES, DEFAULT_CONSOLE_CHAT_SESSION_MODE, } from "./session-mode-view.js";
+export { CONSOLE_CHAT_SESSION_MODES, DEFAULT_CONSOLE_CHAT_SESSION_MODE, SESSION_MODE_COPY, } from "./session-mode-view.js";
+export const SESSION_MODE_INVALID_CODE = "INVALID_SESSION_MODE";
+export const SESSION_MODE_UNKNOWN_CODE = "UNKNOWN_SESSION_MODE";
+export const SESSION_MODE_ACTION_DENIED_CODE = "SESSION_MODE_ACTION_DENIED";
+export const SESSION_MODE_IMMUTABLE_CODE = "SESSION_MODE_IMMUTABLE";
+export class InvalidChatSessionModeError extends Error {
+    value;
+    code = SESSION_MODE_INVALID_CODE;
+    constructor(value) {
+        super(`sessionMode must be "workflow" or "pi"${value === undefined || value === null || value === ""
+            ? ""
+            : `; got ${String(value)}`}`);
+        this.value = value;
+        this.name = "InvalidChatSessionModeError";
+    }
+}
+export class UnknownChatSessionModeError extends Error {
+    value;
+    code = SESSION_MODE_UNKNOWN_CODE;
+    constructor(value) {
+        super(`chat session record has unknown sessionMode ${JSON.stringify(value)}; refusing to run as workflow`);
+        this.value = value;
+        this.name = "UnknownChatSessionModeError";
+    }
+}
+const MODE_SET = new Set(CONSOLE_CHAT_SESSION_MODES);
+function isSessionMode(value) {
+    return typeof value === "string" && MODE_SET.has(value);
+}
+/**
+ * Create-path parser. Missing / null / "" → workflow. Explicit illegal
+ * values fail closed and must not silently degrade.
+ */
+export function parseCreateSessionMode(value) {
+    if (value === undefined || value === null || value === "") {
+        return DEFAULT_CONSOLE_CHAT_SESSION_MODE;
+    }
+    if (isSessionMode(value))
+        return value;
+    throw new InvalidChatSessionModeError(value);
+}
+/**
+ * Restore-path parser. Missing field → workflow (stock-data rule, not a
+ * compatibility shim). Present but unknown → fail closed.
+ */
+export function readStoredSessionMode(value) {
+    if (value === undefined || value === null || value === "") {
+        return DEFAULT_CONSOLE_CHAT_SESSION_MODE;
+    }
+    if (isSessionMode(value))
+        return value;
+    throw new UnknownChatSessionModeError(value);
+}
+export function isWorkflowSessionMode(mode) {
+    return mode === "workflow";
+}
+export function isPiSessionMode(mode) {
+    return mode === "pi";
+}
+/** Shared Console foundations that both modes keep. Not a native-only prompt. */
+export const PI_CHAT_SYSTEM_PROMPT_BASE = [
+    "You are Console Chat in Pi mode: a coding assistant with Pi tools plus Console shared foundations.",
+    "Use read/write/edit/bash/grep/find/ls to inspect and change the workspace. apply_patch, full-tools, shell and coding-chat are denied.",
+    "Agent (Explore) is a built-in read-only subagent for path-uncertain codebase search. Do not use it for a known single-file read. Prefer safe-read/safe-grep for secret-safe probes.",
+    "ask_user_question pauses for a real user answer. todo_write tracks the current work and is restored after compression; it is not a workflow auto-continue signal. The persistent terminal tool is available.",
+    "This session keeps Console compression (L0/L1/L2, sift, strict checkpoint) and existing Aimax / SDD access. Do not create tasks, run DAGs, drive Goals, or start requirement interviews from this session.",
+    "Obey repository AGENTS.md, skills and extensions when they apply. Choosing Pi mode is not extra write authorization and does not bypass Console access control or output scrubbing.",
+].join("\n");
+export const CHAT_SAFE_EXPLORE_TOOL_IDS = Object.freeze([
+    "safe-read",
+    "safe-grep",
+    "git-status",
+    "git-diff",
+]);
+export const PI_CHAT_GENERIC_HELPER_TOOLS = Object.freeze([
+    "ask_user_question",
+    "todo_write",
+]);
+export const PI_CHAT_WORKFLOW_TOOL_IDS = Object.freeze([
+    "get_goal",
+    "create_goal",
+    "update_goal",
+]);
+const CHAT_EXTENSION_DENIED_TOOL_IDS = new Set([
+    "apply_patch",
+    "apply-patch",
+    "full-tools",
+    "full_tools",
+    "coding-chat",
+    "coding_chat",
+    "shell",
+].map((name) => name.toLowerCase()));
+const WORKFLOW_OPERATOR_TOOL_IDS = new Set(OPERATOR_CHAT_ALLOWED_TOOLS.map((name) => name.toLowerCase()));
+const PI_GOAL_TOOL_IDS = new Set(PI_CHAT_WORKFLOW_TOOL_IDS.map((name) => name.toLowerCase()));
+export function workflowActiveToolBaseline() {
+    return [
+        ...OPERATOR_CHAT_ALLOWED_TOOLS,
+        ...OPERATOR_CHAT_PI_BUILTIN_TOOLS,
+        ...CHAT_SAFE_EXPLORE_TOOL_IDS,
+        ...OPERATOR_CHAT_BUILTIN_CUSTOM_TOOLS,
+    ];
+}
+export function piActiveToolBaseline() {
+    return [
+        ...OPERATOR_CHAT_PI_BUILTIN_TOOLS,
+        ...CHAT_SAFE_EXPLORE_TOOL_IDS,
+        ...OPERATOR_CHAT_BUILTIN_CUSTOM_TOOLS,
+        ...PI_CHAT_GENERIC_HELPER_TOOLS,
+    ];
+}
+export function chatActiveToolBaseline(sessionMode) {
+    return sessionMode === "pi"
+        ? piActiveToolBaseline()
+        : workflowActiveToolBaseline();
+}
+/**
+ * Gate 2 pin: mode baseline plus user/project extension tools. Pi mode must
+ * not re-add operator actions or Goal tools via the extras pass.
+ */
+export function computeChatActiveToolNames(session, sessionMode) {
+    const baseline = chatActiveToolBaseline(sessionMode);
+    if (!session?.getAllTools)
+        return baseline;
+    const baselineLower = new Set(baseline.map((name) => name.toLowerCase()));
+    const extras = [];
+    for (const tool of session.getAllTools()) {
+        const name = tool?.name;
+        if (!name || typeof name !== "string")
+            continue;
+        const lower = name.toLowerCase();
+        if (baselineLower.has(lower))
+            continue;
+        if (CHAT_EXTENSION_DENIED_TOOL_IDS.has(lower))
+            continue;
+        if (sessionMode === "pi" && WORKFLOW_OPERATOR_TOOL_IDS.has(lower))
+            continue;
+        if (sessionMode === "pi" && PI_GOAL_TOOL_IDS.has(lower))
+            continue;
+        extras.push(name);
+    }
+    return extras.length > 0 ? [...baseline, ...extras] : baseline;
+}
+export function authorizeChatSessionTool(toolId, sessionMode) {
+    if (sessionMode === "workflow")
+        return authorizeOperatorChatTool(toolId);
+    const id = toolId.trim();
+    if (!id) {
+        return {
+            ok: false,
+            code: "tool-unknown",
+            toolId: id,
+            message: "empty tool id is not allowed in Pi mode",
+        };
+    }
+    if (isOperatorChatToolDenied(id)) {
+        return {
+            ok: false,
+            code: "tool-denied",
+            toolId: id,
+            message: `tool "${id}" is denied in Pi mode (no apply_patch/full-tools/shell/coding-chat)`,
+        };
+    }
+    const lower = id.toLowerCase();
+    if (WORKFLOW_OPERATOR_TOOL_IDS.has(lower) || PI_GOAL_TOOL_IDS.has(lower)) {
+        return {
+            ok: false,
+            code: "tool-denied",
+            toolId: id,
+            message: `tool "${id}" is a workflow action and is not available in Pi mode`,
+        };
+    }
+    const authorized = new Set(piActiveToolBaseline().map((name) => name.toLowerCase()));
+    if (authorized.has(lower))
+        return { ok: true, toolId: id };
+    return {
+        ok: false,
+        code: "tool-unknown",
+        toolId: id,
+        message: `tool "${id}" is not registered for Pi mode`,
+    };
+}
+export function composeChatSystemPromptParts(input) {
+    const base = input.sessionMode === "pi"
+        ? PI_CHAT_SYSTEM_PROMPT_BASE
+        : input.workflowPrompt;
+    const suffix = input.sessionMode === "workflow" ? input.systemPromptSuffix?.trim() : "";
+    return suffix ? [base, suffix] : [base];
+}
+export function composeChatSystemPrompt(input) {
+    return composeChatSystemPromptParts(input).join("\n\n");
+}
+export const PI_TODO_WRITE_DESCRIPTION = "Record and update a structured task list for the current work. Send the ENTIRE list every call — it REPLACES the previous list (no partial updates, no per-item edits). Before starting multi-step work, add one todo per concrete step. Keep at least one todo `in_progress` while work remains. Mark a todo `completed` immediately when it is done (do not batch completions) and resend the full list as progress advances. Skip the list for simple Q&A, read-only lookups, and single-step tasks. Statuses: `pending` / `in_progress` / `completed`.";
+// Slash gating lives in the browser-safe view module (shortcuts.ts is in the
+// UI bundle); re-export here for Node-side consumers.
+export { WORKFLOW_EXCLUSIVE_SLASH_ACTIONS, isWorkflowExclusiveSlashAction, } from "./session-mode-view.js";
+export function shouldLoadWorkflowBusinessTools(sessionMode) {
+    return sessionMode === "workflow";
+}
+export function shouldInjectGoalContinuation(sessionMode) {
+    return sessionMode === "workflow";
+}
+export function shouldAcceptOperatorSnapshot(sessionMode) {
+    return sessionMode === "workflow";
+}
+export const SESSION_MODE_ACTION_DENIED_MESSAGE = "this action is only available in workflow sessions";
+/** Stable tool name used by tests and catalogs for the Explore subagent. */
+export const PI_CHAT_AGENT_TOOL_NAME = OPERATOR_CHAT_AGENT_TOOL_NAME;

package/dist/worker/console/chat/session-store.js

@@ -15,6 +15,7 @@ import { readdir, rm } from "node:fs/promises";
 import { readJsonIfExists, writeSecureJson, } from "../../../infrastructure/console/app-data.js";
 import { dispatchOperatorAction } from "../operator-actions.js";
 import { authorizeOperatorChatTool } from "./tools.js";
+import { authorizeChatSessionTool, DEFAULT_CONSOLE_CHAT_SESSION_MODE, readStoredSessionMode, } from "./session-mode.js";
 import { projectOperationForChat } from "./chat-event-store.js";
 import { scrubSecrets } from "./explore-tools.js";
 import { hashDeferredTurnPayload, parseDeferredTurns, } from "./deferred-turn.js";
@@ -106,6 +107,7 @@ export class ChatSessionStore {
             ...(typeof raw.workspaceId === "string" && raw.workspaceId
                 ? { workspaceId: raw.workspaceId }
                 : {}),
+            sessionMode: readStoredSessionMode(raw.sessionMode),
             deferredTurns: normalizedDeferredTurns,
             ...(normalizedDeferredTurns[0] ? { deferredTurn: normalizedDeferredTurns[0] } : {}),
             deferredQueueRevision: Number.isSafeInteger(raw.deferredQueueRevision) && (raw.deferredQueueRevision ?? 0) >= 0
@@ -143,7 +145,17 @@ export class ChatSessionStore {
         }
         const records = await Promise.all(names
             .filter((name) => name.endsWith(".json"))
-            .map((name) => this.get(name.slice(0, -".json".length))));
+            .map(async (name) => {
+            try {
+                return await this.get(name.slice(0, -".json".length));
+            }
+            catch (error) {
+                // Skip corrupt records (e.g. unknown sessionMode) but stay
+                // diagnosable: silent disappearance is untraceable otherwise.
+                process.stderr.write(`[console] chat session record skipped in list: ${name.slice(0, -".json".length)}: ${error instanceof Error ? error.message : String(error)}\n`);
+                return undefined;
+            }
+        }));
         return records
             .filter((record) => Boolean(record) && (options?.includeArchived || record.state === "active"))
             .sort((a, b) => b.updatedAt.localeCompare(a.updatedAt));
@@ -172,6 +184,7 @@ export class ChatSessionStore {
                 updatedAt: now,
                 modelProvider: input.modelProvider,
                 modelId: input.modelId,
+                sessionMode: input.sessionMode ?? DEFAULT_CONSOLE_CHAT_SESSION_MODE,
                 messages: [],
                 toolInvocations: [],
             };
@@ -497,9 +510,10 @@ export class ChatSessionStore {
 /**
  * Dispatch a Chat tool invocation into the operator action layer.
  *
- * Gate 3 (per-call): authorizeOperatorChatTool is re-checked here. Even if a
- * malicious or drifted session somehow requested a denied tool, this gate
- * refuses before any operator action runs (V12 / V15).
+ * Gate 3 (per-call): authorizeChatSessionTool is re-checked here with the
+ * session mode. Even if a malicious or drifted session somehow requested a
+ * denied or workflow-exclusive tool, this gate refuses before any operator
+ * action runs (V12 / V15).
  *
  * High-risk actions (contractApply / runDag / etc.) are NOT registered as
  * tools, so they never reach here; but we still deny defensively.
@@ -514,8 +528,10 @@ function redactHumanGateToken(value) {
     delete clone.humanGateToken;
     return clone;
 }
-export async function dispatchChatToolCall(ctx, toolName, args, clientRequestId) {
-    const decision = authorizeOperatorChatTool(toolName);
+export async function dispatchChatToolCall(ctx, toolName, args, clientRequestId, sessionMode) {
+    const decision = sessionMode === undefined
+        ? authorizeOperatorChatTool(toolName)
+        : authorizeChatSessionTool(toolName, sessionMode);
     if (!decision.ok) {
         return {
             ok: false,

package/dist/worker/console/chat/shortcuts.js

@@ -5,6 +5,7 @@
  * prompt / skill commands are merged via mergeSlashCommands with conflict
  * priority: operator/web > extension > skill > prompt.
  */
+import { isWorkflowExclusiveSlashAction } from "./session-mode-view.js";
 export const SHORTCUTS = [
     {
         command: "/task",
@@ -138,7 +139,10 @@ export function mergeSlashCommands(dynamic = [], capabilities = {}) {
             byName.set(key, { ...item, command: key });
         }
     };
+    const hideWorkflow = capabilities.sessionMode === "pi";
     for (const item of SHORTCUTS) {
+        if (hideWorkflow && isWorkflowExclusiveSlashAction(item.action))
+            continue;
         upsert({
             command: item.command,
             label: item.label,
@@ -148,6 +152,8 @@ export function mergeSlashCommands(dynamic = [], capabilities = {}) {
         });
     }
     for (const item of WEB_SLASH_COMMANDS) {
+        if (hideWorkflow && isWorkflowExclusiveSlashAction(item.action))
+            continue;
         upsert({
             command: item.command,
             label: item.label,

package/dist/worker/console/chat/terminal-routes.js

@@ -0,0 +1,216 @@
+/**
+ * Operator Chat — terminal management HTTP API (Console UI side).
+ *
+ * Endpoints (all under /api/operator/v1/chat):
+ *   GET  /terminals                          list terminal sessions (all owners)
+ *   POST /terminals                          spawn { shell, name?, cwd?, ownerSessionId? }
+ *   GET  /terminals/:id                      session info + buffered output
+ *   POST /terminals/:id/input                { data }  write to the PTY
+ *   POST /terminals/:id/resize               { cols, rows }
+ *   POST /terminals/:id/interrupt            send Ctrl+C
+ *   POST /terminals/:id/kill                 stop and await full exit
+ *   GET  /terminals/:id/stream               SSE: buffered replay + live chunks
+ *
+ * Mutating routes require the Console boot token (same gate as other chat
+ * mutations). The stream is read-only and uses the same origin checks as the
+ * chat event stream.
+ */
+import { TerminalSessionError, availableShellKinds, } from "./terminal-sessions.js";
+function sendJson(res, status, body) {
+    const payload = JSON.stringify(body);
+    res.writeHead(status, {
+        "content-type": "application/json; charset=utf-8",
+        "cache-control": "no-store",
+    });
+    res.end(payload);
+}
+function mapTerminalError(res, error) {
+    if (error instanceof TerminalSessionError) {
+        const status = error.code === "TERMINAL_NOT_FOUND"
+            ? 404
+            : error.code === "TERMINAL_EXITED" || error.code === "TERMINAL_SEND_ACTIVE"
+                ? 409
+                : 500;
+        sendJson(res, status, {
+            ok: false,
+            error: { code: error.code, message: error.message },
+        });
+        return;
+    }
+    sendJson(res, 500, {
+        ok: false,
+        error: {
+            code: "TERMINAL_INTERNAL",
+            message: error instanceof Error ? error.message : String(error),
+        },
+    });
+}
+async function readJsonBody(req, maxBytes = 512 * 1024) {
+    const chunks = [];
+    let total = 0;
+    for await (const chunk of req) {
+        const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        total += buf.length;
+        if (total > maxBytes)
+            throw new Error("request body too large");
+        chunks.push(buf);
+    }
+    if (chunks.length === 0)
+        return {};
+    const raw = Buffer.concat(chunks).toString("utf8");
+    if (!raw.trim())
+        return {};
+    return JSON.parse(raw);
+}
+/** Route dispatcher; returns true when the request was handled. */
+export async function handleTerminalRequest(req, res, deps, pathname) {
+    if (!pathname.startsWith("/api/operator/v1/chat/terminals"))
+        return false;
+    const method = (req.method ?? "GET").toUpperCase();
+    const rest = pathname.slice("/api/operator/v1/chat/terminals".length);
+    const parts = rest.split("/").filter(Boolean);
+    try {
+        // GET /terminals — list (+ available shell kinds for this platform)
+        if (method === "GET" && parts.length === 0) {
+            sendJson(res, 200, {
+                ok: true,
+                data: {
+                    terminals: deps.terminals.list(),
+                    availableShells: availableShellKinds().kinds,
+                },
+            });
+            return true;
+        }
+        // POST /terminals — spawn
+        if (method === "POST" && parts.length === 0) {
+            const gate = deps.gateMutation(req);
+            if (!gate.ok) {
+                sendJson(res, gate.status, { ok: false, error: { code: gate.code, message: gate.message } });
+                return true;
+            }
+            const body = await readJsonBody(req);
+            const kinds = availableShellKinds().kinds;
+            const shell = kinds.includes(body.shell)
+                ? body.shell
+                : undefined;
+            if (!shell) {
+                sendJson(res, 400, {
+                    ok: false,
+                    error: {
+                        code: "INVALID_INPUT",
+                        message: `shell must be one of: ${kinds.join(", ")} (available on this platform)`,
+                    },
+                });
+                return true;
+            }
+            const info = deps.terminals.spawn({
+                ownerSessionId: typeof body.ownerSessionId === "string" && body.ownerSessionId
+                    ? body.ownerSessionId
+                    : "console-ui",
+                name: typeof body.name === "string" && body.name ? body.name : `${shell}-ui`,
+                shell: shell,
+                cwd: typeof body.cwd === "string" && body.cwd
+                    ? body.cwd
+                    : (deps.defaultCwd ?? undefined),
+                cols: typeof body.cols === "number" ? body.cols : undefined,
+                rows: typeof body.rows === "number" ? body.rows : undefined,
+            });
+            sendJson(res, 201, { ok: true, data: info });
+            return true;
+        }
+        const sessionId = parts[0];
+        if (!sessionId)
+            return false;
+        const sub = parts[1] ?? "";
+        // GET /terminals/:id — info + buffered output
+        if (method === "GET" && parts.length === 1) {
+            const info = deps.terminals.get(sessionId);
+            const output = deps.terminals.readAll(sessionId);
+            sendJson(res, 200, { ok: true, data: { ...info, output } });
+            return true;
+        }
+        // GET /terminals/:id/stream — SSE
+        if (method === "GET" && sub === "stream") {
+            // Validate existence first (404 before opening the stream).
+            const info = deps.terminals.get(sessionId);
+            void info;
+            res.writeHead(200, {
+                "content-type": "text/event-stream; charset=utf-8",
+                "cache-control": "no-cache, no-store",
+                connection: "keep-alive",
+                "x-accel-buffering": "no",
+            });
+            const writeFrame = (event, data) => {
+                if (res.writableEnded)
+                    return;
+                res.write(`event: ${event}\ndata: ${JSON.stringify(data)}\n\n`);
+            };
+            const buffered = deps.terminals.readAll(sessionId);
+            writeFrame("snapshot", {
+                truncated: buffered.truncated,
+                totalOutputChars: buffered.totalOutputChars,
+                text: buffered.text,
+                info: deps.terminals.get(sessionId),
+            });
+            const unsubscribe = deps.terminals.subscribe(sessionId, (chunk) => {
+                writeFrame("data", { chunk });
+            });
+            const heartbeat = setInterval(() => {
+                if (!res.writableEnded)
+                    res.write(": heartbeat\n\n");
+            }, 15_000);
+            res.once("close", () => {
+                clearInterval(heartbeat);
+                unsubscribe();
+            });
+            return true;
+        }
+        // Everything else mutates → gate first.
+        const gate = deps.gateMutation(req);
+        if (!gate.ok) {
+            sendJson(res, gate.status, { ok: false, error: { code: gate.code, message: gate.message } });
+            return true;
+        }
+        if (method === "POST" && sub === "input" && parts.length === 2) {
+            const body = await readJsonBody(req);
+            if (typeof body.data !== "string") {
+                sendJson(res, 400, { ok: false, error: { code: "INVALID_INPUT", message: "data (string) is required" } });
+                return true;
+            }
+            deps.terminals.send(sessionId, body.data);
+            sendJson(res, 200, { ok: true });
+            return true;
+        }
+        if (method === "POST" && sub === "resize" && parts.length === 2) {
+            const body = await readJsonBody(req);
+            const cols = Number(body.cols);
+            const rows = Number(body.rows);
+            if (!Number.isInteger(cols) || !Number.isInteger(rows) || cols < 2 || rows < 2 || cols > 500 || rows > 200) {
+                sendJson(res, 400, { ok: false, error: { code: "INVALID_INPUT", message: "cols and rows (integers 2..500/200) are required" } });
+                return true;
+            }
+            deps.terminals.resize(sessionId, cols, rows);
+            sendJson(res, 200, { ok: true });
+            return true;
+        }
+        if (method === "POST" && sub === "interrupt" && parts.length === 2) {
+            deps.terminals.interrupt(sessionId);
+            sendJson(res, 200, { ok: true });
+            return true;
+        }
+        if (method === "POST" && sub === "kill" && parts.length === 2) {
+            await deps.terminals.kill(sessionId);
+            sendJson(res, 200, { ok: true });
+            return true;
+        }
+        sendJson(res, 404, { ok: false, error: { code: "NOT_FOUND", message: `unknown terminal route: ${method} ${pathname}` } });
+        return true;
+    }
+    catch (error) {
+        if (!res.headersSent)
+            mapTerminalError(res, error);
+        else
+            res.end();
+        return true;
+    }
+}