@tea-agent/loop-agent 0.43.0-next.9 → 0.43.0

package/dist/worker/console/chat/routes.js

@@ -134,6 +134,16 @@ export function projectStoredMessagesWithEventOrder(messages, events) {
             if (event.kind !== expectedKind)
                 continue;
             const data = event.data;
+            // Exact alignment wins: since 2026-09-13 message_end frames carry the
+            // durable assistant message id, so restore matches by id, never by
+            // text (duplicate assistant texts would mis-align within a turn).
+            if (typeof data.messageId === "string" && data.messageId) {
+                if (data.messageId === message.id) {
+                    assistantCursor = index + 1;
+                    return event;
+                }
+                continue;
+            }
             const eventText = typeof data.text === "string"
                 ? data.text
                 : typeof data.message === "string"
@@ -271,6 +281,15 @@ function turnEventToStorePartial(event) {
                     text: String(event.text ?? ""),
                     ...(content ? { content } : {}),
                     ...(timing ? { timing } : {}),
+                    // Durable assistant message id (2026-09-13): the session
+                    // store persists message_end BEFORE framing, so a reconnecting
+                    // client and the restore projection can align on this id
+                    // instead of matching text within a time window.
+                    ...(typeof event.messageId ===
+                        "string" &&
+                        event.messageId
+                        ? { messageId: event.messageId }
+                        : {}),
                 },
             };
         }
@@ -1327,7 +1346,7 @@ export async function handleChatGoal(req, res, deps, sessionId) {
         });
         return;
     }
-    if (!(await requireWorkflowSession(res, deps, sessionId)))
+    if (!(await requireChatSession(res, deps, sessionId)))
         return;
     if (req.method === "GET") {
         sendJson(res, 200, { ok: true, goal: registry.get(sessionId) });
@@ -2256,10 +2275,6 @@ export async function driveGoalRound(deps, sessionId) {
         registry.disarm(sessionId);
         return "idle";
     }
-    if (!isWorkflowSessionMode(readStoredSessionMode(record.sessionMode))) {
-        registry.disarm(sessionId);
-        return "idle";
-    }
     const runtimeFacts = deps.runtime.getSessionBusyFacts(sessionId);
     const operationStore = deps.runtime.actionContext?.operations;
     const linkedOperationIds = linkedOperationIdsForGoal(deps.events.snapshot(sessionId));
@@ -4283,8 +4298,13 @@ async function dispatchChatRequest(req, res, deps, pathname, workspaceScope) {
             return true;
         }
     }
-    // Browser probe API (read-only; explains iframe refusals to the panel).
-    if (await handleBrowserRequest(req, res, {}, pathname)) {
+    // Shared real-browser API for the Browser panel and chat browser tools.
+    if (await handleBrowserRequest(req, res, {
+        automation: deps.browserAutomation,
+        requireWorkspace: () => workspaceScope
+            ? { ok: true, workspaceId: workspaceScope }
+            : { ok: false },
+    }, pathname)) {
         return true;
     }
     if (!pathname.startsWith("/api/operator/v1/chat/") &&

package/dist/worker/console/chat/scheduled-goal-booking.js

@@ -0,0 +1,59 @@
+import { z } from "zod";
+import { prepareScheduledGoalDraft } from "../../scheduler/scheduled-goal-dispatch.js";
+import { scheduledGoalDraftSchema } from "../../scheduler/scheduled-goal-types.js";
+import { scheduledGoalHash } from "../../scheduler/scheduled-goal-store.js";
+import { readScheduledGoalResult } from "../../scheduler/scheduled-goal-recovery.js";
+export const scheduledGoalBookingSchema = scheduledGoalDraftSchema.omit({ prepared: true, controllerRef: true }).extend({ chatSessionRef: z.string().regex(/^[a-zA-Z0-9_-]+$/) });
+export const scheduledGoalConfirmationSchema = z.object({
+    goalId: z.string().min(1), stateVersion: z.number().int().positive(),
+    envelopeHash: z.string().regex(/^[a-f0-9]{64}$/),
+}).strict();
+/** Only non-capability fields are returned to Chat/browser. */
+export function projectScheduledGoalBooking(goal) {
+    const { prepared: _prepared, controllerRef, ...scope } = goal.frozen;
+    return {
+        goalId: goal.goalId, stateVersion: goal.stateVersion, goalRevision: goal.goalRevision,
+        envelopeHash: goal.envelopeHash, state: goal.state, scope, controllerRef,
+        confirmationRequired: goal.state === "planned",
+    };
+}
+/** Preparation is not authorization, even when the clock is already due. */
+export async function prepareScheduledGoalBooking(input, deps, resolveFinalTime) {
+    const parsed = scheduledGoalBookingSchema.parse(input);
+    const session = await deps.sessions.get(parsed.chatSessionRef);
+    if (!session || session.state !== "active")
+        throw new Error("booking requires an active Chat session");
+    const admitted = await prepareScheduledGoalDraft(parsed, deps.client);
+    // High-level relative time starts after slow strict admission, not before it.
+    const frozen = resolveFinalTime ? scheduledGoalDraftSchema.parse({ ...admitted, time: resolveFinalTime() }) : admitted;
+    const existing = (await deps.goals.list()).find((goal) => goal.frozen.managedTaskId === frozen.managedTaskId && goal.state === "planned" &&
+        scheduledGoalHash(goal.frozen) === scheduledGoalHash(frozen));
+    const goal = existing ?? await deps.goals.createDraft(frozen);
+    return projectScheduledGoalBooking(goal);
+}
+export async function confirmScheduledGoalBooking(input, deps, human) {
+    // Provenance is supplied by the authenticated route, never parsed from model input.
+    if (human.source !== "human-ui" || !human.requestId?.trim())
+        throw new Error("human confirmation required");
+    const parsed = scheduledGoalConfirmationSchema.parse(input);
+    const goal = await deps.goals.get(parsed.goalId);
+    if (goal.approval?.approvalRef === human.requestId && goal.approval.envelopeHash === parsed.envelopeHash &&
+        goal.approval.approvedVersion === parsed.stateVersion)
+        return projectScheduledGoalBooking(goal);
+    const session = await deps.sessions.get(goal.frozen.chatSessionRef);
+    if (!session || session.state !== "active")
+        throw new Error("booking requires an active Chat session");
+    if (goal.envelopeHash !== parsed.envelopeHash || goal.stateVersion !== parsed.stateVersion || goal.state !== "planned")
+        throw new Error("booking confirmation binding mismatch");
+    // Revalidate controller, strict gate, Task and scope immediately before approval.
+    const { prepared: _prepared, controllerRef: _controller, ...scope } = goal.frozen;
+    const fresh = await prepareScheduledGoalDraft(scope, deps.client);
+    if (scheduledGoalHash(fresh) !== scheduledGoalHash(goal.frozen))
+        throw new Error("booking preparation drift");
+    const approved = await deps.goals.approve(goal.goalId, parsed.stateVersion, parsed.envelopeHash, human.requestId);
+    return projectScheduledGoalBooking(approved);
+}
+export async function getScheduledGoalBooking(goalId, goals) {
+    const goal = await goals.get(goalId);
+    return { ...projectScheduledGoalBooking(goal), result: await readScheduledGoalResult(goalId, goals) };
+}

package/dist/worker/console/chat/scheduled-goal-delivery.js

@@ -0,0 +1,27 @@
+import { scheduledGoalDeliveryKey } from "../../scheduler/scheduled-goal-store.js";
+/** The durable Chat record deduplicates a retry after ledger acknowledgement is lost.
+ * A missing Chat never gets recreated. The goal remains available through its ledger.
+ */
+export async function deliverScheduledGoalResult(goal, goals, sessions) {
+    const key = scheduledGoalDeliveryKey(goal);
+    if (goal.deliveryKey === key && goal.deliveryState === "delivered")
+        return;
+    const evidence = goal.evidence.at(-1);
+    const states = {
+        accepted: "已验收", cancelled: "已取消", blocked: "已停止", budget_exhausted: "预算用尽", unknown: "需要核对",
+        failed: "未通过", pending: "待处理", stale: "证据已失效", succeeded: "通过",
+    };
+    const label = (value) => states[value] ?? value;
+    const text = [
+        `预约目标：${goal.frozen.originalGoal}`,
+        `目标状态：${label(goal.state)}；验收：${label(goal.acceptanceState)}。已执行 ${goal.intents.length} 轮。`,
+        ...(goal.reasonCode ? ["停止原因与需要核对的运行记录，可在本会话的预约面板查看。"] : []),
+        ...(evidence ? evidence.assessment.criteria.map((ac) => {
+            const criterion = goal.frozen.acceptance.criteria.find((item) => item.acId === ac.acId);
+            return `${ac.acId} · ${criterion?.description ?? ac.acId}：${label(ac.status)}${ac.exitCode !== 0 ? `（退出码 ${ac.exitCode ?? "未知"}）` : ""}。`;
+        }) : []),
+        `预约编号：${goal.goalId}。证据和历史保留在预约面板；删除会话不会删除运行事实。`,
+    ].join("\n\n");
+    const delivered = await sessions.appendScheduledGoalResult(goal.frozen.chatSessionRef, key, text);
+    await goals.recordDelivery(goal.goalId, key, delivered ? "delivered" : "unavailable");
+}

package/dist/worker/console/chat/scheduled-goal-request.js

@@ -0,0 +1,190 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { mkdir, open, readFile, realpath, rename, unlink, writeFile } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+import path from "node:path";
+import { z } from "zod";
+import { getTaskPaths } from "../../../task/runtime.js";
+import { scheduledGoalDraftSchema, scheduledGoalTimeSchema } from "../../scheduler/scheduled-goal-types.js";
+import { resolveScheduledGoalTime } from "../../scheduler/scheduled-goal-time.js";
+import { ScheduledGoalStore, scheduledGoalHash } from "../../scheduler/scheduled-goal-store.js";
+import { captureScheduledGoalTree } from "../../scheduler/scheduled-goal-evidence.js";
+import { getScheduledGoalBooking, prepareScheduledGoalBooking } from "./scheduled-goal-booking.js";
+const execFileAsync = promisify(execFile);
+const protectedPaths = [".harness/**", "node_modules/**", ".git/**"];
+const relativePath = z.string().trim().min(1).max(500).refine((value) => !path.isAbsolute(value) && !/^[A-Za-z]:/.test(value) && !value.includes("\\") &&
+    !value.split("/").some((part) => part === ".." || part === "." || part === "") && !value.startsWith("-"), "use a relative repository path without traversal");
+const scheduleSchema = z.object({
+    delayMinutes: z.number().positive().max(525600).optional().describe("Delay AFTER preparation finishes; use for '3 minutes later'. The confirmation card shows the resulting exact time."),
+    localAt: z.string().regex(/^\d{4}-\d{2}-\d{2}[ T]\d{2}:\d{2}$/).optional().describe("Explicit local date/time YYYY-MM-DD HH:mm; never silently move a past date."),
+    timezone: z.string().min(1).optional().describe("IANA timezone, e.g. Asia/Shanghai for Beijing. Defaults to the Console host timezone."),
+    fold: z.enum(["earlier", "later"]).optional(),
+    allowedHours: z.array(z.string()).optional().describe("Local allowed windows; default [] means all day."),
+    startGraceMinutes: z.number().positive().max(1440).optional(),
+    maxDurationMinutes: z.number().positive().max(1440).optional(),
+}).strict().refine((value) => (value.delayMinutes !== undefined) !== (value.localAt !== undefined), "choose exactly one of delayMinutes or localAt");
+/** The model supplies business meaning, never runtime identity or authorization. */
+export const scheduledTaskRequestSchema = z.object({
+    originalGoal: z.string().trim().min(1).max(24000).describe("Faithfully preserve the complete user goal and constraints. Do not add unrequested failure cases, mocks, filenames or acceptance obligations; preserve real-service testing requirements."),
+    workflow: scheduledGoalDraftSchema.shape.workflow,
+    allowedPaths: z.array(relativePath).min(1).max(100).describe("Business outputs in the CURRENT project directory. For a read-only inspection, allow only a report such as scheduled-report.md, never .harness/."),
+    forbiddenPaths: z.array(relativePath).max(100).optional(),
+    acceptance: scheduledGoalDraftSchema.shape.acceptance.describe("Use minimal independent executable checks with AC-1, AC-2 IDs. Each command must exit nonzero on failure. For backend-test, acceptance must only inspect the finished run and must never invoke pytest. Prefer an existing read-only verification command or test -s report.md. Do not invent extra requirements, language-specific grep checks, shell pipelines, command substitution, redirects or compound shell statements. The host already enforces write scope."),
+    budget: scheduledGoalDraftSchema.shape.budget.optional().describe("Omit for ordinary tasks: defaults to one DAG run, one goal attempt and one supervisor call. maxTurns counts goal attempts, NOT model tool calls; maxSupervisorCalls does NOT count polling. Always displayed before confirmation."),
+    schedule: scheduleSchema,
+}).strict();
+export function resolveScheduledTaskTime(input, now) {
+    const schedule = scheduleSchema.parse(input);
+    const timezone = schedule.timezone ?? Intl.DateTimeFormat().resolvedOptions().timeZone;
+    const executeAtUtc = schedule.localAt
+        ? resolveScheduledGoalTime({ localAt: schedule.localAt, timezone, fold: schedule.fold })
+        : new Date(now.getTime() + schedule.delayMinutes * 60000).toISOString();
+    if (Date.parse(executeAtUtc) <= now.getTime())
+        throw new Error("requested time is in the past; provide a new future time (不会自动顺延)");
+    const latestStart = Date.parse(executeAtUtc) + (schedule.startGraceMinutes ?? 15) * 60000;
+    const stop = latestStart + (schedule.maxDurationMinutes ?? 60) * 60000;
+    return scheduledGoalTimeSchema.parse({ executeAtUtc, latestStartUtc: new Date(latestStart).toISOString(),
+        stopAtUtc: new Date(stop).toISOString(), expiresAt: new Date(stop).toISOString(), timezone,
+        allowedHours: schedule.allowedHours ?? [], misfirePolicy: "run-immediately" });
+}
+const git = async (cwd, ...args) => (await execFileAsync("git", ["-C", cwd, ...args], { encoding: "utf8", timeout: 30000, maxBuffer: 4 * 1024 * 1024 })).stdout.trim();
+const sameSet = (a, b) => JSON.stringify([...new Set(a)].sort()) === JSON.stringify([...new Set(b)].sort());
+function assertScheduledAcceptanceDoesNotRepeatBackendTests(request) {
+    if (request.workflow !== "backend-test")
+        return;
+    const repeated = request.acceptance.criteria.find((criterion) => /(?:^|\s)(?:python(?:3)?\s+-m\s+)?pytest\b/i.test(criterion.command));
+    if (repeated)
+        throw new Error(`backend-test acceptance must not invoke pytest; ${repeated.acId} must inspect the completed run instead`);
+}
+/** Synchronous PREPARATION only. CLI calls are bounded and NEVER approve a DAG.
+ * A durable exclusive request marker prevents retries from creating duplicate Tasks
+ * or overwriting imported source. Unknown interrupted preparation is not reclaimed.
+ */
+export async function prepareScheduledTask(input, deps) {
+    const request = scheduledTaskRequestSchema.parse(input);
+    assertScheduledAcceptanceDoesNotRepeatBackendTests(request);
+    for (const ref of request.allowedPaths) {
+        if (/^(?:\.harness|\.git|node_modules)(?:\/|$)/.test(ref) || ref.includes("*") && !/^[\w.-]+\//.test(ref))
+            throw new Error(`protected or unbounded output path ${ref}; use an ordinary bounded report/output path, never runtime directories`);
+    }
+    if (!/^[a-zA-Z0-9_-]+$/.test(deps.sessionId) || (await deps.sessions.get(deps.sessionId))?.state !== "active")
+        throw new Error("preparation requires an active bound Chat session");
+    const identity = deps.client.getIdentity();
+    if (!identity)
+        throw new Error("preparation requires a pinned controller");
+    const repoRoot = await realpath(deps.repoRoot);
+    const now = deps.now ?? (() => new Date());
+    const key = scheduledGoalHash({ repoRoot, sessionId: deps.sessionId, request });
+    // Keep generated paths compact: runtimes/extensions may encode the whole cwd
+    // into one filename. The full hash below still verifies receipt identity.
+    const directory = path.join(deps.preparationRoot, key.slice(0, 24));
+    const recordPath = path.join(directory, "preparation.json");
+    const goals = new ScheduledGoalStore(repoRoot);
+    const existing = await readFile(recordPath, "utf8").then((text) => JSON.parse(text)).catch((error) => {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw error;
+    });
+    if (existing) {
+        if (existing.version !== 1 || existing.requestHash !== key)
+            throw new Error("preparation record binding mismatch");
+        if (existing.goalId)
+            return getScheduledGoalBooking(existing.goalId, goals);
+        // Covers a crash after the goal ledger commit but before the local receipt.
+        const committed = (await goals.list()).find((goal) => goal.frozen.managedTaskId === existing.taskId && goal.frozen.chatSessionRef === deps.sessionId);
+        if (committed)
+            return getScheduledGoalBooking(committed.goalId, goals);
+        throw new Error(`previous preparation ${existing.stage}: ${existing.error ?? "still running or interrupted; do not duplicate or edit its artifacts"}; evidence: ${recordPath}`);
+    }
+    // Replays return their durable result even after the requested time has passed.
+    // New requests validate time before creating artifacts; relative time is also
+    // resolved after preparation so preparation cannot consume the delay.
+    resolveScheduledTaskTime(request.schedule, now());
+    // Check before creating a Task or receipt; never clean or reset the user's workspace.
+    const base = await git(repoRoot, "rev-parse", "HEAD");
+    const initial = await captureScheduledGoalTree(repoRoot, base, request.allowedPaths, protectedPaths);
+    if (initial.changedPaths.length)
+        throw new Error(`current workspace has uncommitted changes: ${initial.changedPaths.slice(0, 10).join(", ")}. Resolve them before booking; do not automatically commit, stash or reset user changes.`);
+    await mkdir(directory, { recursive: true, mode: 0o700 });
+    const lockPath = path.join(directory, "preparing.lock");
+    const lock = await open(lockPath, "wx", 0o600).catch((error) => {
+        if (error.code === "EEXIST")
+            throw new Error("preparation already running; do not duplicate or take over");
+        throw error;
+    });
+    const record = { version: 1, requestHash: key, stage: "workspace", taskId: `scheduled-${key.slice(0, 24)}`, worktree: repoRoot };
+    const persist = async () => {
+        const temporary = `${recordPath}.${randomUUID()}.tmp`;
+        await writeFile(temporary, JSON.stringify(record, null, 2), { mode: 0o600 });
+        await rename(temporary, recordPath);
+    };
+    let started = false;
+    try {
+        // Recheck after acquiring the lock: another request may have finished between
+        // our initial read and lock acquisition.
+        const raced = await readFile(recordPath, "utf8").catch((e) => { if (e.code === "ENOENT")
+            return undefined; throw e; });
+        if (raced)
+            throw new Error("preparation changed concurrently; retry reading the existing request");
+        started = true;
+        await persist();
+        const forbiddenPaths = [...new Set([...protectedPaths, ...(request.forbiddenPaths ?? [])])];
+        const prdPath = path.join(directory, "request.md");
+        const prd = ["# Scheduled task", "## Goal", request.originalGoal,
+            "## Execution context", `Execution and all outputs: current project directory ${record.worktree}.`,
+            "Inspect this project directly. Write only the authorized outputs here; for read-only inspection, write only the requested report. Implementation changes remain in this directory for the user to review. Do not create another worktree, copy outputs elsewhere, or reset/stash existing changes. The confirmed Git base must remain unchanged until execution finishes.",
+            "## Acceptance criteria", ...request.acceptance.criteria.map((ac) => `- ${ac.acId}: ${ac.description}\n  Verification: ${ac.command}`),
+            "## Boundaries", `Workflow: ${request.workflow}; policy: ${request.acceptance.policy}.`,
+            `Allowed outputs: ${JSON.stringify(request.allowedPaths)}. Forbidden outputs: ${JSON.stringify(forbiddenPaths)}.`,
+            "Never modify imported requirements, .harness runtime, dependencies, Git history or configuration. No push, merge or publication. The host delivers the final result to the original Chat; do not implement a second delivery/scheduling mechanism.",
+            "## Verification", ...request.acceptance.criteria.map((ac) => ac.command), ""].join("\n\n");
+        await writeFile(prdPath, prd, { flag: "wx", mode: 0o600 });
+        const boundary = request.allowedPaths.flatMap((ref) => ["--allowed-path", ref])
+            .concat(forbiddenPaths.flatMap((ref) => ["--forbidden-path", ref]))
+            .concat(request.acceptance.criteria.flatMap((ac) => ["--verify", `${ac.acId}:${ac.command}`]));
+        for (let step = 0; step < 2; step++) {
+            record.stage = step === 0 ? "task-import" : "task-prepare";
+            await persist();
+            const args = ["task", "advance", record.taskId, ...(step === 0 ? ["Scheduled task", "--prd", prdPath] : []),
+                "--task-kind", request.workflow, ...boundary, "--json"];
+            const result = await deps.client.run(args, { cwd: record.worktree, artifactName: `${record.taskId}-${step}`, expectJson: true, timeoutMs: 300000 });
+            if (!result.ok || result.exitCode !== 0 || result.timedOut) {
+                const detail = JSON.stringify(result.json ?? result.stderr ?? "no CLI evidence").slice(0, 6000);
+                throw new Error(`${record.stage} failed: ${detail}. Correct the request and re-import through this tool; never edit source/references or runtime files.`);
+            }
+            const envelope = result.json;
+            if (envelope?.ok !== true)
+                throw new Error(`${record.stage}: missing successful CLI envelope`);
+            if (envelope.result?.lifecycleState === "awaiting-write-set-approval")
+                break;
+        }
+        record.stage = "booking";
+        await persist();
+        // Freeze actual strict-prepared path ordering/default restrictions. Never adopt
+        // a broader allowed set or drop a caller restriction to make admission pass.
+        const config = z.object({ taskKind: z.string(), allowedPaths: z.array(z.string()), forbiddenPaths: z.array(z.string()) }).parse(JSON.parse(await readFile(getTaskPaths(record.worktree, record.taskId).taskConfigPath, "utf8")));
+        if (config.taskKind !== request.workflow || !sameSet(config.allowedPaths, request.allowedPaths) || forbiddenPaths.some((ref) => !config.forbiddenPaths.includes(ref)))
+            throw new Error("prepared task scope differs from request; refusing to widen scope");
+        if (deps.client.getIdentity()?.packageFingerprint.value !== identity.packageFingerprint.value)
+            throw new Error("controller changed during preparation");
+        const booking = await prepareScheduledGoalBooking({ managedTaskId: record.taskId, originalGoal: request.originalGoal,
+            chatSessionRef: deps.sessionId, workflow: request.workflow, worktreeRef: record.worktree, frozenBase: base,
+            allowedPaths: config.allowedPaths, forbiddenPaths: config.forbiddenPaths, acceptance: request.acceptance,
+            budget: request.budget ?? { maxTurns: 1, maxDagRuns: 1, maxSupervisorCalls: 1 }, time: resolveScheduledTaskTime(request.schedule, now()),
+        }, { goals, client: deps.client, sessions: deps.sessions }, () => resolveScheduledTaskTime(request.schedule, now()));
+        record.goalId = booking.goalId;
+        record.stage = "planned";
+        await persist();
+        return booking;
+    }
+    catch (error) {
+        record.error = error instanceof Error ? error.message : String(error);
+        if (started)
+            await persist();
+        throw new Error(`Scheduled task preparation stopped at ${record.stage}: ${record.error}`);
+    }
+    finally {
+        await lock.close();
+        await unlink(lockPath);
+    }
+}

package/dist/worker/console/chat/sdd-data-alignment.js

@@ -144,7 +144,7 @@ export class SddDataAlignmentError extends Error {
 }
 export function selectRandomSddSkillName(random = Math.random) {
     const index = Math.min(SDD_SKILL_NAMES.length - 1, Math.max(0, Math.floor(random() * SDD_SKILL_NAMES.length)));
-    return SDD_SKILL_NAMES[index];
+    return SDD_SKILL_NAMES[index] ?? "";
 }
 export function normalizeSddSkillName(value, random = Math.random) {
     if (value !== undefined && typeof value !== "string") {

package/dist/worker/console/chat/session-mode-view.js

@@ -27,21 +27,22 @@ export const SESSION_MODE_COPY = {
         description: "保留压缩与 Explore，直接协作编码",
         createLabel: "新建 Pi 会话",
         bannerTitle: "Pi",
-        bannerBody: "保留 Console 压缩与 Explore，直接协作编码。不注入工作流业务指令、业务工具或 Goal 驱动。",
+        bannerBody: "保留 Console 压缩、Explore 与持续目标，直接协作编码。不注入工作流业务指令与业务工具。",
         landingTitle: "开始一段 Pi 协作",
-        landingBody: "Pi 模式保留压缩、Explore、认证与 SDD 接入，取消工作流业务注入。适合有人监督的直接编码与调试。",
+        landingBody: "Pi 模式保留压缩、Explore、持续目标、认证与 SDD 接入，取消工作流业务注入。适合有人监督的直接编码与调试。",
         emptyTitle: "直接协作编码",
         emptyBody: "会话已就绪。输入框上方可切换工作区或模式。使用 Pi 工具读写仓库；Explore 负责只读深挖。本会话不加载任务 / DAG 工作流工具。",
     },
 };
 /** Slash actions that only exist in workflow sessions. Browser-safe: pure
- *  string constants, no runtime/tool policy imports. */
+ *  string constants, no runtime/tool policy imports. `/goal` was moved to
+ *  shared on 2026-09-10 (exec-plan 2026-09-10-console-chat-goal-for-pi-mode);
+ *  interview/panel navigation remain workflow-only. */
 export const WORKFLOW_EXCLUSIVE_SLASH_ACTIONS = Object.freeze([
     "focus-panel:task",
     "focus-panel:contract",
     "focus-panel:dag",
     "focus:interview",
-    "goal",
 ]);
 export function isWorkflowExclusiveSlashAction(action) {
     return WORKFLOW_EXCLUSIVE_SLASH_ACTIONS.includes(action);

package/dist/worker/console/chat/session-mode.js

@@ -74,7 +74,9 @@ export const PI_CHAT_SYSTEM_PROMPT_BASE = [
     "Use read/write/edit/bash/grep/find/ls to inspect and change the workspace. apply_patch, full-tools, shell and coding-chat are denied.",
     "Agent (Explore) is a built-in read-only subagent for path-uncertain codebase search. Do not use it for a known single-file read. Prefer safe-read/safe-grep for secret-safe probes.",
     "ask_user_question pauses for a real user answer. todo_write tracks the current work and is restored after compression; it is not a workflow auto-continue signal. The persistent terminal tool is available.",
-    "This session keeps Console compression (L0/L1/L2, sift, strict checkpoint) and existing Aimax / SDD access. Do not create tasks, run DAGs, drive Goals, or start requirement interviews from this session.",
+    "Browser tools (navigate/search/snapshot/act/tabs/scroll/press/dialog/wait/screenshot) drive the workspace-controlled real browser shown in the Browser panel. Use refs from the latest page inspection for element actions; they never edit workspace files or execute page scripts. browser_snapshot means browser page inspection, not workspace snapshots.",
+    "Goal tools (get_goal / create_goal / update_goal) track the session's durable cross-turn objective. Create a Goal only when the user explicitly asks to start one; iterate in bounded rounds until complete or blocked.",
+    "This session keeps Console compression (L0/L1/L2, sift, strict checkpoint) and existing Aimax / SDD access. Do not create tasks, run DAGs, or start requirement interviews from this session.",
     "Obey repository AGENTS.md, skills and extensions when they apply. Choosing Pi mode is not extra write authorization and does not bypass Console access control or output scrubbing.",
 ].join("\n");
 export const CHAT_SAFE_EXPLORE_TOOL_IDS = Object.freeze([
@@ -87,7 +89,11 @@ export const PI_CHAT_GENERIC_HELPER_TOOLS = Object.freeze([
     "ask_user_question",
     "todo_write",
 ]);
-export const PI_CHAT_WORKFLOW_TOOL_IDS = Object.freeze([
+/** Durable cross-turn Goal tools. Shared by both session modes since
+ *  2026-09-10 (exec-plan 2026-09-10-console-chat-goal-for-pi-mode); they are
+ *  NOT workflow business tools and are registered whenever a GoalRegistry
+ *  is present. */
+export const GOAL_TOOL_IDS = Object.freeze([
     "get_goal",
     "create_goal",
     "update_goal",
@@ -102,7 +108,6 @@ const CHAT_EXTENSION_DENIED_TOOL_IDS = new Set([
     "shell",
 ].map((name) => name.toLowerCase()));
 const WORKFLOW_OPERATOR_TOOL_IDS = new Set(OPERATOR_CHAT_ALLOWED_TOOLS.map((name) => name.toLowerCase()));
-const PI_GOAL_TOOL_IDS = new Set(PI_CHAT_WORKFLOW_TOOL_IDS.map((name) => name.toLowerCase()));
 export function workflowActiveToolBaseline() {
     return [
         ...OPERATOR_CHAT_ALLOWED_TOOLS,
@@ -117,6 +122,7 @@ export function piActiveToolBaseline() {
         ...CHAT_SAFE_EXPLORE_TOOL_IDS,
         ...OPERATOR_CHAT_BUILTIN_CUSTOM_TOOLS,
         ...PI_CHAT_GENERIC_HELPER_TOOLS,
+        ...GOAL_TOOL_IDS,
     ];
 }
 export function chatActiveToolBaseline(sessionMode) {
@@ -126,10 +132,13 @@ export function chatActiveToolBaseline(sessionMode) {
 }
 /**
  * Gate 2 pin: mode baseline plus user/project extension tools. Pi mode must
- * not re-add operator actions or Goal tools via the extras pass.
+ * not re-add operator actions via the extras pass (Goal tools are shared and
+ * part of the Pi baseline since 2026-09-10).
  */
-export function computeChatActiveToolNames(session, sessionMode) {
-    const baseline = chatActiveToolBaseline(sessionMode);
+export function computeChatActiveToolNames(session, sessionMode, exposedWorkflowTools) {
+    const exposure = sessionMode === "workflow" && exposedWorkflowTools
+        ? new Set(exposedWorkflowTools.map(name => name.toLowerCase())) : undefined;
+    const baseline = chatActiveToolBaseline(sessionMode).filter(name => !exposure || !WORKFLOW_OPERATOR_TOOL_IDS.has(name.toLowerCase()) || exposure.has(name.toLowerCase()));
     if (!session?.getAllTools)
         return baseline;
     const baselineLower = new Set(baseline.map((name) => name.toLowerCase()));
@@ -141,11 +150,11 @@ export function computeChatActiveToolNames(session, sessionMode) {
         const lower = name.toLowerCase();
         if (baselineLower.has(lower))
             continue;
-        if (CHAT_EXTENSION_DENIED_TOOL_IDS.has(lower))
+        if (CHAT_EXTENSION_DENIED_TOOL_IDS.has(lower) || isOperatorChatToolDenied(name))
             continue;
         if (sessionMode === "pi" && WORKFLOW_OPERATOR_TOOL_IDS.has(lower))
             continue;
-        if (sessionMode === "pi" && PI_GOAL_TOOL_IDS.has(lower))
+        if (exposure && WORKFLOW_OPERATOR_TOOL_IDS.has(lower) && !exposure.has(lower))
             continue;
         extras.push(name);
     }
@@ -172,7 +181,7 @@ export function authorizeChatSessionTool(toolId, sessionMode) {
         };
     }
     const lower = id.toLowerCase();
-    if (WORKFLOW_OPERATOR_TOOL_IDS.has(lower) || PI_GOAL_TOOL_IDS.has(lower)) {
+    if (WORKFLOW_OPERATOR_TOOL_IDS.has(lower)) {
         return {
             ok: false,
             code: "tool-denied",
@@ -207,9 +216,6 @@ export { WORKFLOW_EXCLUSIVE_SLASH_ACTIONS, isWorkflowExclusiveSlashAction, } fro
 export function shouldLoadWorkflowBusinessTools(sessionMode) {
     return sessionMode === "workflow";
 }
-export function shouldInjectGoalContinuation(sessionMode) {
-    return sessionMode === "workflow";
-}
 export function shouldAcceptOperatorSnapshot(sessionMode) {
     return sessionMode === "workflow";
 }

package/dist/worker/console/chat/session-store.js

@@ -477,6 +477,24 @@ export class ChatSessionStore {
             };
         });
     }
+    /** Idempotent persistent delivery, serialized with normal Chat updates. */
+    async appendScheduledGoalResult(sessionId, resultKey, text) {
+        if (!/^[a-zA-Z0-9_-]+$/.test(sessionId) || !/^[a-f0-9]{64}$/.test(resultKey))
+            throw new Error("invalid scheduled goal delivery identity");
+        return this.serialize(sessionId, async () => {
+            const record = await this.get(sessionId);
+            if (!record)
+                return false;
+            const id = `scheduled-goal-${resultKey}`;
+            if (record.messages.some((message) => message.id === id))
+                return true;
+            const at = new Date().toISOString();
+            record.messages.push({ id, role: "assistant", text, at });
+            record.updatedAt = at;
+            await this.persist(record);
+            return true;
+        });
+    }
     async appendMessage(sessionId, message) {
         return this.serialize(sessionId, async () => {
             const record = await this.get(sessionId);
@@ -637,21 +655,36 @@ export async function runChatTurn(options) {
             // never observes agent_settled before its accepted operation ref.
             settledEvent = event;
         }
+        else if (event.type === "message_end") {
+            // Persist the assistant bubble FIRST so the SSE frame and the restore
+            // projection share the same durable message id (2026-09-13). The text-
+            // match + 30s window in projectStoredMessagesWithEventOrder was the only
+            // bridge left between the two, and it mis-aligned on duplicate text.
+            let messageId;
+            try {
+                const stored = await store.appendMessage(sessionId, {
+                    role: "assistant",
+                    text: event.text,
+                    ...(event.content && event.content.length > 0
+                        ? { content: event.content }
+                        : {}),
+                });
+                messageId = stored.id;
+            }
+            catch {
+                // Persistence failure must not swallow the SSE frame — the client
+                // still needs the terminal text even if the durable row is absent.
+            }
+            options.onEvent?.(messageId ? { ...event, messageId } : event);
+        }
         else {
             options.onEvent?.(event);
         }
         switch (event.type) {
             case "message_update":
             case "message_end":
-                if (event.type === "message_end") {
-                    pending.push(store.appendMessage(sessionId, {
-                        role: "assistant",
-                        text: event.text,
-                        ...(event.content && event.content.length > 0
-                            ? { content: event.content }
-                            : {}),
-                    }));
-                }
+                // message_update carries no durable row; message_end was already
+                // persisted + framed above. Nothing further to persist here.
                 break;
             case "tool_call":
                 // Forwarded to the caller (SSE) for UI feedback. The actual tool