@tea-agent/loop-agent 0.43.0-next.9 → 0.44.0-next.1

package/dist/worker/console/chat/pi-runtime.js

@@ -26,28 +26,41 @@
  * `createDefaultPiSdkBindings()`.
  */
 import { createHash, randomBytes } from "node:crypto";
-import { access, mkdir, rm, stat, writeFile } from "node:fs/promises";
+import { stat } from "node:fs/promises";
 import path from "node:path";
 import { extractAssistantContentBlocks, extractAssistantText, isAssistantSdkMessage, } from "./assistant-content.js";
 import { parseProviderError, } from "./provider-error.js";
 import { projectCompactSnapshot, } from "./chat-event-store.js";
 import { extractUsageSample } from "./usage.js";
 import { OPERATOR_CHAT_ALLOWED_TOOLS, authorizeOperatorChatTool, assertNoWriteToolInList, } from "./tools.js";
-import { authorizeChatSessionTool, DEFAULT_CONSOLE_CHAT_SESSION_MODE, PI_TODO_WRITE_DESCRIPTION, chatActiveToolBaseline, composeChatSystemPrompt, composeChatSystemPromptParts, computeChatActiveToolNames, shouldInjectGoalContinuation, shouldLoadWorkflowBusinessTools, } from "./session-mode.js";
+import { authorizeChatSessionTool, DEFAULT_CONSOLE_CHAT_SESSION_MODE, chatActiveToolBaseline, composeChatSystemPrompt, composeChatSystemPromptParts, computeChatActiveToolNames, shouldLoadWorkflowBusinessTools, } from "./session-mode.js";
 import { buildAgentCustomTool, ExploreOrchestrator, } from "./subagents/index.js";
 import { createOperatorChatResourceLoader, } from "./resource-loader.js";
-import { applySkillAutoInvocationPreferences, isAutoInvocationEnabled, loadResourcePreferences, skillResourceId, } from "./resource-preferences-store.js";
-import { buildModelCallableToolSchemas } from "./tool-adapter.js";
+import { applySkillAutoInvocationPreferences, loadResourcePreferences, } from "./resource-preferences-store.js";
+import { buildPiModeLoopIsolationOptions } from "./pi-mode-loop-isolation.js";
+import { applyProcessRetryOverride, } from "../../../shared/pi-retry-settings.js";
 import { applyProcessCompactionOverride, createCompactionController, createContextPressureExtension, createSiftBridgeState, housekeepSiftStash, isConsoleSiftEnabled, parseCompactionPolicy, parseSiftBridgeConfig, projectPromptPressure, deriveEffectiveWindow, projectSafeTelemetry, emptyContextPressureCounters, } from "../../../shared/pi-context-pressure/index.js";
 import { incrementCounter as incrementPressureCounter } from "../../../shared/pi-context-pressure/telemetry.js";
 import { resolveDefaultChatModel, resolveLowChatModel, } from "./model-resolver.js";
 import { filterActiveInterviewTools } from "../interview/tools.js";
-import { RUNTIME_CONTEXT_TEXT_MAX, redactRuntimeText, } from "./runtime-context.js";
+import { redactRuntimeText } from "./runtime-context.js";
+import { BrowserAutomationService } from "./browser-automation.js";
 import { buildTodoContinuationContext, } from "./todos.js";
 import { buildPersistentTerminalTools } from "./terminal-tools.js";
 import { buildScmTools } from "./scm-tools.js";
 import { buildGoalContinuationContext, } from "./goals.js";
 import { injectWizardLocalHeaders, } from "./sdd-data-alignment.js";
+import { buildScheduledGoalTools } from "./pi-runtime/custom-tools/scheduled-goal-tools.js";
+import { WorkflowToolExposure, configuredToolExposure, isScheduledBookingTurn, pinScheduledBookingTurnTools, } from "./pi-runtime/progressive-tools.js";
+import { buildCustomOperatorTools } from "./pi-runtime/custom-tools/operator-tools.js";
+import { buildBrowserTools } from "./pi-runtime/custom-tools/browser-tools.js";
+import { buildAskUserQuestionTool } from "./pi-runtime/custom-tools/ask-user-question.js";
+import { buildTodoWriteTool } from "./pi-runtime/custom-tools/todo-write.js";
+import { buildGoalTools } from "./pi-runtime/custom-tools/goal-tools.js";
+import { buildExploreCustomTools } from "./pi-runtime/custom-tools/explore-tools.js";
+import { THINKING_LEVELS, RuntimeSnapshotUnavailableError, } from "./pi-runtime/inspection-types.js";
+import { collectRuntimeInventories, collectSlashCommands, projectRuntimeSnapshot, } from "./pi-runtime/inspection.js";
+import { createDefaultPiSdkBindings, safeGetAgentDir, } from "./pi-runtime/sdk-bindings.js";
 /**
  * Base system prompt fragment every General Operator Chat session receives.
  *
@@ -70,13 +83,14 @@ import { injectWizardLocalHeaders, } from "./sdd-data-alignment.js";
  */
 export const OPERATOR_CHAT_SYSTEM_PROMPT_BASE = [
     "You are General Operator Chat.",
-    "Use operator tools first (dagReport, dagRerunPlan, dagRerun). Pi read/write/edit/bash/grep/find/ls are available; obey repository AGENTS.md. apply_patch, full-tools, shell and coding-chat are denied. Prefer safe-read/safe-grep for probes.",
+    "For workflow requests use operator tools; discover missing capabilities via operatorCapabilities(target). Obey AGENTS.md. Deny apply_patch/full-tools/shell/coding-chat; probe with safe-read/safe-grep. Browser_*: visible Browser panel only (static http(s), no workspace edits/scripts).",
     "No harness and asked to init: `loop-agent init instructions --repo-root .`, then `loop-agent init --repo-root . --profile full --merge`; verify with doctor, inspect and docs audit. Updates: `loop-agent init upgrade --repo-root . --json` until stable; `loop-agent init check-update` is read-only.",
+    "Scheduled intent takes precedence over task content: prepareScheduledTask first; no curl/HTTP probes or tests; never perform the scheduled work now. Only a planned goalId means booked; never self-confirm.",
     "Long DAGs: prepareDagExecution → runDag → operationId. Never foreground-Bash task advance, tail/head pipes or nohup/Start-Process/start; do not end on accepted/queued/running or an operationId — NOT completion. Supervise operationGet/status/dagReport/dagDoctor/operationWait at 60s → 90s → 120s → 180s; reset to 60s on state change; 30-60s re-checks when stall suspected. operationWait MUST use afterSeq=previous nextSeq (recommendedNextCall). Heartbeats: not meaningful progress. Run id ≠ task id.",
-    "Failure: terminal runSummary first. With progress wait; else dagRerunPlan(fromNode=primaryFailure.nodeId); eligible → dagRerun: reruns the failed subgraph, keeps prior successes. Ineligible: Worker → workerTaskRetry; standalone → standaloneTaskRerun after contract adopt (regenerates the whole task, not node continue). Do not call dagResume; do not re-advance a run-failed task. Pre-run identical state twice: stop and report; never loop identical bash/read/grep. Approve only bounded writeSet inside allowedPaths, outside forbiddenPaths, with structured verification.",
-    "Iterate toward the goal in bounded rounds: first summarize the previous round's error in one line, fix its root cause — not the symptom — then rerun the failed node with a fresh plan. Never resubmit an unchanged fix; after two rounds failing the same way, stop and report evidence and remaining routes.",
-    "Continue until success, user stop, or no safe recovery remains; then stop and report failure/evidence. Never create a new task for a transient failure or replace repair-pi with direct edits.",
-    "Narrate long-DAG progress briefly at start, meaningful phase changes/findings, verification failure/recovery, prolonged quiet and terminal state: say what finished and what is next. Never narrate unchanged operationWait polls or heartbeats, or claim beyond structured facts.",
+    "Failure: dagReport(runId) → terminal runSummary. With progress wait; else dagRerunPlan(fromNode=primaryFailure.nodeId); eligible → dagRerun: reruns the failed subgraph, keeps prior successes. Ineligible: Worker → workerTaskRetry; standalone → standaloneTaskRerun after contract adopt (regenerates the whole task, not node continue). No dagResume or re-advance of run-failed tasks. Pre-run identical state twice: stop and report; never loop identical bash/read/grep. Approve only bounded writeSet inside allowedPaths, outside forbiddenPaths, with structured verification.",
+    "Each bounded round: summarize the previous round's error in one line, fix its root cause — not the symptom — then rerun the failed node with a fresh plan. Never resubmit an unchanged fix; after two rounds failing the same way, stop and report evidence and remaining routes.",
+    "Continue until success, user stop, or no safe recovery remains. Never create a new task for a transient failure or replace repair-pi with direct edits.",
+    "Report start, meaningful phase changes, failures, prolonged quiet and completion: what finished and what is next. Never narrate unchanged operationWait polls or heartbeats.",
 ].join("\n");
 /**
  * Built-in SDK tool names registered for every Chat session (ADR 0011).
@@ -278,595 +292,8 @@ export function createWizardLocalHeadersExtension(options) {
         },
     };
 }
-/**
- * Build Pi custom ToolDefinition objects for every whitelisted operator action.
- * Each tool's execute() routes into the operator action dispatcher (Gate 3).
- * Requires the `typebox` + `defineTool` packages (both bundled with the SDK).
- */
-async function buildCustomOperatorTools(options) {
-    // typebox is a transitive dep of @earendil-works/pi-coding-agent; Node's
-    // resolver hoists to the SDK's nested copy. defineTool is re-exported by SDK.
-    const [{ Type }, { defineTool }] = await Promise.all([
-        import("typebox"),
-        import("@earendil-works/pi-coding-agent"),
-    ]);
-    const schemas = buildModelCallableToolSchemas();
-    const ctx = options.actionContext;
-    return schemas.map((schema) => {
-        // TypeBox schema is built dynamically; cast through unknown to the builder
-        // since Static<TParams> is structural and cannot be statically inferred here.
-        const parameters = Type.Object(schema.inputParams.reduce((acc, param) => {
-            // Carry the registry's param description into the tool schema so
-            // the model sees parameter semantics, not just names/types.
-            const desc = param.description?.trim()
-                ? { description: param.description }
-                : {};
-            let t;
-            switch (param.type) {
-                case "string":
-                    t = Type.String(desc);
-                    break;
-                case "boolean":
-                    t = Type.Boolean(desc);
-                    break;
-                case "number":
-                    t = Type.Number(desc);
-                    break;
-                case "array":
-                    t = Type.Array(Type.String({}), Object.keys(desc).length ? desc : {});
-                    break;
-                default:
-                    t = Type.Object({}, { additionalProperties: true });
-            }
-            acc[param.name] = param.required ? t : Type.Optional(t);
-            return acc;
-        }, {}), { additionalProperties: false });
-        return defineTool({
-            name: schema.toolId,
-            label: schema.toolId,
-            description: `${schema.description} (kind=${schema.kind}; cli: ${schema.cli})`,
-            promptSnippet: schema.description,
-            parameters: parameters,
-            async execute(toolCallId, params) {
-                const decision = authorizeChatSessionTool(schema.toolId, options.sessionMode ?? DEFAULT_CONSOLE_CHAT_SESSION_MODE);
-                if (!decision.ok) {
-                    return {
-                        content: [
-                            {
-                                type: "text",
-                                text: JSON.stringify({
-                                    error: decision.message,
-                                    code: decision.code,
-                                }),
-                            },
-                        ],
-                        details: { error: decision.message, code: decision.code },
-                    };
-                }
-                // Defer require to avoid circular import at module load.
-                const { dispatchChatToolCall } = await import("./session-store.js");
-                const result = await dispatchChatToolCall(ctx, decision.toolId, params, toolCallId, options.sessionMode);
-                const payload = result.ok
-                    ? result.result
-                    : { error: result.message, code: result.errorCode };
-                return {
-                    content: [{ type: "text", text: JSON.stringify(payload) }],
-                    details: payload,
-                };
-            },
-        });
-    });
-}
-const ASK_USER_QUESTION_DESCRIPTION = "Ask the user concise questions when a confirmation, choice, or missing detail is required before proceeding. " +
-    "The tool pauses until the user answers. Use it instead of writing questions as ordinary assistant text. " +
-    "Send one or more questions with stable ids; recommended options should be first and end with (Recommended).";
-async function buildAskUserQuestionTool(options) {
-    const [{ Type }, { defineTool }] = await Promise.all([
-        import("typebox"),
-        import("@earendil-works/pi-coding-agent"),
-    ]);
-    return defineTool({
-        name: "ask_user_question",
-        label: "Ask user",
-        description: ASK_USER_QUESTION_DESCRIPTION,
-        promptSnippet: ASK_USER_QUESTION_DESCRIPTION,
-        parameters: Type.Object({
-            questions: Type.Array(Type.Object({
-                id: Type.String({ description: "Stable question id echoed in the answer." }),
-                question: Type.String({ description: "Specific user-facing question." }),
-                header: Type.Optional(Type.String({ description: "Optional short heading." })),
-                detail: Type.Optional(Type.String({ description: "Optional Markdown context shown below the question." })),
-                options: Type.Optional(Type.Array(Type.Object({
-                    label: Type.String({ description: "Short user-facing option label." }),
-                    description: Type.Optional(Type.String({ description: "One sentence explaining impact or tradeoff." })),
-                }, { additionalProperties: false }))),
-                multi_select: Type.Optional(Type.Boolean({ description: "Allow more than one option." })),
-            }, { additionalProperties: false }), { minItems: 1, maxItems: 20 }),
-        }, { additionalProperties: false }),
-        async execute(toolCallId, params, signal) {
-            const answer = await options.registry.ask({
-                sessionId: options.sessionId,
-                toolCallId,
-                questions: params.questions,
-                signal,
-            });
-            return {
-                content: [{ type: "text", text: JSON.stringify(answer) }],
-                details: answer,
-            };
-        },
-    });
-}
-const TODO_WRITE_DESCRIPTION = "Record and update a structured task list for the current work. Send the ENTIRE list every call — it REPLACES the previous list (no partial updates, no per-item edits). Before starting multi-step work, add one todo per concrete step. Keep at least one todo `in_progress` while work remains. Mark a todo `completed` immediately when it is done (do not batch completions) and resend the full list as progress or DAG state advances. Skip the list for simple Q&A, read-only lookups, and single-step tasks. Use it for multi-step implementation and whenever you prepare, run, or supervise a DAG — call `todo_write` before entering the DAG tool chain. Phrase DAG todos as user-facing phases users can understand, not copies of internal DAG nodes. Statuses: `pending` / `in_progress` / `completed`.";
-async function buildTodoWriteTool(options) {
-    const [{ Type }, { defineTool }] = await Promise.all([
-        import("typebox"),
-        import("@earendil-works/pi-coding-agent"),
-    ]);
-    const description = options.sessionMode === "pi"
-        ? PI_TODO_WRITE_DESCRIPTION
-        : TODO_WRITE_DESCRIPTION;
-    return defineTool({
-        name: "todo_write",
-        label: "Update todo list",
-        description,
-        promptSnippet: description,
-        parameters: Type.Object({
-            todos: Type.Array(Type.Object({
-                content: Type.String({ description: "Short imperative task description." }),
-                status: Type.Union([
-                    Type.Literal("pending"),
-                    Type.Literal("in_progress"),
-                    Type.Literal("completed"),
-                ]),
-            }, { additionalProperties: false })),
-        }, { additionalProperties: false }),
-        async execute(toolCallId, params) {
-            const result = options.registry.write(options.sessionId, toolCallId, params.todos);
-            return {
-                content: [{ type: "text", text: JSON.stringify(result) }],
-                details: result,
-            };
-        },
-    });
-}
-const GET_GOAL_DESCRIPTION = "Read the current session's durable cross-turn Goal, including revision, status, round limit, and whether this Console process is authorized to continue it.";
-const CREATE_GOAL_DESCRIPTION = "Create a durable cross-turn Goal only when the user explicitly asks to start or create a Goal. Never silently upgrade an ordinary request. A session may have only one unfinished Goal.";
-const UPDATE_GOAL_DESCRIPTION = "Finish or block the current durable Goal using its exact goalId and revision. Set complete only when the objective is genuinely achieved and no required work remains. Set blocked only when safe progress cannot continue; include the blocker.";
-async function buildGoalTools(options) {
-    const [{ Type }, { defineTool }] = await Promise.all([
-        import("typebox"),
-        import("@earendil-works/pi-coding-agent"),
-    ]);
-    const textResult = (value) => ({
-        content: [{ type: "text", text: JSON.stringify(value) }],
-        details: value,
-    });
-    return [
-        defineTool({
-            name: "get_goal",
-            label: "Get goal",
-            description: GET_GOAL_DESCRIPTION,
-            promptSnippet: GET_GOAL_DESCRIPTION,
-            parameters: Type.Object({}, { additionalProperties: false }),
-            async execute() {
-                return textResult({ goal: options.registry.get(options.sessionId) });
-            },
-        }),
-        defineTool({
-            name: "create_goal",
-            label: "Create goal",
-            description: CREATE_GOAL_DESCRIPTION,
-            promptSnippet: CREATE_GOAL_DESCRIPTION,
-            parameters: Type.Object({
-                objective: Type.String({
-                    description: "Concrete final objective and completion standard explicitly requested by the user.",
-                }),
-            }, { additionalProperties: false }),
-            async execute(_toolCallId, params) {
-                if (!options.registry.consumeModelCreateGrant(options.sessionId)) {
-                    return textResult({
-                        ok: false,
-                        code: "GOAL_EXPLICIT_REQUEST_REQUIRED",
-                        message: "create_goal requires an explicit user request to create or start a Goal",
-                    });
-                }
-                return textResult(options.registry.create({
-                    sessionId: options.sessionId,
-                    objective: params.objective,
-                }));
-            },
-        }),
-        defineTool({
-            name: "update_goal",
-            label: "Update goal",
-            description: UPDATE_GOAL_DESCRIPTION,
-            promptSnippet: UPDATE_GOAL_DESCRIPTION,
-            parameters: Type.Object({
-                goalId: Type.String(),
-                revision: Type.Number({ minimum: 1 }),
-                status: Type.Union([
-                    Type.Literal("complete"),
-                    Type.Literal("blocked"),
-                ]),
-                blocker: Type.Optional(Type.String()),
-            }, { additionalProperties: false }),
-            async execute(_toolCallId, params) {
-                return textResult(options.registry.update({
-                    sessionId: options.sessionId,
-                    goalId: params.goalId,
-                    expectedRevision: params.revision,
-                    phase: params.status,
-                    blocker: params.blocker,
-                    arm: false,
-                }));
-            },
-        }),
-    ];
-}
-/**
- * Build the safe explore custom tools (roadmap M0-A / G16): safe-read,
- * safe-grep, gitStatus, gitDiff. These replace the bare SDK bash/read/grep so
- * the model can probe the repo WITHOUT write escapes (echo redirect, tee,
- * sed -i, node -e) and WITHOUT reading sensitive files (env files, key/pem,
- * auth.json, sessions dir) — and every returned byte is secret-scrubbed
- * before reaching the model context.
- *
- * gitStatus/gitDiff use a FIXED argv (typed, no shell) so they cannot be
- * turned into an arbitrary-shell vector.
- */
-async function buildExploreCustomTools(options) {
-    const [{ Type }, { defineTool }] = await Promise.all([
-        import("typebox"),
-        import("@earendil-works/pi-coding-agent"),
-    ]);
-    const { execFileSync } = await import("node:child_process");
-    const repoRoot = options.repoRoot;
-    const { safeReadFile, safeGrep, scrubSecrets } = await import("./explore-tools.js");
-    function safeGit(args) {
-        try {
-            const stdout = execFileSync("git", args, {
-                cwd: repoRoot,
-                encoding: "utf8",
-                // Fixed argv, no shell, bounded output.
-                maxBuffer: 512 * 1024,
-                timeout: 10_000,
-                windowsHide: true,
-            });
-            return { ok: true, stdout };
-        }
-        catch (e) {
-            return {
-                ok: false,
-                code: "GIT_FAILED",
-                message: e instanceof Error ? e.message : String(e),
-            };
-        }
-    }
-    const safeReadTool = defineTool({
-        name: "safe-read",
-        label: "safe-read",
-        description: "Read a repo-relative file with sensitive-file denylist (.env*/*.key/*.pem/.git/**/auth.json/sessions/**) and secret scrubbing. Absolute paths and .. are rejected.",
-        promptSnippet: "safe-read: read a repo file (safe; secrets scrubbed)",
-        parameters: Type.Object({
-            path: Type.String({ description: "repo-relative file path" }),
-        }, { additionalProperties: false }),
-        async execute(_toolCallId, params) {
-            const raw = String(params.path ?? "");
-            try {
-                const result = await safeReadFile(repoRoot, raw);
-                return {
-                    content: [{ type: "text", text: JSON.stringify(result) }],
-                    details: result,
-                };
-            }
-            catch (e) {
-                const err = e;
-                return {
-                    content: [
-                        {
-                            type: "text",
-                            text: JSON.stringify({
-                                error: err.message ?? String(e),
-                                code: err.code ?? "READ_FAILED",
-                            }),
-                        },
-                    ],
-                    details: {
-                        error: err.message ?? String(e),
-                        code: err.code ?? "READ_FAILED",
-                    },
-                };
-            }
-        },
-    });
-    const safeGrepTool = defineTool({
-        name: "safe-grep",
-        label: "safe-grep",
-        description: "Line search across the repo working tree with sensitive-file denylist and secret scrubbing. pattern is a JS regex source; optional glob filters paths.",
-        promptSnippet: "safe-grep: search repo files (safe; secrets scrubbed)",
-        parameters: Type.Object({
-            pattern: Type.String({ description: "regex source (no shell)" }),
-            caseInsensitive: Type.Optional(Type.Boolean()),
-            glob: Type.Optional(Type.String({ description: "optional glob filter e.g. *.ts" })),
-        }, { additionalProperties: false }),
-        async execute(_toolCallId, params) {
-            try {
-                const result = await safeGrep(repoRoot, String(params.pattern ?? ""), {
-                    caseInsensitive: Boolean(params.caseInsensitive),
-                    glob: params.glob ? String(params.glob) : undefined,
-                });
-                return {
-                    content: [{ type: "text", text: JSON.stringify(result) }],
-                    details: result,
-                };
-            }
-            catch (e) {
-                const err = e;
-                return {
-                    content: [
-                        {
-                            type: "text",
-                            text: JSON.stringify({
-                                error: err.message ?? String(e),
-                                code: err.code ?? "GREP_FAILED",
-                            }),
-                        },
-                    ],
-                    details: {
-                        error: err.message ?? String(e),
-                        code: err.code ?? "GREP_FAILED",
-                    },
-                };
-            }
-        },
-    });
-    const gitStatusTool = defineTool({
-        name: "git-status",
-        label: "git-status",
-        description: "Typed `git status --porcelain` (fixed argv, no shell). Returns scrubbed working-tree status.",
-        promptSnippet: "git-status: working tree status (read-only)",
-        parameters: Type.Object({}, { additionalProperties: false }),
-        async execute() {
-            const r = safeGit(["status", "--porcelain"]);
-            if (!r.ok) {
-                return {
-                    content: [
-                        {
-                            type: "text",
-                            text: JSON.stringify({ error: r.message, code: r.code }),
-                        },
-                    ],
-                    details: { error: r.message, code: r.code },
-                };
-            }
-            const { scrubbed, redactions } = scrubSecrets(r.stdout);
-            const payload = { status: scrubbed, redactions };
-            return {
-                content: [{ type: "text", text: JSON.stringify(payload) }],
-                details: payload,
-            };
-        },
-    });
-    const gitDiffTool = defineTool({
-        name: "git-diff",
-        label: "git-diff",
-        description: "Typed `git diff` (fixed argv: --stat or a single -- path; no shell). Returns scrubbed diff. path must be repo-relative and not sensitive.",
-        promptSnippet: "git-diff: diff (read-only, scrubbed)",
-        parameters: Type.Object({
-            path: Type.Optional(Type.String({
-                description: "optional repo-relative path to diff (default: whole tree --stat)",
-            })),
-        }, { additionalProperties: false }),
-        async execute(_toolCallId, params) {
-            let rawPath = params.path ? String(params.path) : undefined;
-            // If a path is supplied, validate it via the read-path guard so git diff
-            // cannot be aimed at sensitive files (.env* / auth.json / sessions).
-            if (rawPath) {
-                const { guardReadPath } = await import("./explore-tools.js");
-                const g = await guardReadPath(repoRoot, rawPath);
-                if (!g.ok) {
-                    return {
-                        content: [
-                            {
-                                type: "text",
-                                text: JSON.stringify({ error: g.message, code: g.code }),
-                            },
-                        ],
-                        details: { error: g.message, code: g.code },
-                    };
-                }
-                rawPath = g.repoRelative;
-            }
-            const args = rawPath ? ["diff", "--", rawPath] : ["diff", "--stat"];
-            const r = safeGit(args);
-            if (!r.ok) {
-                return {
-                    content: [
-                        {
-                            type: "text",
-                            text: JSON.stringify({ error: r.message, code: r.code }),
-                        },
-                    ],
-                    details: { error: r.message, code: r.code },
-                };
-            }
-            const { scrubbed, redactions } = scrubSecrets(r.stdout);
-            const payload = { diff: scrubbed, redactions };
-            return {
-                content: [{ type: "text", text: JSON.stringify(payload) }],
-                details: payload,
-            };
-        },
-    });
-    return [safeReadTool, safeGrepTool, gitStatusTool, gitDiffTool];
-}
-export const THINKING_LEVELS = [
-    "off",
-    "minimal",
-    "low",
-    "medium",
-    "high",
-    "xhigh",
-    "max",
-];
-/**
- * Structured critical-failure error for snapshot projection (RF-02). Model
- * enumeration or system prompt projection failures throw this so consuming
- * routes can return 503 PI_RUNTIME_UNAVAILABLE instead of a fake-empty 200.
- * Partial ResourceLoader / package-inventory failures are NOT critical — they
- * keep the 200 snapshot and surface as structured diagnostics instead.
- */
-export class RuntimeSnapshotUnavailableError extends Error {
-    code = "PI_RUNTIME_UNAVAILABLE";
-    constructor(message) {
-        super(message);
-        this.name = "RuntimeSnapshotUnavailableError";
-    }
-}
-/**
- * Browser-safe projection of a live runtime snapshot (design §2.2 / RF-03).
- *
- * Every browser-visible string runs the shared secret-scrub chain
- * (scrubSecrets + ghp_/Bearer redaction via redactRuntimeText) and a fixed
- * per-field length limit: 200 (names/spec/source/origin), 400 (paths/errors/
- * diagnostic messages), 600 (skill descriptions), 80 (package versions);
- * truncation uses the fixed `…[truncated N chars …]` marker. The server-only
- * `raw` prompt and the RAW-based `sha256`/`characters` pass through untouched,
- * and real empty lists stay empty.
- *
- * Pure + deterministic and exported so the route harness reuses the exact
- * production implementation (same code path as getRuntimeSnapshot).
- */
-export function projectRuntimeSnapshot(input) {
-    const field = (value, max) => value === undefined ? undefined : redactRuntimeText(value, max);
-    const projectSkill = (skill) => ({
-        name: field(skill.name, 200) ?? "",
-        description: field(skill.description, 600) ?? "",
-        path: field(skill.path, 400) ?? "",
-        ...(skill.baseDir ? { baseDir: field(skill.baseDir, 400) } : {}),
-        scope: skill.scope,
-        source: field(skill.source, 200) ?? "",
-        resourceId: field(skill.resourceId, 200) ?? "",
-        autoInvocationEnabled: skill.autoInvocationEnabled,
-        diagnostics: skill.diagnostics.map((diag) => field(diag, 400) ?? ""),
-    });
-    const projectExtension = (ext) => ({
-        name: field(ext.name, 200) ?? "",
-        path: field(ext.path, 400) ?? "",
-        ...(ext.resolvedPath
-            ? { resolvedPath: field(ext.resolvedPath, 400) }
-            : {}),
-        source: field(ext.source, 200) ?? "",
-        scope: ext.scope,
-        ...(ext.origin ? { origin: field(ext.origin, 200) } : {}),
-        enabled: ext.enabled,
-        ...(ext.error ? { error: field(ext.error, 400) } : {}),
-    });
-    const projectPackage = (pkg) => ({
-        spec: field(pkg.spec, 200) ?? "",
-        scope: pkg.scope,
-        enabled: pkg.enabled,
-        ...(pkg.version ? { version: field(pkg.version, 80) } : {}),
-        ...(pkg.configuredVersion
-            ? { configuredVersion: field(pkg.configuredVersion, 80) }
-            : {}),
-        ...(pkg.packageName ? { packageName: field(pkg.packageName, 200) } : {}),
-        ...(pkg.path ? { path: field(pkg.path, 400) } : {}),
-        ...(pkg.installedPath ? { installedPath: field(pkg.installedPath, 400) } : {}),
-        ...(pkg.cwd ? { cwd: field(pkg.cwd, 400) } : {}),
-        resolved: pkg.resolved.map((resource) => ({
-            type: resource.type,
-            name: field(resource.name, 200) ?? "",
-            path: field(resource.path, 400) ?? "",
-            source: field(resource.source, 200) ?? "",
-            scope: resource.scope,
-        })),
-        diagnostics: pkg.diagnostics.map((diag) => field(diag, 400) ?? ""),
-    });
-    const projectMcpTool = (tool) => ({
-        name: field(tool.name, 200) ?? "",
-        description: field(tool.description, 600) ?? "",
-        ...(tool.server ? { server: field(tool.server, 200) } : {}),
-        source: field(tool.source, 200) ?? "",
-        scope: tool.scope,
-        ...(tool.path ? { path: field(tool.path, 400) } : {}),
-        active: tool.active,
-    });
-    const projectMcp = (mcp) => ({
-        servers: mcp.servers.map((server) => ({
-            name: field(server.name, 200) ?? "",
-            scope: server.scope,
-            status: server.status,
-            enabled: server.enabled,
-            ...(server.transport ? { transport: field(server.transport, 80) } : {}),
-            ...(server.command ? { command: field(server.command, 400) } : {}),
-            ...(server.url ? { url: field(server.url, 400) } : {}),
-            ...(server.configPath ? { configPath: field(server.configPath, 400) } : {}),
-            tools: server.tools.map(projectMcpTool),
-        })),
-        unassignedTools: mcp.unassignedTools.map(projectMcpTool),
-    });
-    const projectDiagnostic = (diag) => ({
-        type: diag.type,
-        ...(diag.code ? { code: diag.code } : {}),
-        message: field(diag.message, 400) ?? "",
-        ...(diag.path ? { path: field(diag.path, 400) } : {}),
-        ...(diag.retryable !== undefined
-            ? { retryable: diag.retryable }
-            : {}),
-    });
-    return {
-        sessionId: input.sessionId,
-        revision: input.revision,
-        loadedAt: input.loadedAt,
-        selection: {
-            ...(input.selection.model
-                ? {
-                    model: {
-                        provider: input.selection.model.provider,
-                        id: input.selection.model.id,
-                        ...(input.selection.model.name
-                            ? { name: field(input.selection.model.name, 200) }
-                            : {}),
-                    },
-                }
-                : {}),
-            thinkingSelection: input.selection.thinkingSelection,
-            ...(input.selection.effectiveThinkingLevel
-                ? { effectiveThinkingLevel: input.selection.effectiveThinkingLevel }
-                : {}),
-        },
-        models: input.models.map((model) => ({
-            provider: model.provider,
-            id: model.id,
-            ...(model.name ? { name: field(model.name, 200) } : {}),
-            ...(model.hasCredentials !== undefined
-                ? { hasCredentials: model.hasCredentials }
-                : {}),
-        })),
-        thinkingLevels: input.thinkingLevels.map((option) => ({ ...option })),
-        systemPrompt: {
-            ...(input.systemPrompt.raw !== undefined
-                ? { raw: input.systemPrompt.raw }
-                : {}),
-            text: redactRuntimeText(input.systemPrompt.text, RUNTIME_CONTEXT_TEXT_MAX),
-            sha256: input.systemPrompt.sha256,
-            characters: input.systemPrompt.characters,
-        },
-        activeTools: [...input.activeTools],
-        contextFiles: input.contextFiles.map((file) => ({
-            path: field(file.path, 400) ?? "",
-            characters: file.characters,
-        })),
-        skills: input.skills.map(projectSkill),
-        extensions: input.extensions.map(projectExtension),
-        packages: input.packages.map(projectPackage),
-        mcp: projectMcp(input.mcp ?? { servers: [], unassignedTools: [] }),
-        diagnostics: input.diagnostics.map(projectDiagnostic),
-        hasBash: input.hasBash,
-    };
-}
+export { THINKING_LEVELS, RuntimeSnapshotUnavailableError, projectRuntimeSnapshot, };
+export { createDefaultPiSdkBindings } from "./pi-runtime/sdk-bindings.js";
 export { extractAssistantContentBlocks, extractAssistantText, isAssistantSdkMessage };
 function readSessionManagerId(manager) {
     if (!manager || typeof manager !== "object")
@@ -964,6 +391,7 @@ export class ConsolePiRuntime {
     /** Non-sensitive models.json metadata used to avoid reparsing unchanged config. */
     modelConfigFiles = new Map();
     sessionManagers = new Map();
+    toolExposures = new Map();
     /** Per-session SDK service scope (resourceLoader / settingsManager) used by the live runtime snapshot. */
     serviceScopes = new Map();
     /** Snapshot revision: bumped on create / reopen / model / thinking / reload. */
@@ -994,10 +422,18 @@ export class ConsolePiRuntime {
     exploreCustomToolsPromise;
     exploreOrchestrator;
     bindings;
+    browserAutomation;
+    ownsBrowserAutomation;
     constructor(options) {
         this.options = options;
         this.loader = createOperatorChatResourceLoader();
         this.bindings = options.bindings ?? createDefaultPiSdkBindings();
+        this.ownsBrowserAutomation = options.browserAutomation === undefined;
+        this.browserAutomation = options.browserAutomation ?? new BrowserAutomationService({
+            profileDir: path.join(this.options.sessionDir, "..", "browser-profile"),
+            downloadsDir: path.join(this.options.sessionDir, "..", "browser-downloads"),
+            screenshotsDir: path.join(this.options.sessionDir, "..", "browser-screenshots"),
+        });
         this.exploreOrchestrator = new ExploreOrchestrator({
             cwd: this.options.cwd,
             bindings: this.bindings,
@@ -1058,11 +494,10 @@ export class ConsolePiRuntime {
         this.sessionModes.set(sessionId, sessionMode);
         return sessionMode;
     }
-    async buildResourceLoaderOptions(base = {}, sessionId) {
+    async buildResourceLoaderOptions(base = {}, sessionId, sessionMode = DEFAULT_CONSOLE_CHAT_SESSION_MODE) {
         const inheritedFactories = Array.isArray(base.extensionFactories)
             ? base.extensionFactories
             : [];
-        const sessionMode = this.sessionModeOf(sessionId);
         const todoContextExtension = sessionId && this.options.todoRegistry
             ? createTodoCompactionContextExtension({
                 sessionId,
@@ -1072,9 +507,7 @@ export class ConsolePiRuntime {
         const pressureExtension = sessionId
             ? this.createContextPressureInlineExtension(sessionId)
             : undefined;
-        const goalContextExtension = sessionId &&
-            this.options.goalRegistry &&
-            shouldInjectGoalContinuation(sessionMode)
+        const goalContextExtension = sessionId && this.options.goalRegistry
             ? createGoalCompactionContextExtension({
                 sessionId,
                 registry: this.options.goalRegistry,
@@ -1092,6 +525,7 @@ export class ConsolePiRuntime {
             pressureExtension,
             wizardLocalHeadersExtension,
         ].filter((item) => Boolean(item));
+        const piMode = sessionMode === "pi";
         return {
             ...base,
             ...(extraFactories.length > 0
@@ -1099,18 +533,23 @@ export class ConsolePiRuntime {
                     extensionFactories: [...inheritedFactories, ...extraFactories],
                 }
                 : {}),
-            skillsOverride: (current) => {
+            ...buildPiModeLoopIsolationOptions({
+                enabled: piMode,
+                cwd: this.options.cwd,
                 // Synchronous override surface: use last-known prefs via a sync
                 // fail-closed path. Prefer async cache filled by ensurePrefs.
-                const prefs = this.cachedSkillPrefs ?? {
-                    schemaVersion: 1,
-                    skills: {},
-                };
-                return {
-                    skills: applySkillAutoInvocationPreferences(current.skills, prefs),
-                    diagnostics: current.diagnostics,
-                };
-            },
+                readPreferences: () => this.cachedSkillPrefs,
+                skillsOverride: (current) => {
+                    const prefs = this.cachedSkillPrefs ?? {
+                        schemaVersion: 1,
+                        skills: {},
+                    };
+                    return {
+                        skills: applySkillAutoInvocationPreferences(current.skills, prefs),
+                        diagnostics: current.diagnostics,
+                    };
+                },
+            }),
         };
     }
     /** Last successfully loaded skill prefs (sync override + snapshot projection). */
@@ -1160,9 +599,11 @@ export class ConsolePiRuntime {
             policy,
             controller: this.getCompactionController(sessionId),
             sift,
+            normalizeTransientProviderErrors: true,
         });
     }
-    applySessionCompactionOverride(sessionId, services, session) {
+    applySessionRecoveryOverrides(sessionId, services, session) {
+        applyProcessRetryOverride(services?.settingsManager);
         const manager = services?.settingsManager;
         const window = session?.getSessionStats?.()?.contextUsage?.contextWindow;
         applyProcessCompactionOverride(manager, {
@@ -1180,7 +621,7 @@ export class ConsolePiRuntime {
         const window = stats?.contextUsage?.contextWindow;
         const tokens = stats?.contextUsage?.tokens;
         if (typeof window === "number" && window > 0) {
-            this.applySessionCompactionOverride(sessionId, this.serviceScopes.get(sessionId) ?? {}, session);
+            this.applySessionRecoveryOverrides(sessionId, this.serviceScopes.get(sessionId) ?? {}, session);
         }
         const projection = projectPromptPressure({
             currentContextTokens: tokens,
@@ -1418,31 +859,36 @@ export class ConsolePiRuntime {
         this.sessionInit.set(sessionId, { status: "initializing", promise });
         return promise;
     }
-    async materializeSession(sessionId, init) {
-        if (this.disposedSessions.has(sessionId))
-            return;
-        await this.syncAimaxAuthToken();
-        const sessionMode = this.rememberSessionMode(sessionId, init.sessionMode ?? this.sessionModeOf(sessionId));
+    /**
+     * Shared session preparation for create/reopen/fork: config capture, prompt
+     * composition, resource loading, model resolution, tool assembly, SDK session
+     * create, extension bind, tool pin, compaction override. Lifecycle maps stay
+     * owned by the caller.
+     */
+    async prepareLiveSession(init) {
+        const aborted = () => Boolean(init.abortIfDisposed && this.disposedSessions.has(init.sessionId));
+        if (aborted())
+            return undefined;
+        if (init.sessionMode === "workflow" && this.options.actionContext) {
+            this.toolExposures.set(init.sessionId, new WorkflowToolExposure(init.sessionManager, this.options.toolExposure ?? configuredToolExposure(process.env.CONSOLE_CHAT_TOOL_EXPOSURE)));
+        }
         const agentDir = await safeGetAgentDir(this.bindings);
         // Capture before services parse models.json. A concurrent edit can therefore
         // cause at most one harmless extra refresh, never a missed next-turn refresh.
         const modelConfigFile = await captureModelConfigFile(agentDir);
         const appendSystemPrompt = composeChatSystemPromptParts({
-            sessionMode,
+            sessionMode: init.sessionMode,
             workflowPrompt: OPERATOR_CHAT_SYSTEM_PROMPT_BASE,
             systemPromptSuffix: init.systemPromptSuffix,
         });
-        // Single services construction for formal materialization (+ optional
-        // default-model resolve from the same modelRuntime). Repo-scoped skill
-        // auto-invocation prefs inject skillsOverride without touching SKILL.md.
         await this.refreshSkillPrefsCache().catch(() => undefined);
         const { services } = await this.bindings.createServices({
             cwd: this.options.cwd,
             agentDir,
-            resourceLoaderOptions: await this.buildResourceLoaderOptions({ appendSystemPrompt }, sessionId),
+            resourceLoaderOptions: await this.buildResourceLoaderOptions({ appendSystemPrompt }, init.sessionId, init.sessionMode),
         });
-        if (this.disposedSessions.has(sessionId))
-            return;
+        if (aborted())
+            return undefined;
         const modelRuntime = services.modelRuntime;
         let model = init.model;
         if (!model && init.resolveDefaultModel) {
@@ -1456,9 +902,9 @@ export class ConsolePiRuntime {
             }) ?? undefined)
             : undefined;
         assertNoWriteToolInList(OPERATOR_CHAT_ALLOWED_TOOLS);
-        const customTools = await this.loadCustomTools(sessionId);
-        if (this.disposedSessions.has(sessionId))
-            return;
+        const customTools = await this.loadCustomTools(init.sessionId);
+        if (aborted())
+            return undefined;
         // pi-web parity: do NOT pass `tools`. A closed allowlist becomes
         // SDK allowedToolNames and filters extension MCP tools out of the
         // registry before Gate 2 can re-add them. Operator/safe customTools
@@ -1472,41 +918,77 @@ export class ConsolePiRuntime {
             ...(customTools.length > 0 ? { customTools } : {}),
             ...(resolvedModel ? { model: resolvedModel } : {}),
         });
-        if (this.disposedSessions.has(sessionId)) {
+        if (aborted()) {
             try {
                 session.dispose();
             }
             catch {
                 // ignore late dispose cleanup
             }
-            return;
+            return undefined;
         }
-        await bindSessionExtensions(session);
-        pinOperatorChatTools(session, sessionMode);
+        try {
+            await bindSessionExtensions(session);
+            this.pinSessionTools(init.sessionId, session);
+        }
+        catch (error) {
+            try {
+                session.dispose();
+            }
+            finally {
+                this.toolExposures.delete(init.sessionId);
+            }
+            throw error;
+        }
+        this.applySessionRecoveryOverrides(init.sessionId, services, session);
+        return {
+            session,
+            modelRuntime,
+            modelConfigFile,
+            model,
+            services: {
+                resourceLoader: services.resourceLoader,
+                settingsManager: services.settingsManager,
+            },
+        };
+    }
+    async materializeSession(sessionId, init) {
+        if (this.disposedSessions.has(sessionId))
+            return;
+        await this.syncAimaxAuthToken();
+        const sessionMode = this.rememberSessionMode(sessionId, init.sessionMode ?? this.sessionModeOf(sessionId));
+        const prepared = await this.prepareLiveSession({
+            sessionId,
+            sessionManager: init.sessionManager,
+            model: init.model,
+            systemPromptSuffix: init.systemPromptSuffix,
+            sessionMode,
+            resolveDefaultModel: init.resolveDefaultModel,
+            abortIfDisposed: true,
+        });
+        if (!prepared)
+            return;
         // Register then re-check dispose race: a concurrent dispose must win.
-        this.sessions.set(sessionId, session);
+        this.sessions.set(sessionId, prepared.session);
         this.sessionManagers.set(sessionId, init.sessionManager);
-        this.modelRuntimes.set(sessionId, modelRuntime);
-        this.modelConfigFiles.set(sessionId, modelConfigFile);
-        this.sessionModels.set(sessionId, model);
-        this.serviceScopes.set(sessionId, {
-            resourceLoader: services.resourceLoader,
-            settingsManager: services.settingsManager,
-        });
-        this.applySessionCompactionOverride(sessionId, services, session);
+        this.modelRuntimes.set(sessionId, prepared.modelRuntime);
+        this.modelConfigFiles.set(sessionId, prepared.modelConfigFile);
+        this.sessionModels.set(sessionId, prepared.model);
+        this.serviceScopes.set(sessionId, prepared.services);
         this.revisions.set(sessionId, 1);
         if (!this.thinkingSelections.has(sessionId)) {
             this.thinkingSelections.set(sessionId, "auto");
         }
         if (this.disposedSessions.has(sessionId)) {
             try {
-                session.dispose();
+                prepared.session.dispose();
             }
             catch {
                 // ignore
             }
             this.sessions.delete(sessionId);
             this.sessionManagers.delete(sessionId);
+            this.toolExposures.delete(sessionId);
             this.modelRuntimes.delete(sessionId);
             this.modelConfigFiles.delete(sessionId);
             this.sessionModels.delete(sessionId);
@@ -1516,6 +998,20 @@ export class ConsolePiRuntime {
             this.thinkingSelections.delete(sessionId);
         }
     }
+    pinSessionTools(sessionId, session, interview = false) {
+        const exposure = this.toolExposures.get(sessionId);
+        if (exposure) {
+            exposure.pin(session, interview);
+            return;
+        }
+        if (interview) {
+            session.setActiveToolsByName(filterActiveInterviewTools(chatActiveToolBaseline(this.sessionModeOf(sessionId))).allowed);
+        }
+        else
+            pinOperatorChatTools(session, this.sessionModeOf(sessionId));
+    }
+    /** Read-only rollout diagnostics; no model parameters or host identities. */
+    getToolExposure(sessionId) { return this.toolExposures.get(sessionId)?.snapshot; }
     /** Cached session-less custom tool definitions (operator + explore). */
     async loadCustomTools(sessionId) {
         const sessionMode = this.sessionModeOf(sessionId);
@@ -1526,6 +1022,11 @@ export class ConsolePiRuntime {
                 : Promise.resolve([]),
             this.loadExploreCustomTools(),
         ]);
+        const scheduledGoalTools = loadWorkflowTools && this.options.actionContext
+            ? await buildScheduledGoalTools({ sessionId, actionContext: this.options.actionContext }) : [];
+        const browserTools = await buildBrowserTools({
+            automation: this.browserAutomation,
+        });
         const questionTool = this.options.questionRegistry
             ? await buildAskUserQuestionTool({
                 sessionId,
@@ -1539,7 +1040,7 @@ export class ConsolePiRuntime {
                 sessionMode,
             })
             : undefined;
-        const goalTools = loadWorkflowTools && this.options.goalRegistry
+        const goalTools = this.options.goalRegistry
             ? await buildGoalTools({ sessionId, registry: this.options.goalRegistry })
             : [];
         const terminalTools = this.options.terminalRegistry
@@ -1576,14 +1077,21 @@ export class ConsolePiRuntime {
             process.stderr.write(`[console] chat Agent tool build failed: ${error instanceof Error ? error.message : String(error)}\n`);
             return undefined;
         });
+        const exposure = this.toolExposures.get(sessionId);
+        const fullCapabilities = operatorCustomTools.find(tool => tool.name === "operatorCapabilities");
+        // Always session-bound: a branch can restore progressive after full fallback.
+        const discovery = exposure?.buildTool(fullCapabilities);
         return [
-            ...operatorCustomTools,
+            ...operatorCustomTools.filter(tool => !discovery || tool.name !== "operatorCapabilities"),
+            ...(discovery ? [discovery] : []),
+            ...scheduledGoalTools,
             ...exploreCustomTools,
             ...(questionTool ? [questionTool] : []),
             ...(todoTool ? [todoTool] : []),
             ...goalTools,
             ...terminalTools,
             ...scmTools,
+            ...browserTools,
             ...(agentTool ? [agentTool] : []),
         ];
     }
@@ -1666,6 +1174,7 @@ export class ConsolePiRuntime {
         const entry = input.summary
             ? manager.branchWithSummary?.(input.branchFromEntryId, input.summary)
             : (manager.branch(input.branchFromEntryId), undefined);
+        this.pinSessionTools(input.sessionId, session);
         return {
             branchedFromEntryId: input.branchFromEntryId,
             ...(entry?.id ? { branchSummaryEntryId: entry.id } : {}),
@@ -1677,6 +1186,9 @@ export class ConsolePiRuntime {
             throw new Error(`chat session not active: ${sessionId}`);
         manager.branch(this.mainlineLeaves.get(sessionId));
         this.mainlineLeaves.delete(sessionId);
+        const session = this.sessions.get(sessionId);
+        if (session)
+            this.pinSessionTools(sessionId, session);
     }
     getBranchContext(sessionId) {
         const manager = this.sessionManagers.get(sessionId);
@@ -1934,9 +1446,9 @@ export class ConsolePiRuntime {
             await session.reload();
             const services = this.serviceScopes.get(sessionId);
             if (services)
-                this.applySessionCompactionOverride(sessionId, services, session);
+                this.applySessionRecoveryOverrides(sessionId, services, session);
             await this.refreshModelConfiguration(sessionId, "force");
-            pinOperatorChatTools(session, this.sessionModeOf(sessionId));
+            this.pinSessionTools(sessionId, session);
         }
         catch (error) {
             return {
@@ -1967,91 +1479,14 @@ export class ConsolePiRuntime {
      * Never returns prompt/skill file bodies.
      */
     async listSlashCommands(sessionId) {
-        const scrub = (value) => {
-            const raw = String(value ?? "");
-            return raw
-                .replace(/\/Users\/[^\s]+/gi, "~")
-                .replace(/[A-Za-z]:\\Users\\[^\s]+/gi, "~")
-                .slice(0, 240);
-        };
         // Fail soft at the HTTP layer: bubble readiness errors so routes can attach
         // a compact warning while the UI keeps local Operator/Pi Web commands.
         await this.ensureSessionReady(sessionId);
         const session = this.sessions.get(sessionId);
         if (!session)
             return { commands: [] };
-        // Same-name conflict priority (AC-3): extension > skill > prompt.
-        // Enum order must not decide the winner — prompt-before-skill still loses.
-        const SOURCE_RANK = {
-            extension: 0,
-            skill: 1,
-            prompt: 2,
-        };
-        const byKey = new Map();
-        const sourceWarnings = [];
-        const push = (command, label, description, source) => {
-            const name = command.startsWith("/") ? command : `/${command}`;
-            const key = name.toLowerCase();
-            if (!key || key === "/")
-                return;
-            const next = {
-                command: name,
-                label: (label || name).slice(0, 80),
-                description: scrub(description),
-                source,
-            };
-            const existing = byKey.get(key);
-            if (!existing || SOURCE_RANK[source] < SOURCE_RANK[existing.source]) {
-                byKey.set(key, next);
-            }
-        };
-        try {
-            const cmds = session.extensionRunner?.getRegisteredCommands?.() ?? [];
-            for (const cmd of cmds) {
-                const name = cmd.invocationName || cmd.name;
-                if (!name)
-                    continue;
-                push(String(name), String(cmd.name || name), String(cmd.description || ""), "extension");
-            }
-        }
-        catch (error) {
-            // Source isolation: keep other sources; surface compact warning (AC-3).
-            sourceWarnings.push(`extension: ${scrub(error instanceof Error ? error.message : String(error))}`);
-        }
-        try {
-            // Enumerate prompts before skills on purpose: priority must still let skill win.
-            for (const tpl of session.promptTemplates ?? []) {
-                if (!tpl?.name)
-                    continue;
-                push(String(tpl.name), String(tpl.name), String(tpl.description || ""), "prompt");
-            }
-        }
-        catch (error) {
-            sourceWarnings.push(`prompt: ${scrub(error instanceof Error ? error.message : String(error))}`);
-        }
-        try {
-            const services = this.serviceScopes.get(sessionId);
-            const resourceLoader = services?.resourceLoader;
-            const skills = resourceLoader?.getSkills?.()?.skills ?? [];
-            for (const skill of skills) {
-                if (!skill?.name)
-                    continue;
-                const command = skill.name.startsWith("skill:")
-                    ? `/${skill.name}`
-                    : `/skill:${skill.name}`;
-                push(command, skill.name, String(skill.description || ""), "skill");
-            }
-        }
-        catch (error) {
-            sourceWarnings.push(`skill: ${scrub(error instanceof Error ? error.message : String(error))}`);
-        }
-        const warning = sourceWarnings.length > 0
-            ? sourceWarnings.join("; ").slice(0, 160)
-            : undefined;
-        return {
-            commands: [...byKey.values()],
-            ...(warning ? { warning } : {}),
-        };
+        const resourceLoader = this.serviceScopes.get(sessionId)?.resourceLoader;
+        return collectSlashCommands({ session, resourceLoader });
     }
     async getRuntimeSnapshot(sessionId, options) {
         try {
@@ -2095,9 +1530,6 @@ export class ConsolePiRuntime {
                 throw new RuntimeSnapshotUnavailableError(`model enumeration failed: ${error instanceof Error ? error.message : String(error)}`);
             }
         }
-        // Thinking options: auto is always offered; explicit levels only when the
-        // runtime session supports setThinkingLevel (xhigh/max ship with the SDK
-        // and therefore surface only when this runtime provides them).
         const supportedLevels = typeof session.setThinkingLevel === "function"
             ? [...THINKING_LEVELS]
             : [];
@@ -2105,220 +1537,25 @@ export class ConsolePiRuntime {
             { value: "auto" },
             ...supportedLevels.map((value) => ({ value })),
         ];
-        // Resource inventories from the session ResourceLoader (ADR 0012 open
-        // surface). Missing loader → real empty lists, never fabricated entries.
-        // Each subface is isolated (RF-02): a throwing subface keeps the other
-        // inventories AND surfaces a structured retryable diagnostic instead of
-        // silently dropping the whole resource projection.
-        const contextFiles = [];
-        const skills = [];
-        const extensions = [];
-        const diagnostics = [];
-        const resolvedResources = [];
-        const resourceFailure = (subface, error) => {
-            diagnostics.push({
-                type: "error",
-                code: "RESOURCE_LOAD_FAILED",
-                message: `${subface} inventory failed: ${error instanceof Error ? error.message : String(error)}`,
-                retryable: true,
-            });
-        };
+        let skillPrefs = { schemaVersion: 1, skills: {} };
+        let skillPrefsError;
         if (resourceLoader) {
-            try {
-                const agentsFiles = resourceLoader.getAgentsFiles?.();
-                for (const file of agentsFiles?.agentsFiles ?? []) {
-                    if (!file.path)
-                        continue;
-                    contextFiles.push({
-                        path: file.path,
-                        characters: file.content?.length ?? 0,
-                    });
-                }
-            }
-            catch (error) {
-                resourceFailure("context files", error);
-            }
-            // Preferences are the source of truth for UI auto-invocation state;
-            // loader disableModelInvocation may also reflect frontmatter. Prefer
-            // explicit preference (default on) when projecting autoInvocationEnabled.
-            let skillPrefs = { schemaVersion: 1, skills: {} };
             try {
                 skillPrefs = await this.loadSkillAutoInvocationPreferences();
             }
             catch (error) {
-                diagnostics.push({
-                    type: "error",
-                    code: "PI_RESOURCE_PREFERENCES_MALFORMED",
-                    message: error instanceof Error ? error.message : String(error),
-                    retryable: true,
-                });
+                skillPrefsError = error;
             }
-            try {
-                const skillsResult = resourceLoader.getSkills?.();
-                for (const skill of skillsResult?.skills ?? []) {
-                    const resourceId = skillResourceId({
-                        name: skill.name,
-                        filePath: skill.filePath,
-                    });
-                    // Preference off always means autoInvocationEnabled=false even if
-                    // loader already applied disableModelInvocation. Frontmatter-only
-                    // disable (no preference) also surfaces as autoInvocationEnabled=false.
-                    const prefEnabled = isAutoInvocationEnabled(skillPrefs, resourceId);
-                    const autoInvocationEnabled = prefEnabled && skill.disableModelInvocation !== true;
-                    skills.push({
-                        name: skill.name,
-                        description: skill.description ?? "",
-                        path: skill.filePath,
-                        ...(skill.baseDir ? { baseDir: skill.baseDir } : {}),
-                        scope: skill.sourceInfo?.scope ?? "unknown",
-                        source: skill.sourceInfo?.source ?? "",
-                        resourceId,
-                        autoInvocationEnabled,
-                        diagnostics: [],
-                    });
-                    resolvedResources.push({
-                        type: "skill",
-                        name: skill.name,
-                        path: skill.filePath,
-                        source: skill.sourceInfo?.source ?? "",
-                        scope: skill.sourceInfo?.scope ?? "unknown",
-                    });
-                }
-                for (const diag of skillsResult?.diagnostics ?? []) {
-                    if (!diag?.message)
-                        continue;
-                    diagnostics.push({
-                        type: diag.type ?? "warning",
-                        message: diag.message,
-                        ...(diag.path ? { path: diag.path } : {}),
-                    });
-                }
-            }
-            catch (error) {
-                resourceFailure("skills", error);
-            }
-            try {
-                const extResult = resourceLoader.getExtensions?.();
-                for (const ext of extResult?.extensions ?? []) {
-                    const path = ext.resolvedPath ?? ext.path ?? "";
-                    extensions.push({
-                        name: ext.sourceInfo?.source ?? ext.path ?? "extension",
-                        path,
-                        ...(ext.resolvedPath ? { resolvedPath: ext.resolvedPath } : {}),
-                        source: ext.sourceInfo?.source ?? "",
-                        scope: ext.sourceInfo?.scope ?? "unknown",
-                        ...(ext.sourceInfo?.origin ? { origin: ext.sourceInfo.origin } : {}),
-                        enabled: true,
-                    });
-                    resolvedResources.push({
-                        type: "extension",
-                        name: ext.sourceInfo?.source ?? ext.path ?? "extension",
-                        path,
-                        source: ext.sourceInfo?.source ?? "",
-                        scope: ext.sourceInfo?.scope ?? "unknown",
-                    });
-                }
-                for (const err of extResult?.errors ?? []) {
-                    if (!err?.error)
-                        continue;
-                    diagnostics.push({
-                        type: "error",
-                        message: err.error,
-                        ...(err.path ? { path: err.path } : {}),
-                    });
-                }
-            }
-            catch (error) {
-                resourceFailure("extensions", error);
-            }
-            try {
-                const promptsResult = resourceLoader.getPrompts?.();
-                for (const prompt of promptsResult?.prompts ?? []) {
-                    resolvedResources.push({
-                        type: "prompt",
-                        name: prompt.name,
-                        path: prompt.filePath,
-                        source: prompt.sourceInfo?.source ?? "",
-                        scope: prompt.sourceInfo?.scope ?? "unknown",
-                    });
-                }
-                for (const diag of promptsResult?.diagnostics ?? []) {
-                    if (!diag?.message)
-                        continue;
-                    diagnostics.push({
-                        type: diag.type ?? "warning",
-                        message: diag.message,
-                        ...(diag.path ? { path: diag.path } : {}),
-                    });
-                }
-            }
-            catch (error) {
-                resourceFailure("prompts", error);
-            }
-            try {
-                const themesResult = resourceLoader.getThemes?.();
-                for (const theme of themesResult?.themes ?? []) {
-                    if (!theme.path)
-                        continue;
-                    resolvedResources.push({
-                        type: "theme",
-                        name: theme.name ?? theme.path,
-                        path: theme.path,
-                        source: "",
-                        scope: "unknown",
-                    });
-                }
-                for (const diag of themesResult?.diagnostics ?? []) {
-                    if (!diag?.message)
-                        continue;
-                    diagnostics.push({
-                        type: diag.type ?? "warning",
-                        message: diag.message,
-                        ...(diag.path ? { path: diag.path } : {}),
-                    });
-                }
-            }
-            catch (error) {
-                resourceFailure("themes", error);
-            }
-        }
-        // Packages: Pi settings specs + resolved resource metadata. Fields the SDK
-        // does not expose stay absent (real missing, never fabricated). A
-        // readPackageInventory failure is a PARTIAL failure (RF-02): the snapshot
-        // stays 200 with a structured retryable diagnostic — never a silent
-        // fake-empty package list.
-        const { readPackageInventory } = await import("./pi-console-config.js");
-        let packages = [];
-        try {
-            packages = (await readPackageInventory(await safeGetAgentDir(this.bindings), this.options.cwd, resolvedResources));
-        }
-        catch (error) {
-            packages = [];
-            diagnostics.push({
-                type: "error",
-                code: "PACKAGE_INVENTORY_FAILED",
-                message: error instanceof Error ? error.message : String(error),
-                retryable: true,
-            });
-        }
-        const { readMcpInventory } = await import("./mcp-inventory.js");
-        let mcp = { servers: [], unassignedTools: [] };
-        try {
-            mcp = await readMcpInventory({
-                agentDir: await safeGetAgentDir(this.bindings),
-                cwd: this.options.cwd,
-                tools: session.getAllTools?.() ?? [],
-                activeToolNames: session.getActiveToolNames(),
-            });
-        }
-        catch (error) {
-            diagnostics.push({
-                type: "error",
-                code: "MCP_INVENTORY_FAILED",
-                message: error instanceof Error ? error.message : String(error),
-                retryable: true,
-            });
         }
+        const inventories = await collectRuntimeInventories({
+            resourceLoader,
+            skillPrefs,
+            skillPrefsError,
+            agentDir: await safeGetAgentDir(this.bindings),
+            cwd: this.options.cwd,
+            tools: session.getAllTools?.() ?? [],
+            activeToolNames: session.getActiveToolNames(),
+        });
         return projectRuntimeSnapshot({
             sessionId,
             revision: this.revisions.get(sessionId) ?? 0,
@@ -2343,19 +1580,24 @@ export class ConsolePiRuntime {
             thinkingLevels,
             systemPrompt: {
                 ...(options?.includeRaw ? { raw: rawSystemPrompt } : {}),
-                // The RAW prompt flows into the projection: text is scrubbed +
-                // length-limited while sha256/characters stay RAW-based (design §2.2).
                 text: rawSystemPrompt,
                 sha256: createHash("sha256").update(rawSystemPrompt).digest("hex"),
                 characters: rawSystemPrompt.length,
             },
             activeTools: session.getActiveToolNames(),
-            contextFiles,
-            skills,
-            extensions,
-            packages,
-            mcp,
-            diagnostics,
+            contextFiles: inventories.contextFiles,
+            skills: inventories.skills,
+            extensions: inventories.extensions,
+            packages: inventories.packages,
+            mcp: inventories.mcp,
+            diagnostics: [
+                ...inventories.diagnostics,
+                ...(this.toolExposures.has(sessionId) ? [{
+                        type: "info",
+                        code: "WORKFLOW_TOOL_EXPOSURE",
+                        message: JSON.stringify(this.toolExposures.get(sessionId).snapshot),
+                    }] : []),
+            ],
             hasBash: true,
         });
     }
@@ -2534,47 +1776,21 @@ export class ConsolePiRuntime {
      */
     async buildSessionWithServices(init) {
         const sessionMode = this.rememberSessionMode(init.sessionId, init.sessionMode ?? this.sessionModeOf(init.sessionId));
-        const agentDir = await safeGetAgentDir(this.bindings);
-        const modelConfigFile = await captureModelConfigFile(agentDir);
-        const appendSystemPrompt = composeChatSystemPromptParts({
-            sessionMode,
-            workflowPrompt: OPERATOR_CHAT_SYSTEM_PROMPT_BASE,
-            systemPromptSuffix: init.systemPromptSuffix,
-        });
-        await this.refreshSkillPrefsCache().catch(() => undefined);
-        const { services } = await this.bindings.createServices({
-            cwd: this.options.cwd,
-            agentDir,
-            resourceLoaderOptions: await this.buildResourceLoaderOptions({ appendSystemPrompt }, init.sessionId),
-        });
-        const modelRuntime = services.modelRuntime;
-        const resolvedModel = init.model
-            ? (this.bindings.resolveModel({
-                modelRuntime,
-                provider: init.model.provider,
-                modelId: init.model.modelId,
-            }) ?? undefined)
-            : undefined;
-        assertNoWriteToolInList(OPERATOR_CHAT_ALLOWED_TOOLS);
-        const customTools = await this.loadCustomTools(init.sessionId);
-        const { session } = await this.bindings.createSessionFromServices({
-            services,
+        const prepared = await this.prepareLiveSession({
+            sessionId: init.sessionId,
             sessionManager: init.sessionManager,
-            excludeTools: [...OPERATOR_CHAT_SESSION_EXCLUDE_TOOLS],
-            ...(customTools.length > 0 ? { customTools } : {}),
-            ...(resolvedModel ? { model: resolvedModel } : {}),
+            model: init.model,
+            systemPromptSuffix: init.systemPromptSuffix,
+            sessionMode,
         });
-        await bindSessionExtensions(session);
-        pinOperatorChatTools(session, sessionMode);
-        this.applySessionCompactionOverride(init.sessionId, services, session);
+        if (!prepared) {
+            throw new Error(`chat session preparation aborted: ${init.sessionId}`);
+        }
         return {
-            session,
-            modelRuntime,
-            modelConfigFile,
-            services: {
-                resourceLoader: services.resourceLoader,
-                settingsManager: services.settingsManager,
-            },
+            session: prepared.session,
+            modelRuntime: prepared.modelRuntime,
+            modelConfigFile: prepared.modelConfigFile,
+            services: prepared.services,
         };
     }
     /** Re-open a previously created session (cross-request). */
@@ -2676,8 +1892,7 @@ export class ConsolePiRuntime {
             if (options?.turnId && this.options.todoRegistry) {
                 this.options.todoRegistry.startTurn(sessionId, options.turnId);
             }
-            if (this.options.goalRegistry &&
-                shouldInjectGoalContinuation(this.sessionModeOf(sessionId))) {
+            if (this.options.goalRegistry) {
                 this.options.goalRegistry.startTurn(sessionId, text);
             }
             // AC-FIX-002: if Stop already fired before readiness, never start model work.
@@ -2699,11 +1914,10 @@ export class ConsolePiRuntime {
             // explicitly restores the normal Operator Chat set (baseline + extension
             // tools, ADR 0012).
             const sessionMode = this.sessionModeOf(sessionId);
-            const requestedTools = chatActiveToolBaseline(sessionMode);
-            const activeTools = options?.mode === "requirement-interview" && sessionMode === "workflow"
-                ? filterActiveInterviewTools(requestedTools).allowed
-                : computeChatActiveToolNames(session, sessionMode);
-            session.setActiveToolsByName(activeTools);
+            this.pinSessionTools(sessionId, session, options?.mode === "requirement-interview" && sessionMode === "workflow");
+            if (sessionMode === "workflow" && isScheduledBookingTurn(text)) {
+                pinScheduledBookingTurnTools(session);
+            }
             // Final pre-prompt fence: abort after tool pin must still skip session.prompt.
             if (options?.signal?.aborted) {
                 return;
@@ -3036,6 +2250,7 @@ export class ConsolePiRuntime {
         }
         this.sessions.delete(sessionId);
         this.sessionManagers.delete(sessionId);
+        this.toolExposures.delete(sessionId);
         this.mainlineLeaves.delete(sessionId);
         this.modelRuntimes.delete(sessionId);
         this.modelConfigFiles.delete(sessionId);
@@ -3052,6 +2267,8 @@ export class ConsolePiRuntime {
         for (const id of [...this.sessions.keys()])
             this.dispose(id);
         void this.exploreOrchestrator.abortAll();
+        if (this.ownsBrowserAutomation)
+            void this.browserAutomation.dispose();
     }
 }
 function mapAssistantMessageEvent(type, sessionId, message) {
@@ -3208,153 +2425,6 @@ async function waitForIdle(session, options) {
         await new Promise((r) => setTimeout(r, 50));
     }
 }
-async function safeGetAgentDir(bindings) {
-    try {
-        return await bindings.getAgentDir();
-    }
-    catch {
-        // Fall back to a Console-app-data scoped agent dir so we never accidentally
-        // touch the user's real ~/.pi/agent config if getAgentDir throws.
-        return path.join(process.cwd(), ".harness", "console", "pi-agent-dir");
-    }
-}
-/**
- * Cached SDK module loader. The pi-coding-agent package is ESM-only, so we
- * must use dynamic import() (not require). Cached to avoid repeated imports.
- */
-let cachedSdk;
-async function loadSdk() {
-    if (!cachedSdk) {
-        cachedSdk = import("@earendil-works/pi-coding-agent");
-    }
-    return cachedSdk;
-}
-/**
- * Default production bindings backed by the real Pi SDK (services mode).
- * Dynamically imported so the worker bundle does not hard-fail if the SDK is
- * absent at module load (discovered lazily by pi-readiness instead).
- */
-export function createDefaultPiSdkBindings() {
-    return {
-        getAgentDir: async () => {
-            const sdk = (await loadSdk());
-            return sdk.getAgentDir();
-        },
-        createServices: async (opts) => {
-            const sdk = (await loadSdk());
-            // createAgentSessionServices returns the full AgentSessionServices object
-            // directly (cwd/agentDir/modelRuntime/settingsManager/resourceLoader).
-            // Wrap it so our type contract is satisfied.
-            const result = await sdk.createAgentSessionServices({
-                cwd: opts.cwd,
-                agentDir: opts.agentDir,
-                resourceLoaderOptions: opts.resourceLoaderOptions,
-            });
-            return { services: result };
-        },
-        createSessionFromServices: async (opts) => {
-            const sdk = (await loadSdk());
-            return sdk.createAgentSessionFromServices({
-                services: opts.services,
-                sessionManager: opts.sessionManager,
-                ...(opts.tools ? { tools: opts.tools } : {}),
-                ...(opts.noTools ? { noTools: opts.noTools } : {}),
-                ...(opts.excludeTools ? { excludeTools: opts.excludeTools } : {}),
-                ...(opts.customTools ? { customTools: opts.customTools } : {}),
-                ...(opts.model ? { model: opts.model } : {}),
-            });
-        },
-        createSessionManager: async (opts) => {
-            const sdk = (await loadSdk());
-            return sdk.SessionManager.create(opts.cwd, opts.sessionDir, {
-                id: opts.sessionId,
-            });
-        },
-        materializeSessionShell: async (opts) => {
-            const sdk = (await loadSdk());
-            const manager = opts.sessionManager;
-            if (typeof manager.setSessionFile !== "function") {
-                throw new Error("Pi SessionManager cannot materialize a session file");
-            }
-            let created = false;
-            try {
-                await mkdir(path.dirname(opts.sessionFile), { recursive: true });
-                // Match Pi's documented session header. Rebinding through the public
-                // SessionManager API marks it flushed, so Pi appends the first user
-                // entry instead of trying to create the already-present file later.
-                await writeFile(opts.sessionFile, `${JSON.stringify({
-                    type: "session",
-                    version: typeof sdk.CURRENT_SESSION_VERSION === "number"
-                        ? sdk.CURRENT_SESSION_VERSION
-                        : 3,
-                    id: opts.sessionId,
-                    timestamp: new Date().toISOString(),
-                    cwd: opts.cwd,
-                })}\n`, { encoding: "utf8", flag: "wx", mode: 0o600 });
-                created = true;
-                manager.setSessionFile(opts.sessionFile);
-            }
-            catch (error) {
-                if (created)
-                    await rm(opts.sessionFile, { force: true }).catch(() => undefined);
-                throw error;
-            }
-        },
-        createInMemorySessionManager: async (opts) => {
-            const sdk = (await loadSdk());
-            return sdk.SessionManager.inMemory(opts.cwd);
-        },
-        forkSessionManager: async (opts) => {
-            const sdk = (await loadSdk());
-            return sdk.SessionManager.forkFrom(opts.sourcePath, opts.targetCwd, opts.targetSessionDir, { id: opts.targetSessionId });
-        },
-        openSessionManager: async (opts) => {
-            const sdk = (await loadSdk());
-            try {
-                // Pi SessionManager.open(missingPath) does NOT throw — it creates a
-                // fresh in-memory session with a random UUID. That would reopen the
-                // wrong conversation under the durable Console sessionId. Fail closed
-                // before open when the persisted file is absent.
-                await access(opts.sessionFile);
-            }
-            catch (error) {
-                const code = error && typeof error === "object" && "code" in error
-                    ? String(error.code ?? "")
-                    : "";
-                if (code === "ENOENT") {
-                    throw Object.assign(new Error(`SESSION_FILE_MISSING: ${opts.sessionFile}`), { code: "SESSION_FILE_MISSING", cause: error });
-                }
-                // File exists but is unreadable (permissions / I/O) — caller maps
-                // undefined to 503 rather than silently creating a fresh session.
-                return undefined;
-            }
-            return sdk.SessionManager.open(opts.sessionFile);
-        },
-        resolveModel: (opts) => {
-            const rt = opts.modelRuntime;
-            if (typeof rt?.getModel !== "function")
-                return undefined;
-            try {
-                return rt.getModel(opts.provider, opts.modelId);
-            }
-            catch {
-                return undefined;
-            }
-        },
-        listAvailableModels: (opts) => {
-            const rt = opts.modelRuntime;
-            const available = rt?.snapshot?.available ?? [];
-            const configured = rt?.snapshot?.configuredProviders;
-            const isConfigured = (provider) => configured instanceof Set ? configured.has(provider) : false;
-            return available.map((m) => ({
-                id: m.id,
-                name: m.name,
-                provider: m.provider,
-                hasCredentials: isConfigured(m.provider),
-            }));
-        },
-    };
-}
 /**
  * Re-export the tool gates for the dispatcher layer so the per-tool-call gate
  * (Gate 3) lives in exactly one place. authorizeChatSessionTool is the