@tea-agent/loop-agent 0.13.0-alpha.0 → 0.13.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (199) hide show
  1. package/AGENTS.md +4 -0
  2. package/CHANGELOG.md +57 -53
  3. package/README.md +12 -3
  4. package/dist/application/dag/generate-task-dag.js +28 -58
  5. package/dist/application/evaluation/candidate-hash.js +75 -0
  6. package/dist/application/evaluation/candidate.js +52 -0
  7. package/dist/application/evaluation/replay.js +289 -0
  8. package/dist/application/evaluation/types.js +130 -0
  9. package/dist/cli/command-definitions.js +17 -4
  10. package/dist/cli/program.js +8 -4
  11. package/dist/commands/eval.js +235 -0
  12. package/dist/commands/init.js +131 -24
  13. package/dist/executors/pi-sdk-executor.js +38 -24
  14. package/dist/executors/shell-executor.js +226 -15
  15. package/dist/executors/shell-presets.js +20 -0
  16. package/dist/executors/shell-verification.js +7 -0
  17. package/dist/governance/manifest-types.js +1 -0
  18. package/dist/infrastructure/evaluation/candidate-store.js +439 -0
  19. package/dist/infrastructure/evaluation/store.js +40 -0
  20. package/dist/task/config-types.js +23 -0
  21. package/dist/worker/observe/routes.js +18 -3
  22. package/dist/worker/observe/spec-evidence.js +1 -1
  23. package/dist/worker/observe/static/dom.js +160 -1
  24. package/dist/worker/observe/static/state.js +14 -0
  25. package/dist/worker/observe/static/views/dag-inspector.js +35 -4
  26. package/dist/worker/observe/static/views/dag.js +9 -0
  27. package/dist/worker/observe/static/views/dashboard.js +702 -445
  28. package/dist/worker/observe/static/views/session-timeline.js +15 -1
  29. package/dist/workflows/dag/backend-test-analysis-contract.js +120 -0
  30. package/dist/workflows/dag/backend-test-case-manifest.js +503 -0
  31. package/dist/workflows/dag/backend-test-execution-contract.js +353 -0
  32. package/dist/workflows/dag/backend-test-result-contract.js +568 -0
  33. package/dist/workflows/dag/decision-envelope.js +57 -2
  34. package/dist/workflows/dag/dynamic-runtime/map.js +90 -2
  35. package/dist/workflows/dag/frontend-implementation-contract.js +240 -0
  36. package/dist/workflows/dag/frontend-project-capability.js +309 -0
  37. package/dist/workflows/dag/frontend-repair.js +341 -0
  38. package/dist/workflows/dag/frontend-risk.js +161 -0
  39. package/dist/workflows/dag/frontend-verification-trace.js +190 -0
  40. package/dist/workflows/dag/init-hybrid.js +2407 -297
  41. package/dist/workflows/dag/node-execution.js +9 -0
  42. package/dist/workflows/dag/prompt.js +9 -0
  43. package/dist/workflows/dag/repair-artifact.js +43 -3
  44. package/dist/workflows/dag/report.js +35 -1
  45. package/dist/workflows/dag/runner.js +28 -2
  46. package/dist/workflows/dag/skill-instructions.js +4 -2
  47. package/dist/workflows/dag/task-demand-routing.js +383 -0
  48. package/dist/workflows/dag/types.js +71 -13
  49. package/dist/workflows/dag/upstream-artifacts.js +1 -0
  50. package/dist/workflows/dag/validate.js +59 -1
  51. package/docs/README.md +6 -3
  52. package/docs/agent-dag-recovery-playbook.md +5 -3
  53. package/docs/agent-dag-runner.md +3 -3
  54. package/docs/architecture/README.md +3 -3
  55. package/docs/architecture/dag-execution.md +1 -1
  56. package/docs/architecture/evolution.md +13 -13
  57. package/docs/architecture/facts-and-state.md +1 -1
  58. package/docs/architecture/runtime-boundaries.md +7 -7
  59. package/docs/architecture/system-overview.md +3 -3
  60. package/docs/architecture/worker-and-feature.md +3 -3
  61. package/docs/design/README.md +124 -42
  62. package/docs/development-principles.md +4 -4
  63. package/docs/exec-plans/active/README.md +12 -11
  64. package/docs/exec-plans/completed/README.md +33 -0
  65. package/docs/feature-workflow.md +114 -39
  66. package/docs/init-surface.manifest.json +30 -3
  67. package/docs/loop-agent-harness.md +9 -8
  68. package/docs/production-readiness.md +1 -1
  69. package/docs/progress/README.md +23 -1
  70. package/docs/reports/README.md +65 -6
  71. package/docs/skills/vetted-skill-registry.md +2 -0
  72. package/docs/templates/agent-dag.schema.json +29 -1
  73. package/docs/templates/agent-dag.supervised-implementation.json +127 -8
  74. package/docs/templates/backend-test-analysis.schema.json +44 -0
  75. package/docs/templates/backend-test-case-manifest.schema.json +190 -0
  76. package/docs/templates/backend-test-dag.classify.prompt.md +75 -0
  77. package/docs/templates/backend-test-dag.generate-pytest.prompt.md +81 -16
  78. package/docs/templates/backend-test-dag.json +311 -40
  79. package/docs/templates/backend-test-dag.retrospect.prompt.md +44 -30
  80. package/docs/templates/backend-test-dag.review-cases.prompt.md +10 -8
  81. package/docs/templates/backend-test-execution.schema.json +133 -0
  82. package/docs/templates/backend-test-result.schema.json +99 -0
  83. package/docs/templates/branch-merge-report.md +93 -0
  84. package/docs/templates/frontend-design-contract.md +9 -0
  85. package/docs/templates/frontend-eval/fixtures/failures/01-type-build-error.md +17 -0
  86. package/docs/templates/frontend-eval/fixtures/failures/02-unit-component-test-fail.md +16 -0
  87. package/docs/templates/frontend-eval/fixtures/failures/03-fixture-schema-drift.md +16 -0
  88. package/docs/templates/frontend-eval/fixtures/failures/04-missing-loading-empty-error-state.md +16 -0
  89. package/docs/templates/frontend-eval/fixtures/failures/05-forbidden-write-writeset-expansion.md +16 -0
  90. package/docs/templates/frontend-eval/fixtures/failures/06-unapproved-dependency-add.md +16 -0
  91. package/docs/templates/frontend-eval/fixtures/failures/07-mock-production-on.md +21 -0
  92. package/docs/templates/frontend-eval/fixtures/functional/01-simple-component-style.md +29 -0
  93. package/docs/templates/frontend-eval/fixtures/functional/02-form-validation.md +28 -0
  94. package/docs/templates/frontend-eval/fixtures/functional/03-list-detail-page.md +28 -0
  95. package/docs/templates/frontend-eval/fixtures/functional/04-api-mock.md +29 -0
  96. package/docs/templates/frontend-eval/fixtures/functional/05-permission-auth-gated-ui.md +27 -0
  97. package/docs/templates/frontend-eval/fixtures/functional/06-ssr-server-client-boundary.md +28 -0
  98. package/docs/templates/frontend-eval/fixtures/functional/07-shared-public-component-api.md +28 -0
  99. package/docs/templates/frontend-eval/fixtures/functional/08-pure-local-no-remote.md +27 -0
  100. package/docs/templates/frontend-eval/metrics.md +138 -0
  101. package/docs/templates/frontend-eval/smoke-targets.md +53 -0
  102. package/docs/templates/frontend-implementation-contract.schema.json +27 -0
  103. package/docs/templates/frontend-task-constraints.md +10 -0
  104. package/docs/templates/frontend-task-requirement.md +9 -0
  105. package/docs/templates/frontend-test-dag.generate-cases.prompt.md +5 -0
  106. package/docs/templates/frontend-test-dag.json +23 -0
  107. package/docs/templates/frontend-test-dag.retrieve-context.prompt.md +3 -0
  108. package/docs/templates/frontend-test-dag.retrospect.prompt.md +3 -0
  109. package/docs/templates/frontend-test-dag.review-cases.prompt.md +3 -0
  110. package/docs/templates/frontend-test-dag.review-execution.prompt.md +3 -0
  111. package/docs/templates/knowledge-graph-bootstrap-dag.json +1 -1
  112. package/docs/templates/knowledge-sync-dag.json +1 -0
  113. package/docs/verification-matrix.md +4 -1
  114. package/examples/decision-gate-agent-dag.json +4 -4
  115. package/examples/hybrid-loop-agent-dag.json +1 -1
  116. package/package.json +2 -2
  117. package/scripts/kb-bootstrap-init-skeleton.sh +2 -1
  118. package/scripts/kb-graph-incremental-prepare.mjs +19 -5
  119. package/scripts/kb-graph-promote.mjs +12 -1
  120. package/skills/ai-engineering-context/SKILL.md +2 -2
  121. package/skills/analyze-product-dependencies/SKILL.md +67 -0
  122. package/skills/analyze-product-dependencies/agents/openai.yaml +4 -0
  123. package/skills/analyze-product-dependencies/references/api-documentation-schema.md +30 -0
  124. package/skills/analyze-product-dependencies/references/dependency-analysis-schema.md +28 -0
  125. package/skills/analyze-product-dependencies/references/example.md +76 -0
  126. package/skills/analyze-product-dependencies/references/forward-test-cases.md +35 -0
  127. package/skills/analyze-product-dependencies/references/input-contract.md +11 -0
  128. package/skills/analyze-product-dependencies/references/scouting-rules.md +61 -0
  129. package/skills/analyze-product-dependencies/scripts/test-validators.mjs +267 -0
  130. package/skills/analyze-product-dependencies/scripts/validate-api-documentation.mjs +101 -0
  131. package/skills/analyze-product-dependencies/scripts/validate-dependency-analysis.mjs +142 -0
  132. package/skills/analyze-product-dependencies/scripts/validate-product-requirement-input.mjs +76 -0
  133. package/skills/analyze-product-dependencies/scripts/validation-helpers.mjs +146 -0
  134. package/skills/analyze-product-requirements/SKILL.md +90 -0
  135. package/skills/analyze-product-requirements/agents/openai.yaml +4 -0
  136. package/skills/analyze-product-requirements/references/acceptance-criteria.md +91 -0
  137. package/skills/analyze-product-requirements/references/clarification-and-knowledge.md +56 -0
  138. package/skills/analyze-product-requirements/references/example.md +86 -0
  139. package/skills/analyze-product-requirements/references/forward-test-cases.md +66 -0
  140. package/skills/analyze-product-requirements/references/product-analysis-schema.md +32 -0
  141. package/skills/analyze-product-requirements/references/product-requirement-schema.md +33 -0
  142. package/skills/analyze-product-requirements/references/requirement-clarification-schema.md +35 -0
  143. package/skills/analyze-product-requirements/scripts/test-validators.mjs +193 -0
  144. package/skills/analyze-product-requirements/scripts/validate-product-analysis.mjs +69 -0
  145. package/skills/analyze-product-requirements/scripts/validate-product-requirement.mjs +97 -0
  146. package/skills/analyze-product-requirements/scripts/validate-requirement-clarification.mjs +98 -0
  147. package/skills/analyze-product-requirements/scripts/validation-helpers.mjs +156 -0
  148. package/skills/browser-tools/SKILL.md +196 -0
  149. package/skills/browser-tools/browser-content.js +103 -0
  150. package/skills/browser-tools/browser-cookies.js +35 -0
  151. package/skills/browser-tools/browser-eval.js +53 -0
  152. package/skills/browser-tools/browser-hn-scraper.js +108 -0
  153. package/skills/browser-tools/browser-nav.js +44 -0
  154. package/skills/browser-tools/browser-pick.js +162 -0
  155. package/skills/browser-tools/browser-screenshot.js +34 -0
  156. package/skills/browser-tools/browser-start.js +86 -0
  157. package/skills/browser-tools/package-lock.json +2556 -0
  158. package/skills/browser-tools/package.json +19 -0
  159. package/skills/frontend-design-review/SKILL.md +6 -1
  160. package/skills/frontend-design-review/references/review-checklist.md +25 -4
  161. package/skills/frontend-implementation/SKILL.md +25 -30
  162. package/skills/frontend-implementation/references/code-standards.md +20 -22
  163. package/skills/frontend-implementation/references/node-contracts.md +17 -53
  164. package/skills/frontend-review/SKILL.md +10 -4
  165. package/skills/frontend-review/references/review-findings.md +8 -3
  166. package/skills/frontend-verification/SKILL.md +22 -9
  167. package/skills/frontend-verification/references/verification-checklist.md +17 -5
  168. package/skills/grill-with-docs/SKILL.md +5 -5
  169. package/skills/grill-with-docs/adr-format.md +3 -3
  170. package/skills/init-capability-evolution/SKILL.md +5 -5
  171. package/skills/loop-agent/SKILL.md +5 -5
  172. package/skills/loop-agent/references/README.md +3 -3
  173. package/skills/loop-agent/references/command-reference.md +98 -24
  174. package/skills/loop-agent/references/docs-converge.md +15 -15
  175. package/skills/loop-agent/references/harness-policy.md +2 -2
  176. package/skills/loop-agent/references/hybrid-dag.md +32 -22
  177. package/skills/loop-agent/references/multi-worktree.md +1 -1
  178. package/skills/loop-agent/references/orchestrator-and-interventions.md +8 -8
  179. package/skills/loop-agent/references/task-workflow.md +1 -1
  180. package/skills/loop-agent/references/verification-and-failure-handling.md +6 -4
  181. package/skills/playwright-cli/SKILL.md +420 -0
  182. package/skills/playwright-cli/references/element-attributes.md +23 -0
  183. package/skills/playwright-cli/references/playwright-tests.md +39 -0
  184. package/skills/playwright-cli/references/request-mocking.md +87 -0
  185. package/skills/playwright-cli/references/running-code.md +241 -0
  186. package/skills/playwright-cli/references/session-management.md +225 -0
  187. package/skills/playwright-cli/references/storage-state.md +275 -0
  188. package/skills/playwright-cli/references/test-generation.md +433 -0
  189. package/skills/playwright-cli/references/tracing.md +139 -0
  190. package/skills/playwright-cli/references/video-recording.md +143 -0
  191. package/skills/playwright-cli-case-generator/SKILL.md +74 -0
  192. package/skills/requesting-code-review/SKILL.md +1 -1
  193. package/skills/systematic-debugging/CREATION-LOG.md +3 -3
  194. package/skills/systematic-debugging/SKILL.md +1 -1
  195. package/skills/systematic-debugging/test-academic.md +1 -1
  196. package/skills/systematic-debugging/test-pressure-1.md +1 -1
  197. package/skills/systematic-debugging/test-pressure-2.md +1 -1
  198. package/skills/systematic-debugging/test-pressure-3.md +1 -1
  199. package/skills/verification-before-completion/SKILL.md +1 -1
@@ -19,6 +19,7 @@ export function buildExpandedChildTask(input) {
19
19
  executor: child.executor,
20
20
  role: child.role,
21
21
  skills: child.skills,
22
+ toolProfile: child.toolProfile,
22
23
  writePolicy: child.writePolicy,
23
24
  allowedPaths: renderDynamicPatternList(child.allowedPaths, item, index, expansion.itemName) ?? [],
24
25
  forbiddenPaths: renderDynamicPatternList(child.forbiddenPaths, item, index, expansion.itemName) ?? [],
@@ -140,10 +141,72 @@ export async function executeDynamicMapExpansion(input) {
140
141
  };
141
142
  await writeDagRunJsonArtifact(input.runDir, `expansions/${input.task.id}.expansion.json`, manifest);
142
143
  await input.persistState();
143
- for (const child of children) {
144
+ const blockedChildren = [];
145
+ const tokenBudget = input.expansion.tokenBudget;
146
+ const isBudgetBlockedRecord = (record) => record?.status === "SKIPPED" &&
147
+ typeof record.stderr === "string" &&
148
+ record.stderr.includes("token-budget-exhausted");
149
+ let totalTokensUsed = 0;
150
+ let tokenBudgetExhausted = false;
151
+ // Resume-safe seed: count completed children and preserve prior budget skips.
152
+ if (tokenBudget !== undefined) {
153
+ for (const child of children) {
154
+ const record = input.state.nodes[child.id];
155
+ if (record?.status === "FINISHED") {
156
+ totalTokensUsed += record.tokensUsed ?? 0;
157
+ }
158
+ else if (isBudgetBlockedRecord(record)) {
159
+ if (!blockedChildren.some((entry) => entry.nodeId === child.id)) {
160
+ blockedChildren.push({
161
+ nodeId: child.id,
162
+ reason: "token-budget-exhausted",
163
+ });
164
+ }
165
+ }
166
+ }
167
+ if ((tokenBudget.maxTotalTokens !== undefined &&
168
+ totalTokensUsed >= tokenBudget.maxTotalTokens) ||
169
+ blockedChildren.length > 0) {
170
+ tokenBudgetExhausted = true;
171
+ }
172
+ }
173
+ for (let childIndex = 0; childIndex < children.length; childIndex += 1) {
174
+ const child = children[childIndex];
144
175
  const childRecord = input.state.nodes[child.id];
176
+ // Never re-run completed or budget-blocked children on resume.
145
177
  if (childRecord?.status === "FINISHED")
146
178
  continue;
179
+ if (isBudgetBlockedRecord(childRecord))
180
+ continue;
181
+ if (tokenBudget !== undefined &&
182
+ (tokenBudgetExhausted ||
183
+ (tokenBudget.maxTotalTokens !== undefined &&
184
+ totalTokensUsed >= tokenBudget.maxTotalTokens))) {
185
+ for (const remaining of children.slice(childIndex)) {
186
+ const record = input.state.nodes[remaining.id];
187
+ if (!record || record.status === "FINISHED")
188
+ continue;
189
+ if (isBudgetBlockedRecord(record)) {
190
+ if (!blockedChildren.some((entry) => entry.nodeId === remaining.id)) {
191
+ blockedChildren.push({
192
+ nodeId: remaining.id,
193
+ reason: "token-budget-exhausted",
194
+ });
195
+ }
196
+ continue;
197
+ }
198
+ record.status = "SKIPPED";
199
+ record.stderr = "blocked: token-budget-exhausted";
200
+ if (!blockedChildren.some((entry) => entry.nodeId === remaining.id)) {
201
+ blockedChildren.push({
202
+ nodeId: remaining.id,
203
+ reason: "token-budget-exhausted",
204
+ });
205
+ }
206
+ }
207
+ await input.persistState();
208
+ break;
209
+ }
147
210
  await executeDagNode({
148
211
  nodeId: child.id,
149
212
  tasksById: input.tasksById,
@@ -159,8 +222,25 @@ export async function executeDynamicMapExpansion(input) {
159
222
  throw new Error(`dynamic child node ${child.id} requested a human pause; map_agent children do not support pause in v0`);
160
223
  },
161
224
  });
225
+ const executedTokens = input.state.nodes[child.id]?.tokensUsed ?? 0;
226
+ totalTokensUsed += executedTokens;
227
+ if (tokenBudget &&
228
+ ((tokenBudget.maxTokensPerCase !== undefined &&
229
+ executedTokens >= tokenBudget.maxTokensPerCase) ||
230
+ (tokenBudget.maxTotalTokens !== undefined &&
231
+ totalTokensUsed >= tokenBudget.maxTotalTokens))) {
232
+ tokenBudgetExhausted = true;
233
+ }
162
234
  }
163
- const failedChildren = childNodeIds.filter((nodeId) => input.state.nodes[nodeId]?.status !== "FINISHED");
235
+ const budgetBlockedIds = new Set(blockedChildren.map((entry) => entry.nodeId));
236
+ const failedChildren = childNodeIds.filter((nodeId) => {
237
+ const record = input.state.nodes[nodeId];
238
+ if (!record || record.status === "FINISHED")
239
+ return false;
240
+ if (budgetBlockedIds.has(nodeId) || isBudgetBlockedRecord(record))
241
+ return false;
242
+ return true;
243
+ });
164
244
  const aggregate = {
165
245
  workflowNodeId: input.expansion.workflowNodeId,
166
246
  itemCount: items.length,
@@ -172,9 +252,17 @@ export async function executeDynamicMapExpansion(input) {
172
252
  stdout: input.state.nodes[nodeId]?.stdout,
173
253
  output: parseJsonFromText(input.state.nodes[nodeId]?.stdout),
174
254
  assistantText: input.state.nodes[nodeId]?.assistantText,
255
+ blocked: blockedChildren.find((child) => child.nodeId === nodeId)?.reason ??
256
+ (isBudgetBlockedRecord(input.state.nodes[nodeId])
257
+ ? "token-budget-exhausted"
258
+ : undefined),
175
259
  })),
260
+ tokensUsed: totalTokensUsed,
176
261
  };
177
262
  return {
263
+ // A post-case token stop is an expected bounded outcome; downstream review
264
+ // must receive its aggregate rather than be skipped with the map barrier.
265
+ // Real child failures remain fail-closed even when later cases are budget-blocked.
178
266
  ok: failedChildren.length === 0,
179
267
  stdout: JSON.stringify(aggregate),
180
268
  stderr: failedChildren.length > 0
@@ -0,0 +1,240 @@
1
+ import { createHash } from "node:crypto";
2
+ import { readFile } from "node:fs/promises";
3
+ import path from "node:path";
4
+ import { z } from "zod";
5
+ import { writeDagRunJsonArtifact } from "../../infrastructure/harness/artifact-store.js";
6
+ export const FRONTEND_IMPLEMENTATION_CONTRACT_SCHEMA_ID = "frontend-implementation-contract-v1";
7
+ const id = z.string().regex(/^(?:REQ|BR|AC)-[A-Z0-9]+(?:-[A-Z0-9]+)*$/);
8
+ const safePath = z
9
+ .string()
10
+ .min(1)
11
+ .refine((value) => !value.startsWith("/") &&
12
+ !value.includes("\\") &&
13
+ !value.split("/").includes(".."), "must be a relative POSIX path without traversal");
14
+ const gap = z
15
+ .object({
16
+ requirementId: id.optional(),
17
+ description: z.string().min(1),
18
+ blocking: z.boolean(),
19
+ })
20
+ .strict();
21
+ export const frontendImplementationContractSchema = z
22
+ .object({
23
+ schemaVersion: z.literal(1),
24
+ sourceBinding: z
25
+ .object({
26
+ taskId: z.string().min(1),
27
+ requirementPath: safePath,
28
+ requirementSha256: z.string().regex(/^[a-f0-9]{64}$/),
29
+ referencePaths: z.array(safePath),
30
+ requirementIds: z.array(id),
31
+ })
32
+ .strict(),
33
+ riskLevel: z.enum(["small", "standard", "high-risk"]),
34
+ targets: z
35
+ .object({
36
+ files: z.array(safePath).min(1),
37
+ routes: z.array(z.string().startsWith("/")).optional(),
38
+ publicApiChanges: z.array(z.string().min(1)).optional(),
39
+ })
40
+ .strict(),
41
+ requirements: z.array(z
42
+ .object({
43
+ id,
44
+ implementationTargets: z.array(safePath),
45
+ verificationTargetIds: z.array(z.string().min(1)),
46
+ evidenceGap: gap.optional(),
47
+ })
48
+ .strict()),
49
+ uiStates: z.array(z
50
+ .object({
51
+ name: z.string().min(1),
52
+ applicable: z.boolean(),
53
+ expectedBehavior: z.string().min(1).optional(),
54
+ implementationTargets: z.array(safePath).optional(),
55
+ verificationTargetIds: z.array(z.string().min(1)).optional(),
56
+ notApplicableReason: z.string().min(1).optional(),
57
+ })
58
+ .strict()),
59
+ interactions: z.array(z
60
+ .object({
61
+ name: z.string().min(1),
62
+ implementationTargets: z.array(safePath),
63
+ verificationTargetIds: z.array(z.string().min(1)),
64
+ })
65
+ .strict()),
66
+ mockApi: z
67
+ .object({
68
+ strategy: z.enum([
69
+ "native",
70
+ "browser-intercept",
71
+ "request-adapter",
72
+ "not-needed",
73
+ ]),
74
+ productionDefaultOff: z.literal(true),
75
+ activation: z.string().min(1),
76
+ endpoints: z.array(z
77
+ .object({
78
+ method: z.enum([
79
+ "GET",
80
+ "POST",
81
+ "PUT",
82
+ "PATCH",
83
+ "DELETE",
84
+ "HEAD",
85
+ "OPTIONS",
86
+ ]),
87
+ path: z.string().startsWith("/"),
88
+ fixture: safePath.optional(),
89
+ consumer: safePath.optional(),
90
+ })
91
+ .strict()),
92
+ })
93
+ .strict(),
94
+ designEvidence: z
95
+ .object({
96
+ source: z.string().min(1),
97
+ paths: z.array(safePath),
98
+ conflicts: z.array(z.string().min(1)),
99
+ })
100
+ .strict(),
101
+ verificationTargets: z.array(z
102
+ .object({
103
+ id: z.string().min(1),
104
+ type: z.enum(["static", "unit", "component", "integration", "mock"]),
105
+ commandLabel: z.string().min(1),
106
+ file: safePath,
107
+ symbol: z.string().min(1).optional(),
108
+ requirementIds: z.array(id),
109
+ uiStates: z.array(z.string().min(1)),
110
+ })
111
+ .strict()),
112
+ evidenceGaps: z.array(gap),
113
+ })
114
+ .strict()
115
+ .superRefine((value, ctx) => {
116
+ const verificationIds = value.verificationTargets.map((target) => target.id);
117
+ if (new Set(verificationIds).size !== verificationIds.length)
118
+ ctx.addIssue({
119
+ code: "custom",
120
+ message: "duplicate verification target id",
121
+ path: ["verificationTargets"],
122
+ });
123
+ const known = new Set(value.sourceBinding.requirementIds);
124
+ for (const requirement of value.requirements) {
125
+ if (!known.has(requirement.id))
126
+ ctx.addIssue({
127
+ code: "custom",
128
+ message: "unknown requirement id",
129
+ path: ["requirements"],
130
+ });
131
+ if ((!requirement.implementationTargets.length ||
132
+ !requirement.verificationTargetIds.length) &&
133
+ !requirement.evidenceGap)
134
+ ctx.addIssue({
135
+ code: "custom",
136
+ message: "requirement needs targets or evidenceGap",
137
+ path: ["requirements"],
138
+ });
139
+ for (const targetId of requirement.verificationTargetIds)
140
+ if (!verificationIds.includes(targetId))
141
+ ctx.addIssue({
142
+ code: "custom",
143
+ message: `unknown verification target ${targetId}`,
144
+ path: ["requirements"],
145
+ });
146
+ }
147
+ for (const state of value.uiStates) {
148
+ if (state.applicable &&
149
+ (!state.expectedBehavior ||
150
+ !state.implementationTargets?.length ||
151
+ !state.verificationTargetIds?.length))
152
+ ctx.addIssue({
153
+ code: "custom",
154
+ message: "applicable UI state requires behavior, implementation, and verification",
155
+ path: ["uiStates"],
156
+ });
157
+ if (!state.applicable && !state.notApplicableReason)
158
+ ctx.addIssue({
159
+ code: "custom",
160
+ message: "non-applicable UI state requires reason",
161
+ path: ["uiStates"],
162
+ });
163
+ }
164
+ });
165
+ const SECRET_KEY = /(?:password|passwd|secret|token|api[_-]?key|private[_-]?key|credential|authorization)/i;
166
+ const SECRET_VALUE = /(?:-----BEGIN [A-Z ]*PRIVATE KEY-----|\b(?:sk|ghp|github_pat|xox[baprs]|AKIA)[-_A-Za-z0-9]{12,}\b)/;
167
+ function secretIssues(value, at = "$", issues = []) {
168
+ if (typeof value === "string" && SECRET_VALUE.test(value))
169
+ issues.push(`${at}: secret-like value is forbidden`);
170
+ if (Array.isArray(value))
171
+ value.forEach((child, index) => secretIssues(child, `${at}[${index}]`, issues));
172
+ else if (value && typeof value === "object")
173
+ for (const [key, child] of Object.entries(value)) {
174
+ if (SECRET_KEY.test(key))
175
+ issues.push(`${at}.${key}: secret-shaped field name is forbidden`);
176
+ secretIssues(child, `${at}.${key}`, issues);
177
+ }
178
+ return issues;
179
+ }
180
+ export function extractFrontendImplementationJson(text) {
181
+ const trimmed = text.trim();
182
+ if (trimmed.startsWith("{") && trimmed.endsWith("}"))
183
+ return JSON.parse(trimmed);
184
+ const blocks = [...trimmed.matchAll(/```json\s*\n([\s\S]*?)\n```/gi)];
185
+ if (blocks.length !== 1)
186
+ throw new Error("output must contain exactly one fenced json object");
187
+ return JSON.parse(blocks[0][1]);
188
+ }
189
+ export async function materializeFrontendImplementationContract(input) {
190
+ if (!input.sourceBinding)
191
+ throw new Error("frontend implementation contract gate requires DAG sourceBinding");
192
+ const record = JSON.parse(await readFile(path.join(input.runDir, `${input.fromNodeId}.json`), "utf8"));
193
+ let parsed;
194
+ try {
195
+ parsed = extractFrontendImplementationJson(record.assistantText?.trim() || record.stdout?.trim() || "");
196
+ }
197
+ catch (error) {
198
+ throw new Error(`invalid-output: ${error instanceof Error ? error.message : String(error)}`);
199
+ }
200
+ const secrets = secretIssues(parsed);
201
+ if (secrets.length)
202
+ throw new Error(`invalid-output: ${secrets.join("; ")}`);
203
+ const result = frontendImplementationContractSchema.safeParse(parsed);
204
+ if (!result.success)
205
+ throw new Error(`invalid-output: ${result.error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`).join("; ")}`);
206
+ const requirement = input.sourceBinding.sources.find((source) => source.kind === "requirement");
207
+ const refs = input.sourceBinding.sources
208
+ .filter((source) => source.kind === "reference")
209
+ .map((source) => source.path)
210
+ .sort();
211
+ const bound = result.data.sourceBinding;
212
+ if (!requirement ||
213
+ bound.taskId !== input.sourceBinding.taskId ||
214
+ bound.requirementPath !== requirement.path ||
215
+ bound.requirementSha256 !== requirement.sha256 ||
216
+ JSON.stringify([...bound.referencePaths].sort()) !== JSON.stringify(refs) ||
217
+ JSON.stringify(bound.requirementIds) !==
218
+ JSON.stringify(input.sourceBinding.requirementIds))
219
+ throw new Error("frontend contract source binding does not match DAG source binding");
220
+ const blockingGaps = [
221
+ ...result.data.evidenceGaps,
222
+ ...result.data.requirements.flatMap((item) => item.evidenceGap ? [item.evidenceGap] : []),
223
+ ].filter((item) => item.blocking);
224
+ if (blockingGaps.length > 0)
225
+ throw new Error(`frontend contract has blocking evidence gap: ${blockingGaps
226
+ .map((item) => item.requirementId ?? item.description)
227
+ .join(", ")}`);
228
+ for (const requirementId of bound.requirementIds)
229
+ if (!result.data.requirements.some((item) => item.id === requirementId) &&
230
+ !result.data.evidenceGaps.some((item) => item.requirementId === requirementId))
231
+ throw new Error(`frontend contract does not cover ${requirementId}`);
232
+ const artifactPath = await writeDagRunJsonArtifact(input.runDir, path.posix.join(input.outputDir, input.artifactName), result.data);
233
+ return {
234
+ path: artifactPath,
235
+ sha256: createHash("sha256")
236
+ .update(`${JSON.stringify(result.data, null, 2)}\n`)
237
+ .digest("hex"),
238
+ schemaId: FRONTEND_IMPLEMENTATION_CONTRACT_SCHEMA_ID,
239
+ };
240
+ }
@@ -0,0 +1,309 @@
1
+ /**
2
+ * Generation-time frontend project capability discovery (M5/M6).
3
+ * Strong evidence only: package.json deps, config files, source imports.
4
+ * Lockfile-only or directory-name-only must NOT activate adapters.
5
+ */
6
+ import { readFile, readdir, stat } from "node:fs/promises";
7
+ import path from "node:path";
8
+ async function exists(filePath) {
9
+ try {
10
+ await stat(filePath);
11
+ return true;
12
+ }
13
+ catch {
14
+ return false;
15
+ }
16
+ }
17
+ async function readJson(filePath) {
18
+ try {
19
+ return JSON.parse(await readFile(filePath, "utf8"));
20
+ }
21
+ catch {
22
+ return null;
23
+ }
24
+ }
25
+ function allDeps(pkg) {
26
+ return {
27
+ ...(pkg.dependencies ?? {}),
28
+ ...(pkg.devDependencies ?? {}),
29
+ ...(pkg.peerDependencies ?? {}),
30
+ };
31
+ }
32
+ function hasDep(deps, name) {
33
+ return Object.hasOwn(deps, name);
34
+ }
35
+ async function listOpenSpec(repoRoot) {
36
+ const root = path.join(repoRoot, "openSpec");
37
+ if (!(await exists(root)))
38
+ return [];
39
+ const out = [];
40
+ async function walk(dir, depth) {
41
+ if (depth > 4)
42
+ return;
43
+ let entries = [];
44
+ try {
45
+ entries = await readdir(dir);
46
+ }
47
+ catch {
48
+ return;
49
+ }
50
+ for (const name of entries) {
51
+ const full = path.join(dir, name);
52
+ try {
53
+ const info = await stat(full);
54
+ if (info.isDirectory())
55
+ await walk(full, depth + 1);
56
+ else if (/\.(md|mdx|json)$/i.test(name)) {
57
+ out.push(path.relative(repoRoot, full).replace(/\\/g, "/"));
58
+ }
59
+ }
60
+ catch {
61
+ // skip
62
+ }
63
+ }
64
+ }
65
+ await walk(root, 0);
66
+ return out.slice(0, 40);
67
+ }
68
+ export function buildAdapterGuidance(capability) {
69
+ const lines = [
70
+ "## Frontend project capability (generation-time)",
71
+ `Framework: ${capability.framework}${capability.frameworkVersion ? `@${capability.frameworkVersion}` : ""}`,
72
+ `Evidence: ${capability.evidencePaths.join(", ") || "(none)"}`,
73
+ "Rules: openSpec/** and task sources outrank adapter tips; do not invent APIs for unknown versions; lockfile-only is not enough.",
74
+ ];
75
+ if (capability.framework === "react") {
76
+ lines.push("React adapter: prefer function components + hooks; reuse existing Testing Library / Vitest patterns; do not introduce new state libs without authorization.");
77
+ }
78
+ else if (capability.framework === "next") {
79
+ lines.push("Next.js adapter: respect App vs Pages router from evidence; keep server/client boundaries explicit; avoid guessing cache/navigation APIs across major versions.");
80
+ }
81
+ else if (capability.framework === "vue") {
82
+ lines.push("Vue adapter: prefer Composition API if project already uses it; reuse Pinia/Vue Router/Vue Query only when evidenced; Vitest + Vue Test Utils when present.");
83
+ }
84
+ else {
85
+ lines.push("Unknown framework: use generic frontend-implementation skill only; do not assume React/Vue/Next APIs.");
86
+ }
87
+ if (capability.a11y.status === "present") {
88
+ lines.push(`A11y tools present: ${capability.a11y.tools.join(", ")}. Report static/component-level evidence only; Browser a11y remains not-run.`);
89
+ }
90
+ else {
91
+ lines.push("A11y tools: absent/unknown — mark a11y checks unavailable/not-run; do not install tools.");
92
+ }
93
+ if (capability.designEvidence.normativePaths.length) {
94
+ lines.push(`Normative design paths: ${capability.designEvidence.normativePaths.slice(0, 8).join(", ")}`);
95
+ }
96
+ return lines.join("\n");
97
+ }
98
+ /**
99
+ * Discover frontend project capability from repo root.
100
+ * Strong evidence: package.json direct deps + config/bootstrap files.
101
+ */
102
+ export async function discoverFrontendProjectCapability(repoRoot) {
103
+ const evidencePaths = [];
104
+ const reasons = [];
105
+ const pkgPath = path.join(repoRoot, "package.json");
106
+ const pkgRaw = await readJson(pkgPath);
107
+ if (!pkgRaw || typeof pkgRaw !== "object") {
108
+ const base = {
109
+ schemaVersion: 1,
110
+ framework: "unknown",
111
+ state: [],
112
+ dataFetching: [],
113
+ componentLibrary: [],
114
+ style: [],
115
+ testRunner: [],
116
+ mock: [],
117
+ a11y: { status: "unknown", tools: [], evidencePaths: [] },
118
+ evidencePaths: [],
119
+ reasons: ["package.json missing or unreadable"],
120
+ designEvidence: {
121
+ normativePaths: [],
122
+ advisoryPaths: [],
123
+ conflicts: [],
124
+ },
125
+ };
126
+ return { ...base, adapterGuidance: buildAdapterGuidance(base) };
127
+ }
128
+ evidencePaths.push("package.json");
129
+ const deps = allDeps(pkgRaw);
130
+ // Lockfile alone does not activate
131
+ for (const lock of ["package-lock.json", "pnpm-lock.yaml", "yarn.lock"]) {
132
+ if (await exists(path.join(repoRoot, lock))) {
133
+ reasons.push(`${lock} present but not used as sole activation evidence`);
134
+ }
135
+ }
136
+ let framework = "unknown";
137
+ let frameworkVersion;
138
+ const configHits = [];
139
+ const nextConfig = ["next.config.js", "next.config.mjs", "next.config.ts"];
140
+ for (const name of nextConfig) {
141
+ if (await exists(path.join(repoRoot, name))) {
142
+ configHits.push(name);
143
+ evidencePaths.push(name);
144
+ }
145
+ }
146
+ if (hasDep(deps, "next") && configHits.some((c) => c.startsWith("next"))) {
147
+ framework = "next";
148
+ frameworkVersion = deps.next?.replace(/^[^\d]*/, "");
149
+ reasons.push("next dependency + next.config*");
150
+ }
151
+ else if (hasDep(deps, "next") && configHits.length === 0) {
152
+ // dep without config: still weak if only transitive — require direct dep
153
+ framework = "next";
154
+ frameworkVersion = deps.next?.replace(/^[^\d]*/, "");
155
+ reasons.push("next direct dependency (config not found)");
156
+ evidencePaths.push("package.json#dependencies.next");
157
+ }
158
+ if (framework === "unknown") {
159
+ const vueConfig = ["vite.config.ts", "vite.config.js", "vue.config.js"];
160
+ let vueCfg = false;
161
+ for (const name of vueConfig) {
162
+ if (await exists(path.join(repoRoot, name))) {
163
+ vueCfg = true;
164
+ evidencePaths.push(name);
165
+ }
166
+ }
167
+ if (hasDep(deps, "vue") && (vueCfg || hasDep(deps, "nuxt"))) {
168
+ framework = "vue";
169
+ frameworkVersion = deps.vue?.replace(/^[^\d]*/, "");
170
+ reasons.push("vue direct dependency + config/tooling");
171
+ }
172
+ }
173
+ if (framework === "unknown" && hasDep(deps, "react")) {
174
+ // Need config or jsx tooling — not lockfile-only
175
+ const reactCfg = (await exists(path.join(repoRoot, "vite.config.ts"))) ||
176
+ (await exists(path.join(repoRoot, "vite.config.js"))) ||
177
+ (await exists(path.join(repoRoot, "webpack.config.js"))) ||
178
+ hasDep(deps, "react-scripts") ||
179
+ hasDep(deps, "vite");
180
+ if (reactCfg) {
181
+ framework = "react";
182
+ frameworkVersion = deps.react?.replace(/^[^\d]*/, "");
183
+ reasons.push("react direct dependency + bundler/tooling evidence");
184
+ evidencePaths.push("package.json#dependencies.react");
185
+ }
186
+ else {
187
+ reasons.push("react listed but no strong config/bundler evidence — framework=unknown");
188
+ }
189
+ }
190
+ const state = [];
191
+ for (const lib of [
192
+ "redux",
193
+ "@reduxjs/toolkit",
194
+ "zustand",
195
+ "jotai",
196
+ "recoil",
197
+ "pinia",
198
+ "vuex",
199
+ ]) {
200
+ if (hasDep(deps, lib))
201
+ state.push(lib);
202
+ }
203
+ const dataFetching = [];
204
+ for (const lib of [
205
+ "@tanstack/react-query",
206
+ "swr",
207
+ "axios",
208
+ "@tanstack/vue-query",
209
+ "ofetch",
210
+ ]) {
211
+ if (hasDep(deps, lib))
212
+ dataFetching.push(lib);
213
+ }
214
+ const componentLibrary = [];
215
+ for (const lib of [
216
+ "antd",
217
+ "@mui/material",
218
+ "element-plus",
219
+ "vuetify",
220
+ "@chakra-ui/react",
221
+ ]) {
222
+ if (hasDep(deps, lib))
223
+ componentLibrary.push(lib);
224
+ }
225
+ const style = [];
226
+ for (const lib of [
227
+ "tailwindcss",
228
+ "sass",
229
+ "less",
230
+ "styled-components",
231
+ "@emotion/react",
232
+ ]) {
233
+ if (hasDep(deps, lib))
234
+ style.push(lib);
235
+ }
236
+ const testRunner = [];
237
+ for (const lib of [
238
+ "vitest",
239
+ "jest",
240
+ "@testing-library/react",
241
+ "@testing-library/vue",
242
+ "@playwright/test",
243
+ ]) {
244
+ if (hasDep(deps, lib))
245
+ testRunner.push(lib);
246
+ }
247
+ const mock = [];
248
+ for (const lib of ["msw", "nock", "miragejs"]) {
249
+ if (hasDep(deps, lib))
250
+ mock.push(lib);
251
+ }
252
+ const a11yTools = [];
253
+ const a11yEvidence = [];
254
+ for (const lib of [
255
+ "eslint-plugin-jsx-a11y",
256
+ "@axe-core/react",
257
+ "jest-axe",
258
+ "vitest-axe",
259
+ "axe-core",
260
+ ]) {
261
+ if (hasDep(deps, lib)) {
262
+ a11yTools.push(lib);
263
+ a11yEvidence.push(`package.json#${lib}`);
264
+ }
265
+ }
266
+ const a11y = {
267
+ status: (a11yTools.length > 0 ? "present" : "absent"),
268
+ tools: a11yTools,
269
+ evidencePaths: a11yEvidence,
270
+ };
271
+ let router;
272
+ if (hasDep(deps, "react-router-dom") || hasDep(deps, "react-router")) {
273
+ router = "react-router";
274
+ }
275
+ if (framework === "next")
276
+ router = router ?? "next-router";
277
+ if (hasDep(deps, "vue-router"))
278
+ router = "vue-router";
279
+ const openSpec = await listOpenSpec(repoRoot);
280
+ const designEvidence = {
281
+ normativePaths: openSpec,
282
+ advisoryPaths: [],
283
+ conflicts: [],
284
+ };
285
+ if (openSpec.length)
286
+ evidencePaths.push(...openSpec.slice(0, 5));
287
+ const base = {
288
+ schemaVersion: 1,
289
+ framework,
290
+ frameworkVersion,
291
+ router,
292
+ state,
293
+ dataFetching,
294
+ componentLibrary,
295
+ style,
296
+ testRunner,
297
+ mock,
298
+ a11y,
299
+ packageManager: (await exists(path.join(repoRoot, "pnpm-lock.yaml")))
300
+ ? "pnpm"
301
+ : (await exists(path.join(repoRoot, "yarn.lock")))
302
+ ? "yarn"
303
+ : "npm",
304
+ evidencePaths: [...new Set(evidencePaths)],
305
+ reasons,
306
+ designEvidence,
307
+ };
308
+ return { ...base, adapterGuidance: buildAdapterGuidance(base) };
309
+ }