@tea-agent/loop-agent 0.16.1-beta.2 → 0.16.1

package/dist/worker/delivery/verification-bundle.js

@@ -3,6 +3,7 @@ import { mkdir, readFile, realpath, rename, unlink, writeFile } from "node:fs/pr
 import path from "node:path";
 import { z } from "zod";
 import { controllerIdentitiesMatch } from "../loop-agent/loop-agent-client.js";
+import { artifactMatchesEvidenceToken, isShellVerificationToken, } from "../outcomes/evidence-tokens.js";
 import { readVerifiedOutcome } from "../outcomes/store.js";
 import { getTaskPoolRoot, readFeatureTaskPoolStates } from "../pool/run-store.js";
 import { workflowSchema } from "../task-spec/workflow-routing.js";
@@ -30,7 +31,12 @@ const bundleOutcomeSchema = z
     outcomePath: z.string().min(1),
     outcomeSha256: z.string().regex(/^[a-f0-9]{64}$/),
     acceptanceCoverage: z.array(z.string().min(1)),
-    artifacts: z.array(z.object({ path: z.string().min(1), sha256: z.string().regex(/^[a-f0-9]{64}$/), kind: z.string().min(1).optional() }).strict()),
+    artifacts: z.array(z.object({
+        path: z.string().min(1),
+        sha256: z.string().regex(/^[a-f0-9]{64}$/),
+        kind: z.string().min(1).optional(),
+        schemaId: z.string().min(1).optional(),
+    }).strict()),
     integrationStatus: z.object({ mock: z.boolean(), real: z.boolean() }).strict(),
     outcomeStatus: z.enum(["succeeded", "failed"]),
     controllerIdentity: z
@@ -243,7 +249,12 @@ function projectBundleAcceptance(item, backendTests, frontendTests, implementati
     return { acId: item.id, status: "covered", priority: item.priority };
 }
 function evidenceKindPresent(entry, kind) {
-    return entry.artifacts.some((artifact) => artifact.kind === kind);
+    if (isShellVerificationToken(kind)) {
+        // Bundle outcomes do not embed shellVerification; shell evidence is
+        // already implied by outcomeStatus === "succeeded" for typed tests.
+        return entry.outcomeStatus === "succeeded";
+    }
+    return entry.artifacts.some((artifact) => artifactMatchesEvidenceToken(artifact, kind));
 }
 function isTypedVerificationWorkflow(workflow) {
     return TYPED_VERIFICATION_WORKFLOWS.includes(workflow);

package/dist/worker/feature/review.js

@@ -4,6 +4,7 @@ import path from "node:path";
 import YAML from "yaml";
 import { z } from "zod";
 import { getRunsJsonlPath, getTaskPoolRoot, readFeatureTaskPoolStates, readJsonlFile } from "../pool/run-store.js";
+import { artifactMatchesEvidenceToken, isShellVerificationToken, } from "../outcomes/evidence-tokens.js";
 import { readVerifiedOutcome } from "../outcomes/store.js";
 import { acceptanceSpecSchema } from "../task-graph/acceptance-schema.js";
 import { taskGraphSpecSchema } from "../task-graph/task-graph-schema.js";
@@ -591,9 +592,9 @@ export function projectDualCoverage(item, states, outcomes, failed, done, expect
         return "awaiting-verification";
     }
     const requiredEvidence = item.verification.required_evidence ?? [];
-    if (requiredEvidence.some((kind) => !verEnvelopes.some(({ envelope }) => kind === "shell-verification"
+    if (requiredEvidence.some((token) => !verEnvelopes.some(({ envelope }) => isShellVerificationToken(token)
         ? envelope.shellVerification?.exitZero === true
-        : envelope.artifacts?.some((artifact) => artifact.kind === kind)))) {
+        : envelope.artifacts?.some((artifact) => artifactMatchesEvidenceToken(artifact, token))))) {
         return "awaiting-verification";
     }
     // 3. integration policy: real-required demands real evidence on every

package/dist/worker/observe/static/dag-helpers.js

@@ -2,11 +2,9 @@
 import { UI_TEXT } from "./constants.js";
 import { el } from "./dom.js";
 import {
-	badge,
 	dagStatusBadge,
 	formatDuration,
 	formatAgo,
-	formatMs,
 } from "./format.js";
 import { navigate } from "./router.js";
 
@@ -139,63 +137,3 @@ export function getActiveNodes(dag) {
 	card.appendChild(link);
 	return card;
 }
-
-export function renderRankLanes(dag) {
-	const container = el("div", "rank-lanes");
-	const nodes = dag.nodes ?? [];
-	const ranks = dag.ranks;
-	const rankGroups = new Map();
-
-	if (ranks && ranks.length > 0) {
-		for (let i = 0; i < ranks.length; i++) {
-			rankGroups.set(String(i), ranks[i]);
-		}
-		for (const node of nodes) {
-			const rank = node.rank ?? "—";
-			if (!rankGroups.has(rank)) {
-				rankGroups.set(rank, [node.nodeId]);
-			} else if (!rankGroups.get(rank).includes(node.nodeId)) {
-				rankGroups.get(rank).push(node.nodeId);
-			}
-		}
-	} else {
-		for (const node of nodes) {
-			const rank = node.rank ?? "—";
-			const list = rankGroups.get(rank) ?? [];
-			list.push(node.nodeId);
-			rankGroups.set(rank, list);
-		}
-	}
-
-	const sortedRanks = [...rankGroups.keys()].sort((a, b) => {
-		const na = Number(a);
-		const nb = Number(b);
-		if (!Number.isNaN(na) && !Number.isNaN(nb)) return na - nb;
-		return a.localeCompare(b);
-	});
-
-	const nodeById = Object.fromEntries(nodes.map((n) => [n.nodeId, n]));
-
-	for (const rank of sortedRanks) {
-		const lane = el("div", "rank-lane");
-		lane.appendChild(el("div", "rank-lane-label", `第 ${rank} 层`));
-		const chips = el("div", "rank-lane-nodes");
-		for (const nodeId of rankGroups.get(rank) ?? []) {
-			const node = nodeById[nodeId] ?? { nodeId };
-			const chip = el("div", "rank-node-chip");
-			if (isNodeActive(node.status)) chip.classList.add("rank-node-active");
-			if (isNodeFailed(node.status)) chip.classList.add("rank-node-error");
-			chip.appendChild(el("span", "rank-node-id", nodeId));
-			if (node.status) chip.appendChild(badge(node.status));
-			if (node.durationMs !== undefined) {
-				chip.appendChild(
-					el("span", "rank-node-dur", formatMs(node.durationMs)),
-				);
-			}
-			chips.appendChild(chip);
-		}
-		lane.appendChild(chips);
-		container.appendChild(lane);
-	}
-	return container;
-}

package/dist/worker/observe/static/styles.css

@@ -70,10 +70,10 @@ a {
 code,
 pre,
 .output-block,
-.rank-node-id,
 .dag-node-label,
 .dag-node-meta,
 .dag-node-status,
+.dag-node-table td:nth-child(2),
 td:first-child,
 .meta-item dd,
 .header-refresh,
@@ -1462,35 +1462,43 @@ body.is-resizing-dag-graph {
 }
 .dag-node-table th:nth-child(1),
 .dag-node-table td:nth-child(1) {
-	width: 19%;
+	width: 5%;
 }
 .dag-node-table th:nth-child(2),
 .dag-node-table td:nth-child(2) {
-	width: 7%;
+	width: 17%;
 }
 .dag-node-table th:nth-child(3),
 .dag-node-table td:nth-child(3) {
-	width: 12%;
+	width: 7%;
 }
 .dag-node-table th:nth-child(4),
 .dag-node-table td:nth-child(4) {
-	width: 16%;
+	width: 11%;
 }
 .dag-node-table th:nth-child(5),
 .dag-node-table td:nth-child(5) {
-	width: 12%;
+	width: 15%;
 }
 .dag-node-table th:nth-child(6),
 .dag-node-table td:nth-child(6) {
-	width: 9%;
+	width: 11%;
 }
 .dag-node-table th:nth-child(7),
 .dag-node-table td:nth-child(7) {
+	width: 9%;
+}
+.dag-node-table th:nth-child(8),
+.dag-node-table td:nth-child(8) {
 	width: 25%;
 }
-.dag-node-table td:nth-child(1),
-.dag-node-table td:nth-child(4),
-.dag-node-table td:nth-child(7) {
+.dag-node-table th:first-child,
+.dag-node-table td:first-child {
+	text-align: center;
+}
+.dag-node-table td:nth-child(2),
+.dag-node-table td:nth-child(5),
+.dag-node-table td:nth-child(8) {
 	overflow-wrap: anywhere;
 }
 .dag-active-node {
@@ -1503,51 +1511,6 @@ body.is-resizing-dag-graph {
 	box-shadow: inset 3px 0 0 var(--orange);
 }
 
-.rank-lanes {
-	display: grid;
-	gap: var(--space-3);
-}
-.rank-lane {
-	display: grid;
-	grid-template-columns: 56px minmax(0, 1fr);
-	gap: var(--space-3);
-	align-items: center;
-}
-.rank-lane-label {
-	color: var(--muted);
-	font-size: 11px;
-	font-weight: 700;
-}
-.rank-lane-nodes {
-	display: flex;
-	flex-wrap: wrap;
-	gap: 8px;
-}
-.rank-node-chip {
-	display: inline-flex;
-	align-items: center;
-	gap: 7px;
-	min-height: 32px;
-	padding: 5px 8px;
-	border: 1px solid var(--hairline);
-	border-radius: var(--radius-sm);
-	background: var(--canvas-soft);
-}
-.rank-node-active {
-	border-color: var(--orange);
-}
-.rank-node-error {
-	border-color: var(--red);
-}
-.rank-node-id {
-	color: var(--ink);
-	font-size: 11px;
-}
-.rank-node-dur {
-	color: var(--muted);
-	font-size: 11px;
-}
-
 .process-timeline-note {
 	margin: 0 0 var(--space-2);
 	color: var(--muted);

package/dist/worker/observe/static/views/dag.js

@@ -82,7 +82,6 @@ import {
 	isNodeFailed,
 	isNodeFinished,
 	isNodeActive,
-	renderRankLanes,
 } from "../dag-helpers.js";
 import { findBatchRunIdForTask } from "../run-processing.js";
 import { renderDagGraph } from "./dag-graph.js";
@@ -275,7 +274,6 @@ export async function renderDagDetail(dagRunId, initial = true) {
 		clearNode(ranksEl);
 		ranksEl.appendChild(el("h3", null, "DAG 依赖图"));
 		ranksEl.appendChild(renderDagGraph(dag, dagRunId, null));
-		ranksEl.appendChild(renderRankLanes(dag));
 	}
 
 	const nodesScrollLeft = nodesEl.scrollLeft;
@@ -298,7 +296,7 @@ export async function renderDagDetail(dagRunId, initial = true) {
 			return a.nodeId.localeCompare(b.nodeId);
 		});
 
-		const rows = sortedNodes.map((node) => {
+		const rows = sortedNodes.map((node, index) => {
 			const active = isNodeActive(node.status);
 			const failed = isNodeFailed(node.status);
 			let className = "";
@@ -313,6 +311,7 @@ export async function renderDagDetail(dagRunId, initial = true) {
 				className,
 				onClick: () => selectDagNode(dagRunId, node.nodeId),
 				cells: [
+					index + 1,
 					node.nodeId,
 					node.rank ?? "—",
 					node.executor ?? "—",
@@ -324,12 +323,21 @@ export async function renderDagDetail(dagRunId, initial = true) {
 			};
 		});
 		const nodeTable = buildTable(
-			["节点 ID", "依赖层", "执行方式", "模型", "状态", "耗时", "备注"],
+			[
+				"序号",
+				"节点 ID",
+				"依赖层",
+				"执行方式",
+				"模型",
+				"状态",
+				"耗时",
+				"备注",
+			],
 			rows,
 		);
 		nodeTable.classList.add("dag-node-table");
 		for (const row of nodeTable.tBodies[0]?.rows ?? []) {
-			for (const columnIndex of [0, 3, 6]) {
+			for (const columnIndex of [1, 4, 7]) {
 				const cell = row.cells[columnIndex];
 				if (cell?.textContent) cell.title = cell.textContent;
 			}

package/dist/worker/outcomes/adapters.js

@@ -1,4 +1,5 @@
 import path from "node:path";
+import { splitStructuredArtifactIdentity } from "./evidence-tokens.js";
 /**
  * Shared artifact extraction. Every successful worker run produces a canonical
  * `run_record` (the worker-run-record.json) and a `dag` (the generated DAG
@@ -43,10 +44,12 @@ function structuredArtifactsFromReport(run) {
         if (node.structuredArtifactPath &&
             node.structuredArtifactSha256 &&
             node.structuredArtifactSchemaId) {
+            const identity = splitStructuredArtifactIdentity(node.structuredArtifactSchemaId);
             artifacts.push({
                 path: node.structuredArtifactPath,
                 sha256: node.structuredArtifactSha256,
-                kind: node.structuredArtifactSchemaId,
+                kind: identity.kind,
+                schemaId: identity.schemaId,
             });
         }
     }

package/dist/worker/outcomes/declared-artifacts.js

@@ -0,0 +1,103 @@
+/** Identity key for domain artifact uniqueness within one Outcome. */
+export function artifactIdentityKey(kind, schemaId) {
+    return `${kind}::${schemaId ?? ""}`;
+}
+/**
+ * Minimal glob matcher aligned with Git write-boundary audit.
+ * Supports `*` (one path segment) and `**` (any depth).
+ */
+export function matchesPathGlob(filePath, glob) {
+    const normalizedPath = filePath.replace(/\\/g, "/");
+    const normalizedGlob = glob.replace(/\\/g, "/");
+    let pattern = "^";
+    for (let index = 0; index < normalizedGlob.length; index += 1) {
+        const char = normalizedGlob[index];
+        if (char === "*" && normalizedGlob[index + 1] === "*") {
+            pattern += ".*";
+            index += 1;
+            continue;
+        }
+        if (char === "*") {
+            pattern += "[^/]*";
+            continue;
+        }
+        pattern += char.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    }
+    return new RegExp(`${pattern}$`).test(normalizedPath);
+}
+export function isPathAllowedForTask(filePath, allowedPaths, forbiddenPaths) {
+    const normalized = filePath.replace(/\\/g, "/");
+    if (normalized.startsWith("/") || normalized.includes("..")) {
+        return { ok: false, reason: `artifact path escapes repo or uses traversal: ${filePath}` };
+    }
+    if (forbiddenPaths.some((glob) => matchesPathGlob(normalized, glob))) {
+        return { ok: false, reason: `artifact path is forbidden: ${filePath}` };
+    }
+    if (allowedPaths.length > 0 &&
+        !allowedPaths.some((glob) => matchesPathGlob(normalized, glob))) {
+        return { ok: false, reason: `artifact path is outside allowed_paths: ${filePath}` };
+    }
+    return { ok: true };
+}
+/**
+ * Project path-bound TaskGraph `produces[]` into Outcome artifact claims.
+ * Entries without `path` are skipped (structured DAG artifacts may satisfy them).
+ * Empty sha256 is filled by the projector after on-disk hash recomputation.
+ */
+export function projectDeclaredPathArtifacts(declared) {
+    if (!declared || declared.length === 0)
+        return [];
+    const artifacts = [];
+    for (const entry of declared) {
+        if (!entry.path)
+            continue;
+        artifacts.push({
+            path: entry.path.replace(/\\/g, "/"),
+            sha256: "",
+            kind: entry.kind,
+            ...(entry.schemaId ? { schemaId: entry.schemaId } : {}),
+        });
+    }
+    return artifacts;
+}
+/**
+ * Merge adapter artifacts with declared path bindings.
+ * Same `{kind,schemaId}` must resolve to one path; conflicts fail closed.
+ */
+export function mergeOutcomeArtifacts(input) {
+    const byIdentity = new Map();
+    const withoutIdentity = [];
+    const ingest = (artifact) => {
+        if (!artifact.kind) {
+            withoutIdentity.push(artifact);
+            return undefined;
+        }
+        const key = artifactIdentityKey(artifact.kind, artifact.schemaId);
+        const existing = byIdentity.get(key);
+        if (!existing) {
+            byIdentity.set(key, artifact);
+            return undefined;
+        }
+        const existingPath = existing.path.replace(/\\/g, "/");
+        const nextPath = artifact.path.replace(/\\/g, "/");
+        if (existingPath !== nextPath) {
+            return `duplicate artifact identity ${key} with conflicting paths: ${existingPath} vs ${nextPath}`;
+        }
+        // Prefer the entry that already carries a declared sha256.
+        if (!existing.sha256 && artifact.sha256) {
+            byIdentity.set(key, artifact);
+        }
+        return undefined;
+    };
+    for (const artifact of input.base) {
+        const error = ingest(artifact);
+        if (error)
+            return { ok: false, reason: error };
+    }
+    for (const artifact of input.declared) {
+        const error = ingest(artifact);
+        if (error)
+            return { ok: false, reason: error };
+    }
+    return { ok: true, artifacts: [...withoutIdentity, ...byIdentity.values()] };
+}

package/dist/worker/outcomes/evidence-tokens.js

@@ -0,0 +1,29 @@
+/**
+ * Shared evidence / artifact identity helpers for Outcome gates, Feature review,
+ * and Feature Verification Bundle projection.
+ */
+/** Canonical required-output / required_evidence token for shell exit-zero. */
+export const SHELL_VERIFICATION_TOKEN = "shell_verification";
+/**
+ * Accept the canonical underscore form and the legacy hyphen form used in early
+ * fullstack packets so dual-coverage and bundle evidence stay aligned.
+ */
+export function isShellVerificationToken(token) {
+    return token === SHELL_VERIFICATION_TOKEN || token === "shell-verification";
+}
+/** Match an evidence token against artifact `kind` or `schemaId`. */
+export function artifactMatchesEvidenceToken(artifact, token) {
+    return artifact.kind === token || artifact.schemaId === token;
+}
+/**
+ * Derive stable `kind` + versioned `schemaId` from a DAG structured-artifact
+ * schema id (e.g. `backend-test-result-v1` → kind `backend-test-result`).
+ * Unversioned ids keep kind === schemaId.
+ */
+export function splitStructuredArtifactIdentity(schemaId) {
+    const match = /^(.*)-v\d+$/.exec(schemaId);
+    if (match?.[1]) {
+        return { kind: match[1], schemaId };
+    }
+    return { kind: schemaId, schemaId };
+}

package/dist/worker/outcomes/gate.js

@@ -1,18 +1,16 @@
+import { isShellVerificationToken, } from "./evidence-tokens.js";
+export { artifactMatchesEvidenceToken, isShellVerificationToken, } from "./evidence-tokens.js";
 /**
  * Deterministic required-output gate.
  *
  * The gate runs *after* a successful DAG report. It performs a **literal
- * string match** of each `outputs.required` token against the `kind` of every
- * artifact the adapter produced (and the run-record/dag canonical kinds). A
- * required token with no matching produced artifact fails closed — the run is
- * downgraded from `succeeded` to `failed` with `ContractMismatch`.
+ * string match** of each known `outputs.required` token against produced
+ * artifact kinds (and the shell-verification exit-zero fact).
  *
- * - No regex / substring matching: a token matches only when an artifact
- *   `kind` equals it exactly.
- * - Unknown tokens (no adapter mapping) are simply unmatched → missing. The
- *   gate never invents a mapping and never passes a run missing a known
- *   required output.
- * - An empty `required` list always passes (nothing to enforce).
+ * Known tokens (`run_record`, `dag_json`, `shell_verification` / legacy
+ * `shell-verification`) fail closed when absent. Unknown legacy tokens are
+ * intentionally ignored for compatibility — they never invent a mapping and
+ * never block promotion. An empty `required` list always passes.
  *
  * This gate is the success-criteria guardrail: "DAG report succeeded but a
  * known required output is missing ⇒ the Task must not be marked Done."
@@ -26,7 +24,7 @@ export function checkRequiredOutputs(envelope, requiredOutputs) {
         .filter((value) => Boolean(value)));
     const missing = [];
     for (const token of requiredOutputs) {
-        if (token === "shell_verification") {
+        if (isShellVerificationToken(token)) {
             if (!envelope.shellVerification?.exitZero)
                 missing.push(token);
             continue;
@@ -34,6 +32,7 @@ export function checkRequiredOutputs(envelope, requiredOutputs) {
         if (KNOWN_ARTIFACT_OUTPUTS.has(token) && !producedKinds.has(token)) {
             missing.push(token);
         }
+        // Unknown tokens: intentionally ignored (legacy compatibility).
     }
     return { passed: missing.length === 0, missing };
 }

package/dist/worker/outcomes/projector.js

@@ -3,6 +3,7 @@ import { readFile, stat } from "node:fs/promises";
 import { sha256File } from "../pool/run-store.js";
 import { taskOutcomeEnvelopeV1Schema } from "./types.js";
 import { getOutcomeAdapter } from "./adapters.js";
+import { isPathAllowedForTask, mergeOutcomeArtifacts, projectDeclaredPathArtifacts, } from "./declared-artifacts.js";
 /**
  * Deterministic path-containment guard. Mirrors run-task's `isPathInside`: a
  * path must resolve *inside* the repo root and must not escape it. Absolute
@@ -66,11 +67,27 @@ export async function projectOutcome(input) {
     if (!adapter) {
         return contractError(`no outcome adapter for workflow "${workflow}"`);
     }
-    // 3. Adapter projection (pure; no FS).
+    // 3. Adapter projection (pure; no FS) + frozen graph `produces.path` bindings.
     const adapterProjection = adapter.project(input);
+    const declaredPathArtifacts = projectDeclaredPathArtifacts(input.declaredArtifacts);
+    const allowedPaths = input.taskSpec.constraints?.allowed_paths ?? [];
+    const forbiddenPaths = input.taskSpec.constraints?.forbidden_paths ?? [];
+    for (const artifact of declaredPathArtifacts) {
+        const containment = isPathAllowedForTask(artifact.path, allowedPaths, forbiddenPaths);
+        if (!containment.ok) {
+            return contractError(containment.reason);
+        }
+    }
+    const merged = mergeOutcomeArtifacts({
+        base: adapterProjection.artifacts,
+        declared: declaredPathArtifacts,
+    });
+    if (!merged.ok) {
+        return contractError(merged.reason);
+    }
     // 4. Artifact path + hash validation.
     const validatedArtifacts = [];
-    for (const artifact of adapterProjection.artifacts) {
+    for (const artifact of merged.artifacts) {
         if (!isRepoRelativePath(input.repoRoot, artifact.path)) {
             return contractError(`artifact path is not repo-relative: ${artifact.path}`);
         }
@@ -94,9 +111,10 @@ export async function projectOutcome(input) {
             return contractError(`artifact sha256 mismatch for ${artifact.path}: declared=${artifact.sha256} actual=${recomputed}`);
         }
         validatedArtifacts.push({
-            path: artifact.path,
+            path: artifact.path.replace(/\\/g, "/"),
             sha256: recomputed,
             ...(artifact.kind ? { kind: artifact.kind } : {}),
+            ...(artifact.schemaId ? { schemaId: artifact.schemaId } : {}),
         });
     }
     // 5. Shell verification from report decision (exit-zero = report succeeded).
@@ -113,6 +131,13 @@ export async function projectOutcome(input) {
         }
         : undefined;
     const sourceBinding = input.sourceBinding ?? deriveSourceBinding(input);
+    const outcomeStatus = input.reportDecision.succeeded ? "succeeded" : "failed";
+    const outcomeFailure = outcomeStatus === "failed"
+        ? {
+            category: "EnvFailure",
+            reason: input.reportDecision.reason || "DAG report did not succeed",
+        }
+        : undefined;
     const envelope = {
         schemaVersion: 1,
         identity: {
@@ -131,7 +156,8 @@ export async function projectOutcome(input) {
         integrationStatus: adapterProjection.integrationStatus,
         ...(controllerIdentity ? { controllerIdentity } : {}),
         createdAt: input.now.toISOString(),
-        outcomeStatus: input.reportDecision.succeeded ? "succeeded" : "failed",
+        outcomeStatus,
+        ...(outcomeFailure ? { outcomeFailure } : {}),
     };
     // 6. Strict schema parse.
     const parsed = taskOutcomeEnvelopeV1Schema.safeParse(envelope);

package/dist/worker/outcomes/types.js

@@ -30,7 +30,10 @@ export const OUTCOME_WORKFLOWS = [
 export const outcomeArtifactSchema = z.object({
     path: z.string().min(1),
     sha256: z.string().regex(/^[a-f0-9]{64}$/, "sha256 must be lowercase hex"),
+    /** Stable artifact family (e.g. `backend-test-result`). */
     kind: z.string().min(1).optional(),
+    /** Versioned schema id (e.g. `backend-test-result-v1`); orthogonal to kind. */
+    schemaId: z.string().min(1).optional(),
 });
 export const shellVerificationSchema = z.object({
     exitZero: z.boolean(),