@tea-agent/loop-agent 0.16.1 → 0.16.2

package/dist/workflows/dag/frontend-implementation-contract.js

@@ -186,6 +186,26 @@ export function extractFrontendImplementationJson(text) {
         throw new Error("output must contain exactly one fenced json object");
     return JSON.parse(blocks[0][1]);
 }
+/**
+ * Build the authoritative frontend-implementation-contract sourceBinding from
+ * the DAG-owned binding. Model JSON must not invent taskId/path/sha256; the
+ * gate overwrites whatever the model emitted so identity cannot drift.
+ */
+export function canonicalFrontendContractSourceBinding(binding) {
+    const requirement = binding.sources.find((source) => source.kind === "requirement");
+    if (!requirement)
+        throw new Error("frontend implementation contract gate requires a requirement source in DAG sourceBinding");
+    return {
+        taskId: binding.taskId,
+        requirementPath: requirement.path,
+        requirementSha256: requirement.sha256,
+        referencePaths: binding.sources
+            .filter((source) => source.kind === "reference")
+            .map((source) => source.path)
+            .sort(),
+        requirementIds: [...binding.requirementIds],
+    };
+}
 export async function materializeFrontendImplementationContract(input) {
     if (!input.sourceBinding)
         throw new Error("frontend implementation contract gate requires DAG sourceBinding");
@@ -200,23 +220,19 @@ export async function materializeFrontendImplementationContract(input) {
     const secrets = secretIssues(parsed);
     if (secrets.length)
         throw new Error(`invalid-output: ${secrets.join("; ")}`);
-    const result = frontendImplementationContractSchema.safeParse(parsed);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        throw new Error("invalid-output: frontend contract must be a JSON object");
+    const canonicalBinding = canonicalFrontendContractSourceBinding(input.sourceBinding);
+    // Always inject DAG-owned identity. Model-provided sourceBinding is advisory
+    // only and must not fail a otherwise-valid contract (common live failure:
+    // wrong requirementPath/sha, extra referencePaths, or omitted binding).
+    const withCanonicalBinding = {
+        ...parsed,
+        sourceBinding: canonicalBinding,
+    };
+    const result = frontendImplementationContractSchema.safeParse(withCanonicalBinding);
     if (!result.success)
         throw new Error(`invalid-output: ${result.error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`).join("; ")}`);
-    const requirement = input.sourceBinding.sources.find((source) => source.kind === "requirement");
-    const refs = input.sourceBinding.sources
-        .filter((source) => source.kind === "reference")
-        .map((source) => source.path)
-        .sort();
-    const bound = result.data.sourceBinding;
-    if (!requirement ||
-        bound.taskId !== input.sourceBinding.taskId ||
-        bound.requirementPath !== requirement.path ||
-        bound.requirementSha256 !== requirement.sha256 ||
-        JSON.stringify([...bound.referencePaths].sort()) !== JSON.stringify(refs) ||
-        JSON.stringify(bound.requirementIds) !==
-            JSON.stringify(input.sourceBinding.requirementIds))
-        throw new Error("frontend contract source binding does not match DAG source binding");
     const blockingGaps = [
         ...result.data.evidenceGaps,
         ...result.data.requirements.flatMap((item) => item.evidenceGap ? [item.evidenceGap] : []),
@@ -225,7 +241,7 @@ export async function materializeFrontendImplementationContract(input) {
         throw new Error(`frontend contract has blocking evidence gap: ${blockingGaps
             .map((item) => item.requirementId ?? item.description)
             .join(", ")}`);
-    for (const requirementId of bound.requirementIds)
+    for (const requirementId of canonicalBinding.requirementIds)
         if (!result.data.requirements.some((item) => item.id === requirementId) &&
             !result.data.evidenceGaps.some((item) => item.requirementId === requirementId))
             throw new Error(`frontend contract does not cover ${requirementId}`);