@tea-agent/loop-agent 0.16.1 → 0.16.3

package/dist/workflows/dag/frontend-implementation-contract.js

@@ -186,6 +186,26 @@ export function extractFrontendImplementationJson(text) {
         throw new Error("output must contain exactly one fenced json object");
     return JSON.parse(blocks[0][1]);
 }
+/**
+ * Build the authoritative frontend-implementation-contract sourceBinding from
+ * the DAG-owned binding. Model JSON must not invent taskId/path/sha256; the
+ * gate overwrites whatever the model emitted so identity cannot drift.
+ */
+export function canonicalFrontendContractSourceBinding(binding) {
+    const requirement = binding.sources.find((source) => source.kind === "requirement");
+    if (!requirement)
+        throw new Error("frontend implementation contract gate requires a requirement source in DAG sourceBinding");
+    return {
+        taskId: binding.taskId,
+        requirementPath: requirement.path,
+        requirementSha256: requirement.sha256,
+        referencePaths: binding.sources
+            .filter((source) => source.kind === "reference")
+            .map((source) => source.path)
+            .sort(),
+        requirementIds: [...binding.requirementIds],
+    };
+}
 export async function materializeFrontendImplementationContract(input) {
     if (!input.sourceBinding)
         throw new Error("frontend implementation contract gate requires DAG sourceBinding");
@@ -200,23 +220,19 @@ export async function materializeFrontendImplementationContract(input) {
     const secrets = secretIssues(parsed);
     if (secrets.length)
         throw new Error(`invalid-output: ${secrets.join("; ")}`);
-    const result = frontendImplementationContractSchema.safeParse(parsed);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        throw new Error("invalid-output: frontend contract must be a JSON object");
+    const canonicalBinding = canonicalFrontendContractSourceBinding(input.sourceBinding);
+    // Always inject DAG-owned identity. Model-provided sourceBinding is advisory
+    // only and must not fail a otherwise-valid contract (common live failure:
+    // wrong requirementPath/sha, extra referencePaths, or omitted binding).
+    const withCanonicalBinding = {
+        ...parsed,
+        sourceBinding: canonicalBinding,
+    };
+    const result = frontendImplementationContractSchema.safeParse(withCanonicalBinding);
     if (!result.success)
         throw new Error(`invalid-output: ${result.error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`).join("; ")}`);
-    const requirement = input.sourceBinding.sources.find((source) => source.kind === "requirement");
-    const refs = input.sourceBinding.sources
-        .filter((source) => source.kind === "reference")
-        .map((source) => source.path)
-        .sort();
-    const bound = result.data.sourceBinding;
-    if (!requirement ||
-        bound.taskId !== input.sourceBinding.taskId ||
-        bound.requirementPath !== requirement.path ||
-        bound.requirementSha256 !== requirement.sha256 ||
-        JSON.stringify([...bound.referencePaths].sort()) !== JSON.stringify(refs) ||
-        JSON.stringify(bound.requirementIds) !==
-            JSON.stringify(input.sourceBinding.requirementIds))
-        throw new Error("frontend contract source binding does not match DAG source binding");
     const blockingGaps = [
         ...result.data.evidenceGaps,
         ...result.data.requirements.flatMap((item) => item.evidenceGap ? [item.evidenceGap] : []),
@@ -225,7 +241,7 @@ export async function materializeFrontendImplementationContract(input) {
         throw new Error(`frontend contract has blocking evidence gap: ${blockingGaps
             .map((item) => item.requirementId ?? item.description)
             .join(", ")}`);
-    for (const requirementId of bound.requirementIds)
+    for (const requirementId of canonicalBinding.requirementIds)
         if (!result.data.requirements.some((item) => item.id === requirementId) &&
             !result.data.evidenceGaps.some((item) => item.requirementId === requirementId))
             throw new Error(`frontend contract does not cover ${requirementId}`);

package/dist/workflows/dag/frontend-worktree-diff.js

@@ -0,0 +1,127 @@
+import { createHash } from "node:crypto";
+import { spawn } from "node:child_process";
+import { mkdir, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { writeDagRunJsonArtifact } from "../../infrastructure/harness/artifact-store.js";
+export const FRONTEND_WORKTREE_DIFF_SCHEMA_ID = "frontend-worktree-diff-v1";
+function runGit(cwd, args) {
+    return new Promise((resolve, reject) => {
+        const child = spawn("git", args, {
+            cwd,
+            env: process.env,
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        let stdout = "";
+        let stderr = "";
+        child.stdout.on("data", (chunk) => {
+            stdout += String(chunk);
+        });
+        child.stderr.on("data", (chunk) => {
+            stderr += String(chunk);
+        });
+        child.on("error", reject);
+        child.on("close", (code) => {
+            resolve({ code: code ?? 1, stdout, stderr });
+        });
+    });
+}
+function splitLines(text) {
+    return text
+        .split(/\r?\n/)
+        .map((line) => line.trim())
+        .filter(Boolean);
+}
+/**
+ * Capture the current workspace worktree as a run-owned review artifact.
+ *
+ * Frontend review is contractually required to inspect an "actual diff". The
+ * model cannot invent one, and failure-path `changes.patch` under Task Pool is
+ * not visible while the DAG is still active. This gate freezes a deterministic
+ * patch + inventory under the current run directory before review runs.
+ */
+export async function runFrontendWorktreeDiffGate(input) {
+    const root = path.resolve(input.workspaceRoot);
+    const revParse = await runGit(root, ["rev-parse", "--is-inside-work-tree"]);
+    if (revParse.code !== 0 || revParse.stdout.trim() !== "true") {
+        throw new Error(`frontend worktree diff gate requires a git worktree: ${revParse.stderr.trim() || revParse.stdout.trim() || "not a git repository"}`);
+    }
+    // Match failure capture semantics: binary-capable tracked diff vs HEAD.
+    const diff = await runGit(root, ["diff", "--binary", "HEAD"]);
+    if (diff.code !== 0) {
+        throw new Error(`frontend worktree diff gate git diff failed: ${diff.stderr.trim() || diff.stdout.trim()}`);
+    }
+    const nameOnly = await runGit(root, [
+        "diff",
+        "--name-only",
+        "--diff-filter=ACDMRTUXB",
+        "HEAD",
+    ]);
+    if (nameOnly.code !== 0) {
+        throw new Error(`frontend worktree diff gate git name-only failed: ${nameOnly.stderr.trim() || nameOnly.stdout.trim()}`);
+    }
+    const untracked = await runGit(root, [
+        "ls-files",
+        "--others",
+        "--exclude-standard",
+    ]);
+    if (untracked.code !== 0) {
+        throw new Error(`frontend worktree diff gate ls-files failed: ${untracked.stderr.trim() || untracked.stdout.trim()}`);
+    }
+    const changedFiles = splitLines(nameOnly.stdout).sort();
+    const untrackedFiles = splitLines(untracked.stdout).sort();
+    const patchBody = diff.stdout.endsWith("\n") || diff.stdout.length === 0
+        ? diff.stdout
+        : `${diff.stdout}\n`;
+    const untrackedSection = untrackedFiles.length === 0
+        ? ""
+        : [
+            "",
+            "# Untracked files (inventory only; contents not inlined)",
+            ...untrackedFiles.map((file) => `# untracked: ${file}`),
+            "",
+        ].join("\n");
+    const patchText = `${patchBody}${untrackedSection}`;
+    const patchSha256 = createHash("sha256").update(patchText).digest("hex");
+    const relativePatch = "artifacts/diff_patch.patch";
+    const absolutePatch = path.join(input.runDir, ...relativePatch.split("/"));
+    await mkdir(path.dirname(absolutePatch), { recursive: true });
+    await writeFile(absolutePatch, patchText, "utf8");
+    const payload = {
+        schemaVersion: 1,
+        schemaId: FRONTEND_WORKTREE_DIFF_SCHEMA_ID,
+        patchPath: relativePatch,
+        patchSha256,
+        changedFiles,
+        untrackedFiles,
+        empty: changedFiles.length === 0 && untrackedFiles.length === 0,
+        capturedAt: new Date().toISOString(),
+    };
+    const artifactPath = await writeDagRunJsonArtifact(input.runDir, "contracts/frontend-worktree-diff.json", payload);
+    return {
+        ok: true,
+        schemaId: FRONTEND_WORKTREE_DIFF_SCHEMA_ID,
+        patchPath: relativePatch,
+        patchAbsolutePath: absolutePatch,
+        patchSha256,
+        changedFiles,
+        untrackedFiles,
+        empty: payload.empty,
+        capturedAt: payload.capturedAt,
+        artifactPath,
+    };
+}
+export function formatFrontendWorktreeDiffStdout(result) {
+    return [
+        `schemaId=${result.schemaId}`,
+        `patchPath=${result.patchPath}`,
+        `patchSha256=${result.patchSha256}`,
+        `changedFiles=${result.changedFiles.length}`,
+        `untrackedFiles=${result.untrackedFiles.length}`,
+        `empty=${result.empty ? "true" : "false"}`,
+        result.artifactPath ? `artifactPath=${result.artifactPath}` : "",
+        ...result.changedFiles.map((file) => `changed:${file}`),
+        ...result.untrackedFiles.map((file) => `untracked:${file}`),
+    ]
+        .filter(Boolean)
+        .join("\n");
+}