@tea-agent/loop-agent 0.16.15-beta.0 → 0.16.15

package/CHANGELOG.md

@@ -18,6 +18,54 @@
 - Pi SDK 执行长推理或大段结构化输出时不再把高频流式增量事件无界累积到内存；同一响应在多个生命周期事件中重复出现的 Token 用量只统计一次，避免 `Invalid string length` 和成本数据虚高。
 - 后端测试复合执行节点继续保持 clean environment、失败分类和 fail-closed outcome，并为 initial/final Result、repair eligibility、traceability 与 Observe 投影保留结构化运行证据。
 
+## [0.16.15] - 2026-07-20
+
+### 修复
+
+- frontend-test case manifest 校验接受 `evidenceDir` 为 `testcase/frontend/evidence/<caseId>` 目录根（不必强制尾斜杠/子路径），避免生成节点写出合法目录后被 materialize 门误杀。
+
+## [0.16.14] - 2026-07-20
+
+### 修复
+
+- `frontend-test` materialize / path audit 自动并入 `testcase/frontend/**` 与 `docs/test-reports/**`，与 hybrid frontend-test DAG 生成约束对齐，避免 TaskSpec 仅声明 `tests/e2e/**` 时 `dag run-task` 直接失败。
+
+## [0.16.13] - 2026-07-20
+
+### 修复
+
+- backend-test 的 `finalize-effective-result` 管道在节点完成后绑定 `contracts/backend-test-result.json` 为 structured artifact，使 Outcome 投影出 `backend-test-result`，解除 FE-TEST Ready Planner 对 BE-TEST 产物门的误阻断。
+
+## [0.16.12] - 2026-07-20
+
+### 修复
+
+- `backend-test` materialize / Git checkpoint 自动并入 `testcase/**`（与 `docs/test-reports/**`）运行时写根，避免 TaskSpec 仍写 `tests/api/**` 时绿跑无法 promote、任务卡在 Running。
+
+## [0.16.11] - 2026-07-20
+
+### 修复
+
+- Worker 报告决策不再把条件分支的 `SKIPPED` 节点当成失败；backend-test 等混合 DAG 在 revise/repair 未选中时，只要 ERROR 不存在且 run finished，即可 `report-completed` 并进入 Outcome/promote。
+
+## [0.16.10] - 2026-07-20
+
+### 修复
+
+- 后端测试执行合同物化会清理 `managedCommand` 中的空字符串（如 `stop: ""`），避免 near-schema 侦察输出在 strict parse 下误拦 in-process BE-TEST。
+
+## [0.16.9] - 2026-07-20
+
+### 修复
+
+- Outcome 结构化产物声明不再绑定节点 mint-time sha256；同一路径若被后续 gate（如 backend-test traceability）就地改写，投影时以磁盘重算 hash 为准，消除 BE-TEST 完成态仍被 `artifact sha256 mismatch` 误拦。
+
+## [0.16.8] - 2026-07-20
+
+### 修复
+
+- Outcome 投影对同一 run-owned 结构化产物路径的多次 rewrite（如 backend-test case manifest initial→final）只保留最后一次 hash 声明，避免 `artifact sha256 mismatch` 误拦已完成的 BE-TEST。
+
 ## [0.16.7] - 2026-07-20
 
 ### 修复

package/dist/executors/pi-executor.js

@@ -186,10 +186,6 @@ function resolvePiCliPath() {
         path.join(nvmBase, nodeVersion, 'lib', 'node_modules'),
     ].flatMap((nodeModulesRoot) => PI_CLI_PACKAGE_NAMES.map((packageName) => piCliPathFromPackageRoot(nodeModulesRoot, packageName)));
     const otherCandidates = [
-        // Prefer the project-local Pi dependency. `npm run` adds node_modules/.bin
-        // to PATH, but direct invocations from the DAG runner may not, so resolve
-        // the package from the current workspace explicitly.
-        ...PI_CLI_PACKAGE_NAMES.map((packageName) => piCliPathFromPackageRoot(path.resolve(process.cwd(), 'node_modules'), packageName)),
         // Global npm installation (non-nvm)
         ...PI_CLI_PACKAGE_NAMES.map((packageName) => piCliPathFromPackageRoot('/usr/local/lib/node_modules', packageName)),
         // Bun installation

package/dist/worker/delivery/git-transaction.js

@@ -6,6 +6,8 @@ import path from "node:path";
 import { z } from "zod";
 import { getTaskPoolRoot } from "../pool/run-store.js";
 import { assertSafeRuntimeId } from "../follow-up/paths.js";
+import { expandAllowedPathsForWorkflow } from "../materialize/harness-task-materializer.js";
+import { resolveWorkflow } from "../task-spec/workflow-routing.js";
 const execFileAsync = promisify(execFile);
 const checkpointSchema = z.object({
     taskId: z.string().min(1),
@@ -275,13 +277,14 @@ function auditChangedPaths(changes, taskSpec) {
         throw new Error(audit.violations[0]);
 }
 function auditChangedPathsReport(changes, taskSpec) {
+    const allowedPaths = expandAllowedPathsForWorkflow(resolveWorkflow(taskSpec).workflow, taskSpec.constraints.allowed_paths);
     const violations = [];
     for (const changed of changes) {
         if (/(^|\/)(\.env(?:\.|$)|[^/]*\.(?:pem|key|p12|pfx))$/i.test(changed))
             violations.push(`changed path may contain sensitive material: ${changed}`);
         else if (taskSpec.constraints.forbidden_paths.some((glob) => matchesGlob(changed, glob)))
             violations.push(`changed path is forbidden for ${taskSpec.id}: ${changed}`);
-        else if (!taskSpec.constraints.allowed_paths.some((glob) => matchesGlob(changed, glob)))
+        else if (!allowedPaths.some((glob) => matchesGlob(changed, glob)))
             violations.push(`changed path is outside allowed_paths for ${taskSpec.id}: ${changed}`);
     }
     return { ok: violations.length === 0, violations };

package/dist/worker/materialize/harness-task-materializer.js

@@ -34,13 +34,17 @@ export async function materializeTaskSpec(options) {
     }
     const paths = getTaskPaths(options.repoRoot, harnessTaskId);
     const baseConfig = await loadTaskConfig(options.repoRoot, harnessTaskId);
+    // backend-test hybrid DAG writes under testcase/** (pytest + md cases + helpers).
+    // TaskSpecs often list legacy tests/api/** surfaces; union runtime write roots so
+    // git checkpoint / path guard can promote green BE-TEST runs.
+    const allowedPaths = expandAllowedPathsForWorkflow(resolvedWorkflow.workflow, options.taskSpec.constraints.allowed_paths);
     const taskConfig = {
         ...baseConfig,
         taskId: harnessTaskId,
         title: options.taskSpec.title,
         taskKind: resolvedWorkflow.taskKind,
         featureId: options.taskSpec.feature_id,
-        allowedPaths: options.taskSpec.constraints.allowed_paths,
+        allowedPaths,
         forbiddenPaths: options.taskSpec.constraints.forbidden_paths,
         hardConstraints: options.taskSpec.constraints.hard_constraints,
         complexity: mapRiskLevelToComplexity(options.taskSpec.risk_level),
@@ -312,6 +316,15 @@ function bulletLines(values) {
         return ["- None"];
     return values.map((value) => `- ${value}`);
 }
+/** Union TaskSpec allowed_paths with workflow-owned write roots. */
+export function expandAllowedPathsForWorkflow(workflow, allowedPaths) {
+    const extras = workflow === "backend-test"
+        ? ["testcase/**", "docs/test-reports/**"]
+        : workflow === "frontend-test"
+            ? ["testcase/frontend/**", "docs/test-reports/**"]
+            : [];
+    return Array.from(new Set([...allowedPaths, ...extras]));
+}
 async function loadExistingTaskConfig(repoRoot, taskId) {
     try {
         return await loadTaskConfig(repoRoot, taskId);

package/dist/worker/outcomes/adapters.js

@@ -39,21 +39,29 @@ function toRepoRelativePath(repoRoot, candidate) {
 function structuredArtifactsFromReport(run) {
     if (!run?.nodes)
         return [];
-    const artifacts = [];
+    // Multiple gates may rewrite the same run-owned path (e.g. backend-test
+    // case manifest initial → final). Keep the last claim in report node order
+    // so projector validates against the file on disk after all rewrites.
+    const byPath = new Map();
     for (const node of run.nodes) {
-        if (node.structuredArtifactPath &&
-            node.structuredArtifactSha256 &&
-            node.structuredArtifactSchemaId) {
-            const identity = splitStructuredArtifactIdentity(node.structuredArtifactSchemaId);
-            artifacts.push({
-                path: node.structuredArtifactPath,
-                sha256: node.structuredArtifactSha256,
-                kind: identity.kind,
-                schemaId: identity.schemaId,
-            });
+        if (!node.structuredArtifactPath ||
+            !node.structuredArtifactSha256 ||
+            !node.structuredArtifactSchemaId) {
+            continue;
         }
+        const identity = splitStructuredArtifactIdentity(node.structuredArtifactSchemaId);
+        const pathKey = node.structuredArtifactPath.replace(/\\/g, "/");
+        // Leave sha256 empty: later DAG nodes (e.g. backend-test traceability)
+        // may rewrite the same run-owned path in place, invalidating the mint-time
+        // structuredArtifactSha256. Projector re-hashes the file on disk.
+        byPath.set(pathKey, {
+            path: pathKey,
+            sha256: "",
+            kind: identity.kind,
+            schemaId: identity.schemaId,
+        });
     }
-    return artifacts;
+    return Array.from(byPath.values());
 }
 /**
  * `agent-dag` — the default standard agent DAG. No dedicated test/integration

package/dist/worker/run-task/run-task.js

@@ -455,7 +455,8 @@ function isPathInside(root, target) {
     const relative = path.relative(root, target);
     return relative !== "" && relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
 }
-function decideFromReport(workerRunId, result) {
+/** Exported for unit tests: map DAG report JSON into Worker report decision. */
+export function decideFromReport(workerRunId, result) {
     if (!result.ok || !result.json) {
         return {
             succeeded: false,
@@ -473,11 +474,16 @@ function decideFromReport(workerRunId, result) {
     }
     const runStatus = readString(run, "status");
     const nodes = readObjectArray(run, "nodes");
+    // Condition-branch SKIPPED nodes are expected on green backend-test / hybrid
+    // paths (e.g. revise/repair not selected). Do not treat SKIPPED as failure.
+    // ERROR and non-success failureCategory on executed nodes still fail closed.
     const failedNode = nodes.find((node) => {
         const status = readString(node, "status");
         const failureCategory = readString(node, "failureCategory");
+        if (status === "SKIPPED") {
+            return false;
+        }
         return (status === "ERROR" ||
-            status === "SKIPPED" ||
             (Boolean(failureCategory) && failureCategory !== "success"));
     });
     if (runStatus !== "completed" && runStatus !== "finished") {

package/dist/workflows/dag/backend-test-execution-contract.js

@@ -334,22 +334,50 @@ function asRecord(value) {
  * Prefer exact schema payloads; otherwise map common discovery shapes onto the
  * pytest-centric runtime contract without inventing secrets or managed commands.
  */
+/** Drop empty managedCommand strings; omit block when not managed-command. */
+export function sanitizeBackendTestExecutionInput(value) {
+    const record = asRecord(value);
+    if (!record)
+        return value;
+    const next = { ...record };
+    const managed = asRecord(record.managedCommand);
+    if (!managed)
+        return next;
+    const cleaned = {};
+    for (const key of ["start", "stop", "sourceRef"]) {
+        const raw = managed[key];
+        if (typeof raw === "string" && raw.trim())
+            cleaned[key] = raw.trim();
+    }
+    if (next.targetMode === "managed-command") {
+        next.managedCommand = cleaned;
+    }
+    else if (Object.keys(cleaned).length === 0) {
+        delete next.managedCommand;
+    }
+    else {
+        // in-process / external: optional managedCommand must not carry empty strings
+        next.managedCommand = cleaned;
+    }
+    return next;
+}
 export function coerceBackendTestExecutionInput(value) {
-    const direct = backendTestExecutionContractSchema.safeParse(value);
+    const sanitized = sanitizeBackendTestExecutionInput(value);
+    const direct = backendTestExecutionContractSchema.safeParse(sanitized);
     if (direct.success)
         return direct.data;
-    const record = asRecord(value);
+    const record = asRecord(sanitized);
     if (!record)
-        return value;
+        return sanitized;
     // Near-schema payloads (string framework + runner + testRoot) must stay fail-closed.
     // Only free-form discovery envelopes are rewritten onto the pytest contract.
     const looksSchemaShaped = typeof record.framework === "string" &&
         asRecord(record.runner) !== null &&
         typeof record.testRoot === "string";
     if (looksSchemaShaped)
-        return value;
+        return sanitized;
     if (typeof record.framework === "string" && record.framework !== "pytest") {
-        return value;
+        return sanitized;
     }
     const frameworkObj = asRecord(record.framework);
     const discovered = asRecord(record.discoveredFixtures);
@@ -504,7 +532,10 @@ export async function materializeBackendTestExecutionContract(input) {
     catch (error) {
         throw new Error(`invalid-output: ${error instanceof Error ? error.message : String(error)}`);
     }
-    const candidates = [parsed, coerceBackendTestExecutionInput(parsed)];
+    const candidates = [
+        sanitizeBackendTestExecutionInput(parsed),
+        coerceBackendTestExecutionInput(parsed),
+    ];
     let accepted = null;
     let lastSchemaError = "invalid execution contract";
     let lastSecretError = "";

package/dist/workflows/dag/init-hybrid.js

@@ -3685,7 +3685,8 @@ function buildFrontendTestHybridDag(sources) {
             " if(!Array.isArray(c.acIds)||c.acIds.length===0||c.acIds.some(a=>typeof a!=='string'||!a.trim())) throw new Error('invalid acIds');",
             " for(const k of ['casePath','evidenceDir']){ const v=c[k]; if(typeof v!=='string'||path.isAbsolute(v)||v.includes('..')) throw new Error('unsafe '+k); }",
             " if(c.casePath!=='testcase/frontend/cases/'+c.caseId+'.md') throw new Error('casePath must match caseId');",
-            " if(!c.evidenceDir.startsWith('testcase/frontend/evidence/'+c.caseId+'/')) throw new Error('case path escapes frontend test roots');",
+            // Accept evidenceDir as case root or nested path under that root.
+            " { const prefix='testcase/frontend/evidence/'+c.caseId; if(!(c.evidenceDir===prefix||c.evidenceDir.startsWith(prefix+'/'))) throw new Error('case path escapes frontend test roots'); }",
             " if(seenCasePath.has(c.casePath)) throw new Error('duplicate casePath'); seenCasePath.add(c.casePath);",
             " if(seenEvidenceDir.has(c.evidenceDir)) throw new Error('duplicate evidenceDir'); seenEvidenceDir.add(c.evidenceDir);",
             "}",

package/dist/workflows/dag/node-execution.js

@@ -1,4 +1,5 @@
 import { createHash } from "node:crypto";
+import { existsSync } from "node:fs";
 import { readFile } from "node:fs/promises";
 import path from "node:path";
 import { recordDecisionEnvelopeForNode, shouldPauseOnHumanEscalation, writeHumanEscalationArtifacts, } from "./decision-envelope.js";
@@ -421,6 +422,19 @@ export async function executeDagNode(input) {
             node.structuredArtifactSha256 = createHash("sha256").update(bytes).digest("hex");
             node.structuredArtifactSchemaId = task.shell.jsonArtifactGate.schemaId;
         }
+        else if (task.shell?.backendTestPipeline === "finalize-effective-result") {
+            // Pipeline materializes contracts/backend-test-result.json without jsonArtifactGate.
+            // Bind it so Outcome adapters project kind=backend-test-result for Ready Planner.
+            const artifactPath = path.join(runDir, "contracts", "backend-test-result.json");
+            if (existsSync(artifactPath)) {
+                const bytes = await readFile(artifactPath);
+                node.structuredArtifactPath = artifactPath;
+                node.structuredArtifactSha256 = createHash("sha256")
+                    .update(bytes)
+                    .digest("hex");
+                node.structuredArtifactSchemaId = "backend-test-result-v1";
+            }
+        }
     }
     state.nodes[nodeId].nodeRecordPath = path.join(runDir, `${nodeId}.json`);
     await writeNodeRecord(runDir, nodeId, state.nodes[nodeId]);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tea-agent/loop-agent",
-  "version": "0.16.15-beta.0",
+  "version": "0.16.15",
   "type": "module",
   "bin": {
     "loop-agent": "bin/loop-agent.js",