@tea-agent/loop-agent 0.16.26 → 0.17.1

package/dist/worker/console/operator-actions.js

@@ -0,0 +1,769 @@
+import { readFile } from "node:fs/promises";
+import { buildOperatorCapabilitiesDocument } from "../../shared/operator/capabilities.js";
+import { operatorFailed, operatorSucceeded, } from "../../shared/operator/envelope.js";
+import { stageUtf8Text } from "./app-data.js";
+import { ALL_CONFIRMATION_CHALLENGES, hashDagBytes, } from "./dag-confirmation.js";
+import { capabilityForObserveTarget, DEFAULT_OBSERVE_BASE_URL, OBSERVE_START_COMMAND, probeAndClassifyObserve, } from "./observe-health-match.js";
+import { buildObserveDeepLink, } from "./observe-link.js";
+import { repoFingerprintV1 } from "./repo-fingerprint.js";
+import { scheduleOperation, } from "./operation-runner.js";
+import { readinessGateFailure, } from "./pi-readiness.js";
+import { isAssessmentFreshForDraft } from "./interview/assessment.js";
+const MUTATION_OR_LONG = new Set([
+    "newTask",
+    "importPrd",
+    "contractApply",
+    "contractAdopt",
+    "contractRecover",
+    "dagRunTask",
+    "runDag",
+]);
+function paramsOf(req) {
+    return (req.actionParams ?? {});
+}
+function str(v) {
+    return typeof v === "string" && v.trim() ? v.trim() : undefined;
+}
+async function runReadCli(ctx, args, command) {
+    const run = ctx.runCommand ?? ((a, o) => ctx.client.run(a, o));
+    try {
+        const result = await run(args, {
+            cwd: ctx.repoRoot,
+            artifactName: `read-${command.replace(/\s+/g, "-")}`,
+            expectJson: true,
+        });
+        if (result.json && typeof result.json === "object") {
+            const env = result.json;
+            if (env.schemaVersion === 1 && typeof env.ok === "boolean") {
+                return env;
+            }
+        }
+        if (result.ok && result.exitCode === 0) {
+            return operatorSucceeded(command, {
+                stdout: result.stdout,
+                raw: result.json,
+            });
+        }
+        return operatorFailed({
+            command,
+            outcome: "rejected",
+            code: "INTERNAL_ERROR",
+            message: result.stderr || `exit ${result.exitCode}`,
+        });
+    }
+    catch (error) {
+        return operatorFailed({
+            command,
+            outcome: "needs-reconcile",
+            code: "OPERATION_NEEDS_RECONCILE",
+            message: error instanceof Error ? error.message : String(error),
+        });
+    }
+}
+async function acceptOperation(ctx, input) {
+    const created = await ctx.operations.create({
+        clientRequestId: input.clientRequestId,
+        action: input.action,
+        actionParams: input.actionParams,
+        taskId: input.taskId,
+        cliArgs: input.cliArgs,
+    });
+    if (created.kind === "conflict") {
+        return {
+            kind: "error",
+            status: 409,
+            body: operatorFailed({
+                command: input.action,
+                outcome: "conflict",
+                code: "REQUEST_ID_REUSE_CONFLICT",
+                message: created.message,
+                details: { operationId: created.existing.operationId },
+            }),
+        };
+    }
+    if (created.kind === "idempotent") {
+        return {
+            kind: "accepted",
+            status: 202,
+            body: {
+                operationId: created.operation.operationId,
+                state: created.operation.state,
+                clientRequestId: created.operation.clientRequestId,
+                action: created.operation.action,
+            },
+        };
+    }
+    const runnerDeps = {
+        store: ctx.operations,
+        events: ctx.events,
+        client: ctx.client,
+        repoRoot: ctx.repoRoot,
+        runCommand: ctx.runCommand,
+    };
+    scheduleOperation(created.operation.operationId, runnerDeps);
+    return {
+        kind: "accepted",
+        status: 202,
+        body: {
+            operationId: created.operation.operationId,
+            state: created.operation.state,
+            clientRequestId: created.operation.clientRequestId,
+            action: created.operation.action,
+        },
+    };
+}
+export async function dispatchOperatorAction(ctx, req) {
+    const action = req.action?.trim();
+    if (!action) {
+        return {
+            kind: "error",
+            status: 400,
+            body: operatorFailed({
+                command: "operator",
+                outcome: "invalid",
+                code: "INVALID_INPUT",
+                message: "action is required",
+            }),
+        };
+    }
+    const readiness = ctx.getReadiness?.() ?? ctx.readiness;
+    const blocked = readinessGateFailure(readiness, action);
+    if (blocked) {
+        return {
+            kind: "error",
+            status: 412,
+            body: operatorFailed({
+                command: action,
+                outcome: "blocked",
+                code: "PI_SETUP_REQUIRED",
+                message: blocked.message,
+                details: { state: blocked.state },
+            }),
+        };
+    }
+    const p = paramsOf(req);
+    switch (action) {
+        case "operatorCapabilities": {
+            const doc = buildOperatorCapabilitiesDocument();
+            return {
+                kind: "sync",
+                status: 200,
+                body: operatorSucceeded("operator capabilities", doc),
+            };
+        }
+        case "inspect": {
+            const body = await runReadCli(ctx, ["inspect", "--json"], "inspect");
+            return { kind: "sync", status: body.ok ? 200 : 400, body };
+        }
+        case "doctor": {
+            const body = await runReadCli(ctx, ["doctor", "--json"], "doctor");
+            return { kind: "sync", status: body.ok ? 200 : 400, body };
+        }
+        case "status": {
+            const taskId = str(p.taskId);
+            if (!taskId) {
+                return invalid(action, "taskId is required");
+            }
+            const body = await runReadCli(ctx, ["status", taskId, "--json"], "status");
+            return {
+                kind: "sync",
+                status: body.ok ? 200 : body.outcome === "not-found" ? 404 : 400,
+                body,
+            };
+        }
+        case "spineCheck": {
+            const taskId = str(p.taskId);
+            if (!taskId)
+                return invalid(action, "taskId is required");
+            const body = await runReadCli(ctx, ["spine", "audit", taskId, "--json"], "spine audit");
+            return { kind: "sync", status: body.ok ? 200 : 400, body };
+        }
+        case "sourceInstructions": {
+            const taskId = str(p.taskId);
+            if (!taskId)
+                return invalid(action, "taskId is required");
+            const body = await runReadCli(ctx, ["instructions", "source", "--task", taskId, "--json"], "instructions source");
+            return { kind: "sync", status: body.ok ? 200 : 400, body };
+        }
+        case "contractShow": {
+            const taskId = str(p.taskId);
+            if (!taskId)
+                return invalid(action, "taskId is required");
+            const body = await runReadCli(ctx, ["task", "contract", "show", taskId, "--json"], "task contract show");
+            return {
+                kind: "sync",
+                status: body.ok ? 200 : body.outcome === "not-found" ? 404 : 400,
+                body,
+            };
+        }
+        case "contractValidate":
+        case "contractDiff":
+            return dispatchContractValidateOrDiff(ctx, action, p);
+        case "contractDraftSave": {
+            const draft = p.draft;
+            const taskId = str(p.taskId) ?? str(draft?.taskId);
+            if (!taskId || !draft) {
+                return invalid(action, "taskId and draft are required");
+            }
+            const { schemaVersion: _sv, taskId: _tid, ...draftRest } = draft;
+            const saved = await ctx.drafts.save({
+                ...draftRest,
+                schemaVersion: 1,
+                taskId,
+                title: str(draft.title) ?? taskId,
+            });
+            return {
+                kind: "sync",
+                status: 200,
+                body: operatorSucceeded("contractDraftSave", {
+                    taskId: saved.draft.taskId,
+                    draftSha256: saved.draftSha256,
+                    path: saved.path,
+                    // never claim canonical
+                    canonical: false,
+                    storage: "console-application-data",
+                }),
+            };
+        }
+        case "observeLink": {
+            const baseUrl = ctx.observeBaseUrl ?? DEFAULT_OBSERVE_BASE_URL;
+            const dagRunId = str(p.dagRunId);
+            const taskId = str(p.taskId);
+            const featureId = str(p.featureId);
+            const workerRunId = str(p.workerRunId);
+            let target;
+            if (dagRunId) {
+                target = { kind: "dag", dagRunId };
+            }
+            else if (taskId) {
+                target = { kind: "task", taskId };
+            }
+            else if (featureId) {
+                target = { kind: "feature", featureId };
+            }
+            else if (workerRunId) {
+                target = { kind: "worker", workerRunId };
+            }
+            else {
+                return invalid(action, "dagRunId, taskId, featureId, or workerRunId required");
+            }
+            const requiredCapability = capabilityForObserveTarget(target);
+            let localFingerprint;
+            try {
+                localFingerprint = repoFingerprintV1(ctx.repoRoot);
+            }
+            catch (error) {
+                return {
+                    kind: "sync",
+                    status: 400,
+                    body: operatorFailed({
+                        command: "observeLink",
+                        outcome: "rejected",
+                        code: "OBSERVE_LINK_BLOCKED",
+                        message: `cannot compute local repoFingerprint: ${error instanceof Error ? error.message : String(error)}`,
+                        details: {
+                            status: "mismatch",
+                            startCommand: OBSERVE_START_COMMAND,
+                        },
+                    }),
+                };
+            }
+            const classified = await probeAndClassifyObserve({
+                baseUrl,
+                localFingerprint,
+                requiredCapability,
+                fetchImpl: ctx.fetchImpl ?? fetch,
+            });
+            if (classified.status !== "match") {
+                return {
+                    kind: "sync",
+                    status: classified.status === "unavailable" ? 503 : 409,
+                    body: operatorFailed({
+                        command: "observeLink",
+                        outcome: classified.status === "unavailable" ? "blocked" : "conflict",
+                        code: "OBSERVE_LINK_BLOCKED",
+                        message: classified.message,
+                        details: {
+                            status: classified.status,
+                            startCommand: OBSERVE_START_COMMAND,
+                            requiredCapability,
+                            healthUrl: classified.url,
+                            localFingerprint,
+                            remoteFingerprint: classified.remoteFingerprint,
+                        },
+                    }),
+                };
+            }
+            const link = buildObserveDeepLink(baseUrl, target);
+            return {
+                kind: "sync",
+                status: 200,
+                body: operatorSucceeded("observeLink", {
+                    url: link,
+                    status: "match",
+                    requiredCapability,
+                }),
+            };
+        }
+        case "dagValidate": {
+            const dagPath = str(p.dagPath) ?? str(p.dagHandle);
+            const taskId = str(p.taskId);
+            if (!dagPath)
+                return invalid(action, "dagPath is required");
+            const args = ["dag", "validate", "--dag", dagPath, "--json"];
+            if (taskId)
+                args.push("--spine-task", taskId);
+            const body = await runReadCli(ctx, args, "dag validate");
+            return { kind: "sync", status: body.ok ? 200 : 400, body };
+        }
+        case "prepareDagConfirmation": {
+            const dagText = str(p.dagText) ?? str(p.dagJson);
+            const dagHandle = str(p.dagHandle) ?? "staged-dag.json";
+            const taskId = str(p.taskId);
+            if (!dagText)
+                return invalid(action, "dagText is required");
+            if (!taskId)
+                return invalid(action, "taskId is required");
+            const staged = await stageUtf8Text(ctx.appData, dagText, {
+                extension: ".json",
+            });
+            const controller = ctx.client.getIdentity?.()?.packageFingerprint?.value ??
+                "unknown-controller";
+            // Server-derived bindings only: never trust browser-supplied hashes as success defaults.
+            const draftRec = await ctx.drafts.get(taskId);
+            const sourceBindingSha256 = draftRec
+                ? draftRec.draftSha256
+                : hashDagBytes(`source:${taskId}:${staged.sha256}`);
+            const validateBody = await runReadCli(ctx, ["dag", "validate", "--dag", staged.path, "--json"], "dag validate");
+            if (!validateBody.ok) {
+                return {
+                    kind: "error",
+                    status: 400,
+                    body: operatorFailed({
+                        command: action,
+                        outcome: "invalid",
+                        code: "INVALID_INPUT",
+                        message: "dag validate failed; cannot prepare confirmation for an invalid DAG",
+                        details: {
+                            validateError: validateBody.error ?? null,
+                            dagSha256: staged.sha256,
+                        },
+                    }),
+                };
+            }
+            const validationResultSha256 = hashDagBytes(JSON.stringify({
+                ok: true,
+                command: "dag validate",
+                result: validateBody.result ?? null,
+            }));
+            // Prefer live managed contract observation over client-supplied binding fields.
+            const showBody = await runReadCli(ctx, ["task", "contract", "show", taskId, "--json"], "task contract show");
+            const showResult = (showBody.result ?? {});
+            const ref = showBody.ok ? showResult.state?.ref : undefined;
+            if (!ref?.canonicalHash || typeof ref.revision !== "number") {
+                return {
+                    kind: "error",
+                    status: 409,
+                    body: operatorFailed({
+                        command: action,
+                        outcome: "blocked",
+                        code: "BINDING_DRIFT",
+                        message: "managed Task Contract binding unavailable; apply/adopt before prepareDagConfirmation",
+                        details: {
+                            effectiveStatus: showResult.state?.effectiveStatus,
+                            showOk: showBody.ok,
+                        },
+                    }),
+                };
+            }
+            const taskContractBinding = {
+                taskId,
+                revision: ref.revision,
+                canonicalHash: ref.canonicalHash,
+                taskConfigSha256: ref.taskConfigSha256,
+                projectionVersion: ref.projectionVersion,
+                canonicalizerVersion: ref.canonicalizerVersion,
+                taskConfigSchemaVersion: ref.taskConfigSchemaVersion,
+            };
+            const confirmation = await ctx.confirmations.prepare({
+                operatorSessionId: ctx.operatorSessionId,
+                dagHandle,
+                dagBytes: dagText,
+                dagBytesPath: staged.path,
+                sourceBindingSha256,
+                taskContractBinding,
+                controllerFingerprint: controller,
+                validationResultSha256,
+                // Writer scopes must come from server-side review packet only; ignore client writeSet claims.
+                confirmedWriterScopes: [],
+                reviewPacket: {
+                    taskId,
+                    dagHandle,
+                    validationOk: true,
+                },
+            });
+            return {
+                kind: "sync",
+                status: 200,
+                body: operatorSucceeded("prepareDagConfirmation", {
+                    confirmation,
+                    requiredChallenges: ALL_CONFIRMATION_CHALLENGES,
+                }),
+            };
+        }
+        case "confirmDagConfirmation": {
+            const confirmationId = str(p.confirmationId);
+            const challenges = p.challenges ?? [];
+            if (!confirmationId) {
+                return invalid(action, "confirmationId is required");
+            }
+            // Ignore client-supplied binding fields; re-derive current from store + staged bytes + live controller.
+            const conf = await ctx.confirmations.get(confirmationId);
+            if (!conf) {
+                return {
+                    kind: "error",
+                    status: 404,
+                    body: operatorFailed({
+                        command: action,
+                        outcome: "not-found",
+                        code: "NOT_FOUND",
+                        message: `confirmation not found: ${confirmationId}`,
+                    }),
+                };
+            }
+            let dagBytes;
+            try {
+                dagBytes = await readFile(conf.dagBytesPath, "utf8");
+            }
+            catch (error) {
+                return {
+                    kind: "error",
+                    status: 409,
+                    body: operatorFailed({
+                        command: action,
+                        outcome: "conflict",
+                        code: "CONFIRMATION_STALE",
+                        message: `cannot re-read staged DAG bytes: ${error instanceof Error ? error.message : String(error)}`,
+                    }),
+                };
+            }
+            const controller = ctx.client.getIdentity?.()?.packageFingerprint?.value ??
+                conf.controllerFingerprint;
+            const result = await ctx.confirmations.confirm({
+                confirmationId,
+                operatorSessionId: ctx.operatorSessionId,
+                challenges,
+                current: {
+                    dagSha256: hashDagBytes(dagBytes),
+                    sourceBindingSha256: conf.sourceBindingSha256,
+                    controllerFingerprint: controller,
+                    validationResultSha256: conf.validationResultSha256,
+                    taskContractBinding: conf.taskContractBinding,
+                },
+            });
+            if (!result.ok) {
+                return {
+                    kind: "error",
+                    status: confirmationErrorStatus(result.code),
+                    body: operatorFailed({
+                        command: action,
+                        outcome: "rejected",
+                        code: result.code,
+                        message: result.message,
+                    }),
+                };
+            }
+            return {
+                kind: "sync",
+                status: 200,
+                body: operatorSucceeded(action, { confirmation: result.confirmation }),
+            };
+        }
+        case "newTask": {
+            const taskId = str(p.taskId);
+            const title = str(p.title) ?? taskId;
+            const clientRequestId = str(req.clientRequestId);
+            if (!taskId || !clientRequestId) {
+                return invalid(action, "taskId and clientRequestId are required");
+            }
+            return acceptOperation(ctx, {
+                action,
+                actionParams: p,
+                clientRequestId,
+                taskId,
+                cliArgs: ["new-task", taskId, title, "--json"],
+            });
+        }
+        case "importPrd": {
+            const taskId = str(p.taskId);
+            const content = str(p.content) ?? str(p.fileText);
+            const clientRequestId = str(req.clientRequestId);
+            if (!taskId || !content || !clientRequestId) {
+                return invalid(action, "taskId, content, and clientRequestId are required");
+            }
+            const staged = await stageUtf8Text(ctx.appData, content, {
+                extension: ".md",
+            });
+            return acceptOperation(ctx, {
+                action,
+                actionParams: { taskId, stagedSha256: staged.sha256 },
+                clientRequestId,
+                taskId,
+                cliArgs: ["import-prd", taskId, "--file", staged.path, "--json"],
+            });
+        }
+        case "contractApply": {
+            const taskId = str(p.taskId);
+            const clientRequestId = str(req.clientRequestId);
+            if (!taskId || !clientRequestId) {
+                return invalid(action, "taskId and clientRequestId are required");
+            }
+            // Require fresh complete assessment bound to current draft
+            const draftRec = await ctx.drafts.get(taskId);
+            if (!draftRec) {
+                return {
+                    kind: "error",
+                    status: 400,
+                    body: operatorFailed({
+                        command: action,
+                        outcome: "invalid",
+                        code: "INVALID_INPUT",
+                        message: "no Console draft for task; save draft first",
+                    }),
+                };
+            }
+            const assessmentId = str(p.assessmentId) ??
+                draftRec.draft.interviewAssessmentRef?.assessmentId;
+            if (!assessmentId) {
+                return {
+                    kind: "error",
+                    status: 403,
+                    body: operatorFailed({
+                        command: action,
+                        outcome: "blocked",
+                        code: "HUMAN_CONFIRMATION_REQUIRED",
+                        message: "fresh complete Interview assessment required before contractApply",
+                    }),
+                };
+            }
+            const assessment = await ctx.assessments.get(assessmentId);
+            if (!assessment) {
+                return {
+                    kind: "error",
+                    status: 403,
+                    body: operatorFailed({
+                        command: action,
+                        outcome: "blocked",
+                        code: "HUMAN_CONFIRMATION_REQUIRED",
+                        message: "assessment not found",
+                    }),
+                };
+            }
+            const fresh = isAssessmentFreshForDraft(assessment, draftRec.draft);
+            if (!fresh.fresh) {
+                return {
+                    kind: "error",
+                    status: 403,
+                    body: operatorFailed({
+                        command: action,
+                        outcome: "blocked",
+                        code: "HUMAN_CONFIRMATION_REQUIRED",
+                        message: fresh.reason,
+                    }),
+                };
+            }
+            const staged = await stageUtf8Text(ctx.appData, JSON.stringify(draftRec.draft, null, 2), { extension: ".json" });
+            const expectedRevision = String(p.expectedRevision ?? "0");
+            const expectedHash = str(p.expectedObservedHash) ?? "unknown";
+            // CLI validates --request-payload-sha256 against input file bytes, not draft projection hash.
+            const payloadSha = staged.sha256;
+            return acceptOperation(ctx, {
+                action,
+                actionParams: {
+                    taskId,
+                    assessmentId,
+                    draftSha256: draftRec.draftSha256,
+                    requestPayloadSha256: payloadSha,
+                },
+                clientRequestId,
+                taskId,
+                cliArgs: [
+                    "task",
+                    "contract",
+                    "apply",
+                    "--task",
+                    taskId,
+                    "--input",
+                    staged.path,
+                    "--expected-revision",
+                    expectedRevision,
+                    "--expected-observed-hash",
+                    expectedHash,
+                    "--request-id",
+                    clientRequestId,
+                    "--request-payload-sha256",
+                    payloadSha,
+                    "--json",
+                ],
+            });
+        }
+        case "dagRunTask": {
+            const taskId = str(p.taskId);
+            const clientRequestId = str(req.clientRequestId);
+            if (!taskId || !clientRequestId) {
+                return invalid(action, "taskId and clientRequestId are required");
+            }
+            const out = await stageUtf8Text(ctx.appData, "", { extension: ".json" });
+            return acceptOperation(ctx, {
+                action,
+                actionParams: p,
+                clientRequestId,
+                taskId,
+                cliArgs: [
+                    "dag",
+                    "run-task",
+                    taskId,
+                    "--profile",
+                    str(p.profile) ?? "auto",
+                    "-o",
+                    out.path,
+                ],
+            });
+        }
+        case "runDag": {
+            // Only confirmationId — never raw dag path from browser
+            const confirmationId = str(p.confirmationId);
+            const clientRequestId = str(req.clientRequestId);
+            if (!confirmationId || !clientRequestId) {
+                return invalid(action, "runDag requires confirmationId and clientRequestId only");
+            }
+            const conf = await ctx.confirmations.get(confirmationId);
+            if (!conf) {
+                return {
+                    kind: "error",
+                    status: 404,
+                    body: operatorFailed({
+                        command: action,
+                        outcome: "not-found",
+                        code: "NOT_FOUND",
+                        message: `confirmation not found: ${confirmationId}`,
+                    }),
+                };
+            }
+            // Re-read staged DAG bytes and hash
+            let dagBytes;
+            try {
+                dagBytes = await readFile(conf.dagBytesPath, "utf8");
+            }
+            catch (error) {
+                return {
+                    kind: "error",
+                    status: 409,
+                    body: operatorFailed({
+                        command: action,
+                        outcome: "conflict",
+                        code: "CONFIRMATION_STALE",
+                        message: `cannot re-read staged DAG bytes: ${error instanceof Error ? error.message : String(error)}`,
+                    }),
+                };
+            }
+            const dagSha256 = hashDagBytes(dagBytes);
+            const controller = ctx.client.getIdentity?.()?.packageFingerprint?.value ??
+                conf.controllerFingerprint;
+            const consumed = await ctx.confirmations.consume({
+                confirmationId,
+                operatorSessionId: ctx.operatorSessionId,
+                current: {
+                    dagSha256,
+                    sourceBindingSha256: conf.sourceBindingSha256,
+                    taskContractBinding: conf.taskContractBinding,
+                    controllerFingerprint: controller,
+                    validationResultSha256: conf.validationResultSha256,
+                },
+            });
+            if (!consumed.ok) {
+                return {
+                    kind: "error",
+                    status: confirmationErrorStatus(consumed.code),
+                    body: operatorFailed({
+                        command: action,
+                        outcome: "rejected",
+                        code: consumed.code,
+                        message: consumed.message,
+                    }),
+                };
+            }
+            return acceptOperation(ctx, {
+                action,
+                actionParams: { confirmationId },
+                clientRequestId,
+                taskId: conf.taskContractBinding.taskId,
+                cliArgs: [
+                    "run-dag",
+                    "--dag",
+                    conf.dagBytesPath,
+                    "--cwd",
+                    ctx.repoRoot,
+                    "--json",
+                ],
+            });
+        }
+        default:
+            return {
+                kind: "error",
+                status: 400,
+                body: operatorFailed({
+                    command: action,
+                    outcome: "invalid",
+                    code: "INVALID_INPUT",
+                    message: `unknown or unsupported action: ${action}`,
+                }),
+            };
+    }
+}
+function invalid(action, message) {
+    return {
+        kind: "error",
+        status: 400,
+        body: operatorFailed({
+            command: action,
+            outcome: "invalid",
+            code: "INVALID_INPUT",
+            message,
+        }),
+    };
+}
+function confirmationErrorStatus(code) {
+    if (code === "NOT_FOUND")
+        return 404;
+    if (code === "HUMAN_CONFIRMATION_REQUIRED")
+        return 403;
+    return 409;
+}
+async function dispatchContractValidateOrDiff(ctx, action, p) {
+    const taskId = str(p.taskId);
+    const draftText = str(p.draftJson) ?? str(p.inputText);
+    if (!taskId)
+        return invalid(action, "taskId is required");
+    let inputPath;
+    if (!draftText) {
+        const stored = await ctx.drafts.get(taskId);
+        if (!stored) {
+            return invalid(action, "draftJson or stored draft required");
+        }
+        const staged = await stageUtf8Text(ctx.appData, JSON.stringify(stored.draft, null, 2), { extension: ".json" });
+        inputPath = staged.path;
+    }
+    else {
+        const staged = await stageUtf8Text(ctx.appData, draftText, {
+            extension: ".json",
+        });
+        inputPath = staged.path;
+    }
+    const sub = action === "contractValidate" ? "validate" : "diff";
+    const body = await runReadCli(ctx, ["task", "contract", sub, "--task", taskId, "--input", inputPath, "--json"], `task contract ${sub}`);
+    return { kind: "sync", status: body.ok ? 200 : 400, body };
+}
+export function isMutationAction(action) {
+    return MUTATION_OR_LONG.has(action);
+}