@tea-agent/loop-agent 0.20.1-beta.0 → 0.20.1

package/docs/README.md

@@ -58,6 +58,7 @@
 - `design/agent-worker-fullstack-workflow-integration.md` — workflow routing、Task Outcome、artifact-aware Ready、`fullstack-v1` 与 Verification Bundle
 - `design/fullstack-end-to-end-delivery-optimization-roadmap.md` — 全栈端到端优化收敛路线图（release train / Delivery / Final Verification）
 - `design/2026-07-22-console-observe-unified-operator-surface.md` — Observe 深度融合进 Console（Wave 1–3 已实现，目标 0.18.0）
+- `design/2026-07-23-operator-task-rerun-and-node-retry.md` — Operator 自动节点重试、从节点重跑、standalone 完整任务重跑与 Worker Task 重排队（**Wave 1–2 已落地**；Wave 3–4 仍分波；优先解决 LLM/provider 不稳定；Inspect 只读 / Operate mutation）
 - `design/local-operator-console-from-pi-web.md` — Operator Console 设计输入；MVP 已随 `0.17.0`–`0.17.2` 发布；统一 surface 见上条
 - `design/taskspec-to-loop-agent-mapping.md` — TaskSpec → loop-agent task 兼容契约（文档镜像；runtime 真源在代码）
 

package/docs/templates/agent-dag.schema.json

@@ -402,10 +402,10 @@
         "retryCategories": {
           "type": "array",
           "items": {
-            "enum": ["timeout", "network", "rate-limit", "unavailable", "output-too-large"]
+            "enum": ["timeout", "network", "rate-limit", "unavailable", "output-too-large", "protocol-invalid"]
           },
           "default": ["timeout", "network", "rate-limit", "unavailable"],
-          "description": "Failure categories eligible for retry. quota is never eligible. output-too-large is reserved for explicit structured-required nodes and is not part of the default retry set."
+          "description": "Failure categories eligible for retry. quota is never eligible. output-too-large is reserved for explicit structured-required nodes. protocol-invalid is for nodes that declare outputProtocol with retryOnInvalid."
         }
       }
     },
@@ -496,6 +496,21 @@
           "minLength": 1,
           "description": "Optional protocol prefix whose first matching Pi assistant-output line is promoted to the canonical first line. Missing matches are not synthesized."
         },
+        "outputProtocol": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["type", "validLines"],
+          "description": "Machine-readable output protocol for safe read-only Pi nodes. Phase 1 supports first-line-enum only (e.g. VERDICT lines). Invalid output may auto-retry when retryOnInvalid is true.",
+          "properties": {
+            "type": { "const": "first-line-enum" },
+            "validLines": {
+              "type": "array",
+              "items": { "type": "string", "minLength": 1 },
+              "minItems": 1
+            },
+            "retryOnInvalid": { "type": "boolean", "default": true }
+          }
+        },
         "allowedPaths": {
           "type": "array",
           "items": { "type": "string", "minLength": 1 },

package/docs/templates/frontend-test-case-checklist.md

@@ -9,9 +9,24 @@ LLM review (when `frontendTest.reviewMode=blocking`) must not invent blocking ru
 |---|---|
 | `open-prefix` | Each case body includes `playwright-cli open --browser=chrome --headed <absolute-http(s)-url>` |
 | `production-url` | Open URL must not look like a production host |
-| `ac-mapping` | Manifest entry has non-empty `acIds` |
+| `ac-mapping` | Manifest entry has non-empty `acIds` (**acceptance** ids, not case ids) |
+| `ac-id-shape` | Each `acIds[]` entry matches `AC-*` / `AC-FE-*` |
+| `ac-id-is-case` | `acIds` must not contain `FE-*` case ids |
+| `unknown-ac` | When task `sourceBinding.requirementIds` lists ACs, every `acIds` entry must be in that set |
+| `case-id-shape` | `caseId` matches `FE-<FEATURE>-<NNN>-...` (never `AC-FE-*`) |
+| `case-id-is-ac` | Do not use acceptance id as `caseId` / filename |
+| `case-path-mismatch` | `casePath === testcase/frontend/cases/{caseId}.md` |
 | `case-file-missing` | `casePath` exists |
 | `no-test-source` | Case text must not introduce pytest / Playwright test source (`pytest`, `playwright.test`, `@playwright/test`) |
+| `playwright-cli-only` | Case steps may only use repo skill `playwright-cli` declared commands; bare `playwright` / `npx playwright` / `playwright test` / `@playwright/test` / Node Playwright API are forbidden |
+
+### ID 对照（避免混用）
+
+| 字段 | 正确示例 | 错误示例 |
+|---|---|---|
+| `caseId` | `FE-LOGIN-001-core` | `AC-FE-001` |
+| `acIds` | `["AC-FE-001"]` | `["FE-LOGIN-001-core"]` |
+| 文件名 | `FE-LOGIN-001-core.md` | `AC-FE-001.md` |
 
 ## Non-blocking (notes only)
 

package/docs/templates/frontend-test-dag.generate-cases.prompt.md

@@ -1,8 +1,20 @@
 # Generate frontend functional cases
 
-Use `playwright-cli-case-generator`. Read only `testcase/frontend/rag/context.md`, `coverage-map.md`, and existing `testcase/frontend/cases/`; write only that cases directory. Produce Markdown cases, `index.md`, and schema-version-1 `manifest.json`. Do not generate pytest or Playwright source code.
+Use `playwright-cli-case-generator`. Read only `testcase/frontend/rag/context.md`, `coverage-map.md`, and existing `testcase/frontend/cases/`; write only that cases directory. Produce Markdown cases, `index.md`, and schema-version-1 `manifest.draft.json` (materialize promotes to `manifest.json`). Do not generate pytest or Playwright source code.
 
-Each case is independently executable and includes AC mapping, preconditions, cleanup, UI assertions, and its isolated evidence path. Use dimensions `core`, `boundary`, `flow`, or `backend`. Never guess API fields, constraints, SLA, credentials, or unrecorded data.
+## HARD ID contract (frequent failure)
+
+| Concept | Field | Shape | Example |
+|---|---|---|---|
+| Test case id | `caseId` + filename | `FE-<FEATURE>-<NNN>-<dimension>` | `FE-LOGIN-001-core` |
+| Acceptance criteria | `acIds[]` | `AC-FE-*` / `AC-*` | `AC-FE-001` |
+
+- **Never** set `caseId` to `AC-FE-001` or name the file `AC-FE-001.md`.
+- **Never** put `FE-LOGIN-001-core` into `acIds`.
+- `casePath` must be `testcase/frontend/cases/<caseId>.md`.
+- `evidenceDir` must be `testcase/frontend/evidence/<caseId>/`.
+
+Each case is independently executable and includes AC mapping (`acIds`), preconditions, cleanup, UI assertions, and its isolated evidence path. Use dimensions `core`, `boundary`, `flow`, or `backend`. Never guess API fields, constraints, SLA, credentials, or unrecorded data.
 
 Every case must use the **resolved** absolute base URL from `testcase/frontend/rag/context.md` (field `baseUrl` / base URL line). Do not leave a `<base-url>` placeholder. Resolution policy (already applied by retrieve-context): prefer `config.md` frontend URL; else default `http://localhost:5173`.
 
@@ -14,6 +26,18 @@ playwright-cli open --browser=chrome --headed <resolved-base-url-from-context.md
 
 Do not put a session flag before `open`. Every later Playwright CLI command must stay in that same default browser session: do **not** emit `-s=<case-id>`, `-s=...`, or assume an undocumented named-session binding.
 
+## playwright-cli-only (hard)
+
+Every browser step must use only commands declared by the repo-local `playwright-cli` skill. Forbidden with **no fallback**: bare `playwright`, `npx playwright`, `playwright test`, `@playwright/test`, Node Playwright API, or generating Playwright/Pytest source. If `playwright-cli` is unavailable, the case must require blocked evidence with `blockedReason: playwright-cli-unavailable` and must not open a browser.
+
+## U/D data ownership (hard for modify/delete)
+
+1. Only mutate data whose ownership is proven by the **current login identity** plus observable UI/API owner fields — never by name, guessed id, or list order alone.
+2. If the current user has no suitable data, create tagged, cleanable data in the current-user context, then modify/delete, then cleanup and verify cleanup.
+3. If safe create is impossible, only task-authorized Mock may construct data, and the case must label it as Mock (not real backend proof).
+4. If ownership is unverifiable and create/Mock are unavailable: require blocked evidence with one of `current-user-data-unavailable`, `data-ownership-unverifiable`, `safe-test-data-setup-unavailable` — never risk cross-user data.
+5. Never touch other users' data, shared fixtures, production data, or non-cleanable data.
+
 For every executable sub-scenario, state the fixture/reset operation, UI reset operation, a fresh snapshot before using element references, and the exact evidence write point. If the isolated environment is unavailable, require writing blocked evidence before any browser command; do not open or connect to a browser.
 
 Each case must require the executor to persist, even when blocked:

package/docs/templates/frontend-test-dag.json

@@ -15,7 +15,10 @@
     "Case children execute serially. Persist each case result, logs and browser evidence before the next child starts.",
     "A token threshold is a post-case stop check, not a model hard token cap; unstarted cases must be recorded as blocked: token-budget-exhausted.",
     "Default pipeline acceptance is the final retrospect report under testcase/frontend/reports/; case full green is optional quality (frontendTest.strictOutcomeGate).",
-    "Default frontendTest.reviewMode=off uses mechanical checklist-shell before materialize; set reviewMode=blocking for legacy dual LLM review gate."
+    "Default frontendTest.reviewMode=off uses mechanical checklist-shell before materialize; set reviewMode=blocking for legacy dual LLM review gate.",
+    "playwright-cli-only: generators and executors may call only skill-declared playwright-cli commands; bare playwright / npx playwright / @playwright/test / Playwright source are forbidden with no native Playwright fallback.",
+    "Environment preflight must curl-probe the frozen non-production baseUrl before generate; unreachable or curl-unavailable ends preflight as blocked (frontend-base-url-unreachable|curl-unavailable) so generate/map do not run.",
+    "U/D cases must prove current-user data ownership or create cleanable current-user data or authorized Mock; otherwise blocked (current-user-data-unavailable|data-ownership-unverifiable|safe-test-data-setup-unavailable) without cross-user mutation."
   ],
   "tasks": [
     {
@@ -24,7 +27,7 @@
       "executor": "pi",
       "role": "planner",
       "toolProfile": "write",
-      "complexity": "HIGH",
+      "complexity": "MED",
       "writePolicy": "exclusive",
       "writeSet": [
         "testcase/frontend/rag/**"
@@ -37,14 +40,43 @@
         ".harness/**",
         "artifacts/**"
       ],
-      "outputContract": "RAG context.md and coverage-map.md.",
+      "outputContract": "RAG context.md and coverage-map.md with baseUrl, baseUrlSource, environmentProbe=pending.",
       "subtask_prompt_markdown": "./frontend-test-dag.retrieve-context.prompt.md"
     },
     {
-      "id": "generate-frontend-functional-cases-pi",
+      "id": "materialize-frontend-test-execution-shell",
       "depends_on": [
         "retrieve-frontend-test-context-pi"
       ],
+      "executor": "shell",
+      "role": "verifier",
+      "complexity": "LOW",
+      "writePolicy": "exclusive",
+      "writeSet": [
+        "testcase/frontend/rag/**"
+      ],
+      "allowedPaths": [
+        "testcase/frontend/rag/**"
+      ],
+      "forbiddenPaths": [
+        ".harness/**",
+        "artifacts/**"
+      ],
+      "outputContract": "Fail-closed environment preflight: absolute non-production baseUrl + curl HTTP reachability; writes environmentProbe facts; unreachable => blockedReason frontend-base-url-unreachable (node ERROR so generate/map do not run).",
+      "subtask_prompt": "Parse frozen baseUrl from context.md (config.md preferred, else http://localhost:5173). Reject production / non-http(s). Probe with curl (HEAD then GET fallback; connect/max-time; no auth/cookie). 2xx/3xx => reachable and continue. 4xx/5xx/DNS/timeout/connection refused/TLS => blockedReason frontend-base-url-unreachable. Missing curl => blockedReason curl-unavailable. Do not start the app. Runtime hybrid generator embeds the authoritative probe script.",
+      "shell": {
+        "commands": [
+          "node -e \"console.log('template placeholder: runtime hybrid DAG embeds curl preflight; do not use this static command as source of truth')\""
+        ],
+        "cwd": ".",
+        "timeoutMs": 60000
+      }
+    },
+    {
+      "id": "generate-frontend-functional-cases-pi",
+      "depends_on": [
+        "materialize-frontend-test-execution-shell"
+      ],
       "executor": "pi",
       "role": "implementer",
       "toolProfile": "write",
@@ -202,7 +234,7 @@
       "dependsPolicy": "all-or-condition-skip"
     },
     {
-      "id": "materialize-frontend-case-manifest-shell",
+      "id": "frontend-case-checklist-shell",
       "depends_on": [
         "final-frontend-case-review-gate-shell"
       ],
@@ -210,6 +242,33 @@
       "role": "verifier",
       "complexity": "LOW",
       "writePolicy": "read-only",
+      "allowedPaths": [
+        "testcase/frontend/rag/**",
+        "testcase/frontend/cases/**"
+      ],
+      "forbiddenPaths": [
+        ".harness/**",
+        "artifacts/**"
+      ],
+      "outputContract": "Mechanical checklist: open-prefix, non-prod absolute URL, acIds, playwright-cli-only, no pytest/playwright test source; emit structured ruleId issues on failure.",
+      "subtask_prompt": "Scan generated cases/manifest against the shared blocking checklist. Runtime hybrid embeds the authoritative script.",
+      "shell": {
+        "commands": [
+          "node -e \"console.log('template placeholder: runtime hybrid embeds checklist')\""
+        ],
+        "cwd": ".",
+        "timeoutMs": 120000
+      }
+    },
+    {
+      "id": "materialize-frontend-case-manifest-shell",
+      "depends_on": [
+        "frontend-case-checklist-shell"
+      ],
+      "executor": "shell",
+      "role": "verifier",
+      "complexity": "LOW",
+      "writePolicy": "read-only",
       "allowedPaths": [
         "testcase/frontend/cases/**"
       ],
@@ -217,7 +276,7 @@
         ".harness/**",
         "artifacts/**"
       ],
-      "outputContract": "Validated frontend manifest payload { cases: [...] }; shell command echo is permitted only as the prefix before exactly one final JSON line.",
+      "outputContract": "Validated frontend manifest payload { cases: [...] }; ruleId-tagged fail-closed validation; atomically materialize testcase/frontend/cases/manifest.json via temp+rename then delete draft; stdout is exactly one final JSON line {cases}.",
       "subtask_prompt": "Validate and materialize the generated frontend case manifest.",
       "shell": {
         "commands": [

package/docs/templates/frontend-test-dag.retrieve-context.prompt.md

@@ -10,5 +10,8 @@ Resolve a single absolute browser base URL and record it explicitly in `context.
 2. If no usable absolute `http://` / `https://` URL is found in `config.md` (or equivalent source facts), default to `http://localhost:5173`.
 3. Never use production hosts. Prefer local / isolated non-production URLs.
 4. Also record `baseUrlSource: config.md|<path>` or `baseUrlSource: default-localhost-5173` so later nodes can audit the choice.
-5. Include the exact browser start prefix that generators must copy:
+5. Write `environmentProbe: pending`. The environment preflight shell will replace this with `reachable`, `unreachable`, or `curl-unavailable` plus a structured `blockedReason` (for example `frontend-base-url-unreachable`).
+6. Include the exact browser start prefix that generators must copy:
    `playwright-cli open --browser=chrome --headed <resolved-base-url>`.
+
+Do not claim the environment is reachable until preflight completes. Preflight does not start the application.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tea-agent/loop-agent",
-  "version": "0.20.1-beta.0",
+  "version": "0.20.1",
   "type": "module",
   "bin": {
     "loop-agent": "bin/loop-agent.js",

package/skills/loop-agent/references/command-reference.md

@@ -303,6 +303,9 @@ loop-agent dag report [--run-id <run-id>] [--lifecycle active|paused|completed|a
 loop-agent dag reconcile-run --run-id <run-id>            # 只读检查 effectiveStatus 与恢复/收口资格
 loop-agent dag reconcile-run --run-id <run-id> --action supersede --reason "..." # 显式保留证据并标记为任务已另行完成
 loop-agent dag reconcile-run --run-id <run-id> --action abandon --reason "..."   # 显式保留证据并收口为已放弃
+loop-agent dag rerun --run-id <run-id> --from-node <node-id> --plan [--json]  # 从节点重跑资格预检（不执行）
+loop-agent dag rerun --run-id <run-id> --from-node <node-id> --plan-hash <sha256> --request-id <key> --reason "..." [--json]  # 安全子图 continuation
+loop-agent dag rerun-task --run-id <run-id> --reason "..." --request-id <key> [--profile auto] [--task-id <id>] [--json]  # standalone 完整任务重跑
 loop-agent dag reconcile-tasks --glob '<pattern>'         # 仅报告的 task/run/artifact/verify drift audit
 loop-agent dag final-verification <task-id>               # 生成 closeout DAG，closeout artifact 后再 final verify
 loop-agent dag decision inspect --run-id <run-id> [--node-id <node-id>]   # dry-run envelope 重解析；除 run 缺失外 exit 0

package/skills/playwright-cli-case-generator/SKILL.md

@@ -20,10 +20,20 @@ Playwright/Pytest 源码，也不修改被测应用。
 
 ## 输出
 
-- 写 `index.md`、`manifest.json` 与独立 case 文件
+- 写 `index.md`、`manifest.draft.json`（生成阶段；materialize 会写成
+  `manifest.json`）与独立 case 文件
   `FE-<FEATURE>-<NNN>-<dimension>.md`；`dimension` 仅为 `core`、`boundary`、
   `flow` 或 `backend`。
-- `manifest.json` 使用 `schemaVersion: 1`，每项只含 `caseId`、`casePath`、
+- **ID 契约（高频失败点，禁止混用）**：
+  - `caseId` / 文件名 = **用例 ID**，形态 `FE-<FEATURE>-<NNN>-<dimension>`
+    （例：`FE-LOGIN-001-core`）。**禁止**把验收标准写成 caseId
+    （错误：`AC-FE-001.md` / `caseId: "AC-FE-001"`）。
+  - `acIds` = **验收标准 ID 列表**，形态 `AC-FE-*` / `AC-*`
+    （例：`["AC-FE-001"]`）。**禁止**把用例 ID 放进 acIds
+    （错误：`acIds: ["FE-LOGIN-001-core"]`）。
+  - `casePath` 必须等于 `testcase/frontend/cases/<caseId>.md`；
+    `evidenceDir` 必须等于 `testcase/frontend/evidence/<caseId>/`。
+- `manifest` 使用 `schemaVersion: 1`，每项只含 `caseId`、`casePath`、
   `dimension`、`acIds`、`evidenceDir`。所有 ID、路径和 evidenceDir 必须唯一，
   并位于 `testcase/frontend/` 内。
 - `index.md` 按功能点列出 case、维度、AC、数据依赖、API 映射和预期执行状态。
@@ -31,9 +41,9 @@ Playwright/Pytest 源码，也不修改被测应用。
 每个 case 必须包含：
 
 1. 元信息：功能、CRUD 分类、维度、关联 AC、RAG 来源、API 映射状态与数据策略。
-2. 前置条件：独立 `-s=<case-id>` session、登录状态、fixture/存量数据、清理责任。
-3. 可独立执行的命令序列：使用 RAG `context.md` 中已解析的绝对 `baseUrl`（优先来自任务源 `config.md`；缺失时默认 `http://localhost:5173`），写成
-   `open --browser=chrome --headed <resolved-base-url>`，禁止保留 `<base-url>` 占位符；再按需登录/数据准备、
+2. 前置条件：默认浏览器 session 中的登录状态、fixture/存量数据、清理责任；不得用 `-s=<case-id>` 建立 named session。
+3. 可独立执行的命令序列：使用 RAG `context.md` 中已解析的绝对 `baseUrl`（优先来自任务源 `config.md`；缺失时默认 `http://localhost:5173`），必须以
+   `playwright-cli open --browser=chrome --headed <resolved-base-url>` 开始，禁止保留 `<base-url>` 占位符，也不得使用 `-s=<case-id>` 或其他 named session；再按需登录/数据准备、
    `snapshot` 后优先使用元素引用、操作、UI 断言、可选 API 断言、cleanup、`close`。
 4. 明确的 UI/API 预期与数据清理结果；无法满足的环境或数据依赖必须写为 `blocked`。
 
@@ -42,6 +52,14 @@ Playwright/Pytest 源码，也不修改被测应用。
 `playwright-cli` skill 已声明的接口；不要生成 `requests --clear`、
 `request-body` 或 `response-body`。
 
+### playwright-cli-only（硬约束）
+
+- 用例步骤只能使用 `playwright-cli` skill 已声明的命令语法。
+- **禁止**裸 `playwright`、`npx playwright`、`playwright test`、`@playwright/test`、
+  Node Playwright API 或生成 Playwright/Pytest 源码。
+- `playwright-cli` 不可用时不得降级到原生 Playwright；应写 blocked evidence，
+  `blockedReason: playwright-cli-unavailable`。
+
 ## 覆盖矩阵
 
 | CRUD 类型 | 必选 | 条件 |
@@ -63,8 +81,18 @@ Playwright/Pytest 源码，也不修改被测应用。
 
 - C-新增优先使用需求中给出的测试数据；仅在已授权 API 映射存在时才描述临时构造
   与清理。
-- R/U/D 优先使用知识包登记的 fixture 或 test-data；不足时只能使用已授权的
-  测试环境 API 注入并清理。
+- R 查询优先使用知识包登记的 fixture 或当前用户可见数据。
+- **U/D 修改删除归属顺序（硬约束）**：
+  1. 仅操作可由**当前登录用户身份**与 UI/API 可观测归属字段共同证明的数据；
+     禁止只凭名称、猜测 ID 或列表顺序认定归属。
+  2. 当前用户无可用数据时，优先在当前用户上下文创建带 run/case 可追踪标记、
+     可清理的数据，再执行 U/D，并在 cleanup 中验证清理。
+  3. 无法安全创建时，仅可使用任务源/RAG 已确认且受路径/环境约束的 Mock，
+     并明确标注为 Mock（不得声称真实后端验证）。
+  4. 既无法证明归属、也无法安全创建或 Mock 时，写 `blocked` evidence，
+     `blockedReason` 使用：`current-user-data-unavailable` |
+     `data-ownership-unverifiable` | `safe-test-data-setup-unavailable`，不执行 U/D。
+  5. 禁止修改/删除其他用户数据、共享 fixture、生产数据或无法确认可清理的数据。
 - 禁止使用生产 URL、真实用户凭据或不可清理的数据写入。无法证明隔离与清理时，
   case 必须为 `blocked`。