@tea-agent/loop-agent 0.24.6 → 0.24.8

package/CHANGELOG.md

@@ -6,6 +6,34 @@
 
 - Observe / Inspect 节点检查器在「节点输出」左侧新增「节点输入」页签：只读投影冻结 `run.json` 顶层节点定义（任务正文、依赖、执行器摘要、边界）与可选 assembled prompt 指纹；完整 assembled prompt 与动态展开子节点仍不在本轮范围
 
+### 修复
+
+- 修复前端证据校验在 Windows 下通过长 `node -e` 命令执行时的终端转义崩溃：改为由 runtime 内部直接校验，兼容 CMD、Git Bash、PowerShell 与 Unix shell
+
+## [0.24.8] - 2026-07-29
+
+### 重点更新
+
+- 修复 FINAL-VERIFY 改写已存在的 allowed_paths 证据（gitignore）时 Git checkpoint 误失败，以及 record-error 后 Task Pool 卡在 Running 无法 mark-failed/retry 的问题
+
+### 修复
+
+- `finalizeGitTask` 对 allowed_paths 内的 pre-existing ignored evidence 允许 rewrite 并 force-add
+- `runReadyTasks` 在 record-error 时 best-effort 投影 `runs.jsonl` + Failed 状态，便于官方 retry
+
+## [0.24.7] - 2026-07-29
+
+### 重点更新
+
+- 修复 Feature Verification Bundle 在 Delivery 重验时因绝对路径 artifact、`qa-testcode` 类型与 `run_record` 后写 hash 漂移而失败的问题
+
+### 修复
+
+- Outcome 投影强制写出 repo-relative artifact 路径
+- Delivery `verifyArtifactRefs` 接受位于仓库内的绝对路径（兼容旧 envelope）
+- `verifyBundleTaskSpecBindings` 接受 `qa-testcode`（backend-test）与 `qa-execute`（frontend-test）
+- Bundle 重验仅 rehash typed evidence（backend/frontend-test-result），忽略可能后写的 run_record
+
 ## [0.24.6] - 2026-07-29
 
 ### 重点更新

package/dist/executors/shell-executor.js

@@ -8,7 +8,7 @@ import { buildRequirementCoverageGateShellCommand, expandShellPreset, buildVerdi
 import { materializeBackendTestAnalysisContract } from "../workflows/dag/backend-test-analysis-contract.js";
 import { extractBackendTestContractEnvelope } from "../workflows/dag/backend-test-contract-envelope.js";
 import { materializeFrontendImplementationContract } from "../workflows/dag/frontend-implementation-contract.js";
-import { materializeFrontendTestResult, } from "../workflows/dag/frontend-test-result-contract.js";
+import { materializeFrontendTestResult, validateFrontendCaseEvidence, } from "../workflows/dag/frontend-test-result-contract.js";
 import { formatFrontendVerificationTraceStdout, runFrontendVerificationTraceGate, } from "../workflows/dag/frontend-verification-trace.js";
 import { formatFrontendWorktreeDiffStdout, runFrontendWorktreeDiffGate, } from "../workflows/dag/frontend-worktree-diff.js";
 import { formatFrontendFailureAssessStdout, formatFrontendRepairContractStdout, runFrontendFailureAssessGate, runFrontendRepairContractGate, } from "../workflows/dag/frontend-repair.js";
@@ -897,6 +897,38 @@ async function executeFrontendVerificationBundle(input, meta) {
         };
     }
 }
+async function executeFrontendTestEvidenceValidation(input) {
+    const started = Date.now();
+    try {
+        const result = await validateFrontendCaseEvidence({ workspaceRoot: input.cwd });
+        const output = `frontend case evidence validation cases=${result.cases} findings=${result.issues.length}${result.issues.length ? ` issues=${JSON.stringify(result.issues)}` : ""}`;
+        if (result.hardFail) {
+            return {
+                ok: false,
+                stdout: "",
+                stderr: `frontend-test evidence hard-fail: ${JSON.stringify(result.issues)}`,
+                failureCategory: "nonzero-exit",
+                durationMs: Date.now() - started,
+            };
+        }
+        return {
+            ok: true,
+            stdout: output,
+            stderr: "",
+            failureCategory: "success",
+            durationMs: Date.now() - started,
+        };
+    }
+    catch (error) {
+        return {
+            ok: false,
+            stdout: "",
+            stderr: error instanceof Error ? error.message : String(error),
+            failureCategory: "invalid-output",
+            durationMs: Date.now() - started,
+        };
+    }
+}
 async function executeFrontendLintBaseline(input, meta) {
     const started = Date.now();
     const shell = input.task.shell;
@@ -997,6 +1029,9 @@ export async function executeDagShellNode(input, meta) {
             return { ok: false, stdout: "", stderr: error instanceof Error ? error.message : String(error), failureCategory: "invalid-output", durationMs: Date.now() - started };
         }
     }
+    if (shell?.frontendTestEvidenceValidation) {
+        return executeFrontendTestEvidenceValidation(input);
+    }
     if (shell?.backendTestPipeline) {
         return executeBackendTestPipelineWithWriteGuard(input, meta);
     }

package/dist/worker/delivery/git-transaction.js

@@ -101,11 +101,12 @@ export async function finalizeGitTask(transaction, outcome) {
     await assertTransactionPosition(transaction.repoRoot, current);
     const currentIgnored = await readIgnoredBaseline(transaction.repoRoot);
     const ignoredBaselineByPath = new Map(current.ignoredBaseline.map((entry) => [entry.path, entry.sha256]));
-    const changedBaselineIgnored = currentIgnored.filter((entry) => ignoredBaselineByPath.has(entry.path) && ignoredBaselineByPath.get(entry.path) !== entry.sha256).map((entry) => entry.path);
-    const missingBaselineIgnored = current.ignoredBaseline.filter((entry) => !currentIgnored.some((candidate) => candidate.path === entry.path)).map((entry) => entry.path);
-    if (changedBaselineIgnored.length > 0 || missingBaselineIgnored.length > 0) {
-        throw new Error(`pre-existing ignored file changed during Git transaction: ${[...changedBaselineIgnored, ...missingBaselineIgnored].join(", ")}`);
-    }
+    const changedBaselineIgnored = currentIgnored
+        .filter((entry) => ignoredBaselineByPath.has(entry.path) && ignoredBaselineByPath.get(entry.path) !== entry.sha256)
+        .map((entry) => entry.path);
+    const missingBaselineIgnored = current.ignoredBaseline
+        .filter((entry) => !currentIgnored.some((candidate) => candidate.path === entry.path))
+        .map((entry) => entry.path);
     const existing = current.checkpoints.find((entry) => entry.workerRunId === outcome.workerRunId);
     if (outcome.status === "reused" || existing) {
         if (!existing)
@@ -123,12 +124,28 @@ export async function finalizeGitTask(transaction, outcome) {
     const newIgnored = currentIgnored.map((entry) => entry.path).filter((entry) => !ignoredBaselineByPath.has(entry));
     if (outcome.status === "succeeded") {
         const allowedPaths = expandAllowedPathsForWorkflow(resolveWorkflow(outcome.taskSpec).workflow, outcome.taskSpec.constraints.allowed_paths);
+        const isAllowedEvidencePath = (entry) => !isSensitivePath(entry) &&
+            !isEphemeralToolCachePath(entry) &&
+            allowedPaths.some((glob) => matchesGlob(entry, glob));
+        // Pre-existing ignored evidence under allowed_paths may be rewritten by
+        // FINAL-VERIFY smoke / verify-final and must force-add into the checkpoint.
+        // Other baseline ignored mutations remain fail-closed (e.g. dist/, secrets).
+        const blockedBaselineChanged = changedBaselineIgnored.filter((entry) => !isAllowedEvidencePath(entry));
+        const blockedBaselineMissing = missingBaselineIgnored.filter((entry) => !isEphemeralToolCachePath(entry) && !isAllowedEvidencePath(entry));
+        if (blockedBaselineChanged.length > 0 || blockedBaselineMissing.length > 0) {
+            throw new Error(`pre-existing ignored file changed during Git transaction: ${[...blockedBaselineChanged, ...blockedBaselineMissing].join(", ")}`);
+        }
         // Evidence under allowed_paths may be gitignored for local convenience (e.g.
         // reports/welcome/** smoke JSON) but must still checkpoint for Task Pool Done.
         // Sensitive / out-of-scope ignored files remain fail-closed; ephemeral tool
         // caches neither block nor force-add.
         const forceAddIgnored = [];
         const blockedIgnored = [];
+        const rewrittenBaselineEvidence = changedBaselineIgnored.filter((entry) => isAllowedEvidencePath(entry));
+        for (const entry of rewrittenBaselineEvidence) {
+            if (!forceAddIgnored.includes(entry))
+                forceAddIgnored.push(entry);
+        }
         for (const entry of newIgnored) {
             if (isEphemeralToolCachePath(entry))
                 continue;
@@ -137,7 +154,8 @@ export async function finalizeGitTask(transaction, outcome) {
                 continue;
             }
             if (allowedPaths.some((glob) => matchesGlob(entry, glob))) {
-                forceAddIgnored.push(entry);
+                if (!forceAddIgnored.includes(entry))
+                    forceAddIgnored.push(entry);
             }
             else {
                 blockedIgnored.push(entry);
@@ -166,7 +184,10 @@ export async function finalizeGitTask(transaction, outcome) {
             await assertTransactionPosition(transaction.repoRoot, { ...current, lastCheckpoint: commit });
             await assertCheckpointMetadata(transaction.repoRoot, commit, outcome.taskSpec, outcome.workerRunId);
             const afterCommitIgnored = await readIgnoredBaseline(transaction.repoRoot);
-            assertIgnoredBaselineUnchanged(current.ignoredBaseline.filter((entry) => !isEphemeralToolCachePath(entry.path)), afterCommitIgnored.filter((entry) => !isEphemeralToolCachePath(entry.path)));
+            // force-add may promote allowed evidence from ignored → tracked; drop those
+            // paths from the post-commit baseline equality check.
+            const forceAdded = new Set(forceAddIgnored);
+            assertIgnoredBaselineUnchanged(current.ignoredBaseline.filter((entry) => !isEphemeralToolCachePath(entry.path) && !forceAdded.has(entry.path)), afterCommitIgnored.filter((entry) => !isEphemeralToolCachePath(entry.path) && !forceAdded.has(entry.path)));
         }
         catch (error) {
             const branch = await git(transaction.repoRoot, ["branch", "--show-current"]).catch(() => "");
@@ -199,6 +220,10 @@ export async function finalizeGitTask(transaction, outcome) {
             changedFiles: checkpointFiles,
         };
     }
+    // Failed / keep-diff paths still fail closed on unexpected baseline ignored mutations.
+    if (changedBaselineIgnored.length > 0 || missingBaselineIgnored.length > 0) {
+        throw new Error(`pre-existing ignored file changed during Git transaction: ${[...changedBaselineIgnored, ...missingBaselineIgnored].join(", ")}`);
+    }
     const artifactDir = path.join(path.dirname(transaction.recordPath), "failures", outcome.workerRunId);
     await captureFailureArtifacts(transaction.repoRoot, artifactDir, changes, newIgnored, outcome);
     if (outcome.keepFailedDiff) {

package/dist/worker/delivery/verification-bundle.js

@@ -404,7 +404,23 @@ export async function verifyBundleOutcomes(repoRoot, bundle) {
             return false;
         if (JSON.stringify(verified.artifacts) !== JSON.stringify(outcome.artifacts))
             return false;
-        if (!await verifyArtifactRefs(repoRoot, outcome.artifacts))
+        // Rehash only durable typed evidence. run_record/dag_json may be rewritten
+        // after outcome projection (worker-run-record appends report commands).
+        const evidenceArtifacts = outcome.artifacts.filter((artifact) => {
+            const kind = artifact.kind ?? "";
+            if (kind === "run_record" || kind === "dag_json")
+                return false;
+            if (kind === "backend-test-result" ||
+                kind === "frontend-test-result" ||
+                kind.includes("backend-test-result") ||
+                kind.includes("frontend-test-result")) {
+                return true;
+            }
+            // Unknown kinds: still rehash unless clearly infrastructure paths.
+            return (!artifact.path.includes("worker-run-record") &&
+                !artifact.path.includes("-dag.json"));
+        });
+        if (!await verifyArtifactRefs(repoRoot, evidenceArtifacts))
             return false;
     }
     return true;
@@ -417,9 +433,12 @@ export function verifyBundleTaskSpecBindings(bundle, specs) {
             return false;
         taskIds.add(outcome.taskId);
         const spec = specs.get(outcome.taskId);
+        // Typed verification tasks may be qa-execute (frontend-test) or qa-testcode
+        // (backend-test Markdown-first). Delivery binds on feature_id + workflow.
+        const typedVerificationTypes = new Set(["qa-execute", "qa-testcode"]);
         if (!spec ||
             spec.feature_id !== bundle.featureId ||
-            spec.type !== "qa-execute" ||
+            !typedVerificationTypes.has(spec.type) ||
             spec.execution?.workflow !== outcome.workflow)
             return false;
     }
@@ -460,9 +479,11 @@ async function verifyArtifactRefs(repoRoot, artifacts) {
         return false;
     }
     for (const artifact of artifacts) {
-        if (path.isAbsolute(artifact.path))
-            return false;
-        const lexical = path.resolve(canonicalRepoRoot, artifact.path);
+        // Accept absolute paths only when they resolve inside the repo (legacy
+        // envelopes may store abs paths). Prefer relative for new projections.
+        const lexical = path.isAbsolute(artifact.path)
+            ? path.resolve(artifact.path)
+            : path.resolve(canonicalRepoRoot, artifact.path);
         let resolved;
         let content;
         try {

package/dist/worker/outcomes/projector.js

@@ -111,8 +111,12 @@ export async function projectOutcome(input) {
         if (artifact.sha256 && artifact.sha256 !== recomputed) {
             return contractError(`artifact sha256 mismatch for ${artifact.path}: declared=${artifact.sha256} actual=${recomputed}`);
         }
+        // Persist portable repo-relative paths only (Delivery verifyArtifactRefs rejects abs paths).
+        const relativePath = path
+            .relative(path.resolve(input.repoRoot), resolved)
+            .replace(/\\/g, "/");
         validatedArtifacts.push({
-            path: artifact.path.replace(/\\/g, "/"),
+            path: relativePath,
             sha256: recomputed,
             ...(artifact.kind ? { kind: artifact.kind } : {}),
             ...(artifact.schemaId ? { schemaId: artifact.schemaId } : {}),

package/dist/worker/runner/run-ready.js

@@ -304,11 +304,51 @@ export async function runReadyTasks(options) {
             if (result.status !== "succeeded") {
                 await options.onTaskFinalized?.({ status: result.status, taskSpec, workerRunId: result.workerRunId, runRecordPath: result.runRecordPath });
             }
+            const recordErrorMessage = errorMessage(error);
+            // Always project a Pool run fact for record-error so operators can
+            // mark-failed / retry without hand-editing Running state.
+            try {
+                await recordTaskPoolRun({
+                    repoRoot: options.repoRoot,
+                    run: {
+                        schemaVersion: 1,
+                        batchRunId,
+                        workerRunId: result.workerRunId,
+                        taskId: result.businessId,
+                        featureId: taskSpec.feature_id,
+                        status: "run-error",
+                        recordedAt: new Date().toISOString(),
+                        error: recordErrorMessage,
+                        runRecordPath: result.runRecordPath,
+                        ...(result.workflow ? { workflow: result.workflow } : {}),
+                        ...(controllerIdentity ? { controllerIdentity } : {}),
+                        ...(retryOfWorkerRunId ? { retryOfWorkerRunId } : {}),
+                    },
+                });
+                await writeTaskPoolState(options.repoRoot, {
+                    schemaVersion: 2,
+                    featureId: taskSpec.feature_id,
+                    taskId,
+                    status: "Failed",
+                    updatedAt: new Date().toISOString(),
+                    workerRunId: result.workerRunId,
+                    lastRunRecordPath: result.runRecordPath,
+                    failure: {
+                        category: "EnvFailure",
+                        recommendedFollowUpKind: "manual-review",
+                        derivedFollowUpTaskId: `${taskId}-record-error-review`,
+                        source: "report-decision",
+                    },
+                });
+            }
+            catch {
+                // Best-effort; batch still reports record-error.
+            }
             tasks.push({
                 taskId,
                 workerRunId: result.workerRunId,
                 status: "record-error",
-                error: errorMessage(error),
+                error: recordErrorMessage,
                 runRecordPath: result.runRecordPath,
             });
             break;

package/dist/workflows/dag/frontend-test-result-contract.js

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { lstat, readFile, realpath } from "node:fs/promises";
+import { lstat, readFile, realpath, stat } from "node:fs/promises";
 import path from "node:path";
 import { z } from "zod";
 import { writeDagRunJsonArtifact } from "../../infrastructure/harness/artifact-store.js";
@@ -68,6 +68,111 @@ export const frontendTestResultContractSchema = z.object({
         ctx.addIssue({ code: z.ZodIssueCode.custom, path: ["integrationMode"], message: "real integration requires passed outcome" });
     }
 });
+async function isNonEmptyFile(filePath) {
+    try {
+        const info = await stat(filePath);
+        return info.isFile() && info.size > 0;
+    }
+    catch {
+        return false;
+    }
+}
+function isSafeEvidenceShellPath(value) {
+    return (typeof value === "string" &&
+        value.length > 0 &&
+        !path.isAbsolute(value) &&
+        !path.win32.isAbsolute(value) &&
+        !value.includes(".."));
+}
+/**
+ * Validate frontend browser evidence without going through a shell command.
+ * Keeping this in the Node executor avoids CMD/Git Bash/PowerShell quoting and
+ * backslash interpretation for the former long `node -e` command.
+ */
+export async function validateFrontendCaseEvidence(input) {
+    const manifestPath = path.join(input.workspaceRoot, "testcase/frontend/cases/manifest.json");
+    try {
+        await stat(manifestPath);
+    }
+    catch {
+        throw new Error("missing testcase/frontend/cases/manifest.json");
+    }
+    const manifest = JSON.parse(await readFile(manifestPath, "utf8"));
+    if (!Array.isArray(manifest.cases))
+        throw new Error("invalid frontend case manifest");
+    const statuses = new Set(["passed", "failed", "blocked"]);
+    const issues = [];
+    let hardFail = false;
+    for (const rawCase of manifest.cases) {
+        const item = rawCase;
+        const id = typeof item?.caseId === "string" ? item.caseId : "?";
+        const dir = item?.evidenceDir;
+        const prefix = `testcase/frontend/evidence/${id}`;
+        if (!item ||
+            typeof item.caseId !== "string" ||
+            typeof dir !== "string" ||
+            !isSafeEvidenceShellPath(dir) ||
+            !(dir === prefix || dir.startsWith(`${prefix}/`))) {
+            hardFail = true;
+            issues.push({ ruleId: "unsafe-evidence-dir", caseId: id, detail: String(dir) });
+            continue;
+        }
+        const execution = path.join(input.workspaceRoot, dir, "execution.md");
+        const resultPath = path.join(input.workspaceRoot, dir, "case-result.json");
+        if (!(await isNonEmptyFile(execution))) {
+            issues.push({ ruleId: "missing-execution", caseId: id, detail: "execution.md is missing or empty" });
+        }
+        let result = null;
+        if (!(await isNonEmptyFile(resultPath))) {
+            issues.push({ ruleId: "missing-case-result", caseId: id, detail: "case-result.json is missing" });
+            continue;
+        }
+        try {
+            result = JSON.parse(await readFile(resultPath, "utf8"));
+        }
+        catch {
+            issues.push({ ruleId: "invalid-case-result", caseId: id, detail: "case-result.json is malformed" });
+            continue;
+        }
+        if (!result || result.caseId !== id) {
+            issues.push({ ruleId: "case-result-identity", caseId: id, detail: "case-result caseId does not match manifest" });
+        }
+        if (!statuses.has(String(result?.status))) {
+            issues.push({ ruleId: "invalid-case-status", caseId: id, detail: "status must be passed, failed, or blocked" });
+        }
+        if (!Array.isArray(result?.evidencePaths)) {
+            issues.push({ ruleId: "invalid-evidence-paths", caseId: id, detail: "evidencePaths must be an array" });
+        }
+        else {
+            for (const evidencePath of result.evidencePaths) {
+                if (!isSafeEvidenceShellPath(evidencePath)) {
+                    hardFail = true;
+                    issues.push({ ruleId: "unsafe-evidence-path", caseId: id, detail: String(evidencePath) });
+                    continue;
+                }
+                const currentPrefix = `${prefix}/`;
+                if (evidencePath.startsWith("testcase/frontend/evidence/") && !evidencePath.startsWith(currentPrefix)) {
+                    hardFail = true;
+                    issues.push({ ruleId: "cross-case-evidence-path", caseId: id, detail: evidencePath });
+                    continue;
+                }
+                const target = evidencePath.startsWith("testcase/")
+                    ? path.join(input.workspaceRoot, evidencePath)
+                    : path.join(input.workspaceRoot, dir, evidencePath);
+                if (!(await isNonEmptyFile(target))) {
+                    issues.push({ ruleId: "missing-evidence", caseId: id, detail: `${evidencePath} is missing or empty` });
+                }
+            }
+        }
+        if (result?.status === "passed" && (!Array.isArray(result.evidencePaths) || !result.evidencePaths.some((entry) => /\.(png|jpg|jpeg|webp|zip|har|webm|mp4)$/i.test(String(entry))))) {
+            issues.push({ ruleId: "passed-without-browser-evidence", caseId: id, detail: "passed case has no screenshot, HAR, video, or equivalent browser artifact" });
+        }
+        if (result?.status === "blocked" && (typeof result.blockedReason !== "string" || !result.blockedReason.trim())) {
+            issues.push({ ruleId: "blocked-reason", caseId: id, detail: "blocked result has no usable reason" });
+        }
+    }
+    return { cases: manifest.cases.length, issues, hardFail };
+}
 function sha256(content) {
     return createHash("sha256").update(content).digest("hex");
 }
@@ -214,43 +319,3 @@ export function buildFrontendTestOutcomeGateShellSnippet(options) {
         `node -e 'const fs=require("fs");const r=JSON.parse(fs.readFileSync(process.argv[1],"utf8"));const ok=r.outcome==="passed"&&r.integrationMode==="real"&&Number(r.totals?.failed||0)===0&&Number(r.totals?.blocked||0)===0&&Array.isArray(r.acceptanceCoverage?.missing)&&r.acceptanceCoverage.missing.length===0;console.log("frontend-test outcome="+r.outcome+" integrationMode="+r.integrationMode);if(!ok)process.exit(1);' "\${RESULT}"`,
     ].join("; ");
 }
-/**
- * Shared frontend-test evidence advisory check for map children + node 7.
- * Hard-fails only for unsafe evidence directories or evidence paths. Missing,
- * malformed, or empty evidence is reported without mutating case outputs.
- */
-export function buildFrontendCaseEvidenceValidateShellSnippet() {
-    const body = [
-        "const fs=require('fs'),path=require('path');",
-        "const manifestPath='testcase/frontend/cases/manifest.json';",
-        "if(!fs.existsSync(manifestPath))throw new Error('missing '+manifestPath);",
-        "const manifest=JSON.parse(fs.readFileSync(manifestPath,'utf8'));",
-        "if(!Array.isArray(manifest.cases))throw new Error('invalid frontend case manifest');",
-        "const statuses=new Set(['passed','failed','blocked']);",
-        "const issues=[];",
-        "let hardFail=false;",
-        "function isSafeRel(p){return typeof p==='string'&&p.length>0&&!path.isAbsolute(p)&&!path.win32.isAbsolute(p)&&!p.includes('..');}",
-        "for(const c of manifest.cases){",
-        " const id=c&&typeof c.caseId==='string'?c.caseId:'?';",
-        " const dir=c&&c.evidenceDir;",
-        " const prefix='testcase/frontend/evidence/'+id;",
-        " if(!c||typeof c.caseId!=='string'||typeof dir!=='string'||!isSafeRel(dir)||!(dir===prefix||dir.startsWith(prefix+'/'))){",
-        "  hardFail=true; issues.push({ruleId:'unsafe-evidence-dir',caseId:id,detail:String(dir)}); continue;",
-        " }",
-        " const execution=path.join(dir,'execution.md');",
-        " const resultPath=path.join(dir,'case-result.json');",
-        " if(!fs.existsSync(execution)||!fs.statSync(execution).isFile()||fs.statSync(execution).size===0)issues.push({ruleId:'missing-execution',caseId:id,detail:'execution.md is missing or empty'});",
-        " let result=null;",
-        " if(!fs.existsSync(resultPath)){issues.push({ruleId:'missing-case-result',caseId:id,detail:'case-result.json is missing'});continue;}",
-        " try{result=JSON.parse(fs.readFileSync(resultPath,'utf8'));}catch(e){issues.push({ruleId:'invalid-case-result',caseId:id,detail:'case-result.json is malformed'});continue;}",
-        " if(!result||result.caseId!==id)issues.push({ruleId:'case-result-identity',caseId:id,detail:'case-result caseId does not match manifest'});",
-        " if(!statuses.has(result&&result.status))issues.push({ruleId:'invalid-case-status',caseId:id,detail:'status must be passed, failed, or blocked'});",
-        " if(!Array.isArray(result&&result.evidencePaths)){issues.push({ruleId:'invalid-evidence-paths',caseId:id,detail:'evidencePaths must be an array'});}else{for(const p of result.evidencePaths){if(!isSafeRel(p)){hardFail=true;issues.push({ruleId:'unsafe-evidence-path',caseId:id,detail:String(p)});continue;}const currentPrefix=prefix+'/';if(p.startsWith('testcase/frontend/evidence/')&&!p.startsWith(currentPrefix)){hardFail=true;issues.push({ruleId:'cross-case-evidence-path',caseId:id,detail:p});continue;}const target=p.startsWith('testcase/')?p:path.join(dir,p);if(!fs.existsSync(target)||!fs.statSync(target).isFile()||fs.statSync(target).size===0)issues.push({ruleId:'missing-evidence',caseId:id,detail:p+' is missing or empty'});}}",
-        " if(result&&result.status==='passed'&&(!Array.isArray(result.evidencePaths)||!result.evidencePaths.some(p=>/\\.(png|jpg|jpeg|webp|zip|har|webm|mp4)$/i.test(p))))issues.push({ruleId:'passed-without-browser-evidence',caseId:id,detail:'passed case has no screenshot, HAR, video, or equivalent browser artifact'});",
-        " if(result&&result.status==='blocked'&&(typeof result.blockedReason!=='string'||!result.blockedReason.trim()))issues.push({ruleId:'blocked-reason',caseId:id,detail:'blocked result has no usable reason'});",
-        "}",
-        "if(hardFail){console.error('frontend-test evidence hard-fail: '+JSON.stringify(issues)); process.exit(1);}",
-        "console.log('frontend case evidence advisory validation ok cases='+manifest.cases.length+' findings='+issues.length+(issues.length?(' issues='+JSON.stringify(issues)):''));",
-    ].join("");
-    return ["node -e", JSON.stringify(body)].join(" ");
-}

package/dist/workflows/dag/init-hybrid.js

@@ -25,7 +25,7 @@ import { normalizeTaskRequirementText, resolveTaskDagTemplateSelection, } from "
 import { BACKEND_TEST_EXECUTION_DEFAULT_TEST_ROOT, buildBackendTestExecutionPreflightShellSnippet, } from "./backend-test-execution-contract.js";
 import { buildBackendTestOutcomeGateShellSnippet } from "./backend-test-result-contract.js";
 import { buildBackendTestIntakeContext } from "./backend-test-intake-context.js";
-import { buildFrontendCaseEvidenceValidateShellSnippet, buildFrontendTestOutcomeGateShellSnippet, } from "./frontend-test-result-contract.js";
+import { buildFrontendTestOutcomeGateShellSnippet } from "./frontend-test-result-contract.js";
 import { classifyFrontendRisk, } from "./frontend-risk.js";
 import { discoverFrontendProjectCapability, } from "./frontend-project-capability.js";
 import { FRONTEND_IMPLEMENTATION_CONTRACT_SCHEMA_ID, loadFrontendImplementationContractJsonSchema, } from "./frontend-implementation-contract.js";
@@ -3504,8 +3504,6 @@ function buildFrontendTestHybridDag(sources) {
             "process.stdout.write(JSON.stringify({cases:manifest.cases}));",
         ].join("")),
     ].join(" ");
-    // Heal malformed/missing case evidence to blocked; only unsafe evidenceDir hard-fails.
-    const evidenceValidation = buildFrontendCaseEvidenceValidateShellSnippet();
     const frontendTestOutcomeGate = buildFrontendTestOutcomeGateShellSnippet();
     const frontendCaseQualityAdvisory = [
         "node -e",
@@ -3753,9 +3751,9 @@ function buildFrontendTestHybridDag(sources) {
         writeSet: [`${evidenceRoot}/**`],
         allowedPaths: ["testcase/frontend/cases/**", `${evidenceRoot}/**`],
         forbiddenPaths: forbidden,
-        outputContract: "Deterministic evidence gate: heal missing/malformed case-result to blocked(invalid-evidence-shape); hard-fail only on unsafe evidenceDir. Does not block retrospect.",
-        subtask_prompt: "Validate frontend case evidence before result materialization. Prefer healing bad shapes to blocked so pipeline can still produce a report; only path-escape failures abort the node.",
-        shell: { commands: [evidenceValidation], cwd: ".", timeoutMs: 120000 },
+        outputContract: "Deterministic evidence gate: missing/malformed evidence is advisory; only unsafe evidenceDir or evidence paths hard-fail. Does not block retrospect.",
+        subtask_prompt: "Validate frontend case evidence before result materialization. Keep missing or malformed evidence as advisory findings; only path-escape failures abort the node.",
+        shell: { commands: [], frontendTestEvidenceValidation: {}, cwd: ".", timeoutMs: 120000 },
     }, {
         id: "materialize-frontend-test-result-shell",
         depends_on: ["validate-frontend-case-evidence-shell"],

package/dist/workflows/dag/types.js

@@ -280,6 +280,7 @@ export const dagBackendTestPipelineSchema = z.enum([
     "markdown-traceability",
     "markdown-execute-html",
 ]);
+export const dagFrontendTestEvidenceValidationSchema = z.object({}).strict();
 export const dagShellConfigSchema = z.object({
     commands: z.array(z.string()).default([]),
     preset: dagShellPresetSchema.optional(),
@@ -293,6 +294,7 @@ export const dagShellConfigSchema = z.object({
     frontendLintBaseline: dagFrontendLintBaselineSchema.optional(),
     frontendVerificationBundle: dagFrontendVerificationBundleSchema.optional(),
     frontendReviewContext: dagFrontendReviewContextSchema.optional(),
+    frontendTestEvidenceValidation: dagFrontendTestEvidenceValidationSchema.optional(),
     backendTestPipeline: dagBackendTestPipelineSchema.optional(),
     verifyEvidence: dagShellVerifyEvidenceSchema.optional(),
     repairArtifactGate: dagRepairArtifactGateSchema.optional(),

package/dist/workflows/dag/validate.js

@@ -461,10 +461,11 @@ function validateShellTaskConfig(task, spec, issues) {
         !shell.backendTestPipeline &&
         !shell.frontendPrewriteGate &&
         !shell.frontendVerificationBundle &&
-        !shell.frontendReviewContext) {
+        !shell.frontendReviewContext &&
+        !shell.frontendTestEvidenceValidation) {
         issues.push({
             type: "missing-shell-commands",
-            message: `shell task ${task.id} requires shell.preset, shell.verdictGate, shell.jsonArtifactGate, shell.backendTestPipeline, and/or non-empty shell.commands`,
+            message: `shell task ${task.id} requires a supported shell operation or non-empty shell.commands`,
         });
     }
     if (commands.some((command) => command.trim().length === 0)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tea-agent/loop-agent",
-  "version": "0.24.6",
+  "version": "0.24.8",
   "type": "module",
   "bin": {
     "loop-agent": "bin/loop-agent.js",