@tea-agent/loop-agent 0.25.4 → 0.25.5

package/AGENTS.md

@@ -46,6 +46,12 @@
 
 这不是 DAG 节点序列。复杂实现默认 Agent DAG；主 agent 拆任务、写 contract、结构化路径、审查 DAG/writeSet/profile/shell verification。微小任务可用 one-shot escape hatch 并记录边界与验证证据。
 
+启动 loop-agent DAG 流程后，主 agent 应自主推进到整个流程结束，不要中途请求无谓的人工确认（如“要我现在执行 DAG 吗？”）。只要 dry-run / validate / writeSet 审查通过就应直接执行并跑完全部 ranks；遇到真问题（契约不一致、writeSet 越界、verify 失败且超出 maxFixLoops、用户明显未授权的高风险动作）才停。即便 profile 是 supervised/reviewed，也不默认在 review-gate 主动停下等人——控制器会在需要人工 approve 时自行提示，主 agent 的职责是推动流程跑完。
+
+DAG 执行期间主 agent 必须持续轮询监视直到 run 结束（FINISHED / FAILED / 需要 approve），不能轮询一次就停下等用户；轮询间隔应合理（避免频繁唤醒浪费 token，也不得住一个节点上赌一次就走）。判活必须用可靠方式：看 `state.json` 的 `runner.heartbeatAt` 是否持续刷新 + `session-events.jsonl` 是否在增长 + `dag doctor` 的 `liveness` 字段，不要只用 `tasklist /FI "PID eq X"` 这类过滤语法在 Git Bash 下会误报 DEAD，从而错判一个正常工作的 run 为 orphaned。遇到疑似 stall 先按 `docs/runtime/agent-dag-runner.md` 查 `lastMeaningfulProgressAt` / provider 活动，有真实进展就继续等，绝不盲目 supersede。
+
+DAG 执行期间，主 agent 不得修改 writeSet 外的任何工作区文件（包括 AGENTS.md、docs、根配置等）。bounded writer 节点的 write guard 用「节点运行期间的工作区 diff」作为越界证据，不区分改动来自 pi 还是主会话——主会话在 pi 节点跑的时候改了 writeSet 外文件，会让 write guard 把账算到 pi 头上、判节点 ERROR、下游 cascade skip。需要改文档/约束时，要么在 DAG 启动前改完，要么等 run 结束后改；务必与 DAG 写入节点在时间上互斥。排查任务路由问题时优先用 `resolveTaskDagTemplateSelection` / `classifyTaskDemand` 等纯函数探针或 `--output` 指定临时路径，不要反复 `dag run-task`——每次调用（含 `--dry-run`）都会在 `.harness/dag-runs/active/` 新建一个 run 目录，dry-run 不执行节点但目录残留，堆积成「一堆 active run」的假象。
+
 ## 项目地图
 
 - `CONTEXT.md`：术语表

package/CHANGELOG.md

@@ -2,10 +2,50 @@
 
 ## [Unreleased]
 
+## [0.25.5] - 2026-07-31
+
+### 重点更新
+
+- 后端测试 DAG 新增确定性场景覆盖分析与 Markdown 到 pytest 的精准对应，显著提升测试质量度量的准确性与透明度
+- 受监督的 DAG 默认启用有界自愈闭环，能够自动处理可恢复的执行失败并安全重算后续节点
+- 全面加固客户端会话恢复机制，精准识别并补偿由模型服务瞬时异常引发的结构校验错误
+- 大幅增强 DAG 执行的确定性收尾能力，确保在模型输出不稳定或前置快照失败时安全降级
+
+### 新增
+
+- 后端测试固定 9 节点 DAG 新增可审计的场景覆盖与 Markdown→pytest 一一对应事实：节点 4 从严格 Coverage Matrix、Case Rule/Test Point 绑定及 OpenAPI required/enum/boundary/pattern/format 规则生成覆盖报告，节点 6 生成 1:1/1:0/1:N/0:1 对应报告，节点 7 校验一致性后物化 canonical manifest
+- 受监督的 DAG 默认启用有界自愈闭环：通过 maxFixLoops 派生收敛预算，将可恢复失败与合法的审查修订请求统一纳入恢复链，并确定性注入上一轮失败证据指针，同时保持对安全失败的不自动重试
+- 后端测试用例生成与独立 Review 改为产品需求优先，并穷举文档化 API 规则，涵盖生命周期、枚举等价类、长度数值边界及业务状态迁移等场景
+- 后端测试 HTML/facts 新增可展开的“用例场景覆盖分析”和“Markdown → pytest 一一对应”质量详情
+
+### 改进
+
+- 减少全量测试中的重复 CLI 冷启动和 self-host canary 二次打包安装场景，收敛低价值重复用例并保留关键端到端主路径
+- DAG 执行期间的主会话行为约束得到增补：启动后自主推进至结束、持续可靠判活、严格限制工作区文件修改，并优先使用纯函数探针排查路由
+
+### 修复
+
+- 修复后端测试节点 4/6 的确定性覆盖与对应分析在自身崩溃时被静默吞掉的问题，现会写入诊断信息并按基础设施故障安全停止
+- 修复后端测试节点 4、6、7 在缺失 spec.sourceBinding 时未统一停止的问题，避免上游回退导致下游 manifest 突发报错
+- 修复成功执行路径下 HTTP 请求/响应日志解析不规范的问题，现统一规范化大小写不敏感的日志前缀并完整解析 JSON，恢复报告中的请求参数与大响应正文
+- 修复 Pi writer 已输出合法结果却因前置说明、Markdown 装饰或中文标点被误判失败的问题，现确定性规范化唯一 outcome 且不影响无副作用操作
+- 修复 Pi writer 前置 Git 快照失败被延后处理的问题，现调用模型前即安全停止，并在失败信息中保留完整的尝试次数与错误上下文
+- 修复不稳定模型输出导致受监督 DAG 无法可信收尾的问题，现使用精确判定协议和有限重试，确保最终状态准确且保持安全关闭
+- 修复合并后 canonical DAG Pi MED 路由错误回退到旧模型的问题，统一恢复为正确配置
+- 修复脚手架样例漂移检查误判当前 worktree 目录名的问题，避免附加 worktree 触发稳定测试失败
+- 修复 Windows 8.3 短路径与长路径指向同一仓库时生成不同指纹的问题，避免应用数据命名空间冲突
+- 修复生成的 OpenCode 恢复插件在 busy→idle 竞态下丢失续接的问题，现保留待处理错误并在明确空闲后安全重试
+- 修复 Pi retry 配置读取将权限或 I/O 错误误判为缺文件的问题，现仅缺失文件时允许新建配置
+- 修复客户端瞬态恢复无法正确处理 TypeValidation 瞬时错误的问题，现能准确识别携带瞬时信号的错误并安全重试，纯 schema 校验失败仍被拒绝
+
 ## [0.25.4] - 2026-07-31
 
 ### 新增
 
+- stream run progress heartbeats
+
+### 新增
+
 - stream run progress heartbeats
 - improve HTML failure triage
 - add native checklist and HTML report gates

package/dist/commands/client-recovery.js

@@ -1,7 +1,12 @@
-import { mkdir, readFile, readdir, rename, rm, writeFile } from "node:fs/promises";
+import { mkdir, readFile, readdir, rename, rm, writeFile, } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
-export const CLIENT_RECOVERY_MODES = ["auto", "project", "user", "off"];
+export const CLIENT_RECOVERY_MODES = [
+    "auto",
+    "project",
+    "user",
+    "off",
+];
 export const OPENCODE_TRANSIENT_RETRY_PLUGIN_PATH = ".opencode/plugins/loop-agent-transient-retry.js";
 export const PERMANENT_ERROR_INTERACTION = "plugin-ignore-permanent-error";
 export const BACKOFF_MS = [2000, 4000, 8000, 16000, 30000];
@@ -16,14 +21,26 @@ export const PI_RECOMMENDED_RETRY = {
     },
 };
 const PERMANENT_MESSAGE_PATTERNS = [
-    { reason: "auth", pattern: /\b(401|unauthorized|invalid api key|authentication)\b/i },
-    { reason: "permission", pattern: /\b(403|forbidden|permission denied|not allowed)\b/i },
-    { reason: "quota", pattern: /\b(quota|rate.?limit|billing|insufficient.?credit)\b/i },
+    {
+        reason: "auth",
+        pattern: /\b(401|unauthorized|invalid api key|authentication)\b/i,
+    },
+    {
+        reason: "permission",
+        pattern: /\b(403|forbidden|permission denied|not allowed)\b/i,
+    },
+    {
+        reason: "quota",
+        pattern: /\b(quota|rate.?limit|billing|insufficient.?credit)\b/i,
+    },
     {
         reason: "context-overflow",
         pattern: /\b(context (length )?overflow|too many tokens|maximum context|context window)\b/i,
     },
-    { reason: "cancelled", pattern: /\b(cancelled|canceled|aborted by user|user cancel)\b/i },
+    {
+        reason: "cancelled",
+        pattern: /\b(cancelled|canceled|aborted by user|user cancel)\b/i,
+    },
     {
         reason: "business-validation",
         pattern: /\b(business validation|invalid task|schema validation)\b/i,
@@ -33,7 +50,6 @@ const TRANSIENT_MESSAGE_PATTERNS = [
     /\bcode[:\s]*502\b/i,
     /\b502\b/,
     /\bLLMRequestError\b/i,
-    /\bTypeValidationError\b/i,
     /\bnetwork fluctuation\b/i,
     /\btimeout\b/i,
     /\btransient provider failure\b/i,
@@ -90,13 +106,34 @@ function hasUnknownErrorShape(error) {
     }
     return false;
 }
+/**
+ * TypeValidation bypass shape: bare TypeValidationError (zod invalid_union
+ * surfaced directly by the provider/SDK instead of wrapped as UnknownError).
+ * Bypass only fires when combined with a transient signal (see classifyTransientUnknownError).
+ */
+function hasTypeValidationShape(error) {
+    const text = collectErrorText(error);
+    if (/\bTypeValidationError\b/i.test(text))
+        return true;
+    if (/Type validation failed/i.test(text))
+        return true;
+    if (error && typeof error === "object") {
+        const record = error;
+        if (typeof record.name === "string" &&
+            /TypeValidationError/i.test(record.name)) {
+            return true;
+        }
+    }
+    return false;
+}
 function isStandardApiError(error) {
     if (!error || typeof error !== "object")
         return false;
     const record = error;
     if (typeof record.name === "string" && /^APIError$/i.test(record.name))
         return true;
-    if (typeof record.name === "string" && /^(AuthError|PermissionError)$/i.test(record.name)) {
+    if (typeof record.name === "string" &&
+        /^(AuthError|PermissionError)$/i.test(record.name)) {
         return true;
     }
     return false;
@@ -106,7 +143,8 @@ function permanentReason(error) {
         const record = error;
         if (typeof record.name === "string" && /AuthError/i.test(record.name))
             return "auth";
-        if (typeof record.name === "string" && /PermissionError/i.test(record.name)) {
+        if (typeof record.name === "string" &&
+            /PermissionError/i.test(record.name)) {
             return "permission";
         }
         return "api-error";
@@ -137,6 +175,12 @@ function looksTransient(error) {
 /**
  * Decide whether an OpenCode error should be resumed by the project plugin.
  * Only compensates transient UnknownError paths that built-in APIError retry misses.
+ *
+ * TypeValidation bypass: a bare TypeValidationError (provider/SDK surfaces
+ * zod invalid_union directly, without the UnknownError wrapper) is treated as
+ * a retryable transient-unknown-error ONLY when it also carries a transient
+ * signal (502 / LLMRequestError / timeout / etc.). A pure schema mismatch
+ * without a transient signal is still rejected (resumable: false).
  */
 export function classifyTransientUnknownError(error) {
     const permanent = permanentReason(error);
@@ -147,7 +191,9 @@ export function classifyTransientUnknownError(error) {
             interaction: PERMANENT_ERROR_INTERACTION,
         };
     }
-    if (!hasUnknownErrorShape(error)) {
+    const isUnknownShape = hasUnknownErrorShape(error);
+    const isTypeValidationShape = hasTypeValidationShape(error);
+    if (!isUnknownShape && !isTypeValidationShape) {
         return {
             resumable: false,
             reason: "not-unknown-error",
@@ -164,7 +210,9 @@ export function classifyTransientUnknownError(error) {
     return { resumable: true, reason: "transient-unknown-error" };
 }
 export function nextBackoffMs(attempt) {
-    if (!Number.isInteger(attempt) || attempt < 0 || attempt >= BACKOFF_MS.length) {
+    if (!Number.isInteger(attempt) ||
+        attempt < 0 ||
+        attempt >= BACKOFF_MS.length) {
         return undefined;
     }
     return BACKOFF_MS[attempt];
@@ -173,10 +221,15 @@ export function canResumeSession(input) {
     if (input.sessionStatus === "retry") {
         return { allowed: false, reason: "builtin-retry-active" };
     }
+    if (!input.sessionStatus) {
+        return { allowed: false, reason: "session-status-unknown" };
+    }
     if (input.locked) {
         return { allowed: false, reason: "session-locked" };
     }
-    if (!input.idle || input.sessionStatus === "busy" || input.sessionStatus === "running") {
+    if (!input.idle ||
+        input.sessionStatus === "busy" ||
+        input.sessionStatus === "running") {
         return { allowed: false, reason: "session-busy" };
     }
     if (input.attempt >= MAX_SESSION_RETRIES) {
@@ -253,7 +306,12 @@ export function planPiRetryMerge(existing) {
             action: "write",
             reason: "missing-file",
             path: settingsPath,
-            next: { retry: { ...PI_RECOMMENDED_RETRY, provider: { ...PI_RECOMMENDED_RETRY.provider } } },
+            next: {
+                retry: {
+                    ...PI_RECOMMENDED_RETRY,
+                    provider: { ...PI_RECOMMENDED_RETRY.provider },
+                },
+            },
         };
     }
     if (!isRecord(existing)) {
@@ -276,7 +334,8 @@ export function planPiRetryMerge(existing) {
     }
     const retry = isRecord(existing.retry) ? { ...existing.retry } : {};
     const provider = isRecord(retry.provider) ? { ...retry.provider } : {};
-    let changed = !isRecord(existing.retry) || !isRecord(existing.retry.provider);
+    let changed = !isRecord(existing.retry) ||
+        !isRecord(existing.retry.provider);
     if (retry.enabled === undefined) {
         retry.enabled = PI_RECOMMENDED_RETRY.enabled;
         changed = true;
@@ -383,7 +442,8 @@ export async function applyPiRetryMerge(input) {
             const dir = path.dirname(settingsPath);
             const entries = await readdir(dir);
             await Promise.all(entries
-                .filter((name) => name.startsWith(`.${path.basename(settingsPath)}.`) && name.endsWith(".tmp"))
+                .filter((name) => name.startsWith(`.${path.basename(settingsPath)}.`) &&
+                name.endsWith(".tmp"))
                 .map((name) => rm(path.join(dir, name), { force: true })));
         }
         catch {
@@ -414,11 +474,13 @@ const MAX_RETRIES = ${MAX_SESSION_RETRIES};
 
 const sessionState = new Map();
 const sessionStatus = new Map();
+const pendingErrors = new Map();
+const recoveryWorkers = new Map();
 
 function getState(sessionId) {
   let state = sessionState.get(sessionId);
   if (!state) {
-    state = { attempt: 0, locked: false };
+    state = { attempt: 0, locked: false, rerunRequested: false };
     sessionState.set(sessionId, state);
   }
   return state;
@@ -449,9 +511,13 @@ function isTransientUnknown(error) {
   if (isPermanent(error)) return false;
   const text = textOf(error);
   const hasUnknown = /UnknownError/i.test(text) || (error && /UnknownError/i.test(String(error.name || "")));
-  if (!hasUnknown) return false;
+  const hasTypeValidation =
+    /\\bTypeValidationError\\b/i.test(text) ||
+    /Type validation failed/i.test(text) ||
+    (error && /TypeValidationError/i.test(String(error.name || "")));
+  if (!hasUnknown && !hasTypeValidation) return false;
   return (
-    /\\b(code[:\\s]*502|502|LLMRequestError|TypeValidationError|Type validation failed|network fluctuation|timeout|transient provider failure|non-standard)\\b/i.test(
+    /\\b(code[:\\s]*502|502|LLMRequestError|network fluctuation|timeout|transient provider failure|non-standard)\\b/i.test(
       text,
     ) ||
     (error && (error.code === 502 || error.status === 502))
@@ -474,68 +540,121 @@ async function wait(ms) {
 }
 
 function statusType(status) {
-  return status && typeof status.type === "string" ? status.type : undefined;
+  const type = status && typeof status.type === "string" ? status.type : undefined;
+  return type === "idle" || type === "retry" || type === "busy" ? type : undefined;
 }
 
 async function readSessionStatus(client, sessionId) {
   const cached = sessionStatus.get(sessionId);
-  if (cached === "retry") return cached;
+  if (cached === "retry" || cached === "busy") {
+    return { ok: true, type: cached };
+  }
   try {
-    const response = await client.session.status();
+    const response = await client.session.status({ throwOnError: true });
+    if (!response || typeof response !== "object" || response.error != null) {
+      return { ok: false };
+    }
     const current = statusType(response?.data?.[sessionId]);
-    if (current) sessionStatus.set(sessionId, current);
-    return current || cached || "idle";
+    if (!current) return { ok: false };
+    sessionStatus.set(sessionId, current);
+    return { ok: true, type: current };
   } catch {
-    return cached || "idle";
+    return { ok: false };
   }
 }
 
+function promptWasAccepted(response) {
+  return Boolean(
+    response &&
+      typeof response === "object" &&
+      response.error == null &&
+      Object.prototype.hasOwnProperty.call(response, "data") &&
+      response.data !== null &&
+      typeof response.data === "object",
+  );
+}
+
 export default async function loopAgentTransientRetryPlugin({ client, $ }) {
   void $;
   void PLUGIN_PATH;
 
-  async function maybeResume(sessionId, error) {
-    if (!sessionId) return { interaction: PERMANENT_INTERACTION, reason: "missing-session" };
-    if (!isTransientUnknown(error)) {
-      return { interaction: PERMANENT_INTERACTION, reason: "plugin-ignore-permanent-error" };
-    }
-
+  async function drainPendingRecovery(sessionId) {
     const state = getState(sessionId);
-    if (state.locked) {
-      return { interaction: PERMANENT_INTERACTION, reason: "session-locked" };
-    }
+    const pending = pendingErrors.get(sessionId);
+    if (!pending) return;
     if (state.attempt >= MAX_RETRIES) {
-      return { interaction: PERMANENT_INTERACTION, reason: "max-retries" };
+      pendingErrors.delete(sessionId);
+      return;
     }
 
-    state.locked = true;
-    try {
-      let status = await readSessionStatus(client, sessionId);
-      // Never race OpenCode built-in retry.
-      if (status === "retry") {
-        return { interaction: PERMANENT_INTERACTION, reason: "builtin-retry-active" };
-      }
-      if (status === "busy" || status === "running") {
-        return { interaction: PERMANENT_INTERACTION, reason: "session-busy" };
-      }
+    // A status event may be stale by the time this worker runs. Confirm idle via
+    // the SDK before and after backoff; every other outcome keeps the error pending.
+    const beforeDelay = await readSessionStatus(client, sessionId);
+    if (pendingErrors.get(sessionId) !== pending) return;
+    if (!beforeDelay.ok || beforeDelay.type !== "idle") return;
 
-      const delay = BACKOFF_MS[state.attempt];
-      const nextAttempt = state.attempt + 1;
-      if (typeof delay === "number") await wait(delay);
-      // Re-check idle after backoff.
-      status = await readSessionStatus(client, sessionId);
-      if (status === "retry" || status === "busy" || status === "running") {
-        return { interaction: PERMANENT_INTERACTION, reason: "session-not-idle" };
-      }
-      const prompt = buildResumePrompt(sessionId, error, nextAttempt);
-      state.attempt = nextAttempt;
-      await client.session.promptAsync({
+    const delay = BACKOFF_MS[state.attempt];
+    if (typeof delay !== "number") {
+      pendingErrors.delete(sessionId);
+      return;
+    }
+    await wait(delay);
+    if (pendingErrors.get(sessionId) !== pending) return;
+
+    const beforePrompt = await readSessionStatus(client, sessionId);
+    if (pendingErrors.get(sessionId) !== pending) return;
+    if (!beforePrompt.ok || beforePrompt.type !== "idle") return;
+
+    const nextAttempt = state.attempt + 1;
+    const prompt = buildResumePrompt(sessionId, pending.error, nextAttempt);
+    let response;
+    try {
+      response = await client.session.promptAsync({
         path: { id: sessionId },
         body: { parts: [{ type: "text", text: prompt }] },
+        throwOnError: true,
       });
-      return { resumed: true, attempt: state.attempt };
-    } finally {
-      state.locked = false;
+    } catch {
+      return;
+    }
+    if (!promptWasAccepted(response)) return;
+
+    state.attempt = nextAttempt;
+    if (pendingErrors.get(sessionId) === pending) {
+      pendingErrors.delete(sessionId);
+    }
+  }
+
+  function startRecoveryWorker(sessionId) {
+    const state = getState(sessionId);
+    if (recoveryWorkers.has(sessionId)) {
+      state.rerunRequested = true;
+      return;
+    }
+    state.locked = true;
+    state.rerunRequested = false;
+    const worker = drainPendingRecovery(sessionId)
+      .catch(() => {})
+      .finally(() => {
+        recoveryWorkers.delete(sessionId);
+        const rerun = state.rerunRequested;
+        state.rerunRequested = false;
+        state.locked = false;
+        if (rerun && pendingErrors.has(sessionId)) {
+          startRecoveryWorker(sessionId);
+        }
+      });
+    recoveryWorkers.set(sessionId, worker);
+  }
+
+  function clearSession(sessionId) {
+    pendingErrors.delete(sessionId);
+    sessionStatus.delete(sessionId);
+    const state = sessionState.get(sessionId);
+    if (state) {
+      state.attempt = 0;
+      state.rerunRequested = false;
+      if (!recoveryWorkers.has(sessionId)) state.locked = false;
     }
   }
 
@@ -544,11 +663,27 @@ export default async function loopAgentTransientRetryPlugin({ client, $ }) {
       if (!event || typeof event !== "object") return;
       const properties = event.properties || {};
       const sessionId =
-        properties.sessionID || properties.sessionId || properties.id;
+        properties.sessionID || properties.sessionId || properties.id || properties.info?.id;
 
       if (event.type === "session.status") {
         const current = statusType(properties.status);
         if (sessionId && current) sessionStatus.set(sessionId, current);
+        if (sessionId && current === "idle" && pendingErrors.has(sessionId)) {
+          startRecoveryWorker(sessionId);
+        }
+        return;
+      }
+
+      if (event.type === "session.idle") {
+        if (sessionId) {
+          sessionStatus.set(sessionId, "idle");
+          if (pendingErrors.has(sessionId)) startRecoveryWorker(sessionId);
+        }
+        return;
+      }
+
+      if (event.type === "session.deleted") {
+        if (sessionId) clearSession(sessionId);
         return;
       }
 
@@ -557,16 +692,26 @@ export default async function loopAgentTransientRetryPlugin({ client, $ }) {
         if (
           info?.role === "assistant" &&
           info.sessionID &&
+          (info.status === undefined || info.status === "completed") &&
           info.time?.completed != null &&
           info.error == null
         ) {
-          getState(info.sessionID).attempt = 0;
+          clearSession(info.sessionID);
         }
         return;
       }
 
       if (event.type === "session.error") {
-        return maybeResume(sessionId, properties.error || properties);
+        if (!sessionId) return;
+        const error = properties.error || properties;
+        if (!isTransientUnknown(error)) {
+          pendingErrors.delete(sessionId);
+          getState(sessionId).rerunRequested = false;
+          return { interaction: PERMANENT_INTERACTION, reason: "plugin-ignore-permanent-error" };
+        }
+        pendingErrors.set(sessionId, { error });
+        startRecoveryWorker(sessionId);
+        return { pending: true };
       }
     },
   };
@@ -647,7 +792,9 @@ export async function runClientRecovery(input) {
             },
         };
     }
-    const plugin = await installProjectOpenCodePlugin({ repoRoot: input.repoRoot });
+    const plugin = await installProjectOpenCodePlugin({
+        repoRoot: input.repoRoot,
+    });
     if (mode !== "user") {
         return { mode, plugin };
     }

package/dist/executors/dag-pi-executor.js

@@ -4,6 +4,7 @@ import { writeDagNodeJsonArtifact, writeTextArtifactFile, } from "../infrastruct
 import { executePiStep, } from "./pi-executor.js";
 import { redactPromptForLog, truncateOutput, } from "../shared/output-truncation.js";
 import { pathsChangedDuringRun, readGitStatusPorcelain, snapshotGitStatusPathFingerprints, snapshotGitStatusPorcelain, validateShellWriteGuard, } from "./shell-write-guard.js";
+import { redactSecrets, truncateUtf8Preview } from "../shared/preview.js";
 export const DAG_PI_READONLY_TOOLS = ["read", "grep", "find", "ls"];
 export const DAG_PI_WRITE_TOOLS = [
     "read",
@@ -15,6 +16,7 @@ export const DAG_PI_WRITE_TOOLS = [
     "ls",
 ];
 export const DEFAULT_DAG_PI_PROVIDER = "wizard-local";
+const WRITER_OUTCOME_PROTOCOL_LINE = "IMPLEMENTATION_OUTCOME:";
 export const DAG_PI_MODEL_PROVIDERS = {
     "gpt-5.3-codex-spark": "wizard-local",
     "gpt-5.5": "wizard-local",
@@ -266,9 +268,14 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep) {
             beforeStatus = await readGitStatusPorcelain(input.cwd);
             beforePathFingerprints = await snapshotGitStatusPathFingerprints(input.cwd, snapshotGitStatusPorcelain(beforeStatus));
         }
-        catch {
-            beforeStatus = undefined;
-            beforePathFingerprints = undefined;
+        catch (error) {
+            return {
+                ok: false,
+                stdout: "",
+                stderr: `writer Git baseline unavailable before Pi execution: ${error instanceof Error ? error.message : String(error)}`,
+                failureCategory: "write-guard",
+                durationMs: Date.now() - started,
+            };
         }
     }
     const reportActivity = input.reportActivity;
@@ -319,7 +326,9 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep) {
         persona,
         step,
     });
-    const mapped = mapPiResultToDagNodeResult(result, input.task.firstProtocolLine);
+    const mapped = mapPiResultToDagNodeResult(result, input.task.writerOutcomePolicy
+        ? WRITER_OUTCOME_PROTOCOL_LINE
+        : input.task.firstProtocolLine);
     if (!isWriteTask) {
         return mapped;
     }
@@ -399,38 +408,94 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep) {
     };
 }
 export function validateWriterImplementationOutcome(text, changedFiles) {
-    const firstLine = text
-        .split(/\r?\n/)
-        .map((line) => line.trim())
-        .find(Boolean);
-    const match = firstLine?.match(/^IMPLEMENTATION_OUTCOME: (changed|already-satisfied|blocked)$/);
-    if (!match) {
+    const parsed = parseWriterImplementationOutcome(text);
+    const diagnostics = writerOutcomeDiagnostics(text, parsed, changedFiles.length);
+    if (parsed.kind !== "valid") {
         return {
             ok: false,
-            reason: "writer outcome validation failed: missing or invalid first line; expected IMPLEMENTATION_OUTCOME: changed, IMPLEMENTATION_OUTCOME: already-satisfied, or IMPLEMENTATION_OUTCOME: blocked",
+            reason: `writer outcome validation failed: ${parsed.kind} outcome; ${diagnostics}; expected IMPLEMENTATION_OUTCOME: changed, IMPLEMENTATION_OUTCOME: already-satisfied, or IMPLEMENTATION_OUTCOME: blocked`,
         };
     }
-    const outcome = match[1];
+    const outcome = parsed.outcome;
     if (outcome === "blocked") {
         return {
             ok: false,
-            reason: "writer outcome validation failed: IMPLEMENTATION_OUTCOME: blocked cannot complete successfully",
+            reason: `writer outcome validation failed: IMPLEMENTATION_OUTCOME: blocked cannot complete successfully; ${diagnostics}`,
         };
     }
     if (outcome === "changed" && changedFiles.length === 0) {
         return {
             ok: false,
-            reason: "writer outcome validation failed: changed outcome has an empty diff",
+            reason: `writer outcome validation failed: changed outcome has an empty diff; ${diagnostics}`,
         };
     }
     if (outcome === "already-satisfied" && changedFiles.length > 0) {
         return {
             ok: false,
-            reason: "writer outcome validation failed: already-satisfied outcome has a non-empty diff",
+            reason: `writer outcome validation failed: already-satisfied outcome has a non-empty diff; ${diagnostics}`,
         };
     }
     return { ok: true, outcome };
 }
+function parseWriterImplementationOutcome(text) {
+    const lines = text.split(/\r?\n/);
+    const candidates = [];
+    for (const [lineIndex, line] of lines.entries()) {
+        const nextLine = lines[lineIndex + 1];
+        const normalized = normalizeProtocolLine(line, WRITER_OUTCOME_PROTOCOL_LINE, nextLine);
+        if (normalized === undefined)
+            continue;
+        const value = normalized
+            .slice(WRITER_OUTCOME_PROTOCOL_LINE.length)
+            .trim();
+        const outcome = isWriterImplementationOutcome(value)
+            ? value
+            : undefined;
+        candidates.push({
+            lineIndex,
+            value,
+            outcome,
+        });
+    }
+    if (candidates.length === 0) {
+        return { kind: "missing", candidates };
+    }
+    if (candidates.some((candidate) => candidate.outcome === undefined)) {
+        return { kind: "unknown", candidates };
+    }
+    const outcomes = new Set(candidates.map((candidate) => candidate.outcome));
+    if (outcomes.size !== 1) {
+        return { kind: "conflicting", candidates };
+    }
+    return {
+        kind: "valid",
+        outcome: candidates[0].outcome,
+        candidates,
+    };
+}
+function isWriterImplementationOutcome(value) {
+    return (value === "changed" ||
+        value === "already-satisfied" ||
+        value === "blocked");
+}
+function writerOutcomeDiagnostics(text, parsed, changedFiles) {
+    const firstNonEmpty = text
+        .split(/\r?\n/)
+        .map((line) => line.trim())
+        .find(Boolean) ?? "(empty)";
+    const candidateSummary = parsed.candidates.length === 0
+        ? "none"
+        : parsed.candidates
+            .slice(0, 4)
+            .map((candidate) => candidate.outcome
+            ? `${candidate.outcome}@line${candidate.lineIndex + 1}`
+            : `unknown(${boundedWriterDiagnostic(candidate.value)})@line${candidate.lineIndex + 1}`)
+            .join(",");
+    return `firstNonEmpty=${boundedWriterDiagnostic(firstNonEmpty)}; candidates=${candidateSummary}; changedFiles=${changedFiles}`;
+}
+function boundedWriterDiagnostic(value) {
+    return JSON.stringify(truncateUtf8Preview(redactSecrets(value), 160));
+}
 export function mapPiResultToDagNodeResult(result, firstProtocolLine) {
     const assistantText = canonicalizeProtocolFirstLine(result.assistantText, firstProtocolLine);
     return {

package/dist/executors/model-routing.js

@@ -1,7 +1,7 @@
 import { DEFAULT_DAG_EXECUTOR_MODELS, } from '../workflows/dag/types.js';
 export const DEFAULT_DAG_MODELS = {
     HIGH: "gpt-5.5",
-    MED: "glm-5.2",
+    MED: "gpt-5.5",
     LOW: "gpt-5.3-codex-spark",
 };
 /**