@tea-agent/loop-agent 0.26.0 → 0.26.1

package/dist/task/source-prepare/reference-integrity.js

@@ -0,0 +1,274 @@
+import { createHash } from "node:crypto";
+import { lstat, open, readFile } from "node:fs/promises";
+import path from "node:path";
+import { getTaskPaths } from "../runtime.js";
+import { readSourceManifest, } from "../source-references.js";
+import { PREPARE_MAX_FILE_BYTES, PREPARE_MAX_PARSE_DOCS, PREPARE_MAX_TOTAL_BYTES, } from "./types.js";
+const PARSEABLE_EXTENSIONS = new Set([".md", ".markdown", ".txt"]);
+const PARSEABLE_ROLES = new Set(["requirement", "acceptance"]);
+function isSafeRelativeReferencePath(materializedPath) {
+    const normalized = materializedPath.replace(/\\/g, "/").trim();
+    if (!normalized)
+        return false;
+    if (normalized.includes("\0"))
+        return false;
+    if (path.isAbsolute(normalized) || /^[a-zA-Z]:[\\/]/.test(normalized)) {
+        return false;
+    }
+    if (normalized.split("/").some((part) => part === ".."))
+        return false;
+    if (!normalized.startsWith("references/"))
+        return false;
+    return true;
+}
+async function streamSha256AndBytes(filePath, maxBytes) {
+    const handle = await open(filePath, "r");
+    try {
+        const hash = createHash("sha256");
+        const buffer = Buffer.alloc(64 * 1024);
+        let bytes = 0;
+        while (true) {
+            const { bytesRead } = await handle.read(buffer, 0, buffer.length, null);
+            if (bytesRead === 0)
+                break;
+            bytes += bytesRead;
+            if (maxBytes !== undefined && bytes > maxBytes) {
+                throw Object.assign(new Error("INPUT_TOO_LARGE"), {
+                    code: "INPUT_TOO_LARGE",
+                    bytes,
+                });
+            }
+            hash.update(buffer.subarray(0, bytesRead));
+        }
+        return { sha256: hash.digest("hex"), bytes };
+    }
+    finally {
+        await handle.close();
+    }
+}
+function isParseableDoc(doc) {
+    const ext = path.extname(doc.materializedPath).toLowerCase();
+    if (!PARSEABLE_EXTENSIONS.has(ext))
+        return false;
+    return PARSEABLE_ROLES.has(doc.role);
+}
+/**
+ * Validate source-manifest + reference files before deriving a draft.
+ * Fail-closed on taskId/path/hash/symlink/size issues.
+ */
+export async function validateImportedPrdReferences(input) {
+    const paths = getTaskPaths(input.repoRoot, input.taskId);
+    const issues = [];
+    const documents = [];
+    const manifest = await readSourceManifest(paths.sourceDir);
+    if (!manifest) {
+        issues.push({
+            code: "MANIFEST_MISSING",
+            level: "blocking",
+            message: "source-manifest.json missing; run import-prd before --use-imported-prd",
+            path: path.join(paths.sourceDir, "source-manifest.json"),
+        });
+        return { ok: false, issues, documents, parseableDocuments: [] };
+    }
+    if (manifest.schemaVersion !== 1) {
+        issues.push({
+            code: "MANIFEST_SCHEMA",
+            level: "blocking",
+            message: `unsupported source-manifest schemaVersion: ${String(manifest.schemaVersion)}`,
+        });
+    }
+    if (manifest.taskId !== input.taskId) {
+        issues.push({
+            code: "MANIFEST_TASK_MISMATCH",
+            level: "blocking",
+            message: `manifest.taskId "${manifest.taskId}" does not match task ${input.taskId}`,
+        });
+    }
+    if (!Array.isArray(manifest.documents)) {
+        issues.push({
+            code: "MANIFEST_INVALID",
+            level: "blocking",
+            message: "source-manifest.documents must be an array",
+        });
+        return { ok: false, issues, documents, parseableDocuments: [] };
+    }
+    // Stable order by materializedPath (import already sorts; re-sort for safety).
+    const ordered = [...manifest.documents].sort((a, b) => a.materializedPath < b.materializedPath
+        ? -1
+        : a.materializedPath > b.materializedPath
+            ? 1
+            : 0);
+    let totalParseBytes = 0;
+    let parseableCount = 0;
+    for (const doc of ordered) {
+        if (!doc ||
+            typeof doc.role !== "string" ||
+            typeof doc.name !== "string" ||
+            typeof doc.materializedPath !== "string" ||
+            typeof doc.sha256 !== "string" ||
+            typeof doc.bytes !== "number") {
+            issues.push({
+                code: "MANIFEST_DOC_INVALID",
+                level: "blocking",
+                message: "manifest document missing required fields",
+            });
+            continue;
+        }
+        if (!isSafeRelativeReferencePath(doc.materializedPath)) {
+            issues.push({
+                code: "REFERENCE_PATH_UNSAFE",
+                level: "blocking",
+                message: `reference path not contained under references/: ${doc.materializedPath}`,
+                path: doc.materializedPath,
+            });
+            continue;
+        }
+        const absolutePath = path.resolve(paths.sourceDir, doc.materializedPath);
+        const relativeToSource = path
+            .relative(paths.sourceDir, absolutePath)
+            .split(path.sep)
+            .join("/");
+        if (relativeToSource.startsWith("..") ||
+            path.isAbsolute(relativeToSource)) {
+            issues.push({
+                code: "REFERENCE_PATH_ESCAPE",
+                level: "blocking",
+                message: `reference path escapes source dir: ${doc.materializedPath}`,
+                path: doc.materializedPath,
+            });
+            continue;
+        }
+        let stats;
+        try {
+            stats = await lstat(absolutePath);
+        }
+        catch {
+            issues.push({
+                code: "REFERENCE_MISSING",
+                level: "blocking",
+                message: `reference file missing: ${doc.materializedPath}`,
+                path: doc.materializedPath,
+            });
+            continue;
+        }
+        if (stats.isSymbolicLink()) {
+            issues.push({
+                code: "REFERENCE_SYMLINK",
+                level: "blocking",
+                message: `reference must be a regular file (symlink rejected): ${doc.materializedPath}`,
+                path: doc.materializedPath,
+            });
+            continue;
+        }
+        if (!stats.isFile()) {
+            issues.push({
+                code: "REFERENCE_NOT_FILE",
+                level: "blocking",
+                message: `reference is not a regular file: ${doc.materializedPath}`,
+                path: doc.materializedPath,
+            });
+            continue;
+        }
+        const parseable = isParseableDoc(doc);
+        if (parseable) {
+            parseableCount += 1;
+            if (parseableCount > PREPARE_MAX_PARSE_DOCS) {
+                issues.push({
+                    code: "INPUT_TOO_LARGE",
+                    level: "blocking",
+                    message: `more than ${PREPARE_MAX_PARSE_DOCS} parseable imported docs`,
+                });
+                continue;
+            }
+        }
+        let hashResult;
+        try {
+            hashResult = await streamSha256AndBytes(absolutePath, parseable ? PREPARE_MAX_FILE_BYTES : undefined);
+        }
+        catch (error) {
+            if (error &&
+                typeof error === "object" &&
+                "code" in error &&
+                error.code === "INPUT_TOO_LARGE") {
+                issues.push({
+                    code: "INPUT_TOO_LARGE",
+                    level: "blocking",
+                    message: `reference exceeds ${PREPARE_MAX_FILE_BYTES} bytes: ${doc.materializedPath}`,
+                    path: doc.materializedPath,
+                });
+                continue;
+            }
+            issues.push({
+                code: "REFERENCE_READ_FAILED",
+                level: "blocking",
+                message: `failed to hash reference: ${doc.materializedPath}`,
+                path: doc.materializedPath,
+            });
+            continue;
+        }
+        if (hashResult.bytes !== doc.bytes) {
+            issues.push({
+                code: "REFERENCE_BYTES_MISMATCH",
+                level: "blocking",
+                message: `bytes mismatch for ${doc.materializedPath}: manifest=${doc.bytes} disk=${hashResult.bytes}`,
+                path: doc.materializedPath,
+            });
+        }
+        if (hashResult.sha256 !== doc.sha256) {
+            issues.push({
+                code: "REFERENCE_HASH_MISMATCH",
+                level: "blocking",
+                message: `sha256 mismatch for ${doc.materializedPath}`,
+                path: doc.materializedPath,
+            });
+        }
+        let content;
+        if (parseable) {
+            totalParseBytes += hashResult.bytes;
+            if (totalParseBytes > PREPARE_MAX_TOTAL_BYTES) {
+                issues.push({
+                    code: "INPUT_TOO_LARGE",
+                    level: "blocking",
+                    message: `total parseable reference bytes exceed ${PREPARE_MAX_TOTAL_BYTES}`,
+                });
+            }
+            else {
+                content = await readFile(absolutePath, "utf-8");
+            }
+        }
+        documents.push({
+            role: doc.role,
+            name: doc.name,
+            materializedPath: doc.materializedPath,
+            absolutePath,
+            sha256: hashResult.sha256,
+            bytes: hashResult.bytes,
+            content,
+            parseable,
+        });
+    }
+    const parseableDocuments = documents.filter((doc) => doc.parseable);
+    const hasRequirement = parseableDocuments.some((doc) => doc.role === "requirement");
+    if (input.requireParseableRequirement !== false && !hasRequirement) {
+        // Still allow if caller will supply supplemental flags/text; prepare.ts decides.
+        // Here we only mark warning-level absence; prepare elevates when needed.
+        issues.push({
+            code: "NO_PARSEABLE_REQUIREMENT",
+            level: "warning",
+            message: "no parseable requirement-role document under source/references (role=requirement, .md/.txt)",
+        });
+    }
+    const blocking = issues.some((issue) => issue.level === "blocking");
+    return {
+        ok: !blocking,
+        issues,
+        documents,
+        parseableDocuments,
+    };
+}
+export function draftReferencesFromManifest(documents) {
+    return documents.map((doc) => ({
+        role: doc.role,
+        ref: doc.materializedPath,
+    }));
+}

package/dist/task/source-prepare/types.js

@@ -0,0 +1,7 @@
+export const PREPARE_MAX_FILE_BYTES = 2 * 1024 * 1024;
+export const PREPARE_MAX_PARSE_DOCS = 8;
+export const PREPARE_MAX_TOTAL_BYTES = 8 * 1024 * 1024;
+export const PREPARE_DEFAULT_FORBIDDEN_PATHS = [
+    ".harness/**",
+    "node_modules/**",
+];

package/dist/worker/observe/static/copy.js

@@ -1,67 +1,67 @@
-/** Copy-only recommended commands (Observe UI R5). */
-import { el } from "./dom.js";
-
-export async function copyText(text) {
-	const value = String(text ?? "");
-	if (!value) return false;
-	try {
-		if (typeof navigator !== "undefined" && navigator.clipboard?.writeText) {
-			await navigator.clipboard.writeText(value);
-			return true;
-		}
-	} catch {
-		// fall through
-	}
-	try {
-		const ta = document.createElement("textarea");
-		ta.value = value;
-		ta.setAttribute("readonly", "");
-		ta.style.position = "fixed";
-		ta.style.left = "-9999px";
-		document.body.appendChild(ta);
-		ta.select();
-		const ok = document.execCommand("copy");
-		document.body.removeChild(ta);
-		return ok;
-	} catch {
-		return false;
-	}
-}
-
-/** Advisory recommended command: copy-only, never executes. */
-export function renderRecommendedCommand(action) {
-	const block = el("div", "recommended-command");
-	if (!action) {
-		block.appendChild(el("span", "muted", "缺失"));
-		return block;
-	}
-	const head = el("div", "recommended-command-head");
-	if (action.kind) {
-		head.appendChild(el("span", "recommended-command-kind", action.kind));
-	}
-	head.appendChild(
-		el("span", "recommended-command-label", action.label ?? "—"),
-	);
-	block.appendChild(head);
-	if (action.command) {
-		const body = el("div", "recommended-command-body");
-		const code = el("code", "recommended-command-text", action.command);
-		body.appendChild(code);
-		const btn = el("button", "copy-command", "复制");
-		btn.type = "button";
-		btn.addEventListener("click", (e) => {
-			e.preventDefault();
-			e.stopPropagation();
-			void copyText(action.command).then((ok) => {
-				btn.textContent = ok ? "已复制" : "复制失败";
-				setTimeout(() => {
-					btn.textContent = "复制";
-				}, 1500);
-			});
-		});
-		body.appendChild(btn);
-		block.appendChild(body);
-	}
-	return block;
-}
-
+/** Copy-only recommended commands (Observe UI R5). */
+import { el } from "./dom.js";
+
+export async function copyText(text) {
+	const value = String(text ?? "");
+	if (!value) return false;
+	try {
+		if (typeof navigator !== "undefined" && navigator.clipboard?.writeText) {
+			await navigator.clipboard.writeText(value);
+			return true;
+		}
+	} catch {
+		// fall through
+	}
+	try {
+		const ta = document.createElement("textarea");
+		ta.value = value;
+		ta.setAttribute("readonly", "");
+		ta.style.position = "fixed";
+		ta.style.left = "-9999px";
+		document.body.appendChild(ta);
+		ta.select();
+		const ok = document.execCommand("copy");
+		document.body.removeChild(ta);
+		return ok;
+	} catch {
+		return false;
+	}
+}
+
+/** Advisory recommended command: copy-only, never executes. */
+export function renderRecommendedCommand(action) {
+	const block = el("div", "recommended-command");
+	if (!action) {
+		block.appendChild(el("span", "muted", "缺失"));
+		return block;
+	}
+	const head = el("div", "recommended-command-head");
+	if (action.kind) {
+		head.appendChild(el("span", "recommended-command-kind", action.kind));
+	}
+	head.appendChild(
+		el("span", "recommended-command-label", action.label ?? "—"),
+	);
+	block.appendChild(head);
+	if (action.command) {
+		const body = el("div", "recommended-command-body");
+		const code = el("code", "recommended-command-text", action.command);
+		body.appendChild(code);
+		const btn = el("button", "copy-command", "复制");
+		btn.type = "button";
+		btn.addEventListener("click", (e) => {
+			e.preventDefault();
+			e.stopPropagation();
+			void copyText(action.command).then((ok) => {
+				btn.textContent = ok ? "已复制" : "复制失败";
+				setTimeout(() => {
+					btn.textContent = "复制";
+				}, 1500);
+			});
+		});
+		body.appendChild(btn);
+		block.appendChild(body);
+	}
+	return block;
+}
+

package/dist/worker/observe/static/dag-layout.d.ts

@@ -1,31 +1,31 @@
-export type DagLayoutNodeInput = { nodeId: string };
-export type DagLayoutEdgeInput = { from: string; to: string };
-export type DagLayoutNode = {
-	nodeId: string;
-	rank: number;
-	index: number;
-	x: number;
-	y: number;
-	width: number;
-	height: number;
-};
-export type DagLayoutEdge = DagLayoutEdgeInput & { path: string };
-export type DagLayout = {
-	width: number;
-	height: number;
-	nodes: DagLayoutNode[];
-	edges: DagLayoutEdge[];
-};
-
-export function layoutDag(
-	nodes?: DagLayoutNodeInput[],
-	edges?: DagLayoutEdgeInput[],
-	ranks?: string[][],
-	options?: Partial<{
-		nodeWidth: number;
-		nodeHeight: number;
-		rankGap: number;
-		nodeGap: number;
-		padding: number;
-	}>,
-): DagLayout;
+export type DagLayoutNodeInput = { nodeId: string };
+export type DagLayoutEdgeInput = { from: string; to: string };
+export type DagLayoutNode = {
+	nodeId: string;
+	rank: number;
+	index: number;
+	x: number;
+	y: number;
+	width: number;
+	height: number;
+};
+export type DagLayoutEdge = DagLayoutEdgeInput & { path: string };
+export type DagLayout = {
+	width: number;
+	height: number;
+	nodes: DagLayoutNode[];
+	edges: DagLayoutEdge[];
+};
+
+export function layoutDag(
+	nodes?: DagLayoutNodeInput[],
+	edges?: DagLayoutEdgeInput[],
+	ranks?: string[][],
+	options?: Partial<{
+		nodeWidth: number;
+		nodeHeight: number;
+		rankGap: number;
+		nodeGap: number;
+		padding: number;
+	}>,
+): DagLayout;

package/dist/worker/observe/static/dag-layout.js

@@ -1,83 +1,83 @@
-const DEFAULTS = {
-	nodeWidth: 216,
-	nodeHeight: 92,
-	rankGap: 104,
-	nodeGap: 28,
-	padding: 32,
-};
-
-export function layoutDag(nodes = [], edges = [], ranks = [], options = {}) {
-	const config = { ...DEFAULTS, ...options };
-	const nodeIds = [...new Set(nodes.map((node) => node.nodeId).filter(Boolean))].sort();
-	if (nodeIds.length === 0) return { width: 320, height: 160, nodes: [], edges: [] };
-	const known = new Set(nodeIds);
-	const validEdges = edges
-		.filter((edge) => known.has(edge.from) && known.has(edge.to) && edge.from !== edge.to)
-		.sort((a, b) => a.from.localeCompare(b.from) || a.to.localeCompare(b.to));
-	const layers = normalizeLayers(nodeIds, validEdges, ranks);
-	const positioned = [];
-	for (let rank = 0; rank < layers.length; rank++) {
-		const ids = layers[rank];
-		for (let index = 0; index < ids.length; index++) {
-			positioned.push({
-				nodeId: ids[index], rank, index,
-				x: config.padding + rank * (config.nodeWidth + config.rankGap),
-				y: config.padding + index * (config.nodeHeight + config.nodeGap),
-				width: config.nodeWidth, height: config.nodeHeight,
-			});
-		}
-	}
-	const byId = new Map(positioned.map((node) => [node.nodeId, node]));
-	const routed = validEdges.map((edge) => {
-		const from = byId.get(edge.from);
-		const to = byId.get(edge.to);
-		const x1 = from.x + from.width;
-		const y1 = from.y + from.height / 2;
-		const x2 = to.x;
-		const y2 = to.y + to.height / 2;
-		const bend = Math.max(36, (x2 - x1) / 2);
-		return { ...edge, path: `M ${x1} ${y1} C ${x1 + bend} ${y1}, ${x2 - bend} ${y2}, ${x2} ${y2}` };
-	});
-	const maxRows = Math.max(...layers.map((layer) => layer.length), 1);
-	return {
-		width: config.padding * 2 + layers.length * config.nodeWidth + (layers.length - 1) * config.rankGap,
-		height: config.padding * 2 + maxRows * config.nodeHeight + (maxRows - 1) * config.nodeGap,
-		nodes: positioned,
-		edges: routed,
-	};
-}
-
-function normalizeLayers(nodeIds, edges, ranks) {
-	const known = new Set(nodeIds);
-	const seen = new Set();
-	const layers = [];
-	if (Array.isArray(ranks)) {
-		for (const rank of ranks) {
-			if (!Array.isArray(rank)) continue;
-			const ids = [...new Set(rank.filter((id) => known.has(id) && !seen.has(id)))].sort();
-			ids.forEach((id) => seen.add(id));
-			if (ids.length > 0) layers.push(ids);
-		}
-	}
-	if (layers.length === 0 && edges.length > 0) {
-		const level = new Map(nodeIds.map((id) => [id, 0]));
-		for (let pass = 0; pass < nodeIds.length; pass++) {
-			let changed = false;
-			for (const edge of edges) {
-				const next = Math.min(nodeIds.length - 1, level.get(edge.from) + 1);
-				if (next > level.get(edge.to)) { level.set(edge.to, next); changed = true; }
-			}
-			if (!changed) break;
-		}
-		for (const id of nodeIds) {
-			const rank = level.get(id);
-			(layers[rank] ??= []).push(id);
-			seen.add(id);
-		}
-		for (const layer of layers) layer?.sort();
-	}
-	for (const id of nodeIds) {
-		if (!seen.has(id)) (layers[0] ??= []).push(id);
-	}
-	return layers.filter(Boolean);
-}
+const DEFAULTS = {
+	nodeWidth: 216,
+	nodeHeight: 92,
+	rankGap: 104,
+	nodeGap: 28,
+	padding: 32,
+};
+
+export function layoutDag(nodes = [], edges = [], ranks = [], options = {}) {
+	const config = { ...DEFAULTS, ...options };
+	const nodeIds = [...new Set(nodes.map((node) => node.nodeId).filter(Boolean))].sort();
+	if (nodeIds.length === 0) return { width: 320, height: 160, nodes: [], edges: [] };
+	const known = new Set(nodeIds);
+	const validEdges = edges
+		.filter((edge) => known.has(edge.from) && known.has(edge.to) && edge.from !== edge.to)
+		.sort((a, b) => a.from.localeCompare(b.from) || a.to.localeCompare(b.to));
+	const layers = normalizeLayers(nodeIds, validEdges, ranks);
+	const positioned = [];
+	for (let rank = 0; rank < layers.length; rank++) {
+		const ids = layers[rank];
+		for (let index = 0; index < ids.length; index++) {
+			positioned.push({
+				nodeId: ids[index], rank, index,
+				x: config.padding + rank * (config.nodeWidth + config.rankGap),
+				y: config.padding + index * (config.nodeHeight + config.nodeGap),
+				width: config.nodeWidth, height: config.nodeHeight,
+			});
+		}
+	}
+	const byId = new Map(positioned.map((node) => [node.nodeId, node]));
+	const routed = validEdges.map((edge) => {
+		const from = byId.get(edge.from);
+		const to = byId.get(edge.to);
+		const x1 = from.x + from.width;
+		const y1 = from.y + from.height / 2;
+		const x2 = to.x;
+		const y2 = to.y + to.height / 2;
+		const bend = Math.max(36, (x2 - x1) / 2);
+		return { ...edge, path: `M ${x1} ${y1} C ${x1 + bend} ${y1}, ${x2 - bend} ${y2}, ${x2} ${y2}` };
+	});
+	const maxRows = Math.max(...layers.map((layer) => layer.length), 1);
+	return {
+		width: config.padding * 2 + layers.length * config.nodeWidth + (layers.length - 1) * config.rankGap,
+		height: config.padding * 2 + maxRows * config.nodeHeight + (maxRows - 1) * config.nodeGap,
+		nodes: positioned,
+		edges: routed,
+	};
+}
+
+function normalizeLayers(nodeIds, edges, ranks) {
+	const known = new Set(nodeIds);
+	const seen = new Set();
+	const layers = [];
+	if (Array.isArray(ranks)) {
+		for (const rank of ranks) {
+			if (!Array.isArray(rank)) continue;
+			const ids = [...new Set(rank.filter((id) => known.has(id) && !seen.has(id)))].sort();
+			ids.forEach((id) => seen.add(id));
+			if (ids.length > 0) layers.push(ids);
+		}
+	}
+	if (layers.length === 0 && edges.length > 0) {
+		const level = new Map(nodeIds.map((id) => [id, 0]));
+		for (let pass = 0; pass < nodeIds.length; pass++) {
+			let changed = false;
+			for (const edge of edges) {
+				const next = Math.min(nodeIds.length - 1, level.get(edge.from) + 1);
+				if (next > level.get(edge.to)) { level.set(edge.to, next); changed = true; }
+			}
+			if (!changed) break;
+		}
+		for (const id of nodeIds) {
+			const rank = level.get(id);
+			(layers[rank] ??= []).push(id);
+			seen.add(id);
+		}
+		for (const layer of layers) layer?.sort();
+	}
+	for (const id of nodeIds) {
+		if (!seen.has(id)) (layers[0] ??= []).push(id);
+	}
+	return layers.filter(Boolean);
+}