@tea-agent/loop-agent 0.26.2 → 0.26.4

package/CHANGELOG.md

@@ -2,6 +2,49 @@
 
 ## [Unreleased]
 
+## [0.26.4] - 2026-08-03
+
+### 重点更新
+
+- 强化 DAG 运行时安全与 writer 工具级写边界
+- 收敛效率与可选 document catalog 兼容
+- 防污染 review-pass 知识写入
+
+### 改进
+
+- fresh init 与旧项目 `init update --apply-safe` 刷新的 `AGENTS.md` managed block 现要求持续监控 DAG 至 `FINISHED`、`FAILED`、`partial_failed` 等已结束终态或 Decision Gate 需要 approve；判活须组合 runner heartbeat、session events 与 `dag doctor` liveness/provider meaningful progress，并禁止 exclusive writer 运行期间主会话或其他 writer 并发修改工作区
+- DAG 治理闭包与收敛效率：已配置 `docs/document-catalog.json` 的项目在生成时从 `completeDirectoryIndexes` 注入具体 index companion 到 implement/repair 内存路径，未配置该可选 catalog 的项目保持原有 DAG 生成能力；repair artifact 支持 `blocked-boundary`/`requiredScope` 与 empty-manifest `no-progress` 提前止损；DAG shell 支持显式 `failFast`，supervised hard verify 在同 run、同工作区指纹与命令契约下仅复用成功命令并写可审计 receipt。真实非零退出与 finished 聚合规则不放宽，且不跨 run 缓存验证结果
+- DAG Pi writer 工具级写边界：移除 writer unrestricted `bash`，以 SDK 同名受控 `edit`/`write` 在文件 API 执行前强制 repo containment、symlink/ancestor containment、`allowedPaths`/`writeSet`/`forbiddenPaths`，并硬拒绝 `.harness/tasks/**` 与 `.harness/dag-runs/**`；CLI-only 与 SDK→CLI 对 writer fail-closed（read-only `cli-only` rollback 保留），SDK resource loader 与 CLI 同时关闭 Pi extension 自动发现，阻止 extension 在 session 启动或覆盖工具后绕过沙箱。授权递归 glob（如 `src/**`）可创建其覆盖的中间目录，但同级越界目录仍在 mutation 前拒绝。same-run hard-verify workspace fingerprint 纳入当前 Task Contract 稳定 ignored 治理输入；这些文件漂移后成功命令全部 `reused=false`，runner-owned dag-runs volatile 不进入指纹。post-run write-guard 与 change-manifest 保持第二层防御
+- DAG convergence 成功知识防污染：只有 `review-pi` 与 review verdict recovery 均 FINISHED 且明确 `VERDICT: pass` 才写入 `review-pass` knowledge pattern；review gate 仅完成路由但上游 authority/protocol/review verdict 非 pass 时按 `non-retry-failure` 收口，不再把 `request-revision` 或被跳过的 review 误记为成功
+
+### 修复
+
+- 修复未配置 document catalog 的项目在 DAG 生成路径上的兼容问题，避免可选 catalog 成为硬依赖
+- 提升 convergence 与 writer 可靠性
+
+## [0.26.3] - 2026-08-02
+
+### 重点更新
+
+- DAG 无害工具副产物自动恢复
+- 提升前端验证命令的精确度与失败分类
+- 隔离测试固件与运行环境标记
+
+### 新增
+
+- DAG 无害工具副产物自动恢复：自动清理 Git Bash 误用 `> nul` / `2> nul` 在仓库根目录生成的普通非 symlink untracked `nul` 文件，避免其干扰 Git 状态复查与变更清单生成
+
+### 改进
+
+- 精确限定前端验证命令的作用域，提升验证执行的准确性
+- 更精准地分类前端验证失败原因，避免模糊报错
+- 将运行器标记与测试固件进行安全隔离，防止测试环境干扰
+
+### 修复
+
+- 修复配置验证目标错误处理符号引用的问题
+- 修复 DAG 执行中无害的根目录 nul 副产物导致流程异常的问题
+
 ## [0.26.2] - 2026-08-02
 
 ### 重点更新

package/dist/executors/dag-pi-executor.js

@@ -2,13 +2,14 @@ import path from "node:path";
 import { createHash } from "node:crypto";
 import { writeDagNodeJsonArtifact, writeTextArtifactFile, } from "../infrastructure/harness/artifact-store.js";
 import { executePiStep, } from "./pi-executor.js";
+import { buildPiWriterToolPolicyContext, createPiWriterCustomTools, } from "./pi-writer-tool-policy.js";
 import { redactPromptForLog, truncateOutput, } from "../shared/output-truncation.js";
-import { GitStatusUnavailableError, pathsChangedDuringRun, readGitStatusPorcelain, snapshotGitStatusPathFingerprints, snapshotGitStatusPorcelain, validateShellWriteGuard, } from "./shell-write-guard.js";
+import { GitStatusUnavailableError, pathsChangedDuringRun, readGitStatusPorcelain, recoverRootNulArtifact, snapshotGitStatusPathFingerprints, snapshotGitStatusPorcelain, validateShellWriteGuard, } from "./shell-write-guard.js";
 import { redactSecrets, truncateUtf8Preview } from "../shared/preview.js";
 export const DAG_PI_READONLY_TOOLS = ["read", "grep", "find", "ls"];
+/** Bounded writer tools: no unrestricted bash; edit/write are policy-wrapped via SDK customTools. */
 export const DAG_PI_WRITE_TOOLS = [
     "read",
-    "bash",
     "edit",
     "write",
     "grep",
@@ -259,6 +260,7 @@ export async function writePiExecutorArtifacts(artifactsDir, input) {
 }
 const DEFAULT_DAG_PI_WRITE_GUARD_DEPENDENCIES = {
     readGitStatusPorcelain,
+    recoverRootNulArtifact,
 };
 export async function executeDagPiNode(input, meta, piStepFn = executePiStep, writeGuardDependencies = DEFAULT_DAG_PI_WRITE_GUARD_DEPENDENCIES) {
     const started = Date.now();
@@ -312,6 +314,29 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
             });
         }
         : undefined;
+    let writerToolPolicy;
+    if (isWriteTask) {
+        try {
+            const policyContext = buildPiWriterToolPolicyContext({
+                repoRoot: input.cwd,
+                allowedPaths: input.task.allowedPaths,
+                writeSet: input.task.writeSet,
+                forbiddenPaths: input.task.forbiddenPaths,
+                writePolicy: input.task.writePolicy,
+            });
+            const customTools = await createPiWriterCustomTools(policyContext);
+            writerToolPolicy = { requireSdk: true, customTools };
+        }
+        catch (error) {
+            return {
+                ok: false,
+                stdout: "",
+                stderr: `pi writer tool policy unavailable before Pi execution: ${error instanceof Error ? error.message : String(error)}`,
+                failureCategory: "tool-policy",
+                durationMs: Date.now() - started,
+            };
+        }
+    }
     const result = await piStepFn({
         attachedFiles: [],
         modelConfig: resolveDagPiModelConfig(input.model, input.thinking ? { thinking: input.thinking } : undefined),
@@ -325,6 +350,7 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
         timeoutMs: input.timeoutMs,
         stallTimeoutMs: input.stallTimeoutMs,
         abortGraceMs: input.abortGraceMs,
+        ...(writerToolPolicy ? { writerToolPolicy } : {}),
         onActivity: bridgeActivity
             ? (activity) => {
                 if (activity.kind === "lease" ||
@@ -360,10 +386,105 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
     let changeManifestAfterStatus;
     let changeManifestChangedFiles;
     if (beforeStatus !== undefined) {
+        let recoveryEvidence;
+        let removalPendingRecheck;
         try {
-            const afterStatus = await writeGuardDependencies.readGitStatusPorcelain(input.cwd, { phase: "pi-writer-after" });
-            const afterSnapshot = snapshotGitStatusPorcelain(afterStatus);
-            const afterPathFingerprints = await snapshotGitStatusPathFingerprints(input.cwd, afterSnapshot);
+            let afterStatus = await writeGuardDependencies.readGitStatusPorcelain(input.cwd, { phase: "pi-writer-after" });
+            let afterSnapshot = snapshotGitStatusPorcelain(afterStatus);
+            let afterPathFingerprints = await snapshotGitStatusPathFingerprints(input.cwd, afterSnapshot);
+            // Benign tool artifact recovery: a new untracked bounded regular file
+            // literally named `nul` at the repository root is removed with
+            // the Node file API, then git status is recaptured so the guard,
+            // outcome validation and change manifest only ever see the
+            // sanitized diff. Every non-matching candidate stays fail-closed.
+            if (afterSnapshot.has("nul")) {
+                const recoverRootNulArtifactFn = writeGuardDependencies.recoverRootNulArtifact ??
+                    recoverRootNulArtifact;
+                const recovery = await recoverRootNulArtifactFn({
+                    rootCwd: input.cwd,
+                    beforeSnapshot: snapshotGitStatusPorcelain(beforeStatus),
+                    afterSnapshot,
+                    afterPathFingerprints,
+                    candidateAuthorized: validateShellWriteGuardFromDiff({
+                        changedFiles: ["nul"],
+                        task: input.task,
+                        concurrentSiblingWriteSets: meta.concurrentSiblingWriteSets,
+                    }).ok,
+                });
+                const beforeStatusSha256 = createHash("sha256")
+                    .update(beforeStatus)
+                    .digest("hex");
+                const afterStatusSha256 = createHash("sha256")
+                    .update(afterStatus)
+                    .digest("hex");
+                if (recovery.action === "removed") {
+                    const evidenceBase = {
+                        candidatePath: "nul",
+                        reason: recovery.reason,
+                        action: "recovered",
+                        result: "removed",
+                        observedSizeBytes: recovery.observedSizeBytes,
+                        removedAt: recovery.removedAt,
+                        beforeStatusSha256,
+                        afterStatusSha256,
+                    };
+                    removalPendingRecheck = evidenceBase;
+                    const recheckedStatus = await writeGuardDependencies.readGitStatusPorcelain(input.cwd, {
+                        phase: "pi-writer-after-recheck",
+                    });
+                    const recheckedSnapshot = snapshotGitStatusPorcelain(recheckedStatus);
+                    afterStatus = recheckedStatus;
+                    afterSnapshot = recheckedSnapshot;
+                    afterPathFingerprints = await snapshotGitStatusPathFingerprints(input.cwd, recheckedSnapshot);
+                    recoveryEvidence = {
+                        ...evidenceBase,
+                        recheck: {
+                            statusSha256: createHash("sha256")
+                                .update(recheckedStatus)
+                                .digest("hex"),
+                            nulStillPresent: recheckedSnapshot.has("nul"),
+                        },
+                    };
+                    removalPendingRecheck = undefined;
+                }
+                else if (recovery.action === "skipped") {
+                    recoveryEvidence = {
+                        candidatePath: "nul",
+                        reason: recovery.reason,
+                        action: "skipped",
+                        result: "kept",
+                        ...(recovery.observedSizeBytes === undefined
+                            ? {}
+                            : { observedSizeBytes: recovery.observedSizeBytes }),
+                        beforeStatusSha256,
+                        afterStatusSha256,
+                        recheck: {
+                            statusSha256: afterStatusSha256,
+                            nulStillPresent: true,
+                        },
+                    };
+                }
+                else {
+                    recoveryEvidence = {
+                        candidatePath: "nul",
+                        reason: recovery.reason,
+                        action: "failed",
+                        result: "removal-failed",
+                        observedSizeBytes: recovery.observedSizeBytes,
+                        errorDetail: recovery.errorDetail,
+                        beforeStatusSha256,
+                        afterStatusSha256,
+                        recheck: {
+                            statusSha256: afterStatusSha256,
+                            nulStillPresent: true,
+                        },
+                    };
+                    writeGuardOk = false;
+                    writeGuardViolations = [
+                        `nul artifact removal failed: ${recovery.errorDetail}`,
+                    ];
+                }
+            }
             const changedFiles = pathsChangedDuringRun(snapshotGitStatusPorcelain(beforeStatus), afterSnapshot, beforePathFingerprints, afterPathFingerprints);
             changeManifestAfterStatus = afterStatus;
             changeManifestChangedFiles = changedFiles;
@@ -372,16 +493,35 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
                 task: input.task,
                 concurrentSiblingWriteSets: meta.concurrentSiblingWriteSets,
             });
-            writeGuardOk = guard.ok;
-            writeGuardViolations = guard.violations;
+            writeGuardOk = writeGuardOk && guard.ok;
+            writeGuardViolations = [...writeGuardViolations, ...guard.violations];
         }
         catch (error) {
             await persistGitWriteGuardDiagnostics(meta.runDir, input.task.id, error);
+            if (removalPendingRecheck) {
+                // The artifact was already deleted but the recheck read failed:
+                // record the recovery facts with the recheck failure so the
+                // evidence trail stays complete while the node remains failed.
+                recoveryEvidence = {
+                    ...removalPendingRecheck,
+                    recheck: {
+                        failed: true,
+                        errorDetail: boundedRecoveryErrorDetail(error),
+                    },
+                };
+            }
             writeGuardOk = false;
             writeGuardViolations = [
                 `git status unavailable: ${error instanceof Error ? error.message : String(error)}`,
             ];
         }
+        if (recoveryEvidence) {
+            await persistBenignToolArtifactRecovery({
+                runDir: meta.runDir,
+                nodeId: input.task.id,
+                evidence: recoveryEvidence,
+            });
+        }
     }
     let writerOutcomeViolation;
     if (mapped.ok && input.task.writerOutcomePolicy) {
@@ -624,9 +764,7 @@ async function persistWriterGitBaseline(input) {
         nodeId: input.nodeId,
         phase: "pi-writer-before",
         capturedAt: new Date().toISOString(),
-        statusSha256: createHash("sha256")
-            .update(input.beforeStatus)
-            .digest("hex"),
+        statusSha256: createHash("sha256").update(input.beforeStatus).digest("hex"),
         dirtyPaths: [...input.beforeSnapshot.keys()].sort(),
         pathFingerprintsSha256: createHash("sha256")
             .update(JSON.stringify(fingerprintEntries))
@@ -639,6 +777,40 @@ async function persistGitWriteGuardDiagnostics(runDir, nodeId, error) {
         return;
     await writeDagNodeJsonArtifact(runDir, nodeId, "git-write-guard-diagnostics.json", error.diagnostics);
 }
+function boundedRecoveryErrorDetail(error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    return detail.length <= 1000
+        ? detail
+        : `${detail.slice(0, 1000)}...[truncated]`;
+}
+/**
+ * Persist bounded run-owned evidence for a recognized repository-root `nul`
+ * candidate: candidate path, reason, action, result and recheck facts plus
+ * status hashes. Never records environment variables or secrets.
+ */
+async function persistBenignToolArtifactRecovery(input) {
+    const artifact = {
+        schemaVersion: 1,
+        nodeId: input.nodeId,
+        candidatePath: input.evidence.candidatePath,
+        reason: input.evidence.reason,
+        action: input.evidence.action,
+        result: input.evidence.result,
+        ...(input.evidence.observedSizeBytes === undefined
+            ? {}
+            : { observedSizeBytes: input.evidence.observedSizeBytes }),
+        ...(input.evidence.errorDetail
+            ? { errorDetail: input.evidence.errorDetail }
+            : {}),
+        ...(input.evidence.removedAt
+            ? { removedAt: input.evidence.removedAt }
+            : {}),
+        beforeStatusSha256: input.evidence.beforeStatusSha256,
+        afterStatusSha256: input.evidence.afterStatusSha256,
+        recheck: input.evidence.recheck,
+    };
+    await writeDagNodeJsonArtifact(input.runDir, input.nodeId, "benign-tool-artifact-recovery.json", artifact);
+}
 /**
  * Validate the writer's observed diff against its declared write boundary.
  * Inlined mirror of runPostRunWriteGuard that reuses the already-computed diff