@tea-agent/loop-agent 0.26.3 → 0.26.4

package/CHANGELOG.md

@@ -2,6 +2,26 @@
 
 ## [Unreleased]
 
+## [0.26.4] - 2026-08-03
+
+### 重点更新
+
+- 强化 DAG 运行时安全与 writer 工具级写边界
+- 收敛效率与可选 document catalog 兼容
+- 防污染 review-pass 知识写入
+
+### 改进
+
+- fresh init 与旧项目 `init update --apply-safe` 刷新的 `AGENTS.md` managed block 现要求持续监控 DAG 至 `FINISHED`、`FAILED`、`partial_failed` 等已结束终态或 Decision Gate 需要 approve；判活须组合 runner heartbeat、session events 与 `dag doctor` liveness/provider meaningful progress，并禁止 exclusive writer 运行期间主会话或其他 writer 并发修改工作区
+- DAG 治理闭包与收敛效率：已配置 `docs/document-catalog.json` 的项目在生成时从 `completeDirectoryIndexes` 注入具体 index companion 到 implement/repair 内存路径，未配置该可选 catalog 的项目保持原有 DAG 生成能力；repair artifact 支持 `blocked-boundary`/`requiredScope` 与 empty-manifest `no-progress` 提前止损；DAG shell 支持显式 `failFast`，supervised hard verify 在同 run、同工作区指纹与命令契约下仅复用成功命令并写可审计 receipt。真实非零退出与 finished 聚合规则不放宽，且不跨 run 缓存验证结果
+- DAG Pi writer 工具级写边界：移除 writer unrestricted `bash`，以 SDK 同名受控 `edit`/`write` 在文件 API 执行前强制 repo containment、symlink/ancestor containment、`allowedPaths`/`writeSet`/`forbiddenPaths`，并硬拒绝 `.harness/tasks/**` 与 `.harness/dag-runs/**`；CLI-only 与 SDK→CLI 对 writer fail-closed（read-only `cli-only` rollback 保留），SDK resource loader 与 CLI 同时关闭 Pi extension 自动发现，阻止 extension 在 session 启动或覆盖工具后绕过沙箱。授权递归 glob（如 `src/**`）可创建其覆盖的中间目录，但同级越界目录仍在 mutation 前拒绝。same-run hard-verify workspace fingerprint 纳入当前 Task Contract 稳定 ignored 治理输入；这些文件漂移后成功命令全部 `reused=false`，runner-owned dag-runs volatile 不进入指纹。post-run write-guard 与 change-manifest 保持第二层防御
+- DAG convergence 成功知识防污染：只有 `review-pi` 与 review verdict recovery 均 FINISHED 且明确 `VERDICT: pass` 才写入 `review-pass` knowledge pattern；review gate 仅完成路由但上游 authority/protocol/review verdict 非 pass 时按 `non-retry-failure` 收口，不再把 `request-revision` 或被跳过的 review 误记为成功
+
+### 修复
+
+- 修复未配置 document catalog 的项目在 DAG 生成路径上的兼容问题，避免可选 catalog 成为硬依赖
+- 提升 convergence 与 writer 可靠性
+
 ## [0.26.3] - 2026-08-02
 
 ### 重点更新

package/dist/executors/dag-pi-executor.js

@@ -2,13 +2,14 @@ import path from "node:path";
 import { createHash } from "node:crypto";
 import { writeDagNodeJsonArtifact, writeTextArtifactFile, } from "../infrastructure/harness/artifact-store.js";
 import { executePiStep, } from "./pi-executor.js";
+import { buildPiWriterToolPolicyContext, createPiWriterCustomTools, } from "./pi-writer-tool-policy.js";
 import { redactPromptForLog, truncateOutput, } from "../shared/output-truncation.js";
 import { GitStatusUnavailableError, pathsChangedDuringRun, readGitStatusPorcelain, recoverRootNulArtifact, snapshotGitStatusPathFingerprints, snapshotGitStatusPorcelain, validateShellWriteGuard, } from "./shell-write-guard.js";
 import { redactSecrets, truncateUtf8Preview } from "../shared/preview.js";
 export const DAG_PI_READONLY_TOOLS = ["read", "grep", "find", "ls"];
+/** Bounded writer tools: no unrestricted bash; edit/write are policy-wrapped via SDK customTools. */
 export const DAG_PI_WRITE_TOOLS = [
     "read",
-    "bash",
     "edit",
     "write",
     "grep",
@@ -313,6 +314,29 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
             });
         }
         : undefined;
+    let writerToolPolicy;
+    if (isWriteTask) {
+        try {
+            const policyContext = buildPiWriterToolPolicyContext({
+                repoRoot: input.cwd,
+                allowedPaths: input.task.allowedPaths,
+                writeSet: input.task.writeSet,
+                forbiddenPaths: input.task.forbiddenPaths,
+                writePolicy: input.task.writePolicy,
+            });
+            const customTools = await createPiWriterCustomTools(policyContext);
+            writerToolPolicy = { requireSdk: true, customTools };
+        }
+        catch (error) {
+            return {
+                ok: false,
+                stdout: "",
+                stderr: `pi writer tool policy unavailable before Pi execution: ${error instanceof Error ? error.message : String(error)}`,
+                failureCategory: "tool-policy",
+                durationMs: Date.now() - started,
+            };
+        }
+    }
     const result = await piStepFn({
         attachedFiles: [],
         modelConfig: resolveDagPiModelConfig(input.model, input.thinking ? { thinking: input.thinking } : undefined),
@@ -326,6 +350,7 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
         timeoutMs: input.timeoutMs,
         stallTimeoutMs: input.stallTimeoutMs,
         abortGraceMs: input.abortGraceMs,
+        ...(writerToolPolicy ? { writerToolPolicy } : {}),
         onActivity: bridgeActivity
             ? (activity) => {
                 if (activity.kind === "lease" ||