@tea-agent/loop-agent 0.28.3 → 0.28.5

package/CHANGELOG.md

@@ -2,6 +2,27 @@
 
 ## [Unreleased]
 
+## [0.28.5] - 2026-08-05
+
+### 重点更新
+
+- 修复 macOS 下 /tmp 路径别名导致 Night Scheduler 工作区隔离校验误报失败的问题
+
+### 修复
+
+- Night Scheduler 准入控制现使用 realpath 规范化控制目录与 worktree 路径，避免 macOS /tmp 别名引发隔离校验假失败
+- Night Scheduler 准入事实仅冻结仓库内相对路径的 worktree 路径，提升隔离检查的准确性
+
+## [0.28.4] - 2026-08-05
+
+### 重点更新
+
+- 修复 Night Scheduler 准入控制中 writeSet 门禁冻结的误报失败问题
+
+### 修复
+
+- Night Scheduler `admission prepare`：为 `task advance --json` 补充 `expectJson`，并允许从 stdout 解析 writeSet gate，修复“did not return JSON”假失败
+
 ## [0.28.3] - 2026-08-05
 
 ### 重点更新

package/dist/worker/run-task/execute-prepared-task.js

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { access, readFile } from "node:fs/promises";
+import { access, readFile, realpath } from "node:fs/promises";
 import path from "node:path";
 import { controllerIdentityExpectationFailure, resolveControllerIdentity, } from "../loop-agent/loop-agent-client.js";
 import { buildWorkerRunId, } from "./run-task.js";
@@ -27,12 +27,13 @@ export async function executePreparedTaskSpec(options) {
         throw new Error(`${identityFailure.code}: ${identityFailure.message}`);
     }
     // Fail closed: never run on control root when workspace differs.
-    const workspaceRoot = path.resolve(options.workspaceRoot);
-    const controlRoot = path.resolve(options.controlRepoRoot);
+    // Resolve realpath so macOS /tmp vs /private/tmp aliases compare equal.
+    const controlRoot = await resolveExistingPath(options.controlRepoRoot);
+    const workspaceRoot = await resolveExistingPath(options.workspaceRoot);
     if (workspaceRoot === controlRoot) {
         throw new Error("executePreparedTask: refusing to run on controlRepoRoot (night isolation required)");
     }
-    const expectedWorkspaceRoot = path.resolve(controlRoot, admission.workspace.path);
+    const expectedWorkspaceRoot = await resolvePathAgainstRoot(controlRoot, admission.workspace.path);
     if (workspaceRoot !== expectedWorkspaceRoot) {
         throw new Error(`executePreparedTask: workspace binding mismatch (expected ${expectedWorkspaceRoot}, got ${workspaceRoot})`);
     }
@@ -130,6 +131,26 @@ function assertWithinRoot(root, candidate, label) {
         throw new Error(`executePreparedTask: ${label} escapes its allowed root`);
     }
 }
+async function resolveExistingPath(inputPath) {
+    const resolved = path.resolve(inputPath);
+    try {
+        return await realpath(resolved);
+    }
+    catch {
+        return resolved;
+    }
+}
+async function resolvePathAgainstRoot(root, relativeOrAbsolute) {
+    const joined = path.isAbsolute(relativeOrAbsolute)
+        ? path.resolve(relativeOrAbsolute)
+        : path.resolve(root, relativeOrAbsolute);
+    try {
+        return await realpath(joined);
+    }
+    catch {
+        return joined;
+    }
+}
 function isAdvanceSuccess(result) {
     if (result.ok)
         return true;

package/dist/worker/scheduler/admission.js

@@ -476,6 +476,7 @@ async function defaultPrepareInWorkspace(input) {
     ], {
         cwd: input.workspaceRoot,
         artifactName: `admission-task-advance-${materializeManifest.harnessTaskId}`,
+        expectJson: true,
     });
     const gate = extractGate(advanceResult, materializeManifest.harnessTaskId);
     const dagBytes = await readFile(getTaskPaths(input.workspaceRoot, materializeManifest.harnessTaskId)
@@ -507,7 +508,15 @@ async function defaultPrepareInWorkspace(input) {
     };
 }
 function extractGate(result, taskId) {
-    const root = result.json;
+    let root = result.json;
+    if ((!root || typeof root !== "object") && result.stdout?.trim()) {
+        try {
+            root = JSON.parse(result.stdout);
+        }
+        catch {
+            // keep root undefined; error below
+        }
+    }
     if (!root || typeof root !== "object") {
         throw new Error(`admission prepare did not return JSON for ${taskId}; cannot open writeSet gate`);
     }

package/dist/worker/scheduler/workspace-adapter.js

@@ -37,13 +37,17 @@ export async function prepareNightWorkspace(spec) {
     if (spec.hydrateNodeModules !== false) {
         nodeModulesLinked = await linkNodeModulesIfPresent(spec.controlRepoRoot, ensured.path);
     }
+    const controlResolved = path.resolve(spec.controlRepoRoot);
     const relative = path
-        .relative(spec.controlRepoRoot, ensured.path)
+        .relative(controlResolved, path.resolve(ensured.path))
         .split(path.sep)
         .join("/") || relativeWorktreePath;
+    if (relative.startsWith("..") || path.isAbsolute(relative)) {
+        throw new Error(`night worktree path must stay under control repo (.worktrees): ${ensured.path}`);
+    }
     return {
         ...ensured,
-        relativeWorktreePath: relative.startsWith("..") ? ensured.path : relative,
+        relativeWorktreePath: relative,
         relativeBranch: branch,
         nodeModulesLinked,
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tea-agent/loop-agent",
-  "version": "0.28.3",
+  "version": "0.28.5",
   "type": "module",
   "bin": {
     "loop-agent": "bin/loop-agent.js",