@tea-agent/loop-agent 0.33.1 → 0.33.3

package/CHANGELOG.md

@@ -2,6 +2,32 @@
 
 ## [Unreleased]
 
+## [0.33.3] - 2026-08-10
+
+### 重点更新
+
+- 修复 Windows 环境下 frontend-test 配置 URL 冻结异常的问题，确保跨平台地址识别行为一致
+
+### 改进
+
+- 改进 frontend-test 的 Windows URL 回归测试，使其具备更好的跨平台可移植性
+
+### 修复
+
+- 修复 Windows 环境下 frontend-test 配置 URL（如 baseUrl、targetUrl、loginUrl）无法正确冻结的问题，冲突候选现安全 fail closed，仅在完全未配置时回退 localhost
+
+## [0.33.2] - 2026-08-10
+
+### 重点更新
+
+- 更新 analyze-product 技能
+- 针对结构化产物的可恢复失败自动重试
+
+### 改进
+
+- 更新 analyze-product 技能
+- 结构化产物在遇到可恢复失败时会自动进行重试
+
 ## [0.33.1] - 2026-08-10
 
 ### 重点更新

package/dist/workflows/dag/frontend-test-html-report.js

@@ -25,21 +25,24 @@ function writeMetric(label, value, color = "#172033") {
 }
 function renderCaseCard(item) {
     const colors = statusColor(item.status);
-    const rerun = typeof item.rerunAttempt === "number" &&
-        item.rerunAttempt > 0
+    const rerun = typeof item.rerunAttempt === "number" && item.rerunAttempt > 0
         ? `<span class="badge" style="color:#175cd3;background:#eff8ff">重跑 ${item.rerunAttempt}</span>`
         : "";
     const error = item.status === "passed"
         ? ""
         : `<div class="error-box"><strong>原因分析</strong><p>${escapeHtml(item.errorAnalysis ?? item.blockedReason ?? "用例未能完成执行。")}</p></div>`;
-    const execution = item.status === "passed"
+    const testPoints = item.testPoints ?? [];
+    const executionSummary = item.executionSummary ?? "";
+    const executionSteps = item.executionSteps ?? [];
+    const hasExecution = executionSummary.trim().length > 0 || executionSteps.length > 0;
+    const execution = !hasExecution
         ? ""
-        : `<div class="error-box"><strong>执行记录</strong><p>${escapeHtml(item.executionSummary ??
-            item.errorAnalysis ??
-            item.blockedReason ??
-            "见 evidence 目录 execution.md / case-result.json")}</p></div>`;
-    const testPoints = item.testPoints;
-    const testPointsHtml = Array.isArray(testPoints) && testPoints.length
+        : `<div class="execution-box"><strong>执行记录</strong>${executionSummary.trim().length > 0
+            ? `<p>${escapeHtml(executionSummary)}</p>`
+            : ""}${executionSteps.length > 0
+            ? listHtml(executionSteps)
+            : ""}</div>`;
+    const testPointsHtml = testPoints.length
         ? `<div><h3>测试点</h3>${listHtml(testPoints)}</div>`
         : "";
     return `<details class="case-card" data-status="${item.status}" ${item.status !== "passed" ? "open" : ""}>
@@ -53,8 +56,8 @@ function renderCaseCard(item) {
         <div><h3>测试步骤</h3>${listHtml(item.caseContent.steps)}</div>
         <div><h3>预期结果</h3>${listHtml(item.caseContent.expectedResults)}</div>
       </div>
-      ${error}
       ${execution}
+      ${error}
     </div>
   </details>`;
 }
@@ -87,18 +90,30 @@ export async function renderFrontendTestHtmlReport(input) {
         ? (result.acceptanceCoverage.covered.length / result.sourceBinding.requirementIds.length) * 100
         : 0;
     const outcomeColors = result.outcome === "passed" ? statusColor("passed") : result.outcome === "failed" ? statusColor("failed") : statusColor("blocked");
-    const markdownCases = result.cases.map((item) => [
-        `## ${item.caseId}`,
-        "",
-        `- 执行结果：${statusLabel(item.status)}`,
-        `- 验收标准：${item.acIds.join("、")}`,
-        "",
-        "### 测试目的", "", item.caseContent.purpose,
-        "", "### 前置条件", "", listMarkdown(item.caseContent.preconditions),
-        "", "### 操作步骤", "", listMarkdown(item.caseContent.steps),
-        "", "### 预期结果", "", listMarkdown(item.caseContent.expectedResults),
-        ...(item.status === "passed" ? [] : ["", "### 错误分析", "", item.errorAnalysis ?? item.blockedReason ?? "用例未能完成执行。"]),
-    ].join("\n")).join("\n\n");
+    const markdownCases = result.cases.map((item) => {
+        const testPoints = item.testPoints ?? [];
+        const executionSummary = item.executionSummary ?? "";
+        const executionSteps = item.executionSteps ?? [];
+        return [
+            `## ${item.caseId}`,
+            "",
+            `- 执行结果：${statusLabel(item.status)}`,
+            `- 验收标准：${item.acIds.join("、")}`,
+            ...(typeof item.rerunAttempt === "number" && item.rerunAttempt > 0
+                ? [`- 重跑次数：${item.rerunAttempt}`]
+                : []),
+            "",
+            "### 测试目的", "", item.caseContent.purpose,
+            ...(testPoints.length ? ["", "### 测试点", "", listMarkdown(testPoints)] : []),
+            "", "### 前置条件", "", listMarkdown(item.caseContent.preconditions),
+            "", "### 测试步骤", "", listMarkdown(item.caseContent.steps),
+            "", "### 预期结果", "", listMarkdown(item.caseContent.expectedResults),
+            ...(executionSummary.trim().length || executionSteps.length
+                ? ["", "### 执行记录", "", executionSummary.trim(), ...(executionSteps.length ? ["", listMarkdown(executionSteps)] : [])]
+                : []),
+            ...(item.status === "passed" ? [] : ["", "### 错误分析", "", item.errorAnalysis ?? item.blockedReason ?? "用例未能完成执行。"]),
+        ];
+    }).map((lines) => lines.filter((line) => line !== undefined).join("\n")).join("\n\n");
     const markdown = [
         "# 前端功能测试报告", "",
         `- 测试结论：${outcomeLabel}`,
@@ -117,7 +132,7 @@ export async function renderFrontendTestHtmlReport(input) {
         ? `<section class="panel"><div class="section-heading"><h2>失败概览</h2><span>${failedCount} 条未通过用例</span></div><div class="failure-list">${result.cases.filter((item) => item.status !== "passed").map((item) => `<div class="failure-row"><span class="case-id">${escapeHtml(item.caseId)}</span><span>${escapeHtml(item.errorAnalysis ?? item.blockedReason ?? "用例未能完成执行。")}</span></div>`).join("")}</div></section>`
         : "";
     const html = `<!doctype html><html lang="zh-CN"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src 'unsafe-inline'"><title>前端功能测试报告</title><style>
-body{margin:0;background:radial-gradient(circle at 8% 0,#edf4ff 0,transparent 36rem),#f5f7fb;color:#17243b;font:15px/1.6 Inter,system-ui,-apple-system,BlinkMacSystemFont,'Segoe UI','Microsoft YaHei',sans-serif}main{max-width:1180px;margin:0 auto;padding:42px 28px 72px}.hero{padding:30px 34px;border:1px solid #294b78;border-radius:24px;background:linear-gradient(125deg,#102849 0%,#173d6d 57%,#245b91 100%);box-shadow:0 18px 40px rgba(16,40,73,.18);display:flex;align-items:flex-start;justify-content:space-between;gap:28px}.eyebrow{color:#9fc6ee;font-size:11px;font-weight:800;letter-spacing:.2em}.hero h1{margin:10px 0 8px;color:#f7fbff;font-size:clamp(28px,3.8vw,44px);line-height:1.1}.hero p{margin:0;color:#bdd2e9;font-size:13px}.decision{min-width:190px;padding:15px 17px;border:1px solid ${outcomeColors.border};border-radius:16px;background:${outcomeColors.bg};color:${outcomeColors.fg}}.decision strong{display:block;font-size:17px}.decision span{display:block;margin-top:4px;font-size:12px}.panel{background:#fff;border:1px solid #e0e7f0;border-radius:15px;box-shadow:0 7px 20px rgba(25,53,92,.04);padding:22px;margin-top:18px}.metrics{display:grid;grid-template-columns:repeat(5,1fr);gap:12px;margin-top:18px}.metric{position:relative;min-height:92px;padding:17px 18px;background:#fff;border:1px solid #e1e8f2;border-radius:13px}.metric:before{content:'';position:absolute;top:0;left:0;right:0;height:3px;background:#4775ef;border-radius:13px 13px 0 0}.metric span{display:block;color:#748198;font-size:12px}.metric strong{display:block;margin-top:12px;font-size:28px;line-height:1;font-weight:800}.section-heading{display:flex;align-items:baseline;justify-content:space-between;gap:12px;margin-bottom:12px}.section-heading h2{margin:0;color:#17365d;font-size:19px}.section-heading span{color:#718097;font-size:12px}.signal-grid{display:grid;grid-template-columns:1fr 1fr;gap:12px}.signal{padding:14px;border:1px solid #e4e9f1;border-radius:11px;background:#fbfcfe}.signal header{display:flex;justify-content:space-between;color:#2a3c5a;font-size:12px}.bar{height:7px;margin:10px 0 6px;background:#edf1f6;border-radius:99px;overflow:hidden}.bar i{display:block;height:100%;border-radius:inherit}.signal small{color:#718097;font-size:11px}.case-card{border:1px solid #e4e9f1;border-radius:13px;background:#fff;overflow:hidden;margin-top:10px}.case-card summary{display:flex;align-items:center;gap:12px;padding:14px 16px;cursor:pointer;list-style:none}.case-card summary::-webkit-details-marker{display:none}.case-id{color:#2b3a55;font:700 12px ui-monospace,SFMono-Regular,Menlo,monospace;white-space:nowrap}.case-title{flex:1;min-width:0;color:#172033;font-weight:650;overflow:hidden;text-overflow:ellipsis}.badge{padding:3px 10px;border-radius:999px;font-size:11px;font-weight:800;white-space:nowrap}.chevron{color:#aab2bf}.case-body{padding:3px 16px 17px;border-top:1px solid #f0f3f7}.case-meta{margin-top:12px;padding:9px 11px;background:#f6f8fa;border-radius:8px;color:#667085;font-size:11px}.case-meta strong{margin-left:8px;color:#344054}.case-grid{display:grid;grid-template-columns:1fr 1fr;gap:10px;margin-top:13px}.case-grid>div{padding:11px 12px;border:1px solid #edf0f4;border-radius:9px;background:#fbfcfe}.case-grid h3{margin:0 0 5px;color:#667085;font-size:11px}.case-grid p,.case-grid ol{margin:0;color:#475467;font-size:13px}.case-grid ol{padding-left:20px}.muted{color:#98a2b3!important}.error-box{margin-top:13px;padding:11px 13px;border:1px solid #fda29b;border-radius:9px;background:#fef3f2;color:#b42318}.error-box strong{font-size:12px}.error-box p{margin:4px 0 0;white-space:pre-wrap;font-size:13px}.failure-list{display:grid;gap:9px}.failure-row{display:flex;align-items:baseline;gap:12px;padding:10px 12px;border-left:4px solid #d34661;border-radius:8px;background:#fff8f9;color:#475467;font-size:13px}.success-note{padding:11px 13px;border-radius:9px;background:#ecfdf3;color:#067647;font-size:13px}.finding-list{padding:11px 13px;border-radius:9px;background:#fffaeb;color:#946200;font-size:13px}.finding-list ol{margin:5px 0 0;padding-left:20px}@media(max-width:850px){.hero{display:block}.decision{margin-top:20px;min-width:0}.metrics{grid-template-columns:repeat(2,1fr)}.signal-grid,.case-grid{grid-template-columns:1fr}}@media(max-width:520px){main{padding:22px 14px 42px}.metrics{grid-template-columns:1fr}.case-card summary{flex-wrap:wrap}.case-title{order:3;flex-basis:100%}}
+body{margin:0;background:radial-gradient(circle at 8% 0,#edf4ff 0,transparent 36rem),#f5f7fb;color:#17243b;font:15px/1.6 Inter,system-ui,-apple-system,BlinkMacSystemFont,'Segoe UI','Microsoft YaHei',sans-serif}main{max-width:1180px;margin:0 auto;padding:42px 28px 72px}.hero{padding:30px 34px;border:1px solid #294b78;border-radius:24px;background:linear-gradient(125deg,#102849 0%,#173d6d 57%,#245b91 100%);box-shadow:0 18px 40px rgba(16,40,73,.18);display:flex;align-items:flex-start;justify-content:space-between;gap:28px}.eyebrow{color:#9fc6ee;font-size:11px;font-weight:800;letter-spacing:.2em}.hero h1{margin:10px 0 8px;color:#f7fbff;font-size:clamp(28px,3.8vw,44px);line-height:1.1}.hero p{margin:0;color:#bdd2e9;font-size:13px}.decision{min-width:190px;padding:15px 17px;border:1px solid ${outcomeColors.border};border-radius:16px;background:${outcomeColors.bg};color:${outcomeColors.fg}}.decision strong{display:block;font-size:17px}.decision span{display:block;margin-top:4px;font-size:12px}.panel{background:#fff;border:1px solid #e0e7f0;border-radius:15px;box-shadow:0 7px 20px rgba(25,53,92,.04);padding:22px;margin-top:18px}.metrics{display:grid;grid-template-columns:repeat(5,1fr);gap:12px;margin-top:18px}.metric{position:relative;min-height:92px;padding:17px 18px;background:#fff;border:1px solid #e1e8f2;border-radius:13px}.metric:before{content:'';position:absolute;top:0;left:0;right:0;height:3px;background:#4775ef;border-radius:13px 13px 0 0}.metric span{display:block;color:#748198;font-size:12px}.metric strong{display:block;margin-top:12px;font-size:28px;line-height:1;font-weight:800}.section-heading{display:flex;align-items:baseline;justify-content:space-between;gap:12px;margin-bottom:12px}.section-heading h2{margin:0;color:#17365d;font-size:19px}.section-heading span{color:#718097;font-size:12px}.signal-grid{display:grid;grid-template-columns:1fr 1fr;gap:12px}.signal{padding:14px;border:1px solid #e4e9f1;border-radius:11px;background:#fbfcfe}.signal header{display:flex;justify-content:space-between;color:#2a3c5a;font-size:12px}.bar{height:7px;margin:10px 0 6px;background:#edf1f6;border-radius:99px;overflow:hidden}.bar i{display:block;height:100%;border-radius:inherit}.signal small{color:#718097;font-size:11px}.case-card{border:1px solid #e4e9f1;border-radius:13px;background:#fff;overflow:hidden;margin-top:10px}.case-card summary{display:flex;align-items:center;gap:12px;padding:14px 16px;cursor:pointer;list-style:none}.case-card summary::-webkit-details-marker{display:none}.case-id{color:#2b3a55;font:700 12px ui-monospace,SFMono-Regular,Menlo,monospace;white-space:nowrap}.case-title{flex:1;min-width:0;color:#172033;font-weight:650;overflow:hidden;text-overflow:ellipsis}.badge{padding:3px 10px;border-radius:999px;font-size:11px;font-weight:800;white-space:nowrap}.chevron{color:#aab2bf}.case-body{padding:3px 16px 17px;border-top:1px solid #f0f3f7}.case-meta{margin-top:12px;padding:9px 11px;background:#f6f8fa;border-radius:8px;color:#667085;font-size:11px}.case-meta strong{margin-left:8px;color:#344054}.case-grid{display:grid;grid-template-columns:1fr 1fr;gap:10px;margin-top:13px}.case-grid>div{padding:11px 12px;border:1px solid #edf0f4;border-radius:9px;background:#fbfcfe}.case-grid h3{margin:0 0 5px;color:#667085;font-size:11px}.case-grid p,.case-grid ol{margin:0;color:#475467;font-size:13px}.case-grid ol{padding-left:20px}.muted{color:#98a2b3!important}.error-box{margin-top:13px;padding:11px 13px;border:1px solid #fda29b;border-radius:9px;background:#fef3f2;color:#b42318}.execution-box{margin-top:13px;padding:11px 13px;border:1px solid #b9d6f5;border-radius:9px;background:#f5f9ff;color:#1f4e79}.execution-box strong{font-size:12px}.execution-box p{margin:4px 0 0;white-space:pre-wrap;font-size:13px}.execution-box ol{margin:6px 0 0;padding-left:20px;color:#28456b;font-size:13px}.error-box strong{font-size:12px}.error-box p{margin:4px 0 0;white-space:pre-wrap;font-size:13px}.failure-list{display:grid;gap:9px}.failure-row{display:flex;align-items:baseline;gap:12px;padding:10px 12px;border-left:4px solid #d34661;border-radius:8px;background:#fff8f9;color:#475467;font-size:13px}.success-note{padding:11px 13px;border-radius:9px;background:#ecfdf3;color:#067647;font-size:13px}.finding-list{padding:11px 13px;border-radius:9px;background:#fffaeb;color:#946200;font-size:13px}.finding-list ol{margin:5px 0 0;padding-left:20px}@media(max-width:850px){.hero{display:block}.decision{margin-top:20px;min-width:0}.metrics{grid-template-columns:repeat(2,1fr)}.signal-grid,.case-grid{grid-template-columns:1fr}}@media(max-width:520px){main{padding:22px 14px 42px}.metrics{grid-template-columns:1fr}.case-card summary{flex-wrap:wrap}.case-title{order:3;flex-basis:100%}}
 
 .filter-bar{display:flex;flex-wrap:wrap;gap:8px;align-items:center;margin:12px 0 16px}
 .filter-label{font-size:13px;color:#475467}

package/dist/workflows/dag/frontend-test-result-contract.js

@@ -37,6 +37,7 @@ export const frontendTestResultContractSchema = z.object({
         rerunAttempt: z.number().int().nonnegative().optional(),
         testPoints: z.array(z.string()).optional(),
         executionSummary: z.string().optional(),
+        executionSteps: z.array(z.string()).optional(),
         caseContent: z.object({
             purpose: z.string(),
             preconditions: z.array(z.string()),
@@ -233,18 +234,56 @@ function markdownList(value) {
     const items = value.split(/\r?\n/).map((line) => line.replace(/^\s*(?:\d+[.)]|[-*+])\s+/, "").trim()).filter(Boolean);
     return items;
 }
+/**
+ * Read planned case facts from the case Markdown. Recognizes both English and
+ * Chinese headings, including `测试点` (test points) and `测试步骤` (planned
+ * test steps), alongside the legacy `操作步骤`/`Steps` headings.
+ */
 async function readFrontendCaseContent(workspaceRoot, casePath) {
     if (!safeRelativePathSchema.safeParse(casePath).success || !casePath.startsWith("testcase/frontend/cases/")) {
         throw new Error(`unsafe frontend case path: ${casePath}`);
     }
     const body = await readFile(path.resolve(workspaceRoot, casePath), "utf8");
     return {
-        purpose: markdownSection(body, ["Test Purpose", "测试目的", "测试场景"]) || "未提供测试目的",
-        preconditions: markdownList(markdownSection(body, ["Preconditions", "前置条件"])),
-        steps: markdownList(markdownSection(body, ["Steps", "操作步骤"])),
-        expectedResults: markdownList(markdownSection(body, ["Expected Results", "预期结果"])),
+        caseContent: {
+            purpose: markdownSection(body, ["Test Purpose", "测试目的", "测试场景"]) || "未提供测试目的",
+            preconditions: markdownList(markdownSection(body, ["Preconditions", "前置条件"])),
+            steps: markdownList(markdownSection(body, ["Test Steps", "测试步骤", "Steps", "操作步骤"])),
+            expectedResults: markdownList(markdownSection(body, ["Expected Results", "预期结果"])),
+        },
+        testPoints: markdownList(markdownSection(body, ["Test Points", "测试点"])),
     };
 }
+/**
+ * Parse bounded fixed sections from execution.md. Only a small allowlist of
+ * headings is recognized and each section is length-capped so model prose
+ * cannot flood the report. Missing sections return empty values (advisory only).
+ */
+const EXECUTION_SUMMARY_MAX_LENGTH = 1200;
+const EXECUTION_STEPS_MAX_ITEMS = 40;
+function parseExecutionMarkdown(body) {
+    const summarySection = markdownSection(body, [
+        "Execution Summary",
+        "Actual Execution Summary",
+        "执行摘要",
+        "实际执行摘要",
+        "执行总结",
+    ]);
+    const rawSummary = summarySection.replace(/\r\n/g, "\n").trim();
+    const summary = rawSummary.length > EXECUTION_SUMMARY_MAX_LENGTH
+        ? `${rawSummary.slice(0, EXECUTION_SUMMARY_MAX_LENGTH - 1)}…`
+        : rawSummary;
+    const stepsSection = markdownSection(body, [
+        "Actual Steps",
+        "Actual Execution Steps",
+        "Execution Steps",
+        "实际执行步骤",
+        "实际步骤",
+        "执行步骤",
+    ]);
+    const steps = markdownList(stepsSection).slice(0, EXECUTION_STEPS_MAX_ITEMS);
+    return { summary, steps };
+}
 function assertInside(root, candidate, label) {
     const relative = path.relative(root, candidate);
     if (relative.startsWith("..") || path.isAbsolute(relative)) {
@@ -371,7 +410,23 @@ export async function materializeFrontendTestResult(input) {
                 });
             }
         }
-        const caseContent = await readFrontendCaseContent(input.workspaceRoot, item.casePath);
+        const { caseContent, testPoints } = await readFrontendCaseContent(input.workspaceRoot, item.casePath);
+        // Parse bounded fixed sections from execution.md. Missing optional
+        // summary/steps are advisory only and never downgrade a passed status.
+        let executionSummary = "";
+        let executionSteps = [];
+        try {
+            const executionBody = await readFile(path.join(evidenceRoot, "execution.md"), "utf8");
+            const parsed = parseExecutionMarkdown(executionBody);
+            executionSummary = parsed.summary;
+            executionSteps = parsed.steps;
+            if (!executionSummary && executionSteps.length === 0) {
+                advisoryFindings.push({ ruleId: "execution-summary-unavailable", caseId: item.caseId, detail: "execution.md has no bounded execution summary/steps; reporting remains status-driven" });
+            }
+        }
+        catch {
+            advisoryFindings.push({ ruleId: "execution-summary-unavailable", caseId: item.caseId, detail: "execution.md summary could not be parsed; reporting remains status-driven" });
+        }
         const explicitAnalysis = typeof resultRaw.errorAnalysis === "string" && resultRaw.errorAnalysis.trim()
             ? resultRaw.errorAnalysis.trim()
             : typeof resultRaw.errorSummary === "string" && resultRaw.errorSummary.trim()
@@ -380,7 +435,23 @@ export async function materializeFrontendTestResult(input) {
         const errorAnalysis = status === "passed"
             ? undefined
             : explicitAnalysis ?? (status === "blocked" ? `用例因 ${blockedReason ?? "未知原因"} 未能完成执行。` : "用例执行失败，但执行结果未提供详细错误分析。");
-        cases.push({ caseId: item.caseId, acIds: item.acIds, status, evidence, caseContent, ...(blockedReason ? { blockedReason } : {}), ...(errorAnalysis ? { errorAnalysis } : {}) });
+        const rerunAttemptRaw = resultRaw.rerunAttempt;
+        const rerunAttempt = typeof rerunAttemptRaw === "number" && Number.isFinite(rerunAttemptRaw) && rerunAttemptRaw >= 0
+            ? Math.trunc(rerunAttemptRaw)
+            : undefined;
+        cases.push({
+            caseId: item.caseId,
+            acIds: item.acIds,
+            status,
+            evidence,
+            caseContent,
+            ...(blockedReason ? { blockedReason } : {}),
+            ...(errorAnalysis ? { errorAnalysis } : {}),
+            ...(rerunAttempt !== undefined ? { rerunAttempt } : {}),
+            ...(testPoints.length > 0 ? { testPoints } : {}),
+            ...(executionSummary ? { executionSummary } : {}),
+            ...(executionSteps.length > 0 ? { executionSteps } : {}),
+        });
     }
     const missing = [...requiredIds].filter((id) => !covered.has(id));
     const totals = {

package/dist/workflows/dag/init-hybrid.js

@@ -3939,34 +3939,129 @@ async function buildBackendTestHybridDag(sources) {
     assertValidDagSpec(spec);
     return spec;
 }
+// Explicit allowlist of controller-owned reference filenames that may declare
+// a non-production browser URL. Hash-bound task sources are the only authority;
+// model-authored RAG/case/evidence files are never consulted.
+const FRONTEND_BASE_URL_DOCUMENT_ALLOWLIST = [
+    /(?:^|[\\/])config\.md$/i,
+    /(?:^|[\\/])environment\.md$/i,
+    /(?:^|[\\/])env\.md$/i,
+    /(?:^|[\\/])urls?\.md$/i,
+    /(?:^|[\\/])references\.md$/i,
+    /(?:^|[\\/])task-reference\.md$/i,
+    /(?:^|[\\/])task-source\.md$/i,
+];
+// Explicit allowlist of URL keys. The semantic name drives a deterministic
+// priority so two conflicting same-priority URLs fail closed instead of being
+// silently picked.
+const FRONTEND_BASE_URL_KEY_ALLOWLIST = [
+    // The primary frontend browser entry point is the strongest signal.
+    { name: "baseurl", priority: 0 },
+    { name: "base url", priority: 0 },
+    { name: "targeturl", priority: 0 },
+    { name: "target url", priority: 0 },
+    { name: "frontendbaseurl", priority: 1 },
+    { name: "frontend base url", priority: 1 },
+    { name: "frontendurl", priority: 1 },
+    { name: "frontend url", priority: 1 },
+    { name: "loginurl", priority: 2 },
+    { name: "login url", priority: 2 },
+];
+const DEFAULT_FRONTEND_BASE_URL = "http://localhost:5173/";
+const DEFAULT_FRONTEND_BASE_URL_SOURCE = "default-localhost-5173";
+function isAllowedFrontendBaseUrlDocument(documentPath) {
+    return FRONTEND_BASE_URL_DOCUMENT_ALLOWLIST.some((pattern) => pattern.test(documentPath));
+}
+function normalizeFrontendBaseUrlKey(raw) {
+    // Normalize separators: kebab/snake/space variants collapse to a comparable
+    // token. Lowercase so casing differences do not bypass the allowlist.
+    return raw
+        .toLowerCase()
+        .replace(/[_\-]+/g, " ")
+        .replace(/\s+/g, " ")
+        .trim();
+}
 /**
  * Resolve the browser origin only from controller-owned task source bytes.
  * Model-authored RAG/case/evidence files are intentionally excluded.
+ *
+ * Safety contract:
+ * - Only hash-bound controller reference documents on the filename allowlist
+ *   may declare a URL.
+ * - Only the explicit key allowlist (baseUrl / targetUrl / loginUrl + common
+ *   case/separator variants) is recognized.
+ * - Candidates are ranked deterministically by key priority then by document
+ *   order; equal-priority conflicting URLs fail closed.
+ * - The resolved URL must be non-production http(s) without credentials, query,
+ *   or fragment. Only when zero candidates exist does the localhost default
+ *   apply.
  */
 export function resolveControllerFrontendBaseUrl(sources) {
-    const candidates = (sources.referenceDocuments ?? [])
-        .filter((document) => /(?:^|[\\/])config\.md$/i.test(document.path))
-        .map((document) => ({
-        markdown: document.markdown,
-        source: toDagSourcePath(sources, document.path),
-    }));
-    let rawBaseUrl = "http://localhost:5173";
-    let baseUrlSource = "default-localhost-5173";
-    for (const candidate of candidates) {
-        const match = candidate.markdown.match(/(?:frontend[_-]?base[_-]?url|base[_-]?url|base[- ]url)\s*[:=]\s*["'`]?((?:https?):\/\/[^\s"'`<>]+)/i);
-        if (!match?.[1]) {
-            if (/(?:frontend[_-]?base[_-]?url|base[_-]?url|base[- ]url)\s*[:=]/i.test(candidate.markdown)) {
-                throw new Error(`frontend-test controller baseUrl is invalid (${candidate.source})`);
+    const allowedKeyByNormalized = new Map(FRONTEND_BASE_URL_KEY_ALLOWLIST.map((variant) => [
+        variant.name,
+        variant.priority,
+    ]));
+    const candidates = [];
+    const documents = sources.referenceDocuments ?? [];
+    documents.forEach((document, documentIndex) => {
+        if (!isAllowedFrontendBaseUrlDocument(document.path))
+            return;
+        const source = toDagSourcePath(sources, document.path);
+        // Only accept `key: value` / `key = value` lines. A colon or equals
+        // sign after a known key bounds the URL; free-form prose is ignored.
+        const keyPattern = /^[ 	]*(?:#>*)?[ 	]*([A-Za-z][A-Za-z0-9 _\-]*?)[ 	]*[:=][ 	]*["'`]?((?:https?:)?\/\/[\S]+?)(?:["'`])?[ 	]*(?:#.*)?$/gm;
+        let match;
+        while ((match = keyPattern.exec(document.markdown)) !== null) {
+            const rawKey = match[1].trim();
+            const normalizedKey = normalizeFrontendBaseUrlKey(rawKey);
+            const priority = allowedKeyByNormalized.get(normalizedKey);
+            if (priority === undefined)
+                continue;
+            let rawUrl = match[2].replace(/[)\]},.;]+$/, "");
+            if (!/^[A-Za-z][A-Za-z0-9+.-]*:\/\//.test(rawUrl)) {
+                rawUrl = `https://${rawUrl.replace(/^\/\/+/, "")}`;
             }
-            continue;
+            candidates.push({
+                url: rawUrl,
+                source,
+                keyName: normalizedKey,
+                priority,
+                documentIndex,
+            });
         }
-        rawBaseUrl = match[1].replace(/[)\]},.;]+$/, "");
-        baseUrlSource = candidate.source;
-        break;
+    });
+    if (candidates.length === 0) {
+        return {
+            baseUrl: DEFAULT_FRONTEND_BASE_URL,
+            baseUrlSource: DEFAULT_FRONTEND_BASE_URL_SOURCE,
+        };
     }
+    // Deterministic ranking: lowest priority number first, then earliest
+    // document, then earliest occurrence in that document.
+    candidates.sort((left, right) => {
+        if (left.priority !== right.priority) {
+            return left.priority - right.priority;
+        }
+        if (left.documentIndex !== right.documentIndex) {
+            return left.documentIndex - right.documentIndex;
+        }
+        return 0;
+    });
+    const bestPriority = candidates[0].priority;
+    const bestPriorityCandidates = candidates.filter((candidate) => candidate.priority === bestPriority);
+    // Fail closed: two distinct URLs at the same priority level are ambiguous.
+    const distinctUrls = new Set(bestPriorityCandidates.map((candidate) => candidate.url));
+    if (distinctUrls.size > 1) {
+        const conflictingSources = bestPriorityCandidates
+            .map((candidate) => `${candidate.source}:${candidate.keyName}`)
+            .join(", ");
+        throw new Error(`frontend-test controller baseUrl is ambiguous (${conflictingSources})`);
+    }
+    const selected = bestPriorityCandidates[0];
+    const baseUrlSource = selected.source;
     let parsed;
     try {
-        parsed = new URL(rawBaseUrl);
+        parsed = new URL(selected.url);
     }
     catch {
         throw new Error(`frontend-test controller baseUrl is invalid (${baseUrlSource})`);
@@ -4399,10 +4494,28 @@ function buildFrontendTestHybridDag(sources) {
             },
         },
     });
-    if (maxRerunAttempts > 0) {
+    let rerunDependency = "execute-frontend-cases-map";
+    for (let round = 1; round <= maxRerunAttempts; round += 1) {
+        const selectorId = round === 1
+            ? "select-frontend-rerun-candidates-shell"
+            : `select-frontend-rerun-candidates-round${round}-shell`;
+        const mapId = round === 1
+            ? "rerun-frontend-cases-map"
+            : `rerun-frontend-cases-round${round}-map`;
+        const candidateArtifact = round === 1
+            ? "rerun-candidates.json"
+            : `rerun-candidates-round${round}.json`;
+        const selectCommand = [
+            "const fs=require('fs'),path=require('path');",
+            "const manifestPath='testcase/frontend/cases/manifest.json';",
+            "if(!fs.existsSync(manifestPath)){process.stdout.write(JSON.stringify({cases:[]}));process.exit(0);}",
+            "const manifest=JSON.parse(fs.readFileSync(manifestPath,'utf8'));const cases=[];",
+            "for(const c of (manifest.cases||[])){const evidenceDir=(c.evidenceDir||('testcase/frontend/evidence/'+c.caseId+'/')).replace(/\/+$/,'')+'/';const resultPath=path.join(evidenceDir,'case-result.json');const execPath=path.join(evidenceDir,'execution.md');let reason=null;let attempt=0;let missing=false;if(!fs.existsSync(resultPath)){missing=true;reason='missing-result-files';}else{try{const r=JSON.parse(fs.readFileSync(resultPath,'utf8'));attempt=Number(r.rerunAttempt||0)||0;if(r.status==='blocked')reason='blocked';if(!r.status){missing=true;reason='missing-result-files';}}catch(_){missing=true;reason='missing-result-files';}}if(!fs.existsSync(execPath)&&reason!=='blocked'){missing=true;reason=reason||'missing-result-files';}const should=(reason==='blocked'||missing)&&attempt<" + String(round) + ";if(should){cases.push({caseId:c.caseId,casePath:c.casePath||('testcase/frontend/cases/'+c.caseId+'.md'),evidenceDir,dimension:c.dimension||'core',acIds:c.acIds||[],rerunAttempt:attempt+1,reason:reason||'blocked'});}}",
+            `fs.mkdirSync('testcase/frontend/evidence',{recursive:true});fs.writeFileSync('testcase/frontend/evidence/${candidateArtifact}',JSON.stringify({schemaVersion:1,cases},null,2)+'\n');process.stdout.write(JSON.stringify({cases}));`,
+        ].join("");
         tasks.push({
-            id: "select-frontend-rerun-candidates-shell",
-            depends_on: ["execute-frontend-cases-map"],
+            id: selectorId,
+            depends_on: [rerunDependency],
             role: "verifier",
             executor: "shell",
             complexity: "LOW",
@@ -4410,42 +4523,33 @@ function buildFrontendTestHybridDag(sources) {
             writeSet: ["testcase/frontend/evidence/**"],
             allowedPaths: [...casesWriteSet, "testcase/frontend/evidence/**"],
             forbiddenPaths: forbidden,
-            outputContract: "Stdout JSON {cases} for blocked or missing-result-file cases with rerunAttempt < maxRerunAttempts.",
-            subtask_prompt: "Select frontend-test cases eligible for bounded rerun.",
+            outputContract: `Stdout JSON {cases} for blocked or missing-result-file cases eligible for rerun round ${round}/${maxRerunAttempts}.`,
+            subtask_prompt: "Select frontend-test cases eligible for this bounded rerun round.",
             shell: {
-                commands: [
-                    [
-                        "node -e",
-                        JSON.stringify("const fs=require('fs'),path=require('path');const manifestPath='testcase/frontend/cases/manifest.json';if(!fs.existsSync(manifestPath)){process.stdout.write(JSON.stringify({cases:[]}));process.exit(0);}const manifest=JSON.parse(fs.readFileSync(manifestPath,'utf8'));const cases=[];for(const c of (manifest.cases||[])){const evidenceDir=(c.evidenceDir||('testcase/frontend/evidence/'+c.caseId+'/')).replace(/\\/+$/,'')+'/';const resultPath=path.join(evidenceDir,'case-result.json');const execPath=path.join(evidenceDir,'execution.md');let reason=null;let attempt=0;let missing=false;if(!fs.existsSync(resultPath)){missing=true;reason='missing-result-files';}else{try{const r=JSON.parse(fs.readFileSync(resultPath,'utf8'));attempt=Number(r.rerunAttempt||0)||0;if(r.status==='blocked')reason='blocked';if(!r.status){missing=true;reason='missing-result-files';}}catch(e){missing=true;reason='missing-result-files';}}if(!fs.existsSync(execPath)&&reason!=='blocked'){missing=true;reason=reason||'missing-result-files';}const should=(reason==='blocked'||missing)&&attempt<" +
-                            maxRerunAttempts +
-                            ";if(should){cases.push({caseId:c.caseId,casePath:c.casePath||('testcase/frontend/cases/'+c.caseId+'.md'),evidenceDir,dimension:c.dimension||'core',acIds:c.acIds||[],rerunAttempt:attempt+1,reason:reason||'blocked'});}}fs.mkdirSync('testcase/frontend/evidence',{recursive:true});fs.writeFileSync('testcase/frontend/evidence/rerun-candidates.json',JSON.stringify({schemaVersion:1,cases},null,2)+'\\n');process.stdout.write(JSON.stringify({cases}));"),
-                    ].join(" "),
-                ],
+                commands: [["node -e", JSON.stringify(selectCommand)].join(" ")],
                 cwd: ".",
                 timeoutMs: 120_000,
             },
         }, {
-            id: "rerun-frontend-cases-map",
-            depends_on: ["select-frontend-rerun-candidates-shell"],
+            id: mapId,
+            depends_on: [selectorId],
             role: "verifier",
             executor: "static",
             complexity: "LOW",
             writePolicy: "none",
             allowedPaths: [],
             forbiddenPaths: forbidden,
-            outputContract: "Serial rerun of blocked/missing-result frontend cases.",
+            outputContract: `Serial rerun round ${round}/${maxRerunAttempts} of blocked or missing-result frontend cases.`,
             subtask_prompt: "Expand rerun candidates into serial browser case children.",
-            static: {
-                resultMarkdown: "Frontend case rerun map expansion barrier.",
-            },
+            static: { resultMarkdown: `Frontend case rerun round ${round} map expansion barrier.` },
             dynamicExpansion: {
                 type: "map_agent",
-                workflowNodeId: "rerun-frontend-cases-map",
-                itemsFrom: "$.nodes['select-frontend-rerun-candidates-shell'].output.cases",
+                workflowNodeId: mapId,
+                itemsFrom: `$.nodes['${selectorId}'].output.cases`,
                 itemName: "case",
                 maxItems: config.maxCasesPerBatch,
                 maxExpandedNodes: config.maxCasesPerBatch,
-                childIdPrefix: "rerun-frontend-case",
+                childIdPrefix: `rerun-frontend-case-r${round}`,
                 workspaceTemplate: "{{case.evidenceDir}}",
                 tolerateChildFailures: true,
                 tokenBudget: {
@@ -4457,10 +4561,7 @@ function buildFrontendTestHybridDag(sources) {
                     role: "implementer",
                     skills: ["playwright-cli"],
                     toolProfile: "write",
-                    commandPolicy: {
-                        mode: "capability-allowlist",
-                        capabilities: ["playwright-cli"],
-                    },
+                    commandPolicy: { mode: "capability-allowlist", capabilities: ["playwright-cli"] },
                     complexity: "MED",
                     writePolicy: "exclusive",
                     writeGuardPolicy: "tools-only",
@@ -4472,23 +4573,22 @@ function buildFrontendTestHybridDag(sources) {
                     ],
                     forbiddenPaths: forbidden,
                     writeSet: [`${evidenceRoot}/{{case.caseId}}/**`],
-                    outputContract: "Compact JSON <=1200 characters with case status, evidence paths, error summary, tokens, and rerunAttempt.",
+                    outputContract: "Compact JSON <=1200 characters with final case status, evidence paths, error summary, tokens, and rerunAttempt.",
                     subtaskPromptTemplate: [
-                        "RERUN attempt {{case.rerunAttempt}} for {{case.caseId}} (reason={{case.reason}}). Rewrite authoritative evidence; set rerunAttempt={{case.rerunAttempt}}.",
+                        "RERUN attempt {{case.rerunAttempt}} for {{case.caseId}} (reason={{case.reason}}). Rewrite the authoritative execution.md and case-result.json; its final status replaces the earlier case result.",
                         "Primary job: EXECUTE case {{case.caseId}} from {{case.casePath}} with skill playwright-cli (fresh Pi session). Use structured playwright_cli only; headless open.",
                         `Start via playwright_cli command=open with args [--browser=chrome, ${controllerFrontend.baseUrl}]. Passed requires open → find → cleanup receipts.`,
-                        "Always write {{case.evidenceDir}}execution.md and {{case.evidenceDir}}case-result.json with caseId, status, evidencePaths, rerunAttempt={{case.rerunAttempt}}.",
+                        "Always write {{case.evidenceDir}}execution.md and {{case.evidenceDir}}case-result.json with caseId, status, evidencePaths, rerunAttempt={{case.rerunAttempt}}. Write fixed sections `### 执行摘要` and `### 实际执行步骤` to execution.md when available.",
                     ].join("\n\n"),
                 },
             },
         });
+        rerunDependency = mapId;
     }
     tasks.push({
         id: "finalize-frontend-test-result-shell",
         depends_on: [
-            maxRerunAttempts > 0
-                ? "rerun-frontend-cases-map"
-                : "execute-frontend-cases-map",
+            rerunDependency,
         ],
         role: "verifier",
         executor: "shell",

package/dist/workflows/dag/retry-policy.js

@@ -19,6 +19,8 @@ export const DEFAULT_DAG_RETRY_CATEGORIES = [
 ];
 export const STRUCTURED_OUTPUT_RETRY_CATEGORY = "output-too-large";
 export const PROTOCOL_INVALID_RETRY_CATEGORY = "protocol-invalid";
+/** Recoverable model artifact/schema formatting failure on read-only structured nodes. */
+export const STRUCTURED_ARTIFACT_INVALID_RETRY_CATEGORY = "invalid-output";
 /** Retry only a proven no-op from an explicitly opt-in bounded Pi writer. */
 export const WRITER_EMPTY_DIFF_RETRY_CATEGORY = "writer-empty-diff";
 /** Retry when a backend-test writer finished but Completeness Gate found missing/broken targets. */
@@ -26,16 +28,19 @@ export const INCOMPLETE_WRITE_SET_RETRY_CATEGORY = "incomplete-write-set";
 export const STRUCTURED_REQUIRED_DAG_RETRY_CATEGORIES = [
     ...DEFAULT_DAG_RETRY_CATEGORIES,
     STRUCTURED_OUTPUT_RETRY_CATEGORY,
+    STRUCTURED_ARTIFACT_INVALID_RETRY_CATEGORY,
 ];
 /** Categories allowed on nodes that declare a machine-readable outputProtocol. */
 export const PROTOCOL_AWARE_DAG_RETRY_CATEGORIES = [
     ...DEFAULT_DAG_RETRY_CATEGORIES,
     PROTOCOL_INVALID_RETRY_CATEGORY,
+    STRUCTURED_ARTIFACT_INVALID_RETRY_CATEGORY,
 ];
 export const ALL_DAG_RETRY_CATEGORIES = [
     ...DEFAULT_DAG_RETRY_CATEGORIES,
     STRUCTURED_OUTPUT_RETRY_CATEGORY,
     PROTOCOL_INVALID_RETRY_CATEGORY,
+    STRUCTURED_ARTIFACT_INVALID_RETRY_CATEGORY,
     WRITER_EMPTY_DIFF_RETRY_CATEGORY,
     INCOMPLETE_WRITE_SET_RETRY_CATEGORY,
 ];

package/docs/templates/frontend-test-dag.generate-cases.prompt.md

@@ -52,7 +52,7 @@ Each case must require the executor to persist, even when blocked:
 - `testcase/frontend/evidence/<case-id>/execution.md`
 - `testcase/frontend/evidence/<case-id>/case-result.json`
 
-`case-result.json` must be valid JSON containing the matching `caseId`, `status` (`passed`, `failed`, or `blocked`), and an `evidencePaths` array. A blocked result must include a non-empty `blockedReason`, such as `isolated-test-environment-unavailable` or `token-budget-exhausted`, and must never claim or imply a pass. `execution.md` records attempted or blocked steps, base-URL safety decision, fixture/reset and request-observation availability, timestamps, and the evidence-file list. Available evidence files are required only when actually produced and must stay under the same case evidence directory.
+`case-result.json` must be valid JSON containing the matching `caseId`, final `status` (`passed`, `failed`, or `blocked`), and an `evidencePaths` array. A rerun must overwrite this same file with its final status and integer `rerunAttempt`; the final report consumes that latest file. A blocked result must include a non-empty `blockedReason`, such as `isolated-test-environment-unavailable` or `token-budget-exhausted`, and must never claim or imply a pass. `execution.md` records attempted or blocked steps, base-URL safety decision, fixture/reset and request-observation availability, timestamps, and the evidence-file list. When available, use fixed headings `### 执行摘要` and `### 实际执行步骤` so the bounded deterministic report extractor can show actual execution facts. Available evidence files are required only when actually produced and must stay under the same case evidence directory.
 
 
 ## Standard scenarios (controller)