@tea-agent/loop-agent 0.38.1 → 0.38.3

package/dist/workflows/dag/rerun-plan.js

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import { assertTaskContractBindingFresh } from "./task-contract-binding.js";
-import { isSafeReadOnlyPiRetryCandidate } from "./retry-policy.js";
+import { isSafeReadOnlyPiRetryCandidate, isTransportCrashedExclusiveWriter } from "./retry-policy.js";
 import { resolveDagTaskSourcePath } from "../../task/dag-source-paths.js";
 const REVIEW_VERDICT_RECOVERY_NODE_ID = "review-verdict-recovery-pi";
 const SAFE_SHELL_GATE_KEYS = [
@@ -122,32 +122,56 @@ function hasDynamicRuntime(task) {
         task.dynamicCondition ||
         task.dynamicLoopUntil);
 }
-function shellHasDisallowedConfig(shell) {
-    if ((shell.commands?.length ?? 0) > 0)
-        return true;
+/**
+ * Narrow admission for the standard DAG's generated final verification node.
+ * `verifyEvidence` alone is metadata, not proof that an arbitrary shell is
+ * read-only, so custom shell ids and non-canonical shapes stay blocked.
+ */
+function isCanonicalGeneratedVerifyShell(task) {
+    if (task.executor !== "shell")
+        return false;
+    const shell = task.shell;
+    if (!shell)
+        return false;
+    const evidence = shell.verifyEvidence;
+    if (task.id !== "verify-shell")
+        return false;
+    if (task.role !== "verifier")
+        return false;
+    if (task.writePolicy !== "read-only")
+        return false;
+    if (!evidence)
+        return false;
+    if (evidence.phase !== "final")
+        return false;
+    if (evidence.quota !== "full")
+        return false;
+    if (evidence.commandSource !== "adapter")
+        return false;
+    if (evidence.finalFullRequired !== true)
+        return false;
+    if ((shell.commands?.length ?? 0) === 0)
+        return false;
+    if (evidence.commandCount !== shell.commands.length)
+        return false;
+    // Any side-effect-capable config disqualifies the node.
     if (shell.preset)
-        return true;
+        return false;
     if (shell.projectGovernanceGate)
-        return true;
+        return false;
     if (shell.frontendPrewriteGate)
-        return true;
+        return false;
     if (shell.frontendVerificationBundle)
-        return true;
+        return false;
     if (shell.frontendReviewContext)
-        return true;
+        return false;
     if (shell.backendTestPipeline)
-        return true;
-    if (shell.verifyEvidence)
-        return true;
-    if (shell.nonZeroExitPolicy)
-        return true;
+        return false;
+    if (shell.nonZeroExitPolicy === "record")
+        return false;
     if (shell.envAllowlist?.length)
-        return true;
-    if (shell.timeoutMs !== undefined)
-        return true;
-    if (shell.cwd)
-        return true;
-    return false;
+        return false;
+    return true;
 }
 function isSafeGateOnlyShell(task) {
     if (task.executor !== "shell")
@@ -155,9 +179,32 @@ function isSafeGateOnlyShell(task) {
     const shell = task.shell;
     if (!shell)
         return false;
-    if (shellHasDisallowedConfig(shell))
+    if (!SAFE_SHELL_GATE_KEYS.some((key) => shell[key] !== undefined)) {
+        return false;
+    }
+    // No side-effect-capable config may ride along on a gate-only shell.
+    // Deterministic/read-only riders are admitted: projectGovernanceGate (repo
+    // governance context path), cwd, and timeoutMs never execute commands, so
+    // the governance-standard gate stays rerun-eligible.
+    if ((shell.commands?.length ?? 0) > 0)
+        return false;
+    if (shell.preset)
+        return false;
+    if (shell.frontendPrewriteGate)
+        return false;
+    if (shell.frontendVerificationBundle)
+        return false;
+    if (shell.frontendReviewContext)
+        return false;
+    if (shell.backendTestPipeline)
+        return false;
+    if (shell.verifyEvidence)
+        return false;
+    if (shell.nonZeroExitPolicy)
+        return false;
+    if (shell.envAllowlist?.length)
         return false;
-    return SAFE_SHELL_GATE_KEYS.some((key) => shell[key] !== undefined);
+    return true;
 }
 function isStaticTask(task) {
     return task.executor === "static";
@@ -259,7 +306,10 @@ export function computeResetClosure(spec, effectiveFromNodeId) {
         ...collectReachableDescendants(spec, effectiveFromNodeId),
     ].sort();
 }
-export function assessResetClosureSafety(spec, resetNodeIds) {
+function isNeverStartedNodeStatus(status) {
+    return status === undefined || status === "SKIPPED" || status === "PENDING";
+}
+export function assessResetClosureSafety(spec, resetNodeIds, options = {}) {
     const tasks = taskById(spec);
     const blockingNodes = [];
     const reasonCodes = [];
@@ -267,7 +317,17 @@ export function assessResetClosureSafety(spec, resetNodeIds) {
         const task = tasks.get(nodeId);
         if (!task)
             continue;
+        if (options.parentNodes !== undefined &&
+            isNeverStartedNodeStatus(options.parentNodes[nodeId]?.status)) {
+            continue;
+        }
         if (isWriterTask(task, spec)) {
+            if (nodeId === options.allowedTransportWriterNodeId)
+                continue;
+            if (nodeId === options.allowedExclusiveShellFromNodeId &&
+                task.executor === "shell") {
+                continue;
+            }
             blockingNodes.push({
                 nodeId,
                 reasonCode: "restart-subgraph-contains-writer",
@@ -305,7 +365,8 @@ export function assessResetClosureSafety(spec, resetNodeIds) {
             continue;
         }
         if (task.executor === "shell") {
-            if (!isSafeGateOnlyShell(task)) {
+            if (!isSafeGateOnlyShell(task) &&
+                !isCanonicalGeneratedVerifyShell(task)) {
                 blockingNodes.push({
                     nodeId,
                     reasonCode: "restart-subgraph-contains-unsafe-shell",
@@ -448,6 +509,20 @@ export async function evaluateDagRerunPlan(input) {
         : [];
     const resetSet = new Set(resetNodeIds);
     const importedNodeIds = allNodeIds.filter((nodeId) => !resetSet.has(nodeId));
+    const tasksByIdForPlan = taskById(input.parentSpec);
+    const effectiveTask = effectiveFromNodeId
+        ? tasksByIdForPlan.get(effectiveFromNodeId)
+        : undefined;
+    const effectiveRecord = effectiveFromNodeId
+        ? input.parentState.nodes[effectiveFromNodeId]
+        : undefined;
+    const transportWriterRestart = Boolean(effectiveFromNodeId &&
+        effectiveRecord?.status === "ERROR" &&
+        isTransportCrashedExclusiveWriter(effectiveTask, effectiveRecord.failureCategory));
+    const convergenceWriterRestart = Boolean(transportWriterRestart &&
+        input.parentSpec.convergence?.enabled === true &&
+        input.parentState.convergence?.enabled === true &&
+        !input.parentState.convergence.terminalReason);
     const controllerIdentityMatched = input.currentControllerFingerprint === undefined ||
         input.parentControllerFingerprint === undefined ||
         input.currentControllerFingerprint === input.parentControllerFingerprint;
@@ -482,11 +557,11 @@ export async function evaluateDagRerunPlan(input) {
         reasonCodes.push("parent-lifecycle-ineligible");
         blockedReasons.push("parent-lifecycle-ineligible");
     }
-    if (input.parentSpec.convergence?.enabled) {
+    if (input.parentSpec.convergence?.enabled && !convergenceWriterRestart) {
         reasonCodes.push("convergence-rerun-unsupported");
         blockedReasons.push("convergence-rerun-unsupported");
     }
-    if (input.parentState.convergence?.enabled) {
+    if (input.parentState.convergence?.enabled && !convergenceWriterRestart) {
         reasonCodes.push("convergence-rerun-unsupported");
         blockedReasons.push("convergence-rerun-unsupported");
     }
@@ -530,7 +605,17 @@ export async function evaluateDagRerunPlan(input) {
             blockedReasons.push("ambiguous-skipped-rewrite");
         }
     }
-    const closureSafety = assessResetClosureSafety(input.parentSpec, resetNodeIds);
+    const closureSafety = assessResetClosureSafety(input.parentSpec, resetNodeIds, {
+        ...(transportWriterRestart && effectiveFromNodeId
+            ? { allowedTransportWriterNodeId: effectiveFromNodeId }
+            : {}),
+        parentNodes: input.parentState.nodes,
+        ...(effectiveFromNodeId &&
+            effectiveTask?.executor === "shell" &&
+            effectiveRecord?.status === "ERROR"
+            ? { allowedExclusiveShellFromNodeId: effectiveFromNodeId }
+            : {}),
+    });
     blockingNodes.push(...closureSafety.blockingNodes);
     for (const code of closureSafety.reasonCodes) {
         reasonCodes.push(code);

package/dist/workflows/dag/rerun-run.js

@@ -445,6 +445,9 @@ async function stageContinuationRun(input) {
         ranks,
         nodes,
         continuation,
+        ...(input.parentState.convergence
+            ? { convergence: structuredClone(input.parentState.convergence) }
+            : {}),
         ...(input.parentState.evaluation
             ? { evaluation: structuredClone(input.parentState.evaluation) }
             : {}),

package/dist/workflows/dag/rerun-task.js

@@ -3,7 +3,8 @@ import path from "node:path";
 import { generateTaskDagUseCase } from "../../application/dag/generate-task-dag.js";
 import { writeJsonAtomic } from "../../infrastructure/harness/atomic-write.js";
 import { DAG_RUNS_DIR, isTerminalDagRunStatus, locateDagRun, readDagRunSpec, readDagRunState, } from "./lifecycle.js";
-import { parseDagSpec } from "./types.js";
+import { deriveDagRerunFeedback } from "./rerun-feedback.js";
+import { parseDagSpec, } from "./types.js";
 export const RERUN_TASK_LINEAGE_REL_PATH = ".runtime/rerun-task-lineage.json";
 export function parseDagRerunTaskArgs(args) {
     if (args.length === 0) {
@@ -218,6 +219,7 @@ async function writeRerunTaskLineage(cwd, newRunId, input) {
         parentRunId: input.parentRunId,
         reason: input.reason,
         requestId: input.requestId,
+        feedback: input.feedback,
         createdAt: new Date().toISOString(),
     }, { repoRoot: cwd, allowCompletedFactsWrite: true });
 }
@@ -228,12 +230,30 @@ function blockedResult(input) {
         reason: input.reason,
         requestId: input.requestId,
         mode: "blocked",
+        feedback: input.feedback ?? {
+            inherited: false,
+            reason: "no-unresolved-verify-review-feedback",
+        },
         blockedReason: input.blockedReason,
         ...(input.note ? { note: input.note } : {}),
         ...(input.taskId ? { taskId: input.taskId } : {}),
         ...(input.conflictPaths ? { conflictPaths: input.conflictPaths } : {}),
     };
 }
+async function readGeneratedRerunFeedback(outputPath) {
+    const raw = JSON.parse(await readFile(outputPath, "utf8"));
+    return parseDagSpec(raw).rerunFeedback;
+}
+function summarizeFeedback(feedback, fallbackReason) {
+    return feedback
+        ? {
+            inherited: true,
+            sourceNodeId: feedback.sourceNodeId,
+            digest: feedback.digest,
+            bindingStatus: feedback.binding.status,
+        }
+        : { inherited: false, reason: fallbackReason };
+}
 function extractRunSummary(generateResult) {
     if (generateResult.mode === "generate+basic-validate")
         return undefined;
@@ -277,7 +297,26 @@ export async function rerunStandaloneTask(input) {
             note: eligibility.note,
         });
     }
+    let parentFeedback;
+    let missingFeedbackReason = "no-unresolved-verify-review-feedback";
+    try {
+        parentFeedback = await deriveDagRerunFeedback({
+            parentRunId: input.parentRunId,
+            taskId: taskResolution.taskId,
+            runDir: located.runDir,
+            spec,
+            state,
+        });
+    }
+    catch {
+        // Feedback is additive recovery context. A corrupt/missing historical
+        // artifact must be reported honestly but must not block an otherwise
+        // eligible full rerun.
+        missingFeedbackReason = "feedback-unavailable";
+    }
     const execute = input.execute ?? true;
+    let effectiveFeedback;
+    let expectedRerunFeedbackDigest;
     // AC-001 generated-output-conflict preflight: when a real execution is
     // requested, first generate the DAG draft (execute:false) so we can inspect
     // the regenerated spec's requireChangedFiles writer write sets against
@@ -296,15 +335,23 @@ export async function rerunStandaloneTask(input) {
             dryRun: false,
             profile: input.profile ?? "auto",
             profileExplicit: input.profileExplicit ?? false,
+            rerunFeedback: parentFeedback,
         });
         if (preflight.mode === "generate+basic-validate") {
             let conflictPaths = [];
             try {
                 const raw = await readFile(preflight.outputPath, "utf8");
                 const preflightSpec = parseDagSpec(JSON.parse(raw));
+                effectiveFeedback = preflightSpec.rerunFeedback;
+                expectedRerunFeedbackDigest = effectiveFeedback?.digest;
+                if (parentFeedback && !effectiveFeedback) {
+                    throw new Error("rerun feedback missing from generated preflight DAG");
+                }
                 conflictPaths = await assessGeneratedOutputConflict(preflightSpec, input.cwd);
             }
-            catch {
+            catch (error) {
+                if (parentFeedback)
+                    throw error;
                 // If the draft cannot be parsed, fall through to the real execution
                 // path: execution's own validation will surface the structural defect.
                 conflictPaths = [];
@@ -332,7 +379,17 @@ export async function rerunStandaloneTask(input) {
         dryRun: false,
         profile: input.profile ?? "auto",
         profileExplicit: input.profileExplicit ?? false,
+        rerunFeedback: parentFeedback,
+        expectedRerunFeedbackDigest,
     });
+    if (parentFeedback && !effectiveFeedback) {
+        effectiveFeedback = await readGeneratedRerunFeedback(generateResult.outputPath);
+    }
+    if (expectedRerunFeedbackDigest &&
+        effectiveFeedback?.digest !== expectedRerunFeedbackDigest) {
+        throw new Error(`rerun feedback drift after generation: expected ${expectedRerunFeedbackDigest}, got ${effectiveFeedback?.digest ?? "missing"}`);
+    }
+    const feedbackSummary = summarizeFeedback(effectiveFeedback, missingFeedbackReason);
     const newRunId = extractNewRunId(generateResult);
     const runSummary = extractRunSummary(generateResult);
     const completedSuccessfully = !execute ||
@@ -342,6 +399,7 @@ export async function rerunStandaloneTask(input) {
             parentRunId: input.parentRunId,
             reason: input.reason,
             requestId: input.requestId,
+            feedback: feedbackSummary,
         });
     }
     const result = {
@@ -350,6 +408,7 @@ export async function rerunStandaloneTask(input) {
         reason: input.reason,
         requestId: input.requestId,
         mode: "generate+validate+execute",
+        feedback: feedbackSummary,
         taskId: taskResolution.taskId,
         ...(newRunId ? { newRunId } : {}),
         ...(runSummary && !completedSuccessfully && "status" in runSummary

package/dist/workflows/dag/retry-policy.js

@@ -201,6 +201,24 @@ function isExclusivePiImplementer(task) {
         !task.dynamicCondition &&
         !task.dynamicLoopUntil);
 }
+/**
+ * Provider/transport failure categories that can crash a writer executor
+ * after some workspace writes already landed on disk. A continuation may
+ * restart that writer itself; it must never import or normalize the ERROR fact.
+ */
+export const WRITER_TRANSPORT_FAILURE_CATEGORIES = new Set([
+    "unavailable",
+    "network",
+    "rate-limit",
+    "timeout",
+]);
+export function isTransportCrashedExclusiveWriter(task, failureCategory) {
+    if (!task)
+        return false;
+    return (isExclusivePiImplementer(task) &&
+        failureCategory !== undefined &&
+        WRITER_TRANSPORT_FAILURE_CATEGORIES.has(failureCategory));
+}
 /**
  * Static eligibility for the requireChangedFiles writer-empty-diff class.
  * The Pi executor assigns writer-empty-diff only after post-write-guard