@tea-agent/loop-agent 0.39.0-beta.0 → 0.39.0-beta.10

package/dist/workflows/dag/frontend-verification-trace.js

@@ -2,6 +2,18 @@ import { readFile, stat, writeFile, mkdir } from "node:fs/promises";
 import path from "node:path";
 import { FRONTEND_IMPLEMENTATION_CONTRACT_SCHEMA_ID, frontendImplementationContractSchema, } from "./frontend-implementation-contract.js";
 export const FRONTEND_VERIFICATION_TRACE_SCHEMA_ID = "frontend-verification-trace-v1";
+/**
+ * Shared marker for a project that exposes no usable verification command at
+ * generation time. The marker command runs (and logs not-run honestly), but it
+ * must never count as successful verification evidence: labels carrying this
+ * text are excluded from successful evidence and targets bound to it fail the
+ * trace gate instead of passing it.
+ */
+export const FRONTEND_NO_VERIFICATION_MARKER_TEXT = "No frontend verification command configured";
+export function isFrontendNoVerificationMarkerLabel(label) {
+    return label.includes(FRONTEND_NO_VERIFICATION_MARKER_TEXT);
+}
+export const FRONTEND_VERIFICATION_UNAVAILABLE_MESSAGE = `frontend verification unavailable: the only frozen static command is the no-op not-run marker (${FRONTEND_NO_VERIFICATION_MARKER_TEXT}); declare verification commands via task.json --verify or 执行约束.md and regenerate the DAG`;
 async function readJsonFile(filePath) {
     return JSON.parse(await readFile(filePath, "utf8"));
 }
@@ -37,7 +49,7 @@ function symbolEvidenceCandidates(symbol) {
         return [symbol, describeTitle, "describe("];
     return [symbol];
 }
-function isConfigurationVerificationFile(file) {
+export function isConfigurationVerificationFile(file) {
     return /(?:^|\/)(?:package\.json|tsconfig(?:\.[^/]+)?\.json|(?:vite|webpack|rollup|docusaurus)\.config\.[cm]?[jt]s)$/.test(file.replace(/\\/g, "/"));
 }
 /**
@@ -52,7 +64,14 @@ export async function evaluateVerificationTargets(input) {
     const hardIssues = [];
     for (const target of input.contract.verificationTargets) {
         const issues = [];
-        const owners = input.labelOwners.get(target.commandLabel);
+        if (isFrontendNoVerificationMarkerLabel(target.commandLabel)) {
+            // A target bound to the not-run marker has no verification behind it;
+            // passing it would let the run finish green without any check.
+            issues.push(`${target.id}: ${FRONTEND_VERIFICATION_UNAVAILABLE_MESSAGE}`);
+        }
+        const owners = isFrontendNoVerificationMarkerLabel(target.commandLabel)
+            ? []
+            : (input.labelOwners.get(target.commandLabel) ?? []);
         if (!owners?.length) {
             issues.push(`commandLabel not executed in current-run frozen evidence: ${target.commandLabel}`);
         }
@@ -82,6 +101,26 @@ export async function evaluateVerificationTargets(input) {
     }
     return { targets, hardIssues };
 }
+/**
+ * Shared deterministic symbol resolvability check used by BOTH the verify
+ * trace gate and the plan-time canonical drop (`dropUnresolvedVerificationSymbols`):
+ * whether `symbol` can be matched inside `content`. Handles `all describe
+ * blocks`, `describe('title')` extraction, and slash-delimited multi-symbol
+ * labels the same way everywhere, so plan-time normalization and the final
+ * trace gate can never disagree.
+ */
+export function verificationSymbolMatchesContent(symbol, content) {
+    if (symbol.trim().toLowerCase() === "all describe blocks")
+        return content.includes("describe(");
+    const symbols = symbol.includes(" / ")
+        ? symbol
+            .split(/[（(]/, 1)[0]
+            .split("/")
+            .map((item) => item.trim())
+            .filter(Boolean)
+        : [symbol];
+    return symbols.every((item) => symbolEvidenceCandidates(item).some((candidate) => content.includes(candidate)));
+}
 async function assertFileAndSymbol(input) {
     const issues = [];
     const absolute = path.resolve(input.workspaceRoot, input.file);
@@ -105,18 +144,8 @@ async function assertFileAndSymbol(input) {
     }
     if (input.symbol) {
         const content = await readFile(absolute, "utf8");
-        const symbols = input.symbol.includes(" / ")
-            ? input.symbol
-                .split(/[（(]/, 1)[0]
-                .split("/")
-                .map((symbol) => symbol.trim())
-                .filter(Boolean)
-            : [input.symbol];
-        for (const symbol of symbols) {
-            const matched = symbolEvidenceCandidates(symbol).some((candidate) => content.includes(candidate));
-            if (!matched) {
-                issues.push(`symbol not found: ${symbol} in ${input.file}`);
-            }
+        if (!verificationSymbolMatchesContent(input.symbol, content)) {
+            issues.push(`symbol not found: ${input.symbol} in ${input.file}`);
         }
     }
     return issues;
@@ -189,11 +218,17 @@ export async function runFrontendVerificationTraceGate(input) {
         throw new Error("trace: selected Mock strategy requires successful Mock verification commands");
     }
     if (input.evidence) {
-        if (input.evidence.static.commandLabels.length === 0) {
-            throw new Error("trace: no successful static verification commands in current run");
+        // The no-op not-run marker never counts as successful verification
+        // evidence, even if it executed with exit code 0.
+        const effectiveStaticLabels = input.evidence.static.commandLabels.filter((label) => !isFrontendNoVerificationMarkerLabel(label));
+        const effectiveBehaviorLabels = input.evidence.behavior.commandLabels.filter((label) => !isFrontendNoVerificationMarkerLabel(label));
+        if (effectiveStaticLabels.length === 0) {
+            throw new Error(input.evidence.static.commandLabels.length > 0
+                ? `trace: ${FRONTEND_VERIFICATION_UNAVAILABLE_MESSAGE}`
+                : "trace: no successful static verification commands in current run");
         }
         if (requiresBehaviorVerification &&
-            input.evidence.behavior.commandLabels.length === 0) {
+            effectiveBehaviorLabels.length === 0) {
             throw new Error("trace: no successful behavior verification commands in current run");
         }
     }

package/dist/workflows/dag/frontend-worktree-diff.js

@@ -5,25 +5,152 @@ import { runResilientGitCommand } from "../../shared/resilient-git.js";
 import { writeDagRunJsonArtifact } from "../../infrastructure/harness/artifact-store.js";
 import { pathMatchesPattern } from "../../shared/git-progress.js";
 export const FRONTEND_WORKTREE_DIFF_SCHEMA_ID = "frontend-worktree-diff-v1";
+export const FRONTEND_REVIEW_DIFF_INDEX_SCHEMA_ID = "frontend-review-diff-index-v1";
+const MAX_REVIEW_DIFF_SUMMARY_ENTRIES = 48;
+/** Maximum diff payload per review artifact; metadata adds a small fixed header. */
+const MAX_REVIEW_DIFF_FRAGMENT_BYTES = 20 * 1024;
 export const FRONTEND_WORKTREE_BASELINE_SCHEMA_ID = "frontend-worktree-baseline-v1";
 async function runGit(cwd, args) {
     const result = await runResilientGitCommand({ cwd, args, readOnly: true });
     return { code: result.code, stdout: result.stdout, stderr: result.stderr };
 }
+/**
+ * Ephemeral interpreter/tool caches that writers may create while drafting
+ * tests (kept in sync with `isEphemeralToolCachePath` in
+ * src/executors/shell-write-guard.ts). They are not product evidence: tool
+ * cache writes must neither fail the write guard nor appear in the review
+ * diff as pre-existing changes.
+ */
+export function isEphemeralToolCachePath(filePath) {
+    const normalized = filePath.replace(/\\/g, "/");
+    if (!normalized)
+        return false;
+    if (normalized === ".pytest_cache" ||
+        normalized.startsWith(".pytest_cache/")) {
+        return true;
+    }
+    if (normalized === ".mypy_cache" || normalized.startsWith(".mypy_cache/")) {
+        return true;
+    }
+    if (normalized === ".ruff_cache" || normalized.startsWith(".ruff_cache/")) {
+        return true;
+    }
+    if (normalized === ".playwright-cli" ||
+        normalized.startsWith(".playwright-cli/")) {
+        return true;
+    }
+    if (normalized === ".coverage" || normalized.startsWith(".coverage.")) {
+        return true;
+    }
+    // vite/vitest runtime caches live under node_modules/.vite (e.g.
+    // node_modules/.vite/vitest/results.json). node_modules is the gitignored
+    // dependency tree — tool cache writes there are never a product change.
+    if (normalized.startsWith("node_modules/.vite/")) {
+        return true;
+    }
+    if (/(?:^|\/)__pycache__(?:\/|$)/.test(normalized))
+        return true;
+    if (/\.(?:pyc|pyo)$/.test(normalized))
+        return true;
+    return false;
+}
 function splitLines(text) {
     return text
         .split(/\r?\n/)
         .map((line) => line.trim())
         .filter(Boolean);
 }
-function statusPaths(status) {
-    return status
-        .split(/\r?\n/)
-        .map((line) => line.trimEnd())
-        .filter((line) => line.length >= 4)
-        .map((line) => line.slice(3).split(" -> ").at(-1) ?? "")
-        .filter(Boolean)
-        .sort();
+function buildReviewDiffSummary(input) {
+    const files = [...input.hunks.reduce((grouped, hunk) => {
+            const existing = grouped.get(hunk.path);
+            if (existing) {
+                existing.bytes += hunk.bytes;
+                existing.lastPatchPath = hunk.patchPath;
+                return grouped;
+            }
+            grouped.set(hunk.path, {
+                path: hunk.path,
+                bytes: hunk.bytes,
+                parts: hunk.parts,
+                firstPatchPath: hunk.patchPath,
+                lastPatchPath: hunk.patchPath,
+            });
+            return grouped;
+        }, new Map()).values()];
+    const listedFiles = files.slice(0, MAX_REVIEW_DIFF_SUMMARY_ENTRIES);
+    const remainingFiles = files.length - listedFiles.length;
+    const listedUntracked = input.untrackedFiles.slice(0, MAX_REVIEW_DIFF_SUMMARY_ENTRIES);
+    const remainingUntracked = input.untrackedFiles.length - listedUntracked.length;
+    return [
+        "# Frontend review diff summary",
+        "",
+        "Read this bounded summary first. Do not read artifacts/diff_patch.patch in full; it is retained only as the canonical audit artifact.",
+        "For a semantic finding, read only the matching per-file diff fragment below and then the current source file when necessary. Read fragments in part order when a file has more than one.",
+        "",
+        `Canonical patch SHA-256: ${input.patchSha256}`,
+        `Canonical patch bytes: ${input.patchBytes}`,
+        `Tracked changed files: ${files.length}`,
+        `Review diff fragments: ${input.hunks.length}`,
+        `Untracked files (inventory only): ${input.untrackedFiles.length}`,
+        "",
+        "## Tracked file diff fragment references",
+        ...(listedFiles.length > 0
+            ? listedFiles.map((file) => file.parts === 1
+                ? `- ${file.path} — ${file.bytes} bytes — read ${file.firstPatchPath} only if this file needs review`
+                : `- ${file.path} — ${file.bytes} bytes across ${file.parts} ordered fragments — read ${file.firstPatchPath} through ${file.lastPatchPath} only if this file needs review`)
+            : ["- (none)"]),
+        ...(remainingFiles > 0
+            ? [`- … ${remainingFiles} additional tracked files are recorded in contracts/frontend-review-diff-index.json; do not bulk-read them.`]
+            : []),
+        "",
+        "## Untracked inventory",
+        ...(listedUntracked.length > 0
+            ? listedUntracked.map((file) => `- ${file}`)
+            : ["- (none)"]),
+        ...(remainingUntracked > 0
+            ? [`- … ${remainingUntracked} additional untracked files are recorded in contracts/frontend-review-diff-index.json.`]
+            : []),
+        "",
+    ].join("\n");
+}
+function splitReviewDiffFragments(text) {
+    const fragments = [];
+    let current = "";
+    for (const line of text.match(/[^\n]*\n|[^\n]+/g) ?? []) {
+        const lineBytes = Buffer.byteLength(line);
+        if (current.length > 0 &&
+            Buffer.byteLength(current) + lineBytes >
+                MAX_REVIEW_DIFF_FRAGMENT_BYTES) {
+            fragments.push(current);
+            current = "";
+        }
+        if (lineBytes <= MAX_REVIEW_DIFF_FRAGMENT_BYTES) {
+            current += line;
+            continue;
+        }
+        // Generated/minified files can produce a single diff line larger than the
+        // review budget. Split by Unicode code point so no fragment exceeds the
+        // byte limit while preserving the original patch bytes when concatenated.
+        let oversizedLineFragment = "";
+        let oversizedLineFragmentBytes = 0;
+        for (const codePoint of line) {
+            const codePointBytes = Buffer.byteLength(codePoint);
+            if (oversizedLineFragmentBytes > 0 &&
+                oversizedLineFragmentBytes + codePointBytes >
+                    MAX_REVIEW_DIFF_FRAGMENT_BYTES) {
+                fragments.push(oversizedLineFragment);
+                oversizedLineFragment = "";
+                oversizedLineFragmentBytes = 0;
+            }
+            oversizedLineFragment += codePoint;
+            oversizedLineFragmentBytes += codePointBytes;
+        }
+        if (oversizedLineFragment)
+            fragments.push(oversizedLineFragment);
+    }
+    if (current.length > 0)
+        fragments.push(current);
+    return fragments.length > 0 ? fragments : [""];
 }
 async function sha256File(filePath) {
     try {
@@ -37,15 +164,26 @@ async function sha256File(filePath) {
 export async function captureFrontendWorktreeBaseline(input) {
     const run = input.dependencies?.runGit ?? runGit;
     const root = path.resolve(input.workspaceRoot);
-    const status = await run(root, [
-        "status",
-        "--porcelain=v1",
-        "--untracked-files=all",
+    // Baseline = the full concrete workspace inventory the writer may touch
+    // (tracked + untracked, gitignored excluded), NOT just currently-changed
+    // files. Using `git status` here made a clean repository baseline-empty
+    // (status has no entries when nothing changed), which wrongly blocked
+    // writer admission with baseline-empty.
+    const ls = await run(root, [
+        "ls-files",
+        "-co",
+        "--exclude-standard",
+        "-z",
     ]);
-    if (status.code !== 0) {
-        throw new Error(`frontend worktree baseline failed: ${status.stderr.trim() || status.stdout.trim()}`);
+    if (ls.code !== 0) {
+        throw new Error(`frontend worktree baseline failed: ${ls.stderr.trim() || ls.stdout.trim()}`);
     }
-    const files = statusPaths(status.stdout);
+    const files = ls.stdout
+        .split("\0")
+        .map((line) => line.trim())
+        .filter(Boolean)
+        .filter((file) => !isEphemeralToolCachePath(file))
+        .sort();
     const hashes = {};
     for (const file of files)
         hashes[file] = await sha256File(path.join(root, file));
@@ -112,8 +250,12 @@ export async function runFrontendWorktreeDiffGate(input) {
     if (untracked.code !== 0) {
         throw new Error(`frontend worktree diff gate ls-files failed: ${untracked.stderr.trim() || untracked.stdout.trim()}`);
     }
-    const changedFilesAll = splitLines(nameOnly.stdout).sort();
-    const untrackedFilesAll = splitLines(untracked.stdout).sort();
+    const changedFilesAll = splitLines(nameOnly.stdout)
+        .filter((file) => !isEphemeralToolCachePath(file))
+        .sort();
+    const untrackedFilesAll = splitLines(untracked.stdout)
+        .filter((file) => !isEphemeralToolCachePath(file))
+        .sort();
     const authorizedChangedPaths = input.authorizedChangedPaths ?? [];
     if (baseline) {
         for (const file of baseline.files) {
@@ -160,11 +302,65 @@ export async function runFrontendWorktreeDiffGate(input) {
     const absolutePatch = path.join(input.runDir, ...relativePatch.split("/"));
     await mkdir(path.dirname(absolutePatch), { recursive: true });
     await writeFile(absolutePatch, patchText, "utf8");
+    // Keep the complete patch as immutable audit evidence, but create a bounded
+    // reviewer entrypoint plus one file-scoped artifact per tracked change. This
+    // prevents final review from loading a multi-thousand-line patch into a
+    // single Pi session merely to inspect one or two relevant files.
+    const reviewHunks = [];
+    const reviewHunksDir = path.join(input.runDir, "artifacts", "diff-hunks");
+    await mkdir(reviewHunksDir, { recursive: true });
+    for (const [index, file] of changedFiles.entries()) {
+        const filePatch = await run(root, ["diff", "--binary", "HEAD", "--", file]);
+        if (filePatch.code !== 0) {
+            throw new Error(`frontend worktree diff hunk failed for ${file}: ${filePatch.stderr.trim() || filePatch.stdout.trim()}`);
+        }
+        const text = filePatch.stdout.endsWith("\n") || filePatch.stdout.length === 0
+            ? filePatch.stdout
+            : `${filePatch.stdout}\n`;
+        const fragments = splitReviewDiffFragments(text);
+        for (const [partIndex, fragment] of fragments.entries()) {
+            const part = partIndex + 1;
+            const patchPath = `artifacts/diff-hunks/${String(index + 1).padStart(3, "0")}-${String(part).padStart(3, "0")}.patch`;
+            const artifact = [
+                "# Frontend review diff fragment",
+                `# path: ${file}`,
+                `# part: ${part}/${fragments.length}`,
+                "",
+                fragment,
+            ].join("\n");
+            await writeFile(path.join(input.runDir, ...patchPath.split("/")), artifact, "utf8");
+            reviewHunks.push({
+                path: file,
+                patchPath,
+                sha256: createHash("sha256").update(artifact).digest("hex"),
+                bytes: Buffer.byteLength(artifact),
+                part,
+                parts: fragments.length,
+            });
+        }
+    }
+    const reviewIndexPath = "contracts/frontend-review-diff-index.json";
+    await writeDagRunJsonArtifact(input.runDir, reviewIndexPath, {
+        schemaVersion: 1,
+        schemaId: FRONTEND_REVIEW_DIFF_INDEX_SCHEMA_ID,
+        patchSha256,
+        hunks: reviewHunks,
+        untrackedFiles,
+    });
+    const reviewSummaryPath = "artifacts/diff_summary.md";
+    await writeFile(path.join(input.runDir, ...reviewSummaryPath.split("/")), buildReviewDiffSummary({
+        patchSha256,
+        patchBytes: Buffer.byteLength(patchText),
+        hunks: reviewHunks,
+        untrackedFiles,
+    }), "utf8");
     const payload = {
         schemaVersion: 1,
         schemaId: FRONTEND_WORKTREE_DIFF_SCHEMA_ID,
         patchPath: relativePatch,
         patchSha256,
+        reviewSummaryPath,
+        reviewIndexPath,
         changedFiles,
         untrackedFiles,
         empty: changedFiles.length === 0 && untrackedFiles.length === 0,
@@ -177,6 +373,8 @@ export async function runFrontendWorktreeDiffGate(input) {
         patchPath: relativePatch,
         patchAbsolutePath: absolutePatch,
         patchSha256,
+        reviewSummaryPath,
+        reviewIndexPath,
         changedFiles,
         untrackedFiles,
         empty: payload.empty,
@@ -189,6 +387,8 @@ export function formatFrontendWorktreeDiffStdout(result) {
         `schemaId=${result.schemaId}`,
         `patchPath=${result.patchPath}`,
         `patchSha256=${result.patchSha256}`,
+        `reviewSummaryPath=${result.reviewSummaryPath}`,
+        `reviewIndexPath=${result.reviewIndexPath}`,
         `changedFiles=${result.changedFiles.length}`,
         `untrackedFiles=${result.untrackedFiles.length}`,
         `empty=${result.empty ? "true" : "false"}`,
@@ -199,3 +399,36 @@ export function formatFrontendWorktreeDiffStdout(result) {
         .filter(Boolean)
         .join("\n");
 }
+/**
+ * Expand glob-shaped contract paths into concrete workspace file paths.
+ *
+ * The frontend contract schema allows `targets.files` entries such as
+ * `src/**` (skeleton inherits the task allowedPaths), but writer admission
+ * derives the concrete writeSet and requires real file paths. This helper
+ * matches every candidate against the enumerated workspace files and returns
+ * the concrete paths. Candidates that are already concrete are kept as-is;
+ * globs that match nothing are dropped (the derived writeSet only contains
+ * paths the writer can actually touch).
+ */
+export function expandFrontendGlobPaths(input) {
+    const concrete = new Set();
+    const patterns = [];
+    for (const candidate of input.candidates) {
+        const normalized = candidate.replace(/\\/g, "/");
+        if (normalized.includes("*")) {
+            patterns.push(normalized);
+        }
+        else {
+            concrete.add(normalized);
+        }
+    }
+    if (patterns.length === 0)
+        return [...concrete].sort();
+    const workspace = [...new Set(input.workspaceFiles.map((f) => f.replace(/\\/g, "/")))];
+    for (const file of workspace) {
+        if (patterns.some((pattern) => pathMatchesPattern(file, pattern))) {
+            concrete.add(file);
+        }
+    }
+    return [...concrete].sort();
+}