@tea-agent/loop-agent 0.39.0-beta.1 → 0.39.0-beta.11

package/dist/worker/observe/node-process.js

@@ -0,0 +1,377 @@
+import { readFile } from "node:fs/promises";
+import { redactSecrets, truncateUtf8Preview } from "../../shared/preview.js";
+import { isSafeObservabilityIdentifier } from "../observability/event-store.js";
+import { parseExecutionOutputKey, } from "./dag-node-execution-output.js";
+import { resolveDagRunArtifact, resolveDagRunJson, } from "./dag-run-artifacts.js";
+import { namedShellHandlers } from "./shell-handler-keys.js";
+export const NODE_PROCESS_SCHEMA_VERSION = 1;
+export const NODE_PROCESS_FIELD_MAX_BYTES = 16 * 1024;
+function boundField(value) {
+    if (value == null || value === "")
+        return { text: null, truncated: false };
+    const redacted = redactSecrets(value);
+    const truncated = truncateUtf8Preview(redacted, NODE_PROCESS_FIELD_MAX_BYTES);
+    return {
+        text: truncated,
+        truncated: truncated !== redacted,
+    };
+}
+function asRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    return value;
+}
+function asString(value) {
+    return typeof value === "string" && value.trim() ? value : null;
+}
+function asNumber(value) {
+    return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
+function asBoolean(value) {
+    return value === true;
+}
+async function readJsonArtifact(repoRoot, dagRunId, segments) {
+    const resolved = resolveDagRunArtifact(repoRoot, dagRunId, segments);
+    if (!resolved.ok)
+        return null;
+    try {
+        const raw = await readFile(resolved.result.absolutePath, "utf8");
+        const parsed = JSON.parse(raw);
+        return asRecord(parsed);
+    }
+    catch {
+        return null;
+    }
+}
+async function readTextArtifact(repoRoot, dagRunId, segments) {
+    const resolved = resolveDagRunArtifact(repoRoot, dagRunId, segments);
+    if (!resolved.ok)
+        return { text: null, truncated: false };
+    try {
+        const raw = await readFile(resolved.result.absolutePath, "utf8");
+        return boundField(raw);
+    }
+    catch {
+        return { text: null, truncated: false };
+    }
+}
+function emptyBody(dagRunId, nodeId, kind, emptyReason, extras = {}) {
+    return {
+        schemaVersion: NODE_PROCESS_SCHEMA_VERSION,
+        dagRunId,
+        nodeId,
+        kind,
+        executor: extras.executor ?? null,
+        handler: extras.handler ?? null,
+        emptyReason,
+        key: extras.key ?? null,
+        commands: extras.commands ?? [],
+        steps: extras.steps ?? [],
+    };
+}
+function classifyKind(task) {
+    const executor = asString(task.executor);
+    const shell = asRecord(task.shell);
+    const handlers = namedShellHandlers(shell);
+    const handler = handlers[0] ?? null;
+    const commands = shell?.commands;
+    const commandsDeclared = Array.isArray(commands) &&
+        commands.some((item) => typeof item === "string" && item.trim());
+    if (executor === "static" || task.static) {
+        return { kind: "static", executor: executor ?? "static", handler, commandsDeclared };
+    }
+    if (executor === "shell" || shell) {
+        if (commandsDeclared) {
+            return { kind: "shell-commands", executor: executor ?? "shell", handler, commandsDeclared };
+        }
+        if (handler) {
+            return { kind: "shell-preset", executor: executor ?? "shell", handler, commandsDeclared };
+        }
+        return { kind: "shell-commands", executor: executor ?? "shell", handler, commandsDeclared };
+    }
+    return {
+        kind: "pi-session",
+        executor: executor ?? "pi",
+        handler,
+        commandsDeclared,
+    };
+}
+function receiptAttemptSegments(nodeId, parsed) {
+    if (parsed?.kind === "attempt") {
+        return [nodeId, `attempt-${parsed.index}`, "shell-command-receipt.json"];
+    }
+    return [nodeId, "shell-command-receipt.json"];
+}
+async function loadShellCommands(repoRoot, dagRunId, nodeId, parsed) {
+    const preferred = await readJsonArtifact(repoRoot, dagRunId, receiptAttemptSegments(nodeId, parsed));
+    const receipt = preferred ??
+        (parsed
+            ? await readJsonArtifact(repoRoot, dagRunId, [
+                nodeId,
+                "shell-command-receipt.json",
+            ])
+            : null);
+    if (!receipt)
+        return null;
+    const rawCommands = Array.isArray(receipt.commands) ? receipt.commands : [];
+    const commands = [];
+    for (let i = 0; i < rawCommands.length; i += 1) {
+        const entry = asRecord(rawCommands[i]) ?? {};
+        const stdout = await readTextArtifact(repoRoot, dagRunId, [
+            nodeId,
+            "commands",
+            `${i + 1}.stdout.txt`,
+        ]);
+        const stderr = await readTextArtifact(repoRoot, dagRunId, [
+            nodeId,
+            "commands",
+            `${i + 1}.stderr.txt`,
+        ]);
+        const commandBound = boundField(asString(entry.command) ?? "");
+        commands.push({
+            index: i + 1,
+            command: commandBound.text ?? "(command)",
+            ok: asBoolean(entry.ok),
+            exitCode: asNumber(entry.exitCode),
+            failureCategory: asString(entry.failureCategory),
+            startedAt: asString(entry.startedAt),
+            finishedAt: asString(entry.finishedAt),
+            durationMs: asNumber(entry.wallDurationMs) ??
+                asNumber(entry.executionDurationMs) ??
+                null,
+            reused: asBoolean(entry.reused),
+            stdout: stdout.text,
+            stderr: stderr.text,
+            truncated: commandBound.truncated || stdout.truncated || stderr.truncated,
+        });
+    }
+    return commands;
+}
+function handlerLabel(handler) {
+    if (handler === "frontendBrowserToolPreflight")
+        return "浏览器工具能力探测";
+    if (handler === "frontendTestStandardScenarios")
+        return "标准场景物化";
+    if (handler === "frontendTestEnvironmentProbe")
+        return "前端环境探测";
+    if (handler === "frontendTestCaseChecklist")
+        return "用例清单校验";
+    if (handler === "frontendTestCaseManifest")
+        return "用例清单物化";
+    if (handler === "frontendTestEvidenceValidation")
+        return "证据校验";
+    if (handler === "frontendTestResultFinalize")
+        return "结果定稿";
+    if (handler === "frontendTestReports" || handler === "frontendTestL5Report" || handler === "frontendTestHtmlReport") {
+        return "测试报告";
+    }
+    if (handler === "frontendPrewriteGate")
+        return "前端预写门禁";
+    if (handler === "finalWriteSetApprovalGate")
+        return "writeSet 终态批准";
+    return handler;
+}
+async function loadPresetSteps(repoRoot, dagRunId, nodeId, handler, parsed) {
+    const written = await readJsonArtifact(repoRoot, dagRunId, [
+        nodeId,
+        "process-receipt.json",
+    ]);
+    if (written && Array.isArray(written.steps)) {
+        return written.steps.flatMap((item, index) => {
+            const step = asRecord(item);
+            if (!step)
+                return [];
+            const detail = boundField(asString(step.detail));
+            return [
+                {
+                    id: asString(step.id) ?? `step-${index + 1}`,
+                    label: asString(step.label) ?? handlerLabel(handler ?? "preset"),
+                    ok: asBoolean(step.ok),
+                    detail: detail.text,
+                    durationMs: asNumber(step.durationMs),
+                    truncated: detail.truncated,
+                },
+            ];
+        });
+    }
+    const capability = await readJsonArtifact(repoRoot, dagRunId, [
+        nodeId,
+        "frontend-browser-capability.json",
+    ]);
+    if (capability && handler === "frontendBrowserToolPreflight") {
+        const detail = boundField(JSON.stringify(capability, null, 2));
+        return [
+            {
+                id: "capability",
+                label: handlerLabel(handler),
+                ok: asString(capability.status) !== "failed",
+                detail: detail.text,
+                durationMs: null,
+                truncated: detail.truncated,
+            },
+        ];
+    }
+    const attemptIndex = parsed?.kind === "attempt" ? parsed.index : 1;
+    const attempt = await readJsonArtifact(repoRoot, dagRunId, [
+        nodeId,
+        `attempt-${attemptIndex}.json`,
+    ]);
+    if (attempt) {
+        const ok = asBoolean(attempt.ok);
+        const detail = boundField(ok
+            ? (asString(attempt.stdout) ?? asString(attempt.assistantText))
+            : (asString(attempt.stderr) ?? asString(attempt.stdout)));
+        return [
+            {
+                id: "run",
+                label: handlerLabel(handler ?? "preset"),
+                ok,
+                detail: detail.text,
+                durationMs: asNumber(attempt.durationMs),
+                truncated: detail.truncated,
+            },
+        ];
+    }
+    return [];
+}
+export async function loadDagNodeProcess(repoRoot, dagRunId, nodeId, rawKey) {
+    if (!isSafeObservabilityIdentifier(dagRunId) ||
+        !isSafeObservabilityIdentifier(nodeId)) {
+        return {
+            status: 400,
+            body: { error: "Invalid dag run or node identifier", reason: "invalid-id" },
+        };
+    }
+    let parsedKey = null;
+    if (rawKey != null && String(rawKey).trim() !== "") {
+        const parsed = parseExecutionOutputKey(rawKey);
+        if (!parsed.ok) {
+            return {
+                status: 400,
+                body: {
+                    error: "Invalid execution key (expected attempt-N or pass-N)",
+                    reason: "invalid-key",
+                },
+            };
+        }
+        parsedKey = parsed;
+    }
+    const runResolved = resolveDagRunJson(repoRoot, dagRunId);
+    if (!runResolved.ok) {
+        if (runResolved.reason === "invalid-id") {
+            return {
+                status: 400,
+                body: { error: "Invalid dag run or node identifier", reason: "invalid-id" },
+            };
+        }
+        if (runResolved.reason === "ambiguous") {
+            return {
+                status: 409,
+                body: { error: "Ambiguous dag run lifecycle", reason: "ambiguous" },
+            };
+        }
+        return {
+            status: 404,
+            body: { error: "DAG run not found", reason: "not-found" },
+        };
+    }
+    let spec = {};
+    try {
+        const raw = JSON.parse(await readFile(runResolved.result.absolutePath, "utf8"));
+        spec = asRecord(raw) ?? {};
+    }
+    catch {
+        return {
+            status: 404,
+            body: { error: "run.json is unreadable", reason: "not-found" },
+        };
+    }
+    const tasks = Array.isArray(spec.tasks) ? spec.tasks : [];
+    const task = tasks
+        .map((item) => asRecord(item))
+        .find((item) => item && asString(item.id) === nodeId);
+    if (!task) {
+        return {
+            status: 200,
+            body: emptyBody(dagRunId, nodeId, "none", "not-executed"),
+        };
+    }
+    const classified = classifyKind(task);
+    const key = parsedKey?.key ?? null;
+    if (classified.kind === "pi-session") {
+        return {
+            status: 200,
+            body: emptyBody(dagRunId, nodeId, "pi-session", "pi-session", {
+                executor: classified.executor,
+                key,
+            }),
+        };
+    }
+    if (classified.kind === "static") {
+        return {
+            status: 200,
+            body: emptyBody(dagRunId, nodeId, "static", "static-no-process", {
+                executor: classified.executor,
+                key,
+            }),
+        };
+    }
+    if (classified.kind === "shell-commands" || classified.kind === "shell-preset") {
+        const commands = await loadShellCommands(repoRoot, dagRunId, nodeId, parsedKey);
+        if (commands && commands.length > 0) {
+            return {
+                status: 200,
+                body: {
+                    schemaVersion: NODE_PROCESS_SCHEMA_VERSION,
+                    dagRunId,
+                    nodeId,
+                    kind: "shell-commands",
+                    executor: classified.executor,
+                    handler: classified.handler,
+                    emptyReason: null,
+                    key,
+                    commands,
+                    steps: [],
+                },
+            };
+        }
+        if (classified.handler || classified.kind === "shell-preset") {
+            const steps = await loadPresetSteps(repoRoot, dagRunId, nodeId, classified.handler, parsedKey);
+            if (steps.length > 0) {
+                return {
+                    status: 200,
+                    body: {
+                        schemaVersion: NODE_PROCESS_SCHEMA_VERSION,
+                        dagRunId,
+                        nodeId,
+                        kind: "shell-preset",
+                        executor: classified.executor,
+                        handler: classified.handler,
+                        emptyReason: null,
+                        key,
+                        commands: [],
+                        steps,
+                    },
+                };
+            }
+        }
+        return {
+            status: 200,
+            body: emptyBody(dagRunId, nodeId, classified.kind, classified.kind === "shell-preset"
+                ? "shell-preset-pending"
+                : "shell-receipt-missing", {
+                executor: classified.executor,
+                handler: classified.handler,
+                key,
+            }),
+        };
+    }
+    return {
+        status: 200,
+        body: emptyBody(dagRunId, nodeId, "none", "not-executed", {
+            executor: classified.executor,
+            handler: classified.handler,
+            key,
+        }),
+    };
+}

package/dist/worker/observe/routes.js

@@ -11,11 +11,16 @@ import { buildGlobalSnapshot, clampDagRunHistoryPageSize, clampTaskRunHistoryLim
 import { loadDagRunExecutionTrajectory } from "../observability/dag-execution-trajectory.js";
 import { resolveDagTaskSourcePath } from "../../task/dag-source-paths.js";
 import { dagSourceBindingSchema } from "../../workflows/dag/types.js";
+import { getTaskPaths } from "../../task/runtime.js";
+import { classifyLedgerGate, computeLedgerInputDigest, LedgerParseError, parseLedgerJson, recoverLedgerInputContract, summarizeLedger, } from "../../task/source-prepare/ledger.js";
 import { getTaskPoolRoot } from "../pool/run-store.js";
+import { resolveDagRunArtifact, } from "./dag-run-artifacts.js";
+import { frontendPrewriteResultV1Schema } from "../../workflows/dag/frontend-prewrite-gate.js";
 import { isAllowedArtifactTextPath, resolveArtifactPath, resolveRepoFilePreview, toRepoRelativeArtifactPath, } from "./paths.js";
 import { extractSpecEvidence, extractSpecReadContent, } from "./spec-evidence.js";
 import { buildDagNodeInput } from "./node-input.js";
 import { loadDagNodeExecutionOutput } from "./dag-node-execution-output.js";
+import { loadDagNodeProcess } from "./node-process.js";
 import { buildObserveHealthV1 } from "./health.js";
 import { buildNightJobDetail, buildNightJobsDoctor, buildNightJobsList, buildNightJobsMorning, } from "./night-jobs.js";
 const ARTIFACT_PREVIEW_MAX_BYTES = 64 * 1024;
@@ -69,6 +74,15 @@ export const ROUTES = [
         pattern: /^\/api\/tasks\/([^/]+)\/runs$/,
         handler: handleTaskRuns,
     },
+    /**
+     * Read-only source fidelity ledger safe summary (AC-009 / AC-FIDELITY-009):
+     * 只返回计数/状态/failure code，不泄漏敏感原文。
+     */
+    {
+        method: "GET",
+        pattern: /^\/api\/tasks\/([^/]+)\/ledger$/,
+        handler: handleTaskLedger,
+    },
     {
         method: "GET",
         pattern: /^\/api\/tasks\/([^/]+)$/,
@@ -100,6 +114,11 @@ export const ROUTES = [
         pattern: /^\/api\/dag-runs\/([^/]+)\/nodes\/([^/]+)\/execution-output$/,
         handler: handleDagNodeExecutionOutput,
     },
+    {
+        method: "GET",
+        pattern: /^\/api\/dag-runs\/([^/]+)\/nodes\/([^/]+)\/process$/,
+        handler: handleDagNodeProcess,
+    },
     {
         method: "GET",
         pattern: /^\/api\/dag-runs\/([^/]+)\/nodes\/([^/]+)\/spec-evidence$/,
@@ -110,6 +129,16 @@ export const ROUTES = [
         pattern: /^\/api\/dag-runs\/([^/]+)\/nodes\/([^/]+)\/spec-evidence\/file$/,
         handler: handleDagNodeSpecEvidenceFile,
     },
+    // DAG run 专属只读 prewrite 结果（AC-006 / AC-BLOCK-006）：唯一读路径为
+    // run-owned contracts/frontend-prewrite-result.json（resolveDagRunArtifact 四类
+    // fail-closed），不扩大 isAllowedArtifactTextPath 通用 allowlist；响应以
+    // frontendPrewriteResultV1Schema（.strict()）解析，Inspector 不再做
+    // /api/artifacts 预览 → JSON.stringify → JSON.parse 双编码。
+    {
+        method: "GET",
+        pattern: /^\/api\/dag-runs\/([^/]+)\/prewrite-result$/,
+        handler: handleDagRunPrewriteResult,
+    },
     {
         method: "GET",
         pattern: /^\/api\/dag-runs\/([^/]+)$/,
@@ -221,14 +250,23 @@ export async function serveObserveStatic(req, res, staticDir, options = {}) {
         sendJson(res, 404, { error: "Not found" });
         return;
     }
-    const content = await readFile(resolvedFile);
+    let content = await readFile(resolvedFile);
     const contentType = contentTypeFor(pathname);
-    res.writeHead(200, {
+    const headers = {
         "Content-Type": contentType,
         "Content-Length": content.byteLength,
         "X-Content-Type-Options": "nosniff",
         "X-Frame-Options": "SAMEORIGIN",
-    });
+    };
+    if (contentType.startsWith("text/html") && options.htmlEnhancer) {
+        const enhanced = options.htmlEnhancer(Buffer.from(content));
+        content = enhanced.content;
+        headers["Content-Length"] = content.byteLength;
+        if (enhanced.setCookie) {
+            headers["Set-Cookie"] = enhanced.setCookie;
+        }
+    }
+    res.writeHead(200, headers);
     res.end(content);
 }
 async function handleHealth(_req, res, _match, ctx) {
@@ -433,6 +471,117 @@ async function handleTaskRuns(_req, res, match, ctx) {
     });
     sendJson(res, 200, page);
 }
+/**
+ * GET /api/tasks/:id/ledger — 只读 ledger 安全摘要。任务存在但无 ledger 时返回
+ * `{ present: false }`（空态，不伪造计数）；任务不存在返回 404；ledger 解析失败
+ * 返回带稳定 SOURCE_FIDELITY_* 错误码的 `{ present: false }`（AC-HARD-003：与
+ * parseLedgerJson 同一稳定码，不泄漏原文）。binding v2 标记 + ledgerSha256 +
+ * inputDigest 仅在真实 v2 绑定（非空 canonical requirement 集）时展示（AC-HARD-004：
+ * v1+optional 冒充 v2 不标记）；inputDigest 与当前权威源输入不一致时置 stale。
+ */
+async function handleTaskLedger(_req, res, match, ctx) {
+    const taskId = match.params.id;
+    if (!isSafeObservabilityIdentifier(taskId)) {
+        sendJson(res, 400, { error: "Invalid task identifier" });
+        return;
+    }
+    const taskPaths = getTaskPaths(ctx.repoRoot, taskId);
+    try {
+        await stat(taskPaths.taskDir);
+    }
+    catch {
+        sendJson(res, 404, { error: "Task not found" });
+        return;
+    }
+    const ledgerPath = path.join(taskPaths.sourceDir, "requirement-ledger.json");
+    let raw;
+    try {
+        raw = await readFile(ledgerPath, "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT") {
+            sendJson(res, 200, { present: false, taskId });
+            return;
+        }
+        sendJson(res, 200, {
+            present: false,
+            taskId,
+            error: "ledger-unreadable",
+        });
+        return;
+    }
+    let ledger;
+    try {
+        ledger = parseLedgerJson(raw);
+    }
+    catch (error) {
+        // AC-HARD-003：解析失败分支使用与 parseLedgerJson 相同的稳定 SOURCE_FIDELITY_*
+        // 错误码（结构化可消费），而非裸字符串/裸 Error。
+        const code = error instanceof LedgerParseError
+            ? error.code
+            : "SOURCE_FIDELITY_LEDGER_STALE";
+        sendJson(res, 200, {
+            present: false,
+            taskId,
+            error: code,
+        });
+        return;
+    }
+    const classification = classifyLedgerGate(ledger);
+    const summary = summarizeLedger(ledger, {
+        gateStatus: classification.ok ? "pass" : "fail",
+        failureCode: classification.ok ? null : classification.code,
+    });
+    // v2 binding 语义（AC-HARD-004）：仅在真实 v2 绑定（canonical requirement 非空，
+    // 具备 requirement→fragment 映射证据）时标记 bindingSchemaVersion=2 并透传
+    // ledgerSha256/inputDigest；空 canonical 的 ledger 是退化/伪造 v2，不标记。
+    const contract = recoverLedgerInputContract(ledger);
+    const realV2Binding = contract.canonicalRequirements.length > 0;
+    let stale = false;
+    if (realV2Binding) {
+        // 当前权威源输入：ledger.sourcePaths（repo-root relative POSIX）→ 当前字节；
+        // 缺失/清空的权威源视为 stale（fail-closed，与 init-hybrid 语义一致）。
+        const currentByPath = new Map();
+        for (const sourcePath of contract.sourcePaths) {
+            try {
+                currentByPath.set(sourcePath, await readFile(path.resolve(ctx.repoRoot, sourcePath), "utf8"));
+            }
+            catch {
+                // 权威源缺失：保持缺失，expectedInputDigest 不一致 → stale。
+            }
+        }
+        const expectedDigest = computeLedgerInputDigest({
+            sourceDocuments: contract.sourcePaths.map((sourcePath) => ({
+                path: sourcePath,
+                content: currentByPath.get(sourcePath) ?? "",
+            })),
+            canonicalRequirements: contract.canonicalRequirements,
+        });
+        stale = ledger.inputDigest !== expectedDigest;
+    }
+    const ledgerSha256 = createHash("sha256").update(raw).digest("hex");
+    sendJson(res, 200, {
+        present: true,
+        taskId,
+        ...(realV2Binding
+            ? {
+                bindingSchemaVersion: 2,
+                ledgerSha256,
+                inputDigest: ledger.inputDigest,
+                stale,
+            }
+            : {}),
+        fragmentCount: summary.fragmentCount,
+        canonicalRequirementCount: summary.canonicalRequirementCount,
+        contextOnlyCount: summary.contextOnlyCount,
+        duplicateCount: summary.duplicateCount,
+        unresolvedCount: summary.unresolvedCount,
+        conflictCount: summary.conflictCount,
+        gateStatus: summary.gateStatus,
+        failureCode: summary.failureCode,
+        exclusions: summary.exclusions,
+    });
+}
 function ambiguousTaskBody(taskId, candidates) {
     return {
         error: "Task identity ambiguous",
@@ -520,6 +669,60 @@ async function handleDagRuns(_req, res, match, ctx) {
     const body = listDagRunHistoryFromSnapshot(snapshot, { page, pageSize });
     sendJson(res, 200, body);
 }
+/**
+ * GET /api/dag-runs/:dagRunId/prewrite-result（AC-006 / AC-BLOCK-006）
+ * 只读 run-owned contracts/frontend-prewrite-result.json：resolveDagRunArtifact 是
+ * 唯一读路径（active/paused/completed 生命周期；invalid-id / unsafe-path /
+ * not-found / ambiguous 四类 fail-closed）。响应以 frontendPrewriteResultV1Schema
+ * （.strict()）解析，拒绝 envelope 之外的字段；不扩大通用 artifact allowlist。
+ */
+async function handleDagRunPrewriteResult(_req, res, match, ctx) {
+    const dagRunId = match.params.id;
+    const resolved = resolveDagRunArtifact(ctx.repoRoot, dagRunId, [
+        "contracts",
+        "frontend-prewrite-result.json",
+    ]);
+    if (!resolved.ok) {
+        if (resolved.reason === "invalid-id") {
+            sendJson(res, 400, { error: "Invalid dag run identifier" });
+            return;
+        }
+        if (resolved.reason === "ambiguous") {
+            sendJson(res, 409, { error: "DAG run identity ambiguous" });
+            return;
+        }
+        sendJson(res, 404, { error: "Prewrite result not found" });
+        return;
+    }
+    let raw;
+    try {
+        raw = await readFile(resolved.result.absolutePath, "utf8");
+    }
+    catch {
+        sendJson(res, 404, { error: "Prewrite result not found" });
+        return;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        sendJson(res, 500, {
+            error: "Prewrite result is not valid JSON",
+            reason: "prewrite-result-unparseable",
+        });
+        return;
+    }
+    const envelope = frontendPrewriteResultV1Schema.safeParse(parsed);
+    if (!envelope.success) {
+        sendJson(res, 500, {
+            error: "Prewrite result is not a valid frontend-prewrite-result-v1 envelope",
+            reason: "prewrite-result-schema-invalid",
+        });
+        return;
+    }
+    sendJson(res, 200, envelope.data);
+}
 export async function handleDagRunById(_req, res, match, ctx) {
     const snapshot = await getSnapshot(ctx);
     const dagRun = snapshot.dagRuns.find((d) => d.dagRunId === match.params.id);
@@ -570,6 +773,24 @@ async function handleDagNodeExecutionOutput(_req, res, match, ctx) {
     const result = await loadDagNodeExecutionOutput(ctx.repoRoot, dagRunId, nodeId, key);
     sendJson(res, result.status, result.body);
 }
+async function handleDagNodeProcess(_req, res, match, ctx) {
+    const dagRunId = match.params.id;
+    const nodeId = match.params.sub;
+    if (!isSafeObservabilityIdentifier(dagRunId) ||
+        !isSafeObservabilityIdentifier(nodeId)) {
+        sendJson(res, 400, { error: "Invalid dag run or node identifier" });
+        return;
+    }
+    if (match.query.has("path") || match.query.has("artifactPath")) {
+        sendJson(res, 400, {
+            error: "Artifact path is not accepted; use optional key=attempt-N|pass-N",
+            reason: "path-not-allowed",
+        });
+        return;
+    }
+    const result = await loadDagNodeProcess(ctx.repoRoot, dagRunId, nodeId, match.query.get("key"));
+    sendJson(res, result.status, result.body);
+}
 async function handleDagNodeSessionEvents(_req, res, match, ctx) {
     const dagRunId = match.params.id;
     const nodeId = match.params.sub;

package/dist/worker/observe/server.js

@@ -83,6 +83,10 @@ export function createObserveServer(options) {
                 url: `http://${host}:${addr.port}`,
                 close: () => new Promise((closeResolve, closeReject) => {
                     server.close((err) => (err ? closeReject(err) : closeResolve()));
+                    // Explicit shutdown must not wait for the 65s keep-alive window.
+                    // This also closes active SSE clients so process/test teardown is
+                    // deterministic instead of timing out behind pooled connections.
+                    server.closeAllConnections();
                 }),
             });
         });