@tea-agent/loop-agent 0.39.0-next.3 → 0.39.0-next.30

package/dist/workflows/dag/frontend-prewrite-gate.js

@@ -1,13 +1,19 @@
+import { createHash } from "node:crypto";
 import { readFile, stat } from "node:fs/promises";
 import path from "node:path";
 import { z } from "zod";
 import { isOpenspecSpecFilePath } from "../../shared/openspec-spec.js";
+import { writeTextArtifactFile } from "../../infrastructure/harness/artifact-store.js";
 import { countExcludedGovernanceSpecFiles, resolveOpenspecGovernanceRoot, } from "../../task/frontend-project-capability.js";
-import { analyzeFrontendImplementationContract, writeFrontendImplementationContractArtifact, writeDeterministicJsonArtifact, assertFrontendSourceBindingFresh, deterministicSha256, sha256Hex, FrontendContractFailure, frontendNormalizationActionSchema, } from "./frontend-implementation-contract.js";
+import { analyzeFrontendImplementationContract, writeFrontendImplementationContractArtifact, writeDeterministicJsonArtifact, assertFrontendSourceBindingFresh, deterministicSha256, sha256Hex, serializeDeterministicJson, FRONTEND_IMPLEMENTATION_CONTRACT_SCHEMA_ID, FrontendContractFailure, frontendNormalizationActionSchema, } from "./frontend-implementation-contract.js";
+import { renderFrontendPlanMarkdown } from "./frontend-plan-render.js";
 import { captureFrontendWorktreeBaseline } from "./frontend-worktree-diff.js";
 import { pathMatchesPattern } from "../../shared/git-progress.js";
+import { normalizeVerdictCandidateLine } from "./dynamic-runtime/shared.js";
 export const FRONTEND_PREWRITE_RESULT_SCHEMA_ID = "frontend-prewrite-result-v1";
 export const FRONTEND_PREWRITE_RESULT_ARTIFACT_NAME = "frontend-prewrite-result.json";
+/** Canonical contract serialization must stay at or below this byte size. */
+export const FRONTEND_CONTRACT_MAX_BYTES = 65536;
 /**
  * Machine-readable failure classification for blocked/retryable-invalid
  * prewrite outcomes. Kept alongside the human-readable failureReason so
@@ -31,6 +37,11 @@ export const frontendPrewriteFailureCodeSchema = z.enum([
     "openspec-citation-block-unparseable",
     "openspec-not-cited",
     "openspec-citation-not-read",
+    "component-spec-reference-invalid",
+    "component-spec-not-cited",
+    "component-choices-missing",
+    "contract-too-large",
+    "revision-patch-unmergeable",
 ]);
 export const frontendPrewriteResultV1Schema = z
     .object({
@@ -147,32 +158,80 @@ async function selectNode(runDir, primary, fallbacks) {
     }
     throw new Error(`frontend prewrite gate no FINISHED candidate: ${rejections.join("; ")}`);
 }
-async function readNodeText(runDir, nodeId) {
-    const record = JSON.parse(await readFile(path.join(runDir, `${nodeId}.json`), "utf8"));
+async function readFinishedNodeRecord(runDir, nodeId) {
+    let record;
+    try {
+        record = JSON.parse(await readFile(path.join(runDir, `${nodeId}.json`), "utf8"));
+    }
+    catch (error) {
+        throw new Error(`frontend prewrite gate cannot parse node record ${nodeId}: ${error instanceof Error ? error.message : String(error)}`);
+    }
     if (record.status !== "FINISHED") {
         throw new Error(`frontend prewrite gate requires FINISHED node ${nodeId} (got ${String(record.status)})`);
     }
-    const text = [record.assistantText, record.stdout]
-        .filter((value) => Boolean(value?.trim()))
-        .join("\n");
+    return record;
+}
+async function readNodeText(runDir, nodeId) {
+    const record = await readFinishedNodeRecord(runDir, nodeId);
+    const text = record.assistantText?.trim() || record.stdout?.trim() || "";
     if (!text)
         throw new Error(`frontend prewrite gate empty output from ${nodeId}`);
     return text;
 }
-async function readNodeRawText(runDir, nodeId) {
-    const record = JSON.parse(await readFile(path.join(runDir, `${nodeId}.json`), "utf8"));
-    return record.assistantText ?? record.stdout ?? "";
+async function readCanonicalContractFromNode(runDir, nodeId) {
+    const record = await readFinishedNodeRecord(runDir, nodeId);
+    if (!record.structuredArtifactPath) {
+        throw new Error(`frontend prewrite gate missing structured artifact for ${nodeId}`);
+    }
+    const artifactPath = path.isAbsolute(record.structuredArtifactPath)
+        ? record.structuredArtifactPath
+        : path.join(runDir, record.structuredArtifactPath);
+    const resolvedRun = path.resolve(runDir);
+    const resolvedArtifact = path.resolve(artifactPath);
+    const relative = path.relative(resolvedRun, resolvedArtifact);
+    if (!relative || relative.startsWith("..") || path.isAbsolute(relative)) {
+        throw new Error(`frontend prewrite gate structured artifact escapes runDir: ${record.structuredArtifactPath}`);
+    }
+    const bytes = await readFile(resolvedArtifact);
+    const digest = createHash("sha256").update(bytes).digest("hex");
+    if (record.structuredArtifactSha256 &&
+        record.structuredArtifactSha256 !== digest) {
+        throw new Error(`frontend prewrite gate structured artifact hash mismatch for ${nodeId}`);
+    }
+    if (record.structuredArtifactSchemaId &&
+        record.structuredArtifactSchemaId !== FRONTEND_IMPLEMENTATION_CONTRACT_SCHEMA_ID) {
+        throw new Error(`frontend prewrite gate structured artifact schema mismatch for ${nodeId}: ${record.structuredArtifactSchemaId}`);
+    }
+    const contractText = bytes.toString("utf8");
+    let citationsText = "";
+    try {
+        const citationsRaw = await readFile(path.join(path.dirname(resolvedArtifact), "openspec-citations.json"), "utf8");
+        try {
+            const parsed = JSON.parse(citationsRaw);
+            citationsText =
+                typeof parsed.block === "string" ? parsed.block : citationsRaw;
+        }
+        catch {
+            citationsText = citationsRaw;
+        }
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+    return { contractText, citationsText, rawSha256: digest };
 }
 function firstNonEmptyVerdictLine(text) {
     const lines = text
         .split(/\r?\n/)
         .map((line) => line.trim())
         .filter(Boolean);
-    const normalize = (line) => {
-        const emphasized = line.match(/^(?:`{1,3}|\*{1,3})\s*(VERDICT:[^`*]+?)\s*(?:`{1,3}|\*{1,3})$/);
-        return (emphasized?.[1] ?? line).trim();
-    };
-    const normalizedLines = lines.map(normalize);
+    // Emphasis stripping (backtick + asterisk) is shared with the runIf
+    // selector and node-level output-protocol validation via
+    // normalizeVerdictCandidateLine. The gate keeps its own loose
+    // pass/request-revision normalization below (prefix match + trailing
+    // prose tolerance) for deterministic fail-closed behavior.
+    const normalizedLines = lines.map(normalizeVerdictCandidateLine);
     const first = normalizedLines[0] ?? "";
     // The prompt requires VERDICT to be the first non-empty line, but model
     // output can still prepend a summary. Keep the protocol strict in the
@@ -389,7 +448,30 @@ export async function runFrontendPrewriteGate(input) {
     // remains an ERROR and is intentionally not classified into prewrite-result.
     const planNodeId = await selectNode(input.runDir, input.config.planFromNodeId, input.config.planFallbackFromNodeIds);
     const reviewNodeId = await selectNode(input.runDir, input.config.reviewFromNodeId, input.config.reviewFallbackFromNodeIds);
-    const candidateRawSha256 = sha256Hex(await readNodeRawText(input.runDir, planNodeId));
+    let planArtifact;
+    try {
+        planArtifact = await readCanonicalContractFromNode(input.runDir, planNodeId);
+    }
+    catch (error) {
+        return finalizePrewrite(input, {
+            planNodeId,
+            reviewNodeId,
+            verdict: "",
+            candidateRawSha256: sha256Hex(""),
+            candidateJsonSha256: null,
+            canonicalSha256: null,
+            normalizationActions: [],
+            mockStrategy: undefined,
+            artifact: undefined,
+            failureReason: error instanceof Error ? error.message : String(error),
+            failureCode: "plan-text-unreadable",
+            classification: "retryable-invalid",
+            openspecReadPaths: [],
+            openspecCandidatePaths: input.config.openspecCandidatePaths ?? [],
+            openspecPolicy: input.config.openspecPolicy ?? "scan-strict",
+        });
+    }
+    const candidateRawSha256 = planArtifact.rawSha256;
     const openspecPolicy = input.config.openspecPolicy ?? "scan-strict";
     const basePending = {
         planNodeId,
@@ -408,18 +490,9 @@ export async function runFrontendPrewriteGate(input) {
         openspecCandidatePaths: input.config.openspecCandidatePaths ?? [],
         openspecPolicy,
     };
-    let planText;
-    try {
-        planText = await readNodeText(input.runDir, planNodeId);
-    }
-    catch (error) {
-        return finalizePrewrite(input, {
-            ...basePending,
-            classification: "retryable-invalid",
-            failureReason: error instanceof Error ? error.message : String(error),
-            failureCode: "plan-text-unreadable",
-        });
-    }
+    const planText = [planArtifact.contractText, planArtifact.citationsText]
+        .filter(Boolean)
+        .join("\n");
     let reviewText;
     try {
         reviewText = await readNodeText(input.runDir, reviewNodeId);
@@ -442,7 +515,8 @@ export async function runFrontendPrewriteGate(input) {
             failureCode: "verdict-not-pass",
         });
     }
-    const missingIds = input.config.requiredRequirementIds.filter((id) => !planText.includes(id));
+    const requirementIdSearchText = planArtifact.contractText;
+    const missingIds = input.config.requiredRequirementIds.filter((id) => !requirementIdSearchText.includes(id));
     if (missingIds.length > 0) {
         return finalizePrewrite(input, {
             ...basePending,
@@ -489,13 +563,13 @@ export async function runFrontendPrewriteGate(input) {
                 workspaceRoot,
             });
     }
-    // Candidate -> canonical conversion. The gate consumes the selected
-    // plan/revision assistant output directly and is the only conversion point.
+    // Candidate -> canonical conversion. The gate consumes the producing node's
+    // hash-bound canonical artifact and never re-merges plan/revision stdout.
     let analysis;
     try {
         analysis = await analyzeFrontendImplementationContract({
             runDir: input.runDir,
-            fromNodeId: planNodeId,
+            rawContractText: planArtifact.contractText,
             sourceBinding: input.sourceBinding,
         });
     }
@@ -515,6 +589,21 @@ export async function runFrontendPrewriteGate(input) {
         }
         throw error;
     }
+    // Size guard: a canonical contract above 64KB is a retryable-invalid defect
+    // (compress the contract) rather than a writer authorization failure.
+    const contractSizeBytes = Buffer.byteLength(serializeDeterministicJson(analysis.canonical), "utf8");
+    if (contractSizeBytes > FRONTEND_CONTRACT_MAX_BYTES) {
+        return finalizePrewrite(input, {
+            ...basePending,
+            verdict,
+            candidateJsonSha256: analysis.candidateJsonSha256,
+            normalizationActions: [],
+            mockStrategy: analysis.canonical.mockApi.strategy,
+            classification: "retryable-invalid",
+            failureReason: `frontend prewrite gate: canonical contract serialization is ${contractSizeBytes} bytes, exceeding the ${FRONTEND_CONTRACT_MAX_BYTES}-byte limit. 压缩契约（移除冗余 prose、重复目标或过长描述）后重试。`,
+            failureCode: "contract-too-large",
+        });
+    }
     const mockStrategy = analysis.canonical.mockApi.strategy;
     if (!input.config.allowedMockStrategies.includes(mockStrategy)) {
         const quotedAllowed = input.config.allowedMockStrategies
@@ -711,6 +800,105 @@ export async function runFrontendPrewriteGate(input) {
             }
         }
     }
+    // Component selection spec conformance (ADR 0016). Deterministic cross-check
+    // that declared component/token selections trace to the frontend spec
+    // (openspec/ai_workspace component + theme) instead of a model's ad-hoc
+    // "better" choice. Runs after the openspec read gate so citation + read
+    // evidence are already resolved.
+    const componentChoices = analysis.canonical.uiComponentChoices ?? [];
+    const componentSpecCandidates = input.config.componentSpecCandidatePaths ?? [];
+    const hasUiVisibleWork = analysis.canonical.uiStates.some((state) => state.applicable) ||
+        analysis.canonical.interactions.length > 0;
+    if (componentSpecCandidates.length > 0 &&
+        hasUiVisibleWork &&
+        componentChoices.length === 0) {
+        return finalizePrewrite(input, {
+            ...basePending,
+            verdict,
+            candidateJsonSha256: analysis.candidateJsonSha256,
+            normalizationActions: [],
+            mockStrategy,
+            classification: "retryable-invalid",
+            failureReason: "frontend prewrite gate: the canonical contract has UI-visible work but uiComponentChoices is missing or empty while the generation-frozen component/theme specification bucket is non-empty. 为每个 UI 用途声明组件选型（decision: specified | reuse-existing | new），specified 必须给 specReference.path/section/line，new 必须给 rationale 声明偏差。",
+            failureCode: "component-choices-missing",
+            openspecReadPaths,
+            openspecCandidatePaths: candidatePaths,
+        });
+    }
+    const componentSpecReferences = componentChoices
+        .map((choice) => ({
+        raw: choice.specReference?.path ?? "",
+        normalized: choice.specReference?.path
+            ? normalizeCitationPath(choice.specReference.path, candidateRoot)
+            : null,
+    }))
+        .filter((ref) => ref.raw.length > 0);
+    if (componentSpecReferences.length > 0) {
+        const invalidRefs = [
+            ...new Set(componentSpecReferences
+                .filter((ref) => !ref.normalized ||
+                !isOpenspecSpecFilePath(ref.normalized))
+                .map((ref) => ref.raw)),
+        ];
+        if (invalidRefs.length > 0) {
+            return finalizePrewrite(input, {
+                ...basePending,
+                verdict,
+                candidateJsonSha256: analysis.candidateJsonSha256,
+                normalizationActions: [],
+                mockStrategy,
+                classification: "retryable-invalid",
+                failureReason: `frontend prewrite gate: these uiComponentChoices specReference paths are not supported openspec/ai_workspace spec files: ${invalidRefs.join(", ")}`,
+                failureCode: "component-spec-reference-invalid",
+                openspecReadPaths,
+                openspecCandidatePaths: candidatePaths,
+            });
+        }
+        if (openspecPolicy === "cited") {
+            const parsedCitations = parseOpenspecCitations(planText, candidateRoot);
+            const citedPaths = new Set(parsedCitations.citations.map((citation) => citation.path));
+            const readSet = new Set(openspecReadPaths);
+            const uncorroborated = [
+                ...new Set(componentSpecReferences
+                    .filter((ref) => !ref.normalized ||
+                    !citedPaths.has(ref.normalized) ||
+                    !readSet.has(ref.normalized))
+                    .map((ref) => ref.raw)),
+            ];
+            if (uncorroborated.length > 0) {
+                return finalizePrewrite(input, {
+                    ...basePending,
+                    verdict,
+                    candidateJsonSha256: analysis.candidateJsonSha256,
+                    normalizationActions: [],
+                    mockStrategy,
+                    classification: "retryable-invalid",
+                    failureReason: `frontend prewrite gate: these uiComponentChoices specReference paths were not cited in the plan openspec-citations block or lack a successful read event: ${uncorroborated.join(", ")}`,
+                    failureCode: "component-spec-not-cited",
+                    openspecReadPaths,
+                    openspecCandidatePaths: candidatePaths,
+                });
+            }
+        }
+    }
+    // Render the deterministic plan.md from the canonical contract (fail-closed
+    // before any artifact is written: no contract, no writer authorization).
+    let planMarkdown;
+    try {
+        planMarkdown = renderFrontendPlanMarkdown(analysis.canonical);
+    }
+    catch (error) {
+        return finalizePrewrite(input, {
+            ...basePending,
+            verdict,
+            candidateJsonSha256: analysis.candidateJsonSha256,
+            normalizationActions: [],
+            mockStrategy,
+            classification: "retryable-invalid",
+            failureReason: `frontend prewrite gate: failed to render ${input.config.planMdArtifactName ?? "frontend-plan.md"}: ${error instanceof Error ? error.message : String(error)}`,
+            failureCode: "contract-invalid",
+        });
+    }
     // Materialize the canonical contract only after every governance check passed.
     const artifact = await writeFrontendImplementationContractArtifact({
         runDir: input.runDir,
@@ -718,6 +906,8 @@ export async function runFrontendPrewriteGate(input) {
         artifactName: input.config.artifactName,
         canonical: analysis.canonical,
     });
+    // Materialize the rendered plan.md in the same outputDir as the contract.
+    await writeTextArtifactFile(path.join(input.runDir, path.posix.join(input.config.outputDir, input.config.planMdArtifactName ?? "frontend-plan.md")), planMarkdown);
     const classification = analysis.normalizationActions.length > 0 ? "accepted-normalized" : "accepted";
     return finalizePrewrite(input, {
         ...basePending,

package/dist/workflows/dag/frontend-test-case-quality.js

@@ -1,25 +1,17 @@
 import { readFile, writeFile, mkdir } from "node:fs/promises";
 import path from "node:path";
+import { markdownSection } from "./frontend-test-markdown.js";
 const CASE_ID = /^FE-[A-Za-z0-9]+-\d{3}-(?:core|boundary|flow|backend)$/i;
 const AC_ID = /^AC(?:-[A-Z0-9]+)+$/i;
 const PLACEHOLDER = /\b(?:TODO|TBD|FIXME)\b|结果正确|页面正常|按实际情况处理|验证成功/i;
 const SECTION_ALIASES = {
     purpose: ["Test Purpose", "测试目的", "测试场景"],
     source: ["Source References", "需求依据"],
-    preconditions: ["Preconditions", "前置条件"],
-    steps: ["Steps", "操作步骤"],
+    preconditions: ["Preconditions", "前置条件", "前置条件与重置"],
+    steps: ["Test Steps", "测试步骤", "Steps", "操作步骤"],
     expected: ["Expected Results", "预期结果"],
     automation: ["Automation Notes", "自动化映射", "自动化说明"],
 };
-function section(body, names) {
-    const marker = new RegExp(`^###\\s+(?:${names.map((v) => v.replace(/[.*+?^${}()|[\\]\\]/g, "\\$&")).join("|")})\\s*$`, "mi");
-    const hit = marker.exec(body);
-    if (!hit)
-        return "";
-    const rest = body.slice(hit.index + hit[0].length);
-    const next = /^###\s+/m.exec(rest);
-    return rest.slice(0, next?.index ?? rest.length).trim();
-}
 function hasList(value) { return /^\s*(?:\d+[.)]|[-*+])\s+\S+/m.test(value); }
 function hasAssertion(value) { return /(?:status|状态|包含|显示|等于|为|可见|不可见|跳转|错误|成功|失败|should|expect|assert|must)/i.test(value); }
 export async function validateFrontendCaseContent(input) {
@@ -69,9 +61,9 @@ export async function validateFrontendCaseContent(input) {
         if (PLACEHOLDER.test(body))
             findings.push({ ruleId: "placeholder-wording", caseId: id, detail: "case contains placeholder or non-assertable wording" });
         for (const [key, names] of Object.entries(SECTION_ALIASES))
-            if (!section(body, names))
+            if (!markdownSection(body, names))
                 findings.push({ ruleId: `missing-${key}`, caseId: id, detail: `missing section: ${names.join(" or ")}` });
-        const steps = section(body, SECTION_ALIASES.steps), expected = section(body, SECTION_ALIASES.expected);
+        const steps = markdownSection(body, SECTION_ALIASES.steps), expected = markdownSection(body, SECTION_ALIASES.expected);
         if (!hasList(steps))
             findings.push({ ruleId: "unstructured-steps", caseId: id, detail: "steps should contain numbered or bulleted executable actions" });
         if (!hasList(expected) || !hasAssertion(expected))

package/dist/workflows/dag/frontend-test-environment-probe.js

@@ -0,0 +1,227 @@
+import { spawnSync } from "node:child_process";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import path from "node:path";
+export const FRONTEND_TEST_CONTEXT_REL = "testcase/frontend/rag/context.md";
+export const FRONTEND_TEST_PROBE_REL = "testcase/frontend/rag/environment-probe.json";
+const CONNECTION_REFUSED_HINT = "被测服务未在 baseUrl 监听（connection refused）。请先启动本地前端（例如 scripts/serve.sh 或项目约定的 npm start），确认可访问后再从 materialize-frontend-test-execution-shell 续跑。";
+export function classifyFrontendBaseUrlProbeFailure(input) {
+    if (input.spawnError)
+        return { errorClass: "spawn-error" };
+    const exit = input.curlExit ?? 0;
+    if (exit === 7) {
+        return { errorClass: "connection-refused", hint: CONNECTION_REFUSED_HINT };
+    }
+    if (exit === 6) {
+        return {
+            errorClass: "dns-unresolved",
+            hint: "无法解析 baseUrl 主机名。确认 context.md 中的地址可在本机解析，或改用 127.0.0.1。",
+        };
+    }
+    if (exit === 28) {
+        return {
+            errorClass: "connect-timeout",
+            hint: "连接 baseUrl 超时。确认被测服务已启动且端口可访问。",
+        };
+    }
+    if (exit !== 0)
+        return { errorClass: `curl-exit-${exit}` };
+    if (input.httpStatus && Number.isFinite(input.httpStatus)) {
+        return { errorClass: `http-${input.httpStatus}` };
+    }
+    return { errorClass: "unreachable" };
+}
+function defaultCurlRunner(args) {
+    const result = spawnSync("curl", [...args], { encoding: "utf8" });
+    return {
+        status: result.status,
+        stdout: result.stdout ?? "",
+        stderr: result.stderr ?? "",
+        error: result.error,
+    };
+}
+function redactUrl(value) {
+    try {
+        const parsed = new URL(value);
+        parsed.username = "";
+        parsed.password = "";
+        parsed.search = "";
+        return parsed.toString();
+    }
+    catch {
+        return value.replace(/\/\/[^@\s]+@/g, "//");
+    }
+}
+function resolveBaseUrl(context) {
+    const patterns = [
+        /baseUrl\s*[:=]\s*["'`]?((?:https?):\/\/[^\s"'`<>]+)/i,
+        /base[-_ ]url\s*[:=]\s*["'`]?((?:https?):\/\/[^\s"'`<>]+)/i,
+        /playwright-cli open --browser=chrome\s+((?:https?):\/\/[^\s"'`<>]+)/i,
+        /(https?:\/\/(?:localhost|127\.0\.0\.1)[^\s)}\],"']*)/i,
+    ];
+    for (const pattern of patterns) {
+        const match = context.match(pattern);
+        if (match?.[1])
+            return match[1].replace(/[)}\],"'.`]+$/g, "");
+    }
+    return null;
+}
+async function writeProbe(workspaceRoot, probe) {
+    const probePath = path.join(workspaceRoot, FRONTEND_TEST_PROBE_REL);
+    const contextPath = path.join(workspaceRoot, FRONTEND_TEST_CONTEXT_REL);
+    await mkdir(path.dirname(probePath), { recursive: true });
+    await writeFile(probePath, `${JSON.stringify(probe, null, 2)}\n`, "utf8");
+    let context = "";
+    try {
+        context = await readFile(contextPath, "utf8");
+    }
+    catch {
+        context = "";
+    }
+    const line = `environmentProbe: ${probe.status}${probe.blockedReason ? ` (${probe.blockedReason})` : ""}`;
+    const next = /environmentProbe\s*[:=]/i.test(context)
+        ? context.replace(/environmentProbe\s*[:=]\s*.*/i, line)
+        : `${context.trimEnd()}\n\n${line}\n`;
+    await writeFile(contextPath, next, "utf8");
+}
+export async function probeFrontendTestEnvironment(input) {
+    const curl = input.curl ?? defaultCurlRunner;
+    const contextPath = path.join(input.workspaceRoot, FRONTEND_TEST_CONTEXT_REL);
+    let context;
+    try {
+        context = await readFile(contextPath, "utf8");
+    }
+    catch {
+        return { ok: false, stderr: `missing ${FRONTEND_TEST_CONTEXT_REL}` };
+    }
+    const rawUrl = resolveBaseUrl(context);
+    if (!rawUrl) {
+        return {
+            ok: false,
+            stderr: "frontend-test preflight missing absolute baseUrl from context.md",
+        };
+    }
+    let parsed;
+    try {
+        parsed = new URL(rawUrl);
+    }
+    catch {
+        return { ok: false, stderr: `baseUrl must be absolute http(s): ${rawUrl}` };
+    }
+    if ((parsed.protocol !== "http:" && parsed.protocol !== "https:") ||
+        parsed.username ||
+        parsed.password ||
+        parsed.search ||
+        parsed.hash) {
+        return {
+            ok: false,
+            stderr: `unsafe baseUrl from context.md: ${redactUrl(rawUrl)}`,
+        };
+    }
+    if (/(?:^|\.)(?:www\.)?[^.]*?(?:prod|production)/i.test(parsed.hostname)) {
+        return {
+            ok: false,
+            stderr: `production URL forbidden: ${redactUrl(rawUrl)}`,
+        };
+    }
+    const baseUrl = parsed.toString();
+    const safe = redactUrl(baseUrl);
+    const sourceMatch = context.match(/baseUrlSource\s*[:=]\s*([^\r\n]+)/i);
+    const baseUrlSource = sourceMatch ? sourceMatch[1].trim() : "context.md";
+    const failBlocked = async (reason, extra) => {
+        const probe = {
+            status: "unreachable",
+            blockedReason: reason,
+            baseUrlRedacted: extra.baseUrlRedacted ?? safe,
+            httpStatus: extra.httpStatus ?? null,
+            method: extra.method ?? null,
+            curlExit: extra.curlExit ?? null,
+            errorClass: extra.errorClass ?? null,
+            ...(extra.hint ? { hint: extra.hint } : {}),
+            ...(extra.baseUrlSource ? { baseUrlSource: extra.baseUrlSource } : {}),
+        };
+        await writeProbe(input.workspaceRoot, probe);
+        const payload = {
+            blockedReason: reason,
+            baseUrl: probe.baseUrlRedacted,
+            httpStatus: probe.httpStatus,
+            errorClass: probe.errorClass,
+            ...(probe.hint ? { hint: probe.hint } : {}),
+        };
+        return {
+            ok: false,
+            stderr: `frontend-test preflight blocked: ${JSON.stringify(payload)}`,
+            probe,
+        };
+    };
+    const curlCheck = curl(["--version"]);
+    if (curlCheck.error || curlCheck.status !== 0) {
+        return failBlocked("curl-unavailable", {
+            baseUrlRedacted: safe,
+            errorClass: "curl-missing",
+        });
+    }
+    const probeMethod = (method) => curl([
+        "-sS",
+        "-o",
+        "/dev/null",
+        "-w",
+        "%{http_code}",
+        "--connect-timeout",
+        "3",
+        "--max-time",
+        "8",
+        "-X",
+        method,
+        "-L",
+        "--max-redirs",
+        "3",
+        "--http1.1",
+        "--proto-redir",
+        "=http,https",
+        safe,
+    ]);
+    let used = "HEAD";
+    let result = probeMethod("HEAD");
+    let code = String(result.stdout || "").trim();
+    let statusNum = Number.parseInt(code, 10);
+    const headRejected = result.status !== 0 || !statusNum || statusNum === 405 || statusNum === 501;
+    if (headRejected) {
+        used = "GET";
+        result = probeMethod("GET");
+        code = String(result.stdout || "").trim();
+        statusNum = Number.parseInt(code, 10);
+    }
+    const ok = statusNum >= 200 && statusNum < 400;
+    if (!ok) {
+        const classified = classifyFrontendBaseUrlProbeFailure({
+            spawnError: Boolean(result.error),
+            curlExit: result.status,
+            httpStatus: Number.isFinite(statusNum) ? statusNum : null,
+        });
+        return failBlocked("frontend-base-url-unreachable", {
+            baseUrlRedacted: safe,
+            httpStatus: Number.isFinite(statusNum) ? statusNum : null,
+            method: used,
+            curlExit: result.status,
+            errorClass: classified.errorClass,
+            hint: classified.hint,
+        });
+    }
+    const probe = {
+        status: "reachable",
+        blockedReason: null,
+        baseUrl: safe,
+        baseUrlRedacted: safe,
+        baseUrlSource,
+        httpStatus: statusNum,
+        method: used,
+        curlExit: result.status,
+        errorClass: null,
+    };
+    await writeProbe(input.workspaceRoot, probe);
+    return {
+        ok: true,
+        stdout: `frontend-test-execution-v1 validated contextBaseUrl=${safe} source=${baseUrlSource} probe=reachable method=${used} httpStatus=${statusNum}`,
+        probe,
+    };
+}

package/dist/workflows/dag/frontend-test-markdown.js

@@ -0,0 +1,61 @@
+/**
+ * Bounded ATX section/list parsing for frontend-test case Markdown.
+ * Generator cases use `##` headings; older fixtures use `###`.
+ */
+const ATX_HEADING = /^(#{1,3})\s+(\S.*)$/;
+function headingMatches(title, names) {
+    const normalized = title.trim();
+    return names.some((name) => {
+        if (normalized === name)
+            return true;
+        return (normalized.startsWith(name) &&
+            (normalized.length === name.length ||
+                /[\s:：与(（-]/.test(normalized.charAt(name.length))));
+    });
+}
+export function markdownSection(body, names) {
+    const lines = body.replace(/\r\n/g, "\n").split("\n");
+    let start = -1;
+    let startLevel = 0;
+    for (let index = 0; index < lines.length; index += 1) {
+        const match = ATX_HEADING.exec(lines[index]);
+        if (!match)
+            continue;
+        if (!headingMatches(match[2], names))
+            continue;
+        start = index;
+        startLevel = match[1].length;
+        break;
+    }
+    if (start < 0)
+        return "";
+    const collected = [];
+    for (let index = start + 1; index < lines.length; index += 1) {
+        const match = ATX_HEADING.exec(lines[index]);
+        if (match && match[1].length <= startLevel)
+            break;
+        collected.push(lines[index]);
+    }
+    return collected.join("\n").trim();
+}
+export function markdownList(value) {
+    const items = [];
+    for (const raw of value.replace(/\r\n/g, "\n").split("\n")) {
+        const listed = raw.match(/^\s*(?:\d+[.)]|[-*+])\s+(.*)$/);
+        if (listed) {
+            const text = listed[1].trim();
+            if (text)
+                items.push(text);
+            continue;
+        }
+        const continuation = raw.match(/^\s{2,}(\S.*)$/);
+        if (continuation && items.length > 0) {
+            items[items.length - 1] = `${items[items.length - 1]} ${continuation[1].trim()}`;
+        }
+    }
+    return items;
+}
+export function markdownH1Title(body) {
+    const match = /^#\s+(\S.*)$/m.exec(body.replace(/\r\n/g, "\n"));
+    return match?.[1]?.trim() ?? "";
+}