@tea-agent/loop-agent 0.39.3 → 0.40.0-beta.2

package/dist/workflows/dag/rerun-run.js

@@ -1,13 +1,14 @@
-import { createHash } from "node:crypto";
-import { access, copyFile, mkdir, readdir, readFile } from "node:fs/promises";
+import { createHash, timingSafeEqual } from "node:crypto";
+import { access, copyFile, lstat, mkdir, readdir, readFile, writeFile } from "node:fs/promises";
 import path from "node:path";
+import { z } from "zod";
 import { writeJsonAtomic } from "../../infrastructure/harness/atomic-write.js";
 import { composeDagPromptOverridePrompt, isDagRerunPromptOverrideEnabled, } from "../../shared/dag-prompt-override.js";
 import { resolveRunningControllerIdentity } from "../../shared/package-metadata.js";
 import { readControllerIdentityArtifact, captureControllerIdentity } from "./controller-identity.js";
 import { DAG_RUNS_DIR, getDagRunDir, isDagNonExecutionLifecycle, locateDagRun, readDagRunSpec, readDagRunState, } from "./lifecycle.js";
 import { buildDagRunId, runDagContinuation, } from "./runner.js";
-import { computePlanHash, evaluateDagRerunPlan, evaluateLiveDagRerunBindings, } from "./rerun-plan.js";
+import { computePlanHash, evaluateArtifactOverrideRerunPlan, evaluateDagRerunPlan, evaluateLiveDagRerunBindings, } from "./rerun-plan.js";
 import { prepareActiveRunDir, writeNodeRecord, writeRunSpec, writeRunState, } from "./run-store.js";
 import { cloneParentSkillSnapshotForContinuation, readSkillSnapshot, } from "./skill-snapshot.js";
 import { topoSortToRanks } from "./topo.js";
@@ -18,6 +19,35 @@ export const WORKER_ASSOCIATION_REL_PATH = ".runtime/worker-association.json";
 function sha256Hex(content) {
     return createHash("sha256").update(content).digest("hex");
 }
+function constantTimeHashEqual(left, right) {
+    if (!/^[a-f0-9]{64}$/.test(left) || !/^[a-f0-9]{64}$/.test(right))
+        return false;
+    return timingSafeEqual(Buffer.from(left, "hex"), Buffer.from(right, "hex"));
+}
+export async function snapshotDagRunManifest(runDir) {
+    const entries = [];
+    const walk = async (dir) => {
+        for (const entry of (await readdir(dir, { withFileTypes: true })).sort((a, b) => a.name.localeCompare(b.name))) {
+            const absolute = path.join(dir, entry.name);
+            const relative = normalizeRunRelativePath(path.relative(runDir, absolute));
+            if (entry.isSymbolicLink())
+                throw new Error(`symlink rejected in DAG run manifest: ${relative}`);
+            if (entry.isDirectory()) {
+                await walk(absolute);
+                continue;
+            }
+            if (!entry.isFile())
+                throw new Error(`non-regular DAG run entry: ${relative}`);
+            const stat = await lstat(absolute);
+            if (stat.nlink !== 1)
+                throw new Error(`hardlink rejected in DAG run manifest: ${relative}`);
+            const bytes = await readFile(absolute);
+            entries.push({ path: relative, sha256: sha256Hex(bytes), bytes: bytes.byteLength });
+        }
+    };
+    await walk(runDir);
+    return sha256Hex(JSON.stringify(entries));
+}
 async function fileExists(filePath) {
     try {
         await access(filePath);
@@ -30,18 +60,67 @@ async function fileExists(filePath) {
 function operatorRequestPath(cwd, requestId) {
     return path.join(cwd, DAG_RUNS_DIR, ".operator-requests", `${requestId}.json`);
 }
+/** Strict envelope for persisted operator-request replays (SF2). */
+const operatorRequestEnvelopeSchema = z
+    .object({
+    schemaVersion: z.literal(1),
+    kind: z.literal("dag-rerun-from-node-request"),
+    requestId: z.string().min(1),
+    parentRunId: z.string().min(1),
+    newRunId: z.string().min(1),
+    createdAt: z.string().min(1),
+    result: z
+        .object({
+        ok: z.boolean(),
+        plan: z
+            .object({
+            parentRunId: z.string().min(1),
+            planHash: z.string().min(1),
+        })
+            .passthrough(),
+        newRunId: z.string().min(1).optional(),
+    })
+        .passthrough(),
+})
+    .strict();
 async function readExistingOperatorRequest(cwd, requestId) {
     try {
         const raw = JSON.parse(await readFile(operatorRequestPath(cwd, requestId), "utf-8"));
-        if (raw.result && typeof raw.result === "object") {
-            return { ...raw.result, idempotentReplay: true };
-        }
+        const parsed = operatorRequestEnvelopeSchema.safeParse(raw);
+        if (!parsed.success)
+            return undefined;
+        const result = parsed.data.result;
+        return {
+            ...result,
+            plan: result.plan,
+            idempotentReplay: true,
+        };
     }
     catch {
         // not found or unreadable
     }
     return undefined;
 }
+/**
+ * Idempotent replay of a previously persisted operator request, if any.
+ * When expected context is supplied, a replay that belongs to a different
+ * parent run or plan is a request-id reuse conflict rather than a valid
+ * answer.
+ */
+export async function readOperatorRequestReplay(cwd, requestId, expected) {
+    const replay = await readExistingOperatorRequest(cwd, requestId);
+    if (!replay)
+        return undefined;
+    if (expected?.parentRunId !== undefined &&
+        replay.plan?.parentRunId !== expected.parentRunId) {
+        throw new Error("REQUEST_ID_REUSE_CONFLICT: operator request replay belongs to a different parent run");
+    }
+    if (expected?.planHash !== undefined &&
+        replay.plan?.planHash !== expected.planHash) {
+        throw new Error("REQUEST_ID_REUSE_CONFLICT: operator request replay belongs to a different plan");
+    }
+    return replay;
+}
 async function persistOperatorRequest(cwd, result, requestId) {
     await writeJsonAtomic(operatorRequestPath(cwd, requestId), {
         schemaVersion: 1,
@@ -246,6 +325,52 @@ export async function planDagRerun(input) {
         bindingStatus,
     });
 }
+export async function planDagArtifactOverride(input) {
+    const located = await locateDagRun(input.cwd, input.parentRunId);
+    if (!located)
+        throw new Error(`dag run not found: ${input.parentRunId}`);
+    if (located.lifecycle !== "completed") {
+        throw new Error(`artifact continuation requires completed parent: ${input.parentRunId}`);
+    }
+    const parentSpec = await readDagRunSpec(located.runDir);
+    const parentState = await readDagRunState(located.runDir);
+    const currentWorkspace = await captureWorkspaceCheckpoint(input.cwd).catch(() => undefined);
+    const parentTerminalWorkspace = await readWorkspaceCheckpoint(located.runDir, WORKSPACE_CHECKPOINT_TERMINAL_REL);
+    const fingerprints = await resolveControllerFingerprints(located.runDir);
+    const skillSnapshotOk = await verifyParentSkillSnapshot(located.runDir, parentState, input.parentRunId);
+    const workerHints = await detectWorkerManagedRun(located.runDir, parentState, parentSpec);
+    const liveBindings = await evaluateLiveDagRerunBindings({ cwd: input.cwd, parentSpec });
+    return evaluateArtifactOverrideRerunPlan({
+        parentRunId: input.parentRunId,
+        parentSpec,
+        parentState,
+        artifactId: input.artifactId,
+        artifactOverrides: input.artifactOverrides,
+        stagingRevisionSha256: input.stagingRevisionSha256,
+        parentLifecycle: "completed",
+        bindings: {
+            ...liveBindings,
+            controllerIdentityMatched: fingerprints.currentControllerFingerprint === undefined ||
+                fingerprints.parentControllerFingerprint === undefined ||
+                fingerprints.currentControllerFingerprint === fingerprints.parentControllerFingerprint,
+            skillSnapshotVerified: skillSnapshotOk,
+            workspaceMatched: parentTerminalWorkspace?.fingerprint !== undefined &&
+                currentWorkspace?.fingerprint !== undefined &&
+                parentTerminalWorkspace.fingerprint === currentWorkspace.fingerprint,
+        },
+        workerAssociation: workerHints.workerManaged
+            ? {
+                kind: "worker-managed",
+                ...(workerHints.featureId ? { featureId: workerHints.featureId } : {}),
+                ...(workerHints.taskId ? { taskId: workerHints.taskId } : {}),
+                ...(workerHints.workerRunId ? { workerRunId: workerHints.workerRunId } : {}),
+            }
+            : { kind: "standalone" },
+        ...(input.workerContinuationAuthority
+            ? { workerContinuationAuthority: input.workerContinuationAuthority }
+            : {}),
+    });
+}
 function normalizeRunRelativePath(relPath) {
     return relPath.replace(/\\/g, "/");
 }
@@ -359,6 +484,18 @@ function buildImportedNodeRecord(parentRecord, parentRunId, sourceNodeRecordSha2
     const { origin: _origin, ...rest } = parentRecord;
     void _origin;
     const imported = structuredClone(rest);
+    imported.declaredArtifacts = imported.declaredArtifacts?.map((artifact) => ({
+        ...artifact,
+        ...(artifact.sha256
+            ? {
+                origin: {
+                    kind: "imported",
+                    parentRunId,
+                    sourceSha256: artifact.sha256,
+                },
+            }
+            : {}),
+    }));
     imported.nodeRecordPath = path.join(newRunDir, `${parentRecord.id}.json`);
     for (const key of [
         "stdoutArtifactPath",
@@ -424,6 +561,66 @@ function applyPromptOverridesToSpec(input) {
     }
     return spec;
 }
+async function applyArtifactOverrideToStagedRun(input) {
+    const override = input.plan.artifactOverrides?.overrides[0];
+    if (!override)
+        throw new Error("artifact override missing from V2 plan");
+    if (override.parentArtifact.runId !== input.parentRunId) {
+        throw new Error("artifact override parent run drift");
+    }
+    if (!constantTimeHashEqual(sha256Hex(input.candidateBytes), override.replacement.sha256)) {
+        throw new Error("ARTIFACT_REVISION_DRIFT: candidate hash mismatch");
+    }
+    if (input.candidateBytes.byteLength !== override.replacement.bytes) {
+        throw new Error("ARTIFACT_REVISION_DRIFT: candidate byte length mismatch");
+    }
+    const relativePath = assertArtifactPathWithinParentRun(input.parentRunDir, override.parentArtifact.path);
+    const parentBytes = await readFile(path.join(input.parentRunDir, ...relativePath.split("/")));
+    if (!constantTimeHashEqual(sha256Hex(parentBytes), override.parentArtifact.sha256)) {
+        throw new Error("ARTIFACT_REVISION_DRIFT: parent artifact changed");
+    }
+    const destinationPath = path.join(input.newRunDir, ...relativePath.split("/"));
+    const resolvedRun = path.resolve(input.newRunDir);
+    if (!path.resolve(destinationPath).startsWith(`${resolvedRun}${path.sep}`)) {
+        throw new Error("ARTIFACT_REVISION_PATH_INVALID");
+    }
+    await mkdir(path.dirname(destinationPath), { recursive: true });
+    await writeFile(destinationPath, input.candidateBytes, { mode: 0o600 });
+    const producer = input.nodes[override.parentArtifact.nodeId];
+    if (!producer || producer.origin?.kind !== "imported") {
+        throw new Error("artifact producer must be imported into continuation");
+    }
+    producer.structuredArtifactPath = destinationPath;
+    producer.structuredArtifactSha256 = override.replacement.sha256;
+    producer.declaredArtifacts = producer.declaredArtifacts?.map((artifact) => artifact.path === relativePath && artifact.sha256 === override.parentArtifact.sha256
+        ? {
+            ...artifact,
+            sha256: override.replacement.sha256,
+            bytes: override.replacement.bytes,
+            origin: {
+                kind: "overridden",
+                parentRunId: input.parentRunId,
+                revisionId: override.revisionId,
+                supersedes: override.supersedes,
+            },
+        }
+        : artifact);
+    await writeNodeRecord(input.newRunDir, override.parentArtifact.nodeId, producer);
+    const manifestNode = input.manifestNodes.find((entry) => entry.nodeId === override.parentArtifact.nodeId);
+    if (manifestNode) {
+        manifestNode.importedArtifacts = manifestNode.importedArtifacts.filter((artifact) => artifact.destinationRelativePath !== relativePath);
+    }
+    return {
+        revisionId: override.revisionId,
+        producerNodeId: override.parentArtifact.nodeId,
+        destinationRelativePath: relativePath,
+        parentSha256: override.parentArtifact.sha256,
+        replacementSha256: override.replacement.sha256,
+        bytes: override.replacement.bytes,
+        mediaType: override.replacement.mediaType,
+        supersedes: override.supersedes,
+    };
+}
 async function stageContinuationRun(input) {
     const specForRun = input.promptOverrides !== undefined && input.promptOverrides.length > 0
         ? applyPromptOverridesToSpec({
@@ -433,7 +630,14 @@ async function stageContinuationRun(input) {
         })
         : input.parentSpec;
     const { ranks } = topoSortToRanks(specForRun);
-    const runId = await buildDagRunId(specForRun, { cwd: input.cwd });
+    const workerContinuationAuthority = input.plan.schemaVersion === 2
+        ? input.plan.workerContinuationAuthority
+        : undefined;
+    const runId = workerContinuationAuthority?.childWorkerRunId
+        ?? await buildDagRunId(specForRun, { cwd: input.cwd });
+    if (workerContinuationAuthority && await locateDagRun(input.cwd, runId)) {
+        throw new Error(`WORKER_CONTINUATION_NEEDS_RECONCILE: child DAG already exists: ${runId}`);
+    }
     const runDir = getDagRunDir(input.cwd, "active", runId);
     await prepareActiveRunDir(runDir);
     await writeRunSpec(runDir, specForRun);
@@ -483,6 +687,12 @@ async function stageContinuationRun(input) {
         ...(input.plan.promptOverrides
             ? { promptOverrides: input.plan.promptOverrides }
             : {}),
+        ...(input.plan.schemaVersion === 2 && input.plan.artifactOverrides
+            ? { artifactOverrides: input.plan.artifactOverrides }
+            : {}),
+        ...(workerContinuationAuthority
+            ? { workerContinuationAuthority }
+            : {}),
         createdAt,
     };
     const state = {
@@ -504,6 +714,16 @@ async function stageContinuationRun(input) {
         ...(input.parentState.budget
             ? { budget: structuredClone(input.parentState.budget) }
             : {}),
+        ...(workerContinuationAuthority
+            ? {
+                workerAssociation: {
+                    schemaVersion: 1,
+                    workerRunId: workerContinuationAuthority.childWorkerRunId,
+                    featureId: workerContinuationAuthority.featureId,
+                    taskId: workerContinuationAuthority.taskId,
+                },
+            }
+            : {}),
     };
     if (!input.parentState.skillSnapshotRef) {
         throw new Error("parent run is missing skill snapshot ref");
@@ -523,11 +743,23 @@ async function stageContinuationRun(input) {
     catch (error) {
         console.warn(`[dag rerun] warning: failed to write workspace start checkpoint: ${error instanceof Error ? error.message : String(error)}`);
     }
+    const overrideManifest = input.plan.schemaVersion === 2 && input.plan.trigger === "artifact-override"
+        ? [await applyArtifactOverrideToStagedRun({
+                parentRunDir: input.parentRunDir,
+                newRunDir: runDir,
+                parentRunId: input.parentRunId,
+                plan: input.plan,
+                candidateBytes: input.artifactCandidateBytes ?? Buffer.alloc(0),
+                nodes,
+                manifestNodes: importManifestNodes,
+            })]
+        : undefined;
     const importManifest = {
         schemaVersion: 1,
         parentRunId: input.parentRunId,
         createdAt,
         nodes: importManifestNodes,
+        ...(overrideManifest ? { overrides: overrideManifest } : {}),
     };
     await writeJsonAtomic(path.join(runDir, IMPORT_MANIFEST_REL_PATH), importManifest);
     await writeJsonAtomic(path.join(runDir, RERUN_PLAN_REL_PATH), input.plan);
@@ -535,9 +767,16 @@ async function stageContinuationRun(input) {
     return { runId, runDir, state, spec: specForRun };
 }
 export async function executeDagRerun(input) {
-    const existing = await readExistingOperatorRequest(input.cwd, input.requestId);
-    if (existing) {
-        return existing;
+    // Replay-first with SF2 envelope validation at the core boundary (same
+    // contract as executeDagArtifactOverrideRerun): an existing operator
+    // request is only a valid idempotent answer when it matches the requested
+    // parent run and plan hash; otherwise REQUEST_ID_REUSE_CONFLICT.
+    const replay = await readOperatorRequestReplay(input.cwd, input.requestId, {
+        parentRunId: input.parentRunId,
+        planHash: input.planHash,
+    });
+    if (replay) {
+        return replay;
     }
     const plan = await planDagRerun({
         cwd: input.cwd,
@@ -545,7 +784,7 @@ export async function executeDagRerun(input) {
         selectedNodeId: input.selectedNodeId,
         promptOverrides: input.promptOverrides,
     });
-    if (plan.planHash !== input.planHash) {
+    if (!constantTimeHashEqual(plan.planHash, input.planHash)) {
         return {
             ok: false,
             plan,
@@ -602,10 +841,149 @@ export async function executeDagRerun(input) {
         summary,
     };
     if (await fileExists(operatorRequestPath(input.cwd, input.requestId))) {
-        const replay = await readExistingOperatorRequest(input.cwd, input.requestId);
+        const replay = await readOperatorRequestReplay(input.cwd, input.requestId, {
+            parentRunId: input.parentRunId,
+            planHash: input.planHash,
+        });
         if (replay)
             return replay;
     }
     await persistOperatorRequest(input.cwd, result, input.requestId);
     return result;
 }
+export async function executeDagArtifactOverrideRerun(input) {
+    // Replay-first, but with SF2 envelope validation at the core boundary: an
+    // existing operator request is only an idempotent answer when it belongs to
+    // the same parent run AND the same plan hash. A caller that supplies a
+    // different planHash/parent (direct call or a race between CLI validation
+    // and this core) must get REQUEST_ID_REUSE_CONFLICT, never an unvalidated
+    // replay.
+    const replay = await readOperatorRequestReplay(input.cwd, input.requestId, {
+        parentRunId: input.parentRunId,
+        planHash: input.planHash,
+    });
+    if (replay)
+        return replay;
+    const plan = await planDagArtifactOverride({
+        cwd: input.cwd,
+        parentRunId: input.parentRunId,
+        artifactId: input.artifactId,
+        artifactOverrides: input.artifactOverrides,
+        stagingRevisionSha256: input.stagingRevisionSha256,
+        ...(input.workerContinuationAuthority
+            ? { workerContinuationAuthority: input.workerContinuationAuthority }
+            : {}),
+    });
+    if (!constantTimeHashEqual(plan.planHash, input.planHash)) {
+        return {
+            ok: false,
+            plan,
+            errorCode: "RERUN_PLAN_DRIFT",
+            message: "plan hash mismatch; refresh impact preview before executing",
+        };
+    }
+    if (!plan.eligible) {
+        return {
+            ok: false,
+            plan,
+            errorCode: "INELIGIBLE",
+            message: plan.blockedReasons.join(", ") || "artifact continuation is not eligible",
+        };
+    }
+    const override = plan.artifactOverrides?.overrides[0];
+    if (!override || !constantTimeHashEqual(sha256Hex(input.candidateBytes), override.replacement.sha256)) {
+        return {
+            ok: false,
+            plan,
+            errorCode: "ARTIFACT_REVISION_DRIFT",
+            message: "staged revision bytes no longer match the plan",
+        };
+    }
+    const located = await locateDagRun(input.cwd, input.parentRunId);
+    if (!located || located.lifecycle !== "completed") {
+        return {
+            ok: false,
+            plan,
+            errorCode: "PARENT_LIFECYCLE",
+            message: `parent run must be completed: ${input.parentRunId}`,
+        };
+    }
+    const parentManifestBefore = await snapshotDagRunManifest(located.runDir);
+    const parentSpec = await readDagRunSpec(located.runDir);
+    const parentState = await readDagRunState(located.runDir);
+    let staged;
+    try {
+        staged = await stageContinuationRun({
+            cwd: input.cwd,
+            parentRunDir: located.runDir,
+            parentRunId: input.parentRunId,
+            parentSpec,
+            parentState,
+            plan,
+            reason: input.reason,
+            requestId: input.requestId,
+            artifactCandidateBytes: input.candidateBytes,
+        });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        if (message.startsWith("WORKER_CONTINUATION_NEEDS_RECONCILE:")) {
+            const result = {
+                ok: false,
+                plan,
+                newRunId: input.workerContinuationAuthority?.childWorkerRunId,
+                errorCode: "WORKER_CONTINUATION_NEEDS_RECONCILE",
+                message,
+            };
+            await persistOperatorRequest(input.cwd, result, input.requestId);
+            return result;
+        }
+        throw error;
+    }
+    const parentManifestAfterStage = await snapshotDagRunManifest(located.runDir);
+    if (!constantTimeHashEqual(parentManifestBefore, parentManifestAfterStage)) {
+        return {
+            ok: false,
+            plan,
+            newRunId: staged.runId,
+            runDir: staged.runDir,
+            errorCode: "PARENT_IMMUTABILITY_VIOLATION",
+            message: "parent run changed while staging the child; child execution was blocked",
+        };
+    }
+    if (input.consumeRevision) {
+        await input.consumeRevision({
+            revisionId: override.revisionId,
+            expectedSha256: override.replacement.sha256,
+        });
+    }
+    const summary = await runDagContinuation({
+        cwd: input.cwd,
+        spec: staged.spec,
+        state: staged.state,
+        runDir: staged.runDir,
+        ...(input.maxConcurrent !== undefined ? { maxConcurrent: input.maxConcurrent } : {}),
+        ...(input.executeNode ? { executeNode: input.executeNode } : {}),
+    });
+    const parentManifestAfterRun = await snapshotDagRunManifest(located.runDir);
+    const immutable = constantTimeHashEqual(parentManifestBefore, parentManifestAfterRun);
+    const result = immutable
+        ? {
+            ok: summary.status === "finished",
+            plan,
+            newRunId: summary.runId,
+            runDir: summary.runDir,
+            summary,
+        }
+        : {
+            ok: false,
+            plan,
+            newRunId: summary.runId,
+            runDir: summary.runDir,
+            summary,
+            errorCode: "PARENT_IMMUTABILITY_VIOLATION",
+            message: "parent run manifest changed during child execution",
+        };
+    await persistOperatorRequest(input.cwd, result, input.requestId);
+    return result;
+}

package/dist/workflows/dag/skill-snapshot.js

@@ -540,6 +540,7 @@ export function buildNodePromptFromSnapshot(input) {
             spec: input.spec,
             task: input.task,
             upstream: input.upstream,
+            runDir: input.runDir,
             resolvedSkills: skillNames,
             resolvedSkillInstructions,
             maxUpstreamChars: policy.resolveMaxUpstreamChars(input.task),