@tea-agent/loop-agent 0.41.0 → 0.42.0-next.1

package/dist/commands/dag-artifact.js

@@ -0,0 +1,284 @@
+import { createHash } from "node:crypto";
+import { lstat, readFile } from "node:fs/promises";
+import path from "node:path";
+import { readRevisionParentArtifact } from "../workflows/dag/context-transfer/operator-actions.js";
+import { readFileBoundarySafe } from "../shared/path-safety.js";
+import { openConsoleAppData } from "../infrastructure/console/app-data.js";
+import { artifactRevisionUploadPath, createArtifactRevision, discardArtifactRevision, acquireArtifactRevisionLease, releaseArtifactRevisionLease, } from "../infrastructure/console/artifact-revision-store.js";
+import { OperationStore } from "../infrastructure/console/operation-store.js";
+import { buildArtifactBindingGraph } from "../workflows/dag/artifact-bindings.js";
+import { resolveArtifactRevisionSchema } from "../workflows/dag/artifact-revision-schema-registry.js";
+import { locateDagRun, readDagRunSpec } from "../workflows/dag/lifecycle.js";
+function parseArtifactArgs(args) {
+    const [first, second] = args;
+    const action = first === "consumers"
+        ? "consumers"
+        : first === "revision" && second === "stage"
+            ? "stage"
+            : first === "revision" && second === "discard"
+                ? "discard"
+                : undefined;
+    if (!action) {
+        throw new Error("usage: dag artifact consumers --run-id <run> --node-id <producer> --artifact <path> [--json] | dag artifact revision <stage|discard> ...");
+    }
+    let runId;
+    let nodeId;
+    let artifactPath;
+    let artifactId;
+    let file;
+    let candidateUpload;
+    let revisionId;
+    let requestId;
+    let json = false;
+    for (let index = action === "consumers" ? 1 : 2; index < args.length; index += 1) {
+        const arg = args[index];
+        const next = () => args[++index];
+        if (arg === "--run-id")
+            runId = next();
+        else if (arg.startsWith("--run-id="))
+            runId = arg.slice(9);
+        else if (arg === "--node-id")
+            nodeId = next();
+        else if (arg.startsWith("--node-id="))
+            nodeId = arg.slice(10);
+        else if (arg === "--artifact")
+            artifactPath = next();
+        else if (arg.startsWith("--artifact="))
+            artifactPath = arg.slice(11);
+        else if (arg === "--artifact-id")
+            artifactId = next();
+        else if (arg.startsWith("--artifact-id="))
+            artifactId = arg.slice(14);
+        else if (arg === "--file")
+            file = next();
+        else if (arg.startsWith("--file="))
+            file = arg.slice(7);
+        else if (arg === "--candidate-upload")
+            candidateUpload = next();
+        else if (arg.startsWith("--candidate-upload="))
+            candidateUpload = arg.slice(19);
+        else if (arg === "--revision-id")
+            revisionId = next();
+        else if (arg.startsWith("--revision-id="))
+            revisionId = arg.slice(14);
+        else if (arg === "--request-id")
+            requestId = next();
+        else if (arg.startsWith("--request-id="))
+            requestId = arg.slice(13);
+        else if (arg === "--json")
+            json = true;
+        else
+            throw new Error(`unknown dag artifact flag: ${arg}`);
+    }
+    return { action, runId, nodeId, artifactPath, artifactId, file, candidateUpload, revisionId, requestId, json };
+}
+function sha256(bytes) {
+    return createHash("sha256").update(bytes).digest("hex");
+}
+function print(value, json, fallback) {
+    process.stdout.write(json ? `${JSON.stringify(value, null, 2)}\n` : `${fallback}\n`);
+}
+export async function runDagArtifactCore(repoRoot, args, cliOptions) {
+    const input = parseArtifactArgs(args);
+    if (input.action === "discard") {
+        if (!input.revisionId || !input.requestId) {
+            throw new Error("dag artifact revision discard requires --revision-id and --request-id");
+        }
+        const appData = openConsoleAppData({ repoRoot, ...(cliOptions?.appDataRoot ? { appDataRoot: cliOptions.appDataRoot } : {}) });
+        const operations = new OperationStore(appData);
+        const created = await operations.create({
+            clientRequestId: input.requestId,
+            action: "cliArtifactRevisionDiscard",
+            actionParams: { revisionId: input.revisionId },
+        });
+        if (created.kind === "conflict")
+            throw new Error(created.code);
+        if (created.kind === "idempotent" && created.operation.state === "succeeded") {
+            return asRecord(created.operation.result);
+        }
+        const leaseHolder = `cli-discard:${input.requestId}`;
+        const revision = await acquireArtifactRevisionLease({
+            appData,
+            revisionId: input.revisionId,
+            holder: leaseHolder,
+        })
+            .then(() => discardArtifactRevision({
+            appData,
+            revisionId: input.revisionId,
+            holder: leaseHolder,
+        }))
+            .finally(() => releaseArtifactRevisionLease({
+            appData,
+            revisionId: input.revisionId,
+            holder: leaseHolder,
+        }).catch(() => { }));
+        const result = { ok: true, revisionId: revision.revisionId, state: revision.state };
+        await operations.update(created.operation.operationId, {
+            state: "succeeded",
+            startedAt: created.operation.createdAt,
+            finishedAt: new Date().toISOString(),
+            result,
+        });
+        return result;
+    }
+    if (!input.runId || !input.nodeId || (!input.artifactPath && !input.artifactId)) {
+        throw new Error("dag artifact requires --run-id, --node-id, and --artifact <relative-path> or --artifact-id <id>");
+    }
+    const located = await locateDagRun(repoRoot, input.runId);
+    if (!located)
+        throw new Error(`dag run not found: ${input.runId}`);
+    const graph = buildArtifactBindingGraph(await readDagRunSpec(located.runDir));
+    const declaration = graph.artifacts.find((item) => item.producerNodeId === input.nodeId &&
+        (input.artifactId
+            ? item.artifactId === input.artifactId
+            : item.path === input.artifactPath));
+    if (!declaration)
+        throw new Error("ARTIFACT_BINDING_UNAVAILABLE");
+    if (input.action === "consumers") {
+        return {
+            schemaVersion: 1,
+            runId: input.runId,
+            nodeId: input.nodeId,
+            artifactId: declaration.artifactId,
+            artifactPath: declaration.path,
+            directConsumerNodeIds: declaration.directConsumerNodeIds,
+            graphSha256: graph.artifactGraphSha256,
+        };
+    }
+    if (!input.requestId || (!input.file && !input.candidateUpload)) {
+        throw new Error("dag artifact revision stage requires --file or --candidate-upload, and --request-id");
+    }
+    const appData = openConsoleAppData({
+        repoRoot,
+        ...(cliOptions?.appDataRoot ? { appDataRoot: cliOptions.appDataRoot } : {}),
+    });
+    // The candidate upload lives in app-data and is cross-process mutable;
+    // resolve + read it TOCTOU-safe (O_NOFOLLOW fd read) instead of
+    // lstat-then-readFile, so a swapped symlink can never feed an unintended
+    // file into the stage. Both the path resolution (assertSafeAppDataPath
+    // rejects symlinks/hardlinks) and the fd read map to the stable
+    // ARTIFACT_REVISION_PATH_INVALID code.
+    let candidateBytes;
+    if (input.candidateUpload) {
+        try {
+            if (!/^[a-f0-9]{64}$/.test(input.candidateUpload)) {
+                throw new Error("invalid --candidate-upload hash");
+            }
+            const candidatePath = artifactRevisionUploadPath(appData, input.candidateUpload);
+            candidateBytes = await readFileBoundarySafe({
+                boundaryRoot: path.dirname(candidatePath),
+                targetPath: candidatePath,
+                label: "candidate upload",
+            });
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            if (/symlink|hardlink|single-link|regular|boundary|escap|app-data/i.test(message)) {
+                throw new Error("ARTIFACT_REVISION_PATH_INVALID");
+            }
+            throw error;
+        }
+    }
+    else {
+        const candidatePath = path.resolve(repoRoot, input.file);
+        const stat = await lstat(candidatePath);
+        if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1) {
+            throw new Error("candidate must be an owned regular file");
+        }
+        candidateBytes = await readFile(candidatePath);
+    }
+    if (candidateBytes.byteLength > 10 * 1024 * 1024)
+        throw new Error("candidate exceeds 10 MiB");
+    const operations = new OperationStore(appData);
+    const actionParams = {
+        runId: input.runId,
+        nodeId: input.nodeId,
+        artifactPath: declaration.path,
+        candidateSha256: sha256(candidateBytes),
+        candidateBytes: candidateBytes.byteLength,
+    };
+    const created = await operations.create({
+        clientRequestId: input.requestId,
+        action: "cliArtifactRevisionStage",
+        actionParams,
+    });
+    if (created.kind === "conflict")
+        throw new Error(created.code);
+    if (created.kind === "idempotent" && created.operation.state === "succeeded") {
+        return asRecord(created.operation.result);
+    }
+    const parent = await readRevisionParentArtifact({
+        cwd: repoRoot,
+        runId: input.runId,
+        producerNodeId: input.nodeId,
+        artifactId: declaration.artifactId,
+    });
+    const revision = await createArtifactRevision({
+        appData,
+        parentRunId: input.runId,
+        producerNodeId: input.nodeId,
+        declaration: parent.declaration,
+        parentSha256: parent.parentSha256,
+        parentBytes: parent.parentBytes,
+        candidateBytes,
+        mediaType: declaration.mediaType,
+        artifactSchemaResolver: resolveArtifactRevisionSchema,
+    });
+    const projected = {
+        revisionId: revision.revisionId,
+        state: revision.state,
+        parent: revision.parent,
+        candidate: {
+            sha256: revision.candidate.sha256,
+            bytes: revision.candidate.bytes,
+            mediaType: revision.candidate.mediaType,
+            uploadedAt: revision.candidate.uploadedAt,
+        },
+        validation: revision.validation,
+        diff: {
+            kind: revision.diff.kind,
+            summary: revision.diff.summary,
+            truncated: revision.diff.truncated,
+        },
+        expiresAt: revision.expiresAt,
+    };
+    const result = { ok: true, revision: projected };
+    await operations.update(created.operation.operationId, {
+        state: "succeeded",
+        startedAt: created.operation.createdAt,
+        finishedAt: new Date().toISOString(),
+        result,
+    });
+    return result;
+}
+function asRecord(value) {
+    return value && typeof value === "object" ? value : { ok: true };
+}
+export async function runDagArtifact(repoRoot, args) {
+    const input = parseArtifactArgs(args);
+    try {
+        const result = await runDagArtifactCore(repoRoot, args);
+        if (input.action === "discard") {
+            print(result, input.json, `Discarded ${String(result.revisionId ?? "")}`);
+        }
+        else if (input.action === "consumers") {
+            const consumers = result;
+            print(result, input.json, `${consumers.artifactPath}: ${(consumers.directConsumerNodeIds ?? []).join(", ") || "no consumers"}`);
+        }
+        else {
+            print(result, input.json, `Staged revision ${String(result.revisionId ?? "")}`);
+        }
+    }
+    catch (error) {
+        if (!input.json)
+            throw error;
+        const message = error instanceof Error ? error.message : String(error);
+        const candidateCode = message.split(":", 1)[0]?.trim() ?? "";
+        const code = /^[A-Z][A-Z0-9_]+$/.test(candidateCode)
+            ? candidateCode
+            : "INTERNAL_ERROR";
+        process.stdout.write(`${JSON.stringify({ schemaVersion: 1, ok: false, error: { code, message } }, null, 2)}\n`);
+        process.stderr.write(`${message}\n`);
+        process.exitCode = 1;
+    }
+}

package/dist/commands/dag-context.js

@@ -0,0 +1,184 @@
+import { randomBytes } from "node:crypto";
+import { link, lstat, readFile, rm, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { buildContextBundle } from "../workflows/dag/context-transfer/context-bundle.js";
+import { effectiveNodeContextV1Schema } from "../shared/context-transfer.js";
+import { locateDagRun } from "../workflows/dag/lifecycle.js";
+function parseContextArgs(args) {
+    const action = args[0];
+    if (action !== "show" && action !== "export") {
+        throw new Error("usage: dag context <show|export> --run-id <id> --node-id <id> --attempt <n> [--json]");
+    }
+    let runId = "";
+    let nodeId = "";
+    let attempt = 0;
+    let json = false;
+    let target = "generic";
+    let profile = "redacted";
+    let output;
+    let acknowledgeSensitiveData = false;
+    for (let index = 1; index < args.length; index += 1) {
+        const arg = args[index];
+        if (arg === "--run-id")
+            runId = args[++index] ?? "";
+        else if (arg.startsWith("--run-id="))
+            runId = arg.slice(9);
+        else if (arg === "--node-id")
+            nodeId = args[++index] ?? "";
+        else if (arg.startsWith("--node-id="))
+            nodeId = arg.slice(10);
+        else if (arg === "--attempt")
+            attempt = Number(args[++index]);
+        else if (arg.startsWith("--attempt="))
+            attempt = Number(arg.slice(10));
+        else if (arg === "--target")
+            target = (args[++index] ?? "");
+        else if (arg.startsWith("--target="))
+            target = arg.slice(9);
+        else if (arg === "--redaction")
+            profile = (args[++index] ?? "");
+        else if (arg.startsWith("--redaction="))
+            profile = arg.slice(12);
+        else if (arg === "--output")
+            output = args[++index];
+        else if (arg.startsWith("--output="))
+            output = arg.slice(9);
+        else if (arg === "--acknowledge-sensitive-data")
+            acknowledgeSensitiveData = true;
+        else if (arg === "--json")
+            json = true;
+        else
+            throw new Error(`unknown dag context flag: ${arg}`);
+    }
+    if (!runId || !nodeId || !Number.isSafeInteger(attempt) || attempt < 1) {
+        throw new Error("dag context requires --run-id, --node-id, and positive --attempt");
+    }
+    if (!["generic", "pi-session", "pi-handoff", "readable"].includes(target)) {
+        throw new Error(`unsupported context target: ${target}`);
+    }
+    if (profile !== "redacted" && profile !== "raw") {
+        throw new Error(`unsupported redaction profile: ${profile}`);
+    }
+    if (action === "export" && !output) {
+        throw new Error("dag context export requires --output <path>");
+    }
+    if (action === "export" && profile === "raw" && !acknowledgeSensitiveData) {
+        throw new Error("raw context export requires --acknowledge-sensitive-data");
+    }
+    return {
+        action,
+        runId,
+        nodeId,
+        attempt,
+        json,
+        target,
+        profile,
+        ...(output ? { output } : {}),
+        acknowledgeSensitiveData,
+    };
+}
+function receiptPath(runDir, nodeId, attempt) {
+    return path.join(runDir, nodeId, "context-receipts", `attempt-${attempt}.json`);
+}
+function outputLabel(repoRoot, outputPath) {
+    const relative = path
+        .relative(repoRoot, outputPath)
+        .split(path.sep)
+        .join("/");
+    return relative && !relative.startsWith("../") && relative !== ".."
+        ? relative
+        : path.basename(outputPath);
+}
+export async function runDagContextCore(repoRoot, args) {
+    const input = parseContextArgs(args);
+    const located = await locateDagRun(repoRoot, input.runId);
+    if (!located)
+        throw new Error(`dag run not found: ${input.runId}`);
+    if (input.action === "show") {
+        let receipt;
+        try {
+            receipt = effectiveNodeContextV1Schema.parse(JSON.parse(await readFile(receiptPath(located.runDir, input.nodeId, input.attempt), "utf8")));
+        }
+        catch {
+            throw new Error("CONTEXT_RECEIPT_MISSING");
+        }
+        return {
+            schemaVersion: 1,
+            runId: input.runId,
+            nodeId: input.nodeId,
+            attempt: input.attempt,
+            capturedAt: receipt.identity.capturedAt,
+            contextDigest: receipt.contextDigest,
+            componentCount: receipt.orderedComponents.length,
+            truncationCount: receipt.promptAssembly.truncations.length,
+            runtime: {
+                executor: receipt.runtime.executor,
+                model: receipt.runtime.resolvedModel ?? receipt.runtime.modelHint ?? null,
+                skills: receipt.runtime.skills,
+                extensions: receipt.runtime.extensions,
+                tools: receipt.runtime.activeTools,
+            },
+        };
+    }
+    const outputPath = path.resolve(repoRoot, input.output);
+    const parent = path.dirname(outputPath);
+    const parentStat = await lstat(parent).catch(() => undefined);
+    if (parentStat?.isSymbolicLink())
+        throw new Error("unsafe output parent symlink");
+    const existing = await lstat(outputPath).catch(() => undefined);
+    if (existing)
+        throw new Error("context export output already exists");
+    const bundle = await buildContextBundle({
+        runDir: located.runDir,
+        runId: input.runId,
+        nodeId: input.nodeId,
+        attempt: input.attempt,
+        profile: input.profile,
+        target: input.target,
+        ...(input.profile === "raw" && input.acknowledgeSensitiveData
+            ? {
+                rawAcknowledgement: {
+                    requestId: `cli-${bundleRequestIdentity(input)}`,
+                    acknowledgedAt: new Date().toISOString(),
+                },
+            }
+            : {}),
+    });
+    const temporaryPath = `${outputPath}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
+    try {
+        await writeFile(temporaryPath, bundle.zipBytes, { flag: "wx", mode: 0o600 });
+        await link(temporaryPath, outputPath);
+        await rm(temporaryPath, { force: true });
+    }
+    catch (error) {
+        await rm(temporaryPath, { force: true }).catch(() => undefined);
+        throw error;
+    }
+    return {
+        schemaVersion: 1,
+        bundleId: bundle.manifest.bundleId,
+        bundleSha256: bundle.manifest.bundleSha256,
+        profile: bundle.manifest.profile,
+        target: bundle.manifest.target,
+        bytes: bundle.zipBytes.byteLength,
+        output: outputLabel(repoRoot, outputPath),
+    };
+}
+export async function runDagContext(repoRoot, args) {
+    const input = parseContextArgs(args);
+    const result = await runDagContextCore(repoRoot, args);
+    if (input.action === "show") {
+        const summary = result;
+        process.stdout.write(input.json
+            ? `${JSON.stringify(result, null, 2)}\n`
+            : `Context ${summary.runId}/${summary.nodeId} attempt ${summary.attempt}\nDigest: ${summary.contextDigest}\nComponents: ${summary.componentCount}\n`);
+        return;
+    }
+    const exported = result;
+    process.stdout.write(input.json
+        ? `${JSON.stringify(result, null, 2)}\n`
+        : `Exported ${exported.bundleId} to ${exported.output} (${exported.bytes} bytes)\n`);
+}
+function bundleRequestIdentity(input) {
+    return `${input.runId}-${input.nodeId}-${input.attempt}`.replace(/[^a-zA-Z0-9._-]/g, "-");
+}

package/dist/commands/dag-rerun.js

@@ -1,6 +1,13 @@
+import { randomBytes } from "node:crypto";
 import { readFile } from "node:fs/promises";
+import { executeArtifactRevisionContinuation, planArtifactRevisionContinuation, } from "../workflows/dag/context-transfer/operator-actions.js";
 import { isDagRerunPromptOverrideEnabled } from "../shared/dag-prompt-override.js";
-import { executeDagRerun, planDagRerun, } from "../workflows/dag/rerun-run.js";
+import { workerContinuationAuthorityV1Schema, } from "../shared/context-transfer.js";
+import { openConsoleAppData } from "../infrastructure/console/app-data.js";
+import { buildArtifactOverrideSet, consumeArtifactRevision, readArtifactRevision, readArtifactRevisionCandidate, acquireArtifactRevisionLease, releaseArtifactRevisionLease, EXECUTE_REVISION_LEASE_TTL_MS, } from "../infrastructure/console/artifact-revision-store.js";
+import { buildArtifactBindingGraph } from "../workflows/dag/artifact-bindings.js";
+import { locateDagRun, readDagRunSpec } from "../workflows/dag/lifecycle.js";
+import { executeDagRerun, planDagRerun, readOperatorRequestReplay, } from "../workflows/dag/rerun-run.js";
 export function parseDagRerunArgs(args) {
     if (args.length === 0) {
         throw new Error("usage: dag rerun --run-id <id> --from-node <node-id> --plan [--json] | dag rerun --run-id <id> --from-node <node-id> --plan-hash <hash> --request-id <key> --reason <text> [--json]");
@@ -111,6 +118,10 @@ async function loadPromptOverrides(specs, mode) {
     return overrides;
 }
 export async function runDagRerun(repoRoot, rawArgs) {
+    if (rawArgs.some((arg) => arg === "--artifact-revision" || arg.startsWith("--artifact-revision="))) {
+        await runArtifactRevisionRerun(repoRoot, rawArgs);
+        return;
+    }
     const parsed = parseDagRerunArgs(rawArgs);
     let promptOverrides;
     const hasOverrides = parsed.promptOverrideSpecs.length > 0 ||
@@ -163,3 +174,197 @@ export async function runDagRerun(repoRoot, rawArgs) {
         }
     }
 }
+function readFlag(args, name) {
+    const exact = args.indexOf(name);
+    if (exact >= 0)
+        return args[exact + 1];
+    const prefix = `${name}=`;
+    return args.find((arg) => arg.startsWith(prefix))?.slice(prefix.length);
+}
+function parseWorkerContinuationAuthority(raw) {
+    if (raw === undefined)
+        return undefined;
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new Error("dag rerun --worker-continuation must be valid JSON");
+    }
+    const result = workerContinuationAuthorityV1Schema.safeParse(parsed);
+    if (!result.success) {
+        throw new Error(`dag rerun --worker-continuation is invalid: ${result.error.issues[0]?.message ?? "schema mismatch"}`);
+    }
+    return result.data;
+}
+function executeLeaseHolder(requestId) {
+    // The request id identifies the idempotency envelope, not a live process.
+    // A unique invocation holder prevents two concurrent direct CLI invocations
+    // with the same request id from treating each other as a lease renewal.
+    return `cli-execute:${requestId}:${randomBytes(12).toString("hex")}`;
+}
+/**
+ * Hold the staging lease across candidate read + continuation execution so a
+ * concurrent discard/second execute fails with LEASE_HELD and a crashed
+ * process leaves a stale, TTL-takeover-able lease instead of silent races.
+ * The acquire/renew here also refreshes the sliding window before the long
+ * child run starts.
+ */
+async function withExecuteRevisionLease(appData, requestId, revisionId, operation) {
+    const holder = executeLeaseHolder(requestId);
+    await acquireArtifactRevisionLease({
+        appData,
+        revisionId,
+        holder,
+        ttlMs: EXECUTE_REVISION_LEASE_TTL_MS,
+    });
+    try {
+        return await operation(holder);
+    }
+    finally {
+        await releaseArtifactRevisionLease({
+            appData,
+            revisionId,
+            holder,
+        }).catch(() => { });
+    }
+}
+export async function runArtifactRevisionRerunCore(repoRoot, rawArgs, cliOptions) {
+    const allowed = new Set([
+        "--run-id",
+        "--artifact-revision",
+        "--plan-hash",
+        "--request-id",
+        "--reason",
+        "--worker-continuation",
+    ]);
+    for (let index = 0; index < rawArgs.length; index += 1) {
+        const arg = rawArgs[index];
+        if (arg === "--plan" || arg === "--json")
+            continue;
+        const name = arg.split("=", 1)[0];
+        if (!allowed.has(name))
+            throw new Error(`unknown artifact revision rerun flag: ${arg}`);
+        if (!arg.includes("="))
+            index += 1;
+    }
+    const parentRunId = readFlag(rawArgs, "--run-id")?.trim();
+    const revisionId = readFlag(rawArgs, "--artifact-revision")?.trim();
+    const planOnly = rawArgs.includes("--plan");
+    if (!parentRunId || !revisionId) {
+        throw new Error("dag rerun artifact revision requires --run-id and --artifact-revision");
+    }
+    const appData = openConsoleAppData({
+        repoRoot,
+        ...(cliOptions?.appDataRoot ? { appDataRoot: cliOptions.appDataRoot } : {}),
+    });
+    const planHash = readFlag(rawArgs, "--plan-hash")?.trim();
+    const requestId = readFlag(rawArgs, "--request-id")?.trim();
+    const reason = readFlag(rawArgs, "--reason")?.trim();
+    const workerContinuation = parseWorkerContinuationAuthority(readFlag(rawArgs, "--worker-continuation"));
+    if (!planOnly && (!planHash || !requestId || !reason)) {
+        throw new Error("dag rerun artifact revision execute requires --plan-hash, --request-id, and --reason");
+    }
+    if (!planOnly) {
+        // Replay-first (B4): a prior execute may have consumed the revision and
+        // the staging record may already have been reconciled away. The persisted
+        // operator request is the authoritative idempotent result and must be
+        // honored before any dependency on the revision metadata. A replay that
+        // does not match the requested parent/planHash is a reuse conflict, not a
+        // valid idempotent answer (SF2).
+        const replay = await readOperatorRequestReplay(repoRoot, requestId, {
+            parentRunId,
+            planHash,
+        });
+        if (replay) {
+            return {
+                payload: replay,
+                exitCode: replay.ok
+                    ? 0
+                    : replay.errorCode === "RERUN_PLAN_DRIFT"
+                        ? 3
+                        : replay.errorCode === "INELIGIBLE"
+                            ? 2
+                            : 1,
+            };
+        }
+    }
+    const revision = await readArtifactRevision(appData, revisionId);
+    if (!revision || revision.parent.runId !== parentRunId) {
+        throw new Error("ARTIFACT_REVISION_EXPIRED");
+    }
+    const located = await locateDagRun(repoRoot, parentRunId);
+    if (!located)
+        throw new Error(`dag run not found: ${parentRunId}`);
+    const declaration = buildArtifactBindingGraph(await readDagRunSpec(located.runDir)).artifacts.find((item) => item.producerNodeId === revision.parent.nodeId &&
+        item.path === revision.parent.artifactPath);
+    if (!declaration)
+        throw new Error("ARTIFACT_BINDING_UNAVAILABLE");
+    const artifactOverrides = buildArtifactOverrideSet(revision);
+    if (planOnly) {
+        if (planHash || requestId || reason) {
+            throw new Error("dag rerun --plan cannot be combined with execute flags");
+        }
+        const plan = await planArtifactRevisionContinuation({
+            cwd: repoRoot,
+            parentRunId,
+            artifactId: declaration.artifactId,
+            artifactOverrides,
+            stagingRevisionSha256: revision.candidate.sha256,
+            ...(workerContinuation
+                ? { workerContinuationAuthority: workerContinuation }
+                : {}),
+        });
+        return { payload: { ok: plan.eligible, plan }, exitCode: plan.eligible ? 0 : 2 };
+    }
+    if (revision.state === "consumed") {
+        // Replay was not found above, so this is a crashed consume without a
+        // persisted result — refuse rather than re-execute a consumed revision.
+        throw new Error("ARTIFACT_REVISION_EXPIRED: revision already consumed and no operator replay exists for this request");
+    }
+    const result = await withExecuteRevisionLease(appData, requestId, revision.revisionId, async (leaseHolder) => {
+        const candidateBytes = await readArtifactRevisionCandidate({ appData, revision });
+        return executeArtifactRevisionContinuation({
+            cwd: repoRoot,
+            parentRunId,
+            artifactId: declaration.artifactId,
+            artifactOverrides,
+            stagingRevisionSha256: revision.candidate.sha256,
+            candidateBytes,
+            planHash: planHash,
+            requestId: requestId,
+            reason: reason,
+            ...(workerContinuation
+                ? { workerContinuationAuthority: workerContinuation }
+                : {}),
+            consumeRevision: async ({ revisionId: consumedId, expectedSha256 }) => {
+                await consumeArtifactRevision({
+                    appData,
+                    revisionId: consumedId,
+                    expectedSha256,
+                    holder: leaseHolder,
+                });
+            },
+        });
+    });
+    return {
+        payload: result,
+        exitCode: result.ok
+            ? 0
+            : result.errorCode === "RERUN_PLAN_DRIFT"
+                ? 3
+                : result.errorCode === "INELIGIBLE"
+                    ? 2
+                    : 1,
+    };
+}
+async function runArtifactRevisionRerun(repoRoot, rawArgs) {
+    const { payload, exitCode } = await runArtifactRevisionRerunCore(repoRoot, rawArgs);
+    process.stdout.write(`${JSON.stringify(payload, null, 2)}\n`);
+    if (exitCode !== 0) {
+        const failure = payload;
+        const message = failure.message ?? failure.errorCode ?? `artifact rerun failed with exit ${exitCode}`;
+        process.stderr.write(`${message}\n`);
+        process.exitCode = exitCode;
+    }
+}