@tea-agent/loop-agent 0.41.1-beta.0 → 0.42.0-next.2

package/dist/cli/program.js

@@ -7,13 +7,14 @@ import { runCoverageAudit } from "../commands/coverage-audit.js";
 import { runCoverageReport } from "../commands/coverage-report.js";
 import { parseCursorPromptArgs, printCursorPromptUsage, runCursorPrompt, } from "../commands/cursor-prompt.js";
 import { runDagApprove } from "../commands/dag-approve.js";
+import { runDagArtifact } from "../commands/dag-artifact.js";
 import { runDagFinalVerification } from "../commands/dag-final-verification.js";
+import { runDagContext } from "../commands/dag-context.js";
 import { runDagInitHybrid } from "../commands/dag-init-hybrid.js";
 import { runDagReconcileTasks } from "../commands/dag-reconcile-tasks.js";
 import { runDagReconcileRun } from "../commands/dag-reconcile-run.js";
 import { runDagRequestInterrupt } from "../commands/dag-request-interrupt.js";
 import { runDagRerunTask } from "../commands/dag-rerun-task.js";
-import { runDagFollowUp } from "../commands/dag-follow-up.js";
 import { runDagRerun } from "../commands/dag-rerun.js";
 import { runDagReject } from "../commands/dag-reject.js";
 import { runDagCloseoutDraft, runDagReport } from "../commands/dag-report.js";
@@ -358,15 +359,18 @@ async function runDagAction(repoRoot, subcommand, rest) {
         case "rerun-task":
             await runDagRerunTask(repoRoot, args);
             return;
-        case "follow-up":
-            await runDagFollowUp(repoRoot, args);
-            return;
         case "reconcile-tasks":
             await runDagReconcileTasks(repoRoot, args);
             return;
         case "final-verification":
             await runDagFinalVerification(repoRoot, args);
             return;
+        case "context":
+            await runDagContext(repoRoot, args);
+            return;
+        case "artifact":
+            await runDagArtifact(repoRoot, args);
+            return;
         case "decision": {
             const [decisionSubcommand, ...decisionArgs] = args;
             if (decisionSubcommand === "inspect") {
@@ -380,7 +384,7 @@ async function runDagAction(repoRoot, subcommand, rest) {
             throw new Error("usage: dag decision <inspect|validate> --run-id <id> [--node-id <node-id>]");
         }
         default:
-            throw new Error("usage: dag <init-hybrid|execute|validate|workflow-plan|workflow-validate|workflow-compile|approve|reject|resume|status|doctor|report|closeout-draft|reconcile-run|request-interrupt|rerun|rerun-task|reconcile-tasks|final-verification|decision> ...");
+            throw new Error("usage: dag <init-hybrid|execute|validate|workflow-plan|workflow-validate|workflow-compile|approve|reject|resume|status|doctor|report|closeout-draft|reconcile-run|request-interrupt|rerun|rerun-task|reconcile-tasks|final-verification|context|artifact|decision> ...");
     }
 }
 function compactArgs(args) {
@@ -549,10 +553,23 @@ function addDagCommand(program, defaultRepoRoot) {
         "request-interrupt",
         "rerun",
         "rerun-task",
-        "follow-up",
         "reconcile-tasks",
         "final-verification",
+        "context",
+        "artifact",
     ], defaultRepoRoot);
+    const context = dag.commands.find((command) => command.name() === "context");
+    if (!context)
+        throw new Error("dag context command registration failed");
+    context
+        .description("Inspect or export a captured effective node context")
+        .addHelpText("after", "\nActions:\n  show --run-id <id> --node-id <id> --attempt <n> [--json]\n  export --run-id <id> --node-id <id> --attempt <n> --output <zip> [--target <generic|pi-session|pi-handoff|readable>] [--redaction <redacted|raw>] [--acknowledge-sensitive-data] [--json]");
+    const artifact = dag.commands.find((command) => command.name() === "artifact");
+    if (!artifact)
+        throw new Error("dag artifact command registration failed");
+    artifact
+        .description("Inspect artifact consumers or manage staged artifact revisions")
+        .addHelpText("after", "\nActions:\n  consumers --run-id <id> --node-id <producer> --artifact <path> [--json]\n  revision stage --run-id <id> --node-id <producer> --artifact <path> --file <replacement> --request-id <id> [--json]\n  revision discard --revision-id <id> --request-id <id> [--json]");
     const validate = createRawArgsCommand("validate", "Validate an Agent DAG spec", defaultRepoRoot);
     configureDagValidate(validate);
     replaceActionWithOptionAwareDispatch(validate, defaultRepoRoot);

package/dist/commands/client-recovery.js

@@ -1328,15 +1328,12 @@ export async function runClientRecovery(input) {
     }
     const plugin = await installProjectOpenCodePlugin({
         repoRoot: input.repoRoot,
-        onlyIfMissing: true,
     });
     const overflowPlugin = await installProjectOpenCodeOverflowCompactPlugin({
         repoRoot: input.repoRoot,
-        onlyIfMissing: true,
     });
     const piExtension = await installProjectPiContextOverflowExtension({
         repoRoot: input.repoRoot,
-        onlyIfMissing: true,
     });
     const pi = await applyProjectPiSettingsMerge({ repoRoot: input.repoRoot });
     if (mode !== "user") {

package/dist/commands/dag-artifact.js

@@ -0,0 +1,284 @@
+import { createHash } from "node:crypto";
+import { lstat, readFile } from "node:fs/promises";
+import path from "node:path";
+import { readRevisionParentArtifact } from "../workflows/dag/context-transfer/operator-actions.js";
+import { readFileBoundarySafe } from "../shared/path-safety.js";
+import { openConsoleAppData } from "../infrastructure/console/app-data.js";
+import { artifactRevisionUploadPath, createArtifactRevision, discardArtifactRevision, acquireArtifactRevisionLease, releaseArtifactRevisionLease, } from "../infrastructure/console/artifact-revision-store.js";
+import { OperationStore } from "../infrastructure/console/operation-store.js";
+import { buildArtifactBindingGraph } from "../workflows/dag/artifact-bindings.js";
+import { resolveArtifactRevisionSchema } from "../workflows/dag/artifact-revision-schema-registry.js";
+import { locateDagRun, readDagRunSpec } from "../workflows/dag/lifecycle.js";
+function parseArtifactArgs(args) {
+    const [first, second] = args;
+    const action = first === "consumers"
+        ? "consumers"
+        : first === "revision" && second === "stage"
+            ? "stage"
+            : first === "revision" && second === "discard"
+                ? "discard"
+                : undefined;
+    if (!action) {
+        throw new Error("usage: dag artifact consumers --run-id <run> --node-id <producer> --artifact <path> [--json] | dag artifact revision <stage|discard> ...");
+    }
+    let runId;
+    let nodeId;
+    let artifactPath;
+    let artifactId;
+    let file;
+    let candidateUpload;
+    let revisionId;
+    let requestId;
+    let json = false;
+    for (let index = action === "consumers" ? 1 : 2; index < args.length; index += 1) {
+        const arg = args[index];
+        const next = () => args[++index];
+        if (arg === "--run-id")
+            runId = next();
+        else if (arg.startsWith("--run-id="))
+            runId = arg.slice(9);
+        else if (arg === "--node-id")
+            nodeId = next();
+        else if (arg.startsWith("--node-id="))
+            nodeId = arg.slice(10);
+        else if (arg === "--artifact")
+            artifactPath = next();
+        else if (arg.startsWith("--artifact="))
+            artifactPath = arg.slice(11);
+        else if (arg === "--artifact-id")
+            artifactId = next();
+        else if (arg.startsWith("--artifact-id="))
+            artifactId = arg.slice(14);
+        else if (arg === "--file")
+            file = next();
+        else if (arg.startsWith("--file="))
+            file = arg.slice(7);
+        else if (arg === "--candidate-upload")
+            candidateUpload = next();
+        else if (arg.startsWith("--candidate-upload="))
+            candidateUpload = arg.slice(19);
+        else if (arg === "--revision-id")
+            revisionId = next();
+        else if (arg.startsWith("--revision-id="))
+            revisionId = arg.slice(14);
+        else if (arg === "--request-id")
+            requestId = next();
+        else if (arg.startsWith("--request-id="))
+            requestId = arg.slice(13);
+        else if (arg === "--json")
+            json = true;
+        else
+            throw new Error(`unknown dag artifact flag: ${arg}`);
+    }
+    return { action, runId, nodeId, artifactPath, artifactId, file, candidateUpload, revisionId, requestId, json };
+}
+function sha256(bytes) {
+    return createHash("sha256").update(bytes).digest("hex");
+}
+function print(value, json, fallback) {
+    process.stdout.write(json ? `${JSON.stringify(value, null, 2)}\n` : `${fallback}\n`);
+}
+export async function runDagArtifactCore(repoRoot, args, cliOptions) {
+    const input = parseArtifactArgs(args);
+    if (input.action === "discard") {
+        if (!input.revisionId || !input.requestId) {
+            throw new Error("dag artifact revision discard requires --revision-id and --request-id");
+        }
+        const appData = openConsoleAppData({ repoRoot, ...(cliOptions?.appDataRoot ? { appDataRoot: cliOptions.appDataRoot } : {}) });
+        const operations = new OperationStore(appData);
+        const created = await operations.create({
+            clientRequestId: input.requestId,
+            action: "cliArtifactRevisionDiscard",
+            actionParams: { revisionId: input.revisionId },
+        });
+        if (created.kind === "conflict")
+            throw new Error(created.code);
+        if (created.kind === "idempotent" && created.operation.state === "succeeded") {
+            return asRecord(created.operation.result);
+        }
+        const leaseHolder = `cli-discard:${input.requestId}`;
+        const revision = await acquireArtifactRevisionLease({
+            appData,
+            revisionId: input.revisionId,
+            holder: leaseHolder,
+        })
+            .then(() => discardArtifactRevision({
+            appData,
+            revisionId: input.revisionId,
+            holder: leaseHolder,
+        }))
+            .finally(() => releaseArtifactRevisionLease({
+            appData,
+            revisionId: input.revisionId,
+            holder: leaseHolder,
+        }).catch(() => { }));
+        const result = { ok: true, revisionId: revision.revisionId, state: revision.state };
+        await operations.update(created.operation.operationId, {
+            state: "succeeded",
+            startedAt: created.operation.createdAt,
+            finishedAt: new Date().toISOString(),
+            result,
+        });
+        return result;
+    }
+    if (!input.runId || !input.nodeId || (!input.artifactPath && !input.artifactId)) {
+        throw new Error("dag artifact requires --run-id, --node-id, and --artifact <relative-path> or --artifact-id <id>");
+    }
+    const located = await locateDagRun(repoRoot, input.runId);
+    if (!located)
+        throw new Error(`dag run not found: ${input.runId}`);
+    const graph = buildArtifactBindingGraph(await readDagRunSpec(located.runDir));
+    const declaration = graph.artifacts.find((item) => item.producerNodeId === input.nodeId &&
+        (input.artifactId
+            ? item.artifactId === input.artifactId
+            : item.path === input.artifactPath));
+    if (!declaration)
+        throw new Error("ARTIFACT_BINDING_UNAVAILABLE");
+    if (input.action === "consumers") {
+        return {
+            schemaVersion: 1,
+            runId: input.runId,
+            nodeId: input.nodeId,
+            artifactId: declaration.artifactId,
+            artifactPath: declaration.path,
+            directConsumerNodeIds: declaration.directConsumerNodeIds,
+            graphSha256: graph.artifactGraphSha256,
+        };
+    }
+    if (!input.requestId || (!input.file && !input.candidateUpload)) {
+        throw new Error("dag artifact revision stage requires --file or --candidate-upload, and --request-id");
+    }
+    const appData = openConsoleAppData({
+        repoRoot,
+        ...(cliOptions?.appDataRoot ? { appDataRoot: cliOptions.appDataRoot } : {}),
+    });
+    // The candidate upload lives in app-data and is cross-process mutable;
+    // resolve + read it TOCTOU-safe (O_NOFOLLOW fd read) instead of
+    // lstat-then-readFile, so a swapped symlink can never feed an unintended
+    // file into the stage. Both the path resolution (assertSafeAppDataPath
+    // rejects symlinks/hardlinks) and the fd read map to the stable
+    // ARTIFACT_REVISION_PATH_INVALID code.
+    let candidateBytes;
+    if (input.candidateUpload) {
+        try {
+            if (!/^[a-f0-9]{64}$/.test(input.candidateUpload)) {
+                throw new Error("invalid --candidate-upload hash");
+            }
+            const candidatePath = artifactRevisionUploadPath(appData, input.candidateUpload);
+            candidateBytes = await readFileBoundarySafe({
+                boundaryRoot: path.dirname(candidatePath),
+                targetPath: candidatePath,
+                label: "candidate upload",
+            });
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            if (/symlink|hardlink|single-link|regular|boundary|escap|app-data/i.test(message)) {
+                throw new Error("ARTIFACT_REVISION_PATH_INVALID");
+            }
+            throw error;
+        }
+    }
+    else {
+        const candidatePath = path.resolve(repoRoot, input.file);
+        const stat = await lstat(candidatePath);
+        if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1) {
+            throw new Error("candidate must be an owned regular file");
+        }
+        candidateBytes = await readFile(candidatePath);
+    }
+    if (candidateBytes.byteLength > 10 * 1024 * 1024)
+        throw new Error("candidate exceeds 10 MiB");
+    const operations = new OperationStore(appData);
+    const actionParams = {
+        runId: input.runId,
+        nodeId: input.nodeId,
+        artifactPath: declaration.path,
+        candidateSha256: sha256(candidateBytes),
+        candidateBytes: candidateBytes.byteLength,
+    };
+    const created = await operations.create({
+        clientRequestId: input.requestId,
+        action: "cliArtifactRevisionStage",
+        actionParams,
+    });
+    if (created.kind === "conflict")
+        throw new Error(created.code);
+    if (created.kind === "idempotent" && created.operation.state === "succeeded") {
+        return asRecord(created.operation.result);
+    }
+    const parent = await readRevisionParentArtifact({
+        cwd: repoRoot,
+        runId: input.runId,
+        producerNodeId: input.nodeId,
+        artifactId: declaration.artifactId,
+    });
+    const revision = await createArtifactRevision({
+        appData,
+        parentRunId: input.runId,
+        producerNodeId: input.nodeId,
+        declaration: parent.declaration,
+        parentSha256: parent.parentSha256,
+        parentBytes: parent.parentBytes,
+        candidateBytes,
+        mediaType: declaration.mediaType,
+        artifactSchemaResolver: resolveArtifactRevisionSchema,
+    });
+    const projected = {
+        revisionId: revision.revisionId,
+        state: revision.state,
+        parent: revision.parent,
+        candidate: {
+            sha256: revision.candidate.sha256,
+            bytes: revision.candidate.bytes,
+            mediaType: revision.candidate.mediaType,
+            uploadedAt: revision.candidate.uploadedAt,
+        },
+        validation: revision.validation,
+        diff: {
+            kind: revision.diff.kind,
+            summary: revision.diff.summary,
+            truncated: revision.diff.truncated,
+        },
+        expiresAt: revision.expiresAt,
+    };
+    const result = { ok: true, revision: projected };
+    await operations.update(created.operation.operationId, {
+        state: "succeeded",
+        startedAt: created.operation.createdAt,
+        finishedAt: new Date().toISOString(),
+        result,
+    });
+    return result;
+}
+function asRecord(value) {
+    return value && typeof value === "object" ? value : { ok: true };
+}
+export async function runDagArtifact(repoRoot, args) {
+    const input = parseArtifactArgs(args);
+    try {
+        const result = await runDagArtifactCore(repoRoot, args);
+        if (input.action === "discard") {
+            print(result, input.json, `Discarded ${String(result.revisionId ?? "")}`);
+        }
+        else if (input.action === "consumers") {
+            const consumers = result;
+            print(result, input.json, `${consumers.artifactPath}: ${(consumers.directConsumerNodeIds ?? []).join(", ") || "no consumers"}`);
+        }
+        else {
+            print(result, input.json, `Staged revision ${String(result.revisionId ?? "")}`);
+        }
+    }
+    catch (error) {
+        if (!input.json)
+            throw error;
+        const message = error instanceof Error ? error.message : String(error);
+        const candidateCode = message.split(":", 1)[0]?.trim() ?? "";
+        const code = /^[A-Z][A-Z0-9_]+$/.test(candidateCode)
+            ? candidateCode
+            : "INTERNAL_ERROR";
+        process.stdout.write(`${JSON.stringify({ schemaVersion: 1, ok: false, error: { code, message } }, null, 2)}\n`);
+        process.stderr.write(`${message}\n`);
+        process.exitCode = 1;
+    }
+}

package/dist/commands/dag-context.js

@@ -0,0 +1,184 @@
+import { randomBytes } from "node:crypto";
+import { link, lstat, readFile, rm, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { buildContextBundle } from "../workflows/dag/context-transfer/context-bundle.js";
+import { effectiveNodeContextV1Schema } from "../shared/context-transfer.js";
+import { locateDagRun } from "../workflows/dag/lifecycle.js";
+function parseContextArgs(args) {
+    const action = args[0];
+    if (action !== "show" && action !== "export") {
+        throw new Error("usage: dag context <show|export> --run-id <id> --node-id <id> --attempt <n> [--json]");
+    }
+    let runId = "";
+    let nodeId = "";
+    let attempt = 0;
+    let json = false;
+    let target = "generic";
+    let profile = "redacted";
+    let output;
+    let acknowledgeSensitiveData = false;
+    for (let index = 1; index < args.length; index += 1) {
+        const arg = args[index];
+        if (arg === "--run-id")
+            runId = args[++index] ?? "";
+        else if (arg.startsWith("--run-id="))
+            runId = arg.slice(9);
+        else if (arg === "--node-id")
+            nodeId = args[++index] ?? "";
+        else if (arg.startsWith("--node-id="))
+            nodeId = arg.slice(10);
+        else if (arg === "--attempt")
+            attempt = Number(args[++index]);
+        else if (arg.startsWith("--attempt="))
+            attempt = Number(arg.slice(10));
+        else if (arg === "--target")
+            target = (args[++index] ?? "");
+        else if (arg.startsWith("--target="))
+            target = arg.slice(9);
+        else if (arg === "--redaction")
+            profile = (args[++index] ?? "");
+        else if (arg.startsWith("--redaction="))
+            profile = arg.slice(12);
+        else if (arg === "--output")
+            output = args[++index];
+        else if (arg.startsWith("--output="))
+            output = arg.slice(9);
+        else if (arg === "--acknowledge-sensitive-data")
+            acknowledgeSensitiveData = true;
+        else if (arg === "--json")
+            json = true;
+        else
+            throw new Error(`unknown dag context flag: ${arg}`);
+    }
+    if (!runId || !nodeId || !Number.isSafeInteger(attempt) || attempt < 1) {
+        throw new Error("dag context requires --run-id, --node-id, and positive --attempt");
+    }
+    if (!["generic", "pi-session", "pi-handoff", "readable"].includes(target)) {
+        throw new Error(`unsupported context target: ${target}`);
+    }
+    if (profile !== "redacted" && profile !== "raw") {
+        throw new Error(`unsupported redaction profile: ${profile}`);
+    }
+    if (action === "export" && !output) {
+        throw new Error("dag context export requires --output <path>");
+    }
+    if (action === "export" && profile === "raw" && !acknowledgeSensitiveData) {
+        throw new Error("raw context export requires --acknowledge-sensitive-data");
+    }
+    return {
+        action,
+        runId,
+        nodeId,
+        attempt,
+        json,
+        target,
+        profile,
+        ...(output ? { output } : {}),
+        acknowledgeSensitiveData,
+    };
+}
+function receiptPath(runDir, nodeId, attempt) {
+    return path.join(runDir, nodeId, "context-receipts", `attempt-${attempt}.json`);
+}
+function outputLabel(repoRoot, outputPath) {
+    const relative = path
+        .relative(repoRoot, outputPath)
+        .split(path.sep)
+        .join("/");
+    return relative && !relative.startsWith("../") && relative !== ".."
+        ? relative
+        : path.basename(outputPath);
+}
+export async function runDagContextCore(repoRoot, args) {
+    const input = parseContextArgs(args);
+    const located = await locateDagRun(repoRoot, input.runId);
+    if (!located)
+        throw new Error(`dag run not found: ${input.runId}`);
+    if (input.action === "show") {
+        let receipt;
+        try {
+            receipt = effectiveNodeContextV1Schema.parse(JSON.parse(await readFile(receiptPath(located.runDir, input.nodeId, input.attempt), "utf8")));
+        }
+        catch {
+            throw new Error("CONTEXT_RECEIPT_MISSING");
+        }
+        return {
+            schemaVersion: 1,
+            runId: input.runId,
+            nodeId: input.nodeId,
+            attempt: input.attempt,
+            capturedAt: receipt.identity.capturedAt,
+            contextDigest: receipt.contextDigest,
+            componentCount: receipt.orderedComponents.length,
+            truncationCount: receipt.promptAssembly.truncations.length,
+            runtime: {
+                executor: receipt.runtime.executor,
+                model: receipt.runtime.resolvedModel ?? receipt.runtime.modelHint ?? null,
+                skills: receipt.runtime.skills,
+                extensions: receipt.runtime.extensions,
+                tools: receipt.runtime.activeTools,
+            },
+        };
+    }
+    const outputPath = path.resolve(repoRoot, input.output);
+    const parent = path.dirname(outputPath);
+    const parentStat = await lstat(parent).catch(() => undefined);
+    if (parentStat?.isSymbolicLink())
+        throw new Error("unsafe output parent symlink");
+    const existing = await lstat(outputPath).catch(() => undefined);
+    if (existing)
+        throw new Error("context export output already exists");
+    const bundle = await buildContextBundle({
+        runDir: located.runDir,
+        runId: input.runId,
+        nodeId: input.nodeId,
+        attempt: input.attempt,
+        profile: input.profile,
+        target: input.target,
+        ...(input.profile === "raw" && input.acknowledgeSensitiveData
+            ? {
+                rawAcknowledgement: {
+                    requestId: `cli-${bundleRequestIdentity(input)}`,
+                    acknowledgedAt: new Date().toISOString(),
+                },
+            }
+            : {}),
+    });
+    const temporaryPath = `${outputPath}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
+    try {
+        await writeFile(temporaryPath, bundle.zipBytes, { flag: "wx", mode: 0o600 });
+        await link(temporaryPath, outputPath);
+        await rm(temporaryPath, { force: true });
+    }
+    catch (error) {
+        await rm(temporaryPath, { force: true }).catch(() => undefined);
+        throw error;
+    }
+    return {
+        schemaVersion: 1,
+        bundleId: bundle.manifest.bundleId,
+        bundleSha256: bundle.manifest.bundleSha256,
+        profile: bundle.manifest.profile,
+        target: bundle.manifest.target,
+        bytes: bundle.zipBytes.byteLength,
+        output: outputLabel(repoRoot, outputPath),
+    };
+}
+export async function runDagContext(repoRoot, args) {
+    const input = parseContextArgs(args);
+    const result = await runDagContextCore(repoRoot, args);
+    if (input.action === "show") {
+        const summary = result;
+        process.stdout.write(input.json
+            ? `${JSON.stringify(result, null, 2)}\n`
+            : `Context ${summary.runId}/${summary.nodeId} attempt ${summary.attempt}\nDigest: ${summary.contextDigest}\nComponents: ${summary.componentCount}\n`);
+        return;
+    }
+    const exported = result;
+    process.stdout.write(input.json
+        ? `${JSON.stringify(result, null, 2)}\n`
+        : `Exported ${exported.bundleId} to ${exported.output} (${exported.bytes} bytes)\n`);
+}
+function bundleRequestIdentity(input) {
+    return `${input.runId}-${input.nodeId}-${input.attempt}`.replace(/[^a-zA-Z0-9._-]/g, "-");
+}