@tea-agent/loop-agent 0.41.1 → 0.42.0-next.10

package/dist/shared/openspec-spec.js

@@ -12,6 +12,19 @@ export const OPENSPEC_SPEC_DIRS = [
     "openspec/project-specs",
     "ai_workspace",
 ];
+/** Default roots used when a frontend task does not declare specRoots. */
+export const DEFAULT_FRONTEND_SPEC_ROOTS = OPENSPEC_SPEC_DIRS;
+/** A task-owned spec root must be a normalized, repo-relative POSIX directory. */
+export function isValidFrontendSpecRoot(value) {
+    return (Boolean(value) &&
+        !value.includes("\\") &&
+        !value.startsWith("/") &&
+        !value.includes("//") &&
+        !value.split("/").some((segment) => !segment ||
+            segment === "." ||
+            segment === ".." ||
+            /\s/.test(segment)));
+}
 /** Allowed spec file extensions (case-insensitive). */
 export const OPENSPEC_SPEC_EXT_RE = /\.(md|mdx|json|yaml|yml)$/i;
 /**
@@ -43,14 +56,17 @@ export function isGovernanceSubtreePath(filePath, governanceRoot) {
  * directories.  `filePath` must be a repo-relative POSIX path (backslashes are
  * normalised internally).  Directory names are case-sensitive.
  */
-export function isOpenspecSpecPath(filePath) {
+export function isFrontendSpecPath(filePath, specRoots = DEFAULT_FRONTEND_SPEC_ROOTS) {
     const normalized = filePath.replaceAll("\\", "/");
-    for (const dir of OPENSPEC_SPEC_DIRS) {
+    for (const dir of specRoots) {
         if (normalized === dir || normalized.startsWith(dir + "/"))
             return true;
     }
     return false;
 }
+export function isOpenspecSpecPath(filePath) {
+    return isFrontendSpecPath(filePath);
+}
 /**
  * Returns `true` when `filename` (the basename only, not a full path) has an
  * allowed frontend specification extension.
@@ -59,10 +75,13 @@ export function isValidOpenspecExtension(filename) {
     return OPENSPEC_SPEC_EXT_RE.test(filename);
 }
 /** Returns `true` for a supported file inside a canonical openspec spec dir. */
-export function isOpenspecSpecFilePath(filePath) {
-    return (isOpenspecSpecPath(filePath) &&
+export function isFrontendSpecFilePath(filePath, specRoots = DEFAULT_FRONTEND_SPEC_ROOTS) {
+    return (isFrontendSpecPath(filePath, specRoots) &&
         isValidOpenspecExtension(filePath.replaceAll("\\", "/")));
 }
+export function isOpenspecSpecFilePath(filePath) {
+    return isFrontendSpecFilePath(filePath);
+}
 /**
  * Returns `true` when free-form search input references a canonical frontend
  * specification directory with exact lowercase directory names.
@@ -123,3 +142,50 @@ export function extractTaskSourceOpenspecPaths(markdown, governanceRoot = DEFAUL
         !isGovernanceSubtreePath(token, governanceRoot))
         .sort();
 }
+/**
+ * Extract explicit specification-file citations for a task's frozen spec roots.
+ * This is intentionally path-only: source preparation decides which roots are
+ * normative, while DAG execution only consumes that frozen configuration.
+ */
+export function extractTaskSourceFrontendSpecPaths(markdown, specRoots, governanceRoot = DEFAULT_OPENSPEC_GOVERNANCE_ROOT) {
+    if (!markdown)
+        return [];
+    const raw = new Set();
+    const collect = (token) => {
+        const normalized = normalizeCitationToken(token);
+        if (normalized)
+            raw.add(normalized);
+    };
+    for (const match of markdown.matchAll(/`([^`\n]+)`/g))
+        collect(match[1] ?? "");
+    for (const match of markdown.matchAll(/\[[^\]]*\]\(([^)\s]+)\)/g))
+        collect(match[1] ?? "");
+    for (const root of specRoots) {
+        const escaped = root.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+        for (const match of markdown.matchAll(new RegExp(`(?:^|[\\s\"'([>])(${escaped}/[A-Za-z0-9._/-]+)`, "g"))) {
+            collect(match[1] ?? "");
+        }
+    }
+    return [...raw]
+        .filter((token) => isFrontendSpecFilePath(token, specRoots) && !isGovernanceSubtreePath(token, governanceRoot))
+        .sort();
+}
+/**
+ * Source-preparation helper for explicitly named normative directories. A root
+ * is inferred only on a line that declares a spec/规范/design-system intent;
+ * arbitrary Markdown links never silently broaden task configuration.
+ */
+export function extractDeclaredFrontendSpecRoots(markdown) {
+    const roots = new Set();
+    for (const line of markdown.split(/\r?\n/)) {
+        if (!/(?:规范|规约|标准|设计系统|\bspec(?:ification)?\b|\bdesign[ -]?system\b|\bguidelines?\b|\brules?\b)/i.test(line))
+            continue;
+        for (const match of line.matchAll(/`([^`]+)`|\[[^\]]+\]\(([^)\s]+)\)/g)) {
+            const raw = (match[1] ?? match[2] ?? "").replaceAll("\\", "/").replace(/\/+$/, "");
+            if (!raw || !isValidFrontendSpecRoot(raw))
+                continue;
+            roots.add(isValidOpenspecExtension(raw) ? raw.split("/").slice(0, -1).join("/") : raw);
+        }
+    }
+    return [...roots].filter(isValidFrontendSpecRoot).sort();
+}

package/dist/shared/operator/capabilities.js

@@ -2240,6 +2240,13 @@ export const OPERATOR_COMMAND_COVERAGE = Object.freeze([
         source: "loop-agent",
         note: "server-side read-only run-facts check (ineligible plan / explicit rerun-task recommendation) replaces the browser Human Gate (2026-08-11).",
     },
+    {
+        command: "loop-agent dag follow-up",
+        coverage: "excluded",
+        action: null,
+        source: "loop-agent",
+        exclusionReason: "Frontend review recovery helper is a direct advanced CLI composition (create/import task and optional advance), not an Operator action endpoint.",
+    },
     {
         command: "loop-agent dag reconcile-tasks",
         coverage: "human-gated-required",
@@ -2252,6 +2259,20 @@ export const OPERATOR_COMMAND_COVERAGE = Object.freeze([
         action: "dagFinalVerification",
         source: "loop-agent",
     },
+    {
+        command: "loop-agent dag context",
+        coverage: "excluded",
+        action: null,
+        source: "loop-agent",
+        exclusionReason: "Context export can disclose raw execution bytes and requires a human-selected output path; Console uses dedicated gated actions instead of the generic CLI wrapper.",
+    },
+    {
+        command: "loop-agent dag artifact",
+        coverage: "excluded",
+        action: null,
+        source: "loop-agent",
+        exclusionReason: "Artifact revision staging consumes a human-selected local file and remains on dedicated Console/CLI mutation gates.",
+    },
     {
         command: "loop-agent workflow list",
         coverage: "advanced",

package/dist/shared/operator/safe-run-summary.js

@@ -0,0 +1 @@
+export {};

package/dist/shared/path-safety.js

@@ -0,0 +1,93 @@
+import { constants as fsConstants } from "node:fs";
+import { lstat, open, realpath } from "node:fs/promises";
+import path from "node:path";
+function assertContained(root, target, label) {
+    if (target === root || !target.startsWith(`${root}${path.sep}`)) {
+        throw new Error(`${label}: path escapes boundary: ${target}`);
+    }
+}
+/**
+ * Reject any symlink on the path between `boundaryRoot` and `targetPath`.
+ * This is the lexical/path-walk phase; callers that consume file bytes must
+ * still use readFileBoundarySafe so the checked object is the opened object.
+ */
+export async function assertRealPathInsideBoundary(input) {
+    const root = path.resolve(input.boundaryRoot);
+    const target = path.resolve(input.targetPath);
+    assertContained(root, target, input.label);
+    const rootStat = await lstat(root).catch(() => undefined);
+    if (!rootStat) {
+        throw new Error(`${input.label}: boundary root is not a real directory`);
+    }
+    if (rootStat.isSymbolicLink()) {
+        throw new Error(`${input.label}: boundary root must not be a symlink`);
+    }
+    if (!rootStat.isDirectory()) {
+        throw new Error(`${input.label}: boundary root is not a real directory`);
+    }
+    const segments = path.relative(root, target).split(path.sep).filter(Boolean);
+    let current = root;
+    for (let index = 0; index < segments.length; index += 1) {
+        current = path.join(current, segments[index]);
+        const stat = await lstat(current).catch(() => undefined);
+        if (!stat) {
+            throw new Error(`${input.label}: path component missing: ${segments[index]}`);
+        }
+        if (stat.isSymbolicLink()) {
+            throw new Error(`${input.label}: symlink is forbidden on path: ${segments[index]}`);
+        }
+        if (index < segments.length - 1 && !stat.isDirectory()) {
+            throw new Error(`${input.label}: path ancestor is not a directory: ${segments[index]}`);
+        }
+    }
+    return target;
+}
+/** Reject a non-regular, symlinked, or hardlinked final entry before opening. */
+export async function assertReadableRegularFile(input) {
+    const target = await assertRealPathInsideBoundary(input);
+    const stat = await lstat(target).catch(() => undefined);
+    if (!stat)
+        throw new Error(`${input.label}: path component missing`);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1) {
+        throw new Error(`${input.label}: path must be a regular single-link file`);
+    }
+    return target;
+}
+/**
+ * Read one owned regular file without reopening an unchecked pathname.
+ *
+ * The preflight rejects normal FIFO/device/hardlink cases without opening
+ * them. O_NOFOLLOW rejects a final symlink introduced after preflight and
+ * O_NONBLOCK prevents a swapped FIFO from blocking. The post-open identity and
+ * realpath checks make an ancestor swap detectable before bytes are consumed.
+ */
+export async function readFileBoundarySafe(input) {
+    const target = await assertReadableRegularFile(input);
+    const flags = fsConstants.O_RDONLY |
+        (fsConstants.O_NOFOLLOW ?? 0) |
+        (fsConstants.O_NONBLOCK ?? 0);
+    const handle = await open(target, flags);
+    try {
+        const opened = await handle.stat();
+        if (!opened.isFile() || opened.nlink !== 1) {
+            throw new Error(`${input.label}: path must be a regular single-link file`);
+        }
+        const [resolvedRoot, resolvedTarget, current] = await Promise.all([
+            realpath(path.resolve(input.boundaryRoot)),
+            realpath(target),
+            lstat(target),
+        ]);
+        assertContained(resolvedRoot, resolvedTarget, input.label);
+        if (current.isSymbolicLink() ||
+            !current.isFile() ||
+            current.nlink !== 1 ||
+            current.dev !== opened.dev ||
+            current.ino !== opened.ino) {
+            throw new Error(`${input.label}: path changed while opening`);
+        }
+        return await handle.readFile();
+    }
+    finally {
+        await handle.close().catch(() => { });
+    }
+}

package/dist/shared/preview.js

@@ -1,10 +1,34 @@
 const ENCODER = new TextEncoder();
 const DECODER = new TextDecoder();
+export function redactSecretsWithFindings(text) {
+    let findingCount = 0;
+    const replaceChanged = (match, replacement) => {
+        if (match !== replacement)
+            findingCount += 1;
+        return replacement;
+    };
+    let redacted = text.replace(/(["']?(?:api[_-]?key|token|password|secret|authorization)["']?\s*[:=]\s*["']?)((?:Bearer\s+)?[^"'\s,}]+)/gi, (match, prefix) => replaceChanged(match, `${prefix}***`));
+    redacted = redacted.replace(/(\b[A-Z][A-Z0-9_]*=)[^\s]+/g, (match, prefix) => replaceChanged(match, `${prefix}***`));
+    redacted = redacted.replace(/\bBearer\s+[^\s"']+/gi, (match) => replaceChanged(match, "Bearer ***"));
+    // High-confidence provider-style tokens (OpenAI sk-, GitHub ghp_/gho_,
+    // Slack xox*, AWS AKIA) are credential-like even without a key=value
+    // prefix (exec-plan 2026-08-25 D4: credential-like 默认阻断).
+    redacted = redacted.replace(/\b(?:sk-[A-Za-z0-9_-]{16,}|gh[pos]_[A-Za-z0-9]{20,}|xox[baprs]-[A-Za-z0-9-]{10,}|AKIA[0-9A-Z]{16})\b/g, (match) => replaceChanged(match, "***"));
+    return { redacted, findingCount };
+}
+export function redactSensitivePathsWithFindings(text) {
+    let findingCount = 0;
+    const replaceHome = (match) => {
+        if (match !== "<redacted-home>")
+            findingCount += 1;
+        return "<redacted-home>";
+    };
+    let redacted = text.replace(/\/(?:Users|home)\/[^/\s"'\\]+/g, replaceHome);
+    redacted = redacted.replace(/\b[A-Za-z]:\\Users\\[^\\/\s"']+/gi, replaceHome);
+    return { redacted, findingCount };
+}
 export function redactSecrets(text) {
-    return text
-        .replace(/\bBearer\s+[^\s"']+/gi, "Bearer ***")
-        .replace(/(\b[A-Z][A-Z0-9_]*=)[^\s]+/g, "$1***")
-        .replace(/(["']?(?:api[_-]?key|token|password|secret|authorization)["']?\s*[:=]\s*["']?)([^"'\s,}]+)/gi, "$1***");
+    return redactSecretsWithFindings(text).redacted;
 }
 export function truncateUtf8Preview(text, maxBytes = 4096) {
     if (maxBytes <= 0)

package/dist/task/config-types.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { isOpenspecSpecFilePath } from "../shared/openspec-spec.js";
+import { DEFAULT_FRONTEND_SPEC_ROOTS, isFrontendSpecFilePath, isValidFrontendSpecRoot, } from "../shared/openspec-spec.js";
 export const taskFlowSchema = z.enum([
     "auto",
     "micro",
@@ -14,6 +14,7 @@ export const taskKindSchema = z.enum([
     "frontend-implementation",
     "frontend-test",
     "backend-test",
+    "backend-test-analysis",
     "knowledge-sync",
     "knowledge-graph-bootstrap",
 ]);
@@ -76,13 +77,27 @@ export const frontendOpenspecPolicySchema = z.enum(["cited", "scan-strict"]);
  */
 export const frontendOpenspecConfigSchema = z.object({
     policy: frontendOpenspecPolicySchema.optional().default("cited"),
+    /**
+     * Repo-relative directories containing frontend normative files. These are
+     * frozen in task.json during contract preparation, before DAG generation.
+     */
+    specRoots: z
+        .array(z.string().refine((candidate) => isValidFrontendSpecRoot(candidate), "frontendOpenspec.specRoots entries must be normalized repo-relative directories"))
+        .optional(),
     requiredReadPaths: z
-        .array(z
-        .string()
-        .refine((candidate) => !candidate.includes("\\") &&
-        isOpenspecSpecFilePath(candidate), "frontendOpenspec.requiredReadPaths entries must be repo-relative supported files under openspec/schemas/, openspec/project-specs/, or ai_workspace/"))
+        .array(z.string())
         .optional()
         .default([]),
+}).superRefine((value, ctx) => {
+    const roots = value.specRoots ?? DEFAULT_FRONTEND_SPEC_ROOTS;
+    if (new Set(roots).size !== roots.length) {
+        ctx.addIssue({ code: z.ZodIssueCode.custom, message: "frontendOpenspec.specRoots must not contain duplicates", path: ["specRoots"] });
+    }
+    for (const required of value.requiredReadPaths) {
+        if (!isFrontendSpecFilePath(required, roots)) {
+            ctx.addIssue({ code: z.ZodIssueCode.custom, message: "frontendOpenspec.requiredReadPaths entries must be repo-relative supported files under frontendOpenspec.specRoots", path: ["requiredReadPaths"] });
+        }
+    }
 });
 /** Batch limits and gate profile for the browser-driven frontend test DAG.
  * Token fields are post-case stop thresholds, not model-provider hard caps. */
@@ -130,6 +145,75 @@ export const frontendTestConfigSchema = z.object({
         .strict()
         .optional(),
 });
+const backendTestBudgetProofSchema = z
+    .object({
+    groupId: z.string().min(1),
+    estimatedCaseCount: z.number().int().positive(),
+    estimatedTestPointCount: z.number().int().positive(),
+    estimatedOutputChars: z.number().int().positive(),
+    maxOutputCharsPerWriter: z.number().int().positive(),
+    estimatorVersion: z.literal("backend-test-output-estimator-v1"),
+    inputSha256: z.string().regex(/^[a-f0-9]{64}$/),
+})
+    .strict();
+const backendTestModuleLayoutEntrySchema = z
+    .object({
+    stem: z.string().regex(/^[a-z][a-z0-9_]*$/),
+    businessResource: z.string().min(1),
+    markdownPath: z.string().min(1),
+    pytestPath: z.string().min(1),
+    ownedOperations: z.array(z.string().regex(/^(?:GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS) \/\S+$/)).min(1),
+    splitReason: z.enum([
+        "explicit-user-layout",
+        "primary-business-resource",
+        "independent-business-resource",
+        "output-budget",
+    ]),
+    budgetProof: backendTestBudgetProofSchema.optional(),
+})
+    .strict()
+    .superRefine((entry, ctx) => {
+    const safe = (value) => !value.startsWith("/") &&
+        !value.startsWith("\\") &&
+        !value.includes("..") &&
+        !value.includes("\\");
+    if (!safe(entry.markdownPath) || !entry.markdownPath.endsWith(".md")) {
+        ctx.addIssue({ code: z.ZodIssueCode.custom, path: ["markdownPath"], message: "must be a safe repository-relative .md path" });
+    }
+    if (!safe(entry.pytestPath) || !entry.pytestPath.endsWith(".py")) {
+        ctx.addIssue({ code: z.ZodIssueCode.custom, path: ["pytestPath"], message: "must be a safe repository-relative .py path" });
+    }
+    if (entry.splitReason === "output-budget" && !entry.budgetProof) {
+        ctx.addIssue({ code: z.ZodIssueCode.custom, path: ["budgetProof"], message: "is required for output-budget split" });
+    }
+    if (entry.splitReason !== "output-budget" && entry.budgetProof) {
+        ctx.addIssue({ code: z.ZodIssueCode.custom, path: ["budgetProof"], message: "is only valid for output-budget split" });
+    }
+});
+const backendTestModuleLayoutSchema = z
+    .object({
+    schemaId: z.literal("backend-test-module-layout-v1"),
+    mode: z.enum(["explicit-file-layout", "business-resource-layout"]),
+    modules: z.array(backendTestModuleLayoutEntrySchema).min(1).max(8),
+})
+    .strict()
+    .superRefine((layout, ctx) => {
+    for (const key of ["stem", "markdownPath", "pytestPath"]) {
+        const seen = new Set();
+        for (let index = 0; index < layout.modules.length; index += 1) {
+            const value = layout.modules[index][key];
+            if (seen.has(value))
+                ctx.addIssue({ code: z.ZodIssueCode.custom, path: ["modules", index, key], message: `duplicate ${key}` });
+            seen.add(value);
+        }
+    }
+    if (layout.mode === "explicit-file-layout") {
+        layout.modules.forEach((entry, index) => {
+            if (entry.splitReason !== "explicit-user-layout")
+                ctx.addIssue({ code: z.ZodIssueCode.custom, path: ["modules", index, "splitReason"], message: "explicit-file-layout requires explicit-user-layout" });
+        });
+    }
+});
 /** Backend-test artifact layout and pipeline mode configuration (plan A/B/D). */
 export const backendTestConfigSchema = z
     .object({
@@ -151,6 +235,8 @@ export const backendTestConfigSchema = z
     workspaceControl: z.enum(["git", "filesystem-only"]).optional(),
     /** Per-command timeout for the readiness-authorized pytest/HTML execution node. */
     executeTimeoutMs: z.number().int().min(60_000).max(7_200_000).optional(),
+    /** Optional strict physical/business module layout; authoritative over model-derived layout. */
+    moduleLayout: backendTestModuleLayoutSchema.optional(),
 })
     .strict()
     .optional();
@@ -165,7 +251,7 @@ const taskConfigObjectSchema = z.object({
     taskId: z.string(),
     title: z.string(),
     sourceFiles: z.array(z.string()),
-    /** standard: 本仓库需求实现；feature-study: 参考外部代码特性并在目标仓库落地；frontend-implementation: 前端实现 DAG；backend-test: 后端测试 DAG；knowledge-sync: 最终验证后回写测试知识库 DAG；knowledge-graph-bootstrap: AI 辅助业务知识图谱初始化 */
+    /** standard: 本仓库需求实现；feature-study: 参考外部代码特性并在目标仓库落地；frontend-implementation: 前端实现 DAG；frontend-test: 前端浏览器测试 DAG；backend-test-analysis: 只读后端测试分析 DAG；backend-test: 后端测试 DAG；knowledge-sync: 最终验证后回写测试知识库 DAG；knowledge-graph-bootstrap: AI 辅助业务知识图谱初始化 */
     taskKind: taskKindSchema.optional().default("standard"),
     /** true = taskKind 由人类显式选择（含显式 standard）；DAG 路由必须尊重，不做语义改写。 */
     taskKindExplicit: z.boolean().optional(),
@@ -209,6 +295,21 @@ const taskConfigObjectSchema = z.object({
     maxFixLoops: z.number().int().min(0).optional().default(2),
     /** Supervised DAG convergence is opt-in until runtime smoke evidence is stronger. */
     convergence: convergenceConfigSchema.optional().default({ enabled: false }),
+    /** Frontend recovery continuation quota. Bounds how many times a failed
+     * frontend run may auto-recover via M6 recovery operations (1 = current
+     * default; raise to 2-3 for more tolerance of transient verify failures). */
+    frontendRecovery: z
+        .object({
+        maxContinuations: z
+            .number()
+            .int()
+            .min(1)
+            .max(5)
+            .optional()
+            .default(1),
+    })
+        .strict()
+        .optional(),
     /** Outer loop auto mode never writes by default; DAG execute requires this policy plus path/writeSet gates. */
     loopAutoExecutionPolicy: loopAutoExecutionPolicySchema
         .optional()

package/dist/task/contract/adopt.js

@@ -90,6 +90,10 @@ export async function adoptTaskContract(input) {
             requirementBytes: bytes.requirementBytes,
             constraintsBytes: bytes.constraintsBytes,
             referenceManifestBytes: bytes.referenceManifestBytes,
+            ...(state.ref?.sourceHashes.requirementLedgerSha256 &&
+                bytes.requirementLedgerBytes !== null
+                ? { requirementLedgerBytes: bytes.requirementLedgerBytes }
+                : {}),
         });
         const taskConfigSha256 = computeTaskConfigSha256(fullConfig);
         const canonicalHash = computeCanonicalHash({

package/dist/task/contract/import-revision.js

@@ -45,6 +45,10 @@ export async function refreshManagedContractAfterImport(input) {
             requirementBytes: bytes.requirementBytes,
             constraintsBytes: bytes.constraintsBytes,
             referenceManifestBytes: bytes.referenceManifestBytes,
+            ...(state2.ref.sourceHashes.requirementLedgerSha256 &&
+                bytes.requirementLedgerBytes !== null
+                ? { requirementLedgerBytes: bytes.requirementLedgerBytes }
+                : {}),
         });
         const taskConfigSha256 = computeTaskConfigSha256(fullConfig);
         const canonicalHash = computeCanonicalHash({

package/dist/task/contract/project.js

@@ -184,6 +184,9 @@ export function mergeManagedTaskConfigFields(existing, draft) {
             command: cmd.command,
             ...(cmd.timeoutMs !== undefined ? { timeoutMs: cmd.timeoutMs } : {}),
         })),
+        ...(draft.frontendOpenspec !== undefined
+            ? { frontendOpenspec: draft.frontendOpenspec }
+            : {}),
     };
     if (draft.featureId !== undefined) {
         next.featureId = draft.featureId;

package/dist/task/contract/schema.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { backendTestConfigSchema, taskKindSchema, taskVerifyCommandSchema, } from "../config-types.js";
+import { backendTestConfigSchema, frontendOpenspecConfigSchema, taskKindSchema, taskVerifyCommandSchema, } from "../config-types.js";
 import { TASK_CONFIG_SCHEMA_VERSION, TASK_CONTRACT_CANONICALIZER_VERSION, TASK_CONTRACT_DRAFT_SCHEMA_VERSION, TASK_CONTRACT_PROJECTION_VERSION, TASK_CONTRACT_REF_SCHEMA_VERSION, } from "./constants.js";
 const sha256Schema = z
     .string()
@@ -74,6 +74,7 @@ export const taskContractDraftSchema = z
     openQuestions: z.array(z.string()).optional(),
     assumptions: z.array(z.string()).optional(),
     hardConstraints: z.array(z.string()).optional(),
+    frontendOpenspec: frontendOpenspecConfigSchema.optional(),
     interviewAssessmentRef: z
         .object({
         draftSha256: z.string().min(1),