@tea-agent/loop-agent 0.42.0-next.2 → 0.42.0-next.4

package/dist/workflows/dag/frontend-verification-trace.js

@@ -49,15 +49,236 @@ function symbolEvidenceCandidates(symbol) {
         return [symbol, describeTitle, "describe("];
     return [symbol];
 }
-function isConfigurationVerificationFile(file) {
+export function isConfigurationVerificationFile(file) {
     return /(?:^|\/)(?:package\.json|tsconfig(?:\.[^/]+)?\.json|(?:vite|webpack|rollup|docusaurus)\.config\.[cm]?[jt]s)$/.test(file.replace(/\\/g, "/"));
 }
+function isIdentifierStart(char) {
+    return char !== undefined && /[A-Za-z_$]/.test(char);
+}
+function isIdentifierPart(char) {
+    return char !== undefined && /[A-Za-z0-9_$]/.test(char);
+}
+function readQuotedString(content, start) {
+    const quote = content[start];
+    if (quote !== "'" && quote !== '"' && quote !== "`")
+        return null;
+    let value = "";
+    for (let index = start + 1; index < content.length; index += 1) {
+        const char = content[index];
+        if (char === "\\") {
+            const escaped = content[index + 1];
+            if (escaped === undefined)
+                return null;
+            value += escaped;
+            index += 1;
+            continue;
+        }
+        if (quote === "`" && char === "$" && content[index + 1] === "{") {
+            // Interpolated templates are not literal titles: their runtime value is
+            // not deterministic from source text alone.
+            return null;
+        }
+        if (char === quote)
+            return { end: index + 1, value };
+        value += char;
+    }
+    return null;
+}
+function skipQuotedSource(content, start) {
+    const quote = content[start];
+    for (let index = start + 1; index < content.length; index += 1) {
+        if (content[index] === "\\") {
+            index += 1;
+            continue;
+        }
+        if (content[index] === quote)
+            return index + 1;
+    }
+    return content.length;
+}
+/**
+ * Small JS/TS lexer for test-title extraction. It intentionally emits only
+ * identifiers, string literals, and punctuation while skipping comments. This
+ * prevents prose in comments or ordinary strings from becoming trace evidence
+ * without adding a parser as a production dependency.
+ */
+function lexFrontendTestSource(content) {
+    const tokens = [];
+    let index = 0;
+    while (index < content.length) {
+        const char = content[index];
+        if (/\s/.test(char ?? "")) {
+            index += 1;
+            continue;
+        }
+        if (char === "/" && content[index + 1] === "/") {
+            index += 2;
+            while (index < content.length && content[index] !== "\n")
+                index += 1;
+            continue;
+        }
+        if (char === "/" && content[index + 1] === "*") {
+            const end = content.indexOf("*/", index + 2);
+            index = end < 0 ? content.length : end + 2;
+            continue;
+        }
+        const quoted = readQuotedString(content, index);
+        if (quoted) {
+            tokens.push({ type: "string", value: quoted.value });
+            index = quoted.end;
+            continue;
+        }
+        if (char === "'" || char === '"' || char === "`") {
+            // Unterminated or interpolated strings are skipped instead of being
+            // tokenized as executable source.
+            index = skipQuotedSource(content, index);
+            continue;
+        }
+        if (isIdentifierStart(char)) {
+            let end = index + 1;
+            while (isIdentifierPart(content[end]))
+                end += 1;
+            tokens.push({ type: "identifier", value: content.slice(index, end) });
+            index = end;
+            continue;
+        }
+        tokens.push({ type: "punctuation", value: char ?? "" });
+        index += 1;
+    }
+    return tokens;
+}
+/** Extract literal titles from real describe/it/test calls in JS/TS source. */
+export function extractFrontendTestTitles(content) {
+    const tokens = lexFrontendTestSource(content);
+    const titles = [];
+    const configurationModifiers = new Set(["each", "runIf", "skipIf"]);
+    function closingParenIndex(openIndex) {
+        let depth = 0;
+        for (let cursor = openIndex; cursor < tokens.length; cursor += 1) {
+            if (tokens[cursor]?.type !== "punctuation")
+                continue;
+            if (tokens[cursor]?.value === "(")
+                depth += 1;
+            if (tokens[cursor]?.value === ")") {
+                depth -= 1;
+                if (depth === 0)
+                    return cursor;
+            }
+        }
+        return null;
+    }
+    for (let index = 0; index < tokens.length; index += 1) {
+        const token = tokens[index];
+        if (token?.type !== "identifier" ||
+            !["describe", "it", "test"].includes(token.value) ||
+            (tokens[index - 1]?.type === "punctuation" &&
+                tokens[index - 1]?.value === ".")) {
+            continue;
+        }
+        let cursor = index + 1;
+        let hasConfigurationModifier = false;
+        while (tokens[cursor]?.type === "punctuation" &&
+            tokens[cursor]?.value === "." &&
+            tokens[cursor + 1]?.type === "identifier") {
+            if (tokens[cursor + 1]?.type === "identifier" &&
+                configurationModifiers.has(tokens[cursor + 1].value)) {
+                hasConfigurationModifier = true;
+            }
+            cursor += 2;
+        }
+        if (tokens[cursor]?.type !== "punctuation" ||
+            tokens[cursor]?.value !== "(") {
+            continue;
+        }
+        if (hasConfigurationModifier) {
+            const close = closingParenIndex(cursor);
+            if (close === null ||
+                tokens[close + 1]?.type !== "punctuation" ||
+                tokens[close + 1]?.value !== "(") {
+                continue;
+            }
+            cursor = close + 1;
+        }
+        if (tokens[cursor + 1]?.type !== "string")
+            continue;
+        titles.push(tokens[cursor + 1].value);
+    }
+    return titles;
+}
+function traceKeyMatchesTitle(traceKey, title) {
+    const escaped = traceKey.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    return new RegExp(`(?:^|[^A-Za-z0-9_-])${escaped}(?:$|[^A-Za-z0-9_-])`).test(title);
+}
+function formatObservedTestTitles(titles) {
+    if (titles.length === 0)
+        return "(none)";
+    const limit = 8;
+    const preview = titles
+        .slice(0, limit)
+        .map((title) => title.length > 120 ? `${title.slice(0, 117)}...` : title)
+        .join(" | ");
+    return titles.length > limit
+        ? `${preview} | ... (${titles.length - limit} more)`
+        : preview;
+}
+async function evaluateTargetFileTrace(input) {
+    const fileIssues = await assertFileAndSymbol({
+        workspaceRoot: input.workspaceRoot,
+        file: input.target.file,
+    });
+    if (fileIssues.length || input.target.type === "static") {
+        return { issues: fileIssues };
+    }
+    const absolute = path.resolve(input.workspaceRoot, input.target.file);
+    const content = await readFile(absolute, "utf8");
+    const observedTestTitles = extractFrontendTestTitles(content);
+    if (observedTestTitles.some((title) => traceKeyMatchesTitle(input.target.id, title))) {
+        return { issues: [], observedTestTitles };
+    }
+    const observed = formatObservedTestTitles(observedTestTitles);
+    return {
+        issues: [
+            `trace key not found in test title: ${input.target.id} in ${input.target.file}; observed test titles: ${observed}`,
+        ],
+        observedTestTitles,
+    };
+}
+/**
+ * Lightweight writer-boundary check. It validates file existence and stable
+ * behavior trace tokens only; frozen commands remain the final trace gate's
+ * responsibility after command execution.
+ */
+export async function evaluateFrontendWriterTracePreflight(input) {
+    const targets = [];
+    const failures = [];
+    for (const target of input.contract.verificationTargets) {
+        const fileTrace = await evaluateTargetFileTrace({
+            workspaceRoot: input.workspaceRoot,
+            target,
+        });
+        for (const detail of fileTrace.issues) {
+            failures.push({ category: "coverage-gap", targetId: target.id, detail });
+        }
+        targets.push({
+            id: target.id,
+            commandLabel: target.commandLabel,
+            file: target.file,
+            ...(target.symbol ? { symbol: target.symbol } : {}),
+            ...(target.type !== "static" ? { traceKey: target.id } : {}),
+            status: fileTrace.issues.length ? "failed" : "ok",
+            matchedNodeIds: [],
+            issues: fileTrace.issues,
+        });
+    }
+    return { ok: failures.length === 0, targets, failures };
+}
 /**
  * Pure verification-target evaluation shared by the trace gate and the repair
  * assess gate. It derives, for each contract verification target, whether the
  * target bound to frozen evidence (commandLabel owners), and whether the file
- * and optional symbol exist in the workspace. It performs no writes and throws
- * nothing: failures are returned as `hardIssues` plus per-target `status`.
+ * and stable behavior-target id exist in a real test title. It performs no
+ * writes and throws nothing: failures are returned as `hardIssues` plus
+ * per-target `status`.
  */
 export async function evaluateVerificationTargets(input) {
     const targets = [];
@@ -75,17 +296,11 @@ export async function evaluateVerificationTargets(input) {
         if (!owners?.length) {
             issues.push(`commandLabel not executed in current-run frozen evidence: ${target.commandLabel}`);
         }
-        const fileIssues = await assertFileAndSymbol({
+        const fileTrace = await evaluateTargetFileTrace({
             workspaceRoot: input.workspaceRoot,
-            file: target.file,
-            // Configuration files prove that the command's entrypoint exists;
-            // they do not expose source symbols. LLMs sometimes derive a
-            // filename fragment such as "build" from tsconfig.build.json.
-            symbol: isConfigurationVerificationFile(target.file)
-                ? undefined
-                : target.symbol,
+            target,
         });
-        issues.push(...fileIssues);
+        issues.push(...fileTrace.issues);
         const status = issues.length ? "failed" : "ok";
         if (issues.length)
             hardIssues.push(...issues.map((i) => `${target.id}: ${i}`));
@@ -94,6 +309,7 @@ export async function evaluateVerificationTargets(input) {
             commandLabel: target.commandLabel,
             file: target.file,
             symbol: target.symbol,
+            ...(target.type !== "static" ? { traceKey: target.id } : {}),
             status,
             matchedNodeIds: owners ?? [],
             issues,
@@ -101,6 +317,25 @@ export async function evaluateVerificationTargets(input) {
     }
     return { targets, hardIssues };
 }
+/**
+ * Legacy deterministic symbol resolvability check retained by canonical
+ * normalization (`dropUnresolvedVerificationSymbols`). New plan tools do not
+ * expose symbol and runtime trace binding uses the stable target id. This
+ * helper still handles old `all describe blocks`, `describe('title')`, and
+ * slash-delimited labels so existing run artifacts normalize consistently.
+ */
+export function verificationSymbolMatchesContent(symbol, content) {
+    if (symbol.trim().toLowerCase() === "all describe blocks")
+        return content.includes("describe(");
+    const symbols = symbol.includes(" / ")
+        ? symbol
+            .split(/[（(]/, 1)[0]
+            .split("/")
+            .map((item) => item.trim())
+            .filter(Boolean)
+        : [symbol];
+    return symbols.every((item) => symbolEvidenceCandidates(item).some((candidate) => content.includes(candidate)));
+}
 async function assertFileAndSymbol(input) {
     const issues = [];
     const absolute = path.resolve(input.workspaceRoot, input.file);
@@ -124,18 +359,8 @@ async function assertFileAndSymbol(input) {
     }
     if (input.symbol) {
         const content = await readFile(absolute, "utf8");
-        const symbols = input.symbol.includes(" / ")
-            ? input.symbol
-                .split(/[（(]/, 1)[0]
-                .split("/")
-                .map((symbol) => symbol.trim())
-                .filter(Boolean)
-            : [input.symbol];
-        for (const symbol of symbols) {
-            const matched = symbolEvidenceCandidates(symbol).some((candidate) => content.includes(candidate));
-            if (!matched) {
-                issues.push(`symbol not found: ${symbol} in ${input.file}`);
-            }
+        if (!verificationSymbolMatchesContent(input.symbol, content)) {
+            issues.push(`symbol not found: ${input.symbol} in ${input.file}`);
         }
     }
     return issues;

package/dist/workflows/dag/frontend-worktree-diff.js

@@ -5,25 +5,152 @@ import { runResilientGitCommand } from "../../shared/resilient-git.js";
 import { writeDagRunJsonArtifact } from "../../infrastructure/harness/artifact-store.js";
 import { pathMatchesPattern } from "../../shared/git-progress.js";
 export const FRONTEND_WORKTREE_DIFF_SCHEMA_ID = "frontend-worktree-diff-v1";
+export const FRONTEND_REVIEW_DIFF_INDEX_SCHEMA_ID = "frontend-review-diff-index-v1";
+const MAX_REVIEW_DIFF_SUMMARY_ENTRIES = 48;
+/** Maximum diff payload per review artifact; metadata adds a small fixed header. */
+const MAX_REVIEW_DIFF_FRAGMENT_BYTES = 20 * 1024;
 export const FRONTEND_WORKTREE_BASELINE_SCHEMA_ID = "frontend-worktree-baseline-v1";
 async function runGit(cwd, args) {
     const result = await runResilientGitCommand({ cwd, args, readOnly: true });
     return { code: result.code, stdout: result.stdout, stderr: result.stderr };
 }
+/**
+ * Ephemeral interpreter/tool caches that writers may create while drafting
+ * tests (kept in sync with `isEphemeralToolCachePath` in
+ * src/executors/shell-write-guard.ts). They are not product evidence: tool
+ * cache writes must neither fail the write guard nor appear in the review
+ * diff as pre-existing changes.
+ */
+export function isEphemeralToolCachePath(filePath) {
+    const normalized = filePath.replace(/\\/g, "/");
+    if (!normalized)
+        return false;
+    if (normalized === ".pytest_cache" ||
+        normalized.startsWith(".pytest_cache/")) {
+        return true;
+    }
+    if (normalized === ".mypy_cache" || normalized.startsWith(".mypy_cache/")) {
+        return true;
+    }
+    if (normalized === ".ruff_cache" || normalized.startsWith(".ruff_cache/")) {
+        return true;
+    }
+    if (normalized === ".playwright-cli" ||
+        normalized.startsWith(".playwright-cli/")) {
+        return true;
+    }
+    if (normalized === ".coverage" || normalized.startsWith(".coverage.")) {
+        return true;
+    }
+    // vite/vitest runtime caches live under node_modules/.vite (e.g.
+    // node_modules/.vite/vitest/results.json). node_modules is the gitignored
+    // dependency tree — tool cache writes there are never a product change.
+    if (normalized.startsWith("node_modules/.vite/")) {
+        return true;
+    }
+    if (/(?:^|\/)__pycache__(?:\/|$)/.test(normalized))
+        return true;
+    if (/\.(?:pyc|pyo)$/.test(normalized))
+        return true;
+    return false;
+}
 function splitLines(text) {
     return text
         .split(/\r?\n/)
         .map((line) => line.trim())
         .filter(Boolean);
 }
-function statusPaths(status) {
-    return status
-        .split(/\r?\n/)
-        .map((line) => line.trimEnd())
-        .filter((line) => line.length >= 4)
-        .map((line) => line.slice(3).split(" -> ").at(-1) ?? "")
-        .filter(Boolean)
-        .sort();
+function buildReviewDiffSummary(input) {
+    const files = [...input.hunks.reduce((grouped, hunk) => {
+            const existing = grouped.get(hunk.path);
+            if (existing) {
+                existing.bytes += hunk.bytes;
+                existing.lastPatchPath = hunk.patchPath;
+                return grouped;
+            }
+            grouped.set(hunk.path, {
+                path: hunk.path,
+                bytes: hunk.bytes,
+                parts: hunk.parts,
+                firstPatchPath: hunk.patchPath,
+                lastPatchPath: hunk.patchPath,
+            });
+            return grouped;
+        }, new Map()).values()];
+    const listedFiles = files.slice(0, MAX_REVIEW_DIFF_SUMMARY_ENTRIES);
+    const remainingFiles = files.length - listedFiles.length;
+    const listedUntracked = input.untrackedFiles.slice(0, MAX_REVIEW_DIFF_SUMMARY_ENTRIES);
+    const remainingUntracked = input.untrackedFiles.length - listedUntracked.length;
+    return [
+        "# Frontend review diff summary",
+        "",
+        "Read this bounded summary first. Do not read artifacts/diff_patch.patch in full; it is retained only as the canonical audit artifact.",
+        "For a semantic finding, read only the matching per-file diff fragment below and then the current source file when necessary. Read fragments in part order when a file has more than one.",
+        "",
+        `Canonical patch SHA-256: ${input.patchSha256}`,
+        `Canonical patch bytes: ${input.patchBytes}`,
+        `Tracked changed files: ${files.length}`,
+        `Review diff fragments: ${input.hunks.length}`,
+        `Untracked files (inventory only): ${input.untrackedFiles.length}`,
+        "",
+        "## Tracked file diff fragment references",
+        ...(listedFiles.length > 0
+            ? listedFiles.map((file) => file.parts === 1
+                ? `- ${file.path} — ${file.bytes} bytes — read ${file.firstPatchPath} only if this file needs review`
+                : `- ${file.path} — ${file.bytes} bytes across ${file.parts} ordered fragments — read ${file.firstPatchPath} through ${file.lastPatchPath} only if this file needs review`)
+            : ["- (none)"]),
+        ...(remainingFiles > 0
+            ? [`- … ${remainingFiles} additional tracked files are recorded in contracts/frontend-review-diff-index.json; do not bulk-read them.`]
+            : []),
+        "",
+        "## Untracked inventory",
+        ...(listedUntracked.length > 0
+            ? listedUntracked.map((file) => `- ${file}`)
+            : ["- (none)"]),
+        ...(remainingUntracked > 0
+            ? [`- … ${remainingUntracked} additional untracked files are recorded in contracts/frontend-review-diff-index.json.`]
+            : []),
+        "",
+    ].join("\n");
+}
+function splitReviewDiffFragments(text) {
+    const fragments = [];
+    let current = "";
+    for (const line of text.match(/[^\n]*\n|[^\n]+/g) ?? []) {
+        const lineBytes = Buffer.byteLength(line);
+        if (current.length > 0 &&
+            Buffer.byteLength(current) + lineBytes >
+                MAX_REVIEW_DIFF_FRAGMENT_BYTES) {
+            fragments.push(current);
+            current = "";
+        }
+        if (lineBytes <= MAX_REVIEW_DIFF_FRAGMENT_BYTES) {
+            current += line;
+            continue;
+        }
+        // Generated/minified files can produce a single diff line larger than the
+        // review budget. Split by Unicode code point so no fragment exceeds the
+        // byte limit while preserving the original patch bytes when concatenated.
+        let oversizedLineFragment = "";
+        let oversizedLineFragmentBytes = 0;
+        for (const codePoint of line) {
+            const codePointBytes = Buffer.byteLength(codePoint);
+            if (oversizedLineFragmentBytes > 0 &&
+                oversizedLineFragmentBytes + codePointBytes >
+                    MAX_REVIEW_DIFF_FRAGMENT_BYTES) {
+                fragments.push(oversizedLineFragment);
+                oversizedLineFragment = "";
+                oversizedLineFragmentBytes = 0;
+            }
+            oversizedLineFragment += codePoint;
+            oversizedLineFragmentBytes += codePointBytes;
+        }
+        if (oversizedLineFragment)
+            fragments.push(oversizedLineFragment);
+    }
+    if (current.length > 0)
+        fragments.push(current);
+    return fragments.length > 0 ? fragments : [""];
 }
 async function sha256File(filePath) {
     try {
@@ -37,15 +164,26 @@ async function sha256File(filePath) {
 export async function captureFrontendWorktreeBaseline(input) {
     const run = input.dependencies?.runGit ?? runGit;
     const root = path.resolve(input.workspaceRoot);
-    const status = await run(root, [
-        "status",
-        "--porcelain=v1",
-        "--untracked-files=all",
+    // Baseline = the full concrete workspace inventory the writer may touch
+    // (tracked + untracked, gitignored excluded), NOT just currently-changed
+    // files. Using `git status` here made a clean repository baseline-empty
+    // (status has no entries when nothing changed), which wrongly blocked
+    // writer admission with baseline-empty.
+    const ls = await run(root, [
+        "ls-files",
+        "-co",
+        "--exclude-standard",
+        "-z",
     ]);
-    if (status.code !== 0) {
-        throw new Error(`frontend worktree baseline failed: ${status.stderr.trim() || status.stdout.trim()}`);
+    if (ls.code !== 0) {
+        throw new Error(`frontend worktree baseline failed: ${ls.stderr.trim() || ls.stdout.trim()}`);
     }
-    const files = statusPaths(status.stdout);
+    const files = ls.stdout
+        .split("\0")
+        .map((line) => line.trim())
+        .filter(Boolean)
+        .filter((file) => !isEphemeralToolCachePath(file))
+        .sort();
     const hashes = {};
     for (const file of files)
         hashes[file] = await sha256File(path.join(root, file));
@@ -112,8 +250,12 @@ export async function runFrontendWorktreeDiffGate(input) {
     if (untracked.code !== 0) {
         throw new Error(`frontend worktree diff gate ls-files failed: ${untracked.stderr.trim() || untracked.stdout.trim()}`);
     }
-    const changedFilesAll = splitLines(nameOnly.stdout).sort();
-    const untrackedFilesAll = splitLines(untracked.stdout).sort();
+    const changedFilesAll = splitLines(nameOnly.stdout)
+        .filter((file) => !isEphemeralToolCachePath(file))
+        .sort();
+    const untrackedFilesAll = splitLines(untracked.stdout)
+        .filter((file) => !isEphemeralToolCachePath(file))
+        .sort();
     const authorizedChangedPaths = input.authorizedChangedPaths ?? [];
     if (baseline) {
         for (const file of baseline.files) {
@@ -160,11 +302,65 @@ export async function runFrontendWorktreeDiffGate(input) {
     const absolutePatch = path.join(input.runDir, ...relativePatch.split("/"));
     await mkdir(path.dirname(absolutePatch), { recursive: true });
     await writeFile(absolutePatch, patchText, "utf8");
+    // Keep the complete patch as immutable audit evidence, but create a bounded
+    // reviewer entrypoint plus one file-scoped artifact per tracked change. This
+    // prevents final review from loading a multi-thousand-line patch into a
+    // single Pi session merely to inspect one or two relevant files.
+    const reviewHunks = [];
+    const reviewHunksDir = path.join(input.runDir, "artifacts", "diff-hunks");
+    await mkdir(reviewHunksDir, { recursive: true });
+    for (const [index, file] of changedFiles.entries()) {
+        const filePatch = await run(root, ["diff", "--binary", "HEAD", "--", file]);
+        if (filePatch.code !== 0) {
+            throw new Error(`frontend worktree diff hunk failed for ${file}: ${filePatch.stderr.trim() || filePatch.stdout.trim()}`);
+        }
+        const text = filePatch.stdout.endsWith("\n") || filePatch.stdout.length === 0
+            ? filePatch.stdout
+            : `${filePatch.stdout}\n`;
+        const fragments = splitReviewDiffFragments(text);
+        for (const [partIndex, fragment] of fragments.entries()) {
+            const part = partIndex + 1;
+            const patchPath = `artifacts/diff-hunks/${String(index + 1).padStart(3, "0")}-${String(part).padStart(3, "0")}.patch`;
+            const artifact = [
+                "# Frontend review diff fragment",
+                `# path: ${file}`,
+                `# part: ${part}/${fragments.length}`,
+                "",
+                fragment,
+            ].join("\n");
+            await writeFile(path.join(input.runDir, ...patchPath.split("/")), artifact, "utf8");
+            reviewHunks.push({
+                path: file,
+                patchPath,
+                sha256: createHash("sha256").update(artifact).digest("hex"),
+                bytes: Buffer.byteLength(artifact),
+                part,
+                parts: fragments.length,
+            });
+        }
+    }
+    const reviewIndexPath = "contracts/frontend-review-diff-index.json";
+    await writeDagRunJsonArtifact(input.runDir, reviewIndexPath, {
+        schemaVersion: 1,
+        schemaId: FRONTEND_REVIEW_DIFF_INDEX_SCHEMA_ID,
+        patchSha256,
+        hunks: reviewHunks,
+        untrackedFiles,
+    });
+    const reviewSummaryPath = "artifacts/diff_summary.md";
+    await writeFile(path.join(input.runDir, ...reviewSummaryPath.split("/")), buildReviewDiffSummary({
+        patchSha256,
+        patchBytes: Buffer.byteLength(patchText),
+        hunks: reviewHunks,
+        untrackedFiles,
+    }), "utf8");
     const payload = {
         schemaVersion: 1,
         schemaId: FRONTEND_WORKTREE_DIFF_SCHEMA_ID,
         patchPath: relativePatch,
         patchSha256,
+        reviewSummaryPath,
+        reviewIndexPath,
         changedFiles,
         untrackedFiles,
         empty: changedFiles.length === 0 && untrackedFiles.length === 0,
@@ -177,6 +373,8 @@ export async function runFrontendWorktreeDiffGate(input) {
         patchPath: relativePatch,
         patchAbsolutePath: absolutePatch,
         patchSha256,
+        reviewSummaryPath,
+        reviewIndexPath,
         changedFiles,
         untrackedFiles,
         empty: payload.empty,
@@ -189,6 +387,8 @@ export function formatFrontendWorktreeDiffStdout(result) {
         `schemaId=${result.schemaId}`,
         `patchPath=${result.patchPath}`,
         `patchSha256=${result.patchSha256}`,
+        `reviewSummaryPath=${result.reviewSummaryPath}`,
+        `reviewIndexPath=${result.reviewIndexPath}`,
         `changedFiles=${result.changedFiles.length}`,
         `untrackedFiles=${result.untrackedFiles.length}`,
         `empty=${result.empty ? "true" : "false"}`,
@@ -199,3 +399,36 @@ export function formatFrontendWorktreeDiffStdout(result) {
         .filter(Boolean)
         .join("\n");
 }
+/**
+ * Expand glob-shaped contract paths into concrete workspace file paths.
+ *
+ * The frontend contract schema allows `targets.files` entries such as
+ * `src/**` (skeleton inherits the task allowedPaths), but writer admission
+ * derives the concrete writeSet and requires real file paths. This helper
+ * matches every candidate against the enumerated workspace files and returns
+ * the concrete paths. Candidates that are already concrete are kept as-is;
+ * globs that match nothing are dropped (the derived writeSet only contains
+ * paths the writer can actually touch).
+ */
+export function expandFrontendGlobPaths(input) {
+    const concrete = new Set();
+    const patterns = [];
+    for (const candidate of input.candidates) {
+        const normalized = candidate.replace(/\\/g, "/");
+        if (normalized.includes("*")) {
+            patterns.push(normalized);
+        }
+        else {
+            concrete.add(normalized);
+        }
+    }
+    if (patterns.length === 0)
+        return [...concrete].sort();
+    const workspace = [...new Set(input.workspaceFiles.map((f) => f.replace(/\\/g, "/")))];
+    for (const file of workspace) {
+        if (patterns.some((pattern) => pathMatchesPattern(file, pattern))) {
+            concrete.add(file);
+        }
+    }
+    return [...concrete].sort();
+}