@tea-agent/loop-agent 0.42.0-next.5 → 0.42.0-next.7

package/AGENTS.md

@@ -81,7 +81,7 @@ DAG 执行期间，主 agent 不得修改 writeSet 外的任何工作区文件
 
 权威源：`docs/governance/verification-matrix.md`。
 
-默认节奏：编辑中只跑矩阵「最低验证」（typecheck + 定向 Vitest）；`git commit` 的 `pre-commit` 只做 `check-repo`；`git push` 的 `pre-push` 经 `node scripts/pre-push-verify.mjs` 在 receipt 命中时复用、miss 时跑 full `bash scripts/ci.sh`（全量 typecheck + `npm test`）。每个 clone 安装一次 hooks：`bash scripts/install-git-hooks.sh`。
+默认节奏：编辑中只跑矩阵「最低验证」（typecheck + 定向 Vitest）；常规 `npm test` 跳过约 6 分钟的 I/O-heavy 池（fast + integration）；`git commit` 的 `pre-commit` 只做 `check-repo`；`git push` 的 `pre-push` 经 `node scripts/pre-push-verify.mjs` 在 receipt 命中时复用、miss 时跑 full `bash scripts/ci.sh`（全量 typecheck + 含 I/O-heavy 的 `npm run test:full`）。每个 clone 安装一次 hooks：`bash scripts/install-git-hooks.sh`。
 
 连续 source→target 交付遵循**单一最终树全量验证**：同一 Git tree、相同环境与命令合同在 receipt TTL 内只选一个本地 full authority（有效 receipt / target pre-push / 可选 `npm run verify:tree`），不按分支名策略化，也不机械双跑 full CI。细节见 verification-matrix 与 branch-merge-guideline。
 

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 ## [Unreleased]
 
+- 修复前端 `--from-text` 任务缺少 source-fidelity ledger、DAG 生成后降级为 v1 并在 `frontend-contract-pi` 0ms 失败的问题：文本入口现在持久化可校验的 v2 绑定输入，init-hybrid 复用任务自有需求源；Console 默认模型与 Pi readiness 同时排除无凭据 provider，避免把不可执行模型误报为可用。
+- 常规回归 `npm test` 默认跳过约 6 分钟的 I/O-heavy 测试池（仍跑 fast + integration）；完整三池改为 `npm run test:full` / `LOOP_AGENT_FULL_TEST=1`。本地 `ci.sh`、GitHub PR 与 release/next 发布门禁仍跑全量，不降低交付验证。
+- 修复 backend-test correspondence 把前面函数的 `pytest.param(..., id="TP-...")` 叠进后续 Case `parameterIds` 的问题：decorator 区域遇到上一 `def`/`class` 或非 decorator 续行即停，不再把整组打成 `TEST_POINT_BINDING_EXTRA`。eligibility 门禁不放宽。
+- 修复 backend-test scenario facts 把内部 max/min/oversize helper 哨兵 `-1/-2/-3` 写成 `observedLength`、导致 N10 在 schema `min(0)` 上 `invalid-output` 的问题：这些 helper 仍按 Markdown bound MATCH，持久化长度只保留非负值。
+- 修复 backend-test 把 GET `params=`/`query=` 过滤字段、Python `True`/`False` 布尔字面量和混合大小写 `pytest.param` 列表漏出 correspondence/payload/scenario 观察的问题：这些 variant 现在可以按 item 授权，而不再把整 Case 打成 `PAYLOAD_SHAPE_MISMATCH` / `VARIANT_PARAMETER_MISSING`。eligibility 门禁不放宽。
+- 修复 backend-test 计划协议标题被翻译成中文后 N3 直接 `missing-module-index`、以及 Markdown writer 漏写精确 Scenario Partition slot 只能等到 N6 才失败的问题：N3 现在把 `## 模块索引/覆盖范围/覆盖矩阵/场景分区` 确定性改写成英文 canonical heading 并最多写回一次 run-owned `plan.md`，同时展开 slot 清单写入 `contracts/backend-test-scenario-partition-slots.json` 并注入 map child `requiredVariantSlots`。Markdown shard completeness 对缺失精确 `TP-SP-...` variant 报 `incomplete-partition-slot-set` 并允许一次有界补写。覆盖语义按方案 A：Case 数量可以少于枚举数量，但每个 slot 仍须独立 variant Test Point；`SINGLE`/`MULTIPLE` 不计覆盖。N6 fail-closed 不放宽。
+- 修复 backend-test strict Markdown map writer 的 upstream artifact pointer 泄漏：当长上游输出的 `stdout.md` 不在当前节点 `readSet` 时，不再向 Pi 注入不可读取的 artifact 路径，避免模型触发 `read-outside-read-set` 后进入 pending；保留有界 preview，并新增回归覆盖严格 writer 边界。
 - 修复 backend-test Manifest 把模型生成的 Module Stem 展示单元格当成模块身份真源、导致 low-tier 输出（缺 `test_` 前缀或整段 Markdown 链接）在 N3 `module-markdown-path-mismatch` 反复失败的问题：N3 现在先解析唯一合法 Markdown Path 与 `<stem>.md` 相对链接作为 canonical 身份，再校验业务 ownership/split 与路径安全；Stem 单元格只作冗余展示并能确定性重写为 canonical 文件名 stem。strict `backendTest.moduleLayout` 改为先按唯一 required Markdown Path 定位模块，再恢复冻结 Markdown/Pytest path pair，避免错误 stem 提前丢弃整行，同时保留 Plan-only pytest path 修复。Markdown Path 缺失/多候选/越界或与 strict path pair 冲突、以及多行 canonicalize 后同 identity（`duplicate-canonical-module-stem`）继续 fail-closed，不再静默去重。同步加强 N2 prompt（Stem 单元格仅允许纯文件名 stem）。
 - 修复 Next Release 的 io-heavy 测试并发不稳定：发布 workflow 将该池固定为单 worker，避免全部测试已通过后触发 Vitest `onTaskUpdate` RPC settlement timeout，并消除 controller identity/package fingerprint 测试之间的共享状态竞态；不跳过或删除任何测试。
 - 修复 backend-test 唯一 pytest collection repair 已产生受控非空修改、却因模型遗漏 `IMPLEMENTATION_OUTCOME` 而阻断整条执行链的问题：仅 N11 exact repair writer 可把完全缺失的 outcome 确定性恢复为候选 changed，随后仍必须由 N12 重新通过 scenario、correspondence、payload、collection、fixture 和 readiness 门禁；unknown/conflicting/blocked、空 diff、越界写入及 provider/context failure 继续 fail-closed。
@@ -9,6 +16,7 @@
 - 新建对话会优先复用当前工作区中真正的空白会话，避免重复创建；有历史消息、工具调用、待发送内容或正在运行的会话不会被复用。
 - 会话列表刷新现在会复用未变化的行和列表引用，标题、运行状态或队列变化时只更新对应会话，侧栏切换和刷新更平滑。
 - Operator Chat 新增仅对具备 Aimax 凭证的用户可见的 `/sdd-bingo` 数据对齐命令；`wizard-local` 模型请求会自动携带与上报一致的 OpenCode 风格会话身份、当前模型和最新 API key，请求头与资格文件变更均在下一次操作自动生效。
+- DAG 节点检查器的「执行记录」默认自动跟随最新内容；右下角新增纯图标悬浮开关，可显式暂停并保留阅读位置，恢复后立即回到底部，悬停时显示当前可执行动作。
 - 修复前端任务产物派生续跑无法识别当前节点链的问题；从实现节点继续时，设计约束、写入准入、验证和收尾步骤会按现行流程安全重放。
 - 统一工作区、Todo 和其他滚动区域的滚动条样式，默认更轻巧，鼠标悬浮时也更容易辨认。
 - HTML 文件预览现在支持页面内的标签切换等交互；较大的自包含 HTML 可以在新窗口中直接完整加载，不再受源码摘要长度影响。
@@ -235,6 +243,20 @@
 - 右侧辅助栏统一承载文件、上下文、调用记录、运行活动和当前 DAG；点击消息流中的运行状态即可在同一侧栏查看运行、门禁与产物，并可自由调整侧栏宽度。
 - 新增任务清单与结构化提问卡片，让长任务的进度和需要用户选择的内容更容易理解。
 - 「对话 / 操作 / 观测」使用统一导航；操作和观测页面可以切换工作区查看对应数据。
+## [0.41.1] - 2026-09-02
+
+### 修复
+
+- 修复 Next Release 发布 workflow 的 io-heavy 测试并发不稳定：将该测试池固定为单 worker，避免全部测试通过后因过高并发触发 Vitest `onTaskUpdate` RPC settlement timeout，并消除 controller identity / package fingerprint 测试之间的共享状态竞态。
+- 修复 Operator Chat 旧会话继续使用过期模型认证的问题：模型配置变化后，下一轮发送或手动重新加载会自动刷新模型目录和当前模型认证。
+- 修复 Operator Chat 长工具链的消息错序：模型过程文字、思考和工具卡片现在按服务端事件顺序稳定交替展示，刷新历史会话后也保持相同顺序。
+- 统一工作区、Todo 和其他滚动区域的滚动条样式，默认更轻巧，鼠标悬浮时也更容易辨认。
+- HTML 文件预览现在支持页面内的标签切换等交互；较大的自包含 HTML 可以在新窗口中直接完整加载，不再受源码摘要长度限制。
+
+### 测试
+
+- `harness.json` Pi MED 档测试不再 pin 具体模型 id，改为校验 tier 形状，避免每次 dogfood 档位切换都造成测试失败。
+
 ## [0.41.0] - 2026-08-31
 
 ### 新增

package/dist/build-stamp.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "version": "0.42.0-next.5",
-  "gitSha": "260dc2585e355412fa689ac856badc73b2f609f9",
-  "builtAt": "2026-09-01T18:19:10.922Z"
+  "version": "0.42.0-next.7",
+  "gitSha": "dc38c285736865703929d788b0f1929513ebe24c",
+  "builtAt": "2026-09-02T17:21:58.319Z"
 }

package/dist/executors/dag-pi-executor.js

@@ -2019,6 +2019,41 @@ export async function createFrontendContractTools(input) {
         },
     };
 }
+async function resolveFrontendScoutSourceDeclaredPaths(input) {
+    const binding = input.spec.sourceBinding;
+    if (!binding?.sources?.length)
+        return undefined;
+    const declared = new Set();
+    const pathToken = /(?:\.?\.?\/)?[A-Za-z0-9_.-]+(?:\/[A-Za-z0-9_.-]+)+\/?/g;
+    const writerPaths = input.spec.tasks
+        .filter((task) => task.executor === "pi" && task.toolProfile === "write")
+        .flatMap((task) => task.allowedPaths ?? []);
+    const prefixes = writerPaths
+        .map((pattern) => pattern.replaceAll("\\", "/").replace(/^\.\//, ""))
+        .map((pattern) => pattern.slice(0, pattern.search(/[!*?[{]/) >= 0 ? pattern.search(/[!*?[{]/) : pattern.length))
+        .map((prefix) => prefix.slice(0, prefix.lastIndexOf("/") + 1))
+        .filter(Boolean);
+    for (const source of binding.sources) {
+        try {
+            const text = await readFile(path.resolve(input.cwd, source.path), "utf8");
+            for (const match of text.matchAll(pathToken)) {
+                const token = match[0].replaceAll("\\", "/").replace(/^\.\//, "").replace(/\/$/, "");
+                if (!token || token.startsWith("http") || token.startsWith("api/"))
+                    continue;
+                declared.add(token);
+                for (const prefix of prefixes) {
+                    if (!token.startsWith(prefix) && !token.startsWith(".harness/"))
+                        declared.add(`${prefix}${token}`);
+                }
+            }
+        }
+        catch {
+            // The source binding itself remains the authority; an unreadable source
+            // produces an empty declaration set, so future test paths fail closed.
+        }
+    }
+    return [...declared].sort();
+}
 /**
  * A+B: `frontend-scout-pi` incremental evidence tools (origin=scout). Runtime
  * enriches committed target-surface / design-evidence facts with hash/section/
@@ -2043,6 +2078,12 @@ export async function createFrontendScoutEvidenceTools(input) {
         content: [{ type: "text", text: JSON.stringify(details) }],
         details,
     });
+    const sourceDeclaredPaths = (input.sourceDeclaredPaths ?? []).map((value) => value.replaceAll("\\", "/").replace(/^\.\//, "").replace(/\/$/, ""));
+    const hasSourceDeclarations = input.sourceDeclaredPaths !== undefined;
+    const isSourceDeclared = (candidate) => {
+        const normalized = candidate.replaceAll("\\", "/").replace(/^\.\//, "").replace(/\/$/, "");
+        return sourceDeclaredPaths.some((declared) => declared === normalized || declared.startsWith(`${normalized}/`));
+    };
     // A+B (AC-003): runtime enriches declared scout paths with hash/freshness
     // from the real filesystem. The model's self-reported path list is never
     // trusted for content identity; a missing file fails closed to fresh=false
@@ -2056,7 +2097,7 @@ export async function createFrontendScoutEvidenceTools(input) {
             const absolute = path.resolve(workspaceRoot, relative);
             if (absolute !== workspaceRoot &&
                 !absolute.startsWith(`${workspaceRoot}${path.sep}`)) {
-                evidence.push({ path: relative, sha256: "0".repeat(64), fresh: false });
+                evidence.push({ path: relative, sha256: "0".repeat(64), fresh: false, sourceDeclared: isSourceDeclared(relative) });
                 continue;
             }
             try {
@@ -2073,6 +2114,7 @@ export async function createFrontendScoutEvidenceTools(input) {
                         path: relative,
                         sha256: createHash("sha256").update(`directory:${relative}`).digest("hex"),
                         fresh: true,
+                        sourceDeclared: isSourceDeclared(relative),
                     });
                     continue;
                 }
@@ -2081,10 +2123,11 @@ export async function createFrontendScoutEvidenceTools(input) {
                     path: relative,
                     sha256: createHash("sha256").update(bytes).digest("hex"),
                     fresh: true,
+                    sourceDeclared: isSourceDeclared(relative),
                 });
             }
             catch {
-                evidence.push({ path: relative, sha256: "0".repeat(64), fresh: false });
+                evidence.push({ path: relative, sha256: "0".repeat(64), fresh: false, sourceDeclared: isSourceDeclared(relative) });
             }
         }
         return evidence;
@@ -2157,6 +2200,7 @@ export async function createFrontendScoutEvidenceTools(input) {
                 dataSource: params?.dataSource ?? "",
                 allowedPathConflicts: params?.allowedPathConflicts ?? [],
                 unresolvedPaths: params?.unresolvedPaths ?? [],
+                ...(hasSourceDeclarations ? { sourceDeclaredPaths } : {}),
                 ...(pathEvidence.length > 0 ? { pathEvidence } : {}),
             });
             return receipt(result);
@@ -3798,6 +3842,10 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
                 runDir: meta.runDir,
                 nodeId: input.task.id,
                 workspaceRoot: input.cwd,
+                sourceDeclaredPaths: await resolveFrontendScoutSourceDeclaredPaths({
+                    cwd: input.cwd,
+                    spec: meta.spec,
+                }),
             });
             writerToolPolicy = {
                 requireSdk: true,
@@ -4091,24 +4139,37 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
             })),
         ];
     if (readBudgetIssues.length > 0) {
-        // Read-budget telemetry is diagnostic only when the provider/executor has
-        // already failed. In particular, keep context-overflow so node-execution
-        // selects its compact retry envelope instead of treating the attempt as a
-        // generic read-burst retry.
-        if (!mapped.ok) {
+        const hasTypedFrontendTerminal = isFrontendReviewTypedTerminalNode(input.task) ||
+            isFrontendDesignTypedTerminalNode(input.task);
+        // A stale/generated DAG may still carry the legacy read budget. Once a
+        // design/review node has a successful typed terminal, telemetry is
+        // diagnostic only; the terminal shadow below still fails closed when the
+        // fact is missing or conflicting.
+        if (mapped.ok && hasTypedFrontendTerminal) {
+            // Continue to the typed terminal shadow validation below.
+        }
+        else {
+            // Read-budget telemetry is diagnostic only when the provider/executor
+            // has already failed. In particular, keep context-overflow so
+            // node-execution selects its compact retry envelope instead of treating
+            // the attempt as a generic read-burst retry.
+            if (!mapped.ok) {
+                return {
+                    ...mapped,
+                    stderr: [mapped.stderr, ...readBudgetIssues]
+                        .filter(Boolean)
+                        .join("\n\n"),
+                };
+            }
             return {
                 ...mapped,
+                ok: false,
+                failureCategory: "read-burst",
                 stderr: [mapped.stderr, ...readBudgetIssues]
                     .filter(Boolean)
                     .join("\n\n"),
             };
         }
-        return {
-            ...mapped,
-            ok: false,
-            failureCategory: "read-burst",
-            stderr: [mapped.stderr, ...readBudgetIssues].filter(Boolean).join("\n\n"),
-        };
     }
     if (isFrontendReviewTypedTerminalNode(input.task)) {
         return await runFrontendReviewTerminalShadow({
@@ -4500,6 +4561,7 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
                         ? "pytest-generate"
                         : "md-generate",
                     writeSet: input.task.writeSet ?? [],
+                    runDir: meta.runDir,
                 })
                 : isBackendTestMdPlanTask(input.task)
                     ? await assessBackendTestMdPlanCompleteness(input.cwd, backendLayout)

package/dist/task/source-prepare/fragment-inventory.js

@@ -16,17 +16,15 @@ const NON_GOAL_HEADING_RE = /(?:^|\s)(?:非目标|out of scope|non-goals|non goa
 const OBJECTIVE_HEADING_RE = /(?:^|\s)(?:目标|objective|问题与目标|业务目标|需求概述)(?:\s|$)/iu;
 /** 可执行片段启发式（AC 风格/祈使语气）：命中则不可按 context-only 降级。 */
 const EXECUTABLE_HINT_RE = /(?:必须|应当|应支持|需要|需|不得|should|must|shall|will|require|support|implement|provide|ensure|verify|当.*?时|when.*?then)/iu;
-/** 显式 AC 式 ID 前缀：AC-001 / AC-FE-001 / AC-FE-INS-001 等（允许 bullet 标记后空格
- * 与 checklist 勾选框）。收紧解析（AC-001 / AC-HARD-001）：AC 后必须跟分隔符
- * （-/_）+ 大写字母/数字 id 形态（含可选 FE/BE/UI/API 作用域前缀与 V4 `#### AC-*`
- * 标题归属）；`## Acceptance Criteria` / `## Acceptance` / Ac 开头普通单词永不产生
- * 伪造 id（ACCEPTANCE 类 id 全量消失）。捕获组 1 = AC id，捕获组 2 = 余下文本。 */
-const EXPLICIT_AC_ID_RE = /^\s*(?:[-*+]|\d+[.)])\s+(?:\[[ xX]\]\s+)?(AC(?:[-_](?:FE|BE|UI|API))?[-_][A-Z0-9]+(?:[-_][A-Z0-9]+)*)\s*[:：]?\s*(.*)$/iu;
-/** 显式 AC 标题式：`#### AC-FE-001 Save nickname` / `### AC-001：正文`。
- * AC 后必须跟分隔符（-/_）+ id 形态；普通单词（Acceptance Criteria / Acceptance）
- * 永不匹配，按 ACCEPTANCE_HEADING_RE 章节分类生成稳定 REQ-SRC-* 片段。
- * 捕获组 1 = AC id，捕获组 2 = 标题余下文本。 */
-const EXPLICIT_AC_HEADING_RE = /^\s*(AC(?:[-_](?:FE|BE|UI|API))?[-_][A-Z0-9]+(?:[-_][A-Z0-9]+)*)\s*[:：]?\s*(.*)$/iu;
+/** 显式 requirement ID：AC-001 / BR-001 / REQ-SRC-001 等（允许 bullet 标记后空格
+ * 与 checklist 勾选框）。AC/BR/REQ 都是 DAG 的合法 canonical requirement 身份；
+ * 之前这里只识别 AC，导致已进入 canonicalRequirements 的 BR 片段无法绑定来源。
+ * 捕获组 1 = requirement id，捕获组 2 = 余下文本。 */
+const EXPLICIT_REQUIREMENT_ID_RE = /^\s*(?:(?:[-*+]|\d+[.)])\s+(?:\[[ xX]\]\s+)?)?((?:REQ|BR|AC)(?:[-_][A-Z0-9]+)+)\s*[:：]?\s*(.*)$/iu;
+/** 显式 requirement 标题式：`#### AC-FE-001 Save nickname` / `### BR-001：正文`。
+ * 普通单词（Acceptance Criteria / Acceptance）永不匹配，按章节分类生成稳定
+ * REQ-SRC-* 片段。捕获组 1 = requirement id，捕获组 2 = 标题余下文本。 */
+const EXPLICIT_REQUIREMENT_HEADING_RE = /^\s*((?:REQ|BR|AC)(?:[-_][A-Z0-9]+)+)\s*[:：]?\s*(.*)$/iu;
 /** Markdown 表格数据行（非分隔行）。 */
 const TABLE_DATA_ROW_RE = /^\s*\|.*\|\s*$/;
 const TABLE_SEPARATOR_ROW_RE = /^\s*\|[\s:|-]+\|\s*$/;
@@ -35,11 +33,11 @@ function isTableHeaderRow(line, nextLine) {
     return isTableDataRow(line) && TABLE_SEPARATOR_ROW_RE.test(nextLine.trim());
 }
 /** 表格行首格显式 AC ID：`| AC-001 | 订单列表加载完成 |` → id=AC-001, rest=订单列表加载完成。 */
-function matchTableRowAcId(line) {
+function matchTableRowRequirementId(line) {
     const trimmed = line.trim().replace(/^\|/, "");
     const cells = trimmed.split("|");
     const first = cells[0]?.trim() ?? "";
-    const idMatch = EXPLICIT_AC_HEADING_RE.exec(first);
+    const idMatch = EXPLICIT_REQUIREMENT_HEADING_RE.exec(first);
     if (!idMatch)
         return null;
     const id = (idMatch[1] ?? "").trim().toUpperCase().replace(/_/g, "-");
@@ -52,6 +50,14 @@ function matchTableRowAcId(line) {
         .trim();
     return { id, rest: rest || id };
 }
+/** The splitter may use only AC ids as fragment identities; BR/REQ ids are
+ * mapped later while keeping the generated REQ-SRC fragment identity. */
+function matchTableRowAcId(line) {
+    const match = matchTableRowRequirementId(line);
+    if (!match || !/^AC(?:-[A-Z0-9]+)+$/iu.test(match.id))
+        return null;
+    return match;
+}
 export function sha256Text(text) {
     return createHash("sha256").update(text, "utf8").digest("hex");
 }
@@ -66,7 +72,20 @@ export function normalizeFragmentText(text) {
         .trim();
 }
 export function matchExplicitAcId(line) {
-    const match = EXPLICIT_AC_ID_RE.exec(line.trim());
+    const match = EXPLICIT_REQUIREMENT_ID_RE.exec(line.trim());
+    if (!match)
+        return null;
+    const rawId = match[1] ?? "";
+    if (!/^AC(?:[-_][A-Z0-9]+)+$/iu.test(rawId))
+        return null;
+    const id = rawId.trim().toUpperCase().replace(/_/g, "-");
+    if (!id)
+        return null;
+    return { id, rest: (match[2] ?? "").trim() };
+}
+/** Match an explicit AC/BR/REQ id in a list item or a paragraph fragment. */
+export function matchExplicitRequirementId(line) {
+    const match = EXPLICIT_REQUIREMENT_ID_RE.exec(line.trim());
     if (!match)
         return null;
     const rawId = match[1] ?? "";
@@ -77,7 +96,20 @@ export function matchExplicitAcId(line) {
 }
 /** V4 显式 AC 标题式匹配：`#### AC-FE-001 Save nickname` → id=AC-FE-001, rest=Save nickname。 */
 export function matchExplicitAcHeading(headingText) {
-    const match = EXPLICIT_AC_HEADING_RE.exec(headingText.trim());
+    const match = EXPLICIT_REQUIREMENT_HEADING_RE.exec(headingText.trim());
+    if (!match)
+        return null;
+    const rawId = match[1] ?? "";
+    if (!/^AC(?:[-_][A-Z0-9]+)+$/iu.test(rawId))
+        return null;
+    const id = rawId.trim().toUpperCase().replace(/_/g, "-");
+    if (!id)
+        return null;
+    return { id, rest: (match[2] ?? "").trim() };
+}
+/** Match an explicit AC/BR/REQ id in a heading. */
+export function matchExplicitRequirementHeading(headingText) {
+    const match = EXPLICIT_REQUIREMENT_HEADING_RE.exec(headingText.trim());
     if (!match)
         return null;
     const rawId = match[1] ?? "";
@@ -389,7 +421,8 @@ export function buildFragmentInventory(input) {
             : null;
         const explicit = explicitIdFromId
             ? { id: explicitIdFromId, rest: fragment.text }
-            : matchExplicitAcId(fragment.text);
+            : matchExplicitRequirementId(fragment.text) ??
+                matchTableRowRequirementId(fragment.text);
         // V4 标题/条目下正文继承的显式 AC ID（不生成取代它的 REQ-SRC-*）。
         const inherited = !explicit && fragment.explicitAcId
             ? { id: fragment.explicitAcId, rest: fragment.text }

package/dist/task/source-prepare/prepare.js

@@ -796,29 +796,46 @@ export async function prepareTaskSource(input) {
     // -------------------------------------------------------------------
     let ledger;
     let ledgerSummary;
-    if (hasImportedPrd &&
-        sourceIntegrity &&
-        sourceIntegrity.parseableDocuments.some((doc) => doc.role === "requirement" || doc.role === "acceptance")) {
+    const hasAuthoritativeImportedDocs = Boolean(hasImportedPrd &&
+        sourceIntegrity?.parseableDocuments.some((doc) => doc.role === "requirement" || doc.role === "acceptance"));
+    // Frontend tasks created from text still need the same source-fidelity
+    // contract as imported-PRD tasks.  In that case the projected requirement
+    // document is the canonical, task-owned source that the DAG can bind to;
+    // without it init-hybrid would silently emit a v1 binding and the first
+    // frontend-contract node would fail before making a model call.
+    if (built.draft.taskKind === "frontend-implementation" &&
+        (hasAuthoritativeImportedDocs ||
+            (input.intent.kind === "facts" && Boolean(input.intent.text)))) {
         try {
-            const authoritativeDocs = sourceIntegrity.parseableDocuments.filter((doc) => (doc.role === "requirement" || doc.role === "acceptance") &&
+            const authoritativeDocs = sourceIntegrity?.parseableDocuments.filter((doc) => (doc.role === "requirement" || doc.role === "acceptance") &&
                 typeof doc.content === "string" &&
-                doc.content.trim().length > 0);
-            const sourceDocuments = authoritativeDocs.map((doc) => {
-                // Canonical source identity 单一边界（AC-001 / AC-FIDELITY-REPAIR-001）：
-                // ledger sourceDocuments[].path 与 DAG 侧 serializeDagTaskSourcePath /
-                // resolveDagTaskSourcePath 一致（repo-root relative POSIX），路径转换只
-                // 发生在该边界，不再二次转换进入 digest 计算。
-                const absolute = path.resolve(contractPaths.sourceDir, doc.materializedPath);
-                return {
-                    path: path
-                        .relative(repoRoot, absolute)
-                        .split(path.sep)
-                        .join("/"),
-                    content: doc.content,
-                };
-            });
+                doc.content.trim().length > 0) ?? [];
+            const requirementProjection = projectRequirementMarkdown(built.draft);
+            const sourceDocuments = authoritativeDocs.length > 0
+                ? authoritativeDocs.map((doc) => {
+                    // Canonical source identity 单一边界（AC-001 / AC-FIDELITY-REPAIR-001）：
+                    // ledger sourceDocuments[].path 与 DAG 侧 serializeDagTaskSourcePath /
+                    // resolveDagTaskSourcePath 一致（repo-root relative POSIX），路径转换只
+                    // 发生在该边界，不再二次转换进入 digest 计算。
+                    const absolute = path.resolve(contractPaths.sourceDir, doc.materializedPath);
+                    return {
+                        path: path
+                            .relative(repoRoot, absolute)
+                            .split(path.sep)
+                            .join("/"),
+                        content: doc.content,
+                    };
+                })
+                : [
+                    {
+                        path: path
+                            .relative(repoRoot, contractPaths.requirementPath)
+                            .split(path.sep)
+                            .join("/"),
+                        content: requirementProjection,
+                    },
+                ];
             if (sourceDocuments.length > 0) {
-                const requirementProjection = projectRequirementMarkdown(built.draft);
                 ledger = await buildRequirementLedger({
                     taskId,
                     requirementSha256: sha256Utf8(requirementProjection),

package/dist/worker/console/chat/model-resolver.js

@@ -125,11 +125,14 @@ function resolveTierDescriptor(selection, available) {
         });
         return {
             provider: selection.provider,
-            resolved: Boolean(entry),
+            resolved: Boolean(entry && entry.hasCredentials !== false),
         };
     }
     const entry = findProviderForModelId(selection.modelId, available);
-    return { provider: entry?.provider, resolved: Boolean(entry) };
+    return {
+        provider: entry?.provider,
+        resolved: Boolean(entry && entry.hasCredentials !== false),
+    };
 }
 /**
  * Resolve harness executors.pi tiers (LOW/MED/HIGH) to provider descriptors.
@@ -196,7 +199,7 @@ export async function resolveDefaultChatModel(repoRoot, available, options) {
         const entry = findProviderForModelId(selection.modelId, available, {
             preferredProvider: selection.provider,
         });
-        if (!entry)
+        if (!entry || entry.hasCredentials === false)
             return undefined;
         return {
             provider: selection.provider,
@@ -205,7 +208,7 @@ export async function resolveDefaultChatModel(repoRoot, available, options) {
         };
     }
     const entry = findProviderForModelId(selection.modelId, available);
-    if (!entry)
+    if (!entry || entry.hasCredentials === false)
         return undefined;
     return {
         provider: entry.provider,

package/dist/worker/console/chat/pi-runtime.js

@@ -26,7 +26,7 @@
  * `createDefaultPiSdkBindings()`.
  */
 import { createHash, randomBytes } from "node:crypto";
-import { access, stat } from "node:fs/promises";
+import { access, mkdir, rm, stat, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { extractAssistantContentBlocks, extractAssistantText, isAssistantSdkMessage, } from "./assistant-content.js";
 import { parseProviderError, } from "./provider-error.js";
@@ -1331,6 +1331,15 @@ export class ConsolePiRuntime {
         if (!sessionFile) {
             throw new Error(`chat session shell missing sessionFile for ${sessionId}`);
         }
+        // Pi's SessionManager.create deliberately postpones writing a JSONL until
+        // an assistant response. Materialize a valid header now, otherwise Console
+        // could persist a path that disappears on a restart before first reply.
+        await this.bindings.materializeSessionShell({
+            sessionManager,
+            sessionId,
+            sessionFile,
+            cwd: this.options.cwd,
+        });
         this.sessionManagers.set(sessionId, sessionManager);
         this.thinkingSelections.set(sessionId, "auto");
         // Detached single-flight materialization; dependent routes await the same promise.
@@ -3173,6 +3182,36 @@ export function createDefaultPiSdkBindings() {
                 id: opts.sessionId,
             });
         },
+        materializeSessionShell: async (opts) => {
+            const sdk = (await loadSdk());
+            const manager = opts.sessionManager;
+            if (typeof manager.setSessionFile !== "function") {
+                throw new Error("Pi SessionManager cannot materialize a session file");
+            }
+            let created = false;
+            try {
+                await mkdir(path.dirname(opts.sessionFile), { recursive: true });
+                // Match Pi's documented session header. Rebinding through the public
+                // SessionManager API marks it flushed, so Pi appends the first user
+                // entry instead of trying to create the already-present file later.
+                await writeFile(opts.sessionFile, `${JSON.stringify({
+                    type: "session",
+                    version: typeof sdk.CURRENT_SESSION_VERSION === "number"
+                        ? sdk.CURRENT_SESSION_VERSION
+                        : 3,
+                    id: opts.sessionId,
+                    timestamp: new Date().toISOString(),
+                    cwd: opts.cwd,
+                })}\n`, { encoding: "utf8", flag: "wx", mode: 0o600 });
+                created = true;
+                manager.setSessionFile(opts.sessionFile);
+            }
+            catch (error) {
+                if (created)
+                    await rm(opts.sessionFile, { force: true }).catch(() => undefined);
+                throw error;
+            }
+        },
         createInMemorySessionManager: async (opts) => {
             const sdk = (await loadSdk());
             return sdk.SessionManager.inMemory(opts.cwd);

package/dist/worker/console/chat/routes.js

@@ -561,9 +561,15 @@ workspaceId) {
         });
         return;
     }
+    let createdSessionId;
+    let persisted = false;
     try {
         const snapshot = snapshotInput === undefined ? undefined : projectCompactSnapshot(snapshotInput);
-        // Fast path: durable shell + Console record before full AgentSession ready.
+        // A Console record promises that its Pi JSONL can be reopened after a
+        // Console restart. Do not make that promise until Pi has finished
+        // materializing the session: the old fast path wrote a record for a
+        // future JSONL path, leaving an unrecoverable orphan when init failed or
+        // the process restarted in that window.
         const handle = await deps.runtime.createSession({
             ...(provider && modelId ? { model: { provider, modelId } } : {}),
             ...(snapshot
@@ -583,40 +589,26 @@ workspaceId) {
             });
             return;
         }
+        createdSessionId = handle.sessionId;
+        await deps.runtime.ensureSessionReady(handle.sessionId);
+        const selection = deps.runtime.getRuntimeSelection(handle.sessionId);
         const session = await deps.store.create({
             sessionId: handle.sessionId,
             sessionFile: handle.sessionFile,
-            modelProvider: handle.model?.provider,
-            modelId: handle.model?.modelId,
+            modelProvider: selection.model?.provider ?? handle.model?.provider,
+            modelId: selection.model?.modelId ?? handle.model?.modelId,
             // AC-R7-002: explicit parameter from the dispatcher — the runtime
             // store.create wrapper is gone; body workspaceId (if any) only acts as
             // a fallback for direct (non-dispatcher) handler tests.
             workspaceId: workspaceId ?? (typeof body.workspaceId === "string" && body.workspaceId ? body.workspaceId : undefined),
         });
+        persisted = true;
         await deps.attachSession?.(handle.sessionId).catch(() => undefined);
         if (snapshot)
             deps.events.append(handle.sessionId, `${handle.sessionId}:snapshot`, {
                 kind: "compact",
                 data: snapshot,
             });
-        // Best-effort: after materialization, patch resolved default model onto the
-        // durable record. Failures stay on the init fence (PI_SESSION_INIT_FAILED).
-        if (typeof deps.runtime.ensureSessionReady === "function") {
-            void deps.runtime
-                .ensureSessionReady(handle.sessionId)
-                .then(async () => {
-                if (typeof deps.runtime.getRuntimeSelection !== "function")
-                    return;
-                const selection = deps.runtime.getRuntimeSelection(handle.sessionId);
-                if (!selection?.model)
-                    return;
-                await deps.store.setRuntimeSelection(handle.sessionId, {
-                    modelProvider: selection.model.provider,
-                    modelId: selection.model.modelId,
-                });
-            })
-                .catch(() => undefined);
-        }
         sendJson(res, 201, {
             ok: true,
             sessionId: handle.sessionId,
@@ -625,14 +617,23 @@ workspaceId) {
             session: { ...session, isBlank: isBlankChatSession(session) },
             activeTools: handle.activeTools,
             hasBash: true,
-            ...(handle.initializing ? { initializing: true } : {}),
         });
     }
     catch (error) {
+        // Before store.create succeeds, this handle has no durable owner. Dispose
+        // it so a failed create cannot survive in-memory until the next restart.
+        if (createdSessionId && !persisted)
+            deps.runtime.dispose(createdSessionId);
         const message = error instanceof Error ? error.message : String(error);
-        sendJson(res, 500, {
+        const code = error && typeof error === "object" && "code" in error
+            ? String(error.code ?? "")
+            : "";
+        sendJson(res, code === "PI_SESSION_INIT_FAILED" ? 503 : 500, {
             ok: false,
-            error: { code: "CHAT_SESSION_CREATE_FAILED", message },
+            error: {
+                code: code === "PI_SESSION_INIT_FAILED" ? code : "CHAT_SESSION_CREATE_FAILED",
+                message,
+            },
         });
     }
 }

package/dist/worker/console/chat/sdd-data-alignment.js

@@ -203,10 +203,13 @@ export async function injectWizardLocalHeaders(options) {
         return;
     if (!(await options.service.isEligible()))
         return;
-    const getAuth = options.context.modelRegistry?.getApiKeyAndHeaders;
-    if (!getAuth)
+    const modelRegistry = options.context.modelRegistry;
+    if (!modelRegistry?.getApiKeyAndHeaders)
         return;
-    const auth = await getAuth(model);
+    // Keep the method call attached to ModelRegistry. Its implementation reads
+    // the private runtime through `this`; extracting the function would make the
+    // SDK path fail closed and silently drop all custom headers.
+    const auth = await modelRegistry.getApiKeyAndHeaders(model);
     if (!auth.ok || typeof auth.apiKey !== "string" || !auth.apiKey)
         return;
     setStaticHeader(options.headers, auth.headers, "client-code", "OpenCode");

package/dist/worker/console/pi-readiness.js

@@ -170,11 +170,12 @@ export async function discoverPiReadinessProbe(options) {
     const availableCount = countAvailableModels(snapshot);
     const providerConfigured = hasProviderConfig(snapshot);
     const availableModels = mapSnapshotAvailableModels(snapshot);
+    const credentialedAvailableCount = availableModels.filter((model) => model.hasCredentials !== false).length;
     const harnessMatrix = await resolveHarnessPiExecutorMatrix(repoRoot, availableModels);
     const resolvedHarnessModels = [];
     if (typeof runtime.getModel === "function") {
         for (const row of harnessMatrix) {
-            if (!row.provider)
+            if (!row.provider || !row.resolved)
                 continue;
             try {
                 if (runtime.getModel(row.provider, row.modelId)) {
@@ -195,7 +196,7 @@ export async function discoverPiReadinessProbe(options) {
             .join(",")
         : "none";
     const authReady = availableCount > 0 || providerConfigured;
-    const modelsAvailable = availableCount > 0 || resolvedHarnessModels.length > 0;
+    const modelsAvailable = credentialedAvailableCount > 0 || resolvedHarnessModels.length > 0;
     let interviewSessionOk = false;
     let sessionMessage;
     if (!authReady || !modelsAvailable) {