@tea-agent/loop-agent 0.42.0-next.8 → 0.42.0

package/dist/workflows/dag/recovery-lease.js

@@ -1,6 +1,8 @@
 import { createHash, randomBytes } from "node:crypto";
-import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
+import { hostname as localHostname } from "node:os";
 import path from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
 import { writeJsonAtomic } from "../../infrastructure/harness/atomic-write.js";
 import { DAG_RUNS_DIR } from "./lifecycle.js";
 function recoveryLeasePath(cwd, parentRunId) {
@@ -23,6 +25,11 @@ function parseLease(raw, parentRunId) {
             record.kind !== "standalone-task-rerun") ||
         typeof record.leaseToken !== "string" ||
         record.leaseToken.length === 0 ||
+        typeof record.ownerPid !== "number" ||
+        !Number.isInteger(record.ownerPid) ||
+        record.ownerPid <= 0 ||
+        typeof record.ownerHostname !== "string" ||
+        record.ownerHostname.length === 0 ||
         typeof record.acquiredAt !== "string" ||
         typeof record.executionRef !== "undefined" &&
             typeof record.executionRef !== "string") {
@@ -30,6 +37,60 @@ function parseLease(raw, parentRunId) {
     }
     return record;
 }
+const LEASE_MUTATION_LOCK_STALE_MS = 60_000;
+const LEASE_MUTATION_LOCK_RETRIES = 200;
+async function withLeaseMutationLock(leasePath, operation) {
+    const lockPath = `${leasePath}.mutation-lock`;
+    for (let attempt = 0; attempt < LEASE_MUTATION_LOCK_RETRIES; attempt += 1) {
+        try {
+            await mkdir(lockPath);
+        }
+        catch (error) {
+            if (!(error && typeof error === "object" && "code" in error && error.code === "EEXIST")) {
+                throw error;
+            }
+            try {
+                const lockStat = await stat(lockPath);
+                if (Date.now() - lockStat.mtimeMs >= LEASE_MUTATION_LOCK_STALE_MS) {
+                    await rm(lockPath, { recursive: true, force: true });
+                    continue;
+                }
+            }
+            catch (statError) {
+                if (statError &&
+                    typeof statError === "object" &&
+                    "code" in statError &&
+                    statError.code === "ENOENT") {
+                    continue;
+                }
+                throw statError;
+            }
+            await delay(10);
+            continue;
+        }
+        try {
+            return await operation();
+        }
+        finally {
+            await rm(lockPath, { recursive: true, force: true });
+        }
+    }
+    throw new Error("dag recovery lease mutation lock is busy");
+}
+function defaultIsProcessAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function leaseOwnerIsAlive(input) {
+    if (input.lease.ownerHostname !== input.hostname)
+        return true;
+    return input.isProcessAlive(input.lease.ownerPid);
+}
 export async function acquireDagRecoveryLease(input) {
     const leasePath = recoveryLeasePath(input.cwd, input.parentRunId);
     const lease = {
@@ -38,13 +99,15 @@ export async function acquireDagRecoveryLease(input) {
         requestId: input.requestId,
         kind: input.kind,
         leaseToken: randomBytes(16).toString("hex"),
+        ownerPid: process.pid,
+        ownerHostname: localHostname(),
         acquiredAt: (input.now ?? (() => new Date()))().toISOString(),
     };
     await mkdir(path.dirname(leasePath), { recursive: true });
     try {
         // `wx` is the cross-process compare-and-create primitive. The lease is
-        // deliberately immutable for a parent run: a later recovery must follow
-        // the committed child lineage rather than fork another DAG.
+        // parent-scoped for the full recovery lineage. Ownership may only be
+        // replaced by claimDagRecoveryLease after the recorded owner is proven dead.
         await writeFile(leasePath, `${JSON.stringify(lease, null, 2)}\n`, {
             encoding: "utf8",
             flag: "wx",
@@ -59,22 +122,49 @@ export async function acquireDagRecoveryLease(input) {
         return { kind: "held", leasePath, lease: existing };
     }
 }
+/**
+ * Reclaim a lease only after its recorded same-host owner is proven dead.
+ * The mutation lock serializes reclaim with execution binding, so a live owner
+ * can never race a stale-owner takeover and launch a second recovery.
+ */
+export async function claimDagRecoveryLease(input) {
+    const hostname = input.hostname ?? localHostname();
+    const isProcessAlive = input.isProcessAlive ?? defaultIsProcessAlive;
+    return withLeaseMutationLock(input.leasePath, async () => {
+        const existing = parseLease(JSON.parse(await readFile(input.leasePath, "utf8")), input.lease.parentRunId);
+        if (existing.leaseToken !== input.lease.leaseToken ||
+            leaseOwnerIsAlive({ lease: existing, hostname, isProcessAlive })) {
+            return { kind: "held", leasePath: input.leasePath, lease: existing };
+        }
+        const claimed = {
+            ...existing,
+            leaseToken: randomBytes(16).toString("hex"),
+            ownerPid: process.pid,
+            ownerHostname: hostname,
+            acquiredAt: (input.now ?? (() => new Date()))().toISOString(),
+        };
+        await writeJsonAtomic(input.leasePath, claimed);
+        return { kind: "acquired", leasePath: input.leasePath, lease: claimed };
+    });
+}
 /** Persist the operation/run identity before the caller is allowed to execute it. */
 export async function bindDagRecoveryLeaseExecution(input) {
     if (!input.executionRef.trim()) {
         throw new Error("dag recovery lease executionRef is required");
     }
-    const existing = parseLease(JSON.parse(await readFile(input.leasePath, "utf8")), input.lease.parentRunId);
-    if (existing.leaseToken !== input.lease.leaseToken) {
-        throw new Error("dag recovery lease ownership drift");
-    }
-    if (existing.executionRef && existing.executionRef !== input.executionRef) {
-        throw new Error("dag recovery lease execution identity drift");
-    }
-    const bound = {
-        ...existing,
-        executionRef: input.executionRef,
-    };
-    await writeJsonAtomic(input.leasePath, bound);
-    return bound;
+    return withLeaseMutationLock(input.leasePath, async () => {
+        const existing = parseLease(JSON.parse(await readFile(input.leasePath, "utf8")), input.lease.parentRunId);
+        if (existing.leaseToken !== input.lease.leaseToken) {
+            throw new Error("dag recovery lease ownership drift");
+        }
+        if (existing.executionRef && existing.executionRef !== input.executionRef) {
+            throw new Error("dag recovery lease execution identity drift");
+        }
+        const bound = {
+            ...existing,
+            executionRef: input.executionRef,
+        };
+        await writeJsonAtomic(input.leasePath, bound);
+        return bound;
+    });
 }

package/dist/workflows/dag/rerun-feedback.js

@@ -399,6 +399,66 @@ export async function deriveDagRerunFeedback(input) {
                 },
             });
         }
+        // Preserve actionable writer failures even when the run stopped before a
+        // final review node could commit typed findings. This is especially
+        // important for provider length exhaustion: the next run must see the
+        // stop reason/tool statistics instead of repeating the same prompt.
+        const writerNodeId = ["frontend-implement-pi", "implement-pi"].find((nodeId) => {
+            const node = input.state.nodes[nodeId];
+            return (node?.status === "ERROR" &&
+                [
+                    "empty-output",
+                    "output-limit",
+                    "invalid-output",
+                    "writer-thinking-exhausted",
+                    "writer-budget-exhausted",
+                    "incomplete-write-set",
+                    "partial-success-with-context-overflow",
+                ].includes(node.failureCategory ?? ""));
+        });
+        if (writerNodeId) {
+            const writerNode = await readNodeRecord(input.runDir, pass, undefined, writerNodeId, input.state.nodes[writerNodeId]);
+            if (writerNode) {
+                const writerFeedback = [
+                    `writer failure category: ${writerNode.failureCategory ?? "unknown"}`,
+                    writerNode.stopReason ? `provider stopReason: ${writerNode.stopReason}` : "",
+                    typeof writerNode.writeToolCallCount === "number"
+                        ? `write tool calls: ${writerNode.writeToolCallCount}`
+                        : "",
+                    writerNode.stderr?.trim() ?? "",
+                    canonicalNodeOutput(writerNode),
+                ]
+                    .filter(Boolean)
+                    .join("\n\n");
+                const parentSourceBindingHash = sourceBindingHash(input.spec);
+                return withDigest({
+                    schemaVersion: 1,
+                    kind: "unresolved-terminal-feedback",
+                    parentRunId: input.parentRunId,
+                    taskId: input.taskId,
+                    sourceNodeId: writerNodeId,
+                    verdict: "request-revision",
+                    failureCategory: writerNode.failureCategory,
+                    feedbackText: scrubAndBoundFeedbackText(writerFeedback, input.runDir, input.state.cwd),
+                    evidenceRefs: [
+                        {
+                            nodeId: writerNodeId,
+                            preservedNodeRecordPath: `${writerNodeId}.json`,
+                        },
+                    ],
+                    attemptSummary: { completedPasses: 1, maxPasses: 1 },
+                    binding: {
+                        ...(parentSourceBindingHash
+                            ? { sourceCanonicalHash: parentSourceBindingHash }
+                            : {}),
+                        ...(input.spec.taskContractBinding?.canonicalHash
+                            ? { taskContractCanonicalHash: input.spec.taskContractBinding.canonicalHash }
+                            : {}),
+                        status: "unknown",
+                    },
+                });
+            }
+        }
         return undefined;
     }
     const completedPasses = pass?.pass ?? Math.max(1, input.state.convergence?.currentPass ?? 1);

package/dist/workflows/dag/rerun-plan.js

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import { z } from "zod";
 import { assertTaskContractBindingFresh } from "./task-contract-binding.js";
+import { workspaceDriftedPaths, } from "./workspace-checkpoint.js";
 import { isSafeReadOnlyPiRetryCandidate, isTransportCrashedExclusiveWriter } from "./retry-policy.js";
 import { resolveDagTaskSourcePath } from "../../task/dag-source-paths.js";
 import { composeDagPromptOverridePrompt, MAX_DAG_RERUN_PROMPT_OVERRIDE_CHARS, } from "../../shared/dag-prompt-override.js";
@@ -1110,6 +1111,46 @@ function deriveSuggestedAction(input) {
     }
     return "manual";
 }
+/**
+ * Gitignore-style-lite matcher for readSet/writeSet path patterns in scoped
+ * workspace-drift evaluation: literal paths match exactly; `**` spans path
+ * segments (a trailing `/**` also matches when nothing follows), `*` stays
+ * within one segment, `?` is one non-separator char.
+ */
+function pathMatchesWorkspacePattern(pathValue, pattern) {
+    const normalizedPath = pathValue.replace(/\\/g, "/").replace(/^\.\//, "");
+    const trimmed = pattern.trim().replace(/\\/g, "/").replace(/^\.\//, "");
+    if (!trimmed || trimmed === "/")
+        return false;
+    if (trimmed === normalizedPath)
+        return true;
+    let source = "";
+    for (let index = 0; index < trimmed.length; index += 1) {
+        const char = trimmed[index];
+        if (char === "*") {
+            if (trimmed[index + 1] === "*") {
+                if (trimmed[index + 2] === "/") {
+                    source += "(?:.*/)?";
+                    index += 2;
+                }
+                else {
+                    source += ".*";
+                    index += 1;
+                }
+            }
+            else {
+                source += "[^/]*";
+            }
+        }
+        else if (char === "?") {
+            source += "[^/]";
+        }
+        else {
+            source += char.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+        }
+    }
+    return new RegExp(`^${source}$`).test(normalizedPath);
+}
 function deriveRisk(reasonCodes, resetCount) {
     if (reasonCodes.includes("restart-subgraph-contains-writer") ||
         reasonCodes.includes("restart-subgraph-contains-unsafe-shell") ||
@@ -1213,7 +1254,14 @@ export async function evaluateDagRerunPlan(input) {
         blockedReasons.push("parent-lifecycle-ineligible");
     }
     else if (input.parentState.status !== "failed" &&
-        input.parentState.status !== "partial_failed") {
+        input.parentState.status !== "partial_failed" &&
+        // A superseded parent is a terminal operator judgment about the run as
+        // a whole, not about its deterministic read-only compute: its FINISHED
+        // upstream nodes are still valid fact donors for the imported set, and
+        // every unsafe case (writers in the reset subgraph, decision gates,
+        // stale checkpoints, unresolved ERROR nodes outside the closure) keeps
+        // its own dedicated block below.
+        input.parentState.status !== "superseded") {
         reasonCodes.push("parent-lifecycle-ineligible");
         blockedReasons.push("parent-lifecycle-ineligible");
     }
@@ -1241,8 +1289,36 @@ export async function evaluateDagRerunPlan(input) {
     else if (input.currentWorkspace?.fingerprint &&
         input.parentTerminalWorkspace.fingerprint !==
             input.currentWorkspace.fingerprint) {
-        reasonCodes.push("workspace-drift");
-        blockedReasons.push("workspace-drift");
+        // Whole-fingerprint drift is refined to content-level paths: the rerun
+        // re-derives (readSet) and rewrites (writeSet) the reset subgraph's own
+        // paths, so drift confined to those paths is recomputed by the rerun
+        // itself and must not force a full standalone rerun. Drift anywhere
+        // else — especially inputs of imported fact-reuse nodes — keeps the
+        // strict block. Indeterminate checkpoints fail closed.
+        const driftedPaths = workspaceDriftedPaths(input.parentTerminalWorkspace, input.currentWorkspace);
+        const importedReadPaths = importedNodeIds.flatMap((nodeId) => {
+            const task = tasksByIdForPlan.get(nodeId);
+            return task?.readSet ?? [];
+        });
+        const scopedDrift = driftedPaths !== undefined &&
+            driftedPaths.length > 0 &&
+            driftedPaths.every((driftPath) => !importedReadPaths.some((pattern) => pathMatchesWorkspacePattern(driftPath, pattern)) &&
+                resetNodeIds.some((nodeId) => {
+                    const task = tasksByIdForPlan.get(nodeId);
+                    if (!task)
+                        return false;
+                    return [
+                        ...(task.writeSet ?? []),
+                        ...(task.readSet ?? []),
+                    ].some((pattern) => pathMatchesWorkspacePattern(driftPath, pattern));
+                }));
+        if (scopedDrift) {
+            reasonCodes.push("workspace-drift-scoped");
+        }
+        else {
+            reasonCodes.push("workspace-drift");
+            blockedReasons.push("workspace-drift");
+        }
     }
     else if (!input.currentWorkspace?.fingerprint) {
         reasonCodes.push("workspace-checkpoint-missing");
@@ -1293,8 +1369,18 @@ export async function evaluateDagRerunPlan(input) {
     }
     for (const nodeId of importedNodeIds) {
         const record = input.parentState.nodes[nodeId];
-        if (!record)
+        if (!record) {
+            reasonCodes.push("parent-facts-invalid");
+            blockedReasons.push("parent-facts-invalid");
+            blockingNodes.push({ nodeId, reasonCode: "parent-facts-invalid" });
             continue;
+        }
+        if (record.status === "PENDING" || record.status === "RUNNING") {
+            reasonCodes.push("parent-facts-invalid");
+            blockedReasons.push("parent-facts-invalid");
+            blockingNodes.push({ nodeId, reasonCode: "parent-facts-invalid" });
+            continue;
+        }
         if (record.status === "ERROR") {
             reasonCodes.push("parent-facts-invalid");
             blockedReasons.push("parent-facts-invalid");

package/dist/workflows/dag/rerun-run.js

@@ -88,11 +88,18 @@ const operatorRequestEnvelopeSchema = z
 })
     .strict();
 async function readExistingOperatorRequest(cwd, requestId) {
+    const requestPath = operatorRequestPath(cwd, requestId);
     try {
-        const raw = JSON.parse(await readFile(operatorRequestPath(cwd, requestId), "utf-8"));
+        const raw = JSON.parse(await readFile(requestPath, "utf-8"));
         const parsed = operatorRequestEnvelopeSchema.safeParse(raw);
-        if (!parsed.success)
-            return undefined;
+        if (!parsed.success) {
+            throw new Error("REQUEST_ID_REUSE_CONFLICT: persisted operator request envelope is invalid or belongs to a different request kind");
+        }
+        if (parsed.data.requestId !== requestId ||
+            parsed.data.parentRunId !== parsed.data.result.plan.parentRunId ||
+            parsed.data.newRunId !== parsed.data.result.newRunId) {
+            throw new Error("REQUEST_ID_REUSE_CONFLICT: persisted operator request envelope binding mismatch");
+        }
         const result = parsed.data.result;
         return {
             ...result,
@@ -100,10 +107,18 @@ async function readExistingOperatorRequest(cwd, requestId) {
             idempotentReplay: true,
         };
     }
-    catch {
-        // not found or unreadable
+    catch (error) {
+        if (error &&
+            typeof error === "object" &&
+            "code" in error &&
+            error.code === "ENOENT") {
+            return undefined;
+        }
+        if (error instanceof Error && error.message.startsWith("REQUEST_ID_REUSE_CONFLICT:")) {
+            throw error;
+        }
+        throw new Error(`REQUEST_ID_REUSE_CONFLICT: invalid persisted operator request envelope: ${error instanceof Error ? error.message : String(error)}`);
     }
-    return undefined;
 }
 /**
  * Idempotent replay of a previously persisted operator request, if any.
@@ -769,6 +784,13 @@ async function stageContinuationRun(input) {
         if (!parentRecord) {
             throw new Error(`parent node record missing for imported node: ${nodeId}`);
         }
+        if (parentRecord.status !== "FINISHED" &&
+            !(parentRecord.status === "SKIPPED" &&
+                (parentRecord.skippedReason?.includes("condition") ||
+                    parentRecord.skippedReason?.includes("runIf") ||
+                    parentRecord.skippedReason?.includes("run-if")))) {
+            throw new Error(`parent node is not a settled fact donor for imported node: ${nodeId}`);
+        }
         const { manifestNode, importedRecord } = await importNodeFacts({
             parentRunDir: input.parentRunDir,
             newRunDir: runDir,