@tea-agent/loop-agent 0.42.0-next.9 → 0.42.1

package/dist/workflows/dag/prompt.js

@@ -136,6 +136,10 @@ export function buildUpstreamContext(task, upstream, maxChars = MAX_UPSTREAM_CHA
     const consumedArtifactIds = new Set((task.consumesArtifacts ?? []).map((binding) => binding.artifactId));
     for (const depId of task.depends_on) {
         const record = upstream[depId];
+        if (task.id === "frontend-scout-pi" && depId === "frontend-contract-pi" && record?.status === "FINISHED") {
+            sections.push(`## Upstream output: ${depId}\nCommitted Contract obligations are supplied in frontend_scout_input. Do not reconstruct them from prose or reread the source.`);
+            continue;
+        }
         const stdout = record?.stdout?.trim() ? record.stdout : "";
         const assistantText = record?.assistantText?.trim()
             ? record.assistantText

package/dist/workflows/dag/recovery-lease.js

@@ -1,6 +1,8 @@
 import { createHash, randomBytes } from "node:crypto";
-import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
+import { hostname as localHostname } from "node:os";
 import path from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
 import { writeJsonAtomic } from "../../infrastructure/harness/atomic-write.js";
 import { DAG_RUNS_DIR } from "./lifecycle.js";
 function recoveryLeasePath(cwd, parentRunId) {
@@ -23,6 +25,11 @@ function parseLease(raw, parentRunId) {
             record.kind !== "standalone-task-rerun") ||
         typeof record.leaseToken !== "string" ||
         record.leaseToken.length === 0 ||
+        typeof record.ownerPid !== "number" ||
+        !Number.isInteger(record.ownerPid) ||
+        record.ownerPid <= 0 ||
+        typeof record.ownerHostname !== "string" ||
+        record.ownerHostname.length === 0 ||
         typeof record.acquiredAt !== "string" ||
         typeof record.executionRef !== "undefined" &&
             typeof record.executionRef !== "string") {
@@ -30,6 +37,60 @@ function parseLease(raw, parentRunId) {
     }
     return record;
 }
+const LEASE_MUTATION_LOCK_STALE_MS = 60_000;
+const LEASE_MUTATION_LOCK_RETRIES = 200;
+async function withLeaseMutationLock(leasePath, operation) {
+    const lockPath = `${leasePath}.mutation-lock`;
+    for (let attempt = 0; attempt < LEASE_MUTATION_LOCK_RETRIES; attempt += 1) {
+        try {
+            await mkdir(lockPath);
+        }
+        catch (error) {
+            if (!(error && typeof error === "object" && "code" in error && error.code === "EEXIST")) {
+                throw error;
+            }
+            try {
+                const lockStat = await stat(lockPath);
+                if (Date.now() - lockStat.mtimeMs >= LEASE_MUTATION_LOCK_STALE_MS) {
+                    await rm(lockPath, { recursive: true, force: true });
+                    continue;
+                }
+            }
+            catch (statError) {
+                if (statError &&
+                    typeof statError === "object" &&
+                    "code" in statError &&
+                    statError.code === "ENOENT") {
+                    continue;
+                }
+                throw statError;
+            }
+            await delay(10);
+            continue;
+        }
+        try {
+            return await operation();
+        }
+        finally {
+            await rm(lockPath, { recursive: true, force: true });
+        }
+    }
+    throw new Error("dag recovery lease mutation lock is busy");
+}
+function defaultIsProcessAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function leaseOwnerIsAlive(input) {
+    if (input.lease.ownerHostname !== input.hostname)
+        return true;
+    return input.isProcessAlive(input.lease.ownerPid);
+}
 export async function acquireDagRecoveryLease(input) {
     const leasePath = recoveryLeasePath(input.cwd, input.parentRunId);
     const lease = {
@@ -38,13 +99,15 @@ export async function acquireDagRecoveryLease(input) {
         requestId: input.requestId,
         kind: input.kind,
         leaseToken: randomBytes(16).toString("hex"),
+        ownerPid: process.pid,
+        ownerHostname: localHostname(),
         acquiredAt: (input.now ?? (() => new Date()))().toISOString(),
     };
     await mkdir(path.dirname(leasePath), { recursive: true });
     try {
         // `wx` is the cross-process compare-and-create primitive. The lease is
-        // deliberately immutable for a parent run: a later recovery must follow
-        // the committed child lineage rather than fork another DAG.
+        // parent-scoped for the full recovery lineage. Ownership may only be
+        // replaced by claimDagRecoveryLease after the recorded owner is proven dead.
         await writeFile(leasePath, `${JSON.stringify(lease, null, 2)}\n`, {
             encoding: "utf8",
             flag: "wx",
@@ -59,22 +122,49 @@ export async function acquireDagRecoveryLease(input) {
         return { kind: "held", leasePath, lease: existing };
     }
 }
+/**
+ * Reclaim a lease only after its recorded same-host owner is proven dead.
+ * The mutation lock serializes reclaim with execution binding, so a live owner
+ * can never race a stale-owner takeover and launch a second recovery.
+ */
+export async function claimDagRecoveryLease(input) {
+    const hostname = input.hostname ?? localHostname();
+    const isProcessAlive = input.isProcessAlive ?? defaultIsProcessAlive;
+    return withLeaseMutationLock(input.leasePath, async () => {
+        const existing = parseLease(JSON.parse(await readFile(input.leasePath, "utf8")), input.lease.parentRunId);
+        if (existing.leaseToken !== input.lease.leaseToken ||
+            leaseOwnerIsAlive({ lease: existing, hostname, isProcessAlive })) {
+            return { kind: "held", leasePath: input.leasePath, lease: existing };
+        }
+        const claimed = {
+            ...existing,
+            leaseToken: randomBytes(16).toString("hex"),
+            ownerPid: process.pid,
+            ownerHostname: hostname,
+            acquiredAt: (input.now ?? (() => new Date()))().toISOString(),
+        };
+        await writeJsonAtomic(input.leasePath, claimed);
+        return { kind: "acquired", leasePath: input.leasePath, lease: claimed };
+    });
+}
 /** Persist the operation/run identity before the caller is allowed to execute it. */
 export async function bindDagRecoveryLeaseExecution(input) {
     if (!input.executionRef.trim()) {
         throw new Error("dag recovery lease executionRef is required");
     }
-    const existing = parseLease(JSON.parse(await readFile(input.leasePath, "utf8")), input.lease.parentRunId);
-    if (existing.leaseToken !== input.lease.leaseToken) {
-        throw new Error("dag recovery lease ownership drift");
-    }
-    if (existing.executionRef && existing.executionRef !== input.executionRef) {
-        throw new Error("dag recovery lease execution identity drift");
-    }
-    const bound = {
-        ...existing,
-        executionRef: input.executionRef,
-    };
-    await writeJsonAtomic(input.leasePath, bound);
-    return bound;
+    return withLeaseMutationLock(input.leasePath, async () => {
+        const existing = parseLease(JSON.parse(await readFile(input.leasePath, "utf8")), input.lease.parentRunId);
+        if (existing.leaseToken !== input.lease.leaseToken) {
+            throw new Error("dag recovery lease ownership drift");
+        }
+        if (existing.executionRef && existing.executionRef !== input.executionRef) {
+            throw new Error("dag recovery lease execution identity drift");
+        }
+        const bound = {
+            ...existing,
+            executionRef: input.executionRef,
+        };
+        await writeJsonAtomic(input.leasePath, bound);
+        return bound;
+    });
 }

package/dist/workflows/dag/rerun-feedback.js

@@ -408,6 +408,7 @@ export async function deriveDagRerunFeedback(input) {
             return (node?.status === "ERROR" &&
                 [
                     "empty-output",
+                    "output-limit",
                     "invalid-output",
                     "writer-thinking-exhausted",
                     "writer-budget-exhausted",

package/dist/workflows/dag/rerun-plan.js

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import { z } from "zod";
 import { assertTaskContractBindingFresh } from "./task-contract-binding.js";
+import { workspaceDriftedPaths, } from "./workspace-checkpoint.js";
 import { isSafeReadOnlyPiRetryCandidate, isTransportCrashedExclusiveWriter } from "./retry-policy.js";
 import { resolveDagTaskSourcePath } from "../../task/dag-source-paths.js";
 import { composeDagPromptOverridePrompt, MAX_DAG_RERUN_PROMPT_OVERRIDE_CHARS, } from "../../shared/dag-prompt-override.js";
@@ -45,6 +46,7 @@ const highRiskContinuationAuthorityV1Schema = z
             tokens: z.number().int().nonnegative().nullable(),
             wallTimeMs: z.number().nonnegative(),
             executorCalls: z.number().int().nonnegative(),
+            providerRequests: z.number().int().nonnegative().optional(),
             repairPasses: z.number().int().nonnegative(),
             peakContextChars: z.number().int().nonnegative(),
             missingTokenNodeIds: z.array(z.string()),
@@ -1110,6 +1112,46 @@ function deriveSuggestedAction(input) {
     }
     return "manual";
 }
+/**
+ * Gitignore-style-lite matcher for readSet/writeSet path patterns in scoped
+ * workspace-drift evaluation: literal paths match exactly; `**` spans path
+ * segments (a trailing `/**` also matches when nothing follows), `*` stays
+ * within one segment, `?` is one non-separator char.
+ */
+function pathMatchesWorkspacePattern(pathValue, pattern) {
+    const normalizedPath = pathValue.replace(/\\/g, "/").replace(/^\.\//, "");
+    const trimmed = pattern.trim().replace(/\\/g, "/").replace(/^\.\//, "");
+    if (!trimmed || trimmed === "/")
+        return false;
+    if (trimmed === normalizedPath)
+        return true;
+    let source = "";
+    for (let index = 0; index < trimmed.length; index += 1) {
+        const char = trimmed[index];
+        if (char === "*") {
+            if (trimmed[index + 1] === "*") {
+                if (trimmed[index + 2] === "/") {
+                    source += "(?:.*/)?";
+                    index += 2;
+                }
+                else {
+                    source += ".*";
+                    index += 1;
+                }
+            }
+            else {
+                source += "[^/]*";
+            }
+        }
+        else if (char === "?") {
+            source += "[^/]";
+        }
+        else {
+            source += char.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+        }
+    }
+    return new RegExp(`^${source}$`).test(normalizedPath);
+}
 function deriveRisk(reasonCodes, resetCount) {
     if (reasonCodes.includes("restart-subgraph-contains-writer") ||
         reasonCodes.includes("restart-subgraph-contains-unsafe-shell") ||
@@ -1213,7 +1255,14 @@ export async function evaluateDagRerunPlan(input) {
         blockedReasons.push("parent-lifecycle-ineligible");
     }
     else if (input.parentState.status !== "failed" &&
-        input.parentState.status !== "partial_failed") {
+        input.parentState.status !== "partial_failed" &&
+        // A superseded parent is a terminal operator judgment about the run as
+        // a whole, not about its deterministic read-only compute: its FINISHED
+        // upstream nodes are still valid fact donors for the imported set, and
+        // every unsafe case (writers in the reset subgraph, decision gates,
+        // stale checkpoints, unresolved ERROR nodes outside the closure) keeps
+        // its own dedicated block below.
+        input.parentState.status !== "superseded") {
         reasonCodes.push("parent-lifecycle-ineligible");
         blockedReasons.push("parent-lifecycle-ineligible");
     }
@@ -1241,8 +1290,41 @@ export async function evaluateDagRerunPlan(input) {
     else if (input.currentWorkspace?.fingerprint &&
         input.parentTerminalWorkspace.fingerprint !==
             input.currentWorkspace.fingerprint) {
-        reasonCodes.push("workspace-drift");
-        blockedReasons.push("workspace-drift");
+        // Whole-fingerprint drift is refined to content-level paths: the rerun
+        // re-derives (readSet) and rewrites (writeSet) the reset subgraph's own
+        // paths, so drift confined to those paths is recomputed by the rerun
+        // itself and must not force a full standalone rerun. Drift anywhere
+        // else — especially inputs of imported fact-reuse nodes — keeps the
+        // strict block. Indeterminate checkpoints fail closed.
+        const driftedPaths = workspaceDriftedPaths(input.parentTerminalWorkspace, input.currentWorkspace);
+        const importedReadPaths = importedNodeIds.flatMap((nodeId) => {
+            const task = tasksByIdForPlan.get(nodeId);
+            return task?.readSet ?? [];
+        });
+        // An omitted or empty readSet is unrestricted, not proof that an
+        // imported node read nothing. Localize drift only when every reused
+        // node has an explicit reading boundary.
+        const importedReadSetsKnown = importedNodeIds.every((nodeId) => (tasksByIdForPlan.get(nodeId)?.readSet?.length ?? 0) > 0);
+        const scopedDrift = importedReadSetsKnown &&
+            driftedPaths !== undefined &&
+            driftedPaths.length > 0 &&
+            driftedPaths.every((driftPath) => !importedReadPaths.some((pattern) => pathMatchesWorkspacePattern(driftPath, pattern)) &&
+                resetNodeIds.some((nodeId) => {
+                    const task = tasksByIdForPlan.get(nodeId);
+                    if (!task)
+                        return false;
+                    return [
+                        ...(task.writeSet ?? []),
+                        ...(task.readSet ?? []),
+                    ].some((pattern) => pathMatchesWorkspacePattern(driftPath, pattern));
+                }));
+        if (scopedDrift) {
+            reasonCodes.push("workspace-drift-scoped");
+        }
+        else {
+            reasonCodes.push("workspace-drift");
+            blockedReasons.push("workspace-drift");
+        }
     }
     else if (!input.currentWorkspace?.fingerprint) {
         reasonCodes.push("workspace-checkpoint-missing");
@@ -1293,8 +1375,18 @@ export async function evaluateDagRerunPlan(input) {
     }
     for (const nodeId of importedNodeIds) {
         const record = input.parentState.nodes[nodeId];
-        if (!record)
+        if (!record) {
+            reasonCodes.push("parent-facts-invalid");
+            blockedReasons.push("parent-facts-invalid");
+            blockingNodes.push({ nodeId, reasonCode: "parent-facts-invalid" });
             continue;
+        }
+        if (record.status === "PENDING" || record.status === "RUNNING") {
+            reasonCodes.push("parent-facts-invalid");
+            blockedReasons.push("parent-facts-invalid");
+            blockingNodes.push({ nodeId, reasonCode: "parent-facts-invalid" });
+            continue;
+        }
         if (record.status === "ERROR") {
             reasonCodes.push("parent-facts-invalid");
             blockedReasons.push("parent-facts-invalid");

package/dist/workflows/dag/rerun-run.js

@@ -88,11 +88,18 @@ const operatorRequestEnvelopeSchema = z
 })
     .strict();
 async function readExistingOperatorRequest(cwd, requestId) {
+    const requestPath = operatorRequestPath(cwd, requestId);
     try {
-        const raw = JSON.parse(await readFile(operatorRequestPath(cwd, requestId), "utf-8"));
+        const raw = JSON.parse(await readFile(requestPath, "utf-8"));
         const parsed = operatorRequestEnvelopeSchema.safeParse(raw);
-        if (!parsed.success)
-            return undefined;
+        if (!parsed.success) {
+            throw new Error("REQUEST_ID_REUSE_CONFLICT: persisted operator request envelope is invalid or belongs to a different request kind");
+        }
+        if (parsed.data.requestId !== requestId ||
+            parsed.data.parentRunId !== parsed.data.result.plan.parentRunId ||
+            parsed.data.newRunId !== parsed.data.result.newRunId) {
+            throw new Error("REQUEST_ID_REUSE_CONFLICT: persisted operator request envelope binding mismatch");
+        }
         const result = parsed.data.result;
         return {
             ...result,
@@ -100,10 +107,18 @@ async function readExistingOperatorRequest(cwd, requestId) {
             idempotentReplay: true,
         };
     }
-    catch {
-        // not found or unreadable
+    catch (error) {
+        if (error &&
+            typeof error === "object" &&
+            "code" in error &&
+            error.code === "ENOENT") {
+            return undefined;
+        }
+        if (error instanceof Error && error.message.startsWith("REQUEST_ID_REUSE_CONFLICT:")) {
+            throw error;
+        }
+        throw new Error(`REQUEST_ID_REUSE_CONFLICT: invalid persisted operator request envelope: ${error instanceof Error ? error.message : String(error)}`);
     }
-    return undefined;
 }
 /**
  * Idempotent replay of a previously persisted operator request, if any.
@@ -769,6 +784,13 @@ async function stageContinuationRun(input) {
         if (!parentRecord) {
             throw new Error(`parent node record missing for imported node: ${nodeId}`);
         }
+        if (parentRecord.status !== "FINISHED" &&
+            !(parentRecord.status === "SKIPPED" &&
+                (parentRecord.skippedReason?.includes("condition") ||
+                    parentRecord.skippedReason?.includes("runIf") ||
+                    parentRecord.skippedReason?.includes("run-if")))) {
+            throw new Error(`parent node is not a settled fact donor for imported node: ${nodeId}`);
+        }
         const { manifestNode, importedRecord } = await importNodeFacts({
             parentRunDir: input.parentRunDir,
             newRunDir: runDir,