@tea-agent/loop-agent 0.43.0 → 0.44.0-next.10

package/dist/task/source-prepare/source-provider-budget.js

@@ -0,0 +1,290 @@
+import { completedSourceExecutionSchema } from "./source-execution.js";
+import { currentFrontendSessionIdentity } from "../../workflows/dag/frontend-session-context.js";
+import { sha256OfCanonicalJson } from "../contract/hash.js";
+import { createHash, randomUUID } from "node:crypto";
+import { lstat, mkdir, readdir, rmdir } from "node:fs/promises";
+import path from "node:path";
+import { sourceProviderBudgetSchema as ledgerSchema } from "../../application/evaluation/budget.js";
+import { writeJsonAtomic } from "../../infrastructure/harness/atomic-write.js";
+import { readFileBoundarySafe } from "../../shared/path-safety.js";
+import { getTaskPaths, loadTaskConfig } from "../runtime.js";
+/** Read-only generation snapshot; never create a zero ledger over old receipts. */
+export async function readTaskSourceProviderBudget(input) {
+    const root = path.join(getTaskPaths(input.repoRoot, input.taskId).taskDir, "artifacts");
+    const file = path.join(root, "source-provider-budget.json");
+    const exists = await lstat(file).then(() => true).catch(error => { if (error.code === "ENOENT")
+        return false; throw error; });
+    if (!exists) {
+        const files = await readdir(path.join(root, "session-budget")).catch(error => { if (error.code === "ENOENT")
+            return []; throw error; });
+        if (files.length || input.expectedBudgetId)
+            throw Error("FRONTEND_PROVIDER_BUDGET_INVALID: missing bound source budget");
+        return undefined;
+    }
+    const ledger = ledgerSchema.parse(JSON.parse((await readFileBoundarySafe({ boundaryRoot: root, targetPath: file, label: "source provider budget" })).toString("utf8")));
+    validateBinding(input, ledger);
+    return ledger;
+}
+function validateBinding(input, ledger) {
+    if (ledger.taskId !== input.taskId || ledger.maxProviderRequests !== input.maxProviderRequests || input.expectedBudgetId && ledger.budgetId !== input.expectedBudgetId || input.minimumReservedRequests !== undefined && ledger.reservedRequests < input.minimumReservedRequests)
+        throw Error("FRONTEND_PROVIDER_BUDGET_INVALID: source budget binding changed");
+}
+/** The short filesystem critical section spans read, admission and atomic
+ * persistence. A stale lock is never stolen on an age heuristic. */
+async function transact(input, reserve) {
+    if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(input.taskId) || !Number.isSafeInteger(input.maxProviderRequests) || input.maxProviderRequests < 1)
+        throw Error("FRONTEND_PROVIDER_BUDGET_INVALID: invalid source budget identity or limit");
+    await loadTaskConfig(input.repoRoot, input.taskId); // never recreate a missing task
+    const root = path.join(getTaskPaths(input.repoRoot, input.taskId).taskDir, "artifacts");
+    const rootStat = await lstat(root);
+    if (!rootStat.isDirectory() || rootStat.isSymbolicLink())
+        throw Error("FRONTEND_PROVIDER_BUDGET_INVALID: source artifact directory is not a real directory");
+    const file = path.join(root, "source-provider-budget.json");
+    const lock = path.join(root, ".source-provider-budget.lock");
+    let held = false;
+    try {
+        for (let attempt = 0; attempt < 100; attempt++) {
+            try {
+                await mkdir(lock);
+                held = true;
+                break;
+            }
+            catch (error) {
+                if (error.code !== "EEXIST")
+                    throw error;
+                await new Promise(resolve => setTimeout(resolve, 10));
+            }
+        }
+        if (!held)
+            throw Error("FRONTEND_PROVIDER_BUDGET_BUSY: source budget lock unavailable");
+        let ledger;
+        try {
+            await lstat(file);
+            ledger = ledgerSchema.parse(JSON.parse((await readFileBoundarySafe({ boundaryRoot: root, targetPath: file, label: "source provider budget" })).toString("utf8")));
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw Error(`FRONTEND_PROVIDER_BUDGET_INVALID: ${error instanceof Error ? error.message : String(error)}`);
+            if (input.expectedBudgetId)
+                throw Error("FRONTEND_PROVIDER_BUDGET_INVALID: bound task budget is missing");
+            // Existing attempts cannot be silently imported as zero-cost history.
+            const previous = await readdir(path.join(root, "session-budget")).catch(error => {
+                if (error.code === "ENOENT")
+                    return [];
+                throw error;
+            });
+            if (previous.length)
+                throw Error("FRONTEND_PROVIDER_BUDGET_INVALID: source receipts have no bound budget");
+            ledger = { schemaVersion: 1, taskId: input.taskId, budgetId: randomUUID(), maxProviderRequests: input.maxProviderRequests, reservedRequests: 0 };
+        }
+        validateBinding(input, ledger);
+        if (reserve) {
+            if (ledger.reservedRequests >= ledger.maxProviderRequests)
+                throw Error("FRONTEND_PROVIDER_BUDGET_EXHAUSTED: source request quota reached");
+            const identity = currentFrontendSessionIdentity();
+            if (identity) {
+                if (identity.executionKind !== "model" || identity.taskId && identity.taskId !== input.taskId)
+                    throw Error("FRONTEND_PROVIDER_BUDGET_INVALID: request belongs to another session/task");
+                const key = `${identity.runId ?? "task"}:${identity.sessionId}`;
+                const previous = ledger.requestSessions?.[key];
+                if (previous && sha256OfCanonicalJson(previous.identity) !== sha256OfCanonicalJson(identity))
+                    throw Error("FRONTEND_PROVIDER_BUDGET_INVALID: session identity changed");
+                ledger.requestSessions ??= {};
+                ledger.requestSessions[key] = { identity, reservedRequests: (previous?.reservedRequests ?? 0) + 1 };
+            }
+            ledger.reservedRequests++;
+        }
+        // A failed write grants no admission. A successful reservation is never refunded.
+        await writeJsonAtomic(file, ledger, { repoRoot: input.repoRoot });
+        return ledger;
+    }
+    finally {
+        if (held)
+            await rmdir(lock);
+    }
+}
+export async function reserveTaskSourceProviderRequest(input) {
+    try {
+        await transact(input, true);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        throw Error(message.startsWith("FRONTEND_PROVIDER_") ? message : `FRONTEND_PROVIDER_BUDGET_PERSIST_FAILED: ${message}`);
+    }
+}
+/** Initialize before the adapter writes its first incomplete session receipt. */
+export async function openTaskSourceProviderBudget(input) {
+    await transact(input, false);
+    return () => reserveTaskSourceProviderRequest(input);
+}
+/** Check the closed set of source sessions registered by durable admission.
+ * Receipt copies deduplicate only when their contents are identical. */
+export function summarizeBoundSourceUsage(ledger, receipts) {
+    ledgerSchema.parse(ledger);
+    const diagnostics = [];
+    const sessions = Object.values(ledger.requestSessions ?? {});
+    const sources = sessions.filter(session => session.identity.runId === null);
+    const unattributedRequests = ledger.reservedRequests - sessions.reduce((sum, session) => sum + session.reservedRequests, 0);
+    if (unattributedRequests)
+        diagnostics.push("unattributed-task-requests");
+    const byId = new Map();
+    for (const receipt of receipts) {
+        if (receipt.identity.runId !== null)
+            continue;
+        const key = receipt.identity.sessionId;
+        const previous = byId.get(key);
+        if (previous && sha256OfCanonicalJson(previous) !== sha256OfCanonicalJson(receipt))
+            diagnostics.push(`conflicting-source-receipt:${key}`);
+        byId.set(key, receipt);
+        if (!sources.some(session => session.identity.sessionId === key))
+            diagnostics.push(`unbound-source-receipt:${key}`);
+    }
+    let totalTokens = 0;
+    for (const session of sources) {
+        const receipt = byId.get(session.identity.sessionId);
+        if (!receipt || session.identity.taskId !== ledger.taskId || !session.identity.sourceDigest || sha256OfCanonicalJson(session.identity) !== sha256OfCanonicalJson(receipt.identity)) {
+            diagnostics.push(`source-session-binding:${session.identity.sessionId}`);
+            continue;
+        }
+        if (receipt.completion !== "complete" || !receipt.terminal || receipt.actual.requestCount !== session.reservedRequests)
+            diagnostics.push(`source-session-incomplete:${session.identity.sessionId}`);
+        const tokens = receipt.actual.totalTokens;
+        if (tokens === null || !Number.isFinite(tokens) || tokens < 0)
+            diagnostics.push(`source-tokens-unknown:${session.identity.sessionId}`);
+        else
+            totalTokens += tokens;
+        if (receipt.attempts.length && (receipt.attempts.some(attempt => attempt.completion !== "complete" || attempt.actual?.requestCount == null || attempt.actual?.totalTokens == null) || receipt.attempts.reduce((sum, attempt) => sum + (attempt.actual?.requestCount ?? 0), 0) !== session.reservedRequests || receipt.attempts.reduce((sum, attempt) => sum + (attempt.actual?.totalTokens ?? 0), 0) !== tokens))
+            diagnostics.push(`source-attempt-usage-mismatch:${session.identity.sessionId}`);
+    }
+    return { complete: diagnostics.length === 0, diagnostics, sourceSessions: sources.length, sourceRequests: sources.reduce((sum, session) => sum + session.reservedRequests, 0), unattributedRequests, totalTokens: diagnostics.length ? null : totalTokens };
+}
+const receiptHash = (bytes) => createHash("sha256").update(bytes).digest("hex");
+/** Freeze actual bytes, not a caller-supplied token total. Concurrent changes
+ * remain diagnostic evidence rather than a cheaper snapshot. */
+export async function freezeTaskSourceUsage(input, ledger) {
+    const root = path.join(getTaskPaths(input.repoRoot, input.taskId).taskDir, "artifacts");
+    const evidence = { receipts: [], executions: [], diagnostics: [] };
+    try {
+        const files = await readdir(path.join(root, "session-budget")).catch(error => { if (error.code === "ENOENT")
+            return []; throw error; });
+        for (const name of files.sort()) {
+            const relative = `session-budget/${name}`;
+            const bytes = await readFileBoundarySafe({ boundaryRoot: root, targetPath: path.join(root, relative), label: "source usage receipt" });
+            evidence.receipts.push({ path: relative, sha256: receiptHash(bytes), content: bytes.toString("utf8") });
+        }
+        const executionIds = new Set(Object.values(ledger.requestSessions ?? {}).filter(row => row.identity.runId === null).map(row => row.identity.sourceExecutionId).filter((id) => !!id));
+        for (const id of [...executionIds].sort()) {
+            const relative = `source-executions/${id}.json`;
+            const bytes = await readFileBoundarySafe({ boundaryRoot: root, targetPath: path.join(root, relative), label: "source execution" });
+            evidence.executions.push({ path: relative, sha256: receiptHash(bytes), content: bytes.toString("utf8") });
+        }
+        for (const ref of [...evidence.receipts, ...evidence.executions]) {
+            const bytes = await readFileBoundarySafe({ boundaryRoot: root, targetPath: path.join(root, ref.path), label: "source usage receipt" });
+            if (receiptHash(bytes) !== ref.sha256)
+                throw Error("source-receipt-changed-during-freeze");
+        }
+        const after = await readTaskSourceProviderBudget(input);
+        if (sha256OfCanonicalJson(after ?? null) !== sha256OfCanonicalJson(ledger))
+            throw Error("source-ledger-changed-during-freeze");
+    }
+    catch (error) {
+        evidence.diagnostics.push(error instanceof Error ? error.message : String(error));
+    }
+    return evidence;
+}
+export function summarizeFrozenSourceUsage(binding) {
+    const diagnostics = [...(binding.evidence?.diagnostics ?? [])];
+    const receipts = [];
+    if (!binding.evidence)
+        diagnostics.push("missing-frozen-source-evidence");
+    for (const ref of binding.evidence?.receipts ?? []) {
+        try {
+            if (!/^session-budget\/[^/\\]+\.json$/.test(ref.path) || receiptHash(ref.content) !== ref.sha256)
+                throw Error("source-receipt-hash-or-path");
+            const receipt = JSON.parse(ref.content);
+            if (receipt.schemaVersion !== 2 || receipt.policyVersion !== "frontend-session-observation-v2" || !receipt.identity || receipt.identity.runId !== null || !receipt.actual || !Array.isArray(receipt.attempts) || !Number.isFinite(Date.parse(receipt.startedAt)) || !receipt.finishedAt || Date.parse(receipt.finishedAt) < Date.parse(receipt.startedAt) || !Number.isFinite(Date.parse(receipt.finishedAt)))
+                throw Error("invalid-source-receipt");
+            receipts.push(receipt);
+        }
+        catch {
+            diagnostics.push(`invalid-frozen-source-receipt:${ref.path}`);
+        }
+    }
+    const executions = new Map();
+    const required = new Set(Object.values(binding.ledger.requestSessions ?? {}).filter(row => row.identity.runId === null).map(row => row.identity.sourceExecutionId).filter((id) => !!id));
+    for (const ref of binding.evidence?.executions ?? []) {
+        try {
+            if (receiptHash(ref.content) !== ref.sha256)
+                throw Error("execution hash");
+            const execution = completedSourceExecutionSchema.parse(JSON.parse(ref.content));
+            if (ref.path !== `source-executions/${execution.executionId}.json` || execution.taskId !== binding.ledger.taskId || !required.has(execution.executionId) || executions.has(execution.executionId))
+                throw Error("execution identity");
+            executions.set(execution.executionId, execution);
+        }
+        catch {
+            diagnostics.push(`invalid-source-execution:${ref.path}`);
+        }
+    }
+    for (const id of required)
+        if (!executions.has(id))
+            diagnostics.push(`missing-source-execution:${id}`);
+    for (const receipt of receipts) {
+        const id = receipt.identity.sourceExecutionId;
+        if (!id) {
+            diagnostics.push(`unregistered-source-execution:${receipt.identity.sessionId}`);
+            continue;
+        }
+        const execution = executions.get(id);
+        if (!execution || Date.parse(receipt.startedAt) < Date.parse(execution.startedAt) || Date.parse(receipt.finishedAt) > Date.parse(execution.finishedAt) || (execution.phase === "semantic-intake") !== (receipt.identity.phase === "semantic-intake"))
+            diagnostics.push(`source-execution-session-mismatch:${receipt.identity.sessionId}`);
+    }
+    const relation = (snapshot) => {
+        if (!binding.contract)
+            return "unbound";
+        if (snapshot.revision === null && snapshot.canonicalHash === null && snapshot.observedCanonicalHash === null)
+            return "pre-contract";
+        if (snapshot.revision === null || snapshot.canonicalHash === null || snapshot.observedCanonicalHash !== snapshot.canonicalHash)
+            return "conflict";
+        if (snapshot.revision > binding.contract.revision)
+            return "future-revision";
+        if (snapshot.revision < binding.contract.revision)
+            return "prior-revision";
+        return snapshot.canonicalHash === binding.contract.canonicalHash ? "current" : "conflict";
+    };
+    const executionContracts = [...executions.values()].map(execution => ({ executionId: execution.executionId, before: relation(execution.beforeContract), after: relation(execution.afterContract) }));
+    for (const row of executionContracts)
+        if ([row.before, row.after].some(value => ["unbound", "conflict", "future-revision"].includes(value)))
+            diagnostics.push(`source-execution-contract:${row.executionId}`);
+    try {
+        const usage = summarizeBoundSourceUsage(binding.ledger, receipts);
+        diagnostics.push(...usage.diagnostics);
+        // Non-source requests in a task-lifetime ledger have not been priced by
+        // this source-only proof. Keep their existing unknown-cost marker.
+        if (binding.ledger.reservedRequests !== usage.sourceRequests)
+            diagnostics.push("non-source-task-cost-unproven");
+        return { ...usage, executionContracts, complete: diagnostics.length === 0, diagnostics, totalTokens: diagnostics.length ? null : usage.totalTokens };
+    }
+    catch {
+        return { executionContracts, complete: false, diagnostics: [...diagnostics, "invalid-source-usage"], sourceSessions: null, sourceRequests: null, unattributedRequests: null, totalTokens: null };
+    }
+}
+/** Evaluation checks the original files against the frozen generation bytes.
+ * It never reads today's task ledger as yesterday's cost. */
+export async function verifyFrozenSourceUsage(repoRoot, binding) {
+    const summary = summarizeFrozenSourceUsage(binding);
+    const diagnostics = [...summary.diagnostics];
+    const root = path.join(getTaskPaths(repoRoot, binding.ledger.taskId).taskDir, "artifacts");
+    for (const ref of [...(binding.evidence?.receipts ?? []), ...(binding.evidence?.executions ?? [])]) {
+        try {
+            if (!/^(?:session-budget|source-executions)\/[^/\\]+\.json$/.test(ref.path))
+                throw Error("invalid path");
+            const bytes = await readFileBoundarySafe({ boundaryRoot: root, targetPath: path.join(root, ref.path), label: "frozen source usage" });
+            if (receiptHash(bytes) !== ref.sha256)
+                throw Error("changed receipt");
+        }
+        catch {
+            diagnostics.push(`source-evidence-missing-or-changed:${ref.path}`);
+        }
+    }
+    return { ...summary, complete: diagnostics.length === 0, diagnostics, totalTokens: diagnostics.length ? null : summary.totalTokens };
+}

package/dist/worker/console/chat/assistant-content.js

@@ -102,43 +102,14 @@ export function splitFinalAssistantBlocks(blocks, options = {}) {
     // after text that is already visible. Keep the whole live message in the
     // chronological process subtree so that update appends the tool in place
     // instead of reparenting the earlier text from answer -> process.
-    if (options.isStreaming) {
-        return { answerBlocks: [], processBlocks: displayable };
-    }
-    let lastProcessIndex = -1;
-    for (let i = displayable.length - 1; i >= 0; i--) {
-        if (!isFinalAnswerBlock(displayable[i])) {
-            lastProcessIndex = i;
-            break;
-        }
-    }
-    if (lastProcessIndex === -1) {
-        return { answerBlocks: displayable, processBlocks: [] };
-    }
-    const trailing = displayable.slice(lastProcessIndex + 1);
-    if (trailing.length > 0) {
-        return {
-            answerBlocks: trailing,
-            processBlocks: displayable.slice(0, lastProcessIndex + 1),
-        };
-    }
-    // The stage ends on a non-text block (a tool call after the prose, or a final
-    // thinking block). Returning an empty answer here hid the whole reply inside
-    // the collapsed process subtree; keep the last prose block as the visible
-    // answer instead (2026-09-08).
-    let lastTextIndex = -1;
-    for (let i = displayable.length - 1; i >= 0; i--) {
-        if (isFinalAnswerBlock(displayable[i])) {
-            lastTextIndex = i;
-            break;
-        }
-    }
-    if (lastTextIndex === -1) {
+    if (options.isStreaming ||
+        displayable.some((block) => block.type === "toolCall")) {
         return { answerBlocks: [], processBlocks: displayable };
     }
+    const answerBlocks = displayable.filter((block) => isFinalAnswerBlock(block) && block.text.trim() !== "");
     return {
-        answerBlocks: [displayable[lastTextIndex]],
-        processBlocks: displayable.filter((_block, index) => index !== lastTextIndex),
+        answerBlocks,
+        processBlocks: displayable.filter((block) => !isFinalAnswerBlock(block)),
     };
 }
 export function joinAssistantText(blocks) {

package/dist/worker/console/chat/chat-event-store.js

@@ -327,18 +327,62 @@ export function projectChatToolEventPayload(input) {
             toolName: input.toolName,
             argsPreview: preview,
             previewHash,
+            ...(input.step === undefined ? {} : { step: input.step }),
+            ...(input.parentToolCallId
+                ? { parentToolCallId: input.parentToolCallId }
+                : {}),
         };
     }
     const { preview, previewHash } = projectToolResultPreview(input.value);
+    if (input.kind === "tool_update") {
+        return {
+            toolCallId: input.toolCallId,
+            toolName: input.toolName,
+            resultPreview: preview,
+            previewHash,
+            ...(input.step === undefined ? {} : { step: input.step }),
+            ...(input.parentToolCallId
+                ? { parentToolCallId: input.parentToolCallId }
+                : {}),
+        };
+    }
     return {
         toolCallId: input.toolCallId,
         toolName: input.toolName,
         resultPreview: preview,
         previewHash,
         isError: Boolean(input.isError),
+        ...(input.step === undefined ? {} : { step: input.step }),
+        ...(input.parentToolCallId
+            ? { parentToolCallId: input.parentToolCallId }
+            : {}),
         ...(input.operationId ? { operationId: input.operationId } : {}),
     };
 }
+export function projectUnknownChatEventPayload(input) {
+    const redact = (value, depth) => {
+        if (depth >= 6)
+            return "[DEPTH_LIMIT]";
+        if (Array.isArray(value)) {
+            return value.slice(0, 50).map((item) => redact(item, depth + 1));
+        }
+        if (!value || typeof value !== "object")
+            return value;
+        const result = {};
+        for (const [key, child] of Object.entries(value).slice(0, 100)) {
+            result[key] = /authorization|cookie|password|secret|token|api[-_]?key/i.test(key)
+                ? "[REDACTED]"
+                : redact(child, depth + 1);
+        }
+        return result;
+    };
+    const { preview, previewHash } = boundedRedactedJson(redact(input.value, 0));
+    return {
+        eventType: input.eventType.slice(0, 120),
+        preview,
+        previewHash,
+    };
+}
 export function projectOperationEventSummary(event) {
     const messagePreview = boundedRedactedText(event.message, 600);
     const dataPreview = event.data === undefined
@@ -406,22 +450,27 @@ function dropOneByPriority(ring) {
     return events.shift();
 }
 /**
- * D2 coalescing decision: merge an incoming `message_update` into the ring tail
- * only when the tail is also a same-turn `message_update` and the update landed
- * inside the coalescing window. Structural events close the window implicitly
- * (their presence makes the tail check fail), so an
- * update → tool_call → update sequence never merges across the tool boundary.
+ * D2 coalescing decision: merge high-frequency cumulative text/tool updates
+ * into a matching ring tail inside the coalescing window. Structural events
+ * close the window implicitly (their presence makes the tail check fail).
  * `partial.at` (when present) drives the clock so tests can inject window
  * boundaries deterministically without fake timers.
  */
 function shouldCoalesce(ring, turnId, partial) {
-    if (partial.kind !== "message_update")
-        return false;
     const tail = ring.events.at(-1);
-    if (!tail || tail.kind !== "message_update")
+    if (!tail || tail.kind !== partial.kind)
         return false;
     if (tail.turnId !== turnId)
         return false;
+    if (partial.kind === "tool_update") {
+        const currentId = partial.data.toolCallId;
+        const tailId = tail.data.toolCallId;
+        if (!currentId || currentId !== tailId)
+            return false;
+    }
+    else if (partial.kind !== "message_update") {
+        return false;
+    }
     const nowMs = partial.at ? Date.parse(partial.at) : Date.now();
     if (Number.isNaN(nowMs))
         return false;
@@ -1016,12 +1065,12 @@ export function createChatEventStore(options) {
                 ring.approxBytes += byteHint(live);
             }
             enforceBounds(sessionId, ring);
-            // B5-1: only high-frequency `message_update` appends defer the persist;
+            // B5-1: high-frequency cumulative updates defer the persist;
             // every other kind (message_end / tool_call / error / turn signals …)
             // still persists synchronously. Because persistNow writes the FULL
             // in-memory ring, one flush also lands any earlier pending updates in
             // order — no two-phase flush is needed.
-            if (partial.kind === "message_update") {
+            if (partial.kind === "message_update" || partial.kind === "tool_update") {
                 const atMs = partial.at ? Date.parse(partial.at) : Date.now();
                 if (!Number.isNaN(atMs)) {
                     persistDebounced(sessionId, ring, atMs);
@@ -1074,6 +1123,9 @@ export function createChatEventStore(options) {
         epoch(sessionId) {
             return ringFor(sessionId).epoch;
         },
+        latestSeq(sessionId) {
+            return ringFor(sessionId).nextSeq - 1;
+        },
         snapshot(sessionId) {
             const ring = rings.get(sessionId) ?? loadRing(sessionId);
             if (ring)