@tea-agent/loop-agent 0.44.0-next.12 → 0.44.0-next.13

package/CHANGELOG.md

@@ -4,9 +4,18 @@
 
 ### 新增
 
+- Console Chat 浏览器控制补齐页面 JavaScript、登录态导入导出、带行上下文的元素查找、Markdown 内容抽取和外部窗口人工点选；条件等待可确认文本、元素或网址变化，多个对话保持各自选中的标签页，旧页面快照不会被误用于其他页面。
+- 浏览器截图可指定标签页和完整页面，作为图片发送给支持视觉的模型，并在工具详情中查看保存的截图；不支持视觉或图片过大时明确提示。右侧网页预览明确标注为独立页面，避免与实际受控窗口的登录态、操作混淆。
+- 登录态文件保存在仓库外，默认不把 cookie 值写入工具结果；导入显式合并 cookies/localStorage，保留未列出的现有数据。页面脚本超时后提示等待恢复或关闭该标签页；现有 Chrome 接管和 frontend-test 自动加载登录态仍为后续能力。
+- Operator Chat 的「预览」面板支持图片预览：`.png` / `.jpg` / `.jpeg` / `.gif` / `.webp` / `.bmp` / `.ico` / `.svg` 直接在预览区展示，宽图按面板宽度缩放、超高图纵向滚动；位图不再误走文本解码、不再提示「binary files cannot be previewed」。SVG 可当图查看，也能切回 XML 源码；新窗口打开图片直接展示原图。
+- 无渲染器的二进制容器（zip/mp4/pdf/docx 等常见格式）在预览区显示「此文件类型无法预览」空态说明，不再报错；未知后缀仍按文本读取，含二进制内容时保持明确报错。
+- 前后端测试工作流的产物默认收进统一的运行时目录：后端测试默认写到运行时目录下的测试区，前端浏览器测试默认写到运行时目录下的测试区，不再混入项目根目录生成 `testcase/`；自定义目录仍可继续使用，已有产物不迁移不删除。新目录随运行时目录一起被 Git 忽略，测试运行仍会逐文件对比哈希来证明真实产出，不会因为目录被忽略而误判为“没有写入”；控制器自己的运行记录不受影响。
+- 项目初始化生成的忽略规则新增 `.playwright-cli/`（浏览器测试工具缓存目录），避免工具缓存被误提交；已初始化的项目按统一更新机制刷新，用户自己写的忽略规则保持不变。 5642d882 (feat(test-workflows): 前后端测试产物默认收进运行时目录，init gitignore 增 .playwright-cli/)
 - 前端 DAG 的行为验证不再只认 Vitest：测试框架改为可插拔适配层，首批支持 Vitest、Jest 与 Playwright Test。三类项目都能用**真实报告**证明契约绑定的测试文件确实执行且通过，`npm`/`pnpm`/`yarn` 的常用测试入口走同一套识别逻辑，直接命令与 `package.json` 脚本不会再得出不同结论。
 - 未适配的测试框架（Cypress、`node --test`、Mocha、自定义脚本等）现在明确报「缺少适配能力」，并附上具体命令与原因；此前这类命令会被判为不支持，错误信息还暗示你「必须改用 Vitest」，把工具的能力缺口显示成了用户配置错误。
 - 行为验证保留「测试确实执行过」的校验：零测试、全部跳过、报告缺失、报告过期、契约绑定文件未执行都判失败，不会退回只看退出码（全部跳过的运行退出码是 0）。
+- Console 对话中的浏览器工具支持原生下拉选择、显式勾选/取消，以及按标签页增量读取控制台日志和网络请求状态；诊断记录有容量上限并提示历史缺口，便于定位页面异常、接口失败与弹窗问题，无需打开额外诊断面板。
+- 前端测试随 loop-agent 安装固定版本的 Playwright CLI，无需另装全局 CLI；运行时使用当前 loop-agent 安装的依赖，避免目标项目或 PATH 中的其他版本干扰。依赖缺失或版本不符时明确失败并提示重新安装；浏览器仍需单独准备，不在安装时自动下载。
 
 - main 上的 npm `next` 预发布改为跑默认测试（fast + integration），不再在每次发布时重复跑约 6 分钟的 I/O-heavy 池；完整三池仍由 PR、正式 release 线、本地推送前检查与发布前钩子承担。同时把该预发布任务的 I/O 并发从 1 调到 2，并把 npm 包可见性确认的等待窗口从约 3 分钟拉长到约 10 分钟，避免包已发出却因仓库异步处理未完成而被判失败。
 
@@ -27,7 +36,7 @@
 
 - Console 操作文案改为面向操作者的说明并给出下一步：等待超时不再伪装成「需要核对」，改为提示操作可能仍在后台运行；「源内容已变更」「前端拆分状态被并发修改」等原本直接展示英文原文的错误，改为说明原因与具体处理步骤；恢复页按钮与提示去掉 reconcile / supersede / orphan / Human Gate 等术语。
 
-- Operator Chat 新增对话驱动的真实浏览器自动化：右侧「浏览器」面板同步共享状态，登录态与下载隔离在仓库外；模型可操作同一浏览器完成导航、搜索、结构化快照、元素操作与截图，不读写仓库文件，也不暴露页面脚本执行。
+- Operator Chat 新增对话驱动的真实浏览器自动化：右侧「浏览器」面板同步网址，登录态与下载隔离在仓库外；模型通过外部受控窗口完成导航、搜索、结构化快照、元素操作与截图，页面脚本执行由显式 browser_eval 提供。
 - 模型驱动的共享浏览器默认改为可见外部窗口，并保留右侧预览；地址、搜索与元素操作不再默认生成大截图，搜索逐字填写并提交真实表单，启动时降低自动化指纹；无法嵌入的页面提供外部打开与聚焦入口，同一持久配置可完成站点安全验证。
 - 修复观测页「执行历史」把仍在重试的节点误报为「最终失败」的问题：只要节点最后一个已记录的尝试失败，就会显示「N 次 · 最终失败」，即使该节点仍在运行、重试已经排队，会让人误判运行已结束。现在节点处于运行/已启动/暂停状态时改为「N 次 · 最近一次失败，仍在重试」，真正到达终态才显示「最终失败」；修复轮次的多轮标签同样处理。
 
@@ -141,6 +150,8 @@
 
 ### 改进
 
+- Console「浅色」主题改为 DeepSeek Harness 浅色家族：白底、侧栏冷灰、近黑正文、发送与主操作为 DeepSeek 蓝，用户气泡为淡蓝；默认暖纸和深色主题不变。
+- 对话时间线的「紧凑 / 完整」改为 DSH 文字 Tab：去掉小卡片边框与全局 34px 按钮高度，选中项用品牌色下划线。
 - DAG 运行时内部按职责拆开：模型配置、领域工具、分段会话、模板族、终态判定与检查点各自独立维护，测试也按行为分成可单独调度的文件。命令、任务流程与用户可见结果不变。本机默认测试并行下整池耗时未证实变快。
 - Operator Chat 输入框下方的会话统计对齐 DSH：长串静态文字收敛为两个可点击摘要，可分别查看模型/工具用时、TTFT、TPS 与 Token 分项；详情卡互斥并支持外部点击或 Escape 关闭，窄屏打开时不会推动输入框或消息流。
 - Operator Chat 长会话新增完整轮次轨道与按需历史定位，可从任意用户消息精确新建会话；历史图片刷新后仍可预览，仓库文件链接可直接定位到行，最终回答显示单轮 token/耗时，并支持可持久化的紧凑/完整阅读模式。图片文件与消息记录分离保存，删除、分叉和失败回滚会同步清理，附件读取重新校验类型与引用。
@@ -154,7 +165,9 @@
 
 ### 修复
 
-- 前端 DAG 的验证失败不再把配置问题算到业务代码头上：报告缺失或过期、报告协议错误、命令或脚本哈希漂移、框架未适配都归为验证配置问题，不再触发一轮无意义的实现重写；测试断言失败仍归实现问题。
+- Console Chat 的浏览器搜索工具在更多真实站点上可用：现代搜索框（`textarea`、`role=searchbox`、`name=search`）不再报“找不到搜索框”；对只在页面内更新结果、不发生跳转的搜索表单也不会超时失败；提交时只在搜索框所属表单内查找提交按钮，不再误点页面上无关的按钮导致“已输入但未提交”。
+- 浏览器导航在页面于加载完成后才发生跳转（如搜索引擎跳转到区域站点）时，不再把后续操作带入上一页；跳转后会等待短暂稳定再返回。
+- 浏览器搜索的默认搜索引擎改为 Bing（可从参数改写）。此前默认的百度对自动化已不可用（新版为文本框加验证码），模型不指定引擎时搜索会直接失败。
 - 已经自带 `--reporter`/`--outputFile` 的测试命令或脚本不会被悄悄覆盖；无法安全注入报告参数时在生成阶段直接报错，要求改用可注入的入口。
 - 修复 Playwright 项目在 Review 阶段被误判失败的问题：审查重读报告时没有带上协议，仍按 Vitest 解析，导致 Playwright 报告因缺少 `testResults` 报错，即使执行与 trace 已经通过。report 引用现在记录协议，review 按同一协议解析并校验一致性。
 - 修复 Playwright 报告路径按 `testDir` 解析错误的问题：报告中的文件路径相对 Playwright 自身的 `config.rootDir`，此前按进程 cwd 解析，配了 `testDir: "./tests"` 的项目会得到 `orders.spec.js` 而非 `tests/orders.spec.js`，契约目标永远无法匹配。

package/dist/build-stamp.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "version": "0.44.0-next.12",
-  "gitSha": "91181001a8cbed75a00a8a6d8e76ae5fab889b36",
-  "builtAt": "2026-09-17T10:04:11.141Z"
+  "version": "0.44.0-next.13",
+  "gitSha": "03e91c507b0ab0f87e6dd376bb7bb735b8e5590e",
+  "builtAt": "2026-09-18T01:29:28.992Z"
 }

package/dist/commands/init.js

@@ -872,6 +872,7 @@ export function buildManagedGitignoreBlock(governanceRoot = DEFAULT_GOVERNANCE_R
         GITIGNORE_BLOCK_START,
         "# loop-agent init surface: rebuildable outputs; AGENTS.md and README.md stay shared",
         ".harness/",
+        ".playwright-cli/",
         ".agents/",
         ".task-pool/",
         ".worktrees/",

package/dist/executors/dag-pi-executor.js

@@ -38,7 +38,7 @@ import { isTargetTemplateTransientRetryNode, isWriterEmptyDiffRetryCandidate, is
 import { assessBackendTestMdPlanCompleteness, assessBackendTestMdWriterCompleteness, assessBackendTestPytestPlanCompleteness, assessBackendTestPytestWriterCompleteness, assessBackendTestShardChildCompleteness, backendTestWriterProgressRoleForTask, classifyBackendTestWriterCompletenessFailure, isBackendTestCompletenessRetryCandidate, isBackendTestMdPlanTask, isBackendTestPytestCollectionRepairOutcomeRecoveryCandidate, isBackendTestPytestPlanTask, isBackendTestShardChildTask, writeBackendTestWriterProgressArtifacts, } from "../workflows/dag/backend-test-writer-completeness.js";
 import { resolveBackendTestLayout } from "../workflows/dag/backend-test-layout.js";
 import { assessBackendTestPlanProtocol } from "../workflows/dag/backend-test-plan-protocol.js";
-import { frontendTestLayoutFromSpec } from "../workflows/dag/frontend-test-layout.js";
+import { frontendTestContextRel, frontendTestLayoutFromSpec, } from "../workflows/dag/frontend-test-layout.js";
 import { redactSecrets, truncateUtf8Preview } from "../shared/preview.js";
 import { writeEffectiveContextReceipt } from "../workflows/dag/context-receipt.js";
 import { estimateFrontendPlanRequirementRecordCalls, isWriterThinkingExhausted, readWriterThinkingExhaustionEvidence, WRITER_BUDGET_EXHAUSTED_CATEGORY, WRITER_TOKEN_BUDGET, FRONTEND_PLAN_COVERAGE_MAX_CONCURRENCY, mapWithConcurrency, buildFrontendPlanWorkload, loadOrCreateFrontendPlanCoverageLayout, collectFrontendVerificationCommandFiles, aggregateParallelPiResults, combineSequentialPiResults, runFrontendScoutParallelSessions, runFrontendContractSegmentedSessions, runFrontendPlanSegmentedSessions, runFrontendReviewSegmentedSessions, runFrontendScoutSegmentedSessions, } from "./dag-pi/sessions/index.js";
@@ -1552,7 +1552,7 @@ async function writePiExtensionsArtifact(nodeArtifactsDir, requested, resolved,
         // best-effort run fact; node execution continues
     }
 }
-async function resolveValidatedFrontendBaseUrlFromContext(workspaceRoot, runDir) {
+async function resolveValidatedFrontendBaseUrlFromContext(workspaceRoot, runDir, layout) {
     try {
         const capability = JSON.parse(await readFile(path.join(runDir, "preflight-frontend-browser-tool-shell", "frontend-browser-capability.json"), "utf8"));
         if (capability.status !== "ready" ||
@@ -1563,7 +1563,7 @@ async function resolveValidatedFrontendBaseUrlFromContext(workspaceRoot, runDir)
     catch {
         throw new Error("browser-command-capability-unavailable: missing or invalid frontend browser capability artifact");
     }
-    const contextPath = path.join(workspaceRoot, "testcase", "frontend", "rag", "context.md");
+    const contextPath = path.join(workspaceRoot, ...frontendTestContextRel(layout).split("/"));
     let markdown;
     try {
         markdown = await readFile(contextPath, "utf8");
@@ -1759,8 +1759,13 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
     let beforeStatus;
     let beforeWorkspaceSnapshot;
     let beforePathFingerprints;
-    /** tools-only and filesystem-only keep the tool sandbox but skip Git baseline. */
-    const filesystemOnly = isWriteTask && meta.spec.backendTestWorkspaceControl === "filesystem-only";
+    /** tools-only and filesystem-only keep the tool sandbox but skip Git baseline.
+     * filesystem-only applies when the node froze it in writeGuardPolicy (D4:
+     * any dedicated test writer under an ignored root) OR the backend-test spec
+     * explicitly selected workspaceControl=filesystem-only. */
+    const filesystemOnly = isWriteTask &&
+        (input.task.writeGuardPolicy === "filesystem-only" ||
+            meta.spec.backendTestWorkspaceControl === "filesystem-only");
     const skipGitWriteGuard = isWriteTask && (input.task.writeGuardPolicy === "tools-only" || filesystemOnly);
     if (isWriteTask && filesystemOnly) {
         try {
@@ -1880,7 +1885,7 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
                             nodeId: input.task.id,
                             caseId,
                             evidenceDir,
-                            baseUrl: await resolveValidatedFrontendBaseUrlFromContext(input.cwd, meta.runDir),
+                            baseUrl: await resolveValidatedFrontendBaseUrlFromContext(input.cwd, meta.runDir, layout),
                             inputRoot: layout.fixturesDir,
                             layout,
                         };

package/dist/executors/pi-writer-tool-policy.js

@@ -1,6 +1,7 @@
 import { access as fsAccess, lstat, mkdir as fsMkdir, readFile as fsReadFile, realpath, writeFile as fsWriteFile, } from "node:fs/promises";
 import path from "node:path";
 import { pathMatchesPattern } from "../shared/git-progress.js";
+import { isAnyTestArtifactPath, isHarnessBaselineForbiddenPattern, } from "../workflows/dag/test-artifact-namespace.js";
 export class PiWriterPathDeniedError extends Error {
     code;
     targetPath;
@@ -105,12 +106,60 @@ function repoRelativePath(root, absoluteTarget, raw, allowRoot) {
     }
     return relative;
 }
+/**
+ * D3 test-artifact exception at the tool layer: a write target inside the
+ * canonical `.harness/testcase` namespace that the task's exclusive writeSet
+ * (or, for mkdir, a writeSet entry at/above it) explicitly owns is exempt
+ * from the BASELINE harness guard patterns (`.harness` / `.harness/**`) only.
+ * Explicit deeper forbidden patterns and the hard controller-facts guard stay
+ * authoritative, matching the DAG validator and the post-hoc write guard.
+ */
+function testArtifactWriteExempt(relative, ctx) {
+    const forbidden = ctx.forbiddenPaths ?? [];
+    let baselineHit = false;
+    for (const pattern of forbidden) {
+        if (!matchesAnyPattern(relative, [pattern]))
+            continue;
+        if (!isHarnessBaselineForbiddenPattern(pattern))
+            return false;
+        baselineHit = true;
+    }
+    if (!baselineHit)
+        return false;
+    if (!isAnyTestArtifactPath(relative))
+        return false;
+    const writeSet = ctx.writeSet ?? [];
+    if ((ctx.writePolicy ?? "exclusive") === "exclusive") {
+        return matchesAnyPattern(relative, writeSet);
+    }
+    return writeSet.length === 0 || matchesAnyPattern(relative, writeSet);
+}
+function testArtifactMkdirExempt(relative, ctx) {
+    const forbidden = ctx.forbiddenPaths ?? [];
+    let baselineHit = false;
+    for (const pattern of forbidden) {
+        if (!pathMatchesPattern(relative, pattern))
+            continue;
+        if (!isHarnessBaselineForbiddenPattern(pattern))
+            return false;
+        baselineHit = true;
+    }
+    if (!baselineHit)
+        return false;
+    if (!isAnyTestArtifactPath(relative))
+        return false;
+    const writeSet = (ctx.writeSet ?? []).map(normalizeRepoRelative);
+    return writeSet.some((candidate) => isPathAtOrBelowDirectory(candidate, relative) ||
+        (relative.length > 0 && pathMatchesPattern(relative, candidate)));
+}
 function assertWritableRelative(relative, ctx) {
     if (isHardForbidden(relative)) {
         throw new PiWriterPathDeniedError("hard-forbidden", relative, "writes under .harness/tasks/** or .harness/dag-runs/** are never allowed for Pi writers");
     }
     const forbidden = ctx.forbiddenPaths ?? [];
-    if (forbidden.length > 0 && matchesAnyPattern(relative, forbidden)) {
+    if (forbidden.length > 0 &&
+        matchesAnyPattern(relative, forbidden) &&
+        !testArtifactWriteExempt(relative, ctx)) {
         throw new PiWriterPathDeniedError("forbidden", relative);
     }
     const writeSet = ctx.writeSet ?? [];
@@ -130,7 +179,8 @@ function assertMkdirRelative(relative, ctx) {
     const forbidden = ctx.forbiddenPaths ?? [];
     if (relative &&
         forbidden.length > 0 &&
-        matchesAnyPattern(relative, forbidden)) {
+        matchesAnyPattern(relative, forbidden) &&
+        !testArtifactMkdirExempt(relative, ctx)) {
         throw new PiWriterPathDeniedError("forbidden", relative);
     }
     const writeSetCandidates = (ctx.writeSet ?? [])
@@ -149,8 +199,14 @@ function assertMkdirRelative(relative, ctx) {
     if (nonHardForbiddenCandidates.length === 0) {
         throw new PiWriterPathDeniedError("hard-forbidden", relative || ".");
     }
-    if (forbidden.length > 0 &&
-        nonHardForbiddenCandidates.every((candidate) => matchesAnyPattern(candidate, forbidden))) {
+    // D3 test-artifact exception: when the target directory is a canonical
+    // namespace root owned by the writeSet, baseline harness guard patterns do
+    // not disqualify allowedPaths candidates either.
+    const effectiveForbidden = testArtifactMkdirExempt(relative, ctx)
+        ? forbidden.filter((pattern) => !isHarnessBaselineForbiddenPattern(pattern))
+        : forbidden;
+    if (effectiveForbidden.length > 0 &&
+        nonHardForbiddenCandidates.every((candidate) => matchesAnyPattern(candidate, effectiveForbidden))) {
         throw new PiWriterPathDeniedError("forbidden", relative || ".");
     }
 }

package/dist/executors/playwright-cli-launcher.js

@@ -1,57 +1,43 @@
-import { existsSync, readFileSync } from "node:fs";
+import { readFileSync, realpathSync, statSync } from "node:fs";
 import path from "node:path";
 import { createRequire } from "node:module";
 const PACKAGE_NAME = "@playwright/cli";
+const PACKAGE_VERSION = "0.1.20";
 function launcherFromManifest(manifestPath) {
-    try {
-        const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
-        if (manifest.name !== PACKAGE_NAME)
-            return undefined;
-        const bin = typeof manifest.bin === "string"
-            ? manifest.bin
-            : manifest.bin && typeof manifest.bin === "object"
-                ? manifest.bin["playwright-cli"]
-                : undefined;
-        if (typeof bin !== "string" || !bin || path.isAbsolute(bin) || bin.split(/[\\/]+/).includes(".."))
-            return undefined;
-        const packageRoot = path.dirname(manifestPath);
-        const entryPath = path.resolve(packageRoot, bin);
-        const relative = path.relative(packageRoot, entryPath);
-        if (relative.startsWith("..") || path.isAbsolute(relative) || !existsSync(entryPath))
-            return undefined;
-        return { executable: process.execPath, argvPrefix: [entryPath], entryPath };
-    }
-    catch {
+    const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+    if (manifest.name !== PACKAGE_NAME)
         return undefined;
+    if (manifest.version !== PACKAGE_VERSION) {
+        throw new Error(`expected ${PACKAGE_NAME}@${PACKAGE_VERSION}, found ${String(manifest.version)}`);
     }
+    const bin = typeof manifest.bin === "string"
+        ? manifest.bin
+        : manifest.bin && typeof manifest.bin === "object"
+            ? manifest.bin["playwright-cli"]
+            : undefined;
+    if (typeof bin !== "string" || !bin || path.isAbsolute(bin) || path.win32.isAbsolute(bin) || bin.split(/[\\/]+/).includes(".."))
+        return undefined;
+    if (!/\.(?:c|m)?js$/i.test(bin))
+        return undefined;
+    const packageRoot = realpathSync(path.dirname(manifestPath));
+    const entryPath = realpathSync(path.resolve(packageRoot, bin));
+    const relative = path.relative(packageRoot, entryPath);
+    if (relative.startsWith("..") || path.isAbsolute(relative) || !statSync(entryPath).isFile())
+        return undefined;
+    return { executable: process.execPath, argvPrefix: [entryPath], entryPath };
 }
-function candidateManifestPaths(cwd) {
-    const paths = new Set();
-    for (const root of [cwd, process.cwd()]) {
-        try {
-            paths.add(createRequire(path.join(path.resolve(root), "package.json")).resolve(`${PACKAGE_NAME}/package.json`));
-        }
-        catch {
-            // Keep searching controller-known module roots.
-        }
-    }
-    // Npm's Windows/global shim is paired with node_modules in either the shim
-    // directory or its parent (.bin). We read package metadata directly; the
-    // .cmd file itself is never executed or parsed as a command string.
-    for (const binDir of (process.env.PATH ?? "").split(path.delimiter).filter(Boolean)) {
-        paths.add(path.join(binDir, "node_modules", ...PACKAGE_NAME.split("/"), "package.json"));
-        paths.add(path.join(binDir, "..", ...PACKAGE_NAME.split("/"), "package.json"));
-    }
-    return [...paths];
-}
-/** Resolve only a package-declared entry; throws instead of falling back to a PATH executable. */
-export function resolvePlaywrightCliLauncher(cwd) {
-    for (const manifestPath of candidateManifestPaths(cwd)) {
+/** Resolve from this installation, independently of the target project's cwd/PATH. */
+export function resolvePlaywrightCliLauncher(_cwd) {
+    try {
+        const manifestPath = createRequire(import.meta.url).resolve(`${PACKAGE_NAME}/package.json`);
         const launcher = launcherFromManifest(manifestPath);
-        if (launcher)
-            return launcher;
+        if (!launcher)
+            throw new Error("invalid package manifest or JavaScript entry");
+        return launcher;
+    }
+    catch (error) {
+        throw new Error(`playwright-cli-unavailable: bundled ${PACKAGE_NAME} installation is missing or invalid; reinstall loop-agent. ${error instanceof Error ? error.message : String(error)}`);
     }
-    throw new Error("playwright-cli-unavailable: verified @playwright/cli JavaScript entry was not found");
 }
 export function checkPlaywrightCliLauncher(cwd) {
     try {

package/dist/executors/shell-write-guard.js

@@ -1,11 +1,11 @@
-import { spawn } from "node:child_process";
 import { createHash } from "node:crypto";
-import { constants, createReadStream } from "node:fs";
-import { access, lstat, readlink, unlink } from "node:fs/promises";
+import { createReadStream } from "node:fs";
+import { lstat, readlink, unlink } from "node:fs/promises";
 import path from "node:path";
 import { pathMatchesPattern } from "../shared/git-progress.js";
 import { expandWorkspaceStatus, hasGitmodulesFile, synthesizeExpandedPorcelain, } from "../shared/git-workspace-status.js";
 import { ResilientGitCommandError, runResilientGitCommand, } from "../shared/resilient-git.js";
+import { isAnyTestArtifactPath, isHarnessBaselineForbiddenPattern, } from "../workflows/dag/test-artifact-namespace.js";
 async function sha256File(filePath) {
     const hash = createHash("sha256");
     for await (const chunk of createReadStream(filePath)) {
@@ -149,7 +149,27 @@ export function validateShellWriteGuard(input) {
             continue;
         }
         if (matchesAnyPattern(filePath, forbiddenPaths)) {
-            violations.push(filePath);
+            // D3 test-artifact exception: a changed file inside the canonical
+            // `.harness/testcase` namespace that the task's exclusive writeSet
+            // explicitly owns is exempt from the BASELINE harness guard patterns
+            // (`.harness` / `.harness/**`) only — spec-level validation gates such
+            // writeSets behind a frozen dedicated-test layout. Any explicit
+            // (deeper or out-of-tree) matching forbidden pattern still wins.
+            const baselinePatternHit = forbiddenPaths.some((forbidden) => isHarnessBaselineForbiddenPattern(forbidden) &&
+                pathMatchesPattern(filePath, forbidden));
+            const explicitPatternHit = forbiddenPaths.some((forbidden) => !isHarnessBaselineForbiddenPattern(forbidden) &&
+                pathMatchesPattern(filePath, forbidden));
+            const ownedByWriteSet = writePolicy === "exclusive" &&
+                writeSet.length > 0 &&
+                matchesAnyPattern(filePath, writeSet);
+            if (explicitPatternHit ||
+                !baselinePatternHit ||
+                !isAnyTestArtifactPath(filePath) ||
+                !ownedByWriteSet) {
+                violations.push(filePath);
+                continue;
+            }
+            // Exempted: canonical test-artifact file owned by the writeSet.
             continue;
         }
         if (writePolicy === "read-only" || writePolicy === "none") {
@@ -380,37 +400,6 @@ export function deriveSameInstallationGitCandidates(primary) {
     }
     return Array.from(new Set([normalized, ...(fallback ? [fallback] : [])]));
 }
-async function resolveGitExecutableCandidates(platform, env) {
-    if (platform !== "win32")
-        return ["git"];
-    const pathValue = env.PATH ?? env.Path ?? "";
-    for (const rawEntry of pathValue.split(path.delimiter)) {
-        const entry = rawEntry.trim().replace(/^"|"$/g, "");
-        if (!entry)
-            continue;
-        const candidate = path.win32.join(entry, "git.exe");
-        try {
-            await access(candidate, constants.X_OK);
-            const sameInstallation = deriveSameInstallationGitCandidates(candidate);
-            const existing = [];
-            for (const executable of sameInstallation) {
-                try {
-                    await access(executable, constants.X_OK);
-                    existing.push(executable);
-                }
-                catch {
-                    // Optional same-installation fallback is absent.
-                }
-            }
-            if (existing.length > 0)
-                return existing;
-        }
-        catch {
-            // Keep searching PATH entries.
-        }
-    }
-    return ["git"];
-}
 export async function readGitStatusPorcelain(cwd, options = {}) {
     let parentPorcelain;
     try {
@@ -510,38 +499,6 @@ export async function readGitStatusPorcelainWithDependencies(cwd, options, depen
         attempts: attemptDiagnostics,
     });
 }
-function readGitStatusPorcelainOnce(cwd, executable) {
-    return new Promise((resolve, reject) => {
-        const child = spawn(executable, ["status", "--porcelain=v1", "--untracked-files=all"], {
-            cwd,
-            env: { ...process.env, GIT_OPTIONAL_LOCKS: "0" },
-            stdio: ["ignore", "pipe", "pipe"],
-            windowsHide: true,
-        });
-        let stdout = "";
-        let stderr = "";
-        child.stdout.setEncoding("utf-8");
-        child.stderr.setEncoding("utf-8");
-        child.stdout.on("data", (chunk) => {
-            stdout += chunk;
-        });
-        child.stderr.on("data", (chunk) => {
-            stderr += chunk;
-        });
-        child.on("error", reject);
-        child.on("close", (code, signal) => {
-            if (code === 0) {
-                resolve(stdout);
-                return;
-            }
-            const detail = stderr.trim() || stdout.trim() || "no stderr/stdout";
-            const error = new Error(`git status failed: ${detail}`);
-            error.exitCode = code;
-            error.signal = signal;
-            reject(error);
-        });
-    });
-}
 export async function runPostRunWriteGuard(input) {
     const afterStatus = await readGitStatusPorcelain(input.rootCwd);
     const beforeSnapshot = snapshotGitStatusPorcelain(input.beforeStatus);

package/dist/governance/exec-plans.js

@@ -191,12 +191,21 @@ function extractIndexReferences(indexContent) {
         // `(${base})` and `` `base` ``. Bare mentions are intentionally NOT
         // treated as references to avoid false positives from partial matches.
         const linkMatches = [...line.matchAll(/\[[^\]]*\]\(([^)]+\.md)\)/g)];
+        // Link spans are blanked before the backtick scan: the index convention
+        // `[`archived.md`](../completed/archived.md)` puts a bare basename in the
+        // link TEXT, which is not an entry for this directory. Reading it as one
+        // reported every archived link as a stale active entry. Blanking (rather
+        // than filtering by content) keeps `[`local.md`](local.md)`, standalone
+        // `local.md` mentions, and mixed lines working, because those still
+        // contribute through their link target or an untouched backtick span.
+        let remainder = line;
         for (const match of linkMatches) {
             const reference = match[1] ? localIndexReference(match[1]) : null;
             if (reference)
                 references.add(reference);
+            remainder = remainder.replace(match[0], " ".repeat(match[0].length));
         }
-        const backtickMatches = [...line.matchAll(/`([^`]+\.md)`/g)];
+        const backtickMatches = [...remainder.matchAll(/`([^`]+\.md)`/g)];
         for (const match of backtickMatches) {
             const reference = match[1] ? localIndexReference(match[1]) : null;
             if (reference)

package/dist/task/config-types.js

@@ -126,7 +126,8 @@ export const frontendOpenspecConfigSchema = z.object({
 export const frontendTestConfigSchema = z.object({
     /**
      * Repository-relative frontend-test artifact root.
-     * Default "testcase/frontend". Semantic validation lives in
+     * Default ".harness/testcase/frontend" (canonical harness test-artifact
+     * namespace). Semantic validation lives in
      * resolveFrontendTestLayout (fail-closed), not in this schema.
      */
     testRoot: z.string().min(1).optional(),
@@ -239,7 +240,8 @@ const backendTestModuleLayoutSchema = z
 /** Backend-test artifact layout and pipeline mode configuration (plan A/B/D). */
 export const backendTestConfigSchema = z
     .object({
-    /** Repository-relative test root. Default "testcase". */
+    /** Repository-relative test root. Default ".harness/testcase" (canonical
+     * harness test-artifact namespace). */
     testRoot: z.string().min(1).optional(),
     /** Markdown subdirectory relative to testRoot. Default "md". */
     markdownRel: z.string().min(1).optional(),

package/dist/task/source-prepare/build-draft.js

@@ -233,6 +233,7 @@ export function buildPrepareDraft(input) {
         allowedPaths,
         forbiddenPaths: finalForbidden,
         noDefaultForbiddenPaths: flags.noDefaultForbiddenPaths,
+        taskKind,
     });
     const draft = {
         schemaVersion: TASK_CONTRACT_DRAFT_SCHEMA_VERSION,

package/dist/task/source-prepare/path-policy.js

@@ -1,5 +1,6 @@
 import { canonicalizePath } from "../contract/canonicalize.js";
 import { PREPARE_DEFAULT_FORBIDDEN_PATHS } from "./types.js";
+import { isAnyTestArtifactPath, isTestArtifactTaskKind, } from "../../workflows/dag/test-artifact-namespace.js";
 function hasNul(value) {
     return value.includes("\0");
 }
@@ -133,6 +134,7 @@ export function assessPreparePaths(input) {
         forbidden.push(result.value);
     }
     const allowedSet = new Set(allowed);
+    const testArtifactTaskKind = isTestArtifactTaskKind(input.taskKind);
     for (const f of forbidden) {
         if (allowedSet.has(f)) {
             blocking.push({
@@ -145,14 +147,22 @@ export function assessPreparePaths(input) {
     }
     for (const a of allowed) {
         for (const f of forbidden) {
-            if (forbiddenAncestorCoversAllowed(a, f)) {
-                blocking.push({
-                    code: "ALLOWED_UNDER_FORBIDDEN_ANCESTOR",
-                    level: "blocking",
-                    message: `allowed path ${a} is fully covered by forbidden ancestor ${f}`,
-                    path: a,
-                });
+            if (!forbiddenAncestorCoversAllowed(a, f))
+                continue;
+            // D3 test-artifact exception: a dedicated test task may allow exactly
+            // the canonical `.harness/testcase` roots under the default `.harness/**`
+            // forbidden ancestor; every other overlap stays blocking.
+            if (testArtifactTaskKind &&
+                f === ".harness/**" &&
+                isAnyTestArtifactPath(a)) {
+                continue;
             }
+            blocking.push({
+                code: "ALLOWED_UNDER_FORBIDDEN_ANCESTOR",
+                level: "blocking",
+                message: `allowed path ${a} is fully covered by forbidden ancestor ${f}`,
+                path: a,
+            });
         }
     }
     for (const a of allowed) {