@dtlabs/ai-toolkit 0.24.2 → 0.24.4

package/CHANGELOG.md

@@ -1,4 +1,20 @@
 ## 0.1.4 (2026-07-21)
+## [0.24.4](https://github.com/dtlab-tech/ai-toolkit/compare/v0.24.3...v0.24.4) (2026-10-27)
+
+
+### Bug Fixes
+
+* **pm-phase2:** regenerate a task whose Estimate is stale, not just missing verification commands ([a772767](https://github.com/dtlab-tech/ai-toolkit/commit/a772767a9d960bfe468829651e7ca2cbc7c6a17e))
+* regenerate a task whose Estimate is stale, not just missing verification commands ([e9d794b](https://github.com/dtlab-tech/ai-toolkit/commit/e9d794b81575c49e95d0291174964058fafd009b))
+
+## [0.24.3](https://github.com/dtlab-tech/ai-toolkit/compare/v0.24.2...v0.24.3) (2026-10-27)
+
+
+### Bug Fixes
+
+* don't fail a worker call over a read-only permission denial ([1b4c521](https://github.com/dtlab-tech/ai-toolkit/commit/1b4c5217b42e9c9dcb74c9bbe60f209522644f9c))
+* **workflow-control:** don't fail a worker call over a read-only permission denial ([fb283c6](https://github.com/dtlab-tech/ai-toolkit/commit/fb283c6a0f44f56d0ca152bcf84bf81c1ca10125))
+
 ## [0.24.2](https://github.com/dtlab-tech/ai-toolkit/compare/v0.24.1...v0.24.2) (2026-10-26)
 
 

package/lib/workflow-control.js

@@ -230,10 +230,27 @@ function createControl(options) {
       tokenLedger.push({ agent: identity.nativeName, model: definition.model,
         phase_delta_tokens: measuredTokens, usage: result.result?.usage || null, evidence_path: evidence.file });
       evidence.save({ response: result, attempts });
+      // A denial on a read-only tool (Read/Glob/Grep) means the agent couldn't fetch some EXTRA
+      // context — a real, recurring pattern where a path the model constructs itself (e.g. a
+      // single leading backslash with no drive letter) resolves outside the project directory
+      // and is correctly denied. Confirmed via production evidence twice, on two different
+      // paths: the agent recovers and still produces a complete, structurally valid result, which
+      // this unconditional check threw away anyway, wasting the entire call and forcing a resume.
+      // Any OTHER tool (Write/Edit/Bash/...) stays an immediate, unconditional failure — a denial
+      // there is a near-miss on a real side effect, not a missed read, and must never be silently
+      // tolerated regardless of what the rest of the response looks like.
+      const READ_ONLY_DENIAL_TOOLS = new Set(['Read', 'Glob', 'Grep'])
       const denials = result.result?.permission_denials;
       if (Array.isArray(denials) && denials.length) {
-        const tools = [...new Set(denials.map(d => d.tool_name || 'unknown'))].join(', ');
-        throw new Error('Worker permission denied: ' + id + '; tools: ' + tools);
+        const nonReadOnly = denials.filter(d => !READ_ONLY_DENIAL_TOOLS.has(d.tool_name));
+        if (nonReadOnly.length) {
+          const tools = [...new Set(nonReadOnly.map(d => d.tool_name || 'unknown'))].join(', ');
+          throw new Error('Worker permission denied: ' + id + '; tools: ' + tools);
+        }
+        // Read-only denial(s) only: fall through to the normal result-validity checks below —
+        // an agent that actually proceeded with missing context will still fail there (a bad
+        // exitCode/is_error, or the caller's own downstream structural validation), the same way
+        // it would if no denial had ever happened.
       }
       if (result.exitCode !== 0 || result.parseError || result.timedOut ||
           !result.result || result.result.is_error !== false) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dtlabs/ai-toolkit",
-  "version": "0.24.2",
+  "version": "0.24.4",
   "description": "AI Toolkit — reusable agents and procedures for developers to build AI-powered applications.",
   "files": [
     "docs/",

package/src/claude/workflows/pm-phase2.js

@@ -440,6 +440,21 @@ function hasVerificationCommands(content) {
   return FENCE_RE_LOCAL.test(verifPart)
 }
 
+// Same resume-validity role as hasVerificationCommands, for the OTHER field this agent's own
+// prompt once asked it to merely restate (removed from "already given" wording in a prior fix —
+// see gaia-generate-work-breakdown-task.md's own Estimate section) but which a task file
+// generated BEFORE that fix can still carry as a literal "—" or explanatory prose instead of a
+// number: wbs-assembler.js's own _numberOrNull throws on exactly that shape at assembly time,
+// well after the dispatch loop below would have skipped regenerating it. A task file whose
+// Estimate fields are not both plain integers is treated the same as one with zero verification
+// commands — regenerated, not skipped forever — so a stale pre-fix file self-heals on the very
+// next resume instead of requiring a hand-fix or a one-off repair script.
+function hasValidEstimate(content) {
+  const minutes = content.match(/^- \*\*Estimate — agent minutes:\*\*\s*(.*)$/m)
+  const tokens = content.match(/^- \*\*Estimate — tokens:\*\*\s*(.*)$/m)
+  return !!minutes && !!tokens && /^\d+$/.test(minutes[1].trim()) && /^\d+$/.test(tokens[1].trim())
+}
+
 // Compact prompt for the per-task detail-generation worker: this task's own skeleton entry,
 // a sibling task list (id + title + outcome only, for duplicate-implementation awareness), and
 // the Tech-Spec excerpt (FTR-026: already pre-sliced to this task's own relevant component(s) by
@@ -637,7 +652,10 @@ return c.run(meta.name, featureDir, prefix, async () => {
     for (const taskId of phase.taskIds) {
       const task = index.tasks[taskId]
       const detailPath = `${wbsDir}/${task.detailFile}`
-      if (task.status === 'generated' && c.exists(detailPath) && hasVerificationCommands(c.read(detailPath))) continue // resume: skip, no dispatch
+      if (task.status === 'generated' && c.exists(detailPath)) {
+        const existing = c.read(detailPath)
+        if (hasVerificationCommands(existing) && hasValidEstimate(existing)) continue // resume: skip, no dispatch
+      }
       const techSpecExcerpt = hasSpec
         ? buildTaskTechSpecExcerpt(components, task, specDir, c.read(specIndexPath))
         : c.read(file('Tech-Spec.md')) // legacy fallback: unchanged, full text