@lazyingart/agintiflow 0.20.178 → 0.20.182

package/docs/autonomous-artifact-pipelines.md

@@ -11,6 +11,7 @@ Each pipeline should create these project-local files or equivalents:
 - Task manifest: stable chunk IDs, source locations, dependencies, prompt/schema version, and output paths.
 - Schema and validator: the exact artifact shape plus semantic checks that define a promotable output.
 - Runners: writer, reviewer, repairer, monitor, merge, compile/export, and status commands.
+- Freshness markers: run IDs, heartbeats, log/status timestamps, and tmux markers that separate a current run from old scrollback.
 - Completion report: counts, first missing ID, failed/quarantined items, latest previews, final artifact paths, and resume commands.
 
 The target repository owns its schemas, prompts, chunk policy, and rendering code. AgInTiFlow owns the behavior: inspect, create missing scripts, run observable sessions, preserve valid work, validate, repair, compile, and report evidence.
@@ -27,10 +28,12 @@ The repairer runs independently of the writer. It can wake from status files, ha
 
 The monitor is gentle. It waits through healthy progress and provider limits, restarts only on hard evidence of stall or crash, and records each decision.
 
+When the monitor restarts a tmux worker, it should require a fresh run marker or updated heartbeat before judging the new run. Capturing a pane immediately after restart can include old failures; those lines are history unless they occur after the current marker or current log timestamp.
+
 ## Concurrency
 
 Parallelism is optional. When used, each worker needs deterministic shard ownership, separate logs, atomic writes, and no direct compile responsibility. Merge, promotion, compilation, publishing, and commits should be serialized unless the project already has a safe coordinator.
 
 ## Completion
 
-A run is complete only when the final artifact was built from the current manifest and the status report shows full coverage or intentional quarantine. A successful tmux pane, a page count, or a single preview file is not enough.
+A run is complete only when the final artifact was built from the current manifest and the status report shows full coverage or intentional quarantine. A successful tmux pane, stale scrollback, a page count, or a single preview file is not enough.

package/docs/runtime-modes-and-autonomy.md

@@ -138,6 +138,22 @@ aginti "start a tmux session named demo, run ls in it, keep it open, and tell me
 
 The agent should use `tmux_start_session`, `tmux_send_keys`, and `tmux_capture_pane`, not Docker `run_command`. In Docker sandbox mode, tmux commands must stay inside the project. In host mode, tmux command text is still governed by host shell policy; if a tmux command is blocked, present the suggested rerun path instead of trying tmux as a workaround. For trusted whole-host tmux work, use the host recipe above.
 
+Long download or long command:
+
+```bash
+aginti "download this large zip with wget -c, verify the final byte count, and do not burn model steps polling it"
+```
+
+The agent should use `start_long_job` once instead of repeatedly calling `wait`, `run_command`, or `tmux_capture_pane`. The tool creates `.aginti/long-jobs/<job-id>/status.json`, stdout/stderr logs, a supervisor log, and an optional status card. For resumable downloads, the agent should first determine `Content-Length` when practical, then call `start_long_job` with:
+
+- `command`: a resumable transfer such as `wget -c URL -O file.zip`
+- `expectedOutputPath`: the downloaded file
+- `expectedSizeBytes`: the expected byte count
+- `verifyCommand`: a deterministic check such as `unzip -t file.zip` or `sha256sum -c`
+- `restartOnFailure`: `true` when the transfer command is safe to resume
+
+After `start_long_job` succeeds, the model loop should finish with the job id and status path. Later status checks should use `long_job_status` or direct shell inspection of the status JSON. This keeps multi-hour I/O under a shell supervisor instead of consuming model tokens and step budget.
+
 ## Future Persistent Container Mode
 
 A useful next runtime mode is a service container:

package/docs/self-healing-pipelines.md

@@ -14,10 +14,12 @@ Concurrency is a tool, not a product stance. AgInTiFlow should choose sequential
 
 Review and repair are separate from writing. A reviewer should detect missing source units, repeated filler, malformed structured data, source drift, and known quality failures, then produce candidate repairs or failed-only requests. A repairer should be able to run independently of the writer, wake from status files, run bounded passes, and exit without blocking healthy progress.
 
+Tmux evidence must be fresh. Tmux panes preserve old scrollback, so after a restart the agent should emit a unique run marker into the pane and durable log/status file, then verify output after that marker. If no marker exists, it must compare log mtimes, process PID/elapsed time, and status timestamps before claiming the current run is healthy. Old failures in scrollback are useful history, not proof that the restarted worker is still failing.
+
 ## Boundaries
 
 AgInTiFlow should not embed project-specific schemas in its core. A book writer, data pipeline, or build system owns its own validators and artifact layout. AgInTiFlow provides the reusable behavior: diagnose, preserve valid work, patch the local workflow, verify, build checkpoint artifacts, restart only affected sessions, and report exact resume commands.
 
 ## Verification
 
-After a repair, the agent should run syntax checks for changed scripts, perform a dry-run or bounded batch when safe, inspect counters and first-missing IDs, and keep unrelated tmux sessions running. If the same symptom repeats, the agent should improve the project workflow or a reusable AgInTiFlow skill instead of repeatedly sending manual nudges.
+After a repair, the agent should run syntax checks for changed scripts, perform a dry-run or bounded batch when safe, inspect counters, first-missing IDs, fresh run markers, and timestamps, and keep unrelated tmux sessions running. If the same symptom repeats, the agent should improve the project workflow or a reusable AgInTiFlow skill instead of repeatedly sending manual nudges.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.178",
+  "version": "0.20.182",
   "type": "module",
   "description": "AgInTiFlow is a project-aware agent workspace for hybrid wet-dry R&D, hardware-aware intelligence, software automation, and industrial workflows.",
   "license": "Apache-2.0",
@@ -63,6 +63,7 @@
     "scripts/smoke-capabilities.js",
     "scripts/smoke-auto-update.js",
     "scripts/smoke-inbox.js",
+    "scripts/smoke-long-jobs.js",
     "scripts/smoke-mcp.js",
     "scripts/fixtures/mcp-stdio-smoke-server.mjs",
     "scripts/smoke-model-roles.js",
@@ -91,7 +92,7 @@
   "scripts": {
     "start": "node run.js",
     "web": "node web.js",
-    "check": "node --check run.js && node --check web.js && node --check bin/aginti-cli.js && node --check src/*.js && node --check src/mcp/*.js && node --check public/app.js && node --check scripts/seed-supervised-homework.js && node --check scripts/smoke-mcp.js && node --check scripts/smoke-web-ui.js && node --check scripts/fixtures/mcp-stdio-smoke-server.mjs",
+    "check": "node --check run.js && node --check web.js && node --check bin/aginti-cli.js && node --check src/*.js && node --check src/mcp/*.js && node --check public/app.js && node --check scripts/seed-supervised-homework.js && node --check scripts/smoke-mcp.js && node --check scripts/smoke-web-ui.js && node --check scripts/smoke-scs-evidence-visibility.js && node --check scripts/fixtures/mcp-stdio-smoke-server.mjs",
     "setup:toolchain-docker": "scripts/setup-agent-toolchain-docker.sh",
     "smoke:coding-tools": "node scripts/smoke-coding-tools.js",
     "smoke:dynamic-step-budget": "node scripts/smoke-dynamic-step-budget.js",
@@ -102,9 +103,11 @@
     "smoke:cli-chat": "node scripts/smoke-cli-chat.js",
     "smoke:docker-command": "node scripts/smoke-docker-command.js",
     "smoke:skills": "node scripts/smoke-skills.js",
+    "smoke:scs-evidence": "node scripts/smoke-scs-evidence-visibility.js",
     "smoke:skillmesh": "node scripts/smoke-skillmesh.js",
     "smoke:toolchain-docker": "node scripts/smoke-toolchain-docker.js",
     "smoke:inbox": "node scripts/smoke-inbox.js",
+    "smoke:long-jobs": "node scripts/smoke-long-jobs.js",
     "smoke:mcp": "node scripts/smoke-mcp.js",
     "smoke:model-roles": "node scripts/smoke-model-roles.js",
     "smoke:platform": "node scripts/smoke-platform.js",
@@ -124,7 +127,7 @@
     "storage:migrate": "node bin/aginti-cli.js storage migrate",
     "publish:env": "node scripts/npm-publish-from-env.js publish --access public",
     "publish:env:whoami": "node scripts/npm-publish-from-env.js whoami",
-    "test": "npm run check && npm run smoke:runtime-compat && npm run smoke:autoupdate && npm run smoke:web-api && npm run smoke:web-ui && npm run smoke:web-autostart && npm run smoke:webapp-command && npm run smoke:web-port-fallback && npm run smoke:docker-command && npm run smoke:coding-tools && npm run smoke:dynamic-step-budget && npm run smoke:aaps-adapter && npm run smoke:auxiliary-tools && npm run smoke:perception-research && npm run smoke:auth && npm run smoke:canvas-artifacts && npm run smoke:capabilities && npm run smoke:mcp && npm run smoke:model-roles && npm run smoke:platform && npm run smoke:permission-modes && npm run smoke:skills && npm run smoke:skillmesh && npm run smoke:tmux-tools && npm run smoke:cli-chat && npm run smoke:inbox",
+    "test": "npm run check && npm run smoke:runtime-compat && npm run smoke:autoupdate && npm run smoke:web-api && npm run smoke:web-ui && npm run smoke:web-autostart && npm run smoke:webapp-command && npm run smoke:web-port-fallback && npm run smoke:docker-command && npm run smoke:coding-tools && npm run smoke:dynamic-step-budget && npm run smoke:aaps-adapter && npm run smoke:auxiliary-tools && npm run smoke:perception-research && npm run smoke:auth && npm run smoke:canvas-artifacts && npm run smoke:capabilities && npm run smoke:mcp && npm run smoke:model-roles && npm run smoke:platform && npm run smoke:permission-modes && npm run smoke:skills && npm run smoke:skillmesh && npm run smoke:tmux-tools && npm run smoke:long-jobs && npm run smoke:cli-chat && npm run smoke:inbox",
     "pack:dry-run": "npm pack --dry-run",
     "smoke:capabilities": "node scripts/smoke-capabilities.js"
   },

package/references/aginti-generalization-audit-2026-05-20.md

@@ -0,0 +1,66 @@
+# AgInTiFlow Generalization Audit
+
+Date: 2026-05-20
+
+## Scope
+
+This audit checks whether the core AgInTiFlow runtime learned a general problem-solving capability, or whether it accidentally hard-coded a project-specific browser workflow.
+
+Reviewed areas:
+
+- SCS controller and evidence gates
+- Engineering guidance and dynamic step budget
+- Built-in skills and project-local skill loading
+- Smoke tests that protect browser workflows, upload contracts, and SCS validation
+
+## Findings
+
+AgInTiFlow core should stay task-independent. It may know that browser work often needs page-state reconciliation, scoped selectors, attachment verification, model/duration verification, submit evidence, and external blocker handling. It should not know a private platform name, a private repository name, a private character set, a fixed prompt, or fixed asset filenames.
+
+The useful general capability is:
+
+- derive a task contract from the user's request
+- preserve exact input paths and forbidden actions
+- reject plans that invent unrequested uploads or skipped UI actions
+- require concrete browser, visual, filesystem, or command evidence before finish
+- route failed finish claims back to a validator/replan loop
+- load narrow project-local skills from `.aginti/skills/<skill-id>/SKILL.md`
+
+## Remediation
+
+Project-specific browser/video terms were removed from core heuristics and smoke fixtures. Generic Chinese and English browser workflow terms remain because they apply across websites.
+
+Kept in core:
+
+- generic browser composer guidance
+- generic upload/asset-library/reference-media verification
+- generic model, mode, duration, and submit-state verification
+- generic external blocker handling such as login, captcha, credits, permission, server error, or user confirmation
+- project-local skill loading and skill-creation workflow
+
+Moved out of core:
+
+- private platform names
+- private repository names
+- private asset filenames
+- private character names
+- task-specific model branding examples
+
+## Design Rule
+
+If a future task requires special UI labels, account behavior, reference media, or platform-specific workarounds, create or update a project-local skill. Only promote a rule into AgInTiFlow core when the rule applies to a broad class of tasks such as browser form submission, book generation, LaTeX compilation, translation, testing, or deployment.
+
+## Verification
+
+Commands run:
+
+```bash
+npm run check
+npm run smoke:model-roles
+node scripts/smoke-skills.js
+node scripts/smoke-dynamic-step-budget.js
+node scripts/smoke-coding-tools.js
+rg -n --hidden --glob '!node_modules/**' --glob '!.git/**' --glob '!dist/**' --glob '!coverage/**' 'xiaoyunque|小云雀|xyq|jianying|LALACHAN|啦啦|拉拉|阿芽|飒飒|Seedance|沉浸式短片|Trio\.png|display\.png|R1\.jpg|patchwork-leather|duanpian' .
+```
+
+Result: checks passed, and the repository search found no remaining private workflow terms in AgInTiFlow runtime code, tests, or general references after excluding this audit's own search expression.

package/references/codex-session-cross-references.md

@@ -40,30 +40,30 @@ AgInTiFlow relevance:
 - AgInTiFlow must not own or silently mutate AAPS-selected project, workflow,
   program, block, or working file.
 
-### LALACHAN Browser And AgInTi Supervision Source Session
+### Browser Automation And AgInTi Supervision Source Session
 
 - Session: `019dc795-e538-75b2-8a03-bc103b32985d`
-- Status context shown by Codex: `~/ProjectsLFS/LALACHAN`
-- Primary repo involved: `/home/lachlan/ProjectsLFS/LALACHAN`
+- Status context shown by Codex: a project-local media/browser workflow repo
+- Primary repo involved: project-local, outside AgInTiFlow core
 - Related AgInTiFlow repo: `/home/lachlan/ProjectsLFS/Agent/AgInTiFlow`
 - Role: failure-source and product-requirement session.
 
-This session started from LALACHAN/Xiaoyunque browser video workflows and exposed
-a general AgInTiFlow weakness: the executor could claim progress or completion
+This session started from a project-local browser video workflow and exposed a
+general AgInTiFlow weakness: the executor could claim progress or completion
 without enough evidence that the requested browser state, upload state, selected
 mode, selected model, prompt, reference media, or generated artifact actually
 existed.
 
 Important lesson from this session:
 
-- Do not hard-code Xiaoyunque-specific rules into AgInTiFlow core.
+- Do not hard-code project-specific browser workflow rules into AgInTiFlow core.
 - Keep domain details in project-local skills such as `.aginti/skills/<id>/SKILL.md`.
 - Improve the core agent harness instead: task contract, monitor, evidence ledger,
   validator gate, replan loop, and real blocker reporting.
 
 Project-local skill produced from this direction:
 
-- `/home/lachlan/ProjectsLFS/LALACHAN/.aginti/skills/xiaoyunque-video-browser/SKILL.md`
+- `.aginti/skills/<project-browser-workflow>/SKILL.md` in the task repository
 
 ### ZhJpBook And AgInTiFlow Implementation Session
 
@@ -76,7 +76,7 @@ Project-local skill produced from this direction:
 This session used a long bilingual book pipeline to stress AgInTiFlow's ability
 to run durable, evidence-based work: source conversion, chunking, DeepSeek JSON
 writing, validation, monitoring, PDF compilation, artifact handling, and recovery.
-The same core principle from the LALACHAN session was then implemented in
+The same core principle from the browser workflow session was then implemented in
 AgInTiFlow.
 
 Relevant AgInTiFlow commits:
@@ -127,7 +127,7 @@ These sessions should be read together:
 - Agent Meta-AAPS supplies the cross-repo bridge: AAPS borrows useful
   AgInTiFlow interaction patterns while keeping AAPS as the state and semantics
   owner.
-- LALACHAN supplies the concrete failure mode: browser automation and media tasks
+- The browser workflow session supplies the concrete failure mode: browser automation and media tasks
   can look successful while the visible external state is wrong or unverified.
 - ZhJpBook supplies the long-running pipeline pressure: the agent must keep
   moving through scripts, monitors, validators, and artifacts without accepting

package/scripts/smoke-coding-tools.js

@@ -448,7 +448,7 @@ try {
   assert(hostLocalhostJsonProbePolicy.allowed, "host localhost JSON probe should not require full-host destructive access");
   assert(hostLocalhostJsonProbePolicy.category === "network-fetch", "host localhost JSON probe should stay classified as network-fetch");
   const absolutePythonHelperPolicy = evaluateCommandPolicy(
-    "/home/lachlan/miniconda3/bin/python scripts/xyq_cdp_browser.py list-pages",
+    "/home/lachlan/miniconda3/bin/python scripts/browser_cdp_helper.py list-pages",
     hostWorkspacePolicy
   );
   assert(absolutePythonHelperPolicy.allowed, "host absolute Python helper script should be allowed without full-host destructive access");

package/scripts/smoke-dynamic-step-budget.js

@@ -7,6 +7,7 @@ import { runAgent } from "../src/agent-runner.js";
 import { resolveRuntimeConfig } from "../src/config.js";
 import {
   browserSubmitFinishIssue,
+  isRecoverableShellToolResult,
   isSuspiciousBroadBrowserToolResult,
   shouldActivateScs,
   shouldReviewToolResult,
@@ -85,6 +86,29 @@ try {
     shouldReviewToolResult(broadBrowserClick, { meta: {} }),
     "SCS should review suspicious broad browser click results"
   );
+  const blockedSecretProbe = {
+    toolName: "run_command",
+    blocked: true,
+    args: { command: "env | grep API_KEY" },
+    reason: "Command is blocked because it references secrets or credential files.",
+  };
+  assert(isRecoverableShellToolResult(blockedSecretProbe), "SCS should classify blocked secret probes as recoverable shell results");
+  assert(
+    !shouldReviewToolResult(blockedSecretProbe, { meta: {} }),
+    "SCS should not derail the phase for a safely blocked credential probe"
+  );
+  const malformedReadOnlyCheck = {
+    toolName: "run_command",
+    ok: false,
+    exitCode: 2,
+    args: { command: "for f in *.pdf; do python3 -c 'print(\"oops\")'" },
+    stderr: "/bin/bash: -c: line 9: syntax error: unexpected end of file",
+  };
+  assert(isRecoverableShellToolResult(malformedReadOnlyCheck), "SCS should classify shell quoting mistakes as recoverable");
+  assert(
+    !shouldReviewToolResult(malformedReadOnlyCheck, { meta: {} }),
+    "SCS should let the normal agent loop repair simple shell quoting mistakes"
+  );
   assert(
     !isSuspiciousBroadBrowserToolResult({
       toolName: "run_command",
@@ -96,19 +120,19 @@ try {
   );
   assert(
     recommendedMaxStepsForTask({
-      goal: "Use Chrome CDP to upload five images, select an asset-library video, choose non-VIP model, and submit the Xiaoyunque browser composer.",
+      goal: "Use Chrome CDP to upload five images, select an asset-library video, choose the requested non-premium model tier, and submit the browser composer.",
     }) >= 48,
     "browser submit workflows need a larger default step budget"
   );
   assert(
     browserSubmitFinishIssue(
-      "小云雀网页上传五张图，从资产库选择参考视频，然后提交生成",
-      "资产库旧三人视频 未执行；提交 未执行；步骤不足。"
+      "网页创作器上传五张图，从素材库选择参考视频，然后提交生成",
+      "素材库参考视频 未执行；提交 未执行；步骤不足。"
     ),
     "SCS finish gate should reject unfinished browser submit reports"
   );
   assert(
-    !browserSubmitFinishIssue("小云雀网页提交生成", "停止：积分不足，需要用户处理 credits not enough。"),
+    !browserSubmitFinishIssue("网页创作器提交生成", "停止：积分不足，需要用户处理 credits not enough。"),
     "SCS finish gate should allow real external browser blockers"
   );
 

package/scripts/smoke-long-jobs.js

@@ -0,0 +1,104 @@
+#!/usr/bin/env node
+import assert from "node:assert/strict";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { checkToolUse } from "../src/guardrails.js";
+import { longJobStatus, startLongJob } from "../src/long-job-tools.js";
+import { tmuxAvailable } from "../src/tmux-tools.js";
+
+const workspace = await fs.mkdtemp(path.join(os.tmpdir(), "agintiflow-long-job-"));
+const config = {
+  allowShellTool: true,
+  allowDestructive: true,
+  allowPasswords: true,
+  commandCwd: workspace,
+  sandboxMode: "host",
+  useDockerSandbox: false,
+};
+const dockerConfig = {
+  ...config,
+  allowDestructive: false,
+  allowPasswords: false,
+  useDockerSandbox: true,
+  sandboxMode: "docker-workspace",
+  packageInstallPolicy: "allow",
+};
+
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+try {
+  if (!(await tmuxAvailable())) {
+    console.log(JSON.stringify({ ok: true, skipped: true, reason: "tmux is not installed" }, null, 2));
+    process.exit(0);
+  }
+
+  const noShell = checkToolUse({
+    toolName: "start_long_job",
+    args: { command: "printf ok > out.txt" },
+    config: { ...config, allowShellTool: false },
+  });
+  assert.equal(noShell.allowed, false, "start_long_job should require shell capability");
+
+  const outsidePath = path.join(os.tmpdir(), "aginti-long-job-outside.txt");
+  const outsideGuard = checkToolUse({
+    toolName: "start_long_job",
+    args: { name: "outside", command: `cat ${outsidePath}` },
+    config: dockerConfig,
+  });
+  assert.equal(outsideGuard.allowed, false, "Docker-mode long jobs should block outside host absolute paths");
+
+  const start = await startLongJob(
+    {
+      name: "smoke-download-style",
+      command: "printf 'abc123' > download.bin",
+      expectedOutputPath: "download.bin",
+      expectedSizeBytes: 6,
+      verifyCommand: "grep -q abc download.bin",
+      pollIntervalSeconds: 5,
+      note: "Smoke test for durable long command handoff.",
+    },
+    config
+  );
+  assert.equal(start.ok, true, start.error || start.reason);
+  assert.equal(start.background, true, "long job should return as a background handoff");
+  assert.match(start.statusPath, /^\.aginti\/long-jobs\//, "status path should be project-local");
+
+  let status = null;
+  for (let i = 0; i < 30; i += 1) {
+    await sleep(250);
+    status = await longJobStatus({ jobId: start.jobId }, config);
+    assert.equal(status.ok, true, status.reason);
+    if (["completed", "failed"].includes(status.state)) break;
+  }
+  assert.equal(status?.state, "completed", `long job did not complete: ${JSON.stringify(status)}`);
+  assert.equal(status.outputBytes, 6, "expected-size progress was not recorded");
+  assert.equal(status.verifyExitCode, 0, "verify command did not pass");
+
+  const output = await fs.readFile(path.join(workspace, "download.bin"), "utf8");
+  assert.equal(output, "abc123", "job output content mismatch");
+  await fs.access(path.join(workspace, start.statusPath));
+  await fs.access(path.join(workspace, start.stdoutPath));
+  await fs.access(path.join(workspace, start.stderrPath));
+  await fs.access(path.join(workspace, start.supervisorLogPath));
+
+  console.log(
+    JSON.stringify(
+      {
+        ok: true,
+        workspace,
+        jobId: start.jobId,
+        statusPath: start.statusPath,
+        state: status.state,
+        outputBytes: status.outputBytes,
+        verifyExitCode: status.verifyExitCode,
+      },
+      null,
+      2
+    )
+  );
+} finally {
+  await fs.rm(workspace, { recursive: true, force: true }).catch(() => {});
+}

package/scripts/smoke-model-roles.js

@@ -11,7 +11,13 @@ import {
 } from "../src/model-routing.js";
 import { normalizeTextToolCallResponse, parseTextToolCalls, usesTextToolProtocol } from "../src/model-client.js";
 import { modelRoleChoices, selectorVisibleWindow } from "../src/interactive-cli.js";
-import { buildScsEvidencePack, buildSupervisorInstruction, reviewScsFinish, shouldRequestScsReplan } from "../src/scs-controller.js";
+import {
+  buildScsEvidencePack,
+  buildSupervisorInstruction,
+  deterministicPlanActionContradiction,
+  reviewScsFinish,
+  shouldRequestScsReplan,
+} from "../src/scs-controller.js";
 import { buildScsEvidenceLedger, deriveScsTaskContract, evaluateScsEvidence } from "../src/scs-evidence.js";
 
 const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
@@ -249,9 +255,28 @@ assert(scsEvidence.includes("evidenceLedger"), "SCS evidence pack should include
 assert(scsEvidence.includes("evaluation"), "SCS evidence pack should include deterministic contract evaluation");
 
 const uploadContract = deriveScsTaskContract({
-  goal: "Upload five images in the browser composer and verify visible thumbnails. Do not submit.",
+  goal:
+    "Upload five images in the browser composer and verify visible thumbnails: /tmp/reference-a.png /tmp/reference-b.png /tmp/reference-c.png. Do not submit.",
   taskProfile: "website",
 });
+assert(
+  uploadContract.exactInputPaths.includes("/tmp/reference-a.png") &&
+    uploadContract.exactInputPaths.includes("/tmp/reference-b.png") &&
+    uploadContract.exactInputPaths.includes("/tmp/reference-c.png"),
+  "SCS contract should preserve exact input/reference paths for browser upload tasks"
+);
+const uploadImagePlanContradiction = deterministicPlanActionContradiction(
+  "Find the latest .mp4 in the project, upload the video file, then click submit.",
+  uploadContract
+);
+assert(
+  /video-file upload/i.test(uploadImagePlanContradiction || ""),
+  "SCS deterministic plan gate should reject invented video-file uploads for image-upload tasks"
+);
+assert(
+  !deterministicPlanActionContradiction("Upload the five images, verify thumbnails, and do not submit.", uploadContract),
+  "SCS deterministic plan gate should allow matching image-upload plans"
+);
 assert(uploadContract.requiresExternalEvidence, "browser upload contract should require external evidence");
 assert(
   uploadContract.requiredEvidence.some((item) => item.category === "browser"),
@@ -272,7 +297,7 @@ const weakUploadLedger = buildScsEvidenceLedger({
           toolName: "run_command",
           ok: true,
           exitCode: 0,
-          args: { command: "scripts/cdp-helper set-file-input PAGE_ID display.png R1.jpg" },
+          args: { command: "scripts/cdp-helper set-file-input PAGE_ID reference-a.png reference-b.jpg" },
           stdout: '{"ok":true,"nodeCount":1}',
         }),
       },
@@ -292,7 +317,7 @@ const strongUploadLedger = buildScsEvidenceLedger({
           toolName: "run_command",
           ok: true,
           exitCode: 0,
-          args: { command: "scripts/cdp-helper upload-images-verify PAGE_ID display.png R1.jpg --screenshot outputs/upload.png" },
+          args: { command: "scripts/cdp-helper upload-images-verify PAGE_ID reference-a.png reference-b.jpg --screenshot outputs/upload.png" },
           stdout: '{"ok":true,"visibleEvidenceCount":5,"screenshot":"outputs/upload.png"}',
         }),
       },
@@ -365,6 +390,42 @@ const jsonObjectContract = deriveScsTaskContract({
 const virtualFileContract = deriveScsTaskContract({
   goal: "Create file: /workspace/virtual-output.txt with virtual Docker path support.",
 });
+const outputListContract = deriveScsTaskContract({
+  goal: [
+    "Create:",
+    "- `work/demo/generate_items.py`",
+    "- `work/demo/review_items.py`",
+    "",
+    "Validate with `work/demo/validate_items.py` before promoting output.",
+    "Do not treat `work/demo/existing_validator.py` as an output artifact.",
+    "",
+    "Output structure:",
+    "- `build/demo/primary/color/book.pdf`",
+    "- `build/demo/secondary/color/book.pdf`",
+    "",
+    "Each generated item file goes to:",
+    "`data/demo/items/{item_id}.json`",
+  ].join("\n"),
+  taskProfile: "code",
+});
+const manyOutputContract = deriveScsTaskContract({
+  goal: [
+    "Required outputs:",
+    "- `out/a01.json`",
+    "- `out/a02.json`",
+    "- `out/a03.json`",
+    "- `out/a04.json`",
+    "- `out/a05.json`",
+    "- `out/a06.json`",
+    "- `out/a07.json`",
+    "- `out/a08.json`",
+    "- `out/a09.json`",
+    "- `out/a10.json`",
+    "- `out/a11.json`",
+    "- `out/a12.json`",
+  ].join("\n"),
+  taskProfile: "code",
+});
 const generatedReviewContract = deriveScsTaskContract({
   goal: [
     "Review focus: changed files only",
@@ -398,6 +459,23 @@ assert(
     !virtualFileContract.requiredEvidence.some((item) => item.category === "artifact"),
   "virtual output filename should require file evidence without treating output in the filename as an artifact"
 );
+assert(
+  outputListContract.exactOutputPaths.includes("work/demo/generate_items.py") &&
+    outputListContract.exactOutputPaths.includes("work/demo/review_items.py") &&
+    outputListContract.exactOutputPaths.includes("build/demo/primary/color/book.pdf") &&
+    outputListContract.exactOutputPaths.includes("build/demo/secondary/color/book.pdf"),
+  "SCS should infer exact outputs from Create/Output structure list sections"
+);
+assert(
+  !outputListContract.exactOutputPaths.includes("work/demo/validate_items.py") &&
+    !outputListContract.exactOutputPaths.includes("work/demo/existing_validator.py") &&
+    !outputListContract.exactOutputPaths.some((item) => item.includes("{item_id}")),
+  "SCS should not treat validator/tool paths or templated paths as exact output artifacts"
+);
+assert(
+  manyOutputContract.exactOutputPaths.length === 12 && manyOutputContract.exactOutputPaths.includes("out/a12.json"),
+  "SCS should preserve more than eight exact output paths for multi-artifact tasks"
+);
 assert(
   generatedReviewContract.requiredEvidence.some((item) => item.category === "command") &&
     !generatedReviewContract.requiredEvidence.some((item) => item.category === "file") &&

package/scripts/smoke-permission-modes.js

@@ -114,6 +114,11 @@ async function main() {
   assert(dangerAbsoluteMkdir.trustedDangerOverride === true, "danger absolute host path should be explicit override");
   const dangerPublish = evaluateCommandPolicy("npm publish", danger);
   assert(dangerPublish.allowed === false, "danger should still block hard publish/token guardrails");
+  const workspaceCdSecretProbe = evaluateCommandPolicy(
+    `cd ${workspace} && env | grep -i 'deepseek\\\\|API_KEY' | head -5; echo "EXIT:$?"`,
+    danger
+  );
+  assert(workspaceCdSecretProbe.allowed === false, "workspace-root cd must not bypass secret command guardrails");
   const outsidePath = path.join(tempRoot, "outside-danger.txt");
   const dangerOutside = await executeWorkspaceTool("write_file", { path: outsidePath, content: "danger outside ok" }, danger);
   assert(dangerOutside.ok === true, "danger should allow outside workspace file write");

package/scripts/smoke-skills.js

@@ -66,7 +66,7 @@ assert(
   ),
   "browser automation prompt did not select browser-automation"
 );
-assert(selectedIds("小云雀 网页 上传 五张图 从资产库选择视频 提交").includes("browser-automation"), "Chinese XYQ prompt did not select browser-automation");
+assert(selectedIds("网页表单 上传 五张图 从素材库选择视频 提交").includes("browser-automation"), "Chinese browser prompt did not select browser-automation");
 assert(selectedIds("write a LaTeX paper and compile a PDF").includes("latex-manuscript"), "latex prompt did not select latex-manuscript");
 assert(selectedIds("edit a Microsoft Word docx and preserve the original").includes("word-documents"), "docx prompt did not select word-documents");
 assert(selectedIds("generate a logo image with grsai nanobanana").includes("image-generation"), "image prompt did not select image-generation");

package/scripts/smoke-tmux-tools.js

@@ -83,6 +83,13 @@ try {
   const destructive = checkTmuxToolUse("tmux_send_keys", { target: start.target, text: "rm -rf /" }, config);
   assert.equal(destructive.allowed, false, "tmux guardrail did not block destructive text");
 
+  const workspaceRelativeCleanup = checkToolUse({
+    toolName: "tmux_start_session",
+    args: { name: `${session}-cleanup`, cwd: ".", command: "rm -f logs/task.status && echo cleaned" },
+    config,
+  });
+  assert.equal(workspaceRelativeCleanup.allowed, true, "Host danger tmux should allow workspace-relative cleanup commands");
+
   const outsidePath = path.join(os.tmpdir(), "agintiflow-outside-workspace-canary.txt");
   const workspacePath = path.join(workspace, "inside-workspace.txt");
   const dockerTmuxOutsideStart = checkToolUse({
@@ -249,6 +256,7 @@ try {
           "list-sessions",
           "secret-guardrail",
           "destructive-guardrail",
+          "host-danger-workspace-cleanup-allowed",
           "docker-tmux-start-outside-path-guardrail",
           "docker-tmux-send-outside-path-guardrail",
           "docker-tmux-start-project-path-allowed",

package/skills/autonomous-artifact-pipeline/SKILL.md

@@ -38,7 +38,8 @@ Before launching long work, create or identify a project-local contract:
 3. Task manifest: stable chunk IDs, source location, dependency order, prompt/schema version, and output paths.
 4. Artifact schema: JSON Schema or other validator-owned shape for each generated unit.
 5. Runners: resumable writer, reviewer, repairer, monitor, merge, compile/export, and status commands.
-6. Completion evidence: counters, first missing item, failed IDs, current previews, final artifact paths, and resume commands.
+6. Freshness evidence: runner IDs, heartbeats, log timestamps, status file mtimes, and tmux markers that separate current output from old scrollback.
+7. Completion evidence: counters, first missing item, failed IDs, current previews, final artifact paths, and resume commands.
 
 Project-specific schemas, prompts, layouts, and compilers belong in the target repository. AgInTiFlow provides the orchestration pattern and should generate or patch local scripts when they are missing.
 
@@ -50,6 +51,7 @@ Project-specific schemas, prompts, layouts, and compilers belong in the target r
 - Use isolated structured-data calls for repetitive JSON units. Keep prompts focused on the chunk, schema, source references, and validation errors.
 - Add deterministic canonicalizers before model retry when failures are representational, such as punctuation normalization, stable token splitting, missing metadata backfill, schema version migration, or renderer-specific wrapping. Do not spend provider calls on repairs a local script can prove.
 - Run writers in tmux or another observable background process. Each worker must have disjoint claims, atomic output writes, and shard-local logs.
+- When restarting a tmux worker, print a unique run marker and write the same marker to its log or status file. A pane capture that only shows old scrollback is not proof of current progress.
 - Keep review and repair asynchronous but safe. Reviewers may produce candidate fixes while writers continue; only validators or merge scripts promote candidates.
 - Compile or export checkpoint previews after successful merge batches and always at final completion.
 - Commit reusable scripts, manifests, validators, templates, and stable checkpoints when the project expects git tracking.
@@ -68,4 +70,4 @@ A robust pipeline has an independent repair path that is not blocked by the main
 
 ## Done Criteria
 
-Do not call the task complete until the final artifact was built from the current manifest and the status report shows complete or intentionally quarantined coverage. A partial PDF, stale page count, or successful worker log is not enough.
+Do not call the task complete until the final artifact was built from the current manifest and the status report shows complete or intentionally quarantined coverage. A partial PDF, stale page count, old tmux scrollback, or successful worker log is not enough.