@lazyingart/agintiflow 0.20.196 → 0.20.197

package/README.md

@@ -109,7 +109,7 @@ Provider signup and key pages:
 
 The CLI quietly auto-starts or reuses the local web UI from the same project. It tries `http://127.0.0.1:3210` first, then `3211`, `3212`, and so on if the port is already occupied by another project. The active URL is shown in the CLI launch header. If startup is blocked, stale, or unavailable, the same header row shows the recovery hint; run `/webapp [port]` inside the CLI to retry, `/webapp stop [port]` to stop the compatible local webapp, or `/webapp restart [port]` to stop and relaunch the local webapp with the current project and canonical `~/.agintiflow` session home. Use `/webapp disable` or `aginti webapp disable` to persistently disable automatic webapp startup and update-time restarts; use `/webapp enable` or `aginti webapp enable` to restore them. After a successful `aginti update` or accepted startup auto-update, AgInTiFlow restarts the compatible local webapp only when webapp auto-start is enabled.
 
-Package installation also makes a best-effort, non-blocking webapp initialization. Install never fails because the optional local webapp could not start.
+Global CLI installation also makes a best-effort, non-blocking webapp initialization. Project dependency installs remain side-effect free by default; set `AGINTIFLOW_POSTINSTALL_WEBAPP=1` only when a local dependency install should start Studio. Installation never fails because the optional local webapp could not start.
 
 Launch the web UI explicitly when you want a foreground web server:
 
@@ -152,6 +152,9 @@ aginti --language de
 | Goal | Command |
 | --- | --- |
 | Start interactive chat | `aginti` or `aginti chat` |
+| Run one clean machine turn | `printf '%s\n' 'task' \| aginti run --stdin --json --task-profile chatops --no-scs -s safe` |
+| Start the narrow public-research backend | Project-local `./node_modules/.bin/aginti-public-research --port 3211`; see [deployment boundary](docs/public-research-wrapper.md) |
+| Start the authenticated text-only fallback | Project-local `./node_modules/.bin/aginti-safe-chat --port 3212`; see [safe-chat boundary](docs/safe-chat.md) |
 | Start local web app | Auto-starts with `aginti`; detached command is `aginti webapp`; disable/enable auto-start with `aginti webapp disable` / `aginti webapp enable`; stop with `aginti webapp stop`; restart with `aginti webapp restart`; foreground mode is `aginti web --port 3210` |
 | Save provider keys | `aginti auth`, `/auth`, `/login` |
 | Review current repo | `/review [focus]` |
@@ -400,6 +403,7 @@ More detail:
 | Runtime modes and autonomy | [docs/runtime-modes-and-autonomy.md](docs/runtime-modes-and-autonomy.md) |
 | Skills and tools | [docs/skills-and-tools.md](docs/skills-and-tools.md) |
 | Image reading and web research | [docs/perception-and-web-research.md](docs/perception-and-web-research.md) |
+| Server-owned text-only fallback | [docs/safe-chat.md](docs/safe-chat.md) |
 | Skill Mesh | [docs/skillmesh.md](docs/skillmesh.md) |
 | Housekeeping logs | [docs/housekeeping.md](docs/housekeeping.md) |
 | npm publishing | [docs/npm-publishing.md](docs/npm-publishing.md) |

package/bin/aginti-public-research.js

@@ -0,0 +1,33 @@
+#!/usr/bin/env node
+import { listenPublicResearchServer } from "../src/public-research-server.js";
+
+function optionValue(argv, name) {
+  const index = argv.indexOf(name);
+  return index >= 0 ? argv[index + 1] : "";
+}
+
+const argv = process.argv.slice(2);
+if (argv.includes("--help") || argv.includes("-h")) {
+  console.log("Usage: aginti-public-research [--host 127.0.0.1] [--port 3211]");
+  console.log("Starts only the fail-closed public research API; it does not start AgInTiFlow Studio or chat.");
+  process.exit(0);
+}
+
+const running = await listenPublicResearchServer({
+  host: optionValue(argv, "--host") || undefined,
+  port: optionValue(argv, "--port") || undefined,
+}).catch((error) => {
+  console.error(`aginti-public-research unavailable: ${error instanceof Error ? error.message : String(error)}`);
+  process.exitCode = 1;
+  return null;
+});
+
+if (running) {
+  console.log(`aginti-public-research: ${running.url}`);
+  const stop = () => {
+    running.server.close(() => process.exit(0));
+    setTimeout(() => process.exit(1), 1500).unref?.();
+  };
+  process.once("SIGINT", stop);
+  process.once("SIGTERM", stop);
+}

package/bin/aginti-safe-chat.js

@@ -0,0 +1,34 @@
+#!/usr/bin/env node
+import { listenSafeChatServer } from "../src/safe-chat-server.js";
+import { redactSensitiveText } from "../src/redaction.js";
+
+function optionValue(argv, name) {
+  const index = argv.indexOf(name);
+  return index >= 0 ? argv[index + 1] : "";
+}
+
+const argv = process.argv.slice(2);
+if (argv.includes("--help") || argv.includes("-h")) {
+  console.log("Usage: aginti-safe-chat [--host 127.0.0.1] [--port 3212]");
+  console.log("Starts the authenticated loopback-only, server-owned DeepSeek text fallback.");
+  process.exit(0);
+}
+
+const running = await listenSafeChatServer({
+  host: optionValue(argv, "--host") || undefined,
+  port: optionValue(argv, "--port") || undefined,
+}).catch((error) => {
+  console.error(`aginti-safe-chat unavailable: ${redactSensitiveText(error instanceof Error ? error.message : String(error))}`);
+  process.exitCode = 1;
+  return null;
+});
+
+if (running) {
+  console.log(`aginti-safe-chat: ${running.url}`);
+  const stop = () => {
+    running.server.close(() => process.exit(0));
+    setTimeout(() => process.exit(1), 1500).unref?.();
+  };
+  process.once("SIGINT", stop);
+  process.once("SIGTERM", stop);
+}

package/docs/machine-run.md

@@ -0,0 +1,18 @@
+# Machine Run Interface
+
+Use `aginti run` when another local application needs one AgInTiFlow turn without interactive CLI output.
+
+```bash
+printf '%s\n' 'Summarize this evidence.' |
+  aginti run --stdin --json --task-profile chatops --no-scs -s safe
+```
+
+`--json` writes exactly one JSON object to stdout:
+
+```json
+{"ok":true,"sessionId":"...","result":"...","stopped":false,"failed":false,"reason":""}
+```
+
+Runtime headers, plans, tool logs, and sandbox diagnostics are suppressed. A missing key, timeout, empty result, or stopped run returns `ok: false` and a nonzero exit code. Callers must forward only `result`, never stderr or the full runtime state.
+
+The `chatops` profile treats the current request as the sole source of authority. It avoids unrelated workspace artifacts and does not use tools for simple conversation. Use `-s safe` for read-only routing and research. Use `-s normal` with the default Docker workspace only when the request needs current-project artifacts. Do not use `-s danger` for unattended chat transports.

package/docs/public-research-wrapper.md

@@ -0,0 +1,162 @@
+# Public Research Wrapper
+
+AgInTiFlow exposes an optional fail-closed backend route for apps that need a narrow server-owned research helper without exposing model or provider controls to clients.
+
+This route is intended for product backends such as EchoMind AI Agent. It is not a replacement for normal AgInTiFlow chat.
+
+## Capability Classification
+
+- **Existing capability:** AgInTiFlow already has a server-owned Codex exec adapter, input/output redaction, bounded subprocess handling, and a disposable per-request workspace.
+- **System-level gap addressed here:** normal AgInTiFlow chat and Studio expose too much tool and API surface for a narrow application backend. The standalone server exposes only health, readiness, status, and research routes. Prompts travel over stdin rather than process arguments.
+- **Deployment/setup gap:** hard host-filesystem and domain-level network isolation cannot be created honestly by an npm process alone. Production must provide the external container/VM and egress firewall described below. The route remains unavailable until that boundary is explicitly attested.
+
+The EchoMind server should call this narrow service only for explicit public-research work. Normal EchoMind chat does not need to invoke AgInTiFlow.
+
+## Project-Local Installation
+
+Install without a global package:
+
+```bash
+npm install --save-exact @lazyingart/agintiflow
+```
+
+Project dependency installation does not auto-start AgInTiFlow Studio. The package postinstall hook reserves that behavior for global CLI installs or explicit `AGINTIFLOW_POSTINSTALL_WEBAPP=1` opt-in.
+
+Start only the narrow service:
+
+```bash
+./node_modules/.bin/aginti-public-research --host 127.0.0.1 --port 3211
+```
+
+Programmatic imports are also available:
+
+```js
+import { runPublicResearchWrapper } from "@lazyingart/agintiflow/public-research";
+import { listenPublicResearchServer } from "@lazyingart/agintiflow/public-research/server";
+```
+
+Importing these modules does not start AgInTiFlow chat, Studio, sessions, model routing, or project tools.
+
+## API
+
+`GET /ready`
+
+Returns `200` only when the route is available, otherwise `503`.
+
+`GET /v1/research/status`
+
+Returns availability, policy, and limits. It intentionally does not return model names.
+
+`POST /v1/research`
+
+Request:
+
+```json
+{
+  "query": "Summarize public NIH guidance about reproducible literature searches.",
+  "context": "Optional non-secret app context.",
+  "allowedDomains": ["nih.gov"]
+}
+```
+
+Response:
+
+```json
+{
+  "ok": true,
+  "feature": "public-research-wrapper",
+  "route": "server-owned-codex",
+  "modelExposed": false,
+  "answer": "..."
+}
+```
+
+Compatibility aliases remain available at `/api/public-research/status` and `/api/public-research`.
+
+The endpoint rejects client-controlled provider, model, cwd, env, token, sandbox, and wrapper fields. Successful answers must include citations whose domains are within the server allowlist. Process stderr/stdout diagnostics are never returned to clients.
+
+## Enablement
+
+The route is disabled by default and fails closed until all required server-side conditions are true:
+
+```bash
+export AGINTI_PUBLIC_RESEARCH_ENABLED=1
+export AGINTI_PUBLIC_RESEARCH_BOUNDARY=external-strict
+export AGINTI_PUBLIC_RESEARCH_CODEX_HOME=/srv/aginti-public-codex
+export AGINTI_PUBLIC_RESEARCH_ALLOWED_DOMAINS="nih.gov pubmed.ncbi.nlm.nih.gov arxiv.org"
+```
+
+Optional bounds:
+
+```bash
+export AGINTI_PUBLIC_RESEARCH_TIMEOUT_MS=90000
+export AGINTI_PUBLIC_RESEARCH_MAX_CONCURRENCY=1
+export AGINTI_PUBLIC_RESEARCH_CODEX_MODEL=server-owned-model
+export AGINTI_PUBLIC_RESEARCH_CODEX_REASONING=medium
+```
+
+Do not set `AGINTI_PUBLIC_RESEARCH_CODEX_HOME` to the user's normal home directory or normal `~/.codex`. Use a dedicated service-owned Codex profile.
+
+`AGINTI_PUBLIC_RESEARCH_BOUNDARY=external-strict` is an operator attestation, not a substitute for isolation. Set it only after the deployment requirements below are enforced. Without it, readiness fails closed.
+
+The standalone server binds to loopback by default. Remote binding additionally requires:
+
+```bash
+export AGINTI_PUBLIC_RESEARCH_ALLOW_REMOTE=1
+export AGINTI_PUBLIC_RESEARCH_BEARER_TOKEN=server-owned-random-value
+```
+
+Do not pass this bearer token to end-user clients. EchoMind server-side code owns it.
+
+## Security Boundary
+
+The wrapper:
+
+- runs `codex exec --ephemeral` from a disposable temp workspace;
+- passes the research prompt through stdin, not command-line arguments;
+- sets `HOME`, `XDG_CONFIG_HOME`, `XDG_CACHE_HOME`, and temp paths to disposable directories;
+- passes only a minimal environment to the Codex process;
+- uses a dedicated `CODEX_HOME` supplied by the server operator;
+- rejects likely secret inputs before invoking Codex;
+- rejects secret-like model output and does not return process diagnostics;
+- enforces timeout, output-size, and concurrency limits;
+- configures the Codex web-search tool with the server-selected domain allowlist;
+- requires the same public allowlist in the research prompt and returned citations;
+- fails closed if disabled, unavailable, or not configured.
+
+The npm process cannot prove that the host filesystem or arbitrary network destinations are unreachable. A production deployment must enforce all of the following before setting `AGINTI_PUBLIC_RESEARCH_BOUNDARY=external-strict`:
+
+1. Run the standalone service as a non-root user inside a dedicated container, microVM, or equivalent sandbox.
+2. Mount no host home, application repository, EchoMind data, Docker socket, SSH agent, or cloud metadata credentials.
+3. Mount only the dedicated Codex service profile needed for authentication, preferably read-only.
+4. Use an ephemeral writable filesystem or tmpfs with bounded size; discard it when the service restarts.
+5. Drop capabilities and apply no-new-privileges, PID, memory, CPU, wall-time, and process limits.
+6. Deny private, loopback, link-local, and metadata destinations at the network boundary.
+7. Permit only required Codex control-plane endpoints at the local egress boundary. Codex web-search source access is separately constrained with `tools.web_search.allowed_domains`; do not enable alternate browser, MCP, or shell-network tools in this service.
+8. Do not log request bodies, authorization headers, Codex prompts, subprocess arguments, or model output.
+
+Codex `--sandbox read-only` is retained as defense in depth, but it is not the host-isolation boundary: read-only mode still permits reads. The external sandbox is what must prevent host home and repository access.
+
+## Smallest Deployment Shape
+
+Use one narrow sidecar/service:
+
+```text
+EchoMind client
+  -> EchoMind server (decides whether public research is needed)
+  -> loopback/private authenticated aginti-public-research
+  -> disposable codex exec worker
+  -> allowlisted egress boundary
+```
+
+Keep concurrency at `1` initially, timeout at or below `90s`, and output below `12k` characters. Scale by adding isolated service replicas rather than sharing host access or widening the route.
+
+## EchoMind Integration Shape
+
+EchoMind should call this route only for explicit public research tasks:
+
+```text
+EchoMind client -> EchoMind server -> narrow research service -> server-owned Codex exec
+```
+
+EchoMind clients should never send model names, provider names, keys, cwd values, user home paths, repository paths, or secrets to this route.

package/docs/safe-chat.md

@@ -0,0 +1,106 @@
+# Safe Chat
+
+AgInTiFlow provides an optional narrow text fallback for server applications. It calls a server-owned DeepSeek route directly and intentionally has no agent loop, tools, filesystem, shell, browser, sessions, artifacts, or persistence.
+
+This service is suitable for a bounded fallback response after an application has already classified a primary provider quota or capacity error. It must not be exposed directly to an end-user client.
+
+## Install and Start
+
+After a release containing this capability is published, install the package locally and start only the narrow service:
+
+```bash
+npm install --save-exact @lazyingart/agintiflow
+./node_modules/.bin/aginti-safe-chat --host 127.0.0.1 --port 3212
+```
+
+Required server environment:
+
+```bash
+export AGINTI_SAFE_CHAT_ENABLED=1
+export AGINTI_SAFE_CHAT_BEARER_TOKEN=server-owned-random-value
+export DEEPSEEK_API_KEY=server-owned-deepseek-key
+```
+
+Optional server-owned configuration:
+
+```bash
+export AGINTI_SAFE_CHAT_DEEPSEEK_MODEL=deepseek-v4-flash
+export AGINTI_SAFE_CHAT_DEEPSEEK_BASE_URL=https://api.deepseek.com/v1
+export AGINTI_SAFE_CHAT_TIMEOUT_MS=60000
+export AGINTI_SAFE_CHAT_MAX_CONCURRENCY=1
+export AGINTI_SAFE_CHAT_MAX_TOKENS=2048
+export AGINTI_SAFE_CHAT_OUTPUT_CHARS=12000
+```
+
+Do not put the bearer token or DeepSeek key in client code, request bodies, command-line arguments, logs, or source control. Use a protected service environment file or secret store.
+The bearer token must contain at least 24 characters.
+The provider endpoint is fail-closed to the exact production hostname `api.deepseek.com` over HTTPS. Credentials, query strings, fragments, alternate hosts, and non-default ports are rejected.
+
+## API
+
+Every endpoint, including health and readiness, requires:
+
+```text
+Authorization: Bearer <server-owned-token>
+```
+
+`GET /health`
+
+`GET /ready`
+
+`GET /v1/chat/status`
+
+`POST /v1/chat`
+
+Request:
+
+```json
+{
+  "prompt": "Explain this idea briefly.",
+  "history": [
+    { "role": "user", "content": "Earlier question" },
+    { "role": "assistant", "content": "Earlier answer" }
+  ],
+  "locale": "en"
+}
+```
+
+Response:
+
+```json
+{
+  "ok": true,
+  "feature": "safe-chat",
+  "answer": "...",
+  "code": "ok",
+  "retryable": false,
+  "modelExposed": false,
+  "providerExposed": false
+}
+```
+
+Compatibility aliases are available at `/api/safe-chat/status` and `/api/safe-chat`.
+
+The request schema accepts only `prompt`, bounded `history`, and an optional short locale. Client-controlled provider, model, key, base URL, system prompt, tool, filesystem, command, environment, and sandbox fields are rejected. Responses never expose provider/model names or upstream diagnostics.
+
+If the calling server cancels a programmatic request or its HTTP connection closes before the response, the upstream request is aborted. Programmatic callers receive a frozen, non-retryable `cancelled` result; a disconnected HTTP caller receives no late response.
+
+Programmatic imports:
+
+```js
+import { getSafeChatStatus, runSafeChat } from "@lazyingart/agintiflow/safe-chat";
+import { listenSafeChatServer } from "@lazyingart/agintiflow/safe-chat/server";
+```
+
+## Deployment Boundary
+
+- Bind only to loopback. The server rejects remote bind addresses.
+- Require a separate bearer token even on loopback.
+- Run under a dedicated non-root service account with a minimal environment.
+- Give the process only the DeepSeek credential and service configuration it needs.
+- Do not source an interactive shell profile from the service.
+- Do not mount application repositories, user homes, Docker sockets, SSH agents, or cloud metadata credentials.
+- Do not log authorization headers, request bodies, prompts, responses, or provider diagnostics.
+- Keep concurrency and output limits low, and let the calling application own account quotas, idempotency, cancellation, and fallback eligibility.
+
+The caller should invoke this service at most once for a classified primary-provider quota or capacity failure. Authentication, policy, invalid-input, and unsafe-output errors must remain fail-closed.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.196",
+  "version": "0.20.197",
   "type": "module",
   "description": "AgInTiFlow is a project-aware agent workspace for hybrid wet-dry R&D, hardware-aware intelligence, software automation, and industrial workflows.",
   "license": "Apache-2.0",
@@ -30,6 +30,14 @@
   "publishConfig": {
     "access": "public"
   },
+  "exports": {
+    "./public-research": "./src/public-research-wrapper.js",
+    "./public-research/server": "./src/public-research-server.js",
+    "./safe-chat": "./src/safe-chat-wrapper.js",
+    "./safe-chat/server": "./src/safe-chat-server.js",
+    "./package.json": "./package.json",
+    "./*": "./*"
+  },
   "files": [
     "AGENTS.md",
     "LICENSE",
@@ -52,7 +60,9 @@
     "scripts/setup-agent-toolchain-docker.sh",
     "scripts/real-deepseek-capabilities.js",
     "scripts/postinstall-webapp.js",
+    "scripts/seed-supervised-homework.js",
     "scripts/smoke-auxiliary-tools.js",
+    "scripts/smoke-agentlink.js",
     "scripts/smoke-auth.js",
     "scripts/smoke-aaps-adapter.js",
     "scripts/smoke-canvas-artifacts.js",
@@ -60,16 +70,21 @@
     "scripts/smoke-coding-tools.js",
     "scripts/smoke-docker-command.js",
     "scripts/smoke-dynamic-step-budget.js",
+    "scripts/smoke-execution-policy.js",
     "scripts/smoke-capabilities.js",
     "scripts/smoke-auto-update.js",
     "scripts/smoke-inbox.js",
     "scripts/smoke-long-jobs.js",
+    "scripts/smoke-run-stdin.js",
     "scripts/smoke-mcp.js",
     "scripts/fixtures/mcp-stdio-smoke-server.mjs",
     "scripts/smoke-model-roles.js",
     "scripts/smoke-platform.js",
     "scripts/smoke-perception-research.js",
     "scripts/smoke-permission-modes.js",
+    "scripts/smoke-public-research-wrapper.js",
+    "scripts/smoke-safe-chat.js",
+    "scripts/smoke-scs-evidence-visibility.js",
     "scripts/smoke-runtime-compat.js",
     "scripts/smoke-skills.js",
     "scripts/smoke-skillmesh.js",
@@ -87,15 +102,18 @@
   ],
   "bin": {
     "aginti": "bin/aginti-cli.js",
-    "aginti-cli": "bin/aginti-cli.js"
+    "aginti-cli": "bin/aginti-cli.js",
+    "aginti-public-research": "bin/aginti-public-research.js",
+    "aginti-safe-chat": "bin/aginti-safe-chat.js"
   },
   "scripts": {
     "start": "node run.js",
     "web": "node web.js",
-    "check": "node --check run.js && node --check web.js && node --check bin/aginti-cli.js && node --check src/*.js && node --check src/mcp/*.js && node --check public/app.js && node --check scripts/seed-supervised-homework.js && node --check scripts/smoke-agentlink.js && node --check scripts/smoke-mcp.js && node --check scripts/smoke-web-ui.js && node --check scripts/smoke-scs-evidence-visibility.js && node --check scripts/fixtures/mcp-stdio-smoke-server.mjs",
+    "check": "node --check run.js && node --check web.js && node --check bin/aginti-cli.js && node --check bin/aginti-public-research.js && node --check bin/aginti-safe-chat.js && node --check src/*.js && node --check src/mcp/*.js && node --check public/app.js && node --check scripts/postinstall-webapp.js && node --check scripts/seed-supervised-homework.js && node --check scripts/smoke-agentlink.js && node --check scripts/smoke-execution-policy.js && node --check scripts/smoke-mcp.js && node --check scripts/smoke-public-research-wrapper.js && node --check scripts/smoke-safe-chat.js && node --check scripts/smoke-web-ui.js && node --check scripts/smoke-scs-evidence-visibility.js && node --check scripts/fixtures/mcp-stdio-smoke-server.mjs",
     "setup:toolchain-docker": "scripts/setup-agent-toolchain-docker.sh",
     "smoke:coding-tools": "node scripts/smoke-coding-tools.js",
     "smoke:dynamic-step-budget": "node scripts/smoke-dynamic-step-budget.js",
+    "smoke:execution-policy": "node scripts/smoke-execution-policy.js",
     "smoke:aaps-adapter": "node scripts/smoke-aaps-adapter.js",
     "smoke:auxiliary-tools": "node scripts/smoke-auxiliary-tools.js",
     "smoke:auth": "node scripts/smoke-auth.js",
@@ -109,11 +127,14 @@
     "smoke:toolchain-docker": "node scripts/smoke-toolchain-docker.js",
     "smoke:inbox": "node scripts/smoke-inbox.js",
     "smoke:long-jobs": "node scripts/smoke-long-jobs.js",
+    "smoke:run-stdin": "node scripts/smoke-run-stdin.js",
     "smoke:mcp": "node scripts/smoke-mcp.js",
     "smoke:model-roles": "node scripts/smoke-model-roles.js",
     "smoke:platform": "node scripts/smoke-platform.js",
     "smoke:perception-research": "node scripts/smoke-perception-research.js",
     "smoke:permission-modes": "node scripts/smoke-permission-modes.js",
+    "smoke:public-research": "node scripts/smoke-public-research-wrapper.js",
+    "smoke:safe-chat": "node scripts/smoke-safe-chat.js",
     "smoke:runtime-compat": "node scripts/smoke-runtime-compat.js",
     "smoke:tmux-tools": "node scripts/smoke-tmux-tools.js",
     "smoke:web-api": "node scripts/smoke-web-api.js",
@@ -128,7 +149,7 @@
     "storage:migrate": "node bin/aginti-cli.js storage migrate",
     "publish:env": "node scripts/npm-publish-from-env.js publish --access public",
     "publish:env:whoami": "node scripts/npm-publish-from-env.js whoami",
-    "test": "npm run check && npm run smoke:runtime-compat && npm run smoke:autoupdate && npm run smoke:web-api && npm run smoke:web-ui && npm run smoke:web-autostart && npm run smoke:webapp-command && npm run smoke:web-port-fallback && npm run smoke:docker-command && npm run smoke:coding-tools && npm run smoke:dynamic-step-budget && npm run smoke:aaps-adapter && npm run smoke:auxiliary-tools && npm run smoke:perception-research && npm run smoke:auth && npm run smoke:agentlink && npm run smoke:canvas-artifacts && npm run smoke:capabilities && npm run smoke:mcp && npm run smoke:model-roles && npm run smoke:platform && npm run smoke:permission-modes && npm run smoke:skills && npm run smoke:skillmesh && npm run smoke:tmux-tools && npm run smoke:long-jobs && npm run smoke:cli-chat && npm run smoke:inbox",
+    "test": "npm run check && npm run smoke:runtime-compat && npm run smoke:autoupdate && npm run smoke:web-api && npm run smoke:web-ui && npm run smoke:web-autostart && npm run smoke:webapp-command && npm run smoke:web-port-fallback && npm run smoke:docker-command && npm run smoke:coding-tools && npm run smoke:dynamic-step-budget && npm run smoke:execution-policy && npm run smoke:aaps-adapter && npm run smoke:auxiliary-tools && npm run smoke:perception-research && npm run smoke:public-research && npm run smoke:safe-chat && npm run smoke:auth && npm run smoke:agentlink && npm run smoke:canvas-artifacts && npm run smoke:capabilities && npm run smoke:mcp && npm run smoke:model-roles && npm run smoke:platform && npm run smoke:permission-modes && npm run smoke:skills && npm run smoke:skillmesh && npm run smoke:tmux-tools && npm run smoke:long-jobs && npm run smoke:run-stdin && npm run smoke:cli-chat && npm run smoke:inbox",
     "pack:dry-run": "npm pack --dry-run",
     "smoke:capabilities": "node scripts/smoke-capabilities.js"
   },

package/public/app.js

@@ -2196,6 +2196,21 @@ function renderPlanEvent(entry) {
   `;
 }
 
+function renderExecutionEvent(entry) {
+  const data = entry.data || {};
+  const tier = data.tier || (entry.eventType === "plan.skipped" ? "focused" : "execution");
+  const reason = data.reason || entry.content || "";
+  return `
+    <article class="event-card event-focused">
+      <div class="event-card-meta">
+        <span>${escapeHtml(tier)}</span>
+        <span>${entry.at ? escapeHtml(new Date(entry.at).toLocaleString()) : ""}</span>
+      </div>
+      ${reason ? `<div class="chat-content">${escapeHtml(reason)}</div>` : ""}
+    </article>
+  `;
+}
+
 function embeddedWorkspaceChangesFromText(value = "") {
   const lines = String(value || "").split(/\r?\n/);
   const changes = [];
@@ -2376,6 +2391,7 @@ function renderStatusEvent(entry) {
 function renderStructuredEvent(entry) {
   const message = entry.message || entry.eventType || "";
   if (message === "plan.created") return renderPlanEvent(entry);
+  if (message === "plan.skipped" || message === "execution.policy_selected") return renderExecutionEvent(entry);
   if (message === "command.output") return renderCommandOutputLog(entry);
   if (message === "file.changed") return renderWorkspaceChangeEvent(entry);
   if (message === "tool.blocked" && entry.data?.permissionAdvice) return renderPermissionApproval(entry);
@@ -2396,6 +2412,7 @@ function renderStructuredEvent(entry) {
   }
   if (
     message === "budget.initialized" ||
+    message === "history.compacted_for_context_budget" ||
     message === "conversation.continued" ||
     message === "conversation.queued_input_applied" ||
     message === "session.finished" ||

package/public/styles.css

@@ -1594,10 +1594,21 @@ button.danger {
     linear-gradient(180deg, rgba(240, 253, 250, 0.9), rgba(255, 251, 235, 0.74));
 }
 
+.event-focused {
+  border-color: rgba(14, 165, 233, 0.34);
+  background:
+    radial-gradient(circle at 0% 0%, rgba(14, 165, 233, 0.15), transparent 28%),
+    linear-gradient(180deg, rgba(240, 249, 255, 0.9), rgba(240, 253, 250, 0.74));
+}
+
 #logs .event-plan {
   background: rgba(15, 23, 42, 0.58);
 }
 
+#logs .event-focused {
+  background: rgba(15, 23, 42, 0.58);
+}
+
 .event-patch {
   border-color: rgba(192, 132, 252, 0.38);
 }

package/references/agent-execution-policy-and-context-budget-2026-07-30.md

@@ -0,0 +1,70 @@
+# Agent Execution Policy and Context Budget Review
+
+Date: 2026-07-30
+
+## Goal
+
+Make AgInTiFlow fast for simple work and durable for complex work without turning isolated task examples into hard-coded behavior.
+
+## Sibling Evidence
+
+- Claw Code separates optional planning and effort controls from ordinary execution. Its runtime performs threshold-based automatic compaction and records removed-message metadata in `rust/crates/runtime/src/compact.rs`, `conversation.rs`, and `session.rs`.
+- Gemini CLI runs `ChatCompressionService` before long histories become unstable and exposes a configurable compression threshold in `packages/core/src/context/chatCompressionService.ts`, `core/client.ts`, and `config/config.ts`. It also keeps loop detection separate from compression.
+- Codex has model-context-window-aware automatic compaction, explicit token-budget guidance, and regression tests for repeated compaction and post-compaction growth in `codex-rs/core/tests/suite/compact.rs` and `token_budget.rs`.
+- AgInTi-OverTree added a useful external-agent boundary in `src/codex-agent.js`: process-group cancellation, structured event ingestion, resumable thread identity, and terminal-state persistence. Its `src/workspace-backend.js` also rejects path escape and symlink traversal. These mechanisms are reusable; paper-specific naming and UI modules are not.
+- Copilot SDK keeps session lifecycle, event transport, tool execution, and cancellation behind typed session APIs. The reusable lesson is lifecycle separation, not provider-specific session types.
+
+## AgInTiFlow Findings
+
+### System-level gaps
+
+1. Every non-greeting run made a separate planning model request, even when smart routing had already assigned a low complexity score.
+2. The default initial step budget remained 24 or more for simple focused tasks.
+3. History compaction only happened after a provider timeout. Long successful runs could carry repeated snapshots and tool results until latency or provider failure forced recovery.
+4. Execution decisions were distributed across model routing, SCS activation, parallel scouts, surgical context, and step budgets without one persisted execution-policy record.
+5. Task profiles declare tool groups, but the runtime still sends the full tool schema. Profile-aware tool-surface reduction remains a future system improvement.
+
+### Core-skill gaps
+
+- Long/background jobs already have a deterministic handoff tool and do not need another prompt-only workaround.
+- Writing, JSON, image/perception, MCP, AgentLink, and research specialists exist. Their main remaining issue is routing them through a smaller initial capability surface when the task is narrow.
+
+## Implemented Policy
+
+AgInTiFlow now selects one of two execution tiers:
+
+- `focused`: low-complexity work starts directly in the agent loop, skips a separate planning request, and defaults to at most 12 initial steps. Explicit user step limits are preserved.
+- `thorough`: complex routing, complexity score 3 or higher, SCS, and high-risk task profiles retain planning, scouts where applicable, dynamic budgets, and evidence validation.
+
+The runtime records `execution.policy_selected` and either `plan.created` or `plan.skipped`. This makes the decision visible in saved sessions, CLI output, and the web timeline.
+
+## Context Budget
+
+The runtime now estimates persisted message size before each model step.
+
+- Default mode: `auto`
+- Default threshold: 180,000 message characters
+- Default compact target: up to 60,000 characters
+- Environment controls:
+  - `AGINTI_CONTEXT_BUDGET_MODE=off|auto|on`
+  - `AGINTI_CONTEXT_BUDGET_CHARS=<positive integer>`
+  - `AGINTI_CONTEXT_TARGET_CHARS=<positive integer>`
+
+Compaction keeps:
+
+- system instructions;
+- the authoritative current goal;
+- original user requests;
+- current plan;
+- recent tool/model evidence;
+- current sandbox, task-profile, step, and browser state.
+
+It removes native tool-call/result history only after converting it into a compact evidence ledger. The runtime records before/after sizes in `history.compacted_for_context_budget`.
+
+## Next General Improvements
+
+1. Add profile-aware progressive tool disclosure. Begin with a small universal tool set and expose specialist/browser/MCP/tmux tools only when task routing or the model requests that capability.
+2. Replace character-only budgeting with provider usage tokens when usage metadata is available, retaining character estimation as a cross-provider fallback.
+3. Add loop/stall detection independent of step count: repeated identical tool calls, repeated equivalent failures, and no-evidence cycles should trigger strategy repair or a truthful blocker.
+
+These belong in AgInTiFlow core. Paper-specific editors, Xiaoyunque defaults, scientific protocols, and project output conventions remain custom skills or application adapters.

package/scripts/postinstall-webapp.js

@@ -1,12 +1,13 @@
 #!/usr/bin/env node
 import path from "node:path";
 import { fileURLToPath } from "node:url";
+import { shouldStartPostinstallWebApp } from "../src/postinstall-policy.js";
 import { ensureAgintiWebApp } from "../src/web-autostart.js";
 
 const packageDir = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const cwd = process.env.INIT_CWD || process.cwd();
 
-if (process.env.CI === "true" || process.env.AGINTIFLOW_SKIP_POSTINSTALL_WEBAPP === "1") {
+if (!shouldStartPostinstallWebApp(process.env)) {
   process.exit(0);
 }