@lazyingart/agintiflow 0.20.213 → 0.20.215

package/docs/supervision-campaign-ledger.md

@@ -130,3 +130,59 @@ checker exactly once, performed no file, canvas, commit, or push side effect,
 and completed with a clean repository-state check. The full npm suite and the
 focused dynamic-budget, SCS/model-role, and web-canvas regressions pass for
 AgInTiFlow `0.20.213`.
+
+### Java repair, permission pause, and durable artifact evidence
+
+`java-event-window-013` passed after exposing two runtime defects with a normal,
+underspecified Java repair prompt. DeepSeek correctly implemented decimal
+duration parsing, non-mutating percentile interpolation, deterministic window
+summaries, project guidance, and generated-output ignores. The first run then
+encountered a host permission blocker while invoking the checked-in test script.
+The runtime continued spending model and SCS turns instead of persisting a
+single actionable pause. After trusted-host approval, loose artifact inference
+also treated a generated test transcript as a mandatory deliverable, prompting
+the agent to create and commit an unrequested `docs/test-results.txt`.
+
+Permission advice that cannot auto-recover now stops the run immediately with
+durable resume data. Approval is single-use, and a resolved blocker cannot be
+replayed by a stale web request. Same-task continuation still preserves the
+original goal when an approval sentence precedes the continuation instruction.
+Artifact evidence from commands is accepted only when it names a supported,
+existing, nonempty path; removed files and label-only prose no longer satisfy
+completion. Exclusion language such as "ignore generated build and session
+outputs" no longer invents an artifact requirement.
+
+The queued correction was applied to the same live session, the stray transcript
+commit was removed, and the intended repair remains at target commit `f2792f3`.
+Independent verification passed the checked-in Java test script, the hidden
+event-window contract, generated-output tracking checks, clean-worktree checks,
+the focused permission/evidence regressions, and the complete AgInTiFlow npm
+suite.
+
+### Long-context memo synthesis and local visual verification
+
+`memo-full-context-pdf-014` used a normal, short writing prompt against a
+realistic interrupted chat export containing corrections, cancellations,
+deadlines, dependencies, completed work, publication boundaries, research
+ideas, and personal errands. The DeepSeek-backed writing agent read the full
+history and produced an editable two-page XeLaTeX/PDF memo instead of copying
+transport rows. Independent acceptance checked every critical commitment,
+rejected raw timestamps and internal identifiers, verified the PDF structure,
+and required a clean intentional commit.
+
+The first draft generalized a concrete Nutstore private-backup destination and
+left generated agent/perception directories unignored. The same durable session
+accepted those exact external findings, restored the actionable destination,
+added narrow generated-state ignores, rebuilt the PDF, inspected both rendered
+pages, and committed the correction as `a275878`. The hidden full-context
+checker, `qpdf`, `pdfinfo`, extracted-text review, independent page renders, and
+clean-worktree check then passed.
+
+The visual-review turn exposed a reusable provider-boundary defect: automatic
+`read_image` was blocked merely because DeepSeek was the active reasoning
+provider, even though the configured local image-perception handoff was safe
+and the perception runtime already supported it. Guardrails now allow the
+DeepSeek-to-LocalLLM handoff when local perception is enabled, continue to block
+hosted vision without explicit authorization, and block all automatic vision
+when both local and hosted routes are disabled. A focused regression covers the
+guard and the actual LocalLLM client route.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.213",
+  "version": "0.20.215",
   "type": "module",
   "description": "AgInTiFlow is a project-aware agent workspace for hybrid wet-dry R&D, hardware-aware intelligence, software automation, and industrial workflows.",
   "license": "Apache-2.0",

package/scripts/smoke-dynamic-step-budget.js

@@ -196,6 +196,74 @@ try {
     sourceRepairContract.requiredEvidence.some((item) => item.category === "file"),
     "an explicit source repair lost its file-change evidence gate"
   );
+  const ignoredGeneratedOutputsContract = deriveScsTaskContract({
+    goal: [
+      "You have explicit trusted-host approval for this isolated Java fixture.",
+      "Continue the same task from the current edits. Run the checked-in project test script, repair any failures,",
+      "create the required project guidance, ignore generated build and session outputs, commit only intentional work,",
+      "and finish with verified evidence.",
+    ].join(" "),
+    taskProfile: "java",
+  });
+  assert(
+    ignoredGeneratedOutputsContract.requiredEvidence.some((item) => item.category === "file") &&
+      ignoredGeneratedOutputsContract.requiredEvidence.some((item) => item.category === "command") &&
+      ignoredGeneratedOutputsContract.requiredEvidence.some((item) => item.category === "git") &&
+      !ignoredGeneratedOutputsContract.requiredEvidence.some((item) => item.category === "artifact"),
+    "ignoring generated build/session outputs invented a standalone artifact requirement"
+  );
+  const durableArtifactPath = path.join(workspace, "reports", "durable-report.pdf");
+  await fs.mkdir(path.dirname(durableArtifactPath), { recursive: true });
+  await fs.writeFile(durableArtifactPath, "%PDF-1.4\nsmoke\n", "utf8");
+  const artifactEvents = [
+    {
+      type: "tool.completed",
+      data: {
+        ok: true,
+        toolName: "run_command",
+        args: { command: "printf smoke > reports/durable-report.pdf" },
+        stdout: "created reports/durable-report.pdf",
+        exitCode: 0,
+      },
+    },
+  ];
+  const durableArtifactLedger = buildScsEvidenceLedger({
+    context: { events: artifactEvents, commandCwd: workspace },
+  });
+  assert(
+    durableArtifactLedger.categories.includes("artifact"),
+    "an existing shell-generated PDF did not count as durable artifact evidence"
+  );
+  await fs.rm(durableArtifactPath);
+  const removedArtifactLedger = buildScsEvidenceLedger({
+    context: { events: artifactEvents, commandCwd: workspace },
+  });
+  assert(
+    !removedArtifactLedger.categories.includes("artifact") &&
+      removedArtifactLedger.items.some((item) => item.category === "artifact" && item.verified === false),
+    "a removed artifact continued to satisfy the final evidence ledger"
+  );
+  const labelOnlyArtifactLedger = buildScsEvidenceLedger({
+    context: {
+      events: [
+        {
+          type: "tool.completed",
+          data: {
+            ok: true,
+            toolName: "run_command",
+            args: { command: "echo ARTIFACT READY" },
+            stdout: "ARTIFACT READY",
+            exitCode: 0,
+          },
+        },
+      ],
+      commandCwd: workspace,
+    },
+  });
+  assert(
+    !labelOnlyArtifactLedger.categories.includes("artifact"),
+    "an artifact label in generic shell text counted as a durable artifact"
+  );
   assert(
     completionEvidenceNeedsCommand({ missingProjectCommands: ["python analysis.py"] }),
     "a pending canonical command did not reopen command execution"

package/scripts/smoke-model-roles.js

@@ -1,5 +1,7 @@
 #!/usr/bin/env node
 import { spawn } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import {
@@ -1086,18 +1088,27 @@ assert(
   !missingWriterToolEval.ok && missingWriterToolEval.missingToolCalls.includes("writing_specialist"),
   "SCS should reject finish when required specialist call is missing"
 );
-const presentWriterToolEval = evaluateScsEvidence(
-  requiredWriterToolContract,
-  buildScsEvidenceLedger({
-    context: {
-      events: [
-        { type: "file.changed", data: { path: "final/story.md" } },
-        { type: "tool.completed", data: { toolName: "writing_specialist", ok: true, artifactPath: "artifacts/writer.json" } },
-      ],
-    },
-  })
-);
-assert(presentWriterToolEval.ok, "SCS should accept required specialist call when tool evidence is present");
+const writerEvidenceRoot = fs.mkdtempSync(path.join(os.tmpdir(), "aginti-writer-evidence-"));
+try {
+  const writerArtifactPath = path.join(writerEvidenceRoot, "artifacts", "writer.json");
+  fs.mkdirSync(path.dirname(writerArtifactPath), { recursive: true });
+  fs.writeFileSync(writerArtifactPath, JSON.stringify({ status: "completed" }), "utf8");
+  const presentWriterToolEval = evaluateScsEvidence(
+    requiredWriterToolContract,
+    buildScsEvidenceLedger({
+      context: {
+        commandCwd: writerEvidenceRoot,
+        events: [
+          { type: "file.changed", data: { path: "final/story.md" } },
+          { type: "tool.completed", data: { toolName: "writing_specialist", ok: true, artifactPath: writerArtifactPath } },
+        ],
+      },
+    })
+  );
+  assert(presentWriterToolEval.ok, "SCS should accept required specialist call when tool evidence is present");
+} finally {
+  fs.rmSync(writerEvidenceRoot, { recursive: true, force: true });
+}
 
 const blockedFileFinish = await reviewScsFinish(
   { mock: true },

package/scripts/smoke-perception-research.js

@@ -83,6 +83,36 @@ async function verifyProviderBoundary({ pngPath, store, config }) {
       config: { ...config, provider: "localllm", allowHostedImagePerception: false },
     });
     assert(!guardedImage.allowed, "guardrails allowed unapproved hosted image perception");
+    const guardedDeepSeekLocalHandoff = checkToolUse({
+      toolName: "read_image",
+      args: { path: path.relative(config.commandCwd, pngPath) },
+      snapshot: { elements: [] },
+      config: {
+        ...config,
+        provider: "deepseek",
+        allowLocalImagePerception: true,
+        allowHostedImagePerception: false,
+      },
+    });
+    assert(
+      guardedDeepSeekLocalHandoff.allowed,
+      "guardrails blocked the safe DeepSeek-to-LocalLLM image handoff"
+    );
+    const blockedDeepSeekWithoutHandoff = checkToolUse({
+      toolName: "read_image",
+      args: { path: path.relative(config.commandCwd, pngPath) },
+      snapshot: { elements: [] },
+      config: {
+        ...config,
+        provider: "deepseek",
+        allowLocalImagePerception: false,
+        allowHostedImagePerception: false,
+      },
+    });
+    assert(
+      !blockedDeepSeekWithoutHandoff.allowed,
+      "guardrails allowed auto image perception after every backend handoff was disabled"
+    );
     const guardedResearch = checkToolUse({
       toolName: "web_research",
       args: { query: "provider boundary smoke", mode: "openai" },

package/scripts/smoke-scs-evidence-visibility.js

@@ -152,38 +152,50 @@ const finishDecision = await reviewScsFinish(
 assert.equal(finishDecision.decision, "finish_allowed", "SCS should not reject finish as no-evidence when the contract ledger is satisfied");
 assert.match(finishDecision.reason, /Overrode a no-evidence finish rejection/);
 
-const researchReportLedger = buildScsEvidenceLedger({
-  context: {
-    events: [{
-      type: "tool.completed",
-      data: {
-        ok: true,
-        toolName: "deep_research",
-        status: "completed",
-        reportPath: "/workspace/reports/cited-research.md",
-        artifactPath: "/session/artifacts/deep-research.json",
-        coverage: {
-          verifiedClaimCount: 12,
-          quoteVerificationRate: 1,
-        },
-        audit: {
-          citationCoverage: 1,
-          unknownEvidenceIds: [],
+const researchEvidenceRoot = fs.mkdtempSync(path.join(os.tmpdir(), "aginti-research-evidence-"));
+try {
+  const reportPath = path.join(researchEvidenceRoot, "reports", "cited-research.md");
+  const artifactPath = path.join(researchEvidenceRoot, "artifacts", "deep-research.json");
+  fs.mkdirSync(path.dirname(reportPath), { recursive: true });
+  fs.mkdirSync(path.dirname(artifactPath), { recursive: true });
+  fs.writeFileSync(reportPath, "# Cited research\n\nVerified report fixture.\n", "utf8");
+  fs.writeFileSync(artifactPath, JSON.stringify({ status: "completed" }), "utf8");
+
+  const researchReportLedger = buildScsEvidenceLedger({
+    context: {
+      events: [{
+        type: "tool.completed",
+        data: {
+          ok: true,
+          toolName: "deep_research",
+          status: "completed",
+          reportPath,
+          artifactPath,
+          coverage: {
+            verifiedClaimCount: 12,
+            quoteVerificationRate: 1,
+          },
+          audit: {
+            citationCoverage: 1,
+            unknownEvidenceIds: [],
+          },
         },
-      },
-    }],
-  },
-});
-assert(
-  ["file", "command", "artifact"].every((category) => researchReportLedger.categories.includes(category)),
-  "a completed and audited deep-research report did not satisfy file, validation-command, and artifact evidence categories"
-);
-assert(
-  researchReportLedger.items.some(
-    (item) => item.category === "command" && /deterministic audit completed/.test(item.proof)
-  ),
-  "deep-research validation evidence did not preserve its deterministic audit provenance"
-);
+      }],
+    },
+  });
+  assert(
+    ["file", "command", "artifact"].every((category) => researchReportLedger.categories.includes(category)),
+    "a completed and audited deep-research report did not satisfy file, validation-command, and artifact evidence categories"
+  );
+  assert(
+    researchReportLedger.items.some(
+      (item) => item.category === "command" && /deterministic audit completed/.test(item.proof)
+    ),
+    "deep-research validation evidence did not preserve its deterministic audit provenance"
+  );
+} finally {
+  fs.rmSync(researchEvidenceRoot, { recursive: true, force: true });
+}
 
 const recoverableLedger = buildScsEvidenceLedger({
   context: {

package/scripts/smoke-truthful-completion.js

@@ -233,6 +233,29 @@ try {
     "same-task resume used the new-request boundary marker"
   );
 
+  const prefixedSameTaskContinuation = await runCase({
+    id: "ordinary-explanation",
+    goal: [
+      "You have explicit trusted-host approval for this isolated fixture.",
+      "Continue the same task from the current edits. Finish it with verified evidence.",
+    ].join(" "),
+    resume: true,
+    responses: [assistant("A base case remains the condition that terminates recursive expansion.")],
+  });
+  const prefixedContinuationEvent = [...prefixedSameTaskContinuation.events]
+    .reverse()
+    .find((event) => event.type === "conversation.continued");
+  assert.equal(
+    prefixedContinuationEvent?.data?.preservesTaskBoundary,
+    true,
+    "a same-task continuation prefixed by a permission statement opened a new task boundary"
+  );
+  assert.equal(
+    prefixedSameTaskContinuation.state.meta?.goalContract?.taskGoal,
+    "Explain why recursion needs a base case.",
+    "a prefixed same-task continuation replaced the durable task goal"
+  );
+
   const quotedChatClassification = await runCase({
     id: "quoted-chat-classification",
     taskProfile: "chatops",
@@ -266,6 +289,36 @@ try {
   assert.equal(proseOnlyAction.events.filter((event) => event.type === "completion.evidence_rejected").length, 2);
   assert(!proseOnlyAction.events.some((event) => event.type === "session.finished"));
 
+  const permissionPause = await runCase({
+    id: "permission-pause",
+    goal: "Run the checked-in project test script and report its verified result.",
+    taskProfile: "java",
+    allowShellTool: true,
+    scsActive: true,
+    setup: async (workspace) => {
+      await fs.mkdir(path.join(workspace, "scripts"), { recursive: true });
+      await fs.writeFile(path.join(workspace, "scripts", "test.sh"), "#!/usr/bin/env bash\necho pass\n", "utf8");
+    },
+    responses: [
+      assistant("", [toolCall("permission-test", "run_command", { command: "bash scripts/test.sh" })]),
+    ],
+  });
+  assert.equal(permissionPause.calls.length, 1, "permission blocker consumed another model turn");
+  assert.equal(permissionPause.result.stopped, true);
+  assert.equal(permissionPause.result.reason, "permission_required");
+  assert(permissionPause.result.permissionAdvice?.suggestedCommand, "permission pause lost its exact resume command");
+  assert.equal(
+    permissionPause.events.filter((event) => event.type === "session.stopped" && event.data?.reason === "permission_required").length,
+    1,
+    "permission blocker did not persist exactly one paused state"
+  );
+  assert(
+    !permissionPause.events.some((event) =>
+      ["scs.student.rethink_plan", "scs.student.reject_phase", "scs.committee.replan_drafted"].includes(event.type)
+    ),
+    "permission blocker triggered an SCS replan instead of waiting for approval"
+  );
+
   const reasoningTruncation = await runCase({
     id: "reasoning-only-tool-continuation",
     goal: "Run pwd and report the verified working directory.",
@@ -371,12 +424,12 @@ try {
 
   const approvalNarrativeWithBlockerEvidence = await runCase({
     id: "approval-narrative-with-blocker-evidence",
-    goal: "Run definitely_missing_aginti_command and report the result.",
+    goal: "Run which definitely_missing_aginti_command and report the result.",
     taskProfile: "shell",
     allowShellTool: true,
     responses: [
       assistant("", [
-        toolCall("missing-command", "run_command", { command: "definitely_missing_aginti_command" }),
+        toolCall("missing-command", "run_command", { command: "which definitely_missing_aginti_command" }),
       ]),
       assistant("The command is unavailable. Approve installing it and I will continue after approval."),
       assistant("Unable to execute the requested command because it is not installed in this environment."),
@@ -695,11 +748,11 @@ try {
 
   const verifiedBlocker = await runCase({
     id: "verified-blocker",
-    goal: "Execute the shell command definitely_not_an_aginti_command and report the result.",
+    goal: "Run which definitely_not_an_aginti_command and report the result.",
     taskProfile: "shell",
     allowShellTool: true,
     responses: [
-      assistant("", [toolCall("run-blocked", "run_command", { command: "definitely_not_an_aginti_command" })]),
+      assistant("", [toolCall("run-blocked", "run_command", { command: "which definitely_not_an_aginti_command" })]),
       assistant("", [
         toolCall("finish-blocked", "finish", {
           result: "Unable to execute the requested command because it is not installed in this environment.",

package/scripts/smoke-web-api.js

@@ -64,11 +64,12 @@ async function waitForHealth() {
   throw new Error(`web server did not become healthy. stdout=${stdout.slice(-500)} stderr=${stderr.slice(-500)}`);
 }
 
-async function waitForRun(sessionId) {
+async function waitForRun(sessionId, terminalStatuses = ["finished", "failed"]) {
+  const acceptedStatuses = new Set(terminalStatuses);
   const deadline = Date.now() + 20000;
   while (Date.now() < deadline) {
     const run = await fetchJson(`/api/runs/${encodeURIComponent(sessionId)}`);
-    if (run.status === "finished" || run.status === "failed") return run;
+    if (acceptedStatuses.has(run.status)) return run;
     await delay(400);
   }
   throw new Error(`run ${sessionId} did not finish in time`);
@@ -548,7 +549,10 @@ try {
       headless: true,
     }),
   });
-  const approvalRaceBlocked = await waitForRun(approvalRaceStart.sessionId);
+  const approvalRaceBlocked = await waitForRun(approvalRaceStart.sessionId, ["stopped", "failed"]);
+  if (approvalRaceBlocked.status !== "stopped") {
+    throw new Error(`permission/message race fixture did not stop for approval: ${approvalRaceBlocked.status}`);
+  }
   if (!approvalRaceBlocked.logs?.some((entry) => entry.message === "tool.blocked" && entry.data?.permissionAdvice)) {
     throw new Error("permission/message race fixture did not produce pending permission advice");
   }
@@ -595,7 +599,10 @@ try {
       headless: true,
     }),
   });
-  const safeRun = await waitForRun(safeRunStart.sessionId);
+  const safeRun = await waitForRun(safeRunStart.sessionId, ["stopped", "failed"]);
+  if (safeRun.status !== "stopped") {
+    throw new Error(`safe mode web run did not stop for approval: ${safeRun.status}`);
+  }
   if (!safeRun.logs?.some((entry) => entry.message === "tool.blocked" && entry.data?.permissionAdvice?.category === "workspace-write")) {
     throw new Error("safe mode web run did not expose workspace-write permission advice");
   }
@@ -630,6 +637,14 @@ try {
   if (!safeApproved.includes("Created by AgInTiFlow mock mode.")) {
     throw new Error("permission-approved continuation did not create the requested file");
   }
+  const staleApproval = await fetch(`${baseUrl}/api/sessions/${encodeURIComponent(safeRunStart.sessionId)}/approve-permission`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ action: "once" }),
+  });
+  if (staleApproval.status !== 404) {
+    throw new Error(`resolved permission advice remained reusable: ${staleApproval.status}`);
+  }
   await fetchJson("/api/preferences", {
     method: "POST",
     headers: { "Content-Type": "application/json" },

package/src/agent-runner.js

@@ -2216,7 +2216,7 @@ function isGenericTaskContinuationText(value = "") {
   const normalized = String(value || "").replace(/\s+/g, " ").trim();
   if (!normalized || normalized.length > 600) return false;
   const explicitSameTaskContinuation =
-    /^(?:(?:please|kindly)\s+)?(?:continue|resume|keep\s+working|finish|complete)\b.{0,180}\b(?:same|current|previous|existing|retained|saved|unfinished)\b.{0,80}\b(?:task|work|run|session|job|state)\b/i.test(normalized);
+    /(?:^|[.!?]\s+)(?:(?:please|kindly)\s+)?(?:continue|resume|keep\s+working|finish|complete)\b.{0,180}\b(?:same|current|previous|existing|retained|saved|unfinished)\b.{0,80}\b(?:task|work|run|session|job|state)\b/i.test(normalized);
   return explicitSameTaskContinuation || /^(?:(?:please|kindly)\s+)?(?:continue|resume|finish|complete|keep\s+working)(?:\s+(?:and\s+)?(?:continue|finish|complete|working))?(?:\s+(?:the\s+)?(?:same|current|previous|existing|retained|saved|unfinished)\s+(?:task|work|run|session|job))?(?:\s+from\s+(?:the\s+)?(?:retained|saved|current|previous)\s+state)?[.!?]*$/i.test(normalized) ||
     /^(?:请)?(?:继续|接着|恢复|完成)(?:之前|上次|当前|同一|这个)?(?:的)?(?:任务|工作|会话|进度)?(?:并完成)?[。！？.!?]*$/u.test(normalized) ||
     /^(?:このまま|前回から|保存した状態から)?(?:同じ|現在の|前の)?(?:タスク|作業|セッション)?(?:を)?(?:続けて|再開して|完了して)(?:ください)?[。！？.!?]*$/u.test(normalized);
@@ -2907,6 +2907,14 @@ export function shouldShortCircuitToolBatch(toolResult) {
   );
 }
 
+export function shouldPauseForPermissionAdvice(toolResult = {}) {
+  return Boolean(
+    toolResult?.blocked &&
+      toolResult?.permissionAdvice &&
+      toolResult.permissionAdvice.autoRecover !== true
+  );
+}
+
 export function skippedAfterBlockedToolResult(toolCall, blockedResult) {
   const toolName = toolCall?.function?.name || "unknown";
   const args = sanitizeToolArgs(toolName, safeParseToolArgs(toolCall));
@@ -6441,6 +6449,51 @@ async function stopForMissingCompletionEvidence({ config, state, store, observer
   };
 }
 
+async function stopForPermissionAdvice({ config, state, store, observers, sessionId, step, toolResult }) {
+  const advice = toolResult?.permissionAdvice && typeof toolResult.permissionAdvice === "object"
+    ? toolResult.permissionAdvice
+    : {};
+  const result = [
+    advice.summary || toolResult?.reason || "The requested action needs a stronger permission mode.",
+    advice.instruction || "Resume after approving the required mode or choose a safer alternative.",
+    advice.suggestedCommand ? `Contained resume: ${advice.suggestedCommand}` : "",
+    advice.trustedHostCommand ? `Trusted-host resume: ${advice.trustedHostCommand}` : "",
+  ].filter(Boolean).join("\n");
+  const detail = {
+    step,
+    toolName: toolResult?.toolName || "",
+    category: toolResult?.category || advice.category || "permission-required",
+    reason: toolResult?.reason || advice.reason || "",
+    permissionAdvice: advice,
+  };
+  state.stepsCompleted = step;
+  state.updatedAt = new Date().toISOString();
+  state.meta = state.meta || {};
+  state.meta.pendingPermissionAdvice = detail;
+  updateGoalStatus(state, "paused", "permission_required", state.updatedAt);
+  await store.appendEvent("session.stopped", {
+    reason: "permission_required",
+    step,
+    detail,
+  });
+  observers.event("session.stopped", {
+    reason: "permission_required",
+    sessionId,
+    toolName: detail.toolName,
+    category: detail.category,
+  });
+  await store.saveState(state);
+  emitConsole(config, result, { kind: "error", error: true });
+  return {
+    sessionId,
+    result,
+    stopped: true,
+    reason: "permission_required",
+    permissionAdvice: advice,
+    ...goalRunMetadata(state),
+  };
+}
+
 export function resetPerTurnToolContractState(state = {}, at = new Date().toISOString()) {
   const prior = state.meta?.toolContractViolation;
   if (!prior) return null;
@@ -8040,6 +8093,7 @@ export async function runAgent(config) {
 
       let continueForQueuedInput = false;
       let continueForCompletionRepair = false;
+      let pendingPermissionPause = null;
       const postBatchToolResults = [];
       for (let toolIndex = 0; toolIndex < toolCalls.length; toolIndex += 1) {
         const toolCall = toolCalls[toolIndex];
@@ -8128,6 +8182,7 @@ export async function runAgent(config) {
               priorBlockedTool: skippedResult.priorBlockedTool,
             });
           }
+          if (shouldPauseForPermissionAdvice(toolResult)) pendingPermissionPause = toolResult;
           break;
         }
 
@@ -8256,6 +8311,18 @@ export async function runAgent(config) {
         }
       }
 
+      if (pendingPermissionPause) {
+        return await stopForPermissionAdvice({
+          config,
+          state,
+          store,
+          observers,
+          sessionId,
+          step,
+          toolResult: pendingPermissionPause,
+        });
+      }
+
       if (continueForCompletionRepair) continue;
 
       for (const toolResult of postBatchToolResults) {

package/src/guardrails.js

@@ -230,11 +230,12 @@ export function checkToolUse({ toolName, args, snapshot, config }) {
       !args.dryRun &&
       ["", "auto", "default"].includes(provider) &&
       !["localllm", "openai"].includes(activeProvider) &&
+      config.allowLocalImagePerception === false &&
       config.allowHostedImagePerception !== true
     ) {
       return {
         allowed: false,
-        reason: `No automatic image-reading backend is enabled for active provider ${activeProvider}. Select localllm or explicitly enable a hosted image backend.`,
+        reason: `No automatic image-reading backend is enabled for active provider ${activeProvider}. Enable the local image-perception handoff, select localllm, or explicitly enable a hosted image backend.`,
         category: "perception-tools",
       };
     }

package/src/model-client.js

@@ -85,7 +85,11 @@ function mockToolCall(name, args = {}) {
 
 function latestToolPayload(messages) {
   for (const message of [...messages].reverse()) {
-    if (message.role === "user" && /^Continue with this new request:|^Goal:/i.test(String(message.content || ""))) {
+    const userContent = String(message.content || "");
+    if (
+      message.role === "user" &&
+      /^(?:Continue with this new request:|Continue the current task from saved state:|Goal:)/i.test(userContent)
+    ) {
       return null;
     }
     if (message.role !== "tool" || !message.content) continue;

package/src/scs-evidence.js

@@ -580,6 +580,10 @@ function inferRequirementCategories(goal = "", taskProfile = "", acceptanceCrite
       /\b(?:clean(?:\s+up)?|remove|delete|clear|purge)\b[^.\n;]{0,120}\b(?:generated|temporary|stale|test)?\s*(?:test\s+)?(?:debris|caches?|byproducts?)\b/gi,
       ""
     )
+    .replace(
+      /\b(?:ignore|exclude|omit|skip|leave\s+out)\b[^.\n;]{0,160}\b(?:generated|temporary|stale|build|session)\b[^.\n;]{0,100}\b(?:outputs?|artifacts?|files?|directories?|folders?)\b/gi,
+      ""
+    )
     .replace(/\bfigure\s+out\b/gi, "");
   const mandatoryEvidenceText = artifactSignalText.replace(
     /[^.\n]{0,240}\b(?:as appropriate|if appropriate|when useful|where applicable)\b/gi,
@@ -2172,6 +2176,7 @@ function eventToEvidence(event = {}) {
       target: data.path || data.artifactId || data.outputPath || "",
       proof: type,
       verified: true,
+      virtualArtifact: Boolean(data.artifactId && !data.path && !data.outputPath),
     });
     if (type === "image.generated") {
       evidence.push({
@@ -2280,16 +2285,31 @@ function toolPayloadToEvidence(payload = {}, source = "tool") {
   if (["open_url", "click", "type", "scroll", "press", "back"].includes(toolName) || /\b(browser|chrome|cdp|playwright|selenium|upload|attach|submit|click|tab|page)\b/.test(text)) {
     push("browser", `${toolName || "browser tool"} affected or inspected browser/UI state`, payload.url || args.url || args.command || "");
   }
-  if (
-    ["open_workspace_file", "preview_workspace", "send_to_canvas", "generate_image", "read_image", "writing_specialist", "json_specialist", "json_specialist_batch"].includes(
-      toolName
-    ) ||
-    payload.artifactId ||
-    payload.outputPath ||
-    payload.artifactPath ||
-    /\b(pdf|png|jpg|jpeg|image|video|screenshot|artifact|preview)\b/.test(text)
-  ) {
-    push("artifact", `${toolName || "tool"} produced or inspected an artifact`, payload.path || payload.outputPath || payload.artifactPath || args.path || "");
+  const artifactTools = new Set([
+    "open_workspace_file",
+    "preview_workspace",
+    "send_to_canvas",
+    "generate_image",
+    "read_image",
+    "writing_specialist",
+    "json_specialist",
+    "json_specialist_batch",
+  ]);
+  const artifactPath = firstArtifactPath(
+    payload.artifactPath,
+    payload.outputPath,
+    payload.reportPath,
+    payload.path,
+    args.path,
+    text
+  );
+  if (artifactTools.has(toolName) || payload.artifactId || artifactPath) {
+    push(
+      "artifact",
+      `${toolName || "tool"} produced or inspected an artifact`,
+      artifactPath || payload.artifactId || "",
+      { virtualArtifact: Boolean(payload.artifactId && !artifactPath) }
+    );
   }
   if (["read_image", "generate_image"].includes(toolName) || /\b(screenshot|visible|thumbnail|preview|image)\b/.test(text)) {
     push("visual", `${toolName || "tool"} supplied visual evidence`, payload.path || payload.outputPath || args.path || "");
@@ -2313,6 +2333,59 @@ function toolPayloadToEvidence(payload = {}, source = "tool") {
   return evidence;
 }
 
+const ARTIFACT_EXTENSION_PATTERN = /\.(?:md|json|csv|txt|html?|tex|pdf|docx|pptx|xlsx|png|jpe?g|webp|svg|mp4|mov|mkv|webm|wav|mp3|flac|zip|7z|tar|gz|step|stp|stl|3mf)$/i;
+const ARTIFACT_PATH_PATTERN = /(?:^|[\s"'`(=])([^\s"'`()=]+\.(?:md|json|csv|txt|html?|tex|pdf|docx|pptx|xlsx|png|jpe?g|webp|svg|mp4|mov|mkv|webm|wav|mp3|flac|zip|7z|tar|gz|step|stp|stl|3mf))(?:$|[\s"'`),;:])/i;
+
+function firstArtifactPath(...values) {
+  for (const value of values) {
+    const candidate = String(value || "").trim();
+    if (!candidate) continue;
+    if (!/\s/.test(candidate) && ARTIFACT_EXTENSION_PATTERN.test(candidate)) {
+      return candidate;
+    }
+    const match = candidate.match(ARTIFACT_PATH_PATTERN);
+    if (match?.[1]) return match[1];
+  }
+  return "";
+}
+
+function revalidateArtifactEvidence(item = {}, state = {}, context = {}) {
+  if (item?.category !== "artifact" || item?.verified === false || item?.virtualArtifact === true) return item;
+  const candidate = firstArtifactPath(item.target, item.proof);
+  if (!candidate) {
+    return item.toolName === "run_command"
+      ? {
+          ...item,
+          verified: false,
+          proof: `${item.proof || "artifact evidence"}; no durable artifact path was reported`,
+        }
+      : item;
+  }
+  const commandCwd = String(
+    context.commandCwd ||
+      state.commandCwd ||
+      state.meta?.runtimeConfig?.commandCwd ||
+      process.cwd()
+  );
+  const resolved = path.isAbsolute(candidate) ? candidate : path.resolve(commandCwd, candidate);
+  let durable = false;
+  try {
+    const stat = fs.statSync(resolved);
+    durable = stat.isDirectory() || (stat.isFile() && stat.size > 0);
+  } catch {
+    durable = false;
+  }
+  return {
+    ...item,
+    target: candidate,
+    resolvedTarget: resolved,
+    verified: durable,
+    proof: durable
+      ? item.proof
+      : `${item.proof || "artifact evidence"}; artifact path no longer exists or is empty`,
+  };
+}
+
 function messageToEvidence(message = {}) {
   if (message.role !== "tool") return [];
   try {
@@ -2327,9 +2400,12 @@ export function buildScsEvidenceLedger({ state = {}, context = {} } = {}) {
   const messages = Array.isArray(state.messages) ? state.messages : [];
   const eventEvidence = events.flatMap(eventToEvidence);
   const messageEvidence = messages.flatMap(messageToEvidence);
-  const items = [...eventEvidence, ...messageEvidence].slice(-80);
-  const categories = unique(items.map((item) => item.category));
-  const toolNames = unique(items.map((item) => item.toolName).filter(Boolean));
+  const items = [...eventEvidence, ...messageEvidence]
+    .slice(-80)
+    .map((item) => revalidateArtifactEvidence(item, state, context));
+  const verifiedItems = items.filter((item) => item?.verified !== false);
+  const categories = unique(verifiedItems.map((item) => item.category));
+  const toolNames = unique(verifiedItems.map((item) => item.toolName).filter(Boolean));
   const blockers = [...events.map(eventToBlocker), ...messages.map(messageToBlocker)]
     .filter(Boolean)
     .slice(-20)

package/web.js

@@ -1367,6 +1367,17 @@ async function ensureNotRunning(sessionId) {
 }
 
 async function latestPermissionAdvice(sessionId) {
+  const events = await sessionStore(sessionId).loadEvents().catch(() => []);
+  for (const event of [...events].reverse()) {
+    if (["permission.approval_granted", "permission.approval_declined"].includes(event.type)) return null;
+    if (event.type === "tool.blocked" && event.data?.permissionAdvice) {
+      return {
+        ...event.data.permissionAdvice,
+        category: event.data.permissionAdvice.category || event.data.category || "",
+      };
+    }
+  }
+
   const inMemory = runs.get(sessionId);
   const memoryEntry = [...(inMemory?.logs || [])]
     .reverse()
@@ -1378,13 +1389,7 @@ async function latestPermissionAdvice(sessionId) {
     };
   }
 
-  const events = await sessionStore(sessionId).loadEvents().catch(() => []);
-  const event = [...events].reverse().find((candidate) => candidate.type === "tool.blocked" && candidate.data?.permissionAdvice);
-  if (!event?.data?.permissionAdvice) return null;
-  return {
-    ...event.data.permissionAdvice,
-    category: event.data.permissionAdvice.category || event.data.category || "",
-  };
+  return null;
 }
 
 function permissionApprovalPrompt(action, advice = {}, originalGoal = "") {
@@ -2421,6 +2426,12 @@ app.post("/api/sessions/:sessionId/approve-permission", async (req, res) => {
         source: "web",
         category: advice.category || "",
       });
+      const state = await store.loadState();
+      if (state?.meta?.pendingPermissionAdvice) {
+        delete state.meta.pendingPermissionAdvice;
+        state.updatedAt = new Date().toISOString();
+        await store.saveState(state);
+      }
       const existing = runs.get(sessionId);
       if (existing) {
         existing.logs.push({
@@ -2473,6 +2484,11 @@ app.post("/api/sessions/:sessionId/approve-permission", async (req, res) => {
       category: advice.category || "",
       permissionMode: targetMode,
     });
+    if (state.meta?.pendingPermissionAdvice) {
+      delete state.meta.pendingPermissionAdvice;
+      state.updatedAt = new Date().toISOString();
+      await store.saveState(state);
+    }
 
     const stored = await loadStoredRun(sessionId);
     if (runs.get(sessionId)?.status === "running") {