@lazyingart/agintiflow 0.20.215 → 0.20.216

package/docs/supervision-campaign-ledger.md

@@ -186,3 +186,52 @@ DeepSeek-to-LocalLLM handoff when local perception is enabled, continue to block
 hosted vision without explicit authorization, and block all automatic vision
 when both local and hosted routes are disabled. A focused regression covers the
 guard and the actual LocalLLM client route.
+
+### SQLite migration and literal-query safety
+
+`database-migration-safety-015` passed on AgInTiFlow `0.20.215` from a normal,
+imperfect maintenance prompt. The DeepSeek-backed database profile diagnosed a
+destructive version-1 migration, `INSERT OR REPLACE` identity loss, and unsafe
+`LIKE` semantics. In one retained session it replaced the migration with an
+in-place transaction, preserved item IDs, tags, and relationships, used an
+identity-preserving UPSERT, escaped `%`, `_`, and backslashes as literal search
+text, added regression tests, and committed target repair `fb97fbd`.
+
+The run also exercised recovery behavior without a supervisor rescue prompt.
+DeepSeek initially requested too many tools in one turn; the contract guard
+rejected that batch and the next turn continued with allowed calls. Later, a
+noncanonical `TEST_EXIT:0` shell suffix confused project-test evidence despite
+five passing tests. The agent recognized the discrepancy, reran the canonical
+README command, obtained `passed:true`, cleaned transient Python artifacts, and
+finished normally. No AgInTiFlow product patch was required for this scenario.
+
+Independent acceptance used
+`supervision/acceptance/database_migration_safety_contract.py` to verify legacy
+IDs `7`, `12`, and `19`, tag relationships, schema columns, foreign keys,
+idempotent reopening, stable URL updates, literal punctuation, archive
+filtering, absence of destructive SQL, intentional commit history, and a clean
+worktree. The hidden contract passed.
+
+### Shell grammar, mutation revision, and output provenance hardening
+
+The next campaign phase exercised completion evidence under realistic compound
+commands, multiline acceptance criteria, delegated test runners, Git workflows,
+and pre-existing output files. The reusable repair centralizes shell
+canonicalization, command classification, Git-action intent, and evidence
+tracking instead of adding project- or prompt-specific branches. In particular,
+escaped line continuations and heredocs are parsed structurally; read-only test
+evidence is separated from write capability; later mutations invalidate stale
+validation; commit, pull-request, tag, and push evidence must occur in the
+requested order; and exact output files count only when the current required
+generator created or changed them.
+
+Five independent review rounds found and drove regressions for inline mutation
+batches, stale opaque validators, Git grammar and ordering, zero-test runners,
+external executable paths, arithmetic shifts mistaken for heredocs, multiline
+command substitutions, stale exact outputs, and ambiguous Git nouns such as
+"commit message" or "branch diagram". A final fresh hosted Codex review was
+blocked by its rolling quota and the DeepSeek review route was blocked by
+provider balance. A separate read-only `localllm-deep` review completed with no
+actionable findings. The full `npm test` suite, focused dynamic-step-budget,
+coding-tools, SCS-evidence, and syntax checks all pass before packaging
+AgInTiFlow `0.20.216`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.215",
+  "version": "0.20.216",
   "type": "module",
   "description": "AgInTiFlow is a project-aware agent workspace for hybrid wet-dry R&D, hardware-aware intelligence, software automation, and industrial workflows.",
   "license": "Apache-2.0",

package/scripts/smoke-coding-tools.js

@@ -19,7 +19,7 @@ import {
 import { formatBehaviorContractForPrompt } from "../src/behavior-contract.js";
 import { resolveRuntimeConfig } from "../src/config.js";
 import { readCodebaseMap } from "../src/codebase-map.js";
-import { evaluateCommandPolicy } from "../src/command-policy.js";
+import { classifyCommand, evaluateCommandPolicy } from "../src/command-policy.js";
 import { shouldReviewToolResult } from "../src/scs-controller.js";
 import {
   engineeringGuidanceForTask,
@@ -328,6 +328,39 @@ try {
     packageInstallPolicy: "block",
     commandCwd: workspace,
   });
+  const opaqueInPlaceEditPolicy = evaluateCommandPolicy("sed -i 's/old/new/' report.md", {
+    allowShellTool: true,
+    sandboxMode: "host",
+    packageInstallPolicy: "block",
+    commandCwd: workspace,
+    allowDestructive: true,
+  });
+  assert(
+    opaqueInPlaceEditPolicy.writesWorkspace === true,
+    "an unknown host shell edit was incorrectly classified as read-only"
+  );
+  const destructiveGitPolicy = evaluateCommandPolicy("git reset --hard HEAD~1", {
+    allowShellTool: true,
+    sandboxMode: "host",
+    packageInstallPolicy: "block",
+    commandCwd: workspace,
+    allowDestructive: true,
+  });
+  assert(
+    destructiveGitPolicy.category === "destructive" &&
+      destructiveGitPolicy.writesWorkspace === true,
+    "a destructive git command was not classified as a workspace mutation"
+  );
+  const safeTagPolicy = evaluateCommandPolicy("git tag v0.20.216", {
+    allowShellTool: true,
+    sandboxMode: "host",
+    packageInstallPolicy: "block",
+    commandCwd: workspace,
+  });
+  assert(
+    safeTagPolicy.allowed && safeTagPolicy.category === "git-workflow" && safeTagPolicy.writesWorkspace,
+    "a bounded local git tag was not classified as a git workflow action"
+  );
   assert(boundedRgPolicy.allowed, "targeted bounded rg should remain allowed");
   const boundedAdvice = buildPermissionAdvice({
     toolName: "run_command",
@@ -692,6 +725,53 @@ try {
   const actualDangerAfterQuotePolicy = evaluateCommandPolicy('echo "rm -rf is text" && rm -rf reports', dockerWorkspacePolicy);
   assert(!actualDangerAfterQuotePolicy.allowed, "actual destructive command after quoted text should still be blocked");
   assert(actualDangerAfterQuotePolicy.category === "destructive", "actual destructive command after quoted text was not classified as destructive");
+  for (const command of [
+    "npm test &",
+    "npm test & sed -i 's/old/new/' report.md",
+  ]) {
+    const classification = classifyCommand(command);
+    const policy = evaluateCommandPolicy(command, hostWorkspacePolicy);
+    assert(
+      !policy.allowed &&
+        classification.category !== "test" &&
+        classification.substantiveTest !== true &&
+        classification.writesWorkspace === true,
+      `background execution bypassed bounded test policy: ${command}`
+    );
+  }
+  const backgroundPublishPolicy = evaluateCommandPolicy(
+    "npm test & npm publish",
+    { ...hostWorkspacePolicy, allowDestructive: true, allowPasswords: true }
+  );
+  assert(
+    !backgroundPublishPolicy.allowed && backgroundPublishPolicy.category === "blocked",
+    "a background test bypassed the hard package-publication guard"
+  );
+  for (const command of [
+    `node -e 'require("fs").writeFileSync("report.md", "changed")' --test`,
+    "node test/unit.test.js --test",
+  ]) {
+    const classification = classifyCommand(command);
+    assert(
+      classification.category !== "test" &&
+        classification.substantiveTest !== true &&
+        classification.writesWorkspace === true,
+      `a Node entrypoint fabricated test-runner identity: ${command}`
+    );
+  }
+  const redirectedTestPolicy = evaluateCommandPolicy("npm test 2>&1", hostWorkspacePolicy);
+  assert(
+    redirectedTestPolicy.allowed && redirectedTestPolicy.substantiveTest === true,
+    "descriptor redirection was mistaken for background test execution"
+  );
+  const singleQuoteBackslashPolicy = evaluateCommandPolicy(
+    "git status 'x\\\\'; touch report.md",
+    dockerWorkspacePolicy
+  );
+  assert(
+    !singleQuoteBackslashPolicy.allowed || singleQuoteBackslashPolicy.category !== "read-only",
+    "a literal backslash inside single quotes hid a following workspace mutation"
+  );
   const safeChmodAndRunPolicy = evaluateCommandPolicy(
     'chmod +x /workspace/reports/run_bounded_02079_v2.sh && bash /workspace/reports/run_bounded_02079.sh 2>&1; echo "RUN_COMMAND_EXIT: $?"',
     dockerWorkspacePolicy
@@ -996,6 +1076,18 @@ try {
   assert(sanitizedSmallRead.content === longSmallFile, "small read_file result did not keep full content for the model");
   assert(sanitizedSmallRead.contentTruncated === false, "small read_file result should not be marked truncated");
   assert(!("contentPreview" in sanitizedSmallRead), "small read_file result should not replace full content with preview");
+  const sanitizedCommandResult = sanitizeToolResult({
+    ok: true,
+    toolName: "run_command",
+    args: { command: "echo password=private-value" },
+    commandPolicy: { normalizedCommand: "echo password=private-value" },
+    stdout: "password=private-value",
+  });
+  const serializedCommandResult = JSON.stringify(sanitizedCommandResult);
+  assert(
+    !serializedCommandResult.includes("private-value") && serializedCommandResult.includes("[REDACTED]"),
+    "a nested normalized command bypassed tool-event redaction"
+  );
   const largeModelRead = toolResultForModel({
     ok: true,
     toolName: "read_file",
@@ -1444,6 +1536,44 @@ try {
     "hybrid wrapped unified apply_patch did not update expected file"
   );
 
+  await fs.mkdir(path.join(workspace, "a"), { recursive: true });
+  await fs.writeFile(path.join(workspace, "report.md"), "root report\n", "utf8");
+  await fs.writeFile(path.join(workspace, "a", "report.md"), "nested old\n", "utf8");
+  const nestedCustomPatch = await executeWorkspaceTool(
+    "apply_patch",
+    {
+      patch: [
+        "*** Begin Patch",
+        "*** Update File: a/report.md",
+        "@@",
+        "-nested old",
+        "+nested new",
+        "*** End Patch",
+      ].join("\n"),
+    },
+    { commandCwd: workspace, allowFileTools: true }
+  );
+  assert(
+    nestedCustomPatch.ok &&
+      (await fs.readFile(path.join(workspace, "a", "report.md"), "utf8")) === "nested new\n" &&
+      (await fs.readFile(path.join(workspace, "report.md"), "utf8")) === "root report\n",
+    "custom patch path canonicalization confused a real a/ directory with a unified-diff prefix"
+  );
+  const nestedCustomDelete = await executeWorkspaceTool(
+    "apply_patch",
+    { patch: ["*** Begin Patch", "*** Delete File: a/report.md", "*** End Patch"].join("\n") },
+    { commandCwd: workspace, allowFileTools: true }
+  );
+  assert(nestedCustomDelete.ok, "custom patch could not delete its exact nested target");
+  const nestedStillExists = await fs
+    .stat(path.join(workspace, "a", "report.md"))
+    .then(() => true)
+    .catch(() => false);
+  assert(
+    !nestedStillExists && (await fs.readFile(path.join(workspace, "report.md"), "utf8")) === "root report\n",
+    "custom delete stripped a real a/ directory and deleted the wrong root file"
+  );
+
   await fs.writeFile(path.join(workspace, "repair-report.md"), "old report\n", "utf8");
   const ordinaryAddExistingError = await executeWorkspaceTool(
     "apply_patch",