@lazyingart/agintiflow 0.20.215 → 0.20.217

package/docs/supervision-campaign-ledger.md

@@ -186,3 +186,84 @@ DeepSeek-to-LocalLLM handoff when local perception is enabled, continue to block
 hosted vision without explicit authorization, and block all automatic vision
 when both local and hosted routes are disabled. A focused regression covers the
 guard and the actual LocalLLM client route.
+
+### SQLite migration and literal-query safety
+
+`database-migration-safety-015` passed on AgInTiFlow `0.20.215` from a normal,
+imperfect maintenance prompt. The DeepSeek-backed database profile diagnosed a
+destructive version-1 migration, `INSERT OR REPLACE` identity loss, and unsafe
+`LIKE` semantics. In one retained session it replaced the migration with an
+in-place transaction, preserved item IDs, tags, and relationships, used an
+identity-preserving UPSERT, escaped `%`, `_`, and backslashes as literal search
+text, added regression tests, and committed target repair `fb97fbd`.
+
+The run also exercised recovery behavior without a supervisor rescue prompt.
+DeepSeek initially requested too many tools in one turn; the contract guard
+rejected that batch and the next turn continued with allowed calls. Later, a
+noncanonical `TEST_EXIT:0` shell suffix confused project-test evidence despite
+five passing tests. The agent recognized the discrepancy, reran the canonical
+README command, obtained `passed:true`, cleaned transient Python artifacts, and
+finished normally. No AgInTiFlow product patch was required for this scenario.
+
+Independent acceptance used
+`supervision/acceptance/database_migration_safety_contract.py` to verify legacy
+IDs `7`, `12`, and `19`, tag relationships, schema columns, foreign keys,
+idempotent reopening, stable URL updates, literal punctuation, archive
+filtering, absence of destructive SQL, intentional commit history, and a clean
+worktree. The hidden contract passed.
+
+### Shell grammar, mutation revision, and output provenance hardening
+
+The next campaign phase exercised completion evidence under realistic compound
+commands, multiline acceptance criteria, delegated test runners, Git workflows,
+and pre-existing output files. The reusable repair centralizes shell
+canonicalization, command classification, Git-action intent, and evidence
+tracking instead of adding project- or prompt-specific branches. In particular,
+escaped line continuations and heredocs are parsed structurally; read-only test
+evidence is separated from write capability; later mutations invalidate stale
+validation; commit, pull-request, tag, and push evidence must occur in the
+requested order; and exact output files count only when the current required
+generator created or changed them.
+
+Five independent review rounds found and drove regressions for inline mutation
+batches, stale opaque validators, Git grammar and ordering, zero-test runners,
+external executable paths, arithmetic shifts mistaken for heredocs, multiline
+command substitutions, stale exact outputs, and ambiguous Git nouns such as
+"commit message" or "branch diagram". A final fresh hosted Codex review was
+blocked by its rolling quota and the DeepSeek review route was blocked by
+provider balance. A separate read-only `localllm-deep` review completed with no
+actionable findings. The full `npm test` suite, focused dynamic-step-budget,
+coding-tools, SCS-evidence, and syntax checks all pass before packaging
+AgInTiFlow `0.20.216`.
+
+### Same-session interruption convergence and bounded completion
+
+The `context-interruption-016` campaign exercised a long retained DeepSeek
+session with multiple concrete interruptions, source corrections, an exact
+external acceptance command, and a final clean-repository requirement. The
+agent owned every target edit and commit. Early recovery turns repeatedly read
+the same already-correct diff, showing that token limits alone do not guarantee
+convergence while the available action surface remains open ended.
+
+The reusable repair is driven by runtime state and evidence rather than task
+literals. Mutations invalidate stale tests and prior completion evidence;
+same-task interruptions refresh per-turn acceptance while retaining durable
+evidence; repository-state recovery derives task-owned paths since the latest
+successful commit and offers a bounded `commit_project_changes` action; and
+the runtime constructs the path-scoped Git command. A current-revision exact
+validator creates a one-use completion candidate. The following turn compacts
+the evidence and exposes only `finish`; rejection or mutation invalidates the
+candidate.
+
+The final live continuation converged in three turns: bounded commit, exact
+validator, and truthful finish. The target ended clean at commit `bd74bbd`.
+Repository-repair context compacted from 156,716 to 5,788 characters, and the
+verified-completion context compacted from 23,658 to 5,157 characters.
+
+An independent read-only DeepSeek review then drove three general fixes: a
+dedicated task-owned commit-path validator that supports binary,
+extensionless, and instruction files while rejecting protected paths;
+platform-aware POSIX and Windows command quoting; and recognition of bounded
+stdin `sed -n` pipelines as read-only inspection. Production code contains no
+campaign scenario IDs, target paths, expected prose, commit IDs, or acceptance
+literals.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.215",
+  "version": "0.20.217",
   "type": "module",
   "description": "AgInTiFlow is a project-aware agent workspace for hybrid wet-dry R&D, hardware-aware intelligence, software automation, and industrial workflows.",
   "license": "Apache-2.0",

package/scripts/smoke-coding-tools.js

@@ -7,6 +7,8 @@ import {
   buildModelTimeoutRetryMessages,
   genericArtifactFilenameBlock,
   modelTimeoutRetryRoute,
+  applyModelTimeoutRetryRoute,
+  recoverFocusedTextRewriteWithWritingSpecialist,
   repairModelMessageHistory,
   shouldResetStaticDiscoveryPhase,
   runAgent,
@@ -16,10 +18,11 @@ import {
   shellDiagnosticHint,
   skippedAfterBlockedToolResult,
 } from "../src/agent-runner.js";
+import { createToolContract, resolveDispatchableToolCallBatch } from "../src/tool-contract.js";
 import { formatBehaviorContractForPrompt } from "../src/behavior-contract.js";
 import { resolveRuntimeConfig } from "../src/config.js";
 import { readCodebaseMap } from "../src/codebase-map.js";
-import { evaluateCommandPolicy } from "../src/command-policy.js";
+import { classifyCommand, evaluateCommandPolicy } from "../src/command-policy.js";
 import { shouldReviewToolResult } from "../src/scs-controller.js";
 import {
   engineeringGuidanceForTask,
@@ -328,6 +331,39 @@ try {
     packageInstallPolicy: "block",
     commandCwd: workspace,
   });
+  const opaqueInPlaceEditPolicy = evaluateCommandPolicy("sed -i 's/old/new/' report.md", {
+    allowShellTool: true,
+    sandboxMode: "host",
+    packageInstallPolicy: "block",
+    commandCwd: workspace,
+    allowDestructive: true,
+  });
+  assert(
+    opaqueInPlaceEditPolicy.writesWorkspace === true,
+    "an unknown host shell edit was incorrectly classified as read-only"
+  );
+  const destructiveGitPolicy = evaluateCommandPolicy("git reset --hard HEAD~1", {
+    allowShellTool: true,
+    sandboxMode: "host",
+    packageInstallPolicy: "block",
+    commandCwd: workspace,
+    allowDestructive: true,
+  });
+  assert(
+    destructiveGitPolicy.category === "destructive" &&
+      destructiveGitPolicy.writesWorkspace === true,
+    "a destructive git command was not classified as a workspace mutation"
+  );
+  const safeTagPolicy = evaluateCommandPolicy("git tag v0.20.216", {
+    allowShellTool: true,
+    sandboxMode: "host",
+    packageInstallPolicy: "block",
+    commandCwd: workspace,
+  });
+  assert(
+    safeTagPolicy.allowed && safeTagPolicy.category === "git-workflow" && safeTagPolicy.writesWorkspace,
+    "a bounded local git tag was not classified as a git workflow action"
+  );
   assert(boundedRgPolicy.allowed, "targeted bounded rg should remain allowed");
   const boundedAdvice = buildPermissionAdvice({
     toolName: "run_command",
@@ -615,6 +651,14 @@ try {
   );
   assert(readonlyVersionPipelinePolicy.allowed, "read-only version probe pipelines should not require package-install-policy=allow");
   assert(readonlyVersionPipelinePolicy.category === "read-only", "read-only version probe pipelines should be classified as read-only");
+  const readonlyDiffSlicePolicy = evaluateCommandPolicy(
+    "git diff -- src/agent-runner.js | sed -n '1,240p'",
+    dockerWorkspaceNoInstallsPolicy
+  );
+  assert(
+    readonlyDiffSlicePolicy.allowed && readonlyDiffSlicePolicy.category === "read-only",
+    "a bounded sed print filter made a read-only Git diff pipeline require broad shell access"
+  );
   const nodeNpmTestPolicy = evaluateCommandPolicy(
     'cd /workspace && node --version && npm test 2>&1; echo "EXIT:$?"',
     dockerWorkspaceNoInstallsPolicy
@@ -692,6 +736,53 @@ try {
   const actualDangerAfterQuotePolicy = evaluateCommandPolicy('echo "rm -rf is text" && rm -rf reports', dockerWorkspacePolicy);
   assert(!actualDangerAfterQuotePolicy.allowed, "actual destructive command after quoted text should still be blocked");
   assert(actualDangerAfterQuotePolicy.category === "destructive", "actual destructive command after quoted text was not classified as destructive");
+  for (const command of [
+    "npm test &",
+    "npm test & sed -i 's/old/new/' report.md",
+  ]) {
+    const classification = classifyCommand(command);
+    const policy = evaluateCommandPolicy(command, hostWorkspacePolicy);
+    assert(
+      !policy.allowed &&
+        classification.category !== "test" &&
+        classification.substantiveTest !== true &&
+        classification.writesWorkspace === true,
+      `background execution bypassed bounded test policy: ${command}`
+    );
+  }
+  const backgroundPublishPolicy = evaluateCommandPolicy(
+    "npm test & npm publish",
+    { ...hostWorkspacePolicy, allowDestructive: true, allowPasswords: true }
+  );
+  assert(
+    !backgroundPublishPolicy.allowed && backgroundPublishPolicy.category === "blocked",
+    "a background test bypassed the hard package-publication guard"
+  );
+  for (const command of [
+    `node -e 'require("fs").writeFileSync("report.md", "changed")' --test`,
+    "node test/unit.test.js --test",
+  ]) {
+    const classification = classifyCommand(command);
+    assert(
+      classification.category !== "test" &&
+        classification.substantiveTest !== true &&
+        classification.writesWorkspace === true,
+      `a Node entrypoint fabricated test-runner identity: ${command}`
+    );
+  }
+  const redirectedTestPolicy = evaluateCommandPolicy("npm test 2>&1", hostWorkspacePolicy);
+  assert(
+    redirectedTestPolicy.allowed && redirectedTestPolicy.substantiveTest === true,
+    "descriptor redirection was mistaken for background test execution"
+  );
+  const singleQuoteBackslashPolicy = evaluateCommandPolicy(
+    "git status 'x\\\\'; touch report.md",
+    dockerWorkspacePolicy
+  );
+  assert(
+    !singleQuoteBackslashPolicy.allowed || singleQuoteBackslashPolicy.category !== "read-only",
+    "a literal backslash inside single quotes hid a following workspace mutation"
+  );
   const safeChmodAndRunPolicy = evaluateCommandPolicy(
     'chmod +x /workspace/reports/run_bounded_02079_v2.sh && bash /workspace/reports/run_bounded_02079.sh 2>&1; echo "RUN_COMMAND_EXIT: $?"',
     dockerWorkspacePolicy
@@ -996,6 +1087,18 @@ try {
   assert(sanitizedSmallRead.content === longSmallFile, "small read_file result did not keep full content for the model");
   assert(sanitizedSmallRead.contentTruncated === false, "small read_file result should not be marked truncated");
   assert(!("contentPreview" in sanitizedSmallRead), "small read_file result should not replace full content with preview");
+  const sanitizedCommandResult = sanitizeToolResult({
+    ok: true,
+    toolName: "run_command",
+    args: { command: "echo password=private-value" },
+    commandPolicy: { normalizedCommand: "echo password=private-value" },
+    stdout: "password=private-value",
+  });
+  const serializedCommandResult = JSON.stringify(sanitizedCommandResult);
+  assert(
+    !serializedCommandResult.includes("private-value") && serializedCommandResult.includes("[REDACTED]"),
+    "a nested normalized command bypassed tool-event redaction"
+  );
   const largeModelRead = toolResultForModel({
     ok: true,
     toolName: "read_file",
@@ -1216,6 +1319,128 @@ try {
     localTimeoutRoute.model === "localllm-fast" && localTimeoutRoute.retryTimeoutMs === 90000,
     "LocalLLM timeout retry did not switch to its same-boundary fast route"
   );
+  const adoptedLocalTimeoutRoute = applyModelTimeoutRetryRoute(
+    { provider: "localllm", model: "localllm-deep", routingMode: "manual" },
+    localTimeoutRoute
+  );
+  assert(
+    adoptedLocalTimeoutRoute.model === "localllm-fast" &&
+      adoptedLocalTimeoutRoute.modelTimeoutRecoveryActive === true &&
+      /continuing this run/.test(adoptedLocalTimeoutRoute.routeReason),
+    "a successful in-provider timeout retry was not retained for later steps in the same run"
+  );
+  const focusedRewriteDescriptor = {
+    type: "function",
+    function: {
+      name: "rewrite_text_excerpt",
+      description: "Rewrite one evidence-selected excerpt.",
+      parameters: {
+        type: "object",
+        properties: {
+          revisedText: {
+            type: "string",
+            minLength: 1,
+            maxLength: 4000,
+            pattern: "^(?:(?!load)[\\s\\S])+$",
+            description:
+              "Return only the complete revised excerpt. Remove the premature first-match operand while preserving the technical meaning.",
+          },
+        },
+        required: ["revisedText"],
+        additionalProperties: false,
+      },
+    },
+  };
+  const focusedRewriteContract = createToolContract([focusedRewriteDescriptor]);
+  const invalidFocusedRewriteCall = {
+    id: "focused-rewrite-smoke",
+    type: "function",
+    function: {
+      name: "rewrite_text_excerpt",
+      arguments: JSON.stringify({ revisedText: "A carefully preloaded technical summary." }),
+    },
+  };
+  const invalidFocusedRewrite = resolveDispatchableToolCallBatch(
+    [invalidFocusedRewriteCall],
+    focusedRewriteContract
+  );
+  assert(
+    !invalidFocusedRewrite.ok &&
+      invalidFocusedRewrite.errors.some((error) => error.code === "ARGUMENT_PATTERN_MISMATCH"),
+    "focused rewrite smoke input did not exercise the semantic pattern failure"
+  );
+  const focusedWriterCalls = [];
+  const focusedRewriteState = {
+    meta: {
+      failedTestDiagnostic: {
+        mutationRevision: 7,
+        failureSignature: "generic-first-occurrence-relation",
+      },
+    },
+  };
+  const focusedRewriteConfig = {
+    provider: "localllm",
+    model: "localllm-fast",
+    baseURL: "http://127.0.0.1:8008/v1",
+    testFailureSignature: "generic-first-occurrence-relation",
+    testFailureRepairPatchTargets: [{
+      path: "notes/handoff.md",
+      search: "A carefully preloaded technical summary.",
+    }],
+    writingClientFactory: (writingConfig) => {
+      focusedWriterCalls.push(writingConfig);
+      return {
+        chat: {
+          completions: {
+            create: async () => ({
+              choices: [{
+                message: {
+                  content: JSON.stringify({
+                    draft: "A carefully prepared technical summary.",
+                    revision_notes: [],
+                    continuity_notes: [],
+                    format_handoff: {},
+                    quality_checks: ["constraint satisfied"],
+                    questions: [],
+                  }),
+                },
+              }],
+            }),
+          },
+        },
+      };
+    },
+  };
+  const recoveredFocusedRewrite = await recoverFocusedTextRewriteWithWritingSpecialist(
+    focusedRewriteConfig,
+    focusedRewriteState,
+    [invalidFocusedRewriteCall],
+    focusedRewriteContract,
+    invalidFocusedRewrite
+  );
+  assert(recoveredFocusedRewrite?.ok, "writing specialist did not recover the bounded semantic rewrite");
+  assert(
+    recoveredFocusedRewrite.recoveredFocusedTextRewrite === true &&
+      JSON.parse(recoveredFocusedRewrite.acceptedToolCalls[0].function.arguments).revisedText ===
+        "A carefully prepared technical summary.",
+    "writing specialist recovery did not return a schema-valid focused rewrite call"
+  );
+  assert(
+    focusedWriterCalls.length === 1 &&
+      focusedWriterCalls[0].provider === "localllm" &&
+      focusedWriterCalls[0].model === "localllm-fast",
+    "focused rewrite recovery crossed the active provider/model boundary"
+  );
+  assert(
+    (await recoverFocusedTextRewriteWithWritingSpecialist(
+      focusedRewriteConfig,
+      focusedRewriteState,
+      [invalidFocusedRewriteCall],
+      focusedRewriteContract,
+      invalidFocusedRewrite
+    )) === null && focusedWriterCalls.length === 1,
+    "focused rewrite recovery repeated for the same retained failure state"
+  );
   const defaultLocalTimeoutRoute = modelTimeoutRetryRoute({
     provider: "localllm",
     model: "localllm-fast",
@@ -1420,6 +1645,25 @@ try {
   const unifiedText = await fs.readFile(path.join(workspace, "unified-target.txt"), "utf8");
   assert(unified.ok && unifiedText === "alpha\nnew\nomega\n", "unified apply_patch did not update expected file");
 
+  await fs.writeFile(path.join(workspace, "no-op-patch-target.txt"), "already correct\n", "utf8");
+  const noOpPatchError = await executeWorkspaceTool(
+    "apply_patch",
+    {
+      path: "no-op-patch-target.txt",
+      search: "already correct",
+      replace: "already correct",
+      expectedReplacements: 1,
+    },
+    { commandCwd: workspace, allowFileTools: true }
+  )
+    .then(() => "")
+    .catch((error) => String(error?.message || error));
+  assert(
+    /patch made no changes/i.test(noOpPatchError) &&
+      (await fs.readFile(path.join(workspace, "no-op-patch-target.txt"), "utf8")) === "already correct\n",
+    "an exact byte-identical replacement was reported as a successful mutation"
+  );
+
   await fs.writeFile(path.join(workspace, "hybrid-patch-target.txt"), "alpha\nold\nomega\n", "utf8");
   const hybridPatch = await executeWorkspaceTool(
     "apply_patch",
@@ -1444,6 +1688,44 @@ try {
     "hybrid wrapped unified apply_patch did not update expected file"
   );
 
+  await fs.mkdir(path.join(workspace, "a"), { recursive: true });
+  await fs.writeFile(path.join(workspace, "report.md"), "root report\n", "utf8");
+  await fs.writeFile(path.join(workspace, "a", "report.md"), "nested old\n", "utf8");
+  const nestedCustomPatch = await executeWorkspaceTool(
+    "apply_patch",
+    {
+      patch: [
+        "*** Begin Patch",
+        "*** Update File: a/report.md",
+        "@@",
+        "-nested old",
+        "+nested new",
+        "*** End Patch",
+      ].join("\n"),
+    },
+    { commandCwd: workspace, allowFileTools: true }
+  );
+  assert(
+    nestedCustomPatch.ok &&
+      (await fs.readFile(path.join(workspace, "a", "report.md"), "utf8")) === "nested new\n" &&
+      (await fs.readFile(path.join(workspace, "report.md"), "utf8")) === "root report\n",
+    "custom patch path canonicalization confused a real a/ directory with a unified-diff prefix"
+  );
+  const nestedCustomDelete = await executeWorkspaceTool(
+    "apply_patch",
+    { patch: ["*** Begin Patch", "*** Delete File: a/report.md", "*** End Patch"].join("\n") },
+    { commandCwd: workspace, allowFileTools: true }
+  );
+  assert(nestedCustomDelete.ok, "custom patch could not delete its exact nested target");
+  const nestedStillExists = await fs
+    .stat(path.join(workspace, "a", "report.md"))
+    .then(() => true)
+    .catch(() => false);
+  assert(
+    !nestedStillExists && (await fs.readFile(path.join(workspace, "report.md"), "utf8")) === "root report\n",
+    "custom delete stripped a real a/ directory and deleted the wrong root file"
+  );
+
   await fs.writeFile(path.join(workspace, "repair-report.md"), "old report\n", "utf8");
   const ordinaryAddExistingError = await executeWorkspaceTool(
     "apply_patch",
@@ -1728,6 +2010,7 @@ try {
           "node_profile_cli_package_manifest",
           "python_profile_helper_test_report",
           "model_timeout_compact_retry_messages",
+          "focused_text_rewrite_specialist_recovery",
         ],
       },
       null,