@lazyingart/agintiflow 0.20.223 → 0.20.225

package/docs/runtime-modes-and-autonomy.md

@@ -73,6 +73,8 @@ Current contract:
 - `danger` is trusted host/full-access mode: host shell, destructive actions, host installs, password typing, and outside-workspace file paths are enabled. Use it only for tasks you trust; obvious secret/publish exfiltration guards remain hard stops.
 - Workspace file tools may read and write inside the configured project folder when file tools are enabled.
 - Narrow workspace-local shell actions such as safe probes, Gradle/TeX builds, and `chmod +x` on a project script may run when the command policy can classify them precisely.
+- Finite literal read-only audits may bind a small literal path, inspect/hash it, count matches through a bounded read-only pipeline, and display numeric results with `echo` or `printf` without asking for destructive permission. Shell line continuations are accepted for finite literal item lists. Every producer, consumer, and surrounding command must still classify as bounded read-only work; network access, redirects, secret/dynamic expansion, shell-state `printf -v`, mutation, dynamic item lists, and computed values used as executable arguments remain blocked.
+- Completion checks distinguish a resolved historical state such as "previously paused" from work that is currently pending or incomplete. A resolved past blocker therefore does not force another verification loop, while any explicit current unfinished state still does.
 - Android/JVM toolchain commands may include safe local env assignments such as `ANDROID_HOME`, `ANDROID_SDK_ROOT`, `JAVA_HOME`, or `GRADLE_USER_HOME`, plus small workspace-local status-log redirects. Secret-like env vars and redirects outside the workspace remain blocked.
 - Workspace writes outside that folder, secret paths, `.git` internals, and dependency folders such as `node_modules` are blocked.
 - `git clone`, `git fetch`, `git pull --ff-only`, `git push`, `curl`, and `wget` are classified as network operations.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.223",
+  "version": "0.20.225",
   "type": "module",
   "description": "AgInTiFlow is a project-aware agent workspace for hybrid wet-dry R&D, hardware-aware intelligence, software automation, and industrial workflows.",
   "license": "Apache-2.0",

package/scripts/smoke-coding-tools.js

@@ -673,6 +673,47 @@ try {
       exactReadOnlyExistenceLoopWithSuffixPolicy.writesWorkspace === false,
     "a finite read-only existence loop with bounded list suffix incorrectly required destructive host permission"
   );
+  const exactReadOnlyReportLiteralAudit =
+    'cd . && for s in \'handoff/LABCANVAS_AGENT_API_HANDOFF_2026_07_29.md\' \'/home/lachlan/ProjectsLFS/AgenticApp\' \'src/agenticapp/musia_ops.py\' \'scripts/xyq_chrome/watch_thread_dom_download.py\' \'Reviewed master\' \'ffprobe verification\' \'Song-only versus MV separation\' \'MV request versus publication separation\'; do n=$(grep -c -- "$s" media-routine-readiness.md); echo "$n :: $s"; done; echo \'--- git status ---\'; git status --short';
+  const exactReadOnlyReportLiteralAuditPolicy = evaluateCommandPolicy(
+    exactReadOnlyReportLiteralAudit,
+    hostWorkspacePolicy
+  );
+  assert(
+    exactReadOnlyReportLiteralAuditPolicy.allowed &&
+      exactReadOnlyReportLiteralAuditPolicy.category === "read-only" &&
+      exactReadOnlyReportLiteralAuditPolicy.boundedForLoop === true &&
+      exactReadOnlyReportLiteralAuditPolicy.needsNetwork === false &&
+      exactReadOnlyReportLiteralAuditPolicy.writesWorkspace === false,
+    "a bounded report literal-count audit incorrectly required destructive host permission"
+  );
+  const exactReadOnlyFormattedReportAudit = [
+    "f=media-routine-readiness.md",
+    "printf 'lines\\tbytes\\tsha256\\n'",
+    'wc -lc "$f"',
+    'sha256sum "$f"',
+    "printf '\\n--- literal occurrence counts (bounded) ---\\n'",
+    "for s in \\",
+    "  '/home/lachlan/ProjectsLFS/Musia' \\",
+    "  '/home/lachlan/ProjectsLFS/AgenticApp' \\",
+    "  'music generation' \\",
+    "; do",
+    '  n=$(grep -oF -- "$s" "$f" | wc -l | tr -d \' \')',
+    '  printf \'%-58s %s\\n\' "$s" "$n"',
+    "done",
+  ].join("\n");
+  const exactReadOnlyFormattedReportAuditPolicy = evaluateCommandPolicy(
+    exactReadOnlyFormattedReportAudit,
+    hostWorkspacePolicy
+  );
+  assert(
+    exactReadOnlyFormattedReportAuditPolicy.allowed &&
+      exactReadOnlyFormattedReportAuditPolicy.category === "read-only" &&
+      exactReadOnlyFormattedReportAuditPolicy.boundedForLoop === true &&
+      exactReadOnlyFormattedReportAuditPolicy.needsNetwork === false &&
+      exactReadOnlyFormattedReportAuditPolicy.writesWorkspace === false,
+    "a literal-file formatted count audit incorrectly required destructive host permission"
+  );
   const exactReadOnlyGitIdentityProbe =
     'git status --short && echo "TOPLEVEL=$(git rev-parse --show-toplevel 2>&1)" && echo "BRANCH=$(git rev-parse --abbrev-ref HEAD 2>&1)"';
   const exactReadOnlyGitIdentityProbePolicy = evaluateCommandPolicy(
@@ -747,6 +788,16 @@ try {
     'for d in /tmp; do git -C "$d" status --short > report.md; done',
     'for d in /tmp; do git -C "$d" remote add origin https://example.com/repo.git; done',
     'for d in /tmp; do git -C "$d" remote set-url origin https://example.com/repo.git; done',
+    'for s in README.md; do n=$(rm -rf report.md); echo "$n :: $s"; done',
+    'for s in README.md; do n=$(curl https://example.com); echo "$n :: $s"; done',
+    'for s in README.md; do n=$(cat "$s"); echo "$n :: $s"; done',
+    'for s in README.md; do n=$(grep -c -- "$s" README.md); rm -rf "$n"; done',
+    'f=README.md; printf "%s\\n" "$(cat .aginti/.env)"; for s in one; do echo "$s"; done',
+    'f=README.md; printf "%s\\n" "$f" > copied.md; for s in one; do echo "$s"; done',
+    'f=$(cat README.md); printf "%s\\n" "$f"; for s in one; do echo "$s"; done',
+    'f=README.md; for s in one; do n=$(grep -oF -- "$s" "$f" | wc -l | tr -d " "); printf -v target "%s" "$n"; done',
+    'f=README.md; for s in one; do n=$(grep -oF -- "$s" "$f" | wc -l | tr -d " "); rm -rf "$n"; done',
+    'for s in \'README.md; rm -rf report.md\'; do echo "$s"; done',
   ]) {
     const unsafeLoopSubstitutionPolicy = evaluateCommandPolicy(
       unsafeLoopSubstitution,

package/scripts/smoke-truthful-completion.js

@@ -7,11 +7,41 @@ import { fileURLToPath } from "node:url";
 import { runAgent } from "../src/agent-runner.js";
 import { resolveRuntimeConfig } from "../src/config.js";
 import { SessionStore } from "../src/session-store.js";
+import { finishResultClaimsIncompleteWork } from "../src/scs-evidence.js";
 
 const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const tempRoot = await fs.mkdtemp(path.join(os.tmpdir(), "agintiflow-truthful-completion-"));
 process.env.AGINTIFLOW_HOME = path.join(tempRoot, "home");
 
+assert.equal(
+  finishResultClaimsIncompleteWork(
+    "The report is complete and the verification that was previously paused now passes. No work remains."
+  ),
+  false,
+  "historical paused wording was mistaken for current unfinished work"
+);
+assert.equal(
+  finishResultClaimsIncompleteWork(
+    "The earlier step was paused, but the report is complete and verified now."
+  ),
+  false,
+  "resolved historical pause was mistaken for current unfinished work"
+);
+assert.equal(
+  finishResultClaimsIncompleteWork(
+    "The earlier step was paused and the report is still incomplete."
+  ),
+  true,
+  "historical-pause normalization hid genuinely incomplete current work"
+);
+assert.equal(
+  finishResultClaimsIncompleteWork(
+    "The earlier report was complete, but the current task is unfinished."
+  ),
+  true,
+  "historical wording hid an unrelated current unfinished task"
+);
+
 function assistant(content, toolCalls = []) {
   return {
     choices: [

package/scripts/smoke-web-port-fallback.js

@@ -9,9 +9,8 @@ import { fileURLToPath } from "node:url";
 const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const runtimeDir = await fs.mkdtemp(path.join(os.tmpdir(), "agintiflow-web-port-fallback-"));
 const host = "127.0.0.1";
-const occupiedPort = 43100 + Math.floor(Math.random() * 1200);
 
-function listenOccupier(port) {
+function listenOccupier(port = 0) {
   return new Promise((resolve, reject) => {
     const server = net.createServer();
     server.once("error", reject);
@@ -49,7 +48,15 @@ async function waitForHealth(port, child, stdout, stderr) {
   throw new Error(`web fallback health failed. stdout=${stdout()} stderr=${stderr()}`);
 }
 
-const occupier = await listenOccupier(occupiedPort);
+// Let the kernel allocate an actually free port and retain the listener. A
+// random high port can already belong to another project on a shared runner,
+// which made this fallback test itself flaky before the product was exercised.
+const occupier = await listenOccupier();
+const occupiedAddress = occupier.address();
+const occupiedPort = typeof occupiedAddress === "object" && occupiedAddress
+  ? Number(occupiedAddress.port)
+  : 0;
+if (!occupiedPort) throw new Error("failed to reserve the occupied test port");
 let stdout = "";
 let stderr = "";
 const child = spawn(process.execPath, [path.join(repoRoot, "bin/aginti-cli.js"), "web", "--port", String(occupiedPort), "--host", host], {

package/src/command-policy.js

@@ -78,6 +78,35 @@ function stripBenignRedirections(command = "") {
     .trim();
 }
 
+function isReadOnlyPrintfCommand(command = "") {
+  const normalized = stripBenignRedirections(command);
+  if (!/^printf(?:\s|$)/.test(normalized) || hasActiveShellExpansion(normalized)) return false;
+  const tokens = tokenizeShellWords(normalized);
+  if (!tokens.length || tokens[0] !== "printf") return false;
+  // Bash's `printf -v name ...` mutates shell state and can influence a later
+  // command. Ordinary printf writes only to stdout and is safe once expansion
+  // and redirection checks have passed.
+  return !tokens.slice(1).some((token) => token === "-v" || /^-v[A-Za-z_]/.test(token));
+}
+
+function isReadOnlyTrDeleteFilter(command = "") {
+  const normalized = stripBenignRedirections(command);
+  if (hasActiveShellExpansion(normalized)) return false;
+  const tokens = tokenizeShellWords(normalized);
+  return tokens.length === 3 && tokens[0] === "tr" && tokens[1] === "-d";
+}
+
+function isReadOnlySha256Command(command = "") {
+  const normalized = stripBenignRedirections(command);
+  if (hasActiveShellExpansion(normalized)) return false;
+  const tokens = tokenizeShellWords(normalized);
+  if (tokens[0] !== "sha256sum" || tokens.length < 2) return false;
+  const paths = tokens.slice(1).filter((token) => token !== "--");
+  return paths.length > 0 && paths.every((token) =>
+    !token.startsWith("-") && READ_ONLY_FOR_LOOP_LITERAL_PATTERN.test(token)
+  );
+}
+
 function isReadOnlyFindCommand(command = "") {
   const normalized = stripBenignRedirections(command);
   if (!/^find\s+/.test(normalized)) return false;
@@ -1359,6 +1388,9 @@ function classifySimpleCommand(normalized) {
 
   if (
     matchAny(READ_ONLY_PATTERNS, commandForPatternMatching) ||
+    isReadOnlyPrintfCommand(commandForPatternMatching) ||
+    isReadOnlyTrDeleteFilter(commandForPatternMatching) ||
+    isReadOnlySha256Command(commandForPatternMatching) ||
     isReadOnlyFindCommand(normalized) ||
     (!hasActiveShellExpansion(benignRedirectCommand) && isReadOnlyShellCondition(benignRedirectCommand))
   ) {
@@ -1543,7 +1575,7 @@ function classifyShellSequence(normalized) {
 
 const READ_ONLY_FOR_LOOP_MAX_ITEMS = 64;
 const READ_ONLY_FOR_LOOP_MAX_COMMANDS = 16;
-const READ_ONLY_FOR_LOOP_LITERAL_PATTERN = /^[A-Za-z0-9_@%+=:,./~+-]+$/;
+const READ_ONLY_FOR_LOOP_LITERAL_PATTERN = /^[A-Za-z0-9_@%+=:,./~+ -]+$/;
 
 function shellIdentifierPattern(value = "") {
   return String(value || "").replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -1708,6 +1740,342 @@ function loopBodyHasOnlyBoundedReadOnlyExpansions(bodySource = "") {
   });
 }
 
+function isBoundedReadOnlyScalarCommand(command = "") {
+  const normalized = stripBenignRedirections(command);
+  if (!normalized || hasActiveShellExpansion(normalized)) return false;
+  const pipeline = splitTopLevelPipeline(normalized);
+  if (pipeline) {
+    if (pipeline.length > 4) return false;
+    const classifications = pipeline.map((part) => classifySimpleCommand(part));
+    if (classifications.some(
+      (classification) => classification.category !== "read-only" || classification.writesWorkspace
+    )) {
+      return false;
+    }
+    const producers = [...pipeline];
+    if (isReadOnlyTrDeleteFilter(producers.at(-1))) producers.pop();
+    const finalProducer = stripBenignRedirections(producers.at(-1) || "");
+    const finalTokens = tokenizeShellWords(finalProducer);
+    return finalTokens[0] === "wc" &&
+      finalTokens.length === 2 &&
+      ["-l", "--lines"].includes(finalTokens[1]);
+  }
+  const tokens = tokenizeShellWords(normalized);
+  if (!tokens.length) return false;
+  if (["grep", "rg"].includes(tokens[0])) {
+    return tokens.slice(1).some((token) =>
+      token === "--count" || /^-[A-Za-z]*c[A-Za-z]*$/.test(token)
+    );
+  }
+  return tokens[0] === "wc" && tokens.slice(1).includes("-l");
+}
+
+function parseReadOnlyLoopBodySequence(value = "") {
+  const text = String(value || "");
+  const commands = [];
+  const separators = [];
+  let current = "";
+  let quote = "";
+  let escaped = false;
+  let substitutionDepth = 0;
+
+  const push = (separator) => {
+    const command = current.trim();
+    if (!command) return false;
+    commands.push(command);
+    separators.push(separator);
+    current = "";
+    return true;
+  };
+
+  for (let index = 0; index < text.length; index += 1) {
+    const char = text[index];
+    if (quote === "'") {
+      current += char;
+      if (char === "'") quote = "";
+      continue;
+    }
+    if (escaped) {
+      current += char;
+      escaped = false;
+      continue;
+    }
+    if (char === "\\") {
+      current += char;
+      escaped = true;
+      continue;
+    }
+    if (char === '"') {
+      quote = quote === '"' ? "" : '"';
+      current += char;
+      continue;
+    }
+    if (!quote && char === "'") {
+      quote = "'";
+      current += char;
+      continue;
+    }
+    if (char === "$" && text[index + 1] === "(") {
+      substitutionDepth += 1;
+      current += "$(";
+      index += 1;
+      continue;
+    }
+    if (!quote && char === ")" && substitutionDepth > 0) {
+      substitutionDepth -= 1;
+      current += char;
+      continue;
+    }
+    if (!quote && substitutionDepth === 0) {
+      const pair = text.slice(index, index + 2);
+      if (pair === "&&" || pair === "||") {
+        if (!push(pair)) return null;
+        index += 1;
+        continue;
+      }
+      if (char === ";" || char === "\n") {
+        if (current.trim() && !push(char === "\n" ? "newline" : char)) return null;
+        continue;
+      }
+    }
+    current += char;
+  }
+  if (quote || escaped || substitutionDepth !== 0) return null;
+  if (current.trim()) commands.push(current.trim());
+  if (!commands.length || separators.length >= commands.length) return null;
+  return { commands, separators };
+}
+
+function commandHasUnbalancedSubstitution(value = "") {
+  const text = String(value || "");
+  let depth = 0;
+  for (let index = 0; index < text.length; index += 1) {
+    if (text[index] === "$" && text[index + 1] === "(") {
+      depth += 1;
+      index += 1;
+      continue;
+    }
+    if (text[index] === ")" && depth > 0) depth -= 1;
+  }
+  return depth !== 0;
+}
+
+function sanitizeReadOnlyLoopAssignments(bodySource = "") {
+  const text = String(bodySource || "").trim();
+  const standardSequence = parseTopLevelShellSequence(text);
+  const standardIsUsable =
+    standardSequence.commands.length > 0 &&
+    !standardSequence.openQuote &&
+    !standardSequence.trailingEscape &&
+    !standardSequence.trailingSeparator &&
+    !standardSequence.commands.some(commandHasUnbalancedSubstitution);
+  const sequence = standardIsUsable
+    ? standardSequence
+    : parseReadOnlyLoopBodySequence(text);
+  if (!sequence) return null;
+
+  const assigned = new Map();
+  const commands = [];
+  for (const sourceCommand of sequence.commands) {
+    let command = sourceCommand;
+    for (const [name, state] of assigned.entries()) {
+      const escapedName = shellIdentifierPattern(name);
+      const reference = new RegExp(`\\$(?:\\{${escapedName}\\}|${escapedName}(?![A-Za-z0-9_]))`, "g");
+      if (!reference.test(command)) continue;
+      if (!/^(?:echo|printf)\s+/.test(command)) return null;
+      command = command.replace(reference, `AGINTI_READ_VALUE_${name}`);
+      state.used = true;
+    }
+
+    const assignment = command.match(/^([A-Za-z_][A-Za-z0-9_]*)=(\$\([\s\S]+\))$/);
+    if (!assignment) {
+      commands.push(command);
+      continue;
+    }
+    const [, name, expression] = assignment;
+    if (assigned.has(name) || assigned.size >= 4) return null;
+    const extracted = extractBoundedCommandSubstitutions(`echo ${expression}`);
+    if (
+      !extracted ||
+      extracted.commands.length !== 1 ||
+      extracted.template !== "echo AGINTI_READ_VALUE_1"
+    ) {
+      return null;
+    }
+    const inner = extracted.commands[0];
+    const classification = classifyShellSequence(inner) ||
+      classifyPipelineSequence(inner) ||
+      classifySimpleCommand(inner);
+    if (
+      classification.category !== "read-only" ||
+      classification.writesWorkspace ||
+      classification.needsNetwork ||
+      !isBoundedReadOnlyScalarCommand(inner)
+    ) {
+      return null;
+    }
+    assigned.set(name, { used: false });
+    commands.push("true");
+  }
+  if ([...assigned.values()].some((state) => !state.used)) return null;
+
+  let sanitized = commands[0];
+  for (let index = 1; index < commands.length; index += 1) {
+    const separator = sequence.separators[index - 1] === "newline"
+      ? "\n"
+      : sequence.separators[index - 1] || ";";
+    sanitized += separator === "\n"
+      ? `\n${commands[index]}`
+      : ` ${separator} ${commands[index]}`;
+  }
+  return sanitized;
+}
+
+const READ_ONLY_LITERAL_ASSIGNMENT_MAX = 8;
+
+function boundedLiteralAssignment(command = "") {
+  const source = String(command || "").trim();
+  if (!source || hasActiveShellExpansion(source)) return null;
+  const tokens = tokenizeShellWords(source);
+  if (tokens.length !== 1) return null;
+  const match = tokens[0].match(/^([A-Za-z_][A-Za-z0-9_]*)=([\s\S]+)$/);
+  if (!match) return null;
+  const [, name, value] = match;
+  if (
+    value.startsWith("-") ||
+    !READ_ONLY_FOR_LOOP_LITERAL_PATTERN.test(value) ||
+    /[\r\n]/.test(value)
+  ) {
+    return null;
+  }
+  return { name, value };
+}
+
+function replaceBoundedLiteralReferences(source = "", name = "", value = "") {
+  const text = String(source || "");
+  let result = "";
+  let quote = "";
+  let escaped = false;
+  let replacements = 0;
+  for (let index = 0; index < text.length; index += 1) {
+    const char = text[index];
+    if (quote === "'") {
+      result += char;
+      if (char === "'") quote = "";
+      continue;
+    }
+    if (escaped) {
+      result += char;
+      escaped = false;
+      continue;
+    }
+    if (char === "\\") {
+      result += char;
+      escaped = true;
+      continue;
+    }
+    if (char === '"') {
+      quote = quote === '"' ? "" : '"';
+      result += char;
+      continue;
+    }
+    if (!quote && char === "'") {
+      quote = "'";
+      result += char;
+      continue;
+    }
+    if (char !== "$") {
+      result += char;
+      continue;
+    }
+    const braced = text.startsWith(`\${${name}}`, index);
+    const bare = text.startsWith(`$${name}`, index) &&
+      !/[A-Za-z0-9_]/.test(text[index + name.length + 1] || "");
+    if (!braced && !bare) {
+      result += char;
+      continue;
+    }
+    result += quote === '"' || !/\s/.test(value) ? value : `'${value}'`;
+    replacements += 1;
+    index += braced ? name.length + 2 : name.length;
+  }
+  return { text: result, replacements };
+}
+
+function joinParsedShellSequence(commands = [], separators = []) {
+  let result = commands[0] || "";
+  for (let index = 1; index < commands.length; index += 1) {
+    const separator = separators[index - 1] === "newline"
+      ? "\n"
+      : separators[index - 1] || ";";
+    result += separator === "\n"
+      ? `\n${commands[index]}`
+      : ` ${separator} ${commands[index]}`;
+  }
+  return result;
+}
+
+function sanitizeReadOnlyCompoundLiteralAssignments({
+  prefixSource = "",
+  loopSource = "",
+  suffixSource = "",
+  loopVariable = "",
+} = {}) {
+  const parsed = parseTopLevelShellSequence(prefixSource);
+  if (
+    !parsed.commands.length ||
+    parsed.openQuote ||
+    parsed.trailingEscape ||
+    parsed.trailingSeparator
+  ) {
+    return null;
+  }
+
+  const assignments = new Map();
+  const commands = [];
+  for (const sourceCommand of parsed.commands) {
+    const assignment = boundedLiteralAssignment(sourceCommand);
+    if (assignment) {
+      if (
+        assignments.has(assignment.name) ||
+        assignment.name === loopVariable ||
+        assignments.size >= READ_ONLY_LITERAL_ASSIGNMENT_MAX
+      ) {
+        return null;
+      }
+      assignments.set(assignment.name, { value: assignment.value, used: false });
+      commands.push("true");
+      continue;
+    }
+    let command = sourceCommand;
+    for (const [name, state] of assignments.entries()) {
+      const replaced = replaceBoundedLiteralReferences(command, name, state.value);
+      command = replaced.text;
+      state.used ||= replaced.replacements > 0;
+    }
+    commands.push(command);
+  }
+  if (!assignments.size) {
+    return { prefixSource, loopSource, suffixSource };
+  }
+
+  let sanitizedLoop = loopSource;
+  let sanitizedSuffix = suffixSource;
+  for (const [name, state] of assignments.entries()) {
+    const loopReplacement = replaceBoundedLiteralReferences(sanitizedLoop, name, state.value);
+    sanitizedLoop = loopReplacement.text;
+    const suffixReplacement = replaceBoundedLiteralReferences(sanitizedSuffix, name, state.value);
+    sanitizedSuffix = suffixReplacement.text;
+    state.used ||= loopReplacement.replacements > 0 || suffixReplacement.replacements > 0;
+  }
+  if ([...assignments.values()].some((state) => !state.used)) return null;
+  return {
+    prefixSource: joinParsedShellSequence(commands, parsed.separators),
+    loopSource: sanitizedLoop,
+    suffixSource: sanitizedSuffix,
+  };
+}
+
 function classifyReadOnlyForLoop(normalized) {
   const text = String(normalized || "").trim();
   if (!/^for\s+/.test(text)) return null;
@@ -1724,7 +2092,11 @@ function classifyReadOnlyForLoop(normalized) {
   if (hasActiveShellExpansion(itemSource) || hasActiveShellCommandSubstitution(itemSource)) {
     return broadForLoopClassification(text, "the item list is dynamic");
   }
-  const items = tokenizeShellWords(itemSource);
+  // A model commonly formats a finite literal list with shell line
+  // continuations. Removing only the exact backslash-newline token preserves
+  // the same static list without admitting arbitrary escapes or expansion.
+  const normalizedItemSource = itemSource.replace(/\\\r?\n/g, " ");
+  const items = tokenizeShellWords(normalizedItemSource);
   if (!items.length || items.length > READ_ONLY_FOR_LOOP_MAX_ITEMS) {
     return broadForLoopClassification(text, "the item list is empty or unbounded");
   }
@@ -1747,10 +2119,11 @@ function classifyReadOnlyForLoop(normalized) {
 
   for (const item of items) {
     const expandedBody = bodySource.replace(variableReference, item);
-    if (!loopBodyHasOnlyBoundedReadOnlyExpansions(expandedBody)) {
+    const sanitizedBody = sanitizeReadOnlyLoopAssignments(expandedBody);
+    if (!sanitizedBody || !loopBodyHasOnlyBoundedReadOnlyExpansions(sanitizedBody)) {
       return broadForLoopClassification(text, "the body contains expansion beyond the loop variable");
     }
-    const classification = classifyReadOnlyLoopBody(expandedBody);
+    const classification = classifyReadOnlyLoopBody(sanitizedBody);
     if (classification.category === "blocked" || classification.category === "destructive") {
       return { ...classification, gitOnly: false };
     }
@@ -1771,7 +2144,7 @@ function classifyReadOnlyForLoop(normalized) {
 
 function classifyReadOnlyCompoundSequence(normalized) {
   const text = String(normalized || "").trim();
-  if (!text || hasActiveShellCommandSubstitution(text)) return null;
+  if (!text) return null;
 
   let forIndex = findUnquotedShellWord(text, "for");
   const startsAtCommandBoundary = (index) => {
@@ -1784,13 +2157,27 @@ function classifyReadOnlyCompoundSequence(normalized) {
   }
   if (forIndex < 0) return null;
 
-  const prefixSource = trimShellListBoundary(text.slice(0, forIndex));
+  let prefixSource = trimShellListBoundary(text.slice(0, forIndex));
   const doneIndex = findUnquotedShellWord(text, "done", forIndex + 3);
   if (doneIndex < 0) return null;
-  const loopSource = text.slice(forIndex, doneIndex + 4).trim();
-  const suffixSource = trimShellListBoundary(text.slice(doneIndex + 4));
+  let loopSource = text.slice(forIndex, doneIndex + 4).trim();
+  let suffixSource = trimShellListBoundary(text.slice(doneIndex + 4));
   if (!prefixSource && !suffixSource) return null;
 
+  const loopVariable = loopSource.match(/^for[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+in\b/)?.[1] || "";
+  if (prefixSource) {
+    const sanitized = sanitizeReadOnlyCompoundLiteralAssignments({
+      prefixSource,
+      loopSource,
+      suffixSource,
+      loopVariable,
+    });
+    if (!sanitized) {
+      return broadForLoopClassification(text, "the prelude contains an unsafe or unused shell assignment");
+    }
+    ({ prefixSource, loopSource, suffixSource } = sanitized);
+  }
+
   for (const [label, source] of [["prelude", prefixSource], ["suffix", suffixSource]]) {
     if (!source) continue;
     const classification = classifyReadOnlyCommandList(source);
@@ -1908,7 +2295,11 @@ function classifyCdCommand(normalized) {
   if (!isSafeRelativeDir(dir) && !virtualWorkspacePath) {
     return { category: "blocked", reason: `cd target must be a safe workspace-relative directory: ${dir}` };
   }
-  const innerClassification = classifyShellSequence(inner.trim()) || classifyPipelineSequence(inner.trim()) || classifySimpleCommand(inner.trim());
+  const innerClassification = classifyReadOnlyCompoundSequence(inner.trim()) ||
+    classifyReadOnlyForLoop(inner.trim()) ||
+    classifyShellSequence(inner.trim()) ||
+    classifyPipelineSequence(inner.trim()) ||
+    classifySimpleCommand(inner.trim());
   if (innerClassification.category === "blocked") return innerClassification;
   return { ...innerClassification, cdDir: dir, virtualWorkspacePath };
 }
@@ -1929,7 +2320,9 @@ function classifyReadOnlyRootCd(normalized, config = {}) {
   const readOnlyRoot = configuredReadOnlyRoot(config, dir);
   if (!readOnlyRoot) return null;
 
-  const innerClassification = classifyShellSequence(inner.trim()) ||
+  const innerClassification = classifyReadOnlyCompoundSequence(inner.trim()) ||
+    classifyReadOnlyForLoop(inner.trim()) ||
+    classifyShellSequence(inner.trim()) ||
     classifyPipelineSequence(inner.trim()) ||
     classifySimpleCommand(inner.trim());
   const safeCategory = ["read-only", "network-fetch"].includes(innerClassification.category);

package/src/scs-evidence.js

@@ -2952,6 +2952,14 @@ export function finishResultClaimsBlocker(result = "") {
 
 export function finishResultClaimsIncompleteWork(result = "") {
   const text = String(result || "")
+    .replace(
+      /\b(?:earlier|previous|prior|former)\s+(?:step|attempt|run|verification|check|phase|command|process|audit)\s+(?:was|were|had\s+been)\s+(?:paused|pending|incomplete|unfinished)\b/gi,
+      ""
+    )
+    .replace(
+      /\b(?:(?:was|were|had\s+been)\s+)?(?:previously|formerly|earlier|already)\s+(?:paused|pending|incomplete|unfinished)\b/gi,
+      ""
+    )
     .replace(/\b(?:not|never)\s+(?:paused|pending|incomplete|unfinished)\b/gi, "")
     .replace(/\b(?:no|without)\s+(?:remaining|pending|unfinished)\s+(?:work|steps?|tasks?|actions?)\b/gi, "");
   const explicitIncompleteState =