@lazyingart/agintiflow 0.20.225 → 0.20.227

package/docs/runtime-modes-and-autonomy.md

@@ -73,7 +73,7 @@ Current contract:
 - `danger` is trusted host/full-access mode: host shell, destructive actions, host installs, password typing, and outside-workspace file paths are enabled. Use it only for tasks you trust; obvious secret/publish exfiltration guards remain hard stops.
 - Workspace file tools may read and write inside the configured project folder when file tools are enabled.
 - Narrow workspace-local shell actions such as safe probes, Gradle/TeX builds, and `chmod +x` on a project script may run when the command policy can classify them precisely.
-- Finite literal read-only audits may bind a small literal path, inspect/hash it, count matches through a bounded read-only pipeline, and display numeric results with `echo` or `printf` without asking for destructive permission. Shell line continuations are accepted for finite literal item lists. Every producer, consumer, and surrounding command must still classify as bounded read-only work; network access, redirects, secret/dynamic expansion, shell-state `printf -v`, mutation, dynamic item lists, and computed values used as executable arguments remain blocked.
+- Finite literal read-only audits may bind a small literal path, inspect/hash it, count matches through a bounded read-only pipeline, summarize stdin with `sort | uniq -c`, and display numeric results with `echo` or `printf` without asking for destructive permission. Shell line continuations are accepted for finite literal item lists. Every producer, consumer, and surrounding command must still classify as bounded read-only work; network access, redirects, output-file operands, secret/dynamic expansion, shell-state `printf -v`, mutation, dynamic item lists, and computed values used as executable arguments remain blocked.
 - Completion checks distinguish a resolved historical state such as "previously paused" from work that is currently pending or incomplete. A resolved past blocker therefore does not force another verification loop, while any explicit current unfinished state still does.
 - Android/JVM toolchain commands may include safe local env assignments such as `ANDROID_HOME`, `ANDROID_SDK_ROOT`, `JAVA_HOME`, or `GRADLE_USER_HOME`, plus small workspace-local status-log redirects. Secret-like env vars and redirects outside the workspace remain blocked.
 - Workspace writes outside that folder, secret paths, `.git` internals, and dependency folders such as `node_modules` are blocked.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.225",
+  "version": "0.20.227",
   "type": "module",
   "description": "AgInTiFlow is a project-aware agent workspace for hybrid wet-dry R&D, hardware-aware intelligence, software automation, and industrial workflows.",
   "license": "Apache-2.0",

package/scripts/smoke-coding-tools.js

@@ -714,6 +714,19 @@ try {
       exactReadOnlyFormattedReportAuditPolicy.writesWorkspace === false,
     "a literal-file formatted count audit incorrectly required destructive host permission"
   );
+  const exactReadOnlyMultiPatternSummary =
+    "grep -oF -e 'handoff/report.md' -e 'Reviewed master' -e 'ffprobe' report.md | sort | uniq -c";
+  const exactReadOnlyMultiPatternSummaryPolicy = evaluateCommandPolicy(
+    exactReadOnlyMultiPatternSummary,
+    hostWorkspacePolicy
+  );
+  assert(
+    exactReadOnlyMultiPatternSummaryPolicy.allowed &&
+      exactReadOnlyMultiPatternSummaryPolicy.category === "read-only" &&
+      exactReadOnlyMultiPatternSummaryPolicy.needsNetwork === false &&
+      exactReadOnlyMultiPatternSummaryPolicy.writesWorkspace === false,
+    "a bounded grep/sort/uniq count summary incorrectly required destructive host permission"
+  );
   const exactReadOnlyGitIdentityProbe =
     'git status --short && echo "TOPLEVEL=$(git rev-parse --show-toplevel 2>&1)" && echo "BRANCH=$(git rev-parse --abbrev-ref HEAD 2>&1)"';
   const exactReadOnlyGitIdentityProbePolicy = evaluateCommandPolicy(
@@ -797,6 +810,9 @@ try {
     'f=$(cat README.md); printf "%s\\n" "$f"; for s in one; do echo "$s"; done',
     'f=README.md; for s in one; do n=$(grep -oF -- "$s" "$f" | wc -l | tr -d " "); printf -v target "%s" "$n"; done',
     'f=README.md; for s in one; do n=$(grep -oF -- "$s" "$f" | wc -l | tr -d " "); rm -rf "$n"; done',
+    "grep -oF -e 'term' report.md | sort | uniq -c output.txt",
+    "grep -oF -e 'term' report.md | sort | uniq -c > output.txt",
+    'grep -oF -e "$(cat .aginti/.env)" report.md | sort | uniq -c',
     'for s in \'README.md; rm -rf report.md\'; do echo "$s"; done',
   ]) {
     const unsafeLoopSubstitutionPolicy = evaluateCommandPolicy(

package/scripts/smoke-truthful-completion.js

@@ -27,6 +27,13 @@ assert.equal(
   false,
   "resolved historical pause was mistaken for current unfinished work"
 );
+assert.equal(
+  finishResultClaimsIncompleteWork(
+    "The bounded verification (the previously-paused step) passed, and the audit is complete."
+  ),
+  false,
+  "a hyphenated resolved historical pause was mistaken for current unfinished work"
+);
 assert.equal(
   finishResultClaimsIncompleteWork(
     "The earlier step was paused and the report is still incomplete."

package/src/command-policy.js

@@ -96,6 +96,18 @@ function isReadOnlyTrDeleteFilter(command = "") {
   return tokens.length === 3 && tokens[0] === "tr" && tokens[1] === "-d";
 }
 
+function isReadOnlyUniqFilter(command = "") {
+  const normalized = stripBenignRedirections(command);
+  if (hasActiveShellExpansion(normalized)) return false;
+  const tokens = tokenizeShellWords(normalized);
+  if (!tokens.length || tokens[0] !== "uniq") return false;
+  // Restrict uniq to stdin-only display/count options. Positional operands are
+  // intentionally rejected because a second operand is an output file.
+  return tokens.slice(1).every((token) =>
+    /^(?:-[cdui]+|--(?:count|repeated|unique|ignore-case))$/.test(token)
+  );
+}
+
 function isReadOnlySha256Command(command = "") {
   const normalized = stripBenignRedirections(command);
   if (hasActiveShellExpansion(normalized)) return false;
@@ -1390,6 +1402,7 @@ function classifySimpleCommand(normalized) {
     matchAny(READ_ONLY_PATTERNS, commandForPatternMatching) ||
     isReadOnlyPrintfCommand(commandForPatternMatching) ||
     isReadOnlyTrDeleteFilter(commandForPatternMatching) ||
+    isReadOnlyUniqFilter(commandForPatternMatching) ||
     isReadOnlySha256Command(commandForPatternMatching) ||
     isReadOnlyFindCommand(normalized) ||
     (!hasActiveShellExpansion(benignRedirectCommand) && isReadOnlyShellCondition(benignRedirectCommand))

package/src/scs-evidence.js

@@ -2957,7 +2957,7 @@ export function finishResultClaimsIncompleteWork(result = "") {
       ""
     )
     .replace(
-      /\b(?:(?:was|were|had\s+been)\s+)?(?:previously|formerly|earlier|already)\s+(?:paused|pending|incomplete|unfinished)\b/gi,
+      /\b(?:(?:was|were|had\s+been)\s+)?(?:previously|formerly|earlier|already)[\s-]+(?:paused|pending|incomplete|unfinished)(?:[\s-]+(?:step|attempt|run|verification|check|phase|command|process|audit))?\b/gi,
       ""
     )
     .replace(/\b(?:not|never)\s+(?:paused|pending|incomplete|unfinished)\b/gi, "")