@lazyingart/agintiflow 0.20.227 → 0.20.228

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.227",
+  "version": "0.20.228",
   "type": "module",
   "description": "AgInTiFlow is a project-aware agent workspace for hybrid wet-dry R&D, hardware-aware intelligence, software automation, and industrial workflows.",
   "license": "Apache-2.0",

package/scripts/smoke-coding-tools.js

@@ -1115,6 +1115,27 @@ try {
   assert(cdWorkspacePolicy.allowed, "cd /workspace should be allowed in docker-workspace mode");
   const gitCleanDryRunPolicy = evaluateCommandPolicy("git clean -nd reports", dockerWorkspacePolicy);
   assert(gitCleanDryRunPolicy.allowed, "git clean dry-run should be allowed as read-only inspection evidence");
+  const gitRmCachedPolicy = evaluateCommandPolicy(
+    "git rm --cached -q build/__pycache__/content.cpython-312.pyc",
+    dockerWorkspaceNoInstallsPolicy
+  );
+  assert(gitRmCachedPolicy.allowed, "bounded git rm --cached should preserve the working tree and remain allowed");
+  assert(gitRmCachedPolicy.category === "git-workflow", "bounded git rm --cached should be a git workflow command");
+  const gitRmCachedRecursivePolicy = evaluateCommandPolicy(
+    "git rm --cached -r build",
+    dockerWorkspaceNoInstallsPolicy
+  );
+  assert(!gitRmCachedRecursivePolicy.allowed, "recursive git rm --cached should remain guarded");
+  const gitRmCachedGlobPolicy = evaluateCommandPolicy(
+    "git rm --cached 'build/**/*.pyc'",
+    dockerWorkspaceNoInstallsPolicy
+  );
+  assert(!gitRmCachedGlobPolicy.allowed, "globbed git rm --cached should remain guarded");
+  const gitRmWorkingTreePolicy = evaluateCommandPolicy(
+    "git rm build/content.py",
+    dockerWorkspaceNoInstallsPolicy
+  );
+  assert(!gitRmWorkingTreePolicy.allowed, "git rm without --cached must remain guarded");
   const localGitInitPolicy = evaluateCommandPolicy("git init", dockerWorkspaceNoInstallsPolicy);
   assert(localGitInitPolicy.allowed, "local git init should be allowed without package installs");
   assert(localGitInitPolicy.category === "git-workflow", "local git init should be classified as git-workflow");

package/scripts/smoke-scs-evidence-visibility.js

@@ -264,6 +264,16 @@ assert(
   "excluding output filenames also removed a real required text term"
 );
 
+const wordDocumentContract = deriveScsTaskContract({
+  goal: "Create an editable DOCX and a phone-friendly PDF, then verify both outputs.",
+  taskProfile: "word",
+});
+assert.deepEqual(
+  wordDocumentContract.requiredEvidence.map((item) => item.category).sort(),
+  ["artifact", "command", "file"],
+  "Word document production must require written files, validation, and durable artifacts"
+);
+
 const groundingRoot = fs.mkdtempSync(path.join(os.tmpdir(), "aginti-source-grounding-"));
 try {
   const reportPath = path.join(groundingRoot, "READINESS.md");

package/src/command-policy.js

@@ -1226,6 +1226,48 @@ function classifyGitCleanDryRun(normalized) {
   };
 }
 
+function classifyGitRmCached(normalized) {
+  if (!/^git\s+rm\b/.test(normalized) || hasActiveShellExpansion(normalized)) return null;
+  const tokens = tokenizeShellWords(normalized);
+  if (tokens[0] !== "git" || tokens[1] !== "rm") return null;
+
+  let cached = false;
+  const paths = [];
+  let afterOptions = false;
+  for (const token of tokens.slice(2)) {
+    if (!afterOptions && token === "--") {
+      afterOptions = true;
+      continue;
+    }
+    if (!afterOptions && ["--cached"].includes(token)) {
+      cached = true;
+      continue;
+    }
+    if (!afterOptions && ["-q", "--quiet"].includes(token)) continue;
+    if (!afterOptions && token.startsWith("-")) return null;
+    paths.push(token);
+  }
+  if (!cached || !paths.length || paths.length > 20) return null;
+  if (
+    paths.some(
+      (target) =>
+        target === "." ||
+        /[*?\[\]{}]/.test(target) ||
+        !isSafeRelativeDir(target)
+    )
+  ) {
+    return null;
+  }
+  return {
+    category: "git-workflow",
+    needsNetwork: false,
+    writesWorkspace: true,
+    gitOnly: true,
+    reason:
+      "Git rm --cached removes only bounded literal workspace paths from the index; working-tree files are preserved.",
+  };
+}
+
 function classifyGitClone(normalized) {
   const match = normalized.match(
     /^git\s+clone(?:\s+--depth\s+\d+)?(?:\s+--branch\s+[-\w./]+)?\s+(https:\/\/\S+)(?:\s+([-\w./]+))?$/
@@ -1305,6 +1347,8 @@ function classifySimpleCommand(normalized) {
   }
   const gitCleanDryRun = classifyGitCleanDryRun(normalized);
   if (gitCleanDryRun) return gitCleanDryRun;
+  const gitRmCached = classifyGitRmCached(normalized);
+  if (gitRmCached) return gitRmCached;
   const scopedReadOnlyGitProbe = classifyScopedReadOnlyGitProbe(normalized);
   if (scopedReadOnlyGitProbe) return scopedReadOnlyGitProbe;
   const gitWorkflowClassification = classifyGitWorkflow(normalized);

package/src/scs-evidence.js

@@ -259,7 +259,7 @@ const PROFILE_REQUIREMENTS = {
   design: ["artifact", "visual"],
   image: ["artifact", "visual"],
   slides: ["artifact"],
-  word: ["artifact"],
+  word: ["file", "command", "artifact"],
   data: ["file", "command", "artifact"],
   qa: ["command"],
   review: ["command"],

package/src/task-profiles.js

@@ -276,7 +276,7 @@ export const TASK_PROFILES = {
     id: "word",
     label: "Word documents",
     prompt:
-      "Bias toward Word/docx/document workflows while still using writing, conversion, LaTeX, or scripts when useful. Preserve originals, create clear output filenames, use available local tools such as pandoc/libreoffice/python packages when present, and verify generated documents exist before reporting success.",
+      "Bias toward Word/docx/document workflows while still using writing, conversion, LaTeX, or scripts when useful. Preserve source material byte-for-byte and synthesize a reader-facing document from the current corrected facts instead of concatenating notes, logs, schemas, task IDs, private paths, or delivery instructions. Prefer mature editable-document tooling already available in the workspace, such as python-docx, pandoc, or LibreOffice, over hand-written OOXML; when direct OOXML is genuinely necessary, validate its package parts and openability. Keep one maintainable source of truth and a reproducible project-local build command. Verify the DOCX is structurally editable, render or convert it for visual inspection, compile the PDF, inspect every rendered page, and run pdftotext or an equivalent extraction check that rejects replacement characters and unexpected control glyphs. Resolve stale-versus-current facts explicitly, use clear descriptive filenames, exclude caches and generated debris from commits, inspect git status/diff before committing, and report success only after the editable source, reader-facing content, visual layout, searchable text, and requested artifacts all pass.",
     tools: ["files", "shell", "canvas", "sandbox"],
   },
   latex: {