@lazyingart/agintiflow 0.20.234 → 0.20.236

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.234",
+  "version": "0.20.236",
   "type": "module",
   "description": "AgInTiFlow is a project-aware agent workspace for hybrid wet-dry R&D, hardware-aware intelligence, software automation, and industrial workflows.",
   "license": "Apache-2.0",

package/scripts/smoke-coding-tools.js

@@ -1074,6 +1074,22 @@ try {
     documentBuildSequencePolicy.category === "general-shell",
     "document build sequence should remain broad trusted shell, not destructive"
   );
+  const documentIntegrityBuildPolicy = evaluateCommandPolicy(
+    "set -e; mkdir -p output .verification; echo '== source hashes BEFORE build =='; sha256sum README.md PROJECT_NOTES.md source/budget.csv source/meeting-notes.txt source/style-notes.md | tee .verification/src-before.sha256; echo '== chmod + build =='; chmod +x build.sh scripts/*.py; ./build.sh; echo '== source hashes AFTER build (must match BEFORE) =='; sha256sum README.md PROJECT_NOTES.md source/budget.csv source/meeting-notes.txt source/style-notes.md | tee .verification/src-after.sha256; diff .verification/src-before.sha256 .verification/src-after.sha256 && echo 'SOURCE FILES UNCHANGED (byte-for-byte preserved)'",
+    dockerWorkspacePolicy
+  );
+  assert(
+    documentIntegrityBuildPolicy.allowed,
+    "document integrity build with bounded workspace tee targets should be allowed in trusted Docker mode"
+  );
+  assert(
+    documentIntegrityBuildPolicy.category === "general-shell",
+    "document integrity build should remain broad trusted shell, not destructive"
+  );
+  const externalTeePolicy = evaluateCommandPolicy("tee /etc/aginti-test", dockerWorkspacePolicy);
+  assert(!externalTeePolicy.allowed, "tee outside the workspace should remain blocked");
+  const globTeePolicy = evaluateCommandPolicy("tee reports/*.txt", dockerWorkspacePolicy);
+  assert(!globTeePolicy.allowed, "tee wildcard targets should remain blocked");
   const hostGlobChmodPolicy = evaluateCommandPolicy("chmod +x scripts/*.py", hostWorkspacePolicy);
   assert(!hostGlobChmodPolicy.allowed, "host workspace chmod globs should require explicit trusted host access");
   const recursiveChmodPolicy = evaluateCommandPolicy("chmod -R +x scripts", dockerWorkspacePolicy);

package/scripts/smoke-document-artifact-quality.js

@@ -2,6 +2,7 @@ import assert from "node:assert/strict";
 
 import {
   evaluateCurrentStateText,
+  evaluateDocumentConsistency,
   evaluatePdfPageBalance,
   extractSupersededLiterals,
 } from "../src/document-artifact-quality.js";
@@ -42,6 +43,41 @@ const currentDocument = evaluateCurrentStateText({
 });
 assert.equal(currentDocument.ok, true, "authoritative current-state prose was rejected");
 
+const supersedesHistory = evaluateCurrentStateText({
+  sourceText: source,
+  outputText: "This document supersedes earlier planning notes. The current owner is Mei.",
+  currentStateRequired: true,
+});
+assert.equal(supersedesHistory.ok, false, "present-tense supersedes history was accepted");
+assert(
+  supersedesHistory.defects.some((item) => item.code === "historical-transition-prose"),
+  "present-tense supersedes did not produce a historical transition defect"
+);
+
+const inconsistentActions = evaluateDocumentConsistency([
+  "Three open actions remain.",
+  "Remaining Actions",
+  "Place filter order 28 August 2026",
+  "Provide wiring diagram 2 September 2026",
+  "Complete safety review 5 September 2026",
+  "Freeze checklist 10 September 2026",
+  "Budget",
+].join("\n"));
+assert.equal(inconsistentActions.ok, false, "declared action count contradicted by the action section was accepted");
+assert.equal(inconsistentActions.actionSectionItemCount, 4);
+assert.equal(inconsistentActions.defects[0]?.code, "action-count-inconsistency");
+
+const consistentActions = evaluateDocumentConsistency([
+  "Four open actions remain.",
+  "Remaining Actions",
+  "Place filter order 28 August 2026",
+  "Provide wiring diagram 2 September 2026",
+  "Complete safety review 5 September 2026",
+  "Freeze checklist 10 September 2026",
+  "Budget",
+].join("\n"));
+assert.equal(consistentActions.ok, true, "matching declared and section action counts were rejected");
+
 function page(
   words,
   { height = 842, startY = 60, endY = 700, heading = "Section", wordHeight = 10 } = {}

package/src/command-policy.js

@@ -733,7 +733,7 @@ function classifyBackgroundShell(normalized = "") {
 
 const SAFE_WORKSPACE_WRITE_PATTERNS = [/^mkdir\s+-p\s+[-\w./]+$/];
 const SAFE_CHMOD_MODE_PATTERN = /^[-+=,rwxugoXst0-7]+$/;
-const SAFE_CHMOD_TARGET_LIMIT = 64;
+const SAFE_WORKSPACE_TARGET_LIMIT = 64;
 const SAFE_ENV_ASSIGNMENT_NAMES = new Set(["ANDROID_HOME", "ANDROID_SDK_ROOT", "JAVA_HOME", "GRADLE_USER_HOME", "PATH"]);
 const SAFE_ENV_VALUE_PATTERN = /^[-\w./:@+,%]+$/;
 
@@ -1010,7 +1010,7 @@ function classifyWorkspacePermissionChange(normalized = "") {
   if (tokens[index] !== "chmod") return null;
   const mode = String(tokens[index + 1] || "");
   const targets = tokens.slice(index + 2);
-  if (!SAFE_CHMOD_MODE_PATTERN.test(mode) || !targets.length || targets.length > SAFE_CHMOD_TARGET_LIMIT) {
+  if (!SAFE_CHMOD_MODE_PATTERN.test(mode) || !targets.length || targets.length > SAFE_WORKSPACE_TARGET_LIMIT) {
     return null;
   }
   const unsafeTarget = targets.find((target) => !isSafeWorkspaceChmodTarget(target));
@@ -1030,6 +1030,33 @@ function classifyWorkspacePermissionChange(normalized = "") {
   };
 }
 
+function classifyWorkspaceTee(normalized = "") {
+  if (hasActiveShellExpansion(normalized)) return null;
+  const tokens = tokenizeShellWords(normalized);
+  if (tokens[0] !== "tee") return null;
+  let index = 1;
+  if (["-a", "--append"].includes(tokens[index])) index += 1;
+  if (tokens[index] === "--") index += 1;
+  const targets = tokens.slice(index);
+  if (!targets.length || targets.length > SAFE_WORKSPACE_TARGET_LIMIT) return null;
+  const unsafeTarget = targets.find(
+    (target) => target.includes("*") || !isSafeWorkspaceChmodTarget(target)
+  );
+  if (unsafeTarget) {
+    return {
+      category: "blocked",
+      reason: `tee target must be a bounded literal workspace-relative path: ${unsafeTarget}`,
+    };
+  }
+  return {
+    category: "workspace-write",
+    needsNetwork: false,
+    writesWorkspace: true,
+    virtualWorkspacePath: targets.some((target) => target.startsWith("/workspace/")),
+    reason: `Command writes standard input to ${targets.length} bounded workspace target${targets.length === 1 ? "" : "s"}.`,
+  };
+}
+
 function isInsideDirectory(root, candidate) {
   const relative = path.relative(root, candidate);
   return relative === "" || (relative && !relative.startsWith("..") && !path.isAbsolute(relative));
@@ -1427,6 +1454,8 @@ function classifySimpleCommand(normalized) {
   }
   const permissionChangeClassification = classifyWorkspacePermissionChange(normalized);
   if (permissionChangeClassification) return permissionChangeClassification;
+  const teeClassification = classifyWorkspaceTee(normalized);
+  if (teeClassification) return teeClassification;
   const gitCloneClassification = classifyGitClone(normalized);
   if (gitCloneClassification) return gitCloneClassification;
   const envExportClassification = classifySafeEnvExport(normalized);

package/src/document-artifact-quality.js

@@ -28,8 +28,24 @@ const EXCLUDED_DIRECTORY_NAMES = new Set([
 const INTENTIONAL_SPARSE_PAGE_PATTERN =
   /^(?:appendix|approval|approvals|acknowledgements?|back cover|contact|notes|references|sign[- ]?off|signatures?)\b/i;
 const HISTORICAL_TRANSITION_PATTERN =
-  /\b(?:formerly|no longer|previously|replac(?:ed|ing)|superseded|used to be)\b/i;
+  /\b(?:formerly|no longer|previously|replac(?:ed|ing)|supersed(?:e|ed|es|ing)|used to be)\b/i;
 const MIN_READABLE_MEDIAN_WORD_HEIGHT_PT = 8.8;
+const COUNT_WORDS = new Map([
+  ["zero", 0], ["one", 1], ["two", 2], ["three", 3], ["four", 4], ["five", 5],
+  ["six", 6], ["seven", 7], ["eight", 8], ["nine", 9], ["ten", 10],
+  ["eleven", 11], ["twelve", 12], ["thirteen", 13], ["fourteen", 14], ["fifteen", 15],
+  ["sixteen", 16], ["seventeen", 17], ["eighteen", 18], ["nineteen", 19], ["twenty", 20],
+]);
+const ACTION_COUNT_PATTERN = new RegExp(
+  `\\b(\\d+|${[...COUNT_WORDS.keys()].join("|")})\\s+(?:open|remaining|outstanding|pending)\\s+(?:action items?|actions?|tasks?|items?)\\b`,
+  "gi"
+);
+const ACTION_SECTION_HEADING_PATTERN =
+  /^\s*(?:remaining|open|outstanding|pending)\s+(?:action items?|actions?|tasks?|items?|next steps)\s*$/i;
+const DOCUMENT_SECTION_HEADING_PATTERN =
+  /^\s*(?:appendix|budget|current decisions?|executive summary|notes|references|risks?(?: and mitigations)?|summary)\s*$/i;
+const HUMAN_DATE_PATTERN =
+  /\b(?:\d{4}-\d{2}-\d{2}|\d{1,2}\s+(?:jan(?:uary)?|feb(?:ruary)?|mar(?:ch)?|apr(?:il)?|may|jun(?:e)?|jul(?:y)?|aug(?:ust)?|sep(?:tember)?|oct(?:ober)?|nov(?:ember)?|dec(?:ember)?)(?:\s+\d{4})?|(?:jan(?:uary)?|feb(?:ruary)?|mar(?:ch)?|apr(?:il)?|may|jun(?:e)?|jul(?:y)?|aug(?:ust)?|sep(?:tember)?|oct(?:ober)?|nov(?:ember)?|dec(?:ember)?)\s+\d{1,2}(?:,\s*\d{4})?)\b/gi;
 
 function portablePath(value = "") {
   return String(value || "").replace(/\\/g, "/");
@@ -248,6 +264,47 @@ export function evaluateCurrentStateText({ sourceText = "", outputText = "", cur
   return { ok: defects.length === 0, defects, supersededLiterals, presentSupersededLiterals };
 }
 
+function parsedCount(value = "") {
+  const normalized = String(value || "").trim().toLowerCase();
+  if (/^\d+$/.test(normalized)) return Number.parseInt(normalized, 10);
+  return COUNT_WORDS.get(normalized);
+}
+
+function actionSectionItemCount(outputText = "") {
+  const lines = String(outputText || "").split(/\r?\n/);
+  const headingIndex = lines.findIndex((line) => ACTION_SECTION_HEADING_PATTERN.test(line));
+  if (headingIndex < 0) return 0;
+  const section = [];
+  for (const line of lines.slice(headingIndex + 1)) {
+    if (DOCUMENT_SECTION_HEADING_PATTERN.test(line)) break;
+    section.push(line);
+  }
+  const sectionText = section.join("\n");
+  const dates = new Set(
+    [...sectionText.matchAll(HUMAN_DATE_PATTERN)].map((match) => normalizedComparableText(match[0]))
+  );
+  const bullets = section.filter((line) => /^\s*(?:[-*•]|\d+[.)])\s+\S/.test(line)).length;
+  return Math.max(dates.size, bullets);
+}
+
+export function evaluateDocumentConsistency(outputText = "") {
+  const defects = [];
+  const sectionCount = actionSectionItemCount(outputText);
+  if (sectionCount > 0) {
+    for (const match of String(outputText || "").matchAll(ACTION_COUNT_PATTERN)) {
+      const declaredCount = parsedCount(match[1]);
+      if (Number.isInteger(declaredCount) && declaredCount !== sectionCount) {
+        defects.push({
+          code: "action-count-inconsistency",
+          message: `The document declares ${declaredCount} open action${declaredCount === 1 ? "" : "s"}, but the Remaining Actions section contains ${sectionCount} dated/listed item${sectionCount === 1 ? "" : "s"}. Reconcile the summary and action table before delivery.`,
+        });
+        break;
+      }
+    }
+  }
+  return { ok: defects.length === 0, defects, actionSectionItemCount: sectionCount };
+}
+
 async function collectSourceDocuments(commandCwd) {
   const documents = [];
   let totalBytes = 0;
@@ -419,6 +476,7 @@ export async function validateWordDocumentArtifacts({
       if (artifact.extension === ".pdf") {
         const extracted = await extractPdf(artifact);
         const semantic = evaluateCurrentStateText({ sourceText, outputText: extracted.text, currentStateRequired });
+        const consistency = evaluateDocumentConsistency(extracted.text);
         const pageBalance = evaluatePdfPageBalance(extracted.bbox);
         if (!String(extracted.text || "").trim()) {
           defects.push({
@@ -435,6 +493,7 @@ export async function validateWordDocumentArtifacts({
           });
         }
         defects.push(...semantic.defects.map((item) => ({ ...item, path: artifact.path })));
+        defects.push(...consistency.defects.map((item) => ({ ...item, path: artifact.path })));
         defects.push(...pageBalance.defects.map((item) => ({ ...item, path: artifact.path })));
         artifactReports.push({
           path: artifact.path,
@@ -442,11 +501,13 @@ export async function validateWordDocumentArtifacts({
           textChars: extracted.text.length,
           pageCount: pageBalance.pages.length,
           pages: pageBalance.pages,
+          actionSectionItemCount: consistency.actionSectionItemCount,
           supersededLiterals: semantic.supersededLiterals,
         });
       } else {
         const text = await extractDocxText(artifact);
         const semantic = evaluateCurrentStateText({ sourceText, outputText: text, currentStateRequired });
+        const consistency = evaluateDocumentConsistency(text);
         if (!String(text || "").trim()) {
           defects.push({
             code: "empty-docx-text",
@@ -455,10 +516,12 @@ export async function validateWordDocumentArtifacts({
           });
         }
         defects.push(...semantic.defects.map((item) => ({ ...item, path: artifact.path })));
+        defects.push(...consistency.defects.map((item) => ({ ...item, path: artifact.path })));
         artifactReports.push({
           path: artifact.path,
           extension: artifact.extension,
           textChars: text.length,
+          actionSectionItemCount: consistency.actionSectionItemCount,
           supersededLiterals: semantic.supersededLiterals,
         });
       }

package/src/task-profiles.js

@@ -276,7 +276,7 @@ export const TASK_PROFILES = {
     id: "word",
     label: "Word documents",
     prompt:
-      "Bias toward Word/docx/document workflows while still using writing, conversion, LaTeX, or scripts when useful. Preserve source material byte-for-byte and synthesize a reader-facing document from the authoritative current facts instead of concatenating notes, logs, schemas, task IDs, private paths, or delivery instructions. Reconcile conflicting or superseded source facts before drafting: values labeled corrected, replaced, earlier, old, prior, cancelled, or no longer selected identify what to discard, and those discarded literals must not appear in the final document unless the user explicitly requests history or the history is necessary to explain a live decision. Keep the reconciliation history private: a current-state handoff should say who owns the work, which value is approved, and which option is selected, not narrate who was replaced or which preliminary value is no longer used. Before finishing, extract the final text and search for every superseded literal found in the sources. Prefer mature editable-document tooling already available in the workspace, such as python-docx, pandoc, or LibreOffice, over hand-written OOXML; when direct OOXML is genuinely necessary, validate its package parts and openability. Keep one maintainable source of truth and a reproducible project-local build command. Verify the DOCX is structurally editable, compile the PDF, run pdftotext or an equivalent extraction check that rejects replacement characters and unexpected control glyphs, and verify PDF text bounding boxes remain inside a readable page margin. Render every PDF page to a separate image under an ignored build/verification directory. Inspect one rendered page per read_image call, never batch pages into one vision call, and repair orphaned headings, near-empty spill pages, awkward table or paragraph breaks, overlaps, clipping, excessive whitespace, weak hierarchy, and inconsistent number formatting before finishing. Keep normal readable body type, line spacing, and margins; never shrink typography merely to force the document onto one page. When content spans pages, move or redistribute coherent sections so each page is useful instead of leaving a short spill page. Preserve an intentionally sparse appendix, approval, signature, reference, or back-matter page when it serves a real purpose. Retain ignored verification renders as evidence; optional cleanup must never block completion. Use clear descriptive filenames, exclude caches and generated debris from commits, inspect git status/diff before committing, and report success only after the editable source, reader-facing current-state content, visual layout, searchable text, and requested artifacts all pass.",
+      "Bias toward Word/docx/document workflows while still using writing, conversion, LaTeX, or scripts when useful. Preserve source material byte-for-byte and synthesize a reader-facing document from the authoritative current facts instead of concatenating notes, logs, schemas, task IDs, private paths, or delivery instructions. Reconcile conflicting or superseded source facts before drafting: values labeled corrected, replaced, earlier, old, prior, cancelled, or no longer selected identify what to discard, and those discarded literals must not appear in the final document unless the user explicitly requests history or the history is necessary to explain a live decision. Keep the reconciliation history private: a current-state handoff should say who owns the work, which value is approved, and which option is selected, not narrate who was replaced or which preliminary value is no longer used. Before finishing, extract the final text and search for every superseded literal found in the sources. Cross-check every quantitative statement against the detailed section it summarizes: counts of open actions, risks, decisions, line items, totals, dates, and owners must agree everywhere. Prefer mature editable-document tooling already available in the workspace, such as python-docx, pandoc, or LibreOffice, over hand-written OOXML; when direct OOXML is genuinely necessary, validate its package parts and openability. Keep one maintainable source of truth and a reproducible project-local build command. When reproducibility is requested, declare dependencies in project files and make the exact documented command work from a clean project shell; do not rely on inherited packages or claim that dependencies are already installed merely because the current agent container has them. Run that exact documented command, not only its inner generator. Verify the DOCX is structurally editable, compile the PDF, run pdftotext or an equivalent extraction check that rejects replacement characters and unexpected control glyphs, and verify PDF text bounding boxes remain inside a readable page margin. Render every PDF page to a separate image under an ignored build/verification directory. Inspect one rendered page per read_image call, never batch pages into one vision call, and repair orphaned headings, near-empty spill pages, awkward table or paragraph breaks, overlaps, clipping, excessive whitespace, weak hierarchy, and inconsistent number formatting before finishing. Keep normal readable body type, line spacing, and margins; never shrink typography merely to force the document onto one page. When content spans pages, move or redistribute coherent sections so each page is useful instead of leaving a short spill page. Preserve an intentionally sparse appendix, approval, signature, reference, or back-matter page when it serves a real purpose. Retain ignored verification renders as evidence; optional cleanup must never block completion. Use clear descriptive filenames, exclude caches and generated debris from commits, inspect git status/diff before committing, and honor any project instruction that requires an intentional clean commit even when the chat did not repeat it. Report success only after the editable source, reader-facing current-state content, internal consistency, visual layout, searchable text, exact documented build command, and requested artifacts all pass.",
     tools: ["files", "shell", "canvas", "sandbox"],
   },
   latex: {