@lazyingart/agintiflow 0.20.237 → 0.20.239

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.237",
+  "version": "0.20.239",
   "type": "module",
   "description": "AgInTiFlow is a project-aware agent workspace for hybrid wet-dry R&D, hardware-aware intelligence, software automation, and industrial workflows.",
   "license": "Apache-2.0",

package/scripts/smoke-coding-tools.js

@@ -14,6 +14,7 @@ import {
   runAgent,
   sanitizeToolResult,
   toolResultForModel,
+  shouldPauseForPermissionAdvice,
   shouldShortCircuitToolBatch,
   shellDiagnosticHint,
   skippedAfterBlockedToolResult,
@@ -1311,6 +1312,79 @@ try {
     ),
     "an explicitly requested deletion was incorrectly treated as optional housekeeping"
   );
+  assert(
+    isUnrequestedCleanupCommand(
+      "run_command",
+      { command: "rm -rf /tmp/run-a /tmp/run-b" },
+      {
+        goal:
+          "Continue the deterministic comparison. Do not delete any project or temporary directory; use fresh paths instead.",
+      },
+      {}
+    ),
+    "a negated deletion constraint was mistaken for destructive authorization"
+  );
+  const negatedCleanupAdvice = buildPermissionAdvice({
+    toolName: "run_command",
+    args: { command: "rm -rf /tmp/run-a /tmp/run-b" },
+    guard: {
+      category: "destructive",
+      reason: "Destructive shell commands require Allow destructive actions.",
+    },
+    config: {
+      ...dockerWorkspacePolicy,
+      goal: "Do not delete any project or temporary directory; keep working on the build.",
+    },
+    state: { sessionId: "coding-negated-cleanup-smoke" },
+  });
+  assert(
+    negatedCleanupAdvice.autoRecover === true,
+    "blocked cleanup under a do-not-delete goal should recover without pausing"
+  );
+  const dynamicEvidenceAdvice = buildPermissionAdvice({
+    toolName: "run_command",
+    args: {
+      command:
+        'STAMP=$(date -u +%Y%m%dT%H%M%SZ); bash build.sh 2>&1 | tee ".aginti/build-${STAMP}.log"',
+    },
+    guard: {
+      category: "destructive",
+      reason:
+        'Command contains a write-capable or destructive token: tee ".aginti/build-${STAMP}.log"',
+    },
+    config: {
+      ...dockerWorkspacePolicy,
+      goal: "Build twice and retain deterministic evidence without deleting anything.",
+    },
+    state: { sessionId: "coding-dynamic-evidence-smoke" },
+  });
+  assert(
+    dynamicEvidenceAdvice.autoRecover === true &&
+      /literal workspace-relative evidence paths/i.test(dynamicEvidenceAdvice.instruction),
+    "dynamic evidence filename false positive should recover into literal workspace paths"
+  );
+  assert(
+    !shouldPauseForPermissionAdvice({ blocked: true, permissionAdvice: dynamicEvidenceAdvice }),
+    "dynamic evidence filename recovery still produced a permission pause"
+  );
+  const destructiveDynamicEvidenceAdvice = buildPermissionAdvice({
+    toolName: "run_command",
+    args: {
+      command:
+        'rm -rf output; STAMP=$(date -u +%Y%m%dT%H%M%SZ); bash build.sh 2>&1 | tee ".aginti/build-${STAMP}.log"',
+    },
+    guard: {
+      category: "destructive",
+      reason: "Destructive shell commands require Allow destructive actions.",
+    },
+    config: { ...dockerWorkspacePolicy, goal: "Build and verify the document." },
+    state: { sessionId: "coding-destructive-dynamic-evidence-smoke" },
+  });
+  assert(
+    destructiveDynamicEvidenceAdvice.autoRecover === true &&
+      /Unrequested cleanup was blocked safely/i.test(destructiveDynamicEvidenceAdvice.summary),
+    "a real cleanup token should not be mislabeled as only dynamic evidence formatting"
+  );
   const documentPageBatchGuard = checkToolUse({
     toolName: "read_image",
     args: { imagePaths: ["build/verification/page-1.png", "build/verification/page-2.png"] },

package/scripts/smoke-context-budget-recovery.js

@@ -144,6 +144,8 @@ const runtimeMessages = buildContextBudgetCompactionMessages(
           toolName: "read_file",
           path: "/evidence/Musia/SKILL.md",
           bytes: 2048,
+          sha256: "1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef",
+          contentTruncated: false,
           content: [
             "---",
             "name: musia-music-production",
@@ -187,9 +189,12 @@ assert.ok(runtimeText.includes("Retained source evidence"));
 assert.ok(runtimeText.includes("/evidence/Musia/SKILL.md"));
 assert.ok(runtimeText.includes("Create and review songs through the established Musia production workflow"));
 assert.ok(runtimeText.includes("# Musia Music Production"));
+assert.ok(runtimeText.includes("sha256=1234567890abcdef"));
+assert.ok(runtimeText.includes("content=complete"));
 assert.ok(runtimeText.includes("node bin/musia.js doctor --json"));
 assert.ok(runtimeText.includes("scripts/xyq_cdp_browser.py"));
 assert.ok(!runtimeText.includes("OLD-COMPACTION-MUST-NOT-RECUR"));
 assert.match(runtimeText, /Do not reread a listed source solely because compaction occurred/);
+assert.match(runtimeText, /never restart a full-file read loop after compaction/);
 
 console.log("context budget recovery smoke passed");

package/scripts/smoke-document-artifact-quality.js

@@ -3,7 +3,9 @@ import assert from "node:assert/strict";
 import {
   evaluateCurrentStateText,
   evaluateDocumentConsistency,
+  evaluateExtractedDocumentText,
   evaluatePdfPageBalance,
+  evaluatePdfTextBounds,
   extractSupersededLiterals,
 } from "../src/document-artifact-quality.js";
 
@@ -122,4 +124,21 @@ const readableOnePage = evaluatePdfPageBalance(
 );
 assert.equal(readableOnePage.ok, true, "readable one-page typography was rejected");
 
+const cleanExtractedText = evaluateExtractedDocumentText("Page one\n\fPage two\tvalue\r\n");
+assert.equal(cleanExtractedText.ok, true, "normal whitespace and PDF form feeds were rejected");
+
+const corruptExtractedText = evaluateExtractedDocumentText("Reference detector \u0016 complete \ufffd");
+assert.equal(corruptExtractedText.ok, false, "control and replacement glyphs were accepted");
+assert.deepEqual(corruptExtractedText.codePoints, [0x16, 0xfffd]);
+assert.equal(corruptExtractedText.defects[0]?.code, "corrupt-extracted-text");
+
+const boundedText = evaluatePdfTextBounds(`<doc>${page(20)}</doc>`);
+assert.equal(boundedText.ok, true, "text inside readable margins was rejected");
+
+const clippedText = evaluatePdfTextBounds(
+  '<doc><page width="595" height="842"><word xMin="8" yMin="60" xMax="90" yMax="70">clipped</word></page></doc>'
+);
+assert.equal(clippedText.ok, false, "text outside readable margins was accepted");
+assert.equal(clippedText.defects[0]?.code, "pdf-text-outside-readable-margin");
+
 console.log("document artifact quality smoke test passed");

package/scripts/smoke-dynamic-step-budget.js

@@ -2281,6 +2281,27 @@ try {
     shellMutationState.meta.projectVerification?.mutationRevision === 1,
     "git metadata incorrectly invalidated current project-content verification"
   );
+  const gitMetadataWithObservationsResult = {
+    toolName: "run_command",
+    ok: true,
+    exitCode: 0,
+    args: {
+      command:
+        "git add report.md && git commit -m 'record verified report' && echo '=== status ===' && git status --porcelain && git log -1 --oneline",
+    },
+    stdout: "=== status ===\nabc123 record verified report",
+    stderr: "",
+  };
+  recordProjectVerificationOutcome(shellMutationState, gitMetadataWithObservationsResult, {
+    commandCwd: workspace,
+    taskProfile: "writing",
+    allowShellTool: true,
+    sandboxMode: "host",
+  });
+  assert(
+    shellMutationState.meta.projectVerification?.mutationRevision === 1,
+    "metadata-only Git chain with observational output invalidated current verification"
+  );
   const gitCheckoutResult = {
     toolName: "run_command",
     ok: true,

package/scripts/smoke-model-roles.js

@@ -29,7 +29,13 @@ import {
   shouldActivateScs,
   shouldRequestScsReplan,
 } from "../src/scs-controller.js";
-import { buildScsEvidenceLedger, deriveScsTaskContract, evaluateScsEvidence } from "../src/scs-evidence.js";
+import {
+  buildScsEvidenceLedger,
+  deriveScsTaskContract,
+  evaluateScsEvidence,
+  gitActionsSatisfyContract,
+  inferSuccessfulGitActionsFromCommandResult,
+} from "../src/scs-evidence.js";
 import { resolveRuntimeConfig } from "../src/config.js";
 import { classifyGoalIntent, isDirectAnswerIntent } from "../src/goal-intent.js";
 import { languageWriterDefaults } from "../src/writing-specialist.js";
@@ -922,6 +928,26 @@ assert(
     !committedEvaluation.missing.some((item) => item.category === "git"),
   "a successful git commit did not satisfy the explicit git requirement"
 );
+const recoveredCommitActions = inferSuccessfulGitActionsFromCommandResult({
+  ok: true,
+  exitCode: 0,
+  args: {
+    command:
+      'echo "seed author: $(git log -1 --format=\'%an <%ae>\')"; git config user.name "$(git log -1 --format=\'%an\')"; git commit -m "finish handoff" && git log -1 --oneline',
+  },
+  stdout: "[main abc1234] finish handoff\n 8 files changed, 499 insertions(+)",
+});
+assert(
+  recoveredCommitActions.length === 1 && recoveredCommitActions[0] === "commit",
+  "a canonical successful commit was lost because its command had a setup prefix or shell expansion"
+);
+assert(
+  gitActionsSatisfyContract(
+    { requiredGitActions: ["add", "commit"] },
+    recoveredCommitActions
+  ),
+  "a successful commit did not satisfy the implied staging step after a partially successful add/commit chain"
+);
 const explainCodeContract = deriveScsTaskContract({
   goal: "Explain JavaScript closures at a high level.",
   taskProfile: "code",

package/scripts/smoke-progressive-tool-selection.js

@@ -2471,6 +2471,25 @@ assert(recoveredMixedBatch.ok, "valid mixed batch could not recover through boun
 assert(recoveredMixedBatch.recoveredSequentially, "mixed batch recovery was not recorded");
 assert(recoveredMixedBatch.acceptedToolCalls.length === 1, "mixed batch recovery dispatched more than one call");
 assert(recoveredMixedBatch.deferredToolCalls.length === 1, "mixed batch recovery did not defer the extra call");
+const fiveCallMixedBatch = [
+  ...safeReadCalls,
+  contractCall("safe-read-four", "read_file", { path: "fourth.txt" }),
+  contractCall("deferred-write-five", "write_file", { path: "later.txt", content: "later" }),
+];
+const recoveredFiveCallMixedBatch = resolveDispatchableToolCallBatch(
+  fiveCallMixedBatch,
+  createToolContract([...safeReadDescriptors, strictWriteDescriptor])
+);
+assert(recoveredFiveCallMixedBatch.ok, "five-call mixed batch was rejected instead of bounded deferral");
+assert(
+  recoveredFiveCallMixedBatch.acceptedToolCalls.length === 1 &&
+    recoveredFiveCallMixedBatch.deferredToolCalls.length === 4,
+  "five-call mixed batch did not dispatch exactly one call and preserve the suffix"
+);
+assert(
+  recoveredFiveCallMixedBatch.deferredToolCalls.at(-1)?.function?.name === "write_file",
+  "bounded mixed recovery lost or executed the deferred write"
+);
 const oversizedReadCalls = Array.from({ length: 5 }, (_, index) =>
   contractCall(`read-${index}`, "read_file", { path: `file-${index}.txt` })
 );
@@ -2492,6 +2511,13 @@ assert(
   !resolveDispatchableToolCallBatch(excessiveReadBatch, safeReadContract).ok,
   "unbounded safe read batch escaped the reported-call cap"
 );
+assert(
+  !resolveDispatchableToolCallBatch(
+    [...excessiveReadBatch.slice(0, 12), contractCall("excessive-write", "write_file", { path: "later.txt", content: "later" })],
+    createToolContract([...safeReadDescriptors, strictWriteDescriptor])
+  ).ok,
+  "unbounded mixed batch escaped the reported-call cap"
+);
 
 for (const [label, call, expectedCode] of [
   [

package/skills/word-documents/SKILL.md

@@ -20,3 +20,16 @@ tools:
 Prefer safe conversions through available tools such as `pandoc`, `libreoffice`, or Python libraries when installed. Preserve originals; write converted or edited outputs to a new file unless overwrite is explicit.
 
 If binary `.docx` content cannot be inspected directly, explain the needed converter and create a project-local script or setup note.
+
+For a repository handoff or generated document project:
+
+- synthesize the authoritative current state instead of narrating superseded values unless history was requested;
+- keep editable source plus the requested reader format, normally DOCX and a phone-readable PDF;
+- provide and document a conventional project-local `build.sh` entry point, even when it delegates to a Python or TeX implementation;
+- make a clean-checkout build provision or clearly verify its dependencies rather than relying silently on the current shell;
+- preserve source inputs byte-for-byte and keep session data, visual-inspection renders, LaTeX intermediates, caches, and other transient evidence ignored; prefer ignore rules over deleting evidence, and never couple cleanup commands to the build or validation command;
+- validate extracted DOCX/PDF text for current facts, stale or private values, encoding damage, and missing action/evidence content;
+- render every PDF page and inspect it for clipping, overlap, orphaned headings, sparse spill pages, readable margins, and phone-scale readability;
+- when the task is in a git repository and requests a finished handoff, commit only intentional project files and finish with a clean worktree unless the user says not to commit.
+
+Visual polish does not establish content quality. Cross-check names, dates, totals, counts, statuses, decisions, actions, risks, evidence, and limitations against the source material before completion.

package/src/agent-runner.js

@@ -826,6 +826,12 @@ function summarizeRetainedSourceEvidence(messages = [], limit = 28) {
     const parts = [`tool=${toolName}`];
     if (sourcePath) parts.push(`path=${sourcePath}`);
     if (Number.isFinite(Number(payload.bytes))) parts.push(`bytes=${Number(payload.bytes)}`);
+    if (payload.sha256) parts.push(`sha256=${String(payload.sha256).slice(0, 16)}`);
+    if (payload.contentTruncated === true || payload.contentTruncatedByLines === true) {
+      parts.push("content=truncated");
+    } else if (toolName === "read_file" && typeof payload.content === "string") {
+      parts.push("content=complete");
+    }
     if (payload.summary) parts.push(`summary=${compactSingleLine(payload.summary, 220)}`);
     if (toolName === "read_file") {
       const semantic = summarizeReadSemanticEvidence(payload);
@@ -1249,6 +1255,7 @@ function buildCompactedRuntimeMessages(state, config, snapshot, step, options =
     "",
     "Retained source evidence summaries (already inspected; reread an exact source only when its needed content is absent here):",
     "Do not reread a listed source solely because compaction occurred.",
+    "A content=complete entry is authoritative for that recorded sha256. Use search_files or one bounded range read only when an exact edit anchor is absent; never restart a full-file read loop after compaction.",
     ...(retainedSourceEvidence.length
       ? retainedSourceEvidence.map((item) => `- ${item}`)
       : ["- No structured source evidence was available before compaction."]),
@@ -5986,6 +5993,17 @@ const WORKTREE_CHANGING_GIT_ACTIONS = new Set([
 
 function commandCanMutateProjectContent(command = "", commandPolicy = {}) {
   if (commandPolicy.writesWorkspace !== true && commandPolicy.mayMutateProject !== true) return false;
+  const sequence = parseTopLevelShellSequence(String(command || ""));
+  if (
+    sequence.commands.length > 1 &&
+    !sequence.openQuote &&
+    !sequence.trailingEscape &&
+    !sequence.trailingSeparator
+  ) {
+    return sequence.commands.some((segment) =>
+      commandCanMutateProjectContent(segment, classifyCommand(segment))
+    );
+  }
   const category = String(commandPolicy.category || "");
   if (!["git-workflow", "git-remote"].includes(category)) return true;
   if (/\bgit\s+clone\b/i.test(String(command || ""))) return true;
@@ -11787,9 +11805,9 @@ export async function runAgent(config) {
           content: [
             "Runtime batching note: the valid tool batch exceeded the bounded per-turn dispatch limit.",
             `The first ${toolCalls.length} call(s) ran sequentially; do not repeat them.`,
-            "These remaining read-only calls were deferred and did not run:",
+            "These remaining calls were deferred and did not run:",
             ...deferredSummary,
-            "Request only the specific deferred reads still needed, in a bounded batch, then move to the requested artifact.",
+            "Review the deferred list, request only the calls still needed in a bounded batch, and do not assume any deferred write or command ran.",
           ].join("\n"),
         });
       }

package/src/document-artifact-quality.js

@@ -30,6 +30,7 @@ const INTENTIONAL_SPARSE_PAGE_PATTERN =
 const HISTORICAL_TRANSITION_PATTERN =
   /\b(?:formerly|no longer|previously|replac(?:ed|ing)|supersed(?:e|ed|es|ing)|used to be)\b/i;
 const MIN_READABLE_MEDIAN_WORD_HEIGHT_PT = 8.8;
+const MIN_READABLE_HORIZONTAL_MARGIN_PT = 18;
 const COUNT_WORDS = new Map([
   ["zero", 0], ["one", 1], ["two", 2], ["three", 3], ["four", 4], ["five", 5],
   ["six", 6], ["seven", 7], ["eight", 8], ["nine", 9], ["ten", 10],
@@ -239,6 +240,49 @@ export function evaluatePdfPageBalance(bboxXml = "") {
   };
 }
 
+export function evaluateExtractedDocumentText(text = "") {
+  const unexpected = [...String(text || "").matchAll(/[\u0000-\u0008\u000b\u000e-\u001f\u007f-\u009f\ufffd]/gu)]
+    .map((match) => match[0].codePointAt(0))
+    .filter(Number.isInteger);
+  const codePoints = [...new Set(unexpected)].sort((a, b) => a - b);
+  const defects = [];
+  if (codePoints.length) {
+    defects.push({
+      code: "corrupt-extracted-text",
+      message: `The independently extracted reader text contains unexpected control or replacement glyphs: ${codePoints
+        .map((value) => `U+${value.toString(16).toUpperCase().padStart(4, "0")}`)
+        .join(", ")}. Repair the document encoding or generator instead of stripping these bytes only during validation.`,
+    });
+  }
+  return { ok: defects.length === 0, defects, codePoints };
+}
+
+export function evaluatePdfTextBounds(bboxXml = "", minimumMargin = MIN_READABLE_HORIZONTAL_MARGIN_PT) {
+  const pages = parsePdfBboxPages(bboxXml);
+  const defects = [];
+  for (const [index, page] of pages.entries()) {
+    if (!Number.isFinite(page.width) || page.width <= 0) continue;
+    const outside = page.words.filter((word) =>
+      word.text && (
+        !Number.isFinite(word.xMin) ||
+        !Number.isFinite(word.xMax) ||
+        word.xMin < minimumMargin ||
+        word.xMax > page.width - minimumMargin
+      )
+    );
+    if (!outside.length) continue;
+    const sample = outside
+      .slice(0, 4)
+      .map((word) => `${JSON.stringify(word.text)} at ${Number(word.xMin).toFixed(1)}..${Number(word.xMax).toFixed(1)} pt`)
+      .join("; ");
+    defects.push({
+      code: "pdf-text-outside-readable-margin",
+      message: `PDF page ${index + 1} places ${outside.length} text item${outside.length === 1 ? "" : "s"} outside the ${minimumMargin} pt horizontal readability margin (${sample}). Reflow the text or table instead of accepting clipping.`,
+    });
+  }
+  return { ok: pages.length > 0 && defects.length === 0, checked: pages.length > 0, defects };
+}
+
 export function evaluateCurrentStateText({ sourceText = "", outputText = "", currentStateRequired = false } = {}) {
   const supersededLiterals = extractSupersededLiterals(sourceText);
   const presentSupersededLiterals = supersededLiterals.filter((literal) => containsLiteral(outputText, literal));
@@ -475,9 +519,11 @@ export async function validateWordDocumentArtifacts({
     try {
       if (artifact.extension === ".pdf") {
         const extracted = await extractPdf(artifact);
+        const textQuality = evaluateExtractedDocumentText(extracted.text);
         const semantic = evaluateCurrentStateText({ sourceText, outputText: extracted.text, currentStateRequired });
         const consistency = evaluateDocumentConsistency(extracted.text);
         const pageBalance = evaluatePdfPageBalance(extracted.bbox);
+        const textBounds = evaluatePdfTextBounds(extracted.bbox);
         if (!String(extracted.text || "").trim()) {
           defects.push({
             code: "empty-pdf-text",
@@ -493,8 +539,10 @@ export async function validateWordDocumentArtifacts({
           });
         }
         defects.push(...semantic.defects.map((item) => ({ ...item, path: artifact.path })));
+        defects.push(...textQuality.defects.map((item) => ({ ...item, path: artifact.path })));
         defects.push(...consistency.defects.map((item) => ({ ...item, path: artifact.path })));
         defects.push(...pageBalance.defects.map((item) => ({ ...item, path: artifact.path })));
+        defects.push(...textBounds.defects.map((item) => ({ ...item, path: artifact.path })));
         artifactReports.push({
           path: artifact.path,
           extension: artifact.extension,
@@ -506,6 +554,7 @@ export async function validateWordDocumentArtifacts({
         });
       } else {
         const text = await extractDocxText(artifact);
+        const textQuality = evaluateExtractedDocumentText(text);
         const semantic = evaluateCurrentStateText({ sourceText, outputText: text, currentStateRequired });
         const consistency = evaluateDocumentConsistency(text);
         if (!String(text || "").trim()) {
@@ -516,6 +565,7 @@ export async function validateWordDocumentArtifacts({
           });
         }
         defects.push(...semantic.defects.map((item) => ({ ...item, path: artifact.path })));
+        defects.push(...textQuality.defects.map((item) => ({ ...item, path: artifact.path })));
         defects.push(...consistency.defects.map((item) => ({ ...item, path: artifact.path })));
         artifactReports.push({
           path: artifact.path,

package/src/permission-advice.js

@@ -67,11 +67,40 @@ export function isOptionalGeneratedPreviewCleanup(toolName = "", args = {}) {
   );
 }
 
+export function isRecoverableDynamicEvidenceWrite(toolName = "", args = {}, guard = {}) {
+  if (toolName !== "run_command" || guard?.category !== "destructive") return false;
+  const command = String(args.command || args.text || "");
+  if (!/\btee\s+/i.test(command)) return false;
+  if (
+    /(?:^|[;&|\n]\s*)(?:command\s+)?(?:rm|rmdir|mv|chmod|chown)\b/i.test(command) ||
+    /\bgit\s+(?:checkout|switch|reset|clean)\b/i.test(command) ||
+    /(?:^|\s)-delete(?:\s|$)/i.test(command)
+  ) {
+    return false;
+  }
+  const dynamicWorkspaceEvidenceTarget = new RegExp(
+    String.raw`\btee\s+(?:--?append\s+|-a\s+)?["']?(?:\.aginti|artifacts|build/verification|output/verification)/[^\n;|]*\$\{?[A-Z_][A-Z0-9_]*\}?`,
+    "i"
+  );
+  return dynamicWorkspaceEvidenceTarget.test(command);
+}
+
 function goalRequestsDeletion(config = {}, state = {}) {
   const goal = String(config.goal || state.goal || state.meta?.goalContract?.current || "");
-  return /\b(?:delete|remove|clean\s+up|cleanup|purge|erase|discard|drop)\b|删除|刪除|移除|清理|清除|删掉|刪掉|削除|消去/i.test(
-    goal
-  );
+  const deletionIntent = /\b(?:delete|remove|clean\s+up|cleanup|purge|erase|discard|drop)\b|删除|刪除|移除|清理|清除|删掉|刪掉|削除|消去/i;
+  if (!deletionIntent.test(goal)) return false;
+
+  // A safety constraint such as "do not delete" is the opposite of
+  // authorization. Strip bounded negated phrases before looking for a genuine
+  // deletion request elsewhere in the goal.
+  const withoutNegatedDeletion = goal
+    .replace(
+      /\b(?:do\s+not|don't|dont|never|must\s+not|should\s+not|shouldn't|without)\s+(?:retry(?:ing)?\s+or\s+)?(?:delete|remove|clean\s+up|cleanup|purge|erase|discard|drop)(?:\s+any)?\b/gi,
+      " "
+    )
+    .replace(/(?:不要|不可|禁止|无需|無需|不需要)(?:再)?(?:删除|刪除|移除|清理|清除|删掉|刪掉)/g, " ")
+    .replace(/(?:削除|消去)(?:しない|するな|不要)/g, " ");
+  return deletionIntent.test(withoutNegatedDeletion);
 }
 
 export function isUnrequestedCleanupCommand(toolName = "", args = {}, config = {}, state = {}) {
@@ -291,6 +320,21 @@ function adviceForCategory(category = "", { toolName = "", args = {}, config = {
   }
 
   if (category === "destructive") {
+    if (isRecoverableDynamicEvidenceWrite(toolName, args, { category, reason })) {
+      return {
+        ...base,
+        autoRecover: true,
+        summary:
+          "A generated-evidence command used a shell-expanded output filename that the workspace guard could not prove safe. The command stayed blocked, but no destructive permission is needed.",
+        instruction:
+          "Do not retry the same command and do not request destructive approval. Reissue the check with fresh literal workspace-relative evidence paths under `.aginti/verification/`; avoid variables, globs, and `/tmp` in tee/redirection targets, then continue the substantive validation.",
+        options: [
+          "Use a literal timestamp or nonce already written into the command text.",
+          "Keep every log, hash file, and render under `.aginti/verification/`.",
+          "Split the build and evidence checks into smaller commands if that makes each output path explicit.",
+        ],
+      };
+    }
     if (
       isOptionalGeneratedPreviewCleanup(toolName, args) ||
       isUnrequestedCleanupCommand(toolName, args, config, state)

package/src/scs-controller.js

@@ -354,7 +354,7 @@ function fallbackHardContractPlan(goal = "", contract = {}, studentReason = "",
     forbiddenTextTerms.length ? `5. Ensure the output does not contain these forbidden term(s): ${forbiddenTextTerms.join(", ")}.` : "",
     requiredToolCalls.length ? `6. Call these explicitly required tool(s) before finish: ${requiredToolCalls.join(", ")}.` : "",
     selectedSkillPaths.length
-      ? `7. Read the selected Markdown guidance at these exact paths before choosing an interface: ${selectedSkillPaths.join(", ")}. Skill IDs are not commands.`
+      ? `7. Read the selected Markdown guidance once before choosing an interface: ${selectedSkillPaths.join(", ")}. If retained source evidence records the path as already inspected, use that evidence and do not reread it solely after compaction. Skill IDs are not commands.`
       : "",
     readOnlyRoots.length
       ? `8. Inspect only the exact active read-only roots or their children with structured read tools: ${readOnlyRoots.join(", ")}. Do not pass --read-root to an in-task command.`

package/src/scs-evidence.js

@@ -204,7 +204,20 @@ function missingRequiredGitActionSequence(required = [], observed = []) {
   let cursor = 0;
   for (let index = 0; index < expected.length; index += 1) {
     const observedIndex = actual.indexOf(expected[index], cursor);
-    if (observedIndex < 0) return expected.slice(index);
+    if (observedIndex < 0) {
+      // A successful commit proves that an index was staged, even when the
+      // preceding `git add` happened in an earlier partially successful shell
+      // chain or the commit used `-a`. Preserve the requested add -> commit
+      // order without forcing the model to repeat a completed commit.
+      if (expected[index] === "add" && expected[index + 1] === "commit") {
+        const commitIndex = actual.indexOf("commit", cursor);
+        if (commitIndex >= 0) {
+          cursor = commitIndex;
+          continue;
+        }
+      }
+      return expected.slice(index);
+    }
     cursor = observedIndex + 1;
   }
   if (expected.at(-1) === "push") {
@@ -1070,7 +1083,20 @@ export function inferSuccessfulGitActionsFromCommandResult(payload = {}) {
     return inferGitActionsFromCommand(exitWrapper.command);
   }
   if (payload.ok === false || Number(payload.exitCode ?? 0) !== 0) return [];
-  return inferGitActionsFromCommand(command);
+  const inferred = inferGitActionsFromCommand(command);
+  if (inferred.length) return inferred;
+
+  // Shell expansion or a setup prefix can make the full command ambiguous to
+  // the static parser. A canonical successful commit line plus an explicit
+  // top-level `git commit` still provides concrete commit evidence.
+  const output = String(payload.stdout || payload.result || "");
+  if (
+    /(?:^|[;&|]\s*)git\s+commit\b/i.test(command) &&
+    /^\[[^\]\n]+\s+[0-9a-f]{7,}\]\s+\S+/mi.test(output)
+  ) {
+    return ["commit"];
+  }
+  return [];
 }
 
 function observedProjectCommandSatisfies(requiredCommand = "", item = {}) {

package/src/tool-contract.js

@@ -29,8 +29,7 @@ const SAFE_SEQUENTIAL_READ_TOOLS = new Set([
 const MAX_VALIDATION_ERRORS = 8;
 const MAX_VALIDATION_NODES = 50_000;
 const MAX_SAFE_SEQUENTIAL_READ_CALLS = 4;
-const MAX_RECOVERABLE_SEQUENTIAL_CALLS = 4;
-const MAX_REPORTED_SAFE_READ_CALLS = 12;
+const MAX_REPORTED_SEQUENTIAL_CALLS = 12;
 
 function cloneValue(value) {
   return structuredClone(value);
@@ -436,9 +435,12 @@ export function resolveDispatchableToolCallBatch(toolCalls, contract) {
   const onlyExceededBatchLimit =
     errors.length > 0 && errors.every((error) => error?.code === "TOO_MANY_TOOL_CALLS");
   const safeReadBatch = isSafeSequentialReadBatch(calls);
-  const recoverableCallLimit = safeReadBatch
-    ? MAX_REPORTED_SAFE_READ_CALLS
-    : MAX_RECOVERABLE_SEQUENTIAL_CALLS;
+  // The model may report a bounded batch even though the runtime deliberately
+  // dispatches only one mixed/mutating call at a time. Validate every reported
+  // call against the authenticated contract, then defer the untouched suffix.
+  // This keeps writes sequential without turning a harmless fifth call into a
+  // whole-turn failure.
+  const recoverableCallLimit = MAX_REPORTED_SEQUENTIAL_CALLS;
   if (
     !onlyExceededBatchLimit ||
     calls.length <= 1 ||