@lazyingart/agintiflow 0.20.238 → 0.20.239

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.238",
+  "version": "0.20.239",
   "type": "module",
   "description": "AgInTiFlow is a project-aware agent workspace for hybrid wet-dry R&D, hardware-aware intelligence, software automation, and industrial workflows.",
   "license": "Apache-2.0",

package/scripts/smoke-coding-tools.js

@@ -14,6 +14,7 @@ import {
   runAgent,
   sanitizeToolResult,
   toolResultForModel,
+  shouldPauseForPermissionAdvice,
   shouldShortCircuitToolBatch,
   shellDiagnosticHint,
   skippedAfterBlockedToolResult,
@@ -1311,6 +1312,79 @@ try {
     ),
     "an explicitly requested deletion was incorrectly treated as optional housekeeping"
   );
+  assert(
+    isUnrequestedCleanupCommand(
+      "run_command",
+      { command: "rm -rf /tmp/run-a /tmp/run-b" },
+      {
+        goal:
+          "Continue the deterministic comparison. Do not delete any project or temporary directory; use fresh paths instead.",
+      },
+      {}
+    ),
+    "a negated deletion constraint was mistaken for destructive authorization"
+  );
+  const negatedCleanupAdvice = buildPermissionAdvice({
+    toolName: "run_command",
+    args: { command: "rm -rf /tmp/run-a /tmp/run-b" },
+    guard: {
+      category: "destructive",
+      reason: "Destructive shell commands require Allow destructive actions.",
+    },
+    config: {
+      ...dockerWorkspacePolicy,
+      goal: "Do not delete any project or temporary directory; keep working on the build.",
+    },
+    state: { sessionId: "coding-negated-cleanup-smoke" },
+  });
+  assert(
+    negatedCleanupAdvice.autoRecover === true,
+    "blocked cleanup under a do-not-delete goal should recover without pausing"
+  );
+  const dynamicEvidenceAdvice = buildPermissionAdvice({
+    toolName: "run_command",
+    args: {
+      command:
+        'STAMP=$(date -u +%Y%m%dT%H%M%SZ); bash build.sh 2>&1 | tee ".aginti/build-${STAMP}.log"',
+    },
+    guard: {
+      category: "destructive",
+      reason:
+        'Command contains a write-capable or destructive token: tee ".aginti/build-${STAMP}.log"',
+    },
+    config: {
+      ...dockerWorkspacePolicy,
+      goal: "Build twice and retain deterministic evidence without deleting anything.",
+    },
+    state: { sessionId: "coding-dynamic-evidence-smoke" },
+  });
+  assert(
+    dynamicEvidenceAdvice.autoRecover === true &&
+      /literal workspace-relative evidence paths/i.test(dynamicEvidenceAdvice.instruction),
+    "dynamic evidence filename false positive should recover into literal workspace paths"
+  );
+  assert(
+    !shouldPauseForPermissionAdvice({ blocked: true, permissionAdvice: dynamicEvidenceAdvice }),
+    "dynamic evidence filename recovery still produced a permission pause"
+  );
+  const destructiveDynamicEvidenceAdvice = buildPermissionAdvice({
+    toolName: "run_command",
+    args: {
+      command:
+        'rm -rf output; STAMP=$(date -u +%Y%m%dT%H%M%SZ); bash build.sh 2>&1 | tee ".aginti/build-${STAMP}.log"',
+    },
+    guard: {
+      category: "destructive",
+      reason: "Destructive shell commands require Allow destructive actions.",
+    },
+    config: { ...dockerWorkspacePolicy, goal: "Build and verify the document." },
+    state: { sessionId: "coding-destructive-dynamic-evidence-smoke" },
+  });
+  assert(
+    destructiveDynamicEvidenceAdvice.autoRecover === true &&
+      /Unrequested cleanup was blocked safely/i.test(destructiveDynamicEvidenceAdvice.summary),
+    "a real cleanup token should not be mislabeled as only dynamic evidence formatting"
+  );
   const documentPageBatchGuard = checkToolUse({
     toolName: "read_image",
     args: { imagePaths: ["build/verification/page-1.png", "build/verification/page-2.png"] },

package/scripts/smoke-context-budget-recovery.js

@@ -144,6 +144,8 @@ const runtimeMessages = buildContextBudgetCompactionMessages(
           toolName: "read_file",
           path: "/evidence/Musia/SKILL.md",
           bytes: 2048,
+          sha256: "1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef",
+          contentTruncated: false,
           content: [
             "---",
             "name: musia-music-production",
@@ -187,9 +189,12 @@ assert.ok(runtimeText.includes("Retained source evidence"));
 assert.ok(runtimeText.includes("/evidence/Musia/SKILL.md"));
 assert.ok(runtimeText.includes("Create and review songs through the established Musia production workflow"));
 assert.ok(runtimeText.includes("# Musia Music Production"));
+assert.ok(runtimeText.includes("sha256=1234567890abcdef"));
+assert.ok(runtimeText.includes("content=complete"));
 assert.ok(runtimeText.includes("node bin/musia.js doctor --json"));
 assert.ok(runtimeText.includes("scripts/xyq_cdp_browser.py"));
 assert.ok(!runtimeText.includes("OLD-COMPACTION-MUST-NOT-RECUR"));
 assert.match(runtimeText, /Do not reread a listed source solely because compaction occurred/);
+assert.match(runtimeText, /never restart a full-file read loop after compaction/);
 
 console.log("context budget recovery smoke passed");

package/scripts/smoke-dynamic-step-budget.js

@@ -2281,6 +2281,27 @@ try {
     shellMutationState.meta.projectVerification?.mutationRevision === 1,
     "git metadata incorrectly invalidated current project-content verification"
   );
+  const gitMetadataWithObservationsResult = {
+    toolName: "run_command",
+    ok: true,
+    exitCode: 0,
+    args: {
+      command:
+        "git add report.md && git commit -m 'record verified report' && echo '=== status ===' && git status --porcelain && git log -1 --oneline",
+    },
+    stdout: "=== status ===\nabc123 record verified report",
+    stderr: "",
+  };
+  recordProjectVerificationOutcome(shellMutationState, gitMetadataWithObservationsResult, {
+    commandCwd: workspace,
+    taskProfile: "writing",
+    allowShellTool: true,
+    sandboxMode: "host",
+  });
+  assert(
+    shellMutationState.meta.projectVerification?.mutationRevision === 1,
+    "metadata-only Git chain with observational output invalidated current verification"
+  );
   const gitCheckoutResult = {
     toolName: "run_command",
     ok: true,

package/scripts/smoke-progressive-tool-selection.js

@@ -2471,6 +2471,25 @@ assert(recoveredMixedBatch.ok, "valid mixed batch could not recover through boun
 assert(recoveredMixedBatch.recoveredSequentially, "mixed batch recovery was not recorded");
 assert(recoveredMixedBatch.acceptedToolCalls.length === 1, "mixed batch recovery dispatched more than one call");
 assert(recoveredMixedBatch.deferredToolCalls.length === 1, "mixed batch recovery did not defer the extra call");
+const fiveCallMixedBatch = [
+  ...safeReadCalls,
+  contractCall("safe-read-four", "read_file", { path: "fourth.txt" }),
+  contractCall("deferred-write-five", "write_file", { path: "later.txt", content: "later" }),
+];
+const recoveredFiveCallMixedBatch = resolveDispatchableToolCallBatch(
+  fiveCallMixedBatch,
+  createToolContract([...safeReadDescriptors, strictWriteDescriptor])
+);
+assert(recoveredFiveCallMixedBatch.ok, "five-call mixed batch was rejected instead of bounded deferral");
+assert(
+  recoveredFiveCallMixedBatch.acceptedToolCalls.length === 1 &&
+    recoveredFiveCallMixedBatch.deferredToolCalls.length === 4,
+  "five-call mixed batch did not dispatch exactly one call and preserve the suffix"
+);
+assert(
+  recoveredFiveCallMixedBatch.deferredToolCalls.at(-1)?.function?.name === "write_file",
+  "bounded mixed recovery lost or executed the deferred write"
+);
 const oversizedReadCalls = Array.from({ length: 5 }, (_, index) =>
   contractCall(`read-${index}`, "read_file", { path: `file-${index}.txt` })
 );
@@ -2492,6 +2511,13 @@ assert(
   !resolveDispatchableToolCallBatch(excessiveReadBatch, safeReadContract).ok,
   "unbounded safe read batch escaped the reported-call cap"
 );
+assert(
+  !resolveDispatchableToolCallBatch(
+    [...excessiveReadBatch.slice(0, 12), contractCall("excessive-write", "write_file", { path: "later.txt", content: "later" })],
+    createToolContract([...safeReadDescriptors, strictWriteDescriptor])
+  ).ok,
+  "unbounded mixed batch escaped the reported-call cap"
+);
 
 for (const [label, call, expectedCode] of [
   [

package/src/agent-runner.js

@@ -826,6 +826,12 @@ function summarizeRetainedSourceEvidence(messages = [], limit = 28) {
     const parts = [`tool=${toolName}`];
     if (sourcePath) parts.push(`path=${sourcePath}`);
     if (Number.isFinite(Number(payload.bytes))) parts.push(`bytes=${Number(payload.bytes)}`);
+    if (payload.sha256) parts.push(`sha256=${String(payload.sha256).slice(0, 16)}`);
+    if (payload.contentTruncated === true || payload.contentTruncatedByLines === true) {
+      parts.push("content=truncated");
+    } else if (toolName === "read_file" && typeof payload.content === "string") {
+      parts.push("content=complete");
+    }
     if (payload.summary) parts.push(`summary=${compactSingleLine(payload.summary, 220)}`);
     if (toolName === "read_file") {
       const semantic = summarizeReadSemanticEvidence(payload);
@@ -1249,6 +1255,7 @@ function buildCompactedRuntimeMessages(state, config, snapshot, step, options =
     "",
     "Retained source evidence summaries (already inspected; reread an exact source only when its needed content is absent here):",
     "Do not reread a listed source solely because compaction occurred.",
+    "A content=complete entry is authoritative for that recorded sha256. Use search_files or one bounded range read only when an exact edit anchor is absent; never restart a full-file read loop after compaction.",
     ...(retainedSourceEvidence.length
       ? retainedSourceEvidence.map((item) => `- ${item}`)
       : ["- No structured source evidence was available before compaction."]),
@@ -5986,6 +5993,17 @@ const WORKTREE_CHANGING_GIT_ACTIONS = new Set([
 
 function commandCanMutateProjectContent(command = "", commandPolicy = {}) {
   if (commandPolicy.writesWorkspace !== true && commandPolicy.mayMutateProject !== true) return false;
+  const sequence = parseTopLevelShellSequence(String(command || ""));
+  if (
+    sequence.commands.length > 1 &&
+    !sequence.openQuote &&
+    !sequence.trailingEscape &&
+    !sequence.trailingSeparator
+  ) {
+    return sequence.commands.some((segment) =>
+      commandCanMutateProjectContent(segment, classifyCommand(segment))
+    );
+  }
   const category = String(commandPolicy.category || "");
   if (!["git-workflow", "git-remote"].includes(category)) return true;
   if (/\bgit\s+clone\b/i.test(String(command || ""))) return true;
@@ -11787,9 +11805,9 @@ export async function runAgent(config) {
           content: [
             "Runtime batching note: the valid tool batch exceeded the bounded per-turn dispatch limit.",
             `The first ${toolCalls.length} call(s) ran sequentially; do not repeat them.`,
-            "These remaining read-only calls were deferred and did not run:",
+            "These remaining calls were deferred and did not run:",
             ...deferredSummary,
-            "Request only the specific deferred reads still needed, in a bounded batch, then move to the requested artifact.",
+            "Review the deferred list, request only the calls still needed in a bounded batch, and do not assume any deferred write or command ran.",
           ].join("\n"),
         });
       }

package/src/permission-advice.js

@@ -67,11 +67,40 @@ export function isOptionalGeneratedPreviewCleanup(toolName = "", args = {}) {
   );
 }
 
+export function isRecoverableDynamicEvidenceWrite(toolName = "", args = {}, guard = {}) {
+  if (toolName !== "run_command" || guard?.category !== "destructive") return false;
+  const command = String(args.command || args.text || "");
+  if (!/\btee\s+/i.test(command)) return false;
+  if (
+    /(?:^|[;&|\n]\s*)(?:command\s+)?(?:rm|rmdir|mv|chmod|chown)\b/i.test(command) ||
+    /\bgit\s+(?:checkout|switch|reset|clean)\b/i.test(command) ||
+    /(?:^|\s)-delete(?:\s|$)/i.test(command)
+  ) {
+    return false;
+  }
+  const dynamicWorkspaceEvidenceTarget = new RegExp(
+    String.raw`\btee\s+(?:--?append\s+|-a\s+)?["']?(?:\.aginti|artifacts|build/verification|output/verification)/[^\n;|]*\$\{?[A-Z_][A-Z0-9_]*\}?`,
+    "i"
+  );
+  return dynamicWorkspaceEvidenceTarget.test(command);
+}
+
 function goalRequestsDeletion(config = {}, state = {}) {
   const goal = String(config.goal || state.goal || state.meta?.goalContract?.current || "");
-  return /\b(?:delete|remove|clean\s+up|cleanup|purge|erase|discard|drop)\b|删除|刪除|移除|清理|清除|删掉|刪掉|削除|消去/i.test(
-    goal
-  );
+  const deletionIntent = /\b(?:delete|remove|clean\s+up|cleanup|purge|erase|discard|drop)\b|删除|刪除|移除|清理|清除|删掉|刪掉|削除|消去/i;
+  if (!deletionIntent.test(goal)) return false;
+
+  // A safety constraint such as "do not delete" is the opposite of
+  // authorization. Strip bounded negated phrases before looking for a genuine
+  // deletion request elsewhere in the goal.
+  const withoutNegatedDeletion = goal
+    .replace(
+      /\b(?:do\s+not|don't|dont|never|must\s+not|should\s+not|shouldn't|without)\s+(?:retry(?:ing)?\s+or\s+)?(?:delete|remove|clean\s+up|cleanup|purge|erase|discard|drop)(?:\s+any)?\b/gi,
+      " "
+    )
+    .replace(/(?:不要|不可|禁止|无需|無需|不需要)(?:再)?(?:删除|刪除|移除|清理|清除|删掉|刪掉)/g, " ")
+    .replace(/(?:削除|消去)(?:しない|するな|不要)/g, " ");
+  return deletionIntent.test(withoutNegatedDeletion);
 }
 
 export function isUnrequestedCleanupCommand(toolName = "", args = {}, config = {}, state = {}) {
@@ -291,6 +320,21 @@ function adviceForCategory(category = "", { toolName = "", args = {}, config = {
   }
 
   if (category === "destructive") {
+    if (isRecoverableDynamicEvidenceWrite(toolName, args, { category, reason })) {
+      return {
+        ...base,
+        autoRecover: true,
+        summary:
+          "A generated-evidence command used a shell-expanded output filename that the workspace guard could not prove safe. The command stayed blocked, but no destructive permission is needed.",
+        instruction:
+          "Do not retry the same command and do not request destructive approval. Reissue the check with fresh literal workspace-relative evidence paths under `.aginti/verification/`; avoid variables, globs, and `/tmp` in tee/redirection targets, then continue the substantive validation.",
+        options: [
+          "Use a literal timestamp or nonce already written into the command text.",
+          "Keep every log, hash file, and render under `.aginti/verification/`.",
+          "Split the build and evidence checks into smaller commands if that makes each output path explicit.",
+        ],
+      };
+    }
     if (
       isOptionalGeneratedPreviewCleanup(toolName, args) ||
       isUnrequestedCleanupCommand(toolName, args, config, state)

package/src/scs-controller.js

@@ -354,7 +354,7 @@ function fallbackHardContractPlan(goal = "", contract = {}, studentReason = "",
     forbiddenTextTerms.length ? `5. Ensure the output does not contain these forbidden term(s): ${forbiddenTextTerms.join(", ")}.` : "",
     requiredToolCalls.length ? `6. Call these explicitly required tool(s) before finish: ${requiredToolCalls.join(", ")}.` : "",
     selectedSkillPaths.length
-      ? `7. Read the selected Markdown guidance at these exact paths before choosing an interface: ${selectedSkillPaths.join(", ")}. Skill IDs are not commands.`
+      ? `7. Read the selected Markdown guidance once before choosing an interface: ${selectedSkillPaths.join(", ")}. If retained source evidence records the path as already inspected, use that evidence and do not reread it solely after compaction. Skill IDs are not commands.`
       : "",
     readOnlyRoots.length
       ? `8. Inspect only the exact active read-only roots or their children with structured read tools: ${readOnlyRoots.join(", ")}. Do not pass --read-root to an in-task command.`

package/src/tool-contract.js

@@ -29,8 +29,7 @@ const SAFE_SEQUENTIAL_READ_TOOLS = new Set([
 const MAX_VALIDATION_ERRORS = 8;
 const MAX_VALIDATION_NODES = 50_000;
 const MAX_SAFE_SEQUENTIAL_READ_CALLS = 4;
-const MAX_RECOVERABLE_SEQUENTIAL_CALLS = 4;
-const MAX_REPORTED_SAFE_READ_CALLS = 12;
+const MAX_REPORTED_SEQUENTIAL_CALLS = 12;
 
 function cloneValue(value) {
   return structuredClone(value);
@@ -436,9 +435,12 @@ export function resolveDispatchableToolCallBatch(toolCalls, contract) {
   const onlyExceededBatchLimit =
     errors.length > 0 && errors.every((error) => error?.code === "TOO_MANY_TOOL_CALLS");
   const safeReadBatch = isSafeSequentialReadBatch(calls);
-  const recoverableCallLimit = safeReadBatch
-    ? MAX_REPORTED_SAFE_READ_CALLS
-    : MAX_RECOVERABLE_SEQUENTIAL_CALLS;
+  // The model may report a bounded batch even though the runtime deliberately
+  // dispatches only one mixed/mutating call at a time. Validate every reported
+  // call against the authenticated contract, then defer the untouched suffix.
+  // This keeps writes sequential without turning a harmless fifth call into a
+  // whole-turn failure.
+  const recoverableCallLimit = MAX_REPORTED_SEQUENTIAL_CALLS;
   if (
     !onlyExceededBatchLimit ||
     calls.length <= 1 ||