@lazyingart/agintiflow 0.20.249 → 0.20.251

package/docs/supervision-campaign-ledger.md

@@ -379,3 +379,32 @@ local report paths and existing-document revision language now count as local
 workspace intent, so surrounding research policy does not force a new deep
 research route. The phrase `page-safe` no longer creates a browser-evidence
 requirement. Focused routing/evidence smokes and the full npm suite pass.
+
+### Fresh current-turn command evidence on retained sessions
+
+`security-labshare-035` exercised a long-lived LocalLLM security-repair
+session after the target repository was already fixed, committed, and clean.
+The follow-up prompt deliberately asked the agent not to edit or recommit. It
+required only the exact hidden verifier and `git status --short`, while allowing
+all other passing implementation and unit-test evidence to remain reusable.
+
+Installed AgInTiFlow `0.20.250` incorrectly finished after `inspect_project`.
+It reused the old verifier/status evidence and never executed either command in
+the current turn. The defect was not model quality: the runtime had failed to
+turn explicit commands in a concrete same-task interruption into a fresh,
+revision-bound evidence obligation.
+
+The runtime now records explicit current-turn commands in the active execution
+contract and creates a fresh command batch for only that subset. Unrelated
+passing evidence from the unchanged mutation revision remains valid, while old
+runs of the newly requested commands cannot pre-complete the batch. Inline
+command extraction also recognizes natural `verify`, `validate`, `check`,
+`confirm`, and rerun wording in English and Chinese.
+
+The same real session was replayed against the patched source at goal revision
+`34`. Its event ledger records both commands under
+`required-command-batch-3`: the exact external security contract returned
+`security_labshare_contract: PASS`, and `git status --short` returned empty.
+The target stayed at commit `2b35928` with no mutation. Focused planning,
+truthful-completion, and dynamic-budget regressions pass, as does the complete
+AgInTiFlow npm suite. The fix is released in AgInTiFlow `0.20.251`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.249",
+  "version": "0.20.251",
   "type": "module",
   "description": "AgInTiFlow is a project-aware agent workspace for hybrid wet-dry R&D, hardware-aware intelligence, software automation, and industrial workflows.",
   "license": "Apache-2.0",
@@ -99,6 +99,7 @@
     "scripts/smoke-localllm-auto-max.js",
     "scripts/smoke-localllm-code-routing.js",
     "scripts/smoke-local-failure-recovery.js",
+    "scripts/smoke-planning-timeout-recovery.js",
     "scripts/smoke-local-resource-policy.js",
     "scripts/smoke-localllm-model-tiers.js",
     "scripts/smoke-localllm-provider.js",
@@ -106,6 +107,7 @@
     "scripts/smoke-truthful-completion.js",
     "scripts/smoke-document-artifact-quality.js",
     "scripts/smoke-writing-specialist-routing.js",
+    "scripts/smoke-workspace-secret-false-positive.js",
     "scripts/eval-provider-attribution.js",
     "scripts/local-first-agent-eval.mjs",
     "scripts/fixtures/local-first-agent-eval-fixtures.mjs",
@@ -171,6 +173,7 @@
     "smoke:localllm-auto-max": "node scripts/smoke-localllm-auto-max.js",
     "smoke:localllm-code-routing": "node scripts/smoke-localllm-code-routing.js",
     "smoke:local-failure-recovery": "node scripts/smoke-local-failure-recovery.js",
+    "smoke:planning-timeout-recovery": "node scripts/smoke-planning-timeout-recovery.js",
     "smoke:local-resource-policy": "node scripts/smoke-local-resource-policy.js",
     "smoke:context-budget-recovery": "node scripts/smoke-context-budget-recovery.js",
     "smoke:localllm-model-tiers": "node scripts/smoke-localllm-model-tiers.js",
@@ -179,6 +182,7 @@
     "smoke:truthful-completion": "node scripts/smoke-truthful-completion.js",
     "smoke:document-artifact-quality": "node scripts/smoke-document-artifact-quality.js",
     "smoke:writing-specialist-routing": "node scripts/smoke-writing-specialist-routing.js",
+    "smoke:workspace-secret-false-positive": "node scripts/smoke-workspace-secret-false-positive.js",
     "smoke:mcp": "node scripts/smoke-mcp.js",
     "smoke:model-roles": "node scripts/smoke-model-roles.js",
     "smoke:platform": "node scripts/smoke-platform.js",
@@ -223,7 +227,8 @@
     "storage:migrate": "node bin/aginti-cli.js storage migrate",
     "publish:env": "node scripts/npm-publish-from-env.js publish --access public",
     "publish:env:whoami": "node scripts/npm-publish-from-env.js whoami",
-    "test": "npm run check && npm run smoke:integration-production-mount && npm run smoke:integration-production-runtime-bundle && npm run smoke:integration-retained-idempotency-store && npm run smoke:integration-storage-authority && npm run smoke:integration-retained-durable-common && npm run smoke:integration-retained-file-lock && npm run smoke:integration-retained-event-ledger && npm run smoke:integration-retained-event-ledger-bundle && npm run smoke:integration-retained-repository-kernel && npm run smoke:integration-retained-session-state-store && npm run smoke:integration-retained-native-session-repository-state && npm run smoke:integration-retained-native-execution-evidence && npm run smoke:integration-retained-runtime-repository-surface && npm run smoke:integration-retained-runtime-repository-phase-b && npm run smoke:integration-runtime-repository-contract && npm run smoke:integration-runtime-authority && npm run smoke:localllm-provider && npm run smoke:localllm-model-tiers && npm run smoke:localllm-code-routing && npm run smoke:local-failure-recovery && npm run smoke:localllm-auto-max && npm run smoke:local-resource-policy && npm run smoke:context-budget-recovery && npm run smoke:session-runtime && npm run smoke:runtime-core && npm run smoke:progressive-tools && npm run smoke:truthful-completion && npm run smoke:document-artifact-quality && npm run smoke:writing-specialist-routing && npm run eval:local-first-agent && npm run eval:provider-attribution && npm run smoke:runtime-compat && npm run smoke:autoupdate && npm run smoke:web-api && npm run smoke:math-rendering && npm run smoke:web-ui && npm run smoke:web-autostart && npm run smoke:webapp-command && npm run smoke:web-port-fallback && npm run smoke:docker-command && npm run smoke:coding-tools && npm run smoke:dynamic-step-budget && npm run smoke:execution-policy && npm run smoke:aaps-adapter && npm run smoke:auxiliary-tools && npm run smoke:perception-research && npm run smoke:deep-research && npm run smoke:public-research && npm run smoke:safe-chat && npm run smoke:auth && npm run smoke:agentlink && npm run smoke:canvas-artifacts && npm run smoke:capabilities && npm run smoke:mcp && npm run smoke:model-roles && npm run smoke:platform && npm run smoke:permission-modes && npm run smoke:skills && npm run smoke:skillmesh && npm run smoke:supervision-ledger && npm run smoke:tmux-tools && npm run smoke:long-jobs && npm run smoke:run-stdin && npm run smoke:cli-chat && npm run smoke:inbox",
+    "pretest": "npm run smoke:planning-timeout-recovery",
+    "test": "npm run check && npm run smoke:integration-production-mount && npm run smoke:integration-production-runtime-bundle && npm run smoke:integration-retained-idempotency-store && npm run smoke:integration-storage-authority && npm run smoke:integration-retained-durable-common && npm run smoke:integration-retained-file-lock && npm run smoke:integration-retained-event-ledger && npm run smoke:integration-retained-event-ledger-bundle && npm run smoke:integration-retained-repository-kernel && npm run smoke:integration-retained-session-state-store && npm run smoke:integration-retained-native-session-repository-state && npm run smoke:integration-retained-native-execution-evidence && npm run smoke:integration-retained-runtime-repository-surface && npm run smoke:integration-retained-runtime-repository-phase-b && npm run smoke:integration-runtime-repository-contract && npm run smoke:integration-runtime-authority && npm run smoke:localllm-provider && npm run smoke:localllm-model-tiers && npm run smoke:localllm-code-routing && npm run smoke:local-failure-recovery && npm run smoke:localllm-auto-max && npm run smoke:local-resource-policy && npm run smoke:context-budget-recovery && npm run smoke:session-runtime && npm run smoke:runtime-core && npm run smoke:progressive-tools && npm run smoke:truthful-completion && npm run smoke:document-artifact-quality && npm run smoke:writing-specialist-routing && npm run smoke:workspace-secret-false-positive && npm run eval:local-first-agent && npm run eval:provider-attribution && npm run smoke:runtime-compat && npm run smoke:autoupdate && npm run smoke:web-api && npm run smoke:math-rendering && npm run smoke:web-ui && npm run smoke:web-autostart && npm run smoke:webapp-command && npm run smoke:web-port-fallback && npm run smoke:docker-command && npm run smoke:coding-tools && npm run smoke:dynamic-step-budget && npm run smoke:execution-policy && npm run smoke:aaps-adapter && npm run smoke:auxiliary-tools && npm run smoke:perception-research && npm run smoke:deep-research && npm run smoke:public-research && npm run smoke:safe-chat && npm run smoke:auth && npm run smoke:agentlink && npm run smoke:canvas-artifacts && npm run smoke:capabilities && npm run smoke:mcp && npm run smoke:model-roles && npm run smoke:platform && npm run smoke:permission-modes && npm run smoke:skills && npm run smoke:skillmesh && npm run smoke:supervision-ledger && npm run smoke:tmux-tools && npm run smoke:long-jobs && npm run smoke:run-stdin && npm run smoke:cli-chat && npm run smoke:inbox",
     "pack:dry-run": "npm pack --dry-run",
     "smoke:capabilities": "node scripts/smoke-capabilities.js"
   },

package/scripts/smoke-coding-tools.js

@@ -971,6 +971,55 @@ try {
   const pythonDemoPolicy = evaluateCommandPolicy("python3 demo.py 2>&1", dockerWorkspaceNoInstallsPolicy);
   assert(pythonDemoPolicy.allowed, "workspace-local python demo script should be allowed without package installs");
   assert(pythonDemoPolicy.category === "toolchain", "workspace-local python demo script should be classified as toolchain");
+  const broadLocalProbePolicy = evaluateCommandPolicy(
+    'python3 --version; echo "---IMPORT TEST---"; python3 -c "import pathlib; print(pathlib.Path.cwd())" 2>&1; echo "---FILES---"; ls -la 2>&1 | head -20',
+    dockerWorkspaceNoInstallsPolicy
+  );
+  assert(
+    broadLocalProbePolicy.allowed && broadLocalProbePolicy.category === "general-shell",
+    "networkless general shell inside docker-workspace should not require package-install permission"
+  );
+  const broadLocalHostProbePolicy = evaluateCommandPolicy(
+    'python3 -c "import pathlib; print(pathlib.Path.cwd())"',
+    { ...hostWorkspacePolicy, packageInstallPolicy: "block" }
+  );
+  assert(
+    !broadLocalHostProbePolicy.allowed,
+    "general shell on the host should remain blocked without trusted destructive access"
+  );
+  const explicitBlockedInstallPolicy = evaluateCommandPolicy(
+    "python3 -m pip install requests",
+    dockerWorkspaceNoInstallsPolicy
+  );
+  assert(
+    !explicitBlockedInstallPolicy.allowed && explicitBlockedInstallPolicy.category === "package-install",
+    "decoupling broad shell from install authorization must not allow explicit package installs"
+  );
+  const destructiveNoInstallsPolicy = evaluateCommandPolicy("rm -rf reports", dockerWorkspaceNoInstallsPolicy);
+  assert(
+    !destructiveNoInstallsPolicy.allowed && destructiveNoInstallsPolicy.category === "destructive",
+    "decoupling broad shell from install authorization must not weaken destructive-command guards"
+  );
+  const multiParagraphCommitPolicy = evaluateCommandPolicy(
+    'git commit -m "Harden LabShare" -m "Fix path traversal, avoid shell injection, and preserve normal use."',
+    dockerWorkspaceNoInstallsPolicy
+  );
+  assert(
+    multiParagraphCommitPolicy.allowed &&
+      multiParagraphCommitPolicy.category === "git-workflow" &&
+      multiParagraphCommitPolicy.gitOnly === true,
+    "a bounded multi-paragraph Git commit message should remain a Git-only workflow"
+  );
+  const boundedTaskCommitPolicy = evaluateCommandPolicy(
+    "git add -- 'labshare.py' 'tests/test_labshare.py' 'SECURITY.md' && git commit -m 'Harden LabShare'",
+    dockerWorkspaceNoInstallsPolicy
+  );
+  assert(
+    boundedTaskCommitPolicy.allowed &&
+      boundedTaskCommitPolicy.category === "git-workflow" &&
+      boundedTaskCommitPolicy.gitOnly === true,
+    "the task-owned add-and-commit routine should remain a bounded Git workflow"
+  );
   const rVersionProbePolicy = evaluateCommandPolicy("R --version 2>&1", dockerWorkspaceNoInstallsPolicy);
   assert(rVersionProbePolicy.allowed, "R version probe should be allowed without package installs");
   assert(rVersionProbePolicy.category === "read-only", "R version probe should be classified as read-only");
@@ -1218,6 +1267,38 @@ try {
   });
   assert(permissionAdvice.suggestedCommand.includes("coding-policy-smoke"), "permission advice did not include resume session id");
   assert(permissionAdvice.suggestedCommand.includes("--sandbox-mode docker-workspace"), "permission advice did not suggest docker-workspace recovery");
+  const wrongWorkspaceCdAdvice = buildPermissionAdvice({
+    toolName: "run_command",
+    args: {
+      command:
+        "cd /home/example/project-parent && python3 -m unittest discover -s tests -v",
+    },
+    guard: {
+      category: "blocked",
+      reason:
+        "cd target must be a safe workspace-relative directory: /home/example/project-parent",
+    },
+    config: {
+      ...dockerWorkspacePolicy,
+      commandCwd: "/home/example/project-parent/current-project",
+    },
+    state: { sessionId: "coding-wrong-workspace-cd-smoke" },
+  });
+  assert(
+    wrongWorkspaceCdAdvice.autoRecover === true,
+    "an unnecessary outside-workspace cd should be corrected in-turn instead of pausing"
+  );
+  assert(
+    /configured project root/i.test(wrongWorkspaceCdAdvice.instruction),
+    "workspace cd correction did not direct the model back to the configured project root"
+  );
+  assert(
+    !shouldPauseForPermissionAdvice({
+      blocked: true,
+      permissionAdvice: wrongWorkspaceCdAdvice,
+    }),
+    "recoverable workspace cd correction still paused the session"
+  );
   const destructiveAdvice = buildPermissionAdvice({
     toolName: "run_command",
     args: { command: "rm -rf reports && git reset --hard" },
@@ -1367,6 +1448,32 @@ try {
     !shouldPauseForPermissionAdvice({ blocked: true, permissionAdvice: dynamicEvidenceAdvice }),
     "dynamic evidence filename recovery still produced a permission pause"
   );
+  const malformedPatchGuard = {
+    allowed: false,
+    category: "workspace-patch",
+    reason: "Patch did not contain any supported file operations.",
+    permissionAdvice: {
+      category: "workspace-patch",
+      autoRecover: true,
+      summary: "The patch format or exact context was not accepted; this is not a permission blocker.",
+      instruction: "Inspect the exact file and retry with a supported focused edit.",
+    },
+  };
+  const malformedPatchAdvice = buildPermissionAdvice({
+    toolName: "apply_patch",
+    args: { patch: "*** a/labshare.py\n*** b/labshare.py" },
+    guard: malformedPatchGuard,
+    config: dockerWorkspacePolicy,
+    state: { sessionId: "coding-malformed-patch-smoke" },
+  });
+  assert(
+    malformedPatchAdvice === malformedPatchGuard.permissionAdvice,
+    "explicit recoverable workspace-patch advice was replaced by generic permission advice"
+  );
+  assert(
+    !shouldPauseForPermissionAdvice({ blocked: true, permissionAdvice: malformedPatchAdvice }),
+    "recoverable malformed patch advice still paused the session for permission"
+  );
   const destructiveDynamicEvidenceAdvice = buildPermissionAdvice({
     toolName: "run_command",
     args: {
@@ -1408,6 +1515,104 @@ try {
       /once for each rendered page/i.test(documentPageBatchAdvice.instruction),
     "Word document page batching did not recover into separate visual checks"
   );
+  const alreadyCommittedAdvice = buildFailedCommandAdvice({
+    args: { command: "git commit -m 'Focused repair'" },
+    commandPolicy: evaluateCommandPolicy("git commit -m 'Focused repair'", dockerWorkspacePolicy),
+    commandResult: {
+      ok: false,
+      exitCode: 1,
+      stdout: "On branch main\nnothing to commit, working tree clean\n",
+    },
+    config: dockerWorkspacePolicy,
+    state: {
+      meta: {
+        goalContract: { revision: 9 },
+        projectVerification: { mutationRevision: 4 },
+        durableGitEvidence: [{ action: "commit", goalRevision: 9, mutationRevision: 4 }],
+      },
+    },
+  });
+  assert(
+    alreadyCommittedAdvice?.failureKind === "repository-already-committed" &&
+      alreadyCommittedAdvice.autoRecover === true &&
+      /should not be retried/i.test(alreadyCommittedAdvice.summary),
+    "a clean no-op commit with current durable evidence did not converge"
+  );
+  const sameTaskContinuationAdvice = buildFailedCommandAdvice({
+    args: { command: "git commit -m 'Focused repair'" },
+    commandPolicy: evaluateCommandPolicy("git commit -m 'Focused repair'", dockerWorkspacePolicy),
+    commandResult: {
+      ok: false,
+      exitCode: 1,
+      stdout: "On branch main\nnothing to commit, working tree clean\n",
+    },
+    config: dockerWorkspacePolicy,
+    state: {
+      meta: {
+        goalContract: {
+          revision: 10,
+          history: [
+            { revision: 9, taskHash: "task-a" },
+            { revision: 10, taskHash: "task-a" },
+          ],
+        },
+        projectVerification: { mutationRevision: 4 },
+        durableGitEvidence: [{ action: "commit", goalRevision: 9, mutationRevision: 4 }],
+      },
+    },
+  });
+  assert(
+    sameTaskContinuationAdvice?.failureKind === "repository-already-committed",
+    "a same-task continuation invalidated a clean commit at the current mutation revision"
+  );
+  const newTaskAdvice = buildFailedCommandAdvice({
+    args: { command: "git commit -m 'Focused repair'" },
+    commandPolicy: evaluateCommandPolicy("git commit -m 'Focused repair'", dockerWorkspacePolicy),
+    commandResult: {
+      ok: false,
+      exitCode: 1,
+      stdout: "On branch main\nnothing to commit, working tree clean\n",
+    },
+    config: dockerWorkspacePolicy,
+    state: {
+      meta: {
+        goalContract: {
+          revision: 10,
+          history: [
+            { revision: 9, taskHash: "task-a" },
+            { revision: 10, taskHash: "task-b" },
+          ],
+        },
+        projectVerification: { mutationRevision: 4 },
+        durableGitEvidence: [{ action: "commit", goalRevision: 9, mutationRevision: 4 }],
+      },
+    },
+  });
+  assert(
+    newTaskAdvice === null,
+    "a commit from a prior task satisfied a genuinely new task"
+  );
+  const staleCommitAdvice = buildFailedCommandAdvice({
+    args: { command: "git commit -m 'Focused repair'" },
+    commandPolicy: evaluateCommandPolicy("git commit -m 'Focused repair'", dockerWorkspacePolicy),
+    commandResult: {
+      ok: false,
+      exitCode: 1,
+      stdout: "On branch main\nnothing to commit, working tree clean\n",
+    },
+    config: dockerWorkspacePolicy,
+    state: {
+      meta: {
+        goalContract: { revision: 9 },
+        projectVerification: { mutationRevision: 4 },
+        durableGitEvidence: [{ action: "commit", goalRevision: 8, mutationRevision: 4 }],
+      },
+    },
+  });
+  assert(
+    staleCommitAdvice === null,
+    "a stale commit from an earlier goal revision satisfied a fresh commit request"
+  );
   const failedNetworkAdvice = buildFailedCommandAdvice({
     args: { command: "git clone https://github.com/lazyingart/AgInTiFlow.git" },
     commandPolicy: clonePolicy,

package/scripts/smoke-docker-command.js

@@ -6,12 +6,52 @@ import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { promisify } from "node:util";
+import {
+  dockerWorkspaceAliasMounts,
+  ensureDockerGitIdentity,
+} from "../src/docker-sandbox.js";
 
 const execFileAsync = promisify(execFile);
 const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const tempRoot = await fs.mkdtemp(path.join(os.tmpdir(), "agintiflow-docker-command-"));
 
 try {
+  const identityRepo = path.join(tempRoot, "identity-repo");
+  const dockerState = path.join(tempRoot, "docker-state");
+  await fs.mkdir(identityRepo, { recursive: true });
+  await fs.mkdir(path.join(dockerState, "home"), { recursive: true });
+  await execFileAsync("git", ["init", identityRepo]);
+  await execFileAsync("git", ["-C", identityRepo, "config", "user.name", "AgInTi Test Author"]);
+  await execFileAsync("git", ["-C", identityRepo, "config", "user.email", "aginti-test@example.invalid"]);
+  assert.deepEqual(
+    dockerWorkspaceAliasMounts({ commandCwd: identityRepo, sandboxMode: "docker-workspace" }),
+    [identityRepo],
+    "Docker workspace mode should preserve the exact host workspace path as a scoped writable alias"
+  );
+  assert.deepEqual(
+    dockerWorkspaceAliasMounts({ commandCwd: identityRepo, sandboxMode: "docker-readonly" }),
+    [],
+    "Read-only Docker mode must not create a writable host-path alias"
+  );
+  const identity = await ensureDockerGitIdentity(
+    { commandCwd: identityRepo, dockerStateDir: dockerState },
+    {
+      root: dockerState,
+      home: path.join(dockerState, "home"),
+      cache: path.join(dockerState, "cache"),
+      env: path.join(dockerState, "env"),
+    }
+  );
+  assert.equal(identity.configured, true, "Docker Git identity should reuse an existing repository author");
+  const identityConfig = path.join(dockerState, "home", ".gitconfig.aginti-author");
+  const [storedName, storedEmail] = await Promise.all([
+    execFileAsync("git", ["config", "--file", identityConfig, "--get", "user.name"]),
+    execFileAsync("git", ["config", "--file", identityConfig, "--get", "user.email"]),
+  ]);
+  assert.equal(storedName.stdout.trim(), "AgInTi Test Author");
+  assert.equal(storedEmail.stdout.trim(), "aginti-test@example.invalid");
+  assert.equal((await fs.stat(identityConfig)).mode & 0o777, 0o600, "Docker author config should be private");
+
   const { stdout } = await execFileAsync(process.execPath, [path.join(repoRoot, "bin/aginti-cli.js"), "docker", "status", "--json", "--cwd", tempRoot], {
     cwd: tempRoot,
     env: {