@lazyingart/agintiflow 0.20.25 → 0.20.39

package/scripts/smoke-auto-update.js

@@ -0,0 +1,96 @@
+#!/usr/bin/env node
+import {
+  compareSemver,
+  isGlobalNpmInstall,
+  isNewerVersion,
+  maybeAutoUpdate,
+  shouldAutoUpdateCommand,
+} from "../src/auto-update.js";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+
+function assert(condition, message) {
+  if (!condition) throw new Error(message);
+}
+
+const scopedGlobalPath = "/usr/local/lib/node_modules/@lazyingart/agintiflow";
+const windowsGlobalPath = "C:\\Users\\tester\\AppData\\Roaming\\npm\\node_modules\\@lazyingart\\agintiflow";
+
+assert(compareSemver("0.20.38", "0.20.37") === 1, "patch version compare failed");
+assert(compareSemver("0.21.0", "0.20.99") === 1, "minor version compare failed");
+assert(compareSemver("1.0.0", "0.99.99") === 1, "major version compare failed");
+assert(compareSemver("0.20.37", "0.20.37") === 0, "equal version compare failed");
+assert(compareSemver("0.20.37", "0.20.38") === -1, "older version compare failed");
+assert(isNewerVersion("0.20.38", "0.20.37"), "newer version predicate failed");
+assert(!isNewerVersion("0.20.37", "0.20.37"), "equal version should not update");
+assert(!isNewerVersion("0.20.36", "0.20.37"), "older latest should not update");
+
+assert(isGlobalNpmInstall(scopedGlobalPath), "Unix global npm install path not detected");
+assert(isGlobalNpmInstall(windowsGlobalPath), "Windows global npm install path not detected");
+assert(!isGlobalNpmInstall("/home/user/Projects/AgInTiFlow"), "source checkout should not look globally installed");
+
+assert(shouldAutoUpdateCommand([]), "plain interactive start should check updates");
+assert(shouldAutoUpdateCommand(["web"]), "web start should check updates");
+assert(shouldAutoUpdateCommand(["resume", "latest"]), "resume should check updates");
+assert(shouldAutoUpdateCommand(["write", "a", "test"]), "one-shot task should check updates in a TTY");
+assert(!shouldAutoUpdateCommand(["doctor"]), "doctor should skip updates");
+assert(!shouldAutoUpdateCommand(["models"]), "models should skip updates");
+assert(!shouldAutoUpdateCommand(["--version"]), "version should skip updates");
+assert(!shouldAutoUpdateCommand(["task", "--no-auto-update"]), "--no-auto-update should skip updates");
+
+const skipped = await maybeAutoUpdate({
+  argv: [],
+  force: true,
+  manual: false,
+  packageDir: "/home/user/Projects/AgInTiFlow",
+  packageName: "@lazyingart/agintiflow",
+  packageVersion: "0.20.37",
+  restart: false,
+});
+assert(skipped.skipped === "source-checkout", "source checkout update guard failed");
+
+const tempHome = await fs.mkdtemp(path.join(os.tmpdir(), "agintiflow-auto-update-"));
+const previousHome = process.env.AGINTIFLOW_HOME;
+process.env.AGINTIFLOW_HOME = tempHome;
+await fs.mkdir(tempHome, { recursive: true });
+await fs.writeFile(
+  path.join(tempHome, "update-check.json"),
+  `${JSON.stringify({ checkedAt: Date.now(), latest: "0.20.99" })}\n`,
+  "utf8"
+);
+const writes = [];
+const fakeStdout = {
+  isTTY: true,
+  write(value) {
+    writes.push(String(value));
+  },
+};
+const skipVersion = await maybeAutoUpdate({
+  argv: [],
+  packageDir: scopedGlobalPath,
+  packageName: "@lazyingart/agintiflow",
+  packageVersion: "0.20.38",
+  restart: false,
+  stdout: fakeStdout,
+  selectUpdateAction: async () => "skip-version",
+});
+assert(skipVersion.skipped === "skip-version", "skip-version selector choice was not honored");
+const cacheAfterSkip = JSON.parse(await fs.readFile(path.join(tempHome, "update-check.json"), "utf8"));
+assert(cacheAfterSkip.skippedVersion === "0.20.99", "skip-version did not persist skipped version");
+const repeatedSkip = await maybeAutoUpdate({
+  argv: [],
+  packageDir: scopedGlobalPath,
+  packageName: "@lazyingart/agintiflow",
+  packageVersion: "0.20.38",
+  restart: false,
+  stdout: fakeStdout,
+  selectUpdateAction: async () => {
+    throw new Error("selector should not be called after skip-version");
+  },
+});
+assert(repeatedSkip.skipped === "skipped-version", "cached skipped version was not respected");
+if (previousHome === undefined) delete process.env.AGINTIFLOW_HOME;
+else process.env.AGINTIFLOW_HOME = previousHome;
+
+console.log("auto-update smoke ok");

package/scripts/smoke-auxiliary-tools.js

@@ -11,6 +11,7 @@ import { SessionStore } from "../src/session-store.js";
 
 const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const tempRoot = await fs.mkdtemp(path.join(os.tmpdir(), "agintiflow-auxiliary-"));
+process.env.AGINTIFLOW_HOME = path.join(tempRoot, ".agintiflow-home");
 const runtimeDir = path.join(tempRoot, "runtime");
 const workspace = path.join(tempRoot, "workspace");
 await fs.mkdir(workspace, { recursive: true });

package/scripts/smoke-canvas-artifacts.js

@@ -0,0 +1,67 @@
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { buildArtifacts, normalizeCanvasPayload, persistCanvasPayloadFile, readArtifactContent } from "../src/artifact-tunnel.js";
+import { SessionStore } from "../src/session-store.js";
+
+async function main() {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), "aginti-canvas-artifacts-"));
+  const workspace = path.join(root, "workspace");
+  const sessionsDir = path.join(root, "sessions");
+  await fs.mkdir(workspace, { recursive: true });
+
+  const sourcePath = path.join(workspace, "durable-report.md");
+  await fs.writeFile(sourcePath, "# Durable report\n\nThis file should survive canvas preview cleanup.\n", "utf8");
+
+  const config = {
+    commandCwd: workspace,
+    allowFileTools: true,
+  };
+  const store = new SessionStore(sessionsDir, "canvas-smoke");
+  await store.ensure();
+
+  const normalized = normalizeCanvasPayload(
+    {
+      title: "Durable report",
+      kind: "markdown",
+      path: "durable-report.md",
+      selected: true,
+    },
+    config
+  );
+  if (!normalized.ok) throw new Error(normalized.reason || "canvas payload normalization failed");
+
+  const persisted = await persistCanvasPayloadFile(normalized.payload, { config, store });
+  if (!persisted.ok) throw new Error(persisted.reason || "canvas artifact persistence failed");
+  if (!persisted.payload.artifactPersisted) throw new Error("canvas file was not persisted into session artifacts");
+
+  await fs.rm(sourcePath);
+
+  const events = [
+    {
+      timestamp: new Date().toISOString(),
+      type: "canvas.item",
+      data: {
+        ...persisted.payload,
+        commandCwd: workspace,
+      },
+    },
+  ];
+  const { items } = buildArtifacts({ sessionId: store.sessionId, events, store });
+  if (items.length !== 1) throw new Error(`expected one artifact, got ${items.length}`);
+
+  const content = await readArtifactContent(items[0], { store, config });
+  if (!content.ok) throw new Error(content.error || "persisted artifact could not be read");
+  if (!String(content.text || "").includes("Durable report")) throw new Error("persisted artifact content mismatch");
+
+  const missing = await persistCanvasPayloadFile({ ...normalized.payload, path: "missing.png" }, { config, store });
+  if (missing.ok) throw new Error("missing canvas path should fail persistence");
+
+  await fs.rm(root, { recursive: true, force: true });
+  console.log("smoke-canvas-artifacts ok");
+}
+
+main().catch((error) => {
+  console.error(error);
+  process.exit(1);
+});

package/scripts/smoke-capabilities.js

@@ -5,16 +5,19 @@ import os from "node:os";
 import path from "node:path";
 import { promisify } from "node:util";
 import { fileURLToPath } from "node:url";
+import { defaultMaxStepsForProfile, listTaskProfiles } from "../src/task-profiles.js";
 
 const execFileAsync = promisify(execFile);
 const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const tempRoot = await fs.mkdtemp(path.join(os.tmpdir(), "agintiflow-capabilities-"));
+const agintiflowHome = path.join(tempRoot, ".agintiflow-home");
+process.env.AGINTIFLOW_HOME = agintiflowHome;
 
 function assert(condition, message) {
   if (!condition) throw new Error(message);
 }
 
-async function runCli(args) {
+async function runCli(args, envOverrides = {}) {
   const result = await execFileAsync(process.execPath, [path.join(repoRoot, "bin/aginti-cli.js"), ...args], {
     cwd: tempRoot,
     timeout: 20000,
@@ -22,6 +25,8 @@ async function runCli(args) {
     env: {
       ...process.env,
       AGINTIFLOW_RUNTIME_DIR: "",
+      AGINTIFLOW_HOME: agintiflowHome,
+      ...envOverrides,
     },
   });
   return result.stdout;
@@ -85,6 +90,21 @@ try {
     capabilities.tools?.taskProfiles?.some((profile) => profile.id === "android"),
     "capabilities did not report Android task profile"
   );
+  assert(
+    capabilities.tools?.taskProfiles?.some((profile) => profile.id === "supervision"),
+    "capabilities did not report supervision task profile"
+  );
+  for (const profileId of ["docs", "data", "qa", "database", "devops", "security", "slides", "education", "java", "ios", "go", "rust", "dotnet", "php", "ruby"]) {
+    assert(
+      capabilities.tools?.taskProfiles?.some((profile) => profile.id === profileId),
+      `capabilities did not report ${profileId} task profile`
+    );
+  }
+  const qaProfile = listTaskProfiles().find((profile) => profile.id === "qa");
+  assert(qaProfile, "QA profile is missing");
+  assert(defaultMaxStepsForProfile("qa") >= 40, "QA profile step budget is too low for verification and cleanup");
+  assert(!/misleading failing test/i.test(qaProfile.prompt), "QA profile still encourages misleading test fixtures");
+  assert(/do not stage fake bugs/i.test(qaProfile.prompt), "QA profile does not discourage fake staged failures");
   assert(
     capabilities.trustedDockerPolicy.some((check) => check.command.startsWith("apt-get install") && check.allowed),
     "trusted Docker policy did not allow apt-get install"
@@ -109,17 +129,46 @@ try {
     capabilities.tools?.skills?.some((skill) => skill.id === "android"),
     "capabilities did not report built-in Android skill"
   );
+  assert(
+    capabilities.tools?.skills?.some((skill) => skill.id === "supervision-student"),
+    "capabilities did not report built-in supervision skill"
+  );
+  for (const skillId of ["data-analysis", "docs-knowledge", "qa-testing", "database", "devops-deployment", "security-review", "presentation-slides", "writing-editing", "java-jvm", "ios-swift", "go", "rust", "dotnet-csharp", "php", "ruby"]) {
+    assert(
+      capabilities.tools?.skills?.some((skill) => skill.id === skillId),
+      `capabilities did not report built-in ${skillId} skill`
+    );
+  }
 
   const doctor = JSON.parse(await runCli(["doctor", "--capabilities", "--json"]));
   assert(doctor.project.root === tempRoot, "doctor --capabilities used the wrong project root");
   assert(doctor.project.instructionsPresent, "doctor --capabilities did not report AGINTI.md");
+  const envSandboxRun = await runCli(
+    ["--provider", "mock", "--routing", "manual", "--model", "mock-agent", "--max-steps", "1", "env sandbox smoke"],
+    {
+      SANDBOX_MODE: "host",
+      PACKAGE_INSTALL_POLICY: "allow",
+      USE_DOCKER_SANDBOX: "false",
+    }
+  );
+  assert(envSandboxRun.includes("Shell: host policy=allow"), "one-shot CLI did not respect host sandbox env defaults");
+  assert(!envSandboxRun.includes("Docker workspace:"), "one-shot CLI forced Docker despite host sandbox env defaults");
 
   console.log(
     JSON.stringify(
       {
         ok: true,
         projectRoot: tempRoot,
-        checks: ["aginti-md-init", "capabilities-cli", "doctor-capabilities", "maintenance-policy", "trusted-docker-policy", "git-policy", "skills-capability"],
+        checks: [
+          "aginti-md-init",
+          "capabilities-cli",
+          "doctor-capabilities",
+          "maintenance-policy",
+          "trusted-docker-policy",
+          "git-policy",
+          "skills-capability",
+          "env-sandbox-defaults",
+        ],
       },
       null,
       2

package/scripts/smoke-cli-chat.js

@@ -17,6 +17,7 @@ import {
 
 const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const tempRoot = await fs.mkdtemp(path.join(os.tmpdir(), "agintiflow-cli-chat-"));
+const agintiflowHome = path.join(tempRoot, ".agintiflow-home");
 const binPath = path.join(repoRoot, "bin/aginti-cli.js");
 
 function runChat(inputText) {
@@ -31,6 +32,7 @@ function runCli(args, inputText) {
       env: {
         ...process.env,
         AGINTIFLOW_RUNTIME_DIR: "",
+        AGINTIFLOW_HOME: agintiflowHome,
         AGINTI_LANGUAGE: "en",
       },
     });

package/scripts/smoke-coding-tools.js

@@ -15,6 +15,7 @@ import { executeWorkspaceTool } from "../src/workspace-tools.js";
 
 const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const tempRoot = await fs.mkdtemp(path.join(os.tmpdir(), "agintiflow-coding-tools-"));
+process.env.AGINTIFLOW_HOME = path.join(tempRoot, ".agintiflow-home");
 const runtimeDir = path.join(tempRoot, "runtime");
 const workspace = path.join(tempRoot, "workspace");
 await fs.mkdir(workspace, { recursive: true });
@@ -97,6 +98,30 @@ try {
     taskProfile: "large-codebase",
   });
   assert(/pro/i.test(largeProfileRoute.model), "large-codebase profile did not route to DeepSeek pro");
+  const codeProfileRoute = selectModelRoute({
+    routingMode: "smart",
+    provider: "deepseek",
+    goal: "this repo has some bugs and messy parts. can you make it good and leave it clean?",
+    taskProfile: "code",
+  });
+  assert(/pro/i.test(codeProfileRoute.model), "code profile did not route vague bugfix work to DeepSeek pro");
+  assert(
+    recommendedMaxStepsForTask({
+      goal: "this repo has some bugs and messy parts. can you make it good and leave it clean?",
+      taskProfile: "code",
+      complexityScore: codeProfileRoute.complexityScore,
+    }) >= 36,
+    "code profile did not get enough steps for inspect-fix-test-cleanup"
+  );
+  for (const complexProfile of ["qa", "database", "devops", "security"]) {
+    const route = selectModelRoute({
+      routingMode: "smart",
+      provider: "deepseek",
+      goal: "do the work",
+      taskProfile: complexProfile,
+    });
+    assert(/pro/i.test(route.model), `${complexProfile} profile did not route to DeepSeek pro`);
+  }
   const autoSystemRoute = selectModelRoute({
     routingMode: "smart",
     provider: "deepseek",
@@ -115,6 +140,22 @@ try {
   const guidance = engineeringGuidanceForTask("debug this Python project system bug and fix failing tests", "auto");
   assert(guidance.includes("Python:"), "engineering guidance did not include Python stack advice");
   assert(guidance.includes("System/shell:"), "engineering guidance did not include system stack advice");
+  assert(
+    guidance.includes("workspace-relative commands"),
+    "engineering guidance did not include workspace-relative shell advice"
+  );
+  assert(
+    guidance.includes("obvious duplicates"),
+    "engineering guidance did not include output-polish advice"
+  );
+  assert(
+    guidance.includes("clean git status means tracked work is clean"),
+    "engineering guidance did not distinguish git-clean from transient artifacts"
+  );
+  assert(
+    guidance.includes("find . -type d -name __pycache__"),
+    "engineering guidance did not include recursive Python transient checks"
+  );
   assert(
     shouldRunParallelScouts(
       {

package/scripts/smoke-inbox.js

@@ -2,9 +2,11 @@
 import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
+import { ensureProjectSessionStorage, listProjectSessions } from "../src/project.js";
 import { SessionStore } from "../src/session-store.js";
 
 const tempRoot = await fs.mkdtemp(path.join(os.tmpdir(), "agintiflow-inbox-"));
+process.env.AGINTIFLOW_HOME = path.join(tempRoot, ".agintiflow-home");
 
 function assert(condition, message) {
   if (!condition) throw new Error(message);
@@ -25,11 +27,48 @@ try {
   assert(drained[2].content === "second queued message", "second queued message mismatch");
   assert((await store.drainInbox()).length === 0, "inbox was not cleared after drain");
 
+  const legacyProject = path.join(tempRoot, "legacy-project");
+  const legacySession = "legacy-session-smoke";
+  const legacyDir = path.join(legacyProject, ".sessions", legacySession);
+  await fs.mkdir(legacyDir, { recursive: true });
+  await fs.writeFile(
+    path.join(legacyDir, "state.json"),
+    `${JSON.stringify({
+      sessionId: legacySession,
+      createdAt: "2026-01-01T00:00:00.000Z",
+      updatedAt: "2026-01-01T00:01:00.000Z",
+      provider: "mock",
+      model: "mock-agent",
+      goal: "legacy migration smoke",
+      commandCwd: legacyProject,
+      chat: [],
+    })}\n`,
+    "utf8"
+  );
+  await fs.writeFile(path.join(legacyDir, "events.jsonl"), "", "utf8");
+  const paths = await ensureProjectSessionStorage(legacyProject);
+  const migrated = await listProjectSessions(legacyProject, 10);
+  assert(migrated.some((session) => session.sessionId === legacySession), "legacy session was not discoverable after migration");
+  assert(
+    await fs.stat(path.join(paths.globalSessionsDir, legacySession, "state.json")).then((stat) => stat.isFile()).catch(() => false),
+    "legacy session state was not copied to the global store"
+  );
+  assert(
+    await fs.stat(path.join(paths.sessionsDir, legacySession, "session.json")).then((stat) => stat.isFile()).catch(() => false),
+    "project session pointer was not created"
+  );
+
   console.log(
     JSON.stringify(
       {
         ok: true,
-        checks: ["session-inbox-append", "session-inbox-drain", "session-inbox-asap-priority"],
+        checks: [
+          "session-inbox-append",
+          "session-inbox-drain",
+          "session-inbox-asap-priority",
+          "legacy-session-migration",
+          "global-session-store",
+        ],
       },
       null,
       2

package/scripts/smoke-skills.js

@@ -18,17 +18,35 @@ function selectedIds(goal, taskProfile = "auto") {
 
 const skills = listSkills({ includeBody: true });
 const ids = new Set(skills.map((skill) => skill.id));
-assert(skills.length >= 14, "expected built-in skills to load");
+assert(skills.length >= 27, "expected built-in skills to load");
 for (const required of [
   "aaps",
   "code",
+  "code-review",
+  "data-analysis",
+  "database",
+  "dotnet-csharp",
+  "devops-deployment",
+  "docs-knowledge",
+  "education-tutorial",
+  "go",
   "github-maintenance",
   "image-generation",
+  "ios-swift",
+  "java-jvm",
   "latex-manuscript",
+  "presentation-slides",
+  "qa-testing",
+  "ruby",
+  "rust",
+  "php",
+  "security-review",
   "system-maintenance",
+  "supervision-student",
   "tmux-session",
   "website-app",
   "word-documents",
+  "writing-editing",
 ]) {
   assert(ids.has(required), `missing required skill ${required}`);
 }
@@ -42,6 +60,28 @@ assert(selectedIds("monitor a long running tmux session").includes("tmux-session
 assert(selectedIds("create an .aaps example for @lazyingart/aaps").includes("aaps"), "AAPS prompt did not select aaps");
 assert(selectedIds("debug a C++ CMake build").includes("c-cpp"), "C++ prompt did not select c-cpp");
 assert(selectedIds("set up Stan and CmdStanR reproducibly").includes("r-stan"), "Stan prompt did not select r-stan");
+assert(selectedIds("fix this Java Spring Maven JUnit project").includes("java-jvm"), "Java prompt did not select java-jvm");
+assert(selectedIds("build an iOS SwiftUI app and test it in simulator").includes("ios-swift"), "iOS prompt did not select ios-swift");
+assert(selectedIds("repair this Go module and run go test").includes("go"), "Go prompt did not select go");
+assert(selectedIds("fix a Rust cargo workspace and run cargo test").includes("rust"), "Rust prompt did not select rust");
+assert(selectedIds("debug a C# dotnet web API").includes("dotnet-csharp"), ".NET prompt did not select dotnet-csharp");
+assert(selectedIds("fix a PHP Laravel composer project").includes("php"), "PHP prompt did not select php");
+assert(selectedIds("repair a Ruby Rails app with RSpec").includes("ruby"), "Ruby prompt did not select ruby");
+assert(selectedIds("clean a CSV dataset and make plots").includes("data-analysis"), "data prompt did not select data-analysis");
+assert(selectedIds("write README API docs and a tutorial").includes("docs-knowledge"), "docs prompt did not select docs-knowledge");
+assert(selectedIds("fix failing tests and add regression coverage").includes("qa-testing"), "QA prompt did not select qa-testing");
+const qaSkill = skills.find((skill) => skill.id === "qa-testing");
+assert(qaSkill?.body.includes("Do not invent staged bugs"), "QA skill does not guard against fake staged failures");
+assert(selectedIds("write SQL migrations for sqlite schema").includes("database"), "database prompt did not select database");
+assert(selectedIds("debug Docker deployment logs and port config").includes("devops-deployment"), "devops prompt did not select devops-deployment");
+assert(selectedIds("review auth security and secrets handling").includes("security-review"), "security prompt did not select security-review");
+assert(selectedIds("make a PowerPoint pitch deck").includes("presentation-slides"), "slides prompt did not select presentation-slides");
+assert(selectedIds("edit a markdown screenplay final draft").includes("writing-editing"), "writing prompt did not select writing-editing");
+assert(selectedIds("create a lesson with exercises and quiz").includes("education-tutorial"), "education prompt did not select education-tutorial");
+assert(selectedIds("review this PR architecture without editing").includes("code-review"), "review prompt did not select code-review");
+assert(selectedIds("supervise a student agent in tmux and verify its artifacts", "supervision").includes("supervision-student"), "supervision prompt did not select supervision-student");
+assert(selectedIds("supervision").includes("supervision-student"), "single-word supervision prompt did not select supervision-student");
+assert(!selectedIds("supervision").includes("r-stan"), "single-word supervision prompt incorrectly selected r-stan");
 
 const prompt = formatSkillsForPrompt(selectSkillsForGoal("write latex manuscript with figures", { taskProfile: "latex", limit: 3 }));
 assert(prompt.includes("A skill is Markdown guidance"), "skill prompt does not explain skill semantics");
@@ -59,6 +99,18 @@ const cli = await execFileAsync(process.execPath, [path.join(repoRoot, "bin/agin
 });
 assert(cli.stdout.includes("website-app"), "aginti skills website did not print website-app");
 
+const supervisionCli = await execFileAsync(process.execPath, [path.join(repoRoot, "bin/aginti-cli.js"), "skills", "supervision"], {
+  cwd: repoRoot,
+  timeout: 10000,
+  maxBuffer: 512 * 1024,
+  env: {
+    ...process.env,
+    AGINTIFLOW_RUNTIME_DIR: "",
+  },
+});
+assert(supervisionCli.stdout.includes("supervision-student"), "aginti skills supervision did not print supervision-student");
+assert(!supervisionCli.stdout.includes("r-stan:"), "aginti skills supervision incorrectly printed r-stan");
+
 console.log(
   JSON.stringify(
     {

package/scripts/smoke-toolchain-docker.js

@@ -10,6 +10,7 @@ import { resolveRuntimeConfig } from "../src/config.js";
 
 const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const tempRoot = await fs.mkdtemp(path.join(os.tmpdir(), "agintiflow-toolchain-"));
+process.env.AGINTIFLOW_HOME = path.join(tempRoot, ".agintiflow-home");
 const runtimeDir = path.join(tempRoot, "runtime");
 const workspace = path.join(tempRoot, "workspace");
 await fs.mkdir(workspace, { recursive: true });

package/scripts/smoke-web-api.js

@@ -5,9 +5,12 @@ import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { SessionStore } from "../src/session-store.js";
+import { projectPaths, sessionStoreOptions } from "../src/project.js";
 
 const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const runtimeDir = await fs.mkdtemp(path.join(os.tmpdir(), "agintiflow-api-smoke-"));
+const agintiflowHome = path.join(runtimeDir, ".agintiflow-home");
+process.env.AGINTIFLOW_HOME = agintiflowHome;
 const port = 43000 + Math.floor(Math.random() * 1000);
 const baseUrl = `http://127.0.0.1:${port}`;
 const server = spawn(process.execPath, [path.join(repoRoot, "bin/aginti-cli.js"), "web", "--port", String(port), "--host", "127.0.0.1"], {
@@ -15,6 +18,7 @@ const server = spawn(process.execPath, [path.join(repoRoot, "bin/aginti-cli.js")
   env: {
     ...process.env,
     AGINTIFLOW_RUNTIME_DIR: runtimeDir,
+    AGINTIFLOW_HOME: agintiflowHome,
   },
   stdio: ["ignore", "pipe", "pipe"],
 });
@@ -238,7 +242,8 @@ try {
     }
   );
   if (!deletedInbox.ok) throw new Error("inbox delete endpoint failed");
-  const inboxStore = new SessionStore(path.join(runtimeDir, ".sessions"), runStart.sessionId);
+  const paths = projectPaths(runtimeDir);
+  const inboxStore = new SessionStore(paths.globalSessionsDir, runStart.sessionId, sessionStoreOptions(runtimeDir, runStart.sessionId));
   const remainingInbox = await inboxStore.loadInbox();
   if (remainingInbox.some((item) => item.id === queued.item.id)) throw new Error("inbox delete endpoint left item on disk");
 

package/skills/android/SKILL.md

@@ -26,7 +26,8 @@ tools:
 4. Patch source-set-aware files only: manifests, Gradle scripts, Kotlin/Java sources, XML resources, and project docs. Keep generated build outputs out of patches and commits.
 5. Build with the narrowest useful task first, usually `./gradlew :app:assembleDebug` or `./gradlew assembleDebug`. Repair build failures from the actual error text.
 6. Install and launch on an available device/emulator with `adb install` and `adb shell am start`. Verify with `adb shell pidof`, `adb logcat -d`, `adb shell screencap`, or similar evidence when available.
-7. Commit only after build/install/launch verification, with a clear message. Before final summary, run `git status --short`; leave source changes committed and generated/session artifacts ignored or explicitly reported. If no device/emulator exists, finish with a concrete external blocker and the generated APK path.
+7. Save screenshots and APK references in durable workspace paths with descriptive names when the user did not specify paths, for example `artifacts/screenshots/<app>-<timestamp>.png` and `app/build/outputs/apk/debug/app-debug.apk`. Do not rely only on a temporary screenshot that is deleted after canvas preview.
+8. Commit only after build/install/launch verification, with a clear message. Before final summary, run `git status --short`; leave source changes committed and generated/session artifacts ignored or explicitly reported. If no device/emulator exists, finish with a concrete external blocker and the generated APK path.
 
 ## Missing Tooling
 

package/skills/code-review/SKILL.md

@@ -0,0 +1,24 @@
+---
+id: code-review
+label: Code Review And Architecture Review
+description: Review diffs or codebases for bugs, regressions, design risks, maintainability, missing tests, and architecture issues.
+triggers:
+  - review
+  - code review
+  - architecture review
+  - pr review
+  - audit code
+  - inspect changes
+tools:
+  - inspect_project
+  - search_files
+  - read_file
+  - run_command
+  - web_search
+---
+# Code Review And Architecture Review
+
+Prioritize findings over summary. Inspect changed files, neighboring code, tests, and runtime assumptions. Report concrete risks with file paths, reproduction evidence, and suggested fixes.
+
+If no findings are found, say that clearly and name residual risk or missing test coverage. Do not rewrite code during a review unless the user asks for fixes.
+

package/skills/data-analysis/SKILL.md

@@ -0,0 +1,29 @@
+---
+id: data-analysis
+label: Data Analysis And ETL
+description: Clean, analyze, transform, validate, visualize, and report on datasets using reproducible scripts and durable artifacts.
+triggers:
+  - data
+  - csv
+  - dataset
+  - dataframe
+  - pandas
+  - analysis
+  - etl
+  - chart
+  - plot
+  - visualization
+tools:
+  - inspect_project
+  - read_file
+  - write_file
+  - apply_patch
+  - run_command
+  - send_to_canvas
+---
+# Data Analysis And ETL
+
+Preserve raw inputs. Inspect schemas, row counts, missing values, duplicate rows, units, time zones, and suspicious outliers before writing conclusions.
+
+Prefer a reproducible script over one-off chat math. Save cleaned data, plots, and reports with descriptive filenames. Rerun the script after edits and verify the output actually changed as intended.
+

package/skills/database/SKILL.md

@@ -0,0 +1,27 @@
+---
+id: database
+label: Database And SQL
+description: Work with SQL, schema design, migrations, seed data, query fixes, and local database-backed apps.
+triggers:
+  - database
+  - sql
+  - sqlite
+  - postgres
+  - mysql
+  - migration
+  - schema
+  - query
+  - seed data
+tools:
+  - inspect_project
+  - search_files
+  - read_file
+  - apply_patch
+  - run_command
+---
+# Database And SQL
+
+Inspect existing migrations, models, schema dumps, seed data, and app access patterns before changing persistence code.
+
+Prefer reversible migrations and local fixtures. Never silently drop or rewrite user data. If destructive migration or production credential access would be required, stop and request explicit direction.
+