@lazyingart/agintiflow 0.20.250 → 0.20.251

package/docs/supervision-campaign-ledger.md

@@ -379,3 +379,32 @@ local report paths and existing-document revision language now count as local
 workspace intent, so surrounding research policy does not force a new deep
 research route. The phrase `page-safe` no longer creates a browser-evidence
 requirement. Focused routing/evidence smokes and the full npm suite pass.
+
+### Fresh current-turn command evidence on retained sessions
+
+`security-labshare-035` exercised a long-lived LocalLLM security-repair
+session after the target repository was already fixed, committed, and clean.
+The follow-up prompt deliberately asked the agent not to edit or recommit. It
+required only the exact hidden verifier and `git status --short`, while allowing
+all other passing implementation and unit-test evidence to remain reusable.
+
+Installed AgInTiFlow `0.20.250` incorrectly finished after `inspect_project`.
+It reused the old verifier/status evidence and never executed either command in
+the current turn. The defect was not model quality: the runtime had failed to
+turn explicit commands in a concrete same-task interruption into a fresh,
+revision-bound evidence obligation.
+
+The runtime now records explicit current-turn commands in the active execution
+contract and creates a fresh command batch for only that subset. Unrelated
+passing evidence from the unchanged mutation revision remains valid, while old
+runs of the newly requested commands cannot pre-complete the batch. Inline
+command extraction also recognizes natural `verify`, `validate`, `check`,
+`confirm`, and rerun wording in English and Chinese.
+
+The same real session was replayed against the patched source at goal revision
+`34`. Its event ledger records both commands under
+`required-command-batch-3`: the exact external security contract returned
+`security_labshare_contract: PASS`, and `git status --short` returned empty.
+The target stayed at commit `2b35928` with no mutation. Focused planning,
+truthful-completion, and dynamic-budget regressions pass, as does the complete
+AgInTiFlow npm suite. The fix is released in AgInTiFlow `0.20.251`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.250",
+  "version": "0.20.251",
   "type": "module",
   "description": "AgInTiFlow is a project-aware agent workspace for hybrid wet-dry R&D, hardware-aware intelligence, software automation, and industrial workflows.",
   "license": "Apache-2.0",

package/scripts/smoke-dynamic-step-budget.js

@@ -2885,6 +2885,152 @@ try {
     "the goal contract did not separate durable task lineage from the active interruption"
   );
 
+  const exactVerifier = "python3 /tmp/security_labshare_contract.py";
+  const exactStatus = "git status --short";
+  const retainedUnitTest = "python3 -m unittest discover -s tests -v";
+  const freshCommandState = {
+    goal: "Repair and verify the current security task.",
+    plan: "The prior implementation and validation are complete.",
+    messages: [
+      toolMessage({
+        ok: true,
+        toolName: "run_command",
+        args: { command: retainedUnitTest },
+        exitCode: 0,
+        stdout: "OK",
+        projectMutationRevision: 7,
+        goalRevision: 5,
+      }),
+      toolMessage({
+        ok: true,
+        toolName: "run_command",
+        args: { command: exactVerifier },
+        exitCode: 0,
+        stdout: "security_labshare_contract: PASS",
+        projectMutationRevision: 7,
+        requiredCommandBatchId: "required-command-batch-2",
+        requiredProjectCommand: exactVerifier,
+        goalRevision: 5,
+      }),
+      toolMessage({
+        ok: true,
+        toolName: "run_command",
+        args: { command: exactStatus },
+        exitCode: 0,
+        stdout: "",
+        projectMutationRevision: 7,
+        requiredCommandBatchId: "required-command-batch-2",
+        requiredProjectCommand: exactStatus,
+        goalRevision: 5,
+      }),
+    ],
+    meta: {
+      taskProfile: "security",
+      goalContract: {
+        version: 3,
+        revision: 5,
+        status: "completed",
+        taskGoal: "Repair and verify the current security task.",
+        activeGoal: "Repair and verify the current security task.",
+        currentRequest: "Repair and verify the current security task.",
+        history: [{ revision: 5, taskHash: "same-security-task" }],
+      },
+      projectVerification: {
+        mutationRevision: 7,
+        requiredCommands: [retainedUnitTest],
+        contractRequiredCommands: [exactVerifier, exactStatus],
+        requiredCommandBatchSequence: 2,
+        requiredCommandBatch: {
+          id: "required-command-batch-2",
+          key: JSON.stringify([exactVerifier, exactStatus]),
+          requiredCommands: [exactVerifier, exactStatus],
+          goalRevision: 5,
+          completedCommands: [exactVerifier, exactStatus],
+          completedRuns: [
+            { command: exactVerifier, mutationRevision: 7 },
+            { command: exactStatus, mutationRevision: 7 },
+          ],
+          startedMutationRevision: 7,
+          lastMutationRevision: 7,
+          complete: true,
+        },
+        commandRuns: [{
+          command: retainedUnitTest,
+          mutationRevision: 7,
+          ok: true,
+        }],
+        testRuns: [],
+      },
+    },
+  };
+  const freshCommandRequest =
+    "Continue the same corrective task. Run `python3 /tmp/security_labshare_contract.py`, verify `git status --short`, and finish without editing or recommitting files.";
+  const freshCommandUpdate = applyContinuationContractTransition(
+    freshCommandState,
+    freshCommandRequest,
+    { at: "2026-08-26T04:00:00.000Z" }
+  );
+  assert(
+    freshCommandUpdate?.preserveTaskBoundary && freshCommandUpdate?.refreshExecutionContract,
+    "an explicit same-task command rerun did not refresh the execution contract"
+  );
+  assert(
+    JSON.stringify(freshCommandState.meta.activeExecutionContract.requiredProjectCommands) ===
+      JSON.stringify([exactVerifier, exactStatus]),
+    "the current turn lost an explicitly verified inline command"
+  );
+  assert(
+    freshCommandState.meta.projectVerification.requiredCommandBatch.goalRevision === 6,
+    "the fresh command batch was not bound to the current goal revision"
+  );
+  assert(
+    freshCommandState.meta.projectVerification.requiredCommandBatch.completedCommands.length === 0,
+    "retained command evidence pre-completed a current-turn rerun obligation"
+  );
+  const freshCommandConfig = {
+    taskProfile: "security",
+    commandCwd: workspace,
+  };
+  let freshCommandRuntime = nextStepRuntimeConfig(freshCommandConfig, freshCommandState);
+  assert(
+    freshCommandRuntime.requiredProjectCommandPending === true,
+    "the current-turn verifier was not marked pending"
+  );
+  assert(
+    freshCommandRuntime.requiredProjectCommand === exactVerifier,
+    "the first explicitly repeated command was not pending"
+  );
+  const verifierResult = {
+    ok: true,
+    toolName: "run_command",
+    args: { command: exactVerifier },
+    exitCode: 0,
+    stdout: "security_labshare_contract: PASS",
+    stderr: "",
+  };
+  recordProjectVerificationOutcome(freshCommandState, verifierResult, freshCommandConfig);
+  freshCommandState.messages.push(toolMessage(verifierResult));
+  freshCommandRuntime = nextStepRuntimeConfig(freshCommandConfig, freshCommandState);
+  assert(
+    freshCommandRuntime.requiredProjectCommand === exactStatus,
+    "the second current-turn command was not retained after the verifier passed"
+  );
+  const statusResult = {
+    ok: true,
+    toolName: "run_command",
+    args: { command: exactStatus },
+    exitCode: 0,
+    stdout: "",
+    stderr: "",
+  };
+  recordProjectVerificationOutcome(freshCommandState, statusResult, freshCommandConfig);
+  freshCommandState.messages.push(toolMessage(statusResult));
+  freshCommandRuntime = nextStepRuntimeConfig(freshCommandConfig, freshCommandState);
+  assert(
+    freshCommandRuntime.requiredProjectCommandPending !== true,
+    "the fresh command batch stayed pending after both exact commands passed"
+  );
+
   const bareContinuationState = {
     goal: concreteContinuation,
     plan: "Update both retained outputs, validate, and commit.",

package/src/agent-runner.js

@@ -3066,10 +3066,25 @@ export function resetSameTaskExecutionContract(state = {}, revision = 0) {
     removed.push(key);
   }
   state.plan = "";
+  const activeRevision = Math.max(0, Number(revision || state.meta?.goalContract?.revision || 0));
+  const currentRequest = String(state.meta?.goalContract?.currentRequest || state.goal || "").trim();
+  const currentTurnCommands = normalizedRequiredProjectCommands(
+    deriveScsTaskContract({
+      goal: currentRequest,
+      taskProfile: state.meta?.taskProfile || "auto",
+    }).requiredProjectCommands
+  );
   state.meta.activeExecutionContract = {
-    revision: Math.max(0, Number(revision || state.meta?.goalContract?.revision || 0)),
+    revision: activeRevision,
     refreshedAt: new Date().toISOString(),
+    requiredProjectCommands: currentTurnCommands,
   };
+  const verification = state.meta.projectVerification;
+  if (verification && typeof verification === "object" && currentTurnCommands.length) {
+    startRequiredCommandBatch(verification, currentTurnCommands, {
+      goalRevision: activeRevision,
+    });
+  }
   return removed;
 }
 
@@ -4289,10 +4304,27 @@ function effectiveRequiredProjectCommands(state = {}, verification = {}, config
 
 function currentRequiredCommandBatch(verification = {}, requiredCommands = []) {
   const batch = verification.requiredCommandBatch;
-  const key = requiredCommandBatchKey(requiredCommands);
-  if (!batch || typeof batch !== "object" || !key || batch.key !== key || !batch.id) return null;
+  const effectiveCommands = normalizedRequiredProjectCommands(requiredCommands);
+  const batchCommands = normalizedRequiredProjectCommands(
+    Array.isArray(batch?.requiredCommands)
+      ? batch.requiredCommands
+      : batch?.key === requiredCommandBatchKey(effectiveCommands)
+        ? effectiveCommands
+        : []
+  );
+  if (
+    !batch ||
+    typeof batch !== "object" ||
+    !batch.id ||
+    !batchCommands.length ||
+    batch.key !== requiredCommandBatchKey(batchCommands) ||
+    batchCommands.some((command) => !effectiveCommands.includes(command))
+  ) {
+    return null;
+  }
   return {
     ...batch,
+    requiredCommands: batchCommands,
     completedCommands: Array.isArray(batch.completedCommands)
       ? batch.completedCommands.map(normalizeProjectCommand).filter(Boolean)
       : [],
@@ -4307,13 +4339,20 @@ function currentRequiredCommandBatch(verification = {}, requiredCommands = []) {
   };
 }
 
-function startRequiredCommandBatch(verification = {}, requiredCommands = []) {
+function startRequiredCommandBatch(
+  verification = {},
+  requiredCommands = [],
+  { goalRevision = 0 } = {}
+) {
+  const normalizedCommands = normalizedRequiredProjectCommands(requiredCommands);
   const sequence = Math.max(0, Number(verification.requiredCommandBatchSequence || 0)) + 1;
   verification.requiredCommandBatchSequence = sequence;
   const revision = Math.max(0, Number(verification.mutationRevision || 0));
   const batch = {
     id: `required-command-batch-${sequence}`,
-    key: requiredCommandBatchKey(requiredCommands),
+    key: requiredCommandBatchKey(normalizedCommands),
+    requiredCommands: normalizedCommands,
+    goalRevision: Math.max(0, Number(goalRevision || 0)),
     completedCommands: [],
     completedRuns: [],
     startedMutationRevision: revision + 1,
@@ -4474,7 +4513,7 @@ function requiredCommandRunIsCurrent(
   if (!required || !commandMatches) return false;
   const requiredCommands = verificationRequiredProjectCommands(verification);
   const batch = currentRequiredCommandBatch(verification, requiredCommands);
-  if (batch?.id) {
+  if (batch?.id && batch.requiredCommands.includes(required)) {
     const accepted = batch.completedRuns.find((item) => item.command === required);
     return Boolean(
       accepted &&
@@ -4597,21 +4636,45 @@ export function recordProjectVerificationOutcome(state = {}, toolResult = {}, co
         commandCanMutateProjectContent(mutationCommand, commandPolicy)
     );
     let requiredBatch = currentRequiredCommandBatch(verification, requiredCommands);
+    const activeExecutionContract = state.meta?.activeExecutionContract;
+    const activeTurnCommands =
+      Number(activeExecutionContract?.revision || 0) ===
+      Number(state.meta?.goalContract?.revision || 0)
+        ? normalizedRequiredProjectCommands(activeExecutionContract?.requiredProjectCommands)
+        : [];
+    if (
+      !requiredBatch &&
+      requiredCommand &&
+      activeTurnCommands.includes(requiredCommand)
+    ) {
+      requiredBatch = startRequiredCommandBatch(verification, activeTurnCommands, {
+        goalRevision: state.meta?.goalContract?.revision || 0,
+      });
+    }
+    let batchRequiredCommands = requiredBatch?.requiredCommands || requiredCommands;
     if (projectContentMutation) {
       delete state.meta.verifiedCompletionCandidate;
       if (
         requiredCommand &&
+        batchRequiredCommands.includes(requiredCommand) &&
         (!requiredBatch ||
           requiredBatch.complete ||
           requiredBatch.completedCommands.includes(requiredCommand))
       ) {
-        requiredBatch = startRequiredCommandBatch(verification, requiredCommands);
+        requiredBatch = startRequiredCommandBatch(verification, batchRequiredCommands, {
+          goalRevision: state.meta?.goalContract?.revision || 0,
+        });
+        batchRequiredCommands = requiredBatch.requiredCommands;
       }
       verification.mutationRevision += 1;
-      if (requiredCommand && requiredBatch) {
+      if (
+        requiredCommand &&
+        requiredBatch &&
+        requiredBatch.requiredCommands.includes(requiredCommand)
+      ) {
         invalidateRequiredBatchValidations(
           requiredBatch,
-          requiredCommands,
+          requiredBatch.requiredCommands,
           config,
           requiredCommand
         );
@@ -4640,17 +4703,19 @@ export function recordProjectVerificationOutcome(state = {}, toolResult = {}, co
     };
     if (requiredCommand && commandSucceeded) {
       if (!requiredBatch && requiredMutatingCommands.length === 0) {
-        requiredBatch = startRequiredCommandBatch(verification, requiredCommands);
+        requiredBatch = startRequiredCommandBatch(verification, requiredCommands, {
+          goalRevision: state.meta?.goalContract?.revision || 0,
+        });
         requiredBatch.startedMutationRevision = verification.mutationRevision;
         requiredBatch.lastMutationRevision = verification.mutationRevision;
       }
-      if (requiredBatch) {
+      if (requiredBatch?.requiredCommands.includes(requiredCommand)) {
         recordRequiredBatchRun(
           requiredBatch,
           requiredCommand,
           verification.mutationRevision
         );
-        requiredBatch.complete = requiredCommands.every((candidate) =>
+        requiredBatch.complete = requiredBatch.requiredCommands.every((candidate) =>
           requiredBatch.completedCommands.includes(candidate)
         );
         verification.requiredCommandBatch = requiredBatch;

package/src/scs-evidence.js

@@ -980,9 +980,9 @@ function prefixRequestsInlineCommandExecution(prefix = "") {
   while (preamble.test(clause)) clause = clause.replace(preamble, "").trim();
   clause = clause.replace(/(?:[:：]|--?)\s*$/, "").trim();
   return (
-    /^(?:run|execute|invoke|launch)(?:\s+(?:(?:the|this|that)\s+)?(?:following\s+)?command(?:\s+named)?)?\s*$/i.test(
+    /^(?:run|rerun|re-run|execute|invoke|launch|verify|validate|check|confirm)(?:\s+(?:(?:the|this|that)\s+)?(?:following\s+)?command(?:\s+named)?)?\s*$/i.test(
       clause
-    ) || /^(?:运行|運行|执行|執行|调用|調用)\s*$/.test(clause)
+    ) || /^(?:运行|運行|执行|執行|调用|調用|验证|驗證|检查|檢查|确认|確認)\s*$/.test(clause)
   );
 }
 
@@ -1239,9 +1239,19 @@ export function augmentScsTaskContractWithProjectVerification(contract = {}, sta
     ...verificationRequiredProjectCommands,
   ].map(normalizeProjectCommand).filter(Boolean)).slice(0, 24);
   const requiredCommandBatch = verification.requiredCommandBatch;
+  const batchRequiredCommands = unique(
+    (Array.isArray(requiredCommandBatch?.requiredCommands)
+      ? requiredCommandBatch.requiredCommands
+      : requiredCommandBatch?.key === JSON.stringify(requiredProjectCommands)
+        ? requiredProjectCommands
+        : [])
+      .map(normalizeProjectCommand)
+      .filter((command) => command && requiredProjectCommands.includes(command))
+  );
   const requiredProjectCommandBatchId =
     requiredCommandBatch &&
-    requiredCommandBatch.key === JSON.stringify(requiredProjectCommands) &&
+    batchRequiredCommands.length > 0 &&
+    requiredCommandBatch.key === JSON.stringify(batchRequiredCommands) &&
     requiredCommandBatch.id
       ? String(requiredCommandBatch.id)
       : "";
@@ -1286,7 +1296,7 @@ export function augmentScsTaskContractWithProjectVerification(contract = {}, sta
     requiredProjectCommands,
     requiredProjectCommandBatchId,
     requiredProjectCommandBatchCommands: requiredProjectCommandBatchId
-      ? requiredProjectCommands
+      ? batchRequiredCommands
       : [],
     requiredProjectCommandRuns,
     projectMutationRevision: mutationRevision,