@lazyingart/agintiflow 0.20.264 → 0.20.265

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.264",
+  "version": "0.20.265",
   "type": "module",
   "description": "AgInTiFlow is a project-aware agent workspace for hybrid wet-dry R&D, hardware-aware intelligence, software automation, and industrial workflows.",
   "license": "Apache-2.0",

package/scripts/smoke-coding-tools.js

@@ -8,6 +8,7 @@ import {
   genericArtifactFilenameBlock,
   modelTimeoutExhaustionRoute,
   modelTimeoutRetryRoute,
+  normalizeNoMatchQueryResult,
   applyModelTimeoutRetryRoute,
   recoverFocusedTextRewriteWithWritingSpecialist,
   repairModelMessageHistory,
@@ -956,6 +957,33 @@ try {
   );
   assert(readonlyVersionPipelinePolicy.allowed, "read-only version probe pipelines should not require package-install-policy=allow");
   assert(readonlyVersionPipelinePolicy.category === "read-only", "read-only version probe pipelines should be classified as read-only");
+  const pgrepNoMatchPolicy = evaluateCommandPolicy(
+    "pgrep -af gateway_service",
+    dockerWorkspaceNoInstallsPolicy
+  );
+  assert(
+    pgrepNoMatchPolicy.allowed &&
+      pgrepNoMatchPolicy.category === "read-only" &&
+      pgrepNoMatchPolicy.noMatchExitIsSuccess === true,
+    "pgrep should be a read-only query whose no-match exit is meaningful evidence"
+  );
+  const pgrepNoMatchResult = normalizeNoMatchQueryResult(
+    { ok: false, exitCode: 1, stdout: "", stderr: "" },
+    pgrepNoMatchPolicy
+  );
+  assert(
+    pgrepNoMatchResult.ok === true &&
+      pgrepNoMatchResult.noMatch === true &&
+      pgrepNoMatchResult.semanticOutcome === "no-match",
+    "pgrep exit 1 with no diagnostics should normalize to successful no-match evidence"
+  );
+  assert(
+    normalizeNoMatchQueryResult(
+      { ok: false, exitCode: 2, stdout: "", stderr: "invalid option" },
+      pgrepNoMatchPolicy
+    ).ok === false,
+    "an actual pgrep error was incorrectly normalized as no-match evidence"
+  );
   const readonlyDiffSlicePolicy = evaluateCommandPolicy(
     "git diff -- src/agent-runner.js | sed -n '1,240p'",
     dockerWorkspaceNoInstallsPolicy
@@ -1000,6 +1028,16 @@ try {
   );
   assert(pythonUnittestPolicy.allowed, "stdlib python unittest should be allowed without package installs");
   assert(pythonUnittestPolicy.category === "test", "stdlib python unittest should be classified as test");
+  const pythonNoBytecodeAcceptancePolicy = evaluateCommandPolicy(
+    "PYTHONDONTWRITEBYTECODE=1 python3 /tmp/devops_sensor_gateway_contract.py",
+    dockerWorkspaceNoInstallsPolicy
+  );
+  assert(
+    pythonNoBytecodeAcceptancePolicy.allowed &&
+      pythonNoBytecodeAcceptancePolicy.category === "test" &&
+      pythonNoBytecodeAcceptancePolicy.substantiveTest === true,
+    "a no-bytecode Python acceptance command should retain substantive test classification"
+  );
   const pythonDemoPolicy = evaluateCommandPolicy("python3 demo.py 2>&1", dockerWorkspaceNoInstallsPolicy);
   assert(pythonDemoPolicy.allowed, "workspace-local python demo script should be allowed without package installs");
   assert(pythonDemoPolicy.category === "toolchain", "workspace-local python demo script should be classified as toolchain");

package/scripts/smoke-dynamic-step-budget.js

@@ -60,6 +60,7 @@ import {
   completionExternalBlockerCanClose,
   pythonTopLevelDefinitionDuplicates,
   recordCanonicalGeneratedOutputProgress,
+  recordAlreadyCommittedRepositoryRepair,
   recordProjectVerificationOutcome,
   recordExactOutputProgress,
   recordStaticDiscoveryProgress,
@@ -2095,6 +2096,36 @@ try {
     }
   );
   assert(coveredTestQuality.ok === true, coveredTestQuality.reason);
+  const coveredBeforeAcceptanceQuality = await validateMutatedPythonSourceQuality(
+    { commandCwd: pythonQualityWorkspace },
+    {
+      meta: {
+        projectVerification: {
+          mutationRevision: 3,
+          privateMutationRevision: 0,
+          mutationHistory: [{ revision: 3, paths: ["tests/test_service_launch.py"] }],
+          testRuns: [
+            {
+              command: "PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s tests -v",
+              mutationRevision: 3,
+              privateMutationRevision: 0,
+              passed: true,
+            },
+            {
+              command: "python3 /tmp/project_acceptance.py",
+              mutationRevision: 3,
+              privateMutationRevision: 0,
+              passed: true,
+            },
+          ],
+        },
+      },
+    }
+  );
+  assert(
+    coveredBeforeAcceptanceQuality.ok === true,
+    "a later passing acceptance verifier erased current unit-suite coverage for a changed test"
+  );
   assert(normalizeDynamicStepsMode("off") === "off", "dynamic mode off did not normalize");
   for (const command of [
     "npm run build",
@@ -6136,6 +6167,124 @@ try {
     ) === null,
     "a clean-worktree verification gate could not rerun after a Git-state repair"
   );
+  const successfulRepositoryRepairState = structuredClone(repositoryCleanGateFailure);
+  successfulRepositoryRepairState.goal = "Repair and verify the service lifecycle.";
+  successfulRepositoryRepairState.meta.goalContract = { revision: 4 };
+  successfulRepositoryRepairState.meta.activeExecutionContract = {
+    revision: 4,
+    materialMutationRevision: 6,
+  };
+  const successfulRepositoryCommit = {
+    toolName: "run_command",
+    ok: true,
+    exitCode: 0,
+    args: {
+      command:
+        "git add -- 'gateway_service.py' && git commit -m 'Repair service lifecycle'",
+    },
+    stdout:
+      "[main abcdef1] Repair service lifecycle\n 1 file changed, 1 insertion(+), 1 deletion(-)\n",
+    stderr: "",
+  };
+  recordProjectVerificationOutcome(
+    successfulRepositoryRepairState,
+    successfulRepositoryCommit,
+    { commandCwd: workspace, taskProfile: "devops" }
+  );
+  const successfulRepositoryRepairMarker = recordAlreadyCommittedRepositoryRepair(
+    successfulRepositoryRepairState,
+    successfulRepositoryCommit
+  );
+  const postCommitRepositoryRuntime = nextStepRuntimeConfig(
+    { provider: "deepseek", taskProfile: "devops", commandCwd: workspace },
+    successfulRepositoryRepairState
+  );
+  assert(
+    successfulRepositoryRepairMarker?.source === "successful-commit" &&
+      postCommitRepositoryRuntime.testFailureRepositoryStateRepair !== true &&
+      postCommitRepositoryRuntime.testVerificationPending === true &&
+      postCommitRepositoryRuntime.testVerificationCommand === failedValidationCommand,
+    "a successful bounded repair commit did not advance directly to the exact failed verifier"
+  );
+  const cleanStatusRepositoryRepairState = structuredClone(repositoryCleanGateFailure);
+  cleanStatusRepositoryRepairState.goal = "Resume the committed service repair.";
+  cleanStatusRepositoryRepairState.meta.goalContract = { revision: 5 };
+  cleanStatusRepositoryRepairState.meta.activeExecutionContract = {
+    revision: 5,
+    startedMutationRevision: 6,
+    materialMutationRevision: 6,
+    requiresFileMutation: true,
+    requiresSourceGrounding: true,
+  };
+  cleanStatusRepositoryRepairState.meta.durableGitEvidence = [{
+    action: "commit",
+    goalRevision: 5,
+    mutationRevision: 5,
+  }];
+  const cleanStatusAfterCommit = {
+    toolName: "run_command",
+    ok: true,
+    exitCode: 0,
+    args: { command: "git status --short" },
+    stdout: "",
+    stderr: "",
+  };
+  recordProjectVerificationOutcome(
+    cleanStatusRepositoryRepairState,
+    cleanStatusAfterCommit,
+    { commandCwd: workspace, taskProfile: "devops" }
+  );
+  const cleanStatusRepositoryRepairMarker = recordAlreadyCommittedRepositoryRepair(
+    cleanStatusRepositoryRepairState,
+    cleanStatusAfterCommit
+  );
+  const cleanStatusRepositoryRuntime = nextStepRuntimeConfig(
+    { provider: "deepseek", taskProfile: "devops", commandCwd: workspace },
+    cleanStatusRepositoryRepairState
+  );
+  assert(
+    cleanStatusRepositoryRepairMarker?.source === "clean-status-after-commit" &&
+      cleanStatusRepositoryRuntime.completionFreshMutationRequired !== true &&
+      cleanStatusRepositoryRuntime.testVerificationPending === true &&
+      cleanStatusRepositoryRuntime.testVerificationCommand === failedValidationCommand &&
+      buildKnownConstrainedPhasePlan(
+        { provider: "deepseek", taskProfile: "devops", commandCwd: workspace },
+        cleanStatusRepositoryRepairState,
+        cleanStatusRepositoryRuntime
+      )?.mode === "exact-verification",
+    "current commit plus an exact clean Git status did not recover an interrupted repository repair"
+  );
+  const repeatedDirtyRepositoryResult = {
+    toolName: "run_command",
+    ok: false,
+    exitCode: 1,
+    args: { command: failedValidationCommand },
+    stdout: "",
+    stderr:
+      "AssertionError: repository worktree is not clean after a new unrelated mutation",
+  };
+  recordProjectVerificationOutcome(
+    successfulRepositoryRepairState,
+    repeatedDirtyRepositoryResult,
+    {
+      provider: "deepseek",
+      taskProfile: "devops",
+      commandCwd: workspace,
+      testVerificationPending: true,
+      testVerificationCommand: failedValidationCommand,
+    }
+  );
+  const repeatedDirtyRepositoryRuntime = nextStepRuntimeConfig(
+    { provider: "deepseek", taskProfile: "devops", commandCwd: workspace },
+    successfulRepositoryRepairState
+  );
+  assert(
+    repeatedDirtyRepositoryResult.repositoryStateRepairConsumed === true &&
+      !successfulRepositoryRepairState.meta.repositoryStateRepair &&
+      repeatedDirtyRepositoryRuntime.testFailureRepositoryStateRepair === true &&
+      repeatedDirtyRepositoryRuntime.testVerificationPending !== true,
+    "a consumed repository-repair marker caused an unchanged clean-worktree verifier loop"
+  );
   const oversizedRepositoryState = {
     ...repositoryCleanGateFailure,
     goal: "Complete the current repository task and preserve its established acceptance contract.",
@@ -6599,6 +6748,32 @@ try {
     projectTestVerificationFinishBlock(repairedValidationState) === null,
     "a passing rerun at the current real mutation revision did not reopen completion"
   );
+  const presentationWrappedValidationState = {
+    meta: {
+      projectVerification: {
+        mutationRevision: 7,
+        privateMutationRevision: 0,
+        testRuns: [
+          {
+            command: "python3 -m unittest discover -s tests -v 2>&1",
+            mutationRevision: 2,
+            privateMutationRevision: 0,
+            passed: false,
+          },
+          {
+            command: "PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s tests -v",
+            mutationRevision: 7,
+            privateMutationRevision: 0,
+            passed: true,
+          },
+        ],
+      },
+    },
+  };
+  assert(
+    projectTestVerificationFinishBlock(presentationWrappedValidationState) === null,
+    "presentation-only test wrappers left a superseded failure unresolved"
+  );
   const tracebackEvidence = compactFailedTestEvidence(
     {
       stderr: [

package/scripts/smoke-scs-evidence-visibility.js

@@ -68,6 +68,14 @@ const recoveryInstructionContract = deriveScsTaskContract({
   taskProfile: "devops",
 });
 
+const readOnlyVerificationContinuationContract = deriveScsTaskContract({
+  goal: [
+    "Continue the exact active DevOps task from its clean committed state. Do not mutate source, tests, or documentation and do not create another commit.",
+    "Run exactly `git status --short` once, then follow the runtime's exact required verification commands serially. These include `PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s tests -v` and `PYTHONDONTWRITEBYTECODE=1 python3 /tmp/devops_sensor_gateway_contract.py`.",
+  ].join("\n"),
+  taskProfile: "devops",
+});
+
 const readOnlyReviewContract = deriveScsTaskContract({
   goal: [
     "Review focus: changed files only.",
@@ -171,6 +179,25 @@ assert.deepEqual(
   ],
   "a verification command introduced by 'followed by' was not retained"
 );
+assert.deepEqual(
+  readOnlyVerificationContinuationContract.exactOutputPaths,
+  [],
+  "a verifier command following a negated create clause became an exact output path"
+);
+assert.deepEqual(
+  readOnlyVerificationContinuationContract.exactInputPaths,
+  [],
+  "a quoted verifier command became an exact input path"
+);
+assert.deepEqual(
+  readOnlyVerificationContinuationContract.requiredProjectCommands,
+  [
+    "git status --short",
+    "PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s tests -v",
+    "PYTHONDONTWRITEBYTECODE=1 python3 /tmp/devops_sensor_gateway_contract.py",
+  ],
+  "an exact read-only continuation lost one or more required verification commands"
+);
 assert.equal(
   readOnlyReviewContract.requiresWorkspaceMutation,
   false,

package/src/agent-runner.js

@@ -84,6 +84,7 @@ import {
   buildPermissionAdvice,
   goalRevisionCoversActiveTask,
   isAlreadyCommittedCleanGitNoop,
+  isCleanGitStatusAfterCurrentCommit,
 } from "./permission-advice.js";
 import { formatBehaviorContractForPrompt } from "./behavior-contract.js";
 import { browserStateReconciliationGuidance } from "./browser-automation-guidance.js";
@@ -4295,6 +4296,23 @@ export function shellDiagnosticHint(command = "", result = {}) {
   return "";
 }
 
+export function normalizeNoMatchQueryResult(result = {}, policy = {}) {
+  if (
+    policy?.noMatchExitIsSuccess !== true ||
+    Number(result?.exitCode) !== 1 ||
+    String(result?.stdout || "").trim() ||
+    String(result?.stderr || "").trim()
+  ) {
+    return result;
+  }
+  return {
+    ...result,
+    ok: true,
+    noMatch: true,
+    semanticOutcome: "no-match",
+  };
+}
+
 function hashForLog(value) {
   return crypto.createHash("sha256").update(String(value ?? "")).digest("hex");
 }
@@ -6142,6 +6160,21 @@ export function recordProjectVerificationOutcome(state = {}, toolResult = {}, co
         requiredCommandFailure: failedRequiredCommand,
         ...failedEvidence,
       };
+      const repositoryStateRepairMarker = state.meta?.repositoryStateRepair;
+      if (
+        repositoryStateRepairMarker &&
+        Number(repositoryStateRepairMarker.version || 0) === 1 &&
+        Number(repositoryStateRepairMarker.mutationRevision || 0) ===
+          verification.mutationRevision &&
+        projectTestCommandKey(repositoryStateRepairMarker.command || "") ===
+          projectTestCommandKey(command)
+      ) {
+        // A repository repair authorizes one exact verifier rerun. Consume the
+        // marker so a still-dirty worktree returns to repair instead of
+        // replaying the same verifier indefinitely.
+        delete state.meta.repositoryStateRepair;
+        toolResult.repositoryStateRepairConsumed = true;
+      }
       verification.testRuns = [...verification.testRuns, testRun].slice(-24);
       toolResult.projectTest = testRun;
       if (
@@ -6243,13 +6276,19 @@ export function failedTestRequiresCleanRepositoryState(testRun = {}) {
 }
 
 export function recordAlreadyCommittedRepositoryRepair(state = {}, toolResult = {}) {
-  if (
-    !isAlreadyCommittedCleanGitNoop(
-      toolResult.args || {},
-      toolResult,
-      state
-    )
-  ) {
+  const successfulCommit = inferSuccessfulGitActionsFromCommandResult(toolResult)
+    .includes("commit");
+  const cleanCommitNoop = isAlreadyCommittedCleanGitNoop(
+    toolResult.args || {},
+    toolResult,
+    state
+  );
+  const cleanStatusAfterCommit = isCleanGitStatusAfterCurrentCommit(
+    toolResult.args || {},
+    toolResult,
+    state
+  );
+  if (!successfulCommit && !cleanCommitNoop && !cleanStatusAfterCommit) {
     return null;
   }
   const failed = currentFailedProjectTest(state);
@@ -6266,7 +6305,11 @@ export function recordAlreadyCommittedRepositoryRepair(state = {}, toolResult =
     ),
     failureSignature: String(failed.test.failureSignature || ""),
     command: String(failed.test.command || ""),
-    source: "clean-commit-noop",
+    source: successfulCommit
+      ? "successful-commit"
+      : cleanCommitNoop
+        ? "clean-commit-noop"
+        : "clean-status-after-commit",
     at: new Date().toISOString(),
   };
   state.meta.repositoryStateRepair = marker;
@@ -6277,7 +6320,13 @@ export function recordAlreadyCommittedRepositoryRepair(state = {}, toolResult =
 function projectTestCommandKey(command = "") {
   const normalized = normalizeProjectCommand(command);
   const exitProbe = parseNonMutatingExitStatusWrapper(normalized);
-  return normalizeProjectCommand(exitProbe?.command || normalized);
+  const invocation = normalizeProjectCommand(exitProbe?.command || normalized)
+    // These wrappers alter bytecode/output handling, not the tests selected or
+    // executed. Treating them as distinct suites can leave an old failure
+    // unresolved after the same verifier passes without the wrapper.
+    .replace(/^PYTHONDONTWRITEBYTECODE=(?:0|1|true|false)\s+/i, "")
+    .replace(/\s+(?:2>&1|1>&2)\s*$/u, "");
+  return normalizeProjectCommand(invocation);
 }
 
 function commandIncludesGitCommit(command = "") {
@@ -11509,6 +11558,11 @@ export function nextStepRuntimeConfig(config = {}, state = {}) {
       runtimeConfig.repositoryStateRepairCommitPaths =
         taskOwnedMutationPathsSinceLatestCommit(verification);
     } else if (retainedRepositoryStateRepair) {
+      delete runtimeConfig.completionFreshMutationRequired;
+      delete runtimeConfig.completionFreshMutationRevision;
+      delete runtimeConfig.completionFreshMutationPaths;
+      delete runtimeConfig.completionFreshMutationNeedsSourceRead;
+      delete runtimeConfig.repositoryGroundingRequired;
       runtimeConfig.testFailureRepairActive = false;
       runtimeConfig.testFailureRepairMutationRequired = false;
       runtimeConfig.testFailureRepairNeedsPatchContext = false;
@@ -13560,23 +13614,26 @@ async function runShellCommand(command, config, policy = evaluateCommandPolicy(c
     const result = config.useDockerSandbox
       ? await runDockerSandboxCommand(command, config, policy, { signal: config.abortSignal })
       : await runHostShellCommand(command, config);
-    const diagnosticHint = shellDiagnosticHint(command, result);
+    const normalizedResult = normalizeNoMatchQueryResult(result, policy);
+    const diagnosticHint = shellDiagnosticHint(command, normalizedResult);
 
     return {
-      ok: result.ok !== false,
-      exitCode: Number.isInteger(result.exitCode) ? result.exitCode : 0,
-      stdout: trimCommandOutput(result.stdout, 8000),
-      stderr: trimCommandOutput(result.stderr, 4000),
+      ok: normalizedResult.ok !== false,
+      exitCode: Number.isInteger(normalizedResult.exitCode) ? normalizedResult.exitCode : 0,
+      stdout: trimCommandOutput(normalizedResult.stdout, 8000),
+      stderr: trimCommandOutput(normalizedResult.stderr, 4000),
+      ...(normalizedResult.noMatch === true ? { noMatch: true, semanticOutcome: "no-match" } : {}),
       ...(diagnosticHint ? { diagnosticHint } : {}),
     };
   } catch (error) {
     if (isAbortError(error, config)) throw error;
-    const failedResult = {
+    const rawFailedResult = {
       ok: false,
       exitCode: Number.isInteger(error?.code) ? error.code : 1,
       stdout: trimCommandOutput(error?.stdout || "", 8000),
       stderr: trimCommandOutput(error?.stderr || error?.message || "", 4000),
     };
+    const failedResult = normalizeNoMatchQueryResult(rawFailedResult, policy);
     const diagnosticHint = shellDiagnosticHint(command, failedResult);
     return diagnosticHint ? { ...failedResult, diagnosticHint } : failedResult;
   }
@@ -14656,6 +14713,7 @@ async function executeTool(browserState, toolCall, snapshot, config, store, obse
             mayMutateProject: Boolean(policy.mayMutateProject),
             substantiveTest: Boolean(policy.substantiveTest),
             gitOnly: Boolean(policy.gitOnly),
+            noMatchExitIsSuccess: Boolean(policy.noMatchExitIsSuccess),
             normalizedCommand: normalizeCommandForPolicy(String(args.command), config),
           },
           ...(generatedOutputPaths.length
@@ -15551,13 +15609,13 @@ export async function validateMutatedPythonSourceQuality(config = {}, state = {}
 
   const defects = [];
   const checkedPaths = [];
-  const latestPassingTest = [...(Array.isArray(verification.testRuns) ? verification.testRuns : [])]
+  const currentPassingTests = [...(Array.isArray(verification.testRuns) ? verification.testRuns : [])]
     .reverse()
-    .find(
+    .filter(
       (run) =>
         run?.passed === true &&
-        Number(run?.mutationRevision || 0) === Math.max(0, Number(verification.mutationRevision || 0)) &&
-        Number(run?.privateMutationRevision || 0) === verificationPrivateMutationRevision(verification)
+        !testRunRepresentsInvalidInvocation(run) &&
+        testRunMatchesVerificationRevision(run, verification)
     );
   for (const sourcePath of paths) {
     let target;
@@ -15577,14 +15635,14 @@ export async function validateMutatedPythonSourceQuality(config = {}, state = {}
         message: syntax.reason,
       });
     }
-    if (
-      pathLooksLikeTestSource(sourcePath) &&
-      (!latestPassingTest || !testCommandCoversMutatedPath(latestPassingTest.command, sourcePath))
-    ) {
+    const coveringTest = pathLooksLikeTestSource(sourcePath)
+      ? currentPassingTests.find((run) => testCommandCoversMutatedPath(run.command, sourcePath))
+      : null;
+    if (pathLooksLikeTestSource(sourcePath) && !coveringTest) {
       defects.push({
         code: "mutated-test-not-covered-by-validation",
         path: sourcePath,
-        command: String(latestPassingTest?.command || ""),
+        command: String(currentPassingTests[0]?.command || ""),
       });
     }
     for (const duplicate of pythonTopLevelDefinitionDuplicates(content)) {
@@ -15610,7 +15668,7 @@ export async function validateMutatedPythonSourceQuality(config = {}, state = {}
       item.code === "python-syntax-error"
         ? `${item.path}: ${item.message || "Python syntax validation failed"}`
         : item.code === "mutated-test-not-covered-by-validation"
-        ? `${item.path}: the latest successful test command did not include this changed test (${item.command || "no current test command"})`
+        ? `${item.path}: no current successful test command included this changed test (${item.command || "no current test command"})`
         : item.code === "python-main-guard-before-required-definition"
           ? `${item.path}: __main__ guard at line ${item.guardLine} executes before ` +
             `${(item.calledLater || []).map((candidate) => `${candidate.name} at line ${candidate.line}`).join(", ")}`

package/src/command-policy.js

@@ -20,6 +20,7 @@ const READ_ONLY_PATTERNS = [
   /^find(?:\s+[./~\w-]+)*(?:\s+-maxdepth\s+\d+)?(?:\s+-type\s+[fd])?$/,
   /^rg(?:\s+.+)?$/,
   /^grep(?:\s+.+)?$/,
+  /^pgrep(?:\s+.+)?$/,
   /^cat(?:\s+[-\w./~*]+)+$/,
   /^head(?:\s+.+)?$/,
   /^tail(?:\s+.+)?$/,
@@ -751,7 +752,14 @@ function classifyBackgroundShell(normalized = "") {
 const SAFE_WORKSPACE_WRITE_PATTERNS = [/^mkdir\s+-p\s+[-\w./]+$/];
 const SAFE_CHMOD_MODE_PATTERN = /^[-+=,rwxugoXst0-7]+$/;
 const SAFE_WORKSPACE_TARGET_LIMIT = 64;
-const SAFE_ENV_ASSIGNMENT_NAMES = new Set(["ANDROID_HOME", "ANDROID_SDK_ROOT", "JAVA_HOME", "GRADLE_USER_HOME", "PATH"]);
+const SAFE_ENV_ASSIGNMENT_NAMES = new Set([
+  "ANDROID_HOME",
+  "ANDROID_SDK_ROOT",
+  "GRADLE_USER_HOME",
+  "JAVA_HOME",
+  "PATH",
+  "PYTHONDONTWRITEBYTECODE",
+]);
 const SAFE_ENV_VALUE_PATTERN = /^[-\w./:@+,%]+$/;
 
 const NETWORK_FETCH_PATTERNS = [
@@ -1681,6 +1689,7 @@ function classifySimpleCommand(normalized) {
       needsNetwork: false,
       writesWorkspace: false,
       gitOnly: /^git\s+/.test(commandForPatternMatching),
+      noMatchExitIsSuccess: /^pgrep\b/.test(commandForPatternMatching),
     };
   }
   const packageScript = packageManagerScriptName(validationTokens);

package/src/permission-advice.js

@@ -615,6 +615,44 @@ export function goalRevisionCoversActiveTask(state = {}, evidenceRevision = 0) {
   return candidateRevision >= activeTaskStartRevision;
 }
 
+function hasDurableCommitEvidence(state = {}, { requireCurrentMutation = true } = {}) {
+  const mutationRevision = Math.max(
+    0,
+    Number(state.meta?.projectVerification?.mutationRevision || 0)
+  );
+  return (Array.isArray(state.meta?.durableGitEvidence) ? state.meta.durableGitEvidence : []).some(
+    (item) =>
+      String(item?.action || "").toLowerCase() === "commit" &&
+      goalRevisionCoversActiveTask(state, item?.goalRevision) &&
+      (
+        !requireCurrentMutation ||
+        Number(item?.mutationRevision || 0) >= mutationRevision
+      )
+  );
+}
+
+export function isCleanGitStatusAfterCurrentCommit(args = {}, result = {}, state = {}) {
+  const command = String(args.command || args.text || "").trim();
+  const cleanStatusCommand =
+    /^git(?:\s+-C\s+(?:"[^"]*"|'[^']*'|\S+))?\s+status\s+(?:--short|--porcelain(?:=[^\s]+)?)(?:\s+--untracked-files=(?:all|normal))?$/i.test(
+      command
+    );
+  if (
+    !cleanStatusCommand ||
+    result.ok === false ||
+    Number(result.exitCode ?? 0) !== 0 ||
+    String(result.stdout || "").trim() ||
+    String(result.stderr || "").trim()
+  ) {
+    return false;
+  }
+  // An exact clean status proves that the current files match HEAD. Permit a
+  // same-task commit from an earlier mutation revision so interrupted work
+  // that was externally restored to HEAD can return to its verifier. The
+  // verifier, not this marker, still decides task completion.
+  return hasDurableCommitEvidence(state, { requireCurrentMutation: false });
+}
+
 export function isAlreadyCommittedCleanGitNoop(args = {}, result = {}, state = {}) {
   const command = String(args.command || args.text || "");
   const output = `${result.stdout || ""}\n${result.stderr || ""}`;
@@ -625,16 +663,7 @@ export function isAlreadyCommittedCleanGitNoop(args = {}, result = {}, state = {
   ) {
     return false;
   }
-  const mutationRevision = Math.max(
-    0,
-    Number(state.meta?.projectVerification?.mutationRevision || 0)
-  );
-  return (Array.isArray(state.meta?.durableGitEvidence) ? state.meta.durableGitEvidence : []).some(
-    (item) =>
-      String(item?.action || "").toLowerCase() === "commit" &&
-      goalRevisionCoversActiveTask(state, item?.goalRevision) &&
-      Number(item?.mutationRevision || 0) >= mutationRevision
-  );
+  return hasDurableCommitEvidence(state);
 }
 
 export function buildFailedCommandAdvice({ args = {}, commandPolicy = {}, commandResult = {}, config = {}, state = {} } = {}) {

package/src/scs-evidence.js

@@ -649,6 +649,7 @@ function inferExactInputPaths(goal = "") {
     }
     quotedPathPattern.lastIndex = 0;
     for (const match of line.matchAll(quotedPathPattern)) {
+      if (looksLikeShellCommandLiteral(match[1])) continue;
       pushPath(match[1]);
     }
     const unquotedLine = line.replace(quotedPathPattern, (match) => " ".repeat(match.length));
@@ -1379,12 +1380,36 @@ function prefixRequestsInlineCommandExecution(prefix = "") {
   while (preamble.test(clause)) clause = clause.replace(preamble, "").trim();
   clause = clause.replace(/(?:[:：]|--?)\s*$/, "").trim();
   return (
-    /^(?:followed\s+by|run|rerun|re-run|execute|invoke|launch|verify|validate|check|confirm)(?:\s+(?:(?:the|this|that)\s+)?(?:following\s+)?command(?:\s+named)?)?\s*$/i.test(
+    /^(?:followed\s+by|run|rerun|re-run|execute|invoke|launch|verify|validate|check|confirm)(?:\s+(?:exactly|again|once))?(?:\s+(?:(?:the|this|that)\s+)?(?:exact|required|following\s+)?command(?:\s+named)?)?\s*$/i.test(
       clause
     ) || /^(?:随后运行|隨後運行|接着运行|接著運行|运行|運行|执行|執行|调用|調用|验证|驗證|检查|檢查|确认|確認)\s*$/.test(clause)
   );
 }
 
+function sentenceContinuesRequestedCommandList(source = "", sentenceStart = -1, commandIndex = -1) {
+  const prefix = String(source || "").slice(sentenceStart + 1, commandIndex).trim();
+  if (!/^(?:these|those|the\s+following)\s+(?:commands?\s+)?(?:include|are)\b/i.test(prefix)) {
+    return false;
+  }
+
+  const preceding = String(source || "").slice(0, Math.max(0, sentenceStart)).trimEnd();
+  const previousStart = Math.max(
+    preceding.lastIndexOf("\n"),
+    preceding.lastIndexOf("."),
+    preceding.lastIndexOf("!"),
+    preceding.lastIndexOf("?"),
+    preceding.lastIndexOf("。"),
+    preceding.lastIndexOf("！"),
+    preceding.lastIndexOf("？")
+  );
+  const previousSentence = preceding.slice(previousStart + 1).trim();
+  return (
+    /\b(?:run|rerun|re-run|execute|invoke|launch|verify|validate|check|confirm|follow)\b/i.test(previousSentence) &&
+    /\b(?:exact|required|following|verification|validation|test|check)\b/i.test(previousSentence) &&
+    /\bcommands?\b/i.test(previousSentence)
+  );
+}
+
 function canonicalBareVerifierCommand(rawPath = "") {
   const candidate = String(rawPath || "").trim();
   if (
@@ -1439,7 +1464,12 @@ function inferExplicitRequestedCommands(goal = "") {
       source.lastIndexOf("？", index - 1)
     );
     const prefix = source.slice(sentenceStart + 1, index).trimEnd();
-    if (!prefixRequestsInlineCommandExecution(prefix)) continue;
+    if (
+      !prefixRequestsInlineCommandExecution(prefix) &&
+      !sentenceContinuesRequestedCommandList(source, sentenceStart, index)
+    ) {
+      continue;
+    }
 
     const command = normalizeProjectCommand(match[1]);
     if (
@@ -1487,7 +1517,7 @@ export function deriveScsTaskContract({ goal = "", taskProfile = "", acceptanceC
   }));
   const excludedOutputPaths = inferExplicitlyExcludedOutputPaths(evidenceGoal);
   const inferredOutputPaths = filterExplicitlyExcludedOutputPaths(
-    inferExactOutputPaths(evidenceGoal),
+    inferExactOutputPaths(positiveEvidenceGoal),
     excludedOutputPaths
   );
   const exactOutputPaths = filterExplicitlyExcludedOutputPaths(
@@ -1515,7 +1545,7 @@ export function deriveScsTaskContract({ goal = "", taskProfile = "", acceptanceC
     requiresPerSourceChecks: requiresPerSourceChecks(evidenceGoal),
     requiredToolCalls,
     requiredGitActions,
-    requiredProjectCommands: inferExplicitRequestedCommands(evidenceGoal),
+    requiredProjectCommands: inferExplicitRequestedCommands(positiveEvidenceGoal),
     requiresWorkspaceMutation: goalRequestsWorkspaceMutation(evidenceGoal, taskProfile),
     requiresFileMutation: goalRequestsFileMutation(evidenceGoal, taskProfile),
     requiresSourceGrounding: requiresSourceGrounding(evidenceGoal),