@lazyingart/agintiflow 0.20.264 → 0.20.266

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.264",
+  "version": "0.20.266",
   "type": "module",
   "description": "AgInTiFlow is a project-aware agent workspace for hybrid wet-dry R&D, hardware-aware intelligence, software automation, and industrial workflows.",
   "license": "Apache-2.0",

package/scripts/smoke-capabilities.js

@@ -159,6 +159,12 @@ try {
   assert(defaultMaxStepsForProfile("pipeline") >= 44, "pipeline profile step budget is too low for repair/verify/resume loops");
   assert(!/misleading failing test/i.test(qaProfile.prompt), "QA profile still encourages misleading test fixtures");
   assert(/do not stage fake bugs/i.test(qaProfile.prompt), "QA profile does not discourage fake staged failures");
+  const slidesProfile = listTaskProfiles().find((profile) => profile.id === "slides");
+  assert(slidesProfile, "slides profile is missing");
+  assert(/source-grounded editable slide source/i.test(slidesProfile.prompt), "slides profile does not require grounded editable source");
+  assert(/render every slide/i.test(slidesProfile.prompt), "slides profile does not require full rendered inspection");
+  assert(/wrapped-title decoration overlap/i.test(slidesProfile.prompt), "slides profile does not guard wrapped-title collisions");
+  assert(/fresh git status --short/i.test(slidesProfile.prompt), "slides profile does not require fresh repository evidence");
   assert(
     capabilities.trustedDockerPolicy.some((check) => check.command.startsWith("apt-get install") && check.allowed),
     "trusted Docker policy did not allow apt-get install"

package/scripts/smoke-coding-tools.js

@@ -8,6 +8,7 @@ import {
   genericArtifactFilenameBlock,
   modelTimeoutExhaustionRoute,
   modelTimeoutRetryRoute,
+  normalizeNoMatchQueryResult,
   applyModelTimeoutRetryRoute,
   recoverFocusedTextRewriteWithWritingSpecialist,
   repairModelMessageHistory,
@@ -956,6 +957,33 @@ try {
   );
   assert(readonlyVersionPipelinePolicy.allowed, "read-only version probe pipelines should not require package-install-policy=allow");
   assert(readonlyVersionPipelinePolicy.category === "read-only", "read-only version probe pipelines should be classified as read-only");
+  const pgrepNoMatchPolicy = evaluateCommandPolicy(
+    "pgrep -af gateway_service",
+    dockerWorkspaceNoInstallsPolicy
+  );
+  assert(
+    pgrepNoMatchPolicy.allowed &&
+      pgrepNoMatchPolicy.category === "read-only" &&
+      pgrepNoMatchPolicy.noMatchExitIsSuccess === true,
+    "pgrep should be a read-only query whose no-match exit is meaningful evidence"
+  );
+  const pgrepNoMatchResult = normalizeNoMatchQueryResult(
+    { ok: false, exitCode: 1, stdout: "", stderr: "" },
+    pgrepNoMatchPolicy
+  );
+  assert(
+    pgrepNoMatchResult.ok === true &&
+      pgrepNoMatchResult.noMatch === true &&
+      pgrepNoMatchResult.semanticOutcome === "no-match",
+    "pgrep exit 1 with no diagnostics should normalize to successful no-match evidence"
+  );
+  assert(
+    normalizeNoMatchQueryResult(
+      { ok: false, exitCode: 2, stdout: "", stderr: "invalid option" },
+      pgrepNoMatchPolicy
+    ).ok === false,
+    "an actual pgrep error was incorrectly normalized as no-match evidence"
+  );
   const readonlyDiffSlicePolicy = evaluateCommandPolicy(
     "git diff -- src/agent-runner.js | sed -n '1,240p'",
     dockerWorkspaceNoInstallsPolicy
@@ -1000,6 +1028,16 @@ try {
   );
   assert(pythonUnittestPolicy.allowed, "stdlib python unittest should be allowed without package installs");
   assert(pythonUnittestPolicy.category === "test", "stdlib python unittest should be classified as test");
+  const pythonNoBytecodeAcceptancePolicy = evaluateCommandPolicy(
+    "PYTHONDONTWRITEBYTECODE=1 python3 /tmp/devops_sensor_gateway_contract.py",
+    dockerWorkspaceNoInstallsPolicy
+  );
+  assert(
+    pythonNoBytecodeAcceptancePolicy.allowed &&
+      pythonNoBytecodeAcceptancePolicy.category === "test" &&
+      pythonNoBytecodeAcceptancePolicy.substantiveTest === true,
+    "a no-bytecode Python acceptance command should retain substantive test classification"
+  );
   const pythonDemoPolicy = evaluateCommandPolicy("python3 demo.py 2>&1", dockerWorkspaceNoInstallsPolicy);
   assert(pythonDemoPolicy.allowed, "workspace-local python demo script should be allowed without package installs");
   assert(pythonDemoPolicy.category === "toolchain", "workspace-local python demo script should be classified as toolchain");

package/scripts/smoke-dynamic-step-budget.js

@@ -60,6 +60,7 @@ import {
   completionExternalBlockerCanClose,
   pythonTopLevelDefinitionDuplicates,
   recordCanonicalGeneratedOutputProgress,
+  recordAlreadyCommittedRepositoryRepair,
   recordProjectVerificationOutcome,
   recordExactOutputProgress,
   recordStaticDiscoveryProgress,
@@ -2095,6 +2096,36 @@ try {
     }
   );
   assert(coveredTestQuality.ok === true, coveredTestQuality.reason);
+  const coveredBeforeAcceptanceQuality = await validateMutatedPythonSourceQuality(
+    { commandCwd: pythonQualityWorkspace },
+    {
+      meta: {
+        projectVerification: {
+          mutationRevision: 3,
+          privateMutationRevision: 0,
+          mutationHistory: [{ revision: 3, paths: ["tests/test_service_launch.py"] }],
+          testRuns: [
+            {
+              command: "PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s tests -v",
+              mutationRevision: 3,
+              privateMutationRevision: 0,
+              passed: true,
+            },
+            {
+              command: "python3 /tmp/project_acceptance.py",
+              mutationRevision: 3,
+              privateMutationRevision: 0,
+              passed: true,
+            },
+          ],
+        },
+      },
+    }
+  );
+  assert(
+    coveredBeforeAcceptanceQuality.ok === true,
+    "a later passing acceptance verifier erased current unit-suite coverage for a changed test"
+  );
   assert(normalizeDynamicStepsMode("off") === "off", "dynamic mode off did not normalize");
   for (const command of [
     "npm run build",
@@ -6136,6 +6167,124 @@ try {
     ) === null,
     "a clean-worktree verification gate could not rerun after a Git-state repair"
   );
+  const successfulRepositoryRepairState = structuredClone(repositoryCleanGateFailure);
+  successfulRepositoryRepairState.goal = "Repair and verify the service lifecycle.";
+  successfulRepositoryRepairState.meta.goalContract = { revision: 4 };
+  successfulRepositoryRepairState.meta.activeExecutionContract = {
+    revision: 4,
+    materialMutationRevision: 6,
+  };
+  const successfulRepositoryCommit = {
+    toolName: "run_command",
+    ok: true,
+    exitCode: 0,
+    args: {
+      command:
+        "git add -- 'gateway_service.py' && git commit -m 'Repair service lifecycle'",
+    },
+    stdout:
+      "[main abcdef1] Repair service lifecycle\n 1 file changed, 1 insertion(+), 1 deletion(-)\n",
+    stderr: "",
+  };
+  recordProjectVerificationOutcome(
+    successfulRepositoryRepairState,
+    successfulRepositoryCommit,
+    { commandCwd: workspace, taskProfile: "devops" }
+  );
+  const successfulRepositoryRepairMarker = recordAlreadyCommittedRepositoryRepair(
+    successfulRepositoryRepairState,
+    successfulRepositoryCommit
+  );
+  const postCommitRepositoryRuntime = nextStepRuntimeConfig(
+    { provider: "deepseek", taskProfile: "devops", commandCwd: workspace },
+    successfulRepositoryRepairState
+  );
+  assert(
+    successfulRepositoryRepairMarker?.source === "successful-commit" &&
+      postCommitRepositoryRuntime.testFailureRepositoryStateRepair !== true &&
+      postCommitRepositoryRuntime.testVerificationPending === true &&
+      postCommitRepositoryRuntime.testVerificationCommand === failedValidationCommand,
+    "a successful bounded repair commit did not advance directly to the exact failed verifier"
+  );
+  const cleanStatusRepositoryRepairState = structuredClone(repositoryCleanGateFailure);
+  cleanStatusRepositoryRepairState.goal = "Resume the committed service repair.";
+  cleanStatusRepositoryRepairState.meta.goalContract = { revision: 5 };
+  cleanStatusRepositoryRepairState.meta.activeExecutionContract = {
+    revision: 5,
+    startedMutationRevision: 6,
+    materialMutationRevision: 6,
+    requiresFileMutation: true,
+    requiresSourceGrounding: true,
+  };
+  cleanStatusRepositoryRepairState.meta.durableGitEvidence = [{
+    action: "commit",
+    goalRevision: 5,
+    mutationRevision: 5,
+  }];
+  const cleanStatusAfterCommit = {
+    toolName: "run_command",
+    ok: true,
+    exitCode: 0,
+    args: { command: "git status --short" },
+    stdout: "",
+    stderr: "",
+  };
+  recordProjectVerificationOutcome(
+    cleanStatusRepositoryRepairState,
+    cleanStatusAfterCommit,
+    { commandCwd: workspace, taskProfile: "devops" }
+  );
+  const cleanStatusRepositoryRepairMarker = recordAlreadyCommittedRepositoryRepair(
+    cleanStatusRepositoryRepairState,
+    cleanStatusAfterCommit
+  );
+  const cleanStatusRepositoryRuntime = nextStepRuntimeConfig(
+    { provider: "deepseek", taskProfile: "devops", commandCwd: workspace },
+    cleanStatusRepositoryRepairState
+  );
+  assert(
+    cleanStatusRepositoryRepairMarker?.source === "clean-status-after-commit" &&
+      cleanStatusRepositoryRuntime.completionFreshMutationRequired !== true &&
+      cleanStatusRepositoryRuntime.testVerificationPending === true &&
+      cleanStatusRepositoryRuntime.testVerificationCommand === failedValidationCommand &&
+      buildKnownConstrainedPhasePlan(
+        { provider: "deepseek", taskProfile: "devops", commandCwd: workspace },
+        cleanStatusRepositoryRepairState,
+        cleanStatusRepositoryRuntime
+      )?.mode === "exact-verification",
+    "current commit plus an exact clean Git status did not recover an interrupted repository repair"
+  );
+  const repeatedDirtyRepositoryResult = {
+    toolName: "run_command",
+    ok: false,
+    exitCode: 1,
+    args: { command: failedValidationCommand },
+    stdout: "",
+    stderr:
+      "AssertionError: repository worktree is not clean after a new unrelated mutation",
+  };
+  recordProjectVerificationOutcome(
+    successfulRepositoryRepairState,
+    repeatedDirtyRepositoryResult,
+    {
+      provider: "deepseek",
+      taskProfile: "devops",
+      commandCwd: workspace,
+      testVerificationPending: true,
+      testVerificationCommand: failedValidationCommand,
+    }
+  );
+  const repeatedDirtyRepositoryRuntime = nextStepRuntimeConfig(
+    { provider: "deepseek", taskProfile: "devops", commandCwd: workspace },
+    successfulRepositoryRepairState
+  );
+  assert(
+    repeatedDirtyRepositoryResult.repositoryStateRepairConsumed === true &&
+      !successfulRepositoryRepairState.meta.repositoryStateRepair &&
+      repeatedDirtyRepositoryRuntime.testFailureRepositoryStateRepair === true &&
+      repeatedDirtyRepositoryRuntime.testVerificationPending !== true,
+    "a consumed repository-repair marker caused an unchanged clean-worktree verifier loop"
+  );
   const oversizedRepositoryState = {
     ...repositoryCleanGateFailure,
     goal: "Complete the current repository task and preserve its established acceptance contract.",
@@ -6599,6 +6748,32 @@ try {
     projectTestVerificationFinishBlock(repairedValidationState) === null,
     "a passing rerun at the current real mutation revision did not reopen completion"
   );
+  const presentationWrappedValidationState = {
+    meta: {
+      projectVerification: {
+        mutationRevision: 7,
+        privateMutationRevision: 0,
+        testRuns: [
+          {
+            command: "python3 -m unittest discover -s tests -v 2>&1",
+            mutationRevision: 2,
+            privateMutationRevision: 0,
+            passed: false,
+          },
+          {
+            command: "PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s tests -v",
+            mutationRevision: 7,
+            privateMutationRevision: 0,
+            passed: true,
+          },
+        ],
+      },
+    },
+  };
+  assert(
+    projectTestVerificationFinishBlock(presentationWrappedValidationState) === null,
+    "presentation-only test wrappers left a superseded failure unresolved"
+  );
   const tracebackEvidence = compactFailedTestEvidence(
     {
       stderr: [

package/scripts/smoke-scs-evidence-visibility.js

@@ -68,6 +68,14 @@ const recoveryInstructionContract = deriveScsTaskContract({
   taskProfile: "devops",
 });
 
+const readOnlyVerificationContinuationContract = deriveScsTaskContract({
+  goal: [
+    "Continue the exact active DevOps task from its clean committed state. Do not mutate source, tests, or documentation and do not create another commit.",
+    "Run exactly `git status --short` once, then follow the runtime's exact required verification commands serially. These include `PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s tests -v` and `PYTHONDONTWRITEBYTECODE=1 python3 /tmp/devops_sensor_gateway_contract.py`.",
+  ].join("\n"),
+  taskProfile: "devops",
+});
+
 const readOnlyReviewContract = deriveScsTaskContract({
   goal: [
     "Review focus: changed files only.",
@@ -171,6 +179,25 @@ assert.deepEqual(
   ],
   "a verification command introduced by 'followed by' was not retained"
 );
+assert.deepEqual(
+  readOnlyVerificationContinuationContract.exactOutputPaths,
+  [],
+  "a verifier command following a negated create clause became an exact output path"
+);
+assert.deepEqual(
+  readOnlyVerificationContinuationContract.exactInputPaths,
+  [],
+  "a quoted verifier command became an exact input path"
+);
+assert.deepEqual(
+  readOnlyVerificationContinuationContract.requiredProjectCommands,
+  [
+    "git status --short",
+    "PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s tests -v",
+    "PYTHONDONTWRITEBYTECODE=1 python3 /tmp/devops_sensor_gateway_contract.py",
+  ],
+  "an exact read-only continuation lost one or more required verification commands"
+);
 assert.equal(
   readOnlyReviewContract.requiresWorkspaceMutation,
   false,

package/scripts/smoke-skills.js

@@ -115,6 +115,11 @@ assert(selectedIds("write SQL migrations for sqlite schema").includes("database"
 assert(selectedIds("debug Docker deployment logs and port config").includes("devops-deployment"), "devops prompt did not select devops-deployment");
 assert(selectedIds("review auth security and secrets handling").includes("security-review"), "security prompt did not select security-review");
 assert(selectedIds("make a PowerPoint pitch deck").includes("presentation-slides"), "slides prompt did not select presentation-slides");
+const presentationSkill = skills.find((skill) => skill.id === "presentation-slides");
+assert(presentationSkill?.body.includes("Render every slide"), "presentation skill does not require every slide to be rendered");
+assert(presentationSkill?.body.includes("wrapped titles"), "presentation skill does not require wrapped-title inspection");
+assert(presentationSkill?.body.includes("git status --short"), "presentation skill does not require final repository evidence");
+assert(presentationSkill?.body.includes("Do not call the deck complete"), "presentation skill still permits build-only completion");
 assert(selectedIds("edit a markdown screenplay final draft").includes("writing-editing"), "writing prompt did not select writing-editing");
 assert(selectedIds("create a lesson with exercises and quiz").includes("education-tutorial"), "education prompt did not select education-tutorial");
 assert(selectedIds("review this PR architecture without editing").includes("code-review"), "review prompt did not select code-review");

package/skills/presentation-slides/SKILL.md

@@ -20,7 +20,17 @@ tools:
 ---
 # Slides And Presentations
 
-Clarify audience, goal, length, and tone from context. Build a durable outline before slide text. Keep slides visually sparse: one message, one figure/table/story per slide when possible.
+Infer audience, goal, length, and tone from the request and available project context. Ask only when a missing fact materially changes the deck. Build a durable outline before slide text. Keep slides visually sparse: one message and usually one figure, table, or story per slide.
 
-Use markdown, HTML, LaTeX beamer, PPTX tooling, or available local converters depending on the workspace. Save source plus exported artifacts when possible.
+Use the workspace's established presentation tooling when it exists. Otherwise choose editable PPTX, HTML, Markdown, or LaTeX Beamer tooling that can be rebuilt locally. Keep essential titles, claims, labels, citations, and body text editable. Image generation may supply bounded visual assets, but never use one generated bitmap as a complete slide or slide background.
 
+Ground claims and calculations in the supplied sources. Preserve a reproducible source or build script and speaker notes when they improve delivery. Produce only the requested artifacts, with descriptive stable filenames. If the user supplied an exact validator or acceptance command, run that exact command after the final rebuild.
+
+Before completion:
+
+1. Rebuild the final deck and every requested export from the current source.
+2. Render every slide to a PNG or equivalent preview and inspect the actual images. Check especially wrapped titles, accent rules, clipping, collisions, overflow, unreadably small text, charts, tables, and consistent framing.
+3. Verify that the PPTX or source remains editable, exported files open, slide and PDF page counts agree, calculations match the source data, and no unsupported claims were introduced.
+4. In a Git repository, if the task requests a commit, stage intentional source and deliverables, narrowly ignore only transient build or perception evidence, commit the result, then run a fresh `git status --short`.
+
+Do not call the deck complete from a successful build alone. Artifact paths, model-generated visual descriptions, or an earlier clean status are not substitutes for current rendered inspection and final external verification.

package/src/agent-runner.js

@@ -84,6 +84,7 @@ import {
   buildPermissionAdvice,
   goalRevisionCoversActiveTask,
   isAlreadyCommittedCleanGitNoop,
+  isCleanGitStatusAfterCurrentCommit,
 } from "./permission-advice.js";
 import { formatBehaviorContractForPrompt } from "./behavior-contract.js";
 import { browserStateReconciliationGuidance } from "./browser-automation-guidance.js";
@@ -4295,6 +4296,23 @@ export function shellDiagnosticHint(command = "", result = {}) {
   return "";
 }
 
+export function normalizeNoMatchQueryResult(result = {}, policy = {}) {
+  if (
+    policy?.noMatchExitIsSuccess !== true ||
+    Number(result?.exitCode) !== 1 ||
+    String(result?.stdout || "").trim() ||
+    String(result?.stderr || "").trim()
+  ) {
+    return result;
+  }
+  return {
+    ...result,
+    ok: true,
+    noMatch: true,
+    semanticOutcome: "no-match",
+  };
+}
+
 function hashForLog(value) {
   return crypto.createHash("sha256").update(String(value ?? "")).digest("hex");
 }
@@ -6142,6 +6160,21 @@ export function recordProjectVerificationOutcome(state = {}, toolResult = {}, co
         requiredCommandFailure: failedRequiredCommand,
         ...failedEvidence,
       };
+      const repositoryStateRepairMarker = state.meta?.repositoryStateRepair;
+      if (
+        repositoryStateRepairMarker &&
+        Number(repositoryStateRepairMarker.version || 0) === 1 &&
+        Number(repositoryStateRepairMarker.mutationRevision || 0) ===
+          verification.mutationRevision &&
+        projectTestCommandKey(repositoryStateRepairMarker.command || "") ===
+          projectTestCommandKey(command)
+      ) {
+        // A repository repair authorizes one exact verifier rerun. Consume the
+        // marker so a still-dirty worktree returns to repair instead of
+        // replaying the same verifier indefinitely.
+        delete state.meta.repositoryStateRepair;
+        toolResult.repositoryStateRepairConsumed = true;
+      }
       verification.testRuns = [...verification.testRuns, testRun].slice(-24);
       toolResult.projectTest = testRun;
       if (
@@ -6243,13 +6276,19 @@ export function failedTestRequiresCleanRepositoryState(testRun = {}) {
 }
 
 export function recordAlreadyCommittedRepositoryRepair(state = {}, toolResult = {}) {
-  if (
-    !isAlreadyCommittedCleanGitNoop(
-      toolResult.args || {},
-      toolResult,
-      state
-    )
-  ) {
+  const successfulCommit = inferSuccessfulGitActionsFromCommandResult(toolResult)
+    .includes("commit");
+  const cleanCommitNoop = isAlreadyCommittedCleanGitNoop(
+    toolResult.args || {},
+    toolResult,
+    state
+  );
+  const cleanStatusAfterCommit = isCleanGitStatusAfterCurrentCommit(
+    toolResult.args || {},
+    toolResult,
+    state
+  );
+  if (!successfulCommit && !cleanCommitNoop && !cleanStatusAfterCommit) {
     return null;
   }
   const failed = currentFailedProjectTest(state);
@@ -6266,7 +6305,11 @@ export function recordAlreadyCommittedRepositoryRepair(state = {}, toolResult =
     ),
     failureSignature: String(failed.test.failureSignature || ""),
     command: String(failed.test.command || ""),
-    source: "clean-commit-noop",
+    source: successfulCommit
+      ? "successful-commit"
+      : cleanCommitNoop
+        ? "clean-commit-noop"
+        : "clean-status-after-commit",
     at: new Date().toISOString(),
   };
   state.meta.repositoryStateRepair = marker;
@@ -6277,7 +6320,13 @@ export function recordAlreadyCommittedRepositoryRepair(state = {}, toolResult =
 function projectTestCommandKey(command = "") {
   const normalized = normalizeProjectCommand(command);
   const exitProbe = parseNonMutatingExitStatusWrapper(normalized);
-  return normalizeProjectCommand(exitProbe?.command || normalized);
+  const invocation = normalizeProjectCommand(exitProbe?.command || normalized)
+    // These wrappers alter bytecode/output handling, not the tests selected or
+    // executed. Treating them as distinct suites can leave an old failure
+    // unresolved after the same verifier passes without the wrapper.
+    .replace(/^PYTHONDONTWRITEBYTECODE=(?:0|1|true|false)\s+/i, "")
+    .replace(/\s+(?:2>&1|1>&2)\s*$/u, "");
+  return normalizeProjectCommand(invocation);
 }
 
 function commandIncludesGitCommit(command = "") {
@@ -11509,6 +11558,11 @@ export function nextStepRuntimeConfig(config = {}, state = {}) {
       runtimeConfig.repositoryStateRepairCommitPaths =
         taskOwnedMutationPathsSinceLatestCommit(verification);
     } else if (retainedRepositoryStateRepair) {
+      delete runtimeConfig.completionFreshMutationRequired;
+      delete runtimeConfig.completionFreshMutationRevision;
+      delete runtimeConfig.completionFreshMutationPaths;
+      delete runtimeConfig.completionFreshMutationNeedsSourceRead;
+      delete runtimeConfig.repositoryGroundingRequired;
       runtimeConfig.testFailureRepairActive = false;
       runtimeConfig.testFailureRepairMutationRequired = false;
       runtimeConfig.testFailureRepairNeedsPatchContext = false;
@@ -13560,23 +13614,26 @@ async function runShellCommand(command, config, policy = evaluateCommandPolicy(c
     const result = config.useDockerSandbox
       ? await runDockerSandboxCommand(command, config, policy, { signal: config.abortSignal })
       : await runHostShellCommand(command, config);
-    const diagnosticHint = shellDiagnosticHint(command, result);
+    const normalizedResult = normalizeNoMatchQueryResult(result, policy);
+    const diagnosticHint = shellDiagnosticHint(command, normalizedResult);
 
     return {
-      ok: result.ok !== false,
-      exitCode: Number.isInteger(result.exitCode) ? result.exitCode : 0,
-      stdout: trimCommandOutput(result.stdout, 8000),
-      stderr: trimCommandOutput(result.stderr, 4000),
+      ok: normalizedResult.ok !== false,
+      exitCode: Number.isInteger(normalizedResult.exitCode) ? normalizedResult.exitCode : 0,
+      stdout: trimCommandOutput(normalizedResult.stdout, 8000),
+      stderr: trimCommandOutput(normalizedResult.stderr, 4000),
+      ...(normalizedResult.noMatch === true ? { noMatch: true, semanticOutcome: "no-match" } : {}),
       ...(diagnosticHint ? { diagnosticHint } : {}),
     };
   } catch (error) {
     if (isAbortError(error, config)) throw error;
-    const failedResult = {
+    const rawFailedResult = {
       ok: false,
       exitCode: Number.isInteger(error?.code) ? error.code : 1,
       stdout: trimCommandOutput(error?.stdout || "", 8000),
       stderr: trimCommandOutput(error?.stderr || error?.message || "", 4000),
     };
+    const failedResult = normalizeNoMatchQueryResult(rawFailedResult, policy);
     const diagnosticHint = shellDiagnosticHint(command, failedResult);
     return diagnosticHint ? { ...failedResult, diagnosticHint } : failedResult;
   }
@@ -14656,6 +14713,7 @@ async function executeTool(browserState, toolCall, snapshot, config, store, obse
             mayMutateProject: Boolean(policy.mayMutateProject),
             substantiveTest: Boolean(policy.substantiveTest),
             gitOnly: Boolean(policy.gitOnly),
+            noMatchExitIsSuccess: Boolean(policy.noMatchExitIsSuccess),
             normalizedCommand: normalizeCommandForPolicy(String(args.command), config),
           },
           ...(generatedOutputPaths.length
@@ -15551,13 +15609,13 @@ export async function validateMutatedPythonSourceQuality(config = {}, state = {}
 
   const defects = [];
   const checkedPaths = [];
-  const latestPassingTest = [...(Array.isArray(verification.testRuns) ? verification.testRuns : [])]
+  const currentPassingTests = [...(Array.isArray(verification.testRuns) ? verification.testRuns : [])]
     .reverse()
-    .find(
+    .filter(
       (run) =>
         run?.passed === true &&
-        Number(run?.mutationRevision || 0) === Math.max(0, Number(verification.mutationRevision || 0)) &&
-        Number(run?.privateMutationRevision || 0) === verificationPrivateMutationRevision(verification)
+        !testRunRepresentsInvalidInvocation(run) &&
+        testRunMatchesVerificationRevision(run, verification)
     );
   for (const sourcePath of paths) {
     let target;
@@ -15577,14 +15635,14 @@ export async function validateMutatedPythonSourceQuality(config = {}, state = {}
         message: syntax.reason,
       });
     }
-    if (
-      pathLooksLikeTestSource(sourcePath) &&
-      (!latestPassingTest || !testCommandCoversMutatedPath(latestPassingTest.command, sourcePath))
-    ) {
+    const coveringTest = pathLooksLikeTestSource(sourcePath)
+      ? currentPassingTests.find((run) => testCommandCoversMutatedPath(run.command, sourcePath))
+      : null;
+    if (pathLooksLikeTestSource(sourcePath) && !coveringTest) {
       defects.push({
         code: "mutated-test-not-covered-by-validation",
         path: sourcePath,
-        command: String(latestPassingTest?.command || ""),
+        command: String(currentPassingTests[0]?.command || ""),
       });
     }
     for (const duplicate of pythonTopLevelDefinitionDuplicates(content)) {
@@ -15610,7 +15668,7 @@ export async function validateMutatedPythonSourceQuality(config = {}, state = {}
       item.code === "python-syntax-error"
         ? `${item.path}: ${item.message || "Python syntax validation failed"}`
         : item.code === "mutated-test-not-covered-by-validation"
-        ? `${item.path}: the latest successful test command did not include this changed test (${item.command || "no current test command"})`
+        ? `${item.path}: no current successful test command included this changed test (${item.command || "no current test command"})`
         : item.code === "python-main-guard-before-required-definition"
           ? `${item.path}: __main__ guard at line ${item.guardLine} executes before ` +
             `${(item.calledLater || []).map((candidate) => `${candidate.name} at line ${candidate.line}`).join(", ")}`

package/src/command-policy.js

@@ -20,6 +20,7 @@ const READ_ONLY_PATTERNS = [
   /^find(?:\s+[./~\w-]+)*(?:\s+-maxdepth\s+\d+)?(?:\s+-type\s+[fd])?$/,
   /^rg(?:\s+.+)?$/,
   /^grep(?:\s+.+)?$/,
+  /^pgrep(?:\s+.+)?$/,
   /^cat(?:\s+[-\w./~*]+)+$/,
   /^head(?:\s+.+)?$/,
   /^tail(?:\s+.+)?$/,
@@ -751,7 +752,14 @@ function classifyBackgroundShell(normalized = "") {
 const SAFE_WORKSPACE_WRITE_PATTERNS = [/^mkdir\s+-p\s+[-\w./]+$/];
 const SAFE_CHMOD_MODE_PATTERN = /^[-+=,rwxugoXst0-7]+$/;
 const SAFE_WORKSPACE_TARGET_LIMIT = 64;
-const SAFE_ENV_ASSIGNMENT_NAMES = new Set(["ANDROID_HOME", "ANDROID_SDK_ROOT", "JAVA_HOME", "GRADLE_USER_HOME", "PATH"]);
+const SAFE_ENV_ASSIGNMENT_NAMES = new Set([
+  "ANDROID_HOME",
+  "ANDROID_SDK_ROOT",
+  "GRADLE_USER_HOME",
+  "JAVA_HOME",
+  "PATH",
+  "PYTHONDONTWRITEBYTECODE",
+]);
 const SAFE_ENV_VALUE_PATTERN = /^[-\w./:@+,%]+$/;
 
 const NETWORK_FETCH_PATTERNS = [
@@ -1681,6 +1689,7 @@ function classifySimpleCommand(normalized) {
       needsNetwork: false,
       writesWorkspace: false,
       gitOnly: /^git\s+/.test(commandForPatternMatching),
+      noMatchExitIsSuccess: /^pgrep\b/.test(commandForPatternMatching),
     };
   }
   const packageScript = packageManagerScriptName(validationTokens);

package/src/permission-advice.js

@@ -615,6 +615,44 @@ export function goalRevisionCoversActiveTask(state = {}, evidenceRevision = 0) {
   return candidateRevision >= activeTaskStartRevision;
 }
 
+function hasDurableCommitEvidence(state = {}, { requireCurrentMutation = true } = {}) {
+  const mutationRevision = Math.max(
+    0,
+    Number(state.meta?.projectVerification?.mutationRevision || 0)
+  );
+  return (Array.isArray(state.meta?.durableGitEvidence) ? state.meta.durableGitEvidence : []).some(
+    (item) =>
+      String(item?.action || "").toLowerCase() === "commit" &&
+      goalRevisionCoversActiveTask(state, item?.goalRevision) &&
+      (
+        !requireCurrentMutation ||
+        Number(item?.mutationRevision || 0) >= mutationRevision
+      )
+  );
+}
+
+export function isCleanGitStatusAfterCurrentCommit(args = {}, result = {}, state = {}) {
+  const command = String(args.command || args.text || "").trim();
+  const cleanStatusCommand =
+    /^git(?:\s+-C\s+(?:"[^"]*"|'[^']*'|\S+))?\s+status\s+(?:--short|--porcelain(?:=[^\s]+)?)(?:\s+--untracked-files=(?:all|normal))?$/i.test(
+      command
+    );
+  if (
+    !cleanStatusCommand ||
+    result.ok === false ||
+    Number(result.exitCode ?? 0) !== 0 ||
+    String(result.stdout || "").trim() ||
+    String(result.stderr || "").trim()
+  ) {
+    return false;
+  }
+  // An exact clean status proves that the current files match HEAD. Permit a
+  // same-task commit from an earlier mutation revision so interrupted work
+  // that was externally restored to HEAD can return to its verifier. The
+  // verifier, not this marker, still decides task completion.
+  return hasDurableCommitEvidence(state, { requireCurrentMutation: false });
+}
+
 export function isAlreadyCommittedCleanGitNoop(args = {}, result = {}, state = {}) {
   const command = String(args.command || args.text || "");
   const output = `${result.stdout || ""}\n${result.stderr || ""}`;
@@ -625,16 +663,7 @@ export function isAlreadyCommittedCleanGitNoop(args = {}, result = {}, state = {
   ) {
     return false;
   }
-  const mutationRevision = Math.max(
-    0,
-    Number(state.meta?.projectVerification?.mutationRevision || 0)
-  );
-  return (Array.isArray(state.meta?.durableGitEvidence) ? state.meta.durableGitEvidence : []).some(
-    (item) =>
-      String(item?.action || "").toLowerCase() === "commit" &&
-      goalRevisionCoversActiveTask(state, item?.goalRevision) &&
-      Number(item?.mutationRevision || 0) >= mutationRevision
-  );
+  return hasDurableCommitEvidence(state);
 }
 
 export function buildFailedCommandAdvice({ args = {}, commandPolicy = {}, commandResult = {}, config = {}, state = {} } = {}) {

package/src/scs-evidence.js

@@ -649,6 +649,7 @@ function inferExactInputPaths(goal = "") {
     }
     quotedPathPattern.lastIndex = 0;
     for (const match of line.matchAll(quotedPathPattern)) {
+      if (looksLikeShellCommandLiteral(match[1])) continue;
       pushPath(match[1]);
     }
     const unquotedLine = line.replace(quotedPathPattern, (match) => " ".repeat(match.length));
@@ -1379,12 +1380,36 @@ function prefixRequestsInlineCommandExecution(prefix = "") {
   while (preamble.test(clause)) clause = clause.replace(preamble, "").trim();
   clause = clause.replace(/(?:[:：]|--?)\s*$/, "").trim();
   return (
-    /^(?:followed\s+by|run|rerun|re-run|execute|invoke|launch|verify|validate|check|confirm)(?:\s+(?:(?:the|this|that)\s+)?(?:following\s+)?command(?:\s+named)?)?\s*$/i.test(
+    /^(?:followed\s+by|run|rerun|re-run|execute|invoke|launch|verify|validate|check|confirm)(?:\s+(?:exactly|again|once))?(?:\s+(?:(?:the|this|that)\s+)?(?:exact|required|following\s+)?command(?:\s+named)?)?\s*$/i.test(
       clause
     ) || /^(?:随后运行|隨後運行|接着运行|接著運行|运行|運行|执行|執行|调用|調用|验证|驗證|检查|檢查|确认|確認)\s*$/.test(clause)
   );
 }
 
+function sentenceContinuesRequestedCommandList(source = "", sentenceStart = -1, commandIndex = -1) {
+  const prefix = String(source || "").slice(sentenceStart + 1, commandIndex).trim();
+  if (!/^(?:these|those|the\s+following)\s+(?:commands?\s+)?(?:include|are)\b/i.test(prefix)) {
+    return false;
+  }
+
+  const preceding = String(source || "").slice(0, Math.max(0, sentenceStart)).trimEnd();
+  const previousStart = Math.max(
+    preceding.lastIndexOf("\n"),
+    preceding.lastIndexOf("."),
+    preceding.lastIndexOf("!"),
+    preceding.lastIndexOf("?"),
+    preceding.lastIndexOf("。"),
+    preceding.lastIndexOf("！"),
+    preceding.lastIndexOf("？")
+  );
+  const previousSentence = preceding.slice(previousStart + 1).trim();
+  return (
+    /\b(?:run|rerun|re-run|execute|invoke|launch|verify|validate|check|confirm|follow)\b/i.test(previousSentence) &&
+    /\b(?:exact|required|following|verification|validation|test|check)\b/i.test(previousSentence) &&
+    /\bcommands?\b/i.test(previousSentence)
+  );
+}
+
 function canonicalBareVerifierCommand(rawPath = "") {
   const candidate = String(rawPath || "").trim();
   if (
@@ -1439,7 +1464,12 @@ function inferExplicitRequestedCommands(goal = "") {
       source.lastIndexOf("？", index - 1)
     );
     const prefix = source.slice(sentenceStart + 1, index).trimEnd();
-    if (!prefixRequestsInlineCommandExecution(prefix)) continue;
+    if (
+      !prefixRequestsInlineCommandExecution(prefix) &&
+      !sentenceContinuesRequestedCommandList(source, sentenceStart, index)
+    ) {
+      continue;
+    }
 
     const command = normalizeProjectCommand(match[1]);
     if (
@@ -1487,7 +1517,7 @@ export function deriveScsTaskContract({ goal = "", taskProfile = "", acceptanceC
   }));
   const excludedOutputPaths = inferExplicitlyExcludedOutputPaths(evidenceGoal);
   const inferredOutputPaths = filterExplicitlyExcludedOutputPaths(
-    inferExactOutputPaths(evidenceGoal),
+    inferExactOutputPaths(positiveEvidenceGoal),
     excludedOutputPaths
   );
   const exactOutputPaths = filterExplicitlyExcludedOutputPaths(
@@ -1515,7 +1545,7 @@ export function deriveScsTaskContract({ goal = "", taskProfile = "", acceptanceC
     requiresPerSourceChecks: requiresPerSourceChecks(evidenceGoal),
     requiredToolCalls,
     requiredGitActions,
-    requiredProjectCommands: inferExplicitRequestedCommands(evidenceGoal),
+    requiredProjectCommands: inferExplicitRequestedCommands(positiveEvidenceGoal),
     requiresWorkspaceMutation: goalRequestsWorkspaceMutation(evidenceGoal, taskProfile),
     requiresFileMutation: goalRequestsFileMutation(evidenceGoal, taskProfile),
     requiresSourceGrounding: requiresSourceGrounding(evidenceGoal),

package/src/task-profiles.js

@@ -122,7 +122,7 @@ export const TASK_PROFILES = {
     id: "slides",
     label: "Slides and presentations",
     prompt:
-      "Bias toward presentation, pitch deck, poster, lecture, and slide-style communication. Clarify audience and purpose from available context, create a durable outline and slide files or markdown deck, keep each slide visually focused, include speaker notes when useful, and export/preview when local tools support it.",
+      "Bias toward presentation, pitch deck, poster, lecture, and slide-style communication. Infer audience and purpose from available context, create a durable outline and source-grounded editable slide source, keep each slide visually focused, and include useful speaker notes. Preserve editable text, charts, tables, and shapes instead of flattening complete slides into images. Produce the requested deck/export formats and a reproducible build path when practical. Render every slide to a preview and inspect the actual pixels for clipping, collisions, wrapped-title decoration overlap, unreadable text, and inconsistent framing; rebuild after repairs. Verify source claims and calculations, artifact existence and package readability, slide/page counts across PPTX/PDF/previews, and any exact acceptance command supplied by the user. In a Git repository, when the task asks for a commit, commit intentional source and deliverables, narrowly ignore only transient build/perception evidence, and run a fresh git status --short before claiming completion.",
     tools: ["files", "shell", "canvas", "web_search"],
   },
   education: {