@lazyingart/agintiflow 0.20.272 → 0.20.273

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.272",
+  "version": "0.20.273",
   "type": "module",
   "description": "AgInTiFlow is a project-aware agent workspace for hybrid wet-dry R&D, hardware-aware intelligence, software automation, and industrial workflows.",
   "license": "Apache-2.0",

package/scripts/smoke-dynamic-step-budget.js

@@ -5306,8 +5306,19 @@ try {
       postMutationVerificationRuntime.testVerificationCommand === postMutationVerifier,
     "a material failed-test repair did not advance directly to its exact retained verifier"
   );
+  const generatedDeckValidatorPath = path.join(
+    tempRoot,
+    "acceptance",
+    "presentation_deck_contract.py"
+  );
+  await fs.mkdir(path.dirname(generatedDeckValidatorPath), { recursive: true });
+  await fs.writeFile(
+    generatedDeckValidatorPath,
+    "raise SystemExit('acceptance fixture')\n",
+    "utf8"
+  );
   const generatedDeckValidator =
-    "python3 /tmp/presentation_deck_contract.py --root .";
+    `python3 ${generatedDeckValidatorPath} --root .`;
   await fs.writeFile(
     path.join(workspace, "build_deck.py"),
     "print('build canonical deck')\n",
@@ -5544,6 +5555,41 @@ try {
       JSON.stringify(["build_deck.py"]),
     "failed-test recovery forced immutable evidence reads instead of grounding the canonical producer"
   );
+  assert(
+    JSON.stringify(failedAfterProducerRuntime.testFailureDiagnosticReadPaths) ===
+      JSON.stringify([generatedDeckValidatorPath]) &&
+      failedAfterProducerRuntime.readOnlyRoots.includes(
+        path.dirname(generatedDeckValidatorPath)
+      ),
+    "an exact external validator from the retained failed command was not exposed through a narrow read-only root"
+  );
+  const consumedExternalValidatorState = structuredClone(failedAfterProducerState);
+  consumedExternalValidatorState.meta.toolLoop =
+    consumedExternalValidatorState.meta.toolLoop || { recent: [] };
+  consumedExternalValidatorState.meta.toolLoop.recent = [
+    ...(consumedExternalValidatorState.meta.toolLoop.recent || []),
+    {
+      toolName: "read_file",
+      path: generatedDeckValidatorPath,
+      ok: true,
+      blocked: false,
+      goalRevision: 13,
+      at: "2026-08-27T19:05:02.000Z",
+    },
+  ];
+  const consumedExternalValidatorRuntime = nextStepRuntimeConfig(
+    {
+      provider: "deepseek",
+      taskProfile: "slides",
+      commandCwd: workspace,
+      goal: consumedExternalValidatorState.goal,
+    },
+    consumedExternalValidatorState
+  );
+  assert(
+    consumedExternalValidatorRuntime.testFailureDiagnosticReadPaths.length === 0,
+    "an exact external validator remained exposed after its bounded read completed"
+  );
   const immutableOnlyRepairState = {
     goal: "Treat service_ctl.py as immutable read-only source evidence and finish from existing results.",
     meta: {

package/scripts/smoke-progressive-tool-selection.js

@@ -1804,6 +1804,28 @@ sameNames(
   "an unchanged failed-test rerun did not close discovery until a real mutation"
 );
 
+const externalValidatorPath = "/tmp/aginti-acceptance/deck_contract.py";
+const externalDiagnosticFailedTestRepairTools = selectProgressiveTools(allTools, {
+  config: {
+    provider: "deepseek",
+    testFailureRepairActive: true,
+    testFailureRepairMutationRequired: true,
+    testFailureDiagnosticReadPaths: [externalValidatorPath],
+  },
+  goal: "Repair the canonical producer from the exact external acceptance contract.",
+  profile: "slides",
+});
+sameNames(
+  externalDiagnosticFailedTestRepairTools,
+  ["read_file", "apply_patch", "finish"],
+  "a retained external validator was not exposed as one bounded read during mutation-only recovery"
+);
+assertStrict.deepEqual(
+  externalDiagnosticFailedTestRepairTools[0].function.parameters.properties.path.enum,
+  [externalValidatorPath],
+  "the external validator read was not schema-constrained to its exact path"
+);
+
 const failedTestPatchContextTools = selectProgressiveTools(allTools, {
   config: {
     provider: "localllm",

package/src/agent-runner.js

@@ -6683,6 +6683,51 @@ function failedTestCanonicalRepairPaths(state = {}) {
     .filter((item, index, items) => items.indexOf(item) === index);
 }
 
+export function failedTestExternalDiagnosticReadPaths(
+  config = {},
+  state = {},
+  testRun = null
+) {
+  const failure = testRun || currentFailedProjectTest(state)?.test;
+  const command = String(failure?.command || "").trim();
+  if (!command) return [];
+  const commandCwd = path.resolve(
+    config.commandCwd || state.commandCwd || process.cwd()
+  );
+  const candidates = [];
+  for (const token of tokenizeShellWords(command)) {
+    const rawPath = String(token || "").replace(/[;,]+$/g, "").trim();
+    if (!rawPath || !path.isAbsolute(rawPath)) continue;
+    let realPath = "";
+    try {
+      realPath = fsSync.realpathSync(rawPath);
+      const stat = fsSync.statSync(realPath);
+      if (!stat.isFile() || stat.size > 1_000_000) continue;
+    } catch {
+      continue;
+    }
+    const relative = path.relative(commandCwd, realPath);
+    if (!relative.startsWith("..") && !path.isAbsolute(relative)) continue;
+    const normalized = realPath.replace(/\\/g, "/");
+    if (
+      !PLAIN_TEXT_FILE_EXTENSIONS.has(path.extname(normalized).toLowerCase()) ||
+      /(?:secret|credential|password|private[-_]?key|access[-_]?token)/i.test(normalized) ||
+      !(
+        pathLooksLikeTestSource(normalized) ||
+        /(?:^|\/)(?:acceptance|verification)(?:\/|$)|(?:contract|validator)/i.test(
+          normalized
+        )
+      ) ||
+      candidates.includes(realPath)
+    ) {
+      continue;
+    }
+    candidates.push(realPath);
+    if (candidates.length >= 3) break;
+  }
+  return candidates;
+}
+
 function recoveryEvidenceDependencies(sourcePath = "", content = "") {
   const dependencies = [];
   const append = (candidate) => {
@@ -11452,6 +11497,39 @@ export function nextStepRuntimeConfig(config = {}, state = {}) {
       .slice(0, 8);
     const toolLoop = state.meta?.toolLoop || {};
     const stagnationEpoch = Math.max(0, Number(toolLoop.stagnationEpoch || 0));
+    const externalDiagnosticPaths = failedTestExternalDiagnosticReadPaths(
+      runtimeConfig,
+      state,
+      retainedFailedTest
+    );
+    const consumedExternalDiagnosticPaths = new Set(
+      (Array.isArray(toolLoop.recent) ? toolLoop.recent : [])
+        .filter(
+          (entry) =>
+            entry?.ok === true &&
+            entry?.blocked !== true &&
+            String(entry?.toolName || "") === "read_file" &&
+            Number(entry?.goalRevision || 0) === groundingGoalRevision
+        )
+        .map((entry) => {
+          const rawPath = String(entry?.path || "").trim();
+          return rawPath ? path.resolve(commandCwd, rawPath) : "";
+        })
+        .filter(Boolean)
+    );
+    runtimeConfig.testFailureDiagnosticReadPaths = externalDiagnosticPaths.filter(
+      (candidate) => !consumedExternalDiagnosticPaths.has(candidate)
+    );
+    if (runtimeConfig.testFailureDiagnosticReadPaths.length) {
+      runtimeConfig.readOnlyRoots = [
+        ...(Array.isArray(runtimeConfig.readOnlyRoots)
+          ? runtimeConfig.readOnlyRoots
+          : []),
+        ...runtimeConfig.testFailureDiagnosticReadPaths.map((candidate) =>
+          path.dirname(candidate)
+        ),
+      ].filter((item, index, items) => items.indexOf(item) === index);
+    }
     const currentRecoveryPacket = Boolean(
       state.meta?.failedTestRecoveryPacket &&
         Number(state.meta.failedTestRecoveryPacket.packetVersion || 0) ===

package/src/progressive-tool-selection.js

@@ -733,6 +733,8 @@ function constrainReadFilePaths(tool, paths, phase) {
           ? "Exact canonical project file selected from current task evidence for the required fresh correction."
         : phase === "failed-test-evidence-refresh"
           ? "Exact unread workspace-relative path retained by the current failed-test evidence packet."
+          : phase === "failed-test-diagnostic-read"
+            ? "Exact read-only acceptance or validator source named by the retained failed verification command."
           : "Exact workspace-relative path discovered by inspect_project.",
   };
   return {
@@ -746,6 +748,8 @@ function constrainReadFilePaths(tool, paths, phase) {
             ? "Read one exact canonical project file before the required fresh source correction. Tests, Git actions, and finish remain unavailable until a material patch advances the project mutation revision."
           : phase === "failed-test-evidence-refresh"
             ? "Read one exact unread source or acceptance-test file from the current failed-test evidence packet. Each packet path is exposed at most once before mutation-only recovery resumes."
+            : phase === "failed-test-diagnostic-read"
+              ? "Read one exact existing external acceptance or validator file from the retained failed command. This path is read-only and no neighboring external files are exposed."
           : phase === "read-instructions"
           ? "Read one exact project instruction file discovered by inspect_project before repository mutation or validation commands are enabled."
           : phase === "read-tests"
@@ -2017,24 +2021,36 @@ export function selectProgressiveTools(
           .filter((item, index, items) => items.indexOf(item) === index)
           .slice(0, 1)
       : [];
-    const boundedRepairReadPaths = repairContextPaths.length
-      ? repairContextPaths
-      : optionalRepairRereadPaths;
+    const diagnosticReadPaths = Array.isArray(config.testFailureDiagnosticReadPaths)
+      ? config.testFailureDiagnosticReadPaths
+          .map((item) => String(item || "").replace(/\\/g, "/").trim())
+          .filter(Boolean)
+          .filter((item, index, items) => items.indexOf(item) === index)
+          .slice(0, 3)
+      : [];
+    const boundedRepairReadPaths = [
+      ...diagnosticReadPaths,
+      ...(repairContextPaths.length ? repairContextPaths : optionalRepairRereadPaths),
+    ]
+      .filter((item, index, items) => items.indexOf(item) === index)
+      .slice(0, 8);
     const constrainedRepairRead = boundedRepairReadPaths.length
       ? constrainReadFilePaths(
           available.get("read_file"),
           boundedRepairReadPaths,
-          repairContextPaths.length
-            ? "failed-test-evidence-refresh"
-            : "deepseek-failed-test-source-reread"
+          diagnosticReadPaths.length
+            ? "failed-test-diagnostic-read"
+            : repairContextPaths.length
+              ? "failed-test-evidence-refresh"
+              : "deepseek-failed-test-source-reread"
         )
       : available.get("read_file");
     const toolNames = config.testFailureRepairMutationRequired === true
       ? [
-          ...(config.testFailureRepairNeedsPatchContext === true
-            ? ["read_file", ...(repairContextPaths.length ? [] : ["search_files"])]
-            : optionalRepairRereadPaths.length
-              ? ["read_file"]
+          ...(boundedRepairReadPaths.length
+            ? ["read_file"]
+            : config.testFailureRepairNeedsPatchContext === true
+              ? ["read_file", "search_files"]
               : []),
           "apply_patch",
           ...(constrainedInstructionCreate ? ["write_file"] : []),