@lazyingart/agintiflow 0.20.290 → 0.20.292

package/docs/supervision-campaign-ledger.md

@@ -408,3 +408,65 @@ The same real session was replayed against the patched source at goal revision
 The target stayed at commit `2b35928` with no mutation. Focused planning,
 truthful-completion, and dynamic-budget regressions pass, as does the complete
 AgInTiFlow npm suite. The fix is released in AgInTiFlow `0.20.251`.
+
+### Exact source recovery after context loss
+
+`database-migration-049` repeated an imperfect SQLite repair task against a
+fresh broken workspace. Automatic routing selected only `qa-testing` and
+`database`, but the first run read the canonical source immediately before
+proactive context compaction. The compacted model correctly requested that
+source again; the retained failed-test read budget exposed a different file,
+so two safe but schema-invalid reads stopped the session without dispatch.
+
+AgInTiFlow now treats proactive compaction, local context-window recovery,
+model-timeout compaction, and same-task continuation as bounded context-loss
+boundaries. A current failed-test packet may reopen only its evidence-derived
+production repair paths after such a boundary. Tests, broad discovery,
+arbitrary commands, and unrelated writes remain closed. Once the exact source
+is read in the new context, the ordinary mutation and verification gates apply.
+
+The original session resumed against the patched runtime, repaired the
+transactional schema migration, preserved IDs and tags on URL updates, made
+punctuation search literal, added regression coverage, passed four unit tests,
+and committed a clean tree at `b956470`. The independent migration-safety
+contract also passed. The complete npm suite passes, and the runtime fix is
+released in AgInTiFlow `0.20.291`.
+
+### Explicit test evidence and security-review completion
+
+`security-labshare-050` asked a fresh DeepSeek Pro session to harden a small
+standard-library laboratory service from an imperfect, outcome-level prompt.
+The agent removed a default credential, bounded artifact and dataset paths,
+kept export execution shell-free, redacted audit credentials, protected the
+public status response, added focused tests, and committed a clean repair. The
+hidden acceptance contract then exposed a remaining audit-log injection path:
+newlines in an actor or artifact field could forge additional physical records.
+
+During the retained-session repair, AgInTi fixed the production source but
+committed it before adding the explicitly requested regression test. This was a
+runtime contract defect, not a model-quality failure. The mutation parser did
+not recognize contextual requests such as "add a regression test," and the SCS
+evidence contract did not convert "run the tests" into a fresh test obligation.
+Consequently, source and Git evidence could satisfy the phase too early.
+
+AgInTiFlow now recognizes explicit English and Chinese test-file mutations,
+requires fresh test evidence for explicit run/rerun-test requests, and keeps
+task-owned commit completion closed until that evidence exists. The regression
+suite reproduces the stale persisted contract and proves no commit is offered
+after source mutation but before a fresh passing test. It avoids broad keyword
+matching, so phrases such as "create a canvas preview for this smoke test" do
+not invent a test-file mutation.
+
+The same release accepts genuinely observational Git evidence when no
+consequential Git action is required, permits only the exact bounded Python
+cache-cleanup forms used by project hygiene, and treats masked values such as
+`token=***` as safe status evidence without weakening detection of real
+credential assignments. The security-review skill now covers control-character
+log injection and requires a standalone note to distinguish deployment
+boundary, threat model, controls, residual risks, non-goals, and verification.
+
+The retained session completed `SECURITY.md` after a valid secret-content
+block, passed the exact hidden contract and all 13 visible tests, and left a
+clean target repository at `ef3c099`. Focused regressions and the complete npm
+suite pass. These runtime and skill fixes are released in AgInTiFlow
+`0.20.292`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.290",
+  "version": "0.20.292",
   "type": "module",
   "description": "AgInTiFlow is a project-aware agent workspace for hybrid wet-dry R&D, hardware-aware intelligence, software automation, and industrial workflows.",
   "license": "Apache-2.0",

package/scripts/smoke-coding-tools.js

@@ -1680,6 +1680,45 @@ try {
     mixedValidationCleanupAdvice.autoRecover === true,
     "unrequested cleanup should be skipped without pausing substantive work"
   );
+  const pythonCacheCleanupArgs = {
+    command:
+      "find . -type d -name __pycache__ -prune -exec rm -rf {} + ; find . -type f -name '*.pyc' -delete; git status --short",
+  };
+  assert(
+    isUnrequestedCleanupCommand(
+      "run_command",
+      pythonCacheCleanupArgs,
+      { goal: "Repair the service, run its tests, and commit the intentional work." },
+      {}
+    ),
+    "post-acceptance Python cache deletion was not recognized as optional housekeeping"
+  );
+  const pythonCacheCleanupAdvice = buildPermissionAdvice({
+    toolName: "run_command",
+    args: pythonCacheCleanupArgs,
+    guard: {
+      category: "destructive",
+      reason: "Destructive shell commands require Allow destructive actions.",
+    },
+    config: {
+      ...dockerWorkspacePolicy,
+      goal: "Repair the service, run its tests, and commit the intentional work.",
+    },
+    state: { sessionId: "coding-python-cache-cleanup-smoke" },
+  });
+  assert(
+    pythonCacheCleanupAdvice.autoRecover === true,
+    "ignored Python cache cleanup should be skipped without pausing a completed task"
+  );
+  assert(
+    !isUnrequestedCleanupCommand(
+      "run_command",
+      { command: "find . -type f -delete" },
+      { goal: "Repair the service and commit the result." },
+      {}
+    ),
+    "broad find deletion was incorrectly classified as optional Python cache cleanup"
+  );
   assert(
     !isUnrequestedCleanupCommand(
       "run_command",

package/scripts/smoke-dynamic-step-budget.js

@@ -13546,6 +13546,91 @@ Do not prefix, suffix, wrap, redirect, pipe, or combine that validator command.`
     "a partial multi-artifact task entered task-owned Git completion before its deliverables existed"
   );
 
+  const securityWorkspace = path.join(tempRoot, "security-test-before-commit");
+  await fs.mkdir(securityWorkspace, { recursive: true });
+  await fs.writeFile(path.join(securityWorkspace, "labshare.py"), "def record_access():\n    pass\n");
+  const securityGoal = [
+    "Independent acceptance failed: audit fields permit newline log injection.",
+    "Add a focused regression test, fix the root cause, run the full visible tests,",
+    "review the diff, and commit only this corrective work.",
+  ].join(" ");
+  const securityState = {
+    goal: securityGoal,
+    commandCwd: securityWorkspace,
+    plan: "Patch the source and regression test, run the full suite, then commit the verified work.",
+    messages: [
+      {
+        role: "tool",
+        content: JSON.stringify({
+          ok: true,
+          toolName: "apply_patch",
+          path: "labshare.py",
+          goalRevision: 1,
+          projectMutationRevision: 1,
+        }),
+      },
+      {
+        role: "tool",
+        content: JSON.stringify({
+          ok: true,
+          toolName: "run_command",
+          exitCode: 0,
+          args: { command: "git status --short" },
+          stdout: " M labshare.py\n",
+          goalRevision: 1,
+          projectMutationRevision: 1,
+        }),
+      },
+    ],
+    meta: {
+      taskProfile: "security",
+      goalContract: {
+        revision: 1,
+        currentRequest: securityGoal,
+        taskGoal: securityGoal,
+        activeGoal: securityGoal,
+        activeGoalRevision: 1,
+        history: [{ revision: 1, refreshExecutionContract: true }],
+        lifecycle: [{ at: new Date(Date.now() - 2000).toISOString() }],
+      },
+      // Reproduce the pre-fix persisted contract that recognized a mutation
+      // but failed to classify the requested regression test as file work.
+      activeExecutionContract: {
+        revision: 1,
+        startedMutationRevision: 0,
+        materialMutationRevision: 1,
+        requiresWorkspaceMutation: true,
+        requiresFileMutation: false,
+      },
+      projectVerification: {
+        mutationRevision: 1,
+        mutationHistory: [
+          {
+            revision: 1,
+            at: new Date().toISOString(),
+            toolName: "apply_patch",
+            paths: ["labshare.py"],
+            goalRevision: 1,
+          },
+        ],
+      },
+    },
+  };
+  const securityCompletionContract = completionTaskContract(
+    { goal: securityGoal, taskProfile: "security", commandCwd: securityWorkspace },
+    securityState
+  );
+  const preTestSecurityRuntime = nextStepRuntimeConfig(
+    { goal: securityGoal, taskProfile: "security", commandCwd: securityWorkspace },
+    securityState
+  );
+  assert(
+    securityCompletionContract.requiresFileMutation === true &&
+      securityCompletionContract.requiredEvidence.some((item) => item.category === "test") &&
+      preTestSecurityRuntime.taskOwnedCommitPending !== true,
+    "a regression-test repair entered task-owned Git completion before fresh test evidence"
+  );
+
   await fs.rm(tempRoot, { recursive: true, force: true });
   console.log("smoke-dynamic-step-budget ok");
 } catch (error) {

package/scripts/smoke-model-roles.js

@@ -930,6 +930,22 @@ const refreshedSecurityContract = deriveScsTaskContract({
   goal: "Fix the security issue and run the regression tests.",
   taskProfile: "security",
 });
+const correctiveSecurityContract = deriveScsTaskContract({
+  goal: [
+    "Independent acceptance failed: audit fields permit newline log injection.",
+    "Reopen the exact repair, add a focused regression test, fix the root cause,",
+    "run the full visible tests, review the diff, and commit only this corrective work.",
+  ].join(" "),
+  taskProfile: "security",
+});
+assert(
+  correctiveSecurityContract.requiresWorkspaceMutation === true &&
+    correctiveSecurityContract.requiresFileMutation === true &&
+    correctiveSecurityContract.requiredEvidence.some((item) => item.category === "file") &&
+    correctiveSecurityContract.requiredEvidence.some((item) => item.category === "test") &&
+    correctiveSecurityContract.requiredGitActions.includes("commit"),
+  "a requested regression-test repair could enter Git completion without fresh file and test evidence"
+);
 const staleContractFinish = await reviewScsFinish(
   { mock: true },
   { provider: "mock", model: "mock-agent", taskProfile: "security" },
@@ -964,6 +980,11 @@ const staleContractFinish = await reviewScsFinish(
           exitCode: 0,
           args: { command: "python -m unittest discover -s tests -v" },
           stdout: "Ran 10 tests\nOK",
+          projectTest: {
+            passed: true,
+            command: "python -m unittest discover -s tests -v",
+            mutationRevision: 0,
+          },
         }),
       },
     ],
@@ -1056,6 +1077,20 @@ assert(
   evaluateScsEvidence(commitContract, gitStatusLedger).missingGitActions.includes("commit"),
   "the completion deficit did not identify the missing commit"
 );
+const readOnlyGitContract = {
+  requiresExternalEvidence: true,
+  requiredEvidence: [
+    { id: "command", category: "command", description: "read-only verification" },
+    { id: "git", category: "git", description: "existing commit verification" },
+  ],
+  requiredToolCalls: [],
+  requiredGitActions: [],
+  requiredProjectCommands: [],
+};
+assert(
+  evaluateScsEvidence(readOnlyGitContract, gitStatusLedger).ok,
+  "read-only Git evidence was rejected when the contract required no consequential Git action"
+);
 const committedEvaluation = evaluateScsEvidence(commitContract, gitCommitLedger);
 assert(
   committedEvaluation.missingGitActions.length === 0 &&
@@ -1231,7 +1266,14 @@ const checkedCodeEval = evaluateScsEvidence(
       messages: [
         {
           role: "tool",
-          content: JSON.stringify({ toolName: "run_command", ok: true, exitCode: 0, args: { command: "npm test" }, stdout: "ok" }),
+          content: JSON.stringify({
+            toolName: "run_command",
+            ok: true,
+            exitCode: 0,
+            args: { command: "npm test" },
+            stdout: "ok",
+            projectTest: { passed: true, command: "npm test", mutationRevision: 0 },
+          }),
         },
       ],
     },

package/scripts/smoke-progressive-tool-selection.js

@@ -2818,6 +2818,113 @@ assertStrict.deepEqual(
   ["service_ctl.py"],
   "DeepSeek repair reread fallback was not constrained to the canonical source"
 );
+const postCompactionRepairRuntime = nextStepRuntimeConfig(
+  { provider: "deepseek", taskProfile: "qa" },
+  {
+    ...packetPathReadState,
+    meta: {
+      ...packetPathReadState.meta,
+      failedTestRecoveryPacket: {
+        ...packetPathReadState.meta.failedTestRecoveryPacket,
+        paths: ["tests/test_service_ctl.py", "legacy_fixture.py", "service_ctl.py"],
+        repairPaths: ["legacy_fixture.py", "service_ctl.py"],
+      },
+      toolLoop: {
+        stagnationEpoch: 10,
+        lastContextRecovery: {
+          reason: "proactive-context-compaction",
+          at: "2026-08-24T02:00:13.000Z",
+          preservedStaticEvidence: true,
+        },
+        recent: [
+          ...packetPathReadState.meta.toolLoop.recent,
+          {
+            toolName: "read_file",
+            path: "tests/test_service_ctl.py",
+            ok: true,
+            blocked: false,
+            at: "2026-08-24T02:00:12.000Z",
+          },
+          {
+            toolName: "read_file",
+            path: "legacy_fixture.py",
+            ok: true,
+            blocked: false,
+            at: "2026-08-24T02:00:12.500Z",
+          },
+        ],
+      },
+    },
+  }
+);
+assertStrict.deepEqual(
+  postCompactionRepairRuntime.testFailureRepairContextPaths,
+  ["legacy_fixture.py", "service_ctl.py"],
+  "context compaction did not reopen the exact production source lost from model context"
+);
+assertStrict.equal(
+  postCompactionRepairRuntime.testFailureRepairNeedsPatchContext,
+  true,
+  "context compaction did not restore one bounded source-context turn before mutation"
+);
+const postCompactionRepairTools = selectProgressiveTools(allTools, {
+  config: postCompactionRepairRuntime,
+  goal: "Continue the failed-test repair after proactive context compaction.",
+  profile: "qa",
+});
+sameNames(
+  postCompactionRepairTools,
+  ["read_file", "apply_patch", "finish"],
+  "post-compaction repair reopened broad discovery or verification tools"
+);
+assertStrict.deepEqual(
+  postCompactionRepairTools[0].function.parameters.properties.path.enum,
+  ["legacy_fixture.py", "service_ctl.py"],
+  "post-compaction repair did not constrain rereads to all canonical production sources"
+);
+const sameTaskContinuationRepairRuntime = nextStepRuntimeConfig(
+  { provider: "deepseek", taskProfile: "qa" },
+  {
+    ...packetPathReadState,
+    meta: {
+      ...packetPathReadState.meta,
+      failedTestRecoveryPacket: {
+        ...packetPathReadState.meta.failedTestRecoveryPacket,
+        paths: ["tests/test_service_ctl.py", "legacy_fixture.py", "service_ctl.py"],
+        repairPaths: ["legacy_fixture.py", "service_ctl.py"],
+      },
+      toolLoop: {
+        stagnationEpoch: 11,
+        lastContextRecovery: {
+          reason: "same-task-continuation",
+          at: "2026-08-24T02:01:00.000Z",
+        },
+        recent: [
+          ...packetPathReadState.meta.toolLoop.recent,
+          {
+            toolName: "read_file",
+            path: "tests/test_service_ctl.py",
+            ok: true,
+            blocked: false,
+            at: "2026-08-24T02:00:12.000Z",
+          },
+          {
+            toolName: "read_file",
+            path: "legacy_fixture.py",
+            ok: true,
+            blocked: false,
+            at: "2026-08-24T02:00:12.500Z",
+          },
+        ],
+      },
+    },
+  }
+);
+assertStrict.deepEqual(
+  sameTaskContinuationRepairRuntime.testFailureRepairContextPaths,
+  ["legacy_fixture.py", "service_ctl.py"],
+  "same-task continuation did not reopen all retained canonical production sources"
+);
 const testOnlyPacketState = {
   meta: {
     projectVerification: {

package/scripts/smoke-skills.js

@@ -132,6 +132,12 @@ for (const unrelated of [
 }
 assert(selectedIds("debug Docker deployment logs and port config").includes("devops-deployment"), "devops prompt did not select devops-deployment");
 assert(selectedIds("review auth security and secrets handling").includes("security-review"), "security prompt did not select security-review");
+const securitySkill = skills.find((skill) => skill.id === "security-review");
+assert(
+  securitySkill?.body.includes("carriage-return, newline") &&
+    securitySkill?.body.includes("residual risks and non-goals"),
+  "security skill omitted audit-record injection or structured security-note guidance"
+);
 assert(selectedIds("make a PowerPoint pitch deck").includes("presentation-slides"), "slides prompt did not select presentation-slides");
 const presentationSkill = skills.find((skill) => skill.id === "presentation-slides");
 assert(presentationSkill?.body.includes("Render every slide"), "presentation skill does not require every slide to be rendered");

package/scripts/smoke-workspace-secret-false-positive.js

@@ -71,6 +71,26 @@ const patchResult = await executeWorkspaceTool(
 );
 assert(patchResult.ok, "legacy apply_patch replace content with safe credential-loading code context should not be blocked");
 
+const maskedAuditPatchResult = await executeWorkspaceTool(
+  "apply_patch",
+  {
+    patch: [
+      "*** Begin Patch",
+      "*** Add File: tests/test_audit_mask.py",
+      "+def test_audit_token_is_masked():",
+      "+    assert 'token=***' == 'token=' + ('*' * 3)",
+      "*** End Patch",
+    ].join("\n"),
+  },
+  config
+);
+assert(maskedAuditPatchResult.ok, "an all-asterisk credential mask in regression code must not be treated as a secret");
+assert.equal(
+  redactSensitiveText("token=***"),
+  "token=***",
+  "all-asterisk credential masks must remain visible as non-secret evidence"
+);
+
 const secretResult = await executeWorkspaceTool(
   "write_file",
   { path: "notes/leak-report.txt", content: "DEMO_SECRET_TOKEN=aginti_fake_do_not_use\n", mode: "create" },

package/skills/security-review/SKILL.md

@@ -30,7 +30,9 @@ Inspect auth boundaries, file/path handling, shell command construction, depende
 
 - Do not label a finding HIGH or CRITICAL from pattern matching alone. A high-severity claim needs either a reproduced exploit, a direct code path proof, or a clearly stated "potential/unverified" label with lower severity.
 - For path traversal, SSRF, command injection, open redirect, auth bypass, and file disclosure, test a minimal negative case when a safe local command is available. If runtime policy blocks the test, report the blocker and keep severity conservative.
+- Treat logs, audit records, CSV rows, headers, and other line- or delimiter-based outputs as injection boundaries. Check every untrusted field for carriage-return, newline, delimiter, and control-character injection, and add a regression proving one input event cannot forge extra records.
 - Exclude generated/vendor/session/cache directories such as `node_modules/`, `.sessions/`, `.aginti-sessions/`, `.aginti-thorough-tests/`, build outputs, and coverage when broad scanning. If a scan accidentally includes them, call that out as noisy evidence and do not base severity solely on those hits.
 - When a policy blocks `.env`, key, credential, or permission checks, treat that as a safety limitation. Do not retry variants to bypass the block and do not imply the file content was inspected.
 - Prefer bounded commands: `rg`/`grep` with explicit `--exclude-dir`, `head`, `timeout`, and project-relative paths. Avoid unbounded recursive scans over the whole workspace.
 - Reports should separate confirmed findings, potential findings, false positives, and limitations. Include verification commands and observed results for every high-severity item.
+- A standalone security note should distinguish the deployment boundary, concrete threat model, implemented controls, residual risks and non-goals, and exact verification procedure. Ground each claim in current source or tests; do not substitute a generic security checklist.

package/src/agent-runner.js

@@ -14588,11 +14588,34 @@ export function nextStepRuntimeConfig(config = {}, state = {}) {
       Date.parse(String(state.meta?.failedTestRecoveryPacket?.generatedAt || "")),
       Date.parse(String(state.meta?.failedTestFocusedRecovery?.at || "")),
     ].filter(Number.isFinite);
-    const recoveryPacketContextAt = Number.isFinite(failureAt)
+    const retainedRecoveryPacketContextAt = Number.isFinite(failureAt)
       ? failureAt
       : recoveryPacketContextMarkers.length
         ? Math.max(...recoveryPacketContextMarkers)
         : Number.NaN;
+    const latestContextRecovery = state.meta?.toolLoop?.lastContextRecovery;
+    const latestContextRecoveryAt = Date.parse(
+      String(latestContextRecovery?.at || "")
+    );
+    const postContextLossRepairContext = Boolean(
+      Number.isFinite(latestContextRecoveryAt) &&
+        (!Number.isFinite(retainedRecoveryPacketContextAt) ||
+          latestContextRecoveryAt > retainedRecoveryPacketContextAt) &&
+        [
+          "proactive-context-compaction",
+          "local-context-budget-retry",
+          "model-timeout-retry",
+          "same-task-continuation",
+        ].includes(String(latestContextRecovery?.reason || ""))
+    );
+    const recoveryPacketContextAt = postContextLossRepairContext
+      ? latestContextRecoveryAt
+      : retainedRecoveryPacketContextAt;
+    const activeRecoveryPacketPaths = postContextLossRepairContext
+      ? recoveryPacketRepairPaths
+          .filter((item) => !failedTestPathIsTestEvidence(item))
+          .slice(0, 6)
+      : recoveryPacketPaths;
     const consumedRecoveryPacketPaths = new Set(
       Number.isFinite(recoveryPacketContextAt)
         ? (Array.isArray(toolLoop.recent) ? toolLoop.recent : [])
@@ -14610,7 +14633,7 @@ export function nextStepRuntimeConfig(config = {}, state = {}) {
             .filter(Boolean)
         : []
     );
-    const unreadRecoveryPacketPaths = recoveryPacketPaths.filter(
+    const unreadRecoveryPacketPaths = activeRecoveryPacketPaths.filter(
       (item) => !consumedRecoveryPacketPaths.has(item)
     );
     const recoveryPacketReadCounts = new Map();
@@ -14635,7 +14658,7 @@ export function nextStepRuntimeConfig(config = {}, state = {}) {
       }
     }
     const exactRecoveryPacketContextActive = Boolean(
-      recoveryPacketPaths.length && Number.isFinite(recoveryPacketContextAt)
+      activeRecoveryPacketPaths.length && Number.isFinite(recoveryPacketContextAt)
     );
     const recoveryPacketHasProductionContext = [
       ...recoveryPacketPaths,

package/src/permission-advice.js

@@ -175,7 +175,14 @@ export function isUnrequestedCleanupCommand(toolName = "", args = {}, config = {
   return command
     .split(/(?:&&|;|\n)/)
     .map((segment) => segment.trim())
-    .some((segment) => /^(?:command\s+)?rm\s+(?:-[A-Za-z]*[fr][A-Za-z]*\s+|--force\s+)/.test(segment));
+    .some(
+      (segment) =>
+        /^(?:command\s+)?rm\s+(?:-[A-Za-z]*[fr][A-Za-z]*\s+|--force\s+)/.test(segment) ||
+        /^find\s+\.\s+-type\s+d\s+-name\s+['"]?__pycache__['"]?\s+-prune\s+-exec\s+rm\s+-rf\s+\{\}\s+\+$/.test(
+          segment
+        ) ||
+        /^find\s+\.\s+-type\s+f\s+-name\s+(['"]?)\*\.pyc\1\s+-delete$/.test(segment)
+    );
 }
 
 function quoteShell(value = "") {

package/src/redaction.js

@@ -8,7 +8,7 @@ const SECRET_PATTERNS = [
 ];
 
 const SECRET_ASSIGNMENT_PATTERN = /(\b(?:[A-Za-z0-9]+[_-])*(?:api[_-]?key|apiKey|auth[_-]?token|authToken|token|secret|password|passwd|npm[_-]?token|npmToken|_authToken|grsai|venice[_-]?api[_-]?key|veniceApiKey|openrouter[_-]?api[_-]?key)[^\S\r\n]*([:=])[^\S\r\n]*)([^\s\\"'`,;|(){}]+)/gi;
-const SAFE_ASSIGNMENT_VALUE_PATTERN = /^(?:false|true|null|none|unset|missing|not[-_ ]?set|\[REDACTED\])$/i;
+const SAFE_ASSIGNMENT_VALUE_PATTERN = /^(?:false|true|null|none|unset|missing|not[-_ ]?set|\[REDACTED\]|\*{3,})$/i;
 const SOURCE_TYPE_ANNOTATION_PATTERN = /^(?:str|string|bytes|bytearray|int|float|complex|bool|dict|list|tuple|set|frozenset|object|any|unknown|never|void|path|(?:typing\.)?(?:Any|Optional|Union|Literal|Annotated|Sequence|Mapping|MutableMapping|Callable|Type|ClassVar|Final|List|Dict|Tuple|Set|FrozenSet)\[[^\r\n]{1,120}\])$/i;
 const SOURCE_CALL_HEAD_PATTERN = /^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*$/;
 

package/src/scs-evidence.js

@@ -266,7 +266,11 @@ export function gitActionsSatisfyContract(contract = {}, actions = []) {
     ? contract.requiredGitActions.map((item) => String(item || "").toLowerCase()).filter(Boolean)
     : [];
   if (required.length) return missingRequiredGitActionSequence(required, observed).length === 0;
-  return observed.some((action) => !isObservationalGitAction(action));
+  // A Git evidence requirement can be purely observational, for example when
+  // a continuation asks to verify an existing commit while explicitly
+  // forbidding another commit. Consequential actions remain governed by the
+  // ordered requiredGitActions contract above.
+  return observed.length > 0;
 }
 
 const PROJECT_TEST_PROFILES = new Set([
@@ -1233,14 +1237,37 @@ function codeProfileRequiresCommand(goal = "") {
   return substantiveCodeWork && !simpleDocumentWrite;
 }
 
+function goalRequestsExplicitTestMutation(text = "") {
+  return (
+    /\b(?:add|create|implement|write)\b(?:\s+(?:a|an|the|focused|new|additional|specific|security|unit|integration|regression))*\s+(?:regression\s+)?(?:tests?|test cases?)\b/.test(
+      text
+    ) ||
+    /\b(?:edit|fix|modify|patch|repair|update)\b(?:\s+(?:a|an|the|focused|new|existing|current|failing|specific|security|unit|integration|regression))*\s+(?:regression\s+)?(?:tests?|test cases?)\b/.test(
+      text
+    ) ||
+    /(?:添加|新增|创建|编写|编辑|修复|修改|更新)(?:一个|新的|现有的|失败的|专门的|回归|单元|集成)*测试(?:用例)?/.test(
+      text
+    )
+  );
+}
+
 function goalRequestsWorkspaceMutation(goal = "", taskProfile = "") {
   const text = normalizedText(stripCompletedWorkNarration(stripForbiddenLanguage(goal)));
-  if (String(taskProfile || "").trim().toLowerCase() === "review") {
-    return /\b(?:append|copy|create|delete|edit|fix|implement|modify|move|patch|refactor|remove|rename|repair|replace|rewrite|save|update|write)\b/.test(
+  const explicitAddMutation =
+    goalRequestsExplicitTestMutation(text) ||
+    /\badd\b(?:\s+(?:a|an|the|new|additional|specific))*\s+(?:code|documents?|files?|notes?|readme|scripts?|source|workspace)\b/.test(
       text
+    ) || /(?:添加|新增)(?:一个|新的|额外的|特定的)*(?:文件|文档|代码|脚本|源码)/.test(text);
+  if (String(taskProfile || "").trim().toLowerCase() === "review") {
+    return (
+      explicitAddMutation ||
+      /\b(?:append|copy|create|delete|edit|fix|implement|modify|move|patch|refactor|remove|rename|repair|replace|rewrite|save|update|write)\b/.test(
+        text
+      )
     );
   }
   return (
+    explicitAddMutation ||
     /\b(?:append|build|convert|copy|create|delete|edit|fix|generate|implement|modify|move|patch|refactor|remove|rename|repair|replace|rewrite|save|update|write)\b/.test(
       text
     ) ||
@@ -1251,7 +1278,9 @@ function goalRequestsWorkspaceMutation(goal = "", taskProfile = "") {
 function goalRequestsFileMutation(goal = "", taskProfile = "") {
   const text = normalizedText(stripCompletedWorkNarration(stripForbiddenLanguage(goal)));
   if (!goalRequestsWorkspaceMutation(text, taskProfile)) return false;
+  const explicitTestMutation = goalRequestsExplicitTestMutation(text);
   return (
+    explicitTestMutation ||
     /\b(?:code|codebase|document(?:ation)?|files?|notes?|path|readme|repo(?:sitory)?|script|source|workspace)\b/.test(
       text
     ) ||
@@ -1263,6 +1292,17 @@ function goalRequestsFileMutation(goal = "", taskProfile = "") {
   );
 }
 
+function goalRequestsTestExecution(goal = "") {
+  const text = normalizedText(stripCompletedWorkNarration(stripForbiddenLanguage(goal)));
+  return (
+    /\b(?:run|rerun|re-run|execute|invoke)\b[^.\n;]{0,140}\b(?:tests?|test suite)\b/.test(text) ||
+    /\b(?:tests?|test suite)\b[^.\n;]{0,120}\b(?:pass|passing|green|run|rerun|re-run|execute)\b/.test(text) ||
+    /(?:运行|执行|重跑|重新运行)[^。；\n]{0,100}(?:测试|测试套件)|(?:测试|测试套件)[^。；\n]{0,80}(?:通过|运行|执行)/.test(
+      text
+    )
+  );
+}
+
 function profileRequirementsForGoal(taskProfile = "", goal = "") {
   const profile = String(taskProfile || "").toLowerCase();
   const defaults = PROFILE_REQUIREMENTS[profile] || [];
@@ -1367,6 +1407,9 @@ function inferRequirementCategories(goal = "", taskProfile = "", acceptanceCrite
   if (directCommandSignal || (validationSignal && codeProfileRequiresCommand(positiveGoal))) {
     categories.add("command");
   }
+  if (goalRequestsTestExecution(positiveGoal)) {
+    categories.add("test");
+  }
   if (textHas(mandatoryEvidenceText, /\b(artifact|canvas|pdf|image|video|screenshot|cover|plot|chart|figure|docx|archive|copy to|export|generated|generate|draft)\b/) || /输出|产物|图片|视频|截图|封面|生成/.test(mandatoryEvidenceText)) {
     categories.add("artifact");
   }

package/src/workspace-tools.js

@@ -367,7 +367,7 @@ function stripSafeCredentialReferences(content) {
   const codeKeyName = String.raw`(?:api[_-]?key|apiKey|token|secret|password|passwd|npmToken|authToken|grsai|veniceApiKey|venice_api_key)`;
   const codeExpression = String.raw`[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*|\([^"'\n]*\))?`;
   const envName = String.raw`[A-Z][A-Z0-9_]*(?:API[_-]?KEY|TOKEN|SECRET|PASSWORD|PASSWD|GRSAI|VENICE)[A-Z0-9_]*`;
-  const safeStatus = String.raw`(?:false|true|null|none|unset|missing|not[-_ ]?set|\[REDACTED\])`;
+  const safeStatus = String.raw`(?:false|true|null|none|unset|missing|not[-_ ]?set|\[REDACTED\]|\*{3,})`;
 
   text = text.replace(
     new RegExp(String.raw`\b${keyName}\s*[:=]\s*${safeStatus}\b`, "gi"),