@lazyingart/agintiflow 0.20.316 → 0.20.318

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.316",
+  "version": "0.20.318",
   "type": "module",
   "description": "AgInTiFlow is a project-aware agent workspace for hybrid wet-dry R&D, hardware-aware intelligence, software automation, and industrial workflows.",
   "license": "Apache-2.0",

package/scripts/smoke-dynamic-step-budget.js

@@ -6132,6 +6132,242 @@ try {
       sandboxMode: "host",
     }
   );
+  const scopedRelativeTaskRoot = path.relative(workspace, scopedTaskRoot).replace(/\\/g, "/");
+  const liveScopedGroupTestLogCommand = {
+    toolName: "run_command",
+    ok: true,
+    exitCode: 0,
+    args: {
+      command:
+        `cd ${JSON.stringify(workspace)} && ` +
+        `TASK=${scopedRelativeTaskRoot} && LOG="$TASK/document-reader-test.log" && ` +
+        `{ echo "=== focused test ==="; python3 -m unittest discover -s tests -p 'test_reader.py' -v; RC=$?; echo "EXIT=$RC"; } ` +
+        `> "$LOG" 2>&1; tail -n 6 "$LOG"; echo "LOG_OK=$([ -s "$LOG" ] && echo yes || echo no)"`,
+    },
+    projectMutationPaths: [],
+    stdout: "Ran 7 tests in 0.01s\nOK\nEXIT=0\nLOG_OK=yes\n",
+    stderr: "",
+  };
+  recordProjectVerificationOutcome(
+    scopedTaskState,
+    liveScopedGroupTestLogCommand,
+    {
+      commandCwd: workspace,
+      taskProfile: "qa",
+      allowShellTool: true,
+      sandboxMode: "host",
+    }
+  );
+  const liveScopedTeeTestLogCommand = {
+    toolName: "run_command",
+    ok: true,
+    exitCode: 0,
+    args: {
+      command:
+        `cd ${JSON.stringify(workspace)} && ` +
+        `TASK=${scopedRelativeTaskRoot} && LOG="$TASK/document-reader-test.log" && ` +
+        `{ echo "=== focused test ==="; python3 -m unittest discover -s tests -p 'test_reader.py' -v 2>&1; RC=$?; echo "EXIT=$RC"; } ` +
+        `| tee "$LOG"; grep -q '^OK$' "$LOG"; echo "DONE_EXIT=$?"`,
+    },
+    projectMutationPaths: [],
+    stdout: "Ran 7 tests in 0.01s\nOK\nEXIT=0\nDONE_EXIT=0\n",
+    stderr: "",
+  };
+  recordProjectVerificationOutcome(
+    scopedTaskState,
+    liveScopedTeeTestLogCommand,
+    {
+      commandCwd: workspace,
+      taskProfile: "qa",
+      allowShellTool: true,
+      sandboxMode: "host",
+    }
+  );
+  const liveScopedOutsideStatusTestLogCommand = {
+    toolName: "run_command",
+    ok: true,
+    exitCode: 0,
+    args: {
+      command:
+        `cd ${JSON.stringify(workspace)} && ` +
+        `TASK=${scopedRelativeTaskRoot} && ` +
+        `{ date -u +"RUN_AT=%FT%TZ"; PYTHONPATH=src python -m pytest tests/test_wechat_document_reader.py -q; } ` +
+        `> "$TASK/document-reader-test.log" 2>&1; rc=$?; echo "PYTEST_EXIT=$rc"; ` +
+        `cat "$TASK/document-reader-test.log"`,
+    },
+    projectMutationPaths: [],
+    stdout: "PYTEST_EXIT=0\n....... [100%]\n7 passed in 0.04s\n",
+    stderr: "",
+  };
+  recordProjectVerificationOutcome(
+    scopedTaskState,
+    liveScopedOutsideStatusTestLogCommand,
+    {
+      commandCwd: workspace,
+      taskProfile: "qa",
+      allowShellTool: true,
+      sandboxMode: "host",
+    }
+  );
+  const conditionalTestCommand =
+    `cd ${JSON.stringify(workspace)} && ` +
+    `if PYTHONPATH=src python -c "import pytest" 2>/dev/null; then ` +
+    `PYTHONPATH=src python -m pytest tests/test_wechat_document_reader.py -q; else ` +
+    `PYTHONPATH=src python -m unittest tests.test_wechat_document_reader -v; fi`;
+  const conditionalTestState = { meta: { goalContract: { revision: 1 } } };
+  const conditionalTestResult = {
+    toolName: "run_command",
+    ok: true,
+    exitCode: 0,
+    args: { command: conditionalTestCommand },
+    projectMutationPaths: [],
+    stdout: "....... [100%]\n7 passed in 0.04s\n",
+    stderr: "",
+    commandPolicy: classifyCommand(conditionalTestCommand),
+  };
+  recordProjectVerificationOutcome(
+    conditionalTestState,
+    conditionalTestResult,
+    {
+      commandCwd: workspace,
+      taskProfile: "qa",
+      allowShellTool: true,
+      sandboxMode: "host",
+    }
+  );
+  const mutatingConditionalTestCommand = conditionalTestCommand.replace(
+    "tests.test_wechat_document_reader -v; fi",
+    "tests.test_wechat_document_reader -v; touch src/agent-runner.js; fi"
+  );
+  const mutatingConditionalTestState = { meta: { goalContract: { revision: 1 } } };
+  const mutatingConditionalTestResult = {
+    toolName: "run_command",
+    ok: true,
+    exitCode: 0,
+    args: { command: mutatingConditionalTestCommand },
+    projectMutationPaths: [],
+    stdout: "7 passed in 0.04s\n",
+    stderr: "",
+    commandPolicy: classifyCommand(mutatingConditionalTestCommand),
+  };
+  recordProjectVerificationOutcome(
+    mutatingConditionalTestState,
+    mutatingConditionalTestResult,
+    {
+      commandCwd: workspace,
+      taskProfile: "qa",
+      allowShellTool: true,
+      allowDestructive: true,
+      sandboxMode: "host",
+    }
+  );
+  const unsafeScopedLogState = {
+    goal: scopedTaskGoal,
+    commandCwd: workspace,
+    meta: {
+      goalContract: {
+        revision: 1,
+        taskGoal: scopedTaskGoal,
+        currentRequest: "Create and verify output/result.json.",
+      },
+    },
+  };
+  const outsideScopedGroupTestLogCommand = {
+    toolName: "run_command",
+    ok: true,
+    exitCode: 0,
+    args: {
+      command:
+        `cd ${JSON.stringify(workspace)} && LOG="source-tree-test.log" && ` +
+        `{ python3 -m unittest discover -s tests -p 'test_reader.py' -v; RC=$?; echo "EXIT=$RC"; } ` +
+        `> "$LOG" 2>&1; tail -n 6 "$LOG"`,
+    },
+    projectMutationPaths: [],
+    stdout: "Ran 7 tests in 0.01s\nOK\nEXIT=0\n",
+    stderr: "",
+  };
+  recordProjectVerificationOutcome(
+    unsafeScopedLogState,
+    outsideScopedGroupTestLogCommand,
+    {
+      commandCwd: workspace,
+      taskProfile: "qa",
+      allowShellTool: true,
+      sandboxMode: "host",
+    }
+  );
+  const sourceWriteAfterScopedLogState = {
+    goal: scopedTaskGoal,
+    commandCwd: workspace,
+    meta: {
+      goalContract: {
+        revision: 1,
+        taskGoal: scopedTaskGoal,
+        currentRequest: "Create and verify output/result.json.",
+      },
+    },
+  };
+  const sourceWriteAfterScopedLogCommand = {
+    toolName: "run_command",
+    ok: true,
+    exitCode: 0,
+    args: {
+      command:
+        `cd ${JSON.stringify(workspace)} && ` +
+        `TASK=${scopedRelativeTaskRoot} && LOG="$TASK/document-reader-test.log" && ` +
+        `{ python3 -m unittest discover -s tests -p 'test_reader.py' -v; RC=$?; echo "EXIT=$RC"; } ` +
+        `> "$LOG" 2>&1; touch src/agent-runner.js; tail -n 6 "$LOG"`,
+    },
+    projectMutationPaths: [],
+    stdout: "Ran 7 tests in 0.01s\nOK\nEXIT=0\n",
+    stderr: "",
+  };
+  recordProjectVerificationOutcome(
+    sourceWriteAfterScopedLogState,
+    sourceWriteAfterScopedLogCommand,
+    {
+      commandCwd: workspace,
+      taskProfile: "qa",
+      allowShellTool: true,
+      sandboxMode: "host",
+    }
+  );
+  const spoofedCapturedStatusState = {
+    goal: scopedTaskGoal,
+    commandCwd: workspace,
+    meta: {
+      goalContract: {
+        revision: 1,
+        taskGoal: scopedTaskGoal,
+        currentRequest: "Create and verify output/result.json.",
+      },
+    },
+  };
+  const spoofedCapturedStatusCommand = {
+    toolName: "run_command",
+    ok: true,
+    exitCode: 0,
+    args: {
+      command:
+        `cd ${JSON.stringify(workspace)} && ` +
+        `TASK=${scopedRelativeTaskRoot} && LOG="$TASK/document-reader-test.log" && ` +
+        `{ python3 -m unittest discover -s tests -p 'test_reader.py' -v; RC=$?; echo "EXIT=$RC"; } ` +
+        `> "$LOG" 2>&1; tail -n 6 "$LOG"; echo "EXIT=0"`,
+    },
+    projectMutationPaths: [],
+    stdout: "FAILED (failures=1)\nEXIT=1\nEXIT=0\n",
+    stderr: "",
+  };
+  recordProjectVerificationOutcome(
+    spoofedCapturedStatusState,
+    spoofedCapturedStatusCommand,
+    {
+      commandCwd: workspace,
+      taskProfile: "qa",
+      allowShellTool: true,
+      sandboxMode: "host",
+    }
+  );
   const nullRedirectValidationCommand = {
     toolName: "run_command",
     ok: true,
@@ -6169,6 +6405,25 @@ try {
       scopedManifestCommand.scopedTaskArtifactWrite === true &&
       pythonScopedManifestCommand.scopedTaskArtifactWrite === true &&
       scopedCompoundTestLogCommand.scopedTaskArtifactWrite === true &&
+      liveScopedGroupTestLogCommand.scopedTaskArtifactWrite === true &&
+      liveScopedGroupTestLogCommand.projectTest?.passed === true &&
+      liveScopedGroupTestLogCommand.projectTest?.explicitExitStatus === 0 &&
+      liveScopedTeeTestLogCommand.scopedTaskArtifactWrite === true &&
+      liveScopedTeeTestLogCommand.projectTest?.passed === true &&
+      liveScopedTeeTestLogCommand.projectTest?.explicitExitStatus === 0 &&
+      liveScopedOutsideStatusTestLogCommand.scopedTaskArtifactWrite === true &&
+      liveScopedOutsideStatusTestLogCommand.projectTest?.passed === true &&
+      liveScopedOutsideStatusTestLogCommand.projectTest?.explicitExitStatus === 0 &&
+      conditionalTestState.meta.projectVerification?.mutationRevision === 0 &&
+      conditionalTestResult.boundedReadOnlyTestWrapper === true &&
+      conditionalTestResult.projectTest?.passed === true &&
+      mutatingConditionalTestState.meta.projectVerification?.mutationRevision === 1 &&
+      mutatingConditionalTestResult.projectTest === undefined &&
+      unsafeScopedLogState.meta.projectVerification?.mutationRevision === 1 &&
+      outsideScopedGroupTestLogCommand.scopedTaskArtifactWrite !== true &&
+      sourceWriteAfterScopedLogState.meta.projectVerification?.mutationRevision === 1 &&
+      sourceWriteAfterScopedLogCommand.scopedTaskArtifactWrite !== true &&
+      spoofedCapturedStatusCommand.projectTest === undefined &&
       nullRedirectValidationCommand.readOnlyArtifactValidation === true,
     `task-scoped delivery bookkeeping invalidated requested artifact evidence: ${JSON.stringify({
       requestedOutputRevision,
@@ -6181,6 +6436,46 @@ try {
         pythonScopedManifestCommand.scopedTaskArtifactWrite,
       scopedCompoundTestLogCommand:
         scopedCompoundTestLogCommand.scopedTaskArtifactWrite,
+      liveScopedGroupTestLogCommand: {
+        scopedTaskArtifactWrite: liveScopedGroupTestLogCommand.scopedTaskArtifactWrite,
+        projectTest: liveScopedGroupTestLogCommand.projectTest,
+      },
+      liveScopedTeeTestLogCommand: {
+        scopedTaskArtifactWrite: liveScopedTeeTestLogCommand.scopedTaskArtifactWrite,
+        projectTest: liveScopedTeeTestLogCommand.projectTest,
+      },
+      liveScopedOutsideStatusTestLogCommand: {
+        scopedTaskArtifactWrite:
+          liveScopedOutsideStatusTestLogCommand.scopedTaskArtifactWrite,
+        projectTest: liveScopedOutsideStatusTestLogCommand.projectTest,
+      },
+      conditionalTestResult: {
+        mutationRevision:
+          conditionalTestState.meta.projectVerification?.mutationRevision,
+        boundedReadOnlyTestWrapper:
+          conditionalTestResult.boundedReadOnlyTestWrapper,
+        projectTest: conditionalTestResult.projectTest,
+      },
+      mutatingConditionalTestResult: {
+        mutationRevision:
+          mutatingConditionalTestState.meta.projectVerification?.mutationRevision,
+        projectTest: mutatingConditionalTestResult.projectTest,
+      },
+      outsideScopedGroupTestLogCommand: {
+        mutationRevision:
+          unsafeScopedLogState.meta.projectVerification?.mutationRevision,
+        scopedTaskArtifactWrite:
+          outsideScopedGroupTestLogCommand.scopedTaskArtifactWrite,
+      },
+      sourceWriteAfterScopedLogCommand: {
+        mutationRevision:
+          sourceWriteAfterScopedLogState.meta.projectVerification?.mutationRevision,
+        scopedTaskArtifactWrite:
+          sourceWriteAfterScopedLogCommand.scopedTaskArtifactWrite,
+      },
+      spoofedCapturedStatusCommand: {
+        projectTest: spoofedCapturedStatusCommand.projectTest,
+      },
       nullRedirectValidationCommand:
         nullRedirectValidationCommand.readOnlyArtifactValidation,
     })}`

package/src/agent-runner.js

@@ -4967,6 +4967,407 @@ function normalizeProjectCommand(command = "") {
   return canonicalizeShellCommand(command);
 }
 
+function shellBraceGroups(value = "") {
+  const text = String(value || "");
+  const groups = [];
+  let quote = "";
+  let escaped = false;
+  let start = -1;
+  let depth = 0;
+
+  const isGroupOpen = (index) => {
+    if (text[index] !== "{" || text[index - 1] === "$") return false;
+    const before = text[index - 1] || "";
+    const after = text[index + 1] || "";
+    return (!before || /[\s;&|()]/u.test(before)) && /\s/u.test(after);
+  };
+  const isGroupClose = (index) => {
+    if (text[index] !== "}") return false;
+    const before = text[index - 1] || "";
+    const after = text[index + 1] || "";
+    return /\s/u.test(before) && (!after || /[\s;&|<>)]/u.test(after));
+  };
+
+  for (let index = 0; index < text.length; index += 1) {
+    const char = text[index];
+    if (quote === "'") {
+      if (char === "'") quote = "";
+      continue;
+    }
+    if (escaped) {
+      escaped = false;
+      continue;
+    }
+    if (char === "\\") {
+      escaped = true;
+      continue;
+    }
+    if (quote === '"') {
+      if (char === '"') quote = "";
+      continue;
+    }
+    if (char === "'" || char === '"') {
+      quote = char;
+      continue;
+    }
+    if (start < 0 && isGroupOpen(index)) {
+      start = index;
+      depth = 1;
+      continue;
+    }
+    if (start >= 0 && isGroupOpen(index)) {
+      depth += 1;
+      continue;
+    }
+    if (start >= 0 && isGroupClose(index)) {
+      depth -= 1;
+      if (depth > 0) continue;
+      groups.push({
+        start,
+        end: index,
+        body: text.slice(start + 1, index).trim(),
+      });
+      start = -1;
+      depth = 0;
+    }
+  }
+  return groups;
+}
+
+function unquotedShellControlDelimiter(value = "", keyword = "", startIndex = 0) {
+  const text = String(value || "");
+  const expected = String(keyword || "").toLowerCase();
+  let quote = "";
+  let escaped = false;
+  for (let index = Math.max(0, Number(startIndex || 0)); index < text.length; index += 1) {
+    const char = text[index];
+    if (quote === "'") {
+      if (char === "'") quote = "";
+      continue;
+    }
+    if (escaped) {
+      escaped = false;
+      continue;
+    }
+    if (char === "\\") {
+      escaped = true;
+      continue;
+    }
+    if (quote === '"') {
+      if (char === '"') quote = "";
+      continue;
+    }
+    if (char === "'" || char === '"') {
+      quote = char;
+      continue;
+    }
+    if (char !== ";") continue;
+    const suffix = text.slice(index + 1).match(/^\s*([A-Za-z]+)\b/u);
+    if (String(suffix?.[1] || "").toLowerCase() === expected) return index;
+  }
+  return -1;
+}
+
+function boundedTestAvailabilityProbe(value = "") {
+  let command = normalizeProjectCommand(value);
+  if (!command || /(?:`|\$\()/u.test(command)) return false;
+  command = command
+    .replace(/(?:^|\s)(?:\d*>>?|&>>?)\s*(?:"\/dev\/null"|'\/dev\/null'|\/dev\/null)/gu, " ")
+    .trim()
+    .replace(/^(?:[A-Za-z_]\w*=(?:"[^"\n]*"|'[^'\n]*'|[^\s;&|]+)\s*)+/u, "")
+    .trim();
+  const tokens = tokenizeShellWords(command);
+  if (
+    ["command", "which"].includes(String(tokens[0] || "")) &&
+    (tokens[0] !== "command" || tokens[1] === "-v")
+  ) {
+    const target = tokens[0] === "command" ? tokens[2] : tokens[1];
+    return Boolean(target && /^[A-Za-z0-9_.+-]+$/u.test(target) && tokens.length <= 3);
+  }
+  const executable = String(tokens[0] || "").split(/[\\/]/u).at(-1) || "";
+  const codeIndex = tokens.indexOf("-c");
+  if (!/^python(?:\d+(?:\.\d+)*)?$/iu.test(executable) || codeIndex < 1) return false;
+  const code = String(tokens[codeIndex + 1] || "").trim();
+  if (!code || codeIndex + 2 !== tokens.length) return false;
+  return /^(?:import\s+[A-Za-z_]\w*(?:\.[A-Za-z_]\w*)*|from\s+[A-Za-z_]\w*(?:\.[A-Za-z_]\w*)*\s+import\s+[A-Za-z_]\w*)$/u.test(
+    code
+  );
+}
+
+function boundedTestCommandClassification(value = "") {
+  const command = normalizeProjectCommand(value);
+  const executableCommand = command
+    .replace(/^(?:[A-Za-z_]\w*=(?:"[^"\n]*"|'[^'\n]*'|[^\s;&|]+)\s*)+/u, "")
+    .trim();
+  return {
+    command,
+    executableCommand,
+    policy: classifyCommand(executableCommand),
+  };
+}
+
+function parseBoundedConditionalTestWrapper(value = "") {
+  let normalized = normalizeProjectCommand(value);
+  if (!normalized) return null;
+  normalized = normalized.replace(
+    /^cd\s+(?:"[^"\n]+"|'[^'\n]+'|[^\s;&|]+)\s*&&\s*/u,
+    ""
+  );
+  if (!/^if\s+/u.test(normalized)) return null;
+  const thenAt = unquotedShellControlDelimiter(normalized, "then", 3);
+  if (thenAt < 0) return null;
+  const thenMatch = normalized.slice(thenAt + 1).match(/^\s*then\b/u);
+  if (!thenMatch) return null;
+  const thenBodyStart = thenAt + 1 + thenMatch[0].length;
+  const elseAt = unquotedShellControlDelimiter(normalized, "else", thenBodyStart);
+  if (elseAt < 0) return null;
+  const elseMatch = normalized.slice(elseAt + 1).match(/^\s*else\b/u);
+  if (!elseMatch) return null;
+  const elseBodyStart = elseAt + 1 + elseMatch[0].length;
+  const fiAt = unquotedShellControlDelimiter(normalized, "fi", elseBodyStart);
+  if (fiAt < 0 || !/^\s*fi\s*$/u.test(normalized.slice(fiAt + 1))) return null;
+
+  const condition = normalized.slice(3, thenAt).trim();
+  const thenCommand = normalizeProjectCommand(
+    normalized.slice(thenBodyStart, elseAt).trim()
+  );
+  const elseCommand = normalizeProjectCommand(
+    normalized.slice(elseBodyStart, fiAt).trim()
+  );
+  if (!boundedTestAvailabilityProbe(condition)) return null;
+  const branches = [thenCommand, elseCommand];
+  const classifications = branches.map((candidate) =>
+    boundedTestCommandClassification(candidate)
+  );
+  const policies = classifications.map((candidate) => candidate.policy);
+  if (
+    branches.some((candidate) => {
+      const sequence = parseTopLevelShellSequence(candidate);
+      return (
+        !candidate ||
+        sequence.openQuote ||
+        sequence.trailingEscape ||
+        sequence.trailingSeparator ||
+        sequence.commands.length !== 1
+      );
+    }) ||
+    policies.some((policy) => policy.substantiveTest !== true)
+  ) {
+    return null;
+  }
+  return {
+    command: thenCommand,
+    alternateCommand: elseCommand,
+    wrappedCommand: normalizeProjectCommand(value),
+    statusSource: "process",
+    semanticallyReadOnly: policies.every(
+      (policy, index) =>
+        !commandCanMutateProjectContent(
+          classifications[index].executableCommand,
+          policy
+        )
+    ),
+  };
+}
+
+function capturedStatusEcho(value = "", statusVariable = "") {
+  const label =
+    "(?:(?:[A-Z][A-Z0-9_]{0,31}_)?(?:EXIT|STATUS|RESULT)(?:_CODE)?)";
+  const variable = String(statusVariable || "");
+  const statusOperand = variable
+    ? `\\$(?:\\{${variable.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&")}\\}|${variable.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&")})`
+    : "\\$\\?";
+  return String(value || "").trim().match(
+    new RegExp(
+      `^echo\\s+(?:-n\\s+)?["']?(?<label>${label})\\s*[:=]\\s*${statusOperand}["']?$`,
+      "iu"
+    )
+  );
+}
+
+function boundedReadOnlyTestPrefixCommand(value = "") {
+  const command = normalizeProjectCommand(value);
+  if (!command) return false;
+  const tokens = tokenizeShellWords(command);
+  if (
+    ["date", "echo", "printf"].includes(String(tokens[0] || "")) &&
+    !/(?:`|\$\()/u.test(command)
+  ) {
+    return true;
+  }
+  if (
+    ["cat", "grep", "head", "stat", "tail", "wc"].includes(
+      String(tokens[0] || "")
+    ) &&
+    !/(?:`|\$\(|[|<>])/u.test(command)
+  ) {
+    return true;
+  }
+  const policy = classifyCommand(command);
+  return (
+    policy.writesWorkspace !== true &&
+    policy.mayMutateProject !== true &&
+    policy.substantiveTest !== true
+  );
+}
+
+function parseCapturedTestExitStatusWrapper(value = "") {
+  const normalized = normalizeProjectCommand(value);
+  if (!normalized) return null;
+  const label = "(?:EXIT|STATUS|RESULT)(?:_CODE)?";
+  for (const group of shellBraceGroups(normalized)) {
+    const sequence = parseTopLevelShellSequence(group.body);
+    if (
+      sequence.openQuote ||
+      sequence.trailingEscape ||
+      (sequence.trailingSeparator && sequence.trailingSeparator !== ";") ||
+      sequence.commands.length < 1
+    ) {
+      continue;
+    }
+    for (let index = 1; index < sequence.commands.length - 1; index += 1) {
+      const statusAssignment = String(sequence.commands[index] || "")
+        .trim()
+        .match(/^([A-Za-z_]\w*)\s*=\s*\$\?$/u);
+      if (!statusAssignment) continue;
+      const statusVariable = statusAssignment[1];
+      const escapedVariable = statusVariable.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+      const statusEcho = String(sequence.commands[index + 1] || "").trim();
+      const echoPattern = new RegExp(
+        `^echo\\s+(?:-n\\s+)?["']?(?<label>${label})\\s*[:=]\\s*\\$(?:\\{${escapedVariable}\\}|${escapedVariable})["']?$`,
+        "iu"
+      );
+      const echoMatch = statusEcho.match(echoPattern);
+      if (!echoMatch) continue;
+      const outsideGroup = `${normalized.slice(0, group.start)} ${normalized.slice(group.end + 1)}`;
+      if (
+        /\b(?:echo|printf)\b[^;&|\n]{0,240}\b(?:EXIT|STATUS|RESULT)(?:_CODE)?\s*[:=]/iu.test(
+          outsideGroup
+        )
+      ) {
+        continue;
+      }
+      const testCommand = normalizeProjectCommand(sequence.commands[index - 1]);
+      if (boundedTestCommandClassification(testCommand).policy.substantiveTest !== true) continue;
+      return {
+        command: testCommand,
+        wrappedCommand: normalized,
+        label: String(echoMatch.groups?.label || "").toUpperCase(),
+        statusSource: "captured-group",
+        statusVariable,
+      };
+    }
+
+    for (let index = 0; index < sequence.commands.length - 1; index += 1) {
+      const testCommand = normalizeProjectCommand(sequence.commands[index]);
+      const directEcho = capturedStatusEcho(sequence.commands[index + 1]);
+      if (
+        !directEcho ||
+        boundedTestCommandClassification(testCommand).policy.substantiveTest !== true
+      ) {
+        continue;
+      }
+      if (
+        sequence.commands.slice(0, index).some(
+          (candidate) => !boundedReadOnlyTestPrefixCommand(candidate)
+        ) ||
+        sequence.commands.length !== index + 2
+      ) {
+        continue;
+      }
+      const outsideGroup = `${normalized.slice(0, group.start)} ${normalized.slice(group.end + 1)}`;
+      if (
+        /\b(?:echo|printf)\b[^;&|\n]{0,240}\b(?:EXIT|STATUS|RESULT)(?:_CODE)?\s*[:=]/iu.test(
+          outsideGroup
+        )
+      ) {
+        continue;
+      }
+      return {
+        command: testCommand,
+        wrappedCommand: normalized,
+        label: String(directEcho.groups?.label || "").toUpperCase(),
+        statusSource: "captured-group",
+      };
+    }
+
+    const bodyCommands = sequence.commands.map((candidate) =>
+      normalizeProjectCommand(candidate)
+    );
+    const testCommand = bodyCommands.at(-1) || "";
+    if (
+      boundedTestCommandClassification(testCommand).policy.substantiveTest !== true ||
+      bodyCommands.slice(0, -1).some(
+        (candidate) => !boundedReadOnlyTestPrefixCommand(candidate)
+      )
+    ) {
+      continue;
+    }
+    const suffix = normalized
+      .slice(group.end + 1)
+      .replace(
+        /^\s*(?:(?:\d*>>?|&>>?)\s*(?:"[^"\n]+"|'[^'\n]+'|&\d+|[^\s;&|]+)\s*)+/u,
+        ""
+      )
+      .replace(/^\s*;\s*/u, "");
+    const suffixSequence = parseTopLevelShellSequence(suffix);
+    if (
+      !suffix ||
+      suffixSequence.openQuote ||
+      suffixSequence.trailingEscape ||
+      suffixSequence.trailingSeparator ||
+      suffixSequence.commands.length < 2
+    ) {
+      continue;
+    }
+    const statusAssignment = String(suffixSequence.commands[0] || "")
+      .trim()
+      .match(/^([A-Za-z_]\w*)\s*=\s*\$\?$/u);
+    if (!statusAssignment) continue;
+    const statusEcho = capturedStatusEcho(
+      suffixSequence.commands[1],
+      statusAssignment[1]
+    );
+    if (!statusEcho) continue;
+    if (
+      suffixSequence.commands.slice(2).some((candidate) => {
+        if (
+          /\b(?:echo|printf)\b[^;&|\n]{0,240}\b(?:[A-Z][A-Z0-9_]{0,31}_)?(?:EXIT|STATUS|RESULT)(?:_CODE)?\s*[:=]/iu.test(
+            candidate
+          )
+        ) {
+          return true;
+        }
+        return !boundedReadOnlyTestPrefixCommand(candidate);
+      })
+    ) {
+      continue;
+    }
+    return {
+      command: testCommand,
+      wrappedCommand: normalized,
+      label: String(statusEcho.groups?.label || "").toUpperCase(),
+      statusSource: "captured-group",
+      statusVariable: statusAssignment[1],
+    };
+  }
+  return null;
+}
+
+function projectTestCommandWrapper(command = "") {
+  return (
+    parseCapturedTestExitStatusWrapper(command) ||
+    parseBoundedConditionalTestWrapper(command)
+  );
+}
+
+function projectExitStatusWrapper(command = "") {
+  return (
+    parseNonMutatingExitStatusWrapper(command) ||
+    parseCapturedTestExitStatusWrapper(command)
+  );
+}
+
 function normalizeLeadingWorkspaceCd(command = "", config = {}) {
   const normalized = normalizeProjectCommand(command);
   const sequence = parseTopLevelShellSequence(normalized);
@@ -5037,7 +5438,8 @@ function isRetainedExactVerificationCommand(command = "", config = {}) {
 export function isSubstantiveTestCommand(command = "", config = {}) {
   if (isRetainedExactVerificationCommand(command, config)) return true;
   const normalized = normalizeProjectCommand(normalizeCommandForPolicy(command, config));
-  const text = parseNonMutatingExitStatusWrapper(normalized)?.command || normalized;
+  if (projectTestCommandWrapper(normalized)) return true;
+  const text = projectExitStatusWrapper(normalized)?.command || normalized;
   if (!text) return false;
   const classification = classifyCommand(text);
   if (classification.substantiveTest !== true) return false;
@@ -5142,7 +5544,7 @@ function testRunRepresentsInvalidInvocation(testRun = {}) {
 
 function explicitExitProbeStatus(command = "", result = {}) {
   const normalizedCommand = normalizeProjectCommand(command);
-  const exitProbe = parseNonMutatingExitStatusWrapper(normalizedCommand);
+  const exitProbe = projectExitStatusWrapper(normalizedCommand);
   if (!exitProbe) {
     return {
       present: false,
@@ -5152,9 +5554,26 @@ function explicitExitProbeStatus(command = "", result = {}) {
     };
   }
 
+  let status = parseExplicitExitStatus(result.stdout || "");
+  if (status === null && exitProbe.statusSource === "captured-group") {
+    const escapedLabel = String(exitProbe.label || "")
+      .replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+    const matches = [
+      ...String(result.stdout || "").matchAll(
+        escapedLabel
+          ? new RegExp(
+              `(?:^|\\n)\\s*${escapedLabel}\\s*[:=]\\s*(-?\\d+)\\s*(?=\\n|$)`,
+              "giu"
+            )
+          : /(?:^|\n)\s*(?:EXIT|STATUS|RESULT)(?:_CODE)?\s*[:=]\s*(-?\d+)\s*(?=\n|$)/giu
+      ),
+    ];
+    if (matches.length) status = Number(matches.at(-1)[1]);
+  }
+
   return {
     present: true,
-    status: parseExplicitExitStatus(result.stdout || ""),
+    status,
     command: exitProbe.command,
     wrappedCommand: exitProbe.wrappedCommand || exitProbe.command,
   };
@@ -6719,6 +7138,7 @@ export function recordProjectVerificationOutcome(state = {}, toolResult = {}, co
 
   if (toolName === "run_command") {
     const command = normalizeProjectCommand(toolResult.args?.command || "");
+    const testCommandWrapper = projectTestCommandWrapper(command);
     const retainedExactVerification = isRetainedExactVerificationCommand(
       command,
       config
@@ -6832,6 +7252,7 @@ export function recordProjectVerificationOutcome(state = {}, toolResult = {}, co
       command &&
         toolResult.blocked !== true &&
         !retainedExactVerification &&
+        testCommandWrapper?.semanticallyReadOnly !== true &&
         !disposableGeneratedCleanup &&
         !disposableGeneratedVerificationSideEffects &&
         !scopedTaskArtifactWrite &&
@@ -6856,6 +7277,9 @@ export function recordProjectVerificationOutcome(state = {}, toolResult = {}, co
     if (readOnlyArtifactValidation) {
       toolResult.readOnlyArtifactValidation = true;
     }
+    if (testCommandWrapper?.semanticallyReadOnly === true) {
+      toolResult.boundedReadOnlyTestWrapper = true;
+    }
     let requiredBatch = currentRequiredCommandBatch(verification, requiredCommands);
     const activeExecutionContract = state.meta?.activeExecutionContract;
     const activeTurnCommands =
@@ -7396,7 +7820,7 @@ export function recordAlreadyCommittedRepositoryRepair(state = {}, toolResult =
 
 function projectTestCommandKey(command = "") {
   const normalized = normalizeProjectCommand(command);
-  const exitProbe = parseNonMutatingExitStatusWrapper(normalized);
+  const exitProbe = projectExitStatusWrapper(normalized);
   const invocation = normalizeProjectCommand(exitProbe?.command || normalized)
     // These wrappers alter bytecode/output handling, not the tests selected or
     // executed. Treating them as distinct suites can leave an old failure
@@ -12777,40 +13201,106 @@ function commandWritesOnlyEvidenceMatching(command = "", pathMatches = () => fal
   for (const match of normalized.matchAll(
     /(?:^|[\s;&|])([A-Za-z_]\w*)\s*=\s*("[^"\n]+"|'[^'\n]+'|[^\s;&|]+)/g
   )) {
-    assignments.set(
-      match[1],
-      String(match[2] || "").replace(/^["']|["']$/g, "")
-    );
+    assignments.set(match[1], String(match[2] || "").replace(/^["']|["']$/g, ""));
   }
-  const resolveTarget = (value = "") => {
-    const target = String(value || "")
+  const resolveTarget = (value = "", seen = new Set()) => {
+    let target = String(value || "")
       .trim()
       .replace(/^["']|["']$/g, "");
-    const variable = target.match(/^\$(?:\{([A-Za-z_]\w*)\}|([A-Za-z_]\w*))$/);
-    return variable
-      ? String(assignments.get(variable[1] || variable[2]) || "")
-      : target;
+    if (!target || /\$\(|`/u.test(target)) return "";
+    for (let depth = 0; depth < 8; depth += 1) {
+      let unresolved = false;
+      let changed = false;
+      const expanded = target.replace(
+        /\$(?:\{([A-Za-z_]\w*)\}|([A-Za-z_]\w*))/gu,
+        (match, bracedName, bareName) => {
+          const name = bracedName || bareName;
+          if (!assignments.has(name) || seen.has(name)) {
+            unresolved = true;
+            return match;
+          }
+          const nextSeen = new Set(seen);
+          nextSeen.add(name);
+          const resolved = resolveTarget(assignments.get(name), nextSeen);
+          if (!resolved) {
+            unresolved = true;
+            return match;
+          }
+          changed = true;
+          return resolved;
+        }
+      );
+      target = expanded;
+      if (unresolved) return "";
+      if (!changed) return target;
+    }
+    return "";
   };
-  const tokens = tokenizeShellWords(normalized);
-  if (tokens[0] === "tee") {
+  const evidenceTargetsFromTee = (tokens = []) => {
+    if (tokens[0] !== "tee") return [];
     let index = 1;
     if (["-a", "--append"].includes(tokens[index])) index += 1;
     if (tokens[index] === "--") index += 1;
-    const targets = tokens.slice(index).map(resolveTarget);
+    return tokens.slice(index).map((target) => resolveTarget(target));
+  };
+  const evidenceTargetsFromMkdir = (tokens = []) =>
+    tokens[0] === "mkdir"
+      ? tokens
+          .slice(1)
+          .filter((token) => token !== "-p" && token !== "--")
+          .map((target) => resolveTarget(target))
+      : [];
+  const boundedEchoProbeIsReadOnly = (segment = "") => {
+    const source = String(segment || "").trim();
+    const sourceTokens = tokenizeShellWords(source);
+    if (!["echo", "printf"].includes(String(sourceTokens[0] || ""))) return false;
+    if (source.includes("`") || !source.includes("$(")) return !source.includes("`");
+    const substitutions = [];
+    const remainder = source.replace(/\$\(([^()]*)\)/gu, (match, body) => {
+      substitutions.push(String(body || ""));
+      return "";
+    });
+    if (!substitutions.length || remainder.includes("$(")) return false;
+    return substitutions.every((body) => {
+      const sequence = parseTopLevelShellSequence(body);
+      if (
+        sequence.openQuote ||
+        sequence.trailingEscape ||
+        sequence.trailingSeparator ||
+        !sequence.commands.length
+      ) {
+        return false;
+      }
+      return sequence.commands.every((candidate) => {
+        const candidateTokens = tokenizeShellWords(candidate);
+        if (["echo", "printf"].includes(String(candidateTokens[0] || ""))) {
+          return !String(candidate || "").includes("$(") && !String(candidate || "").includes("`");
+        }
+        if (["[", "test"].includes(String(candidateTokens[0] || ""))) {
+          const operands = candidateTokens.filter(
+            (token) => !["[", "]", "test", "!", "-e", "-f", "-r", "-s"].includes(token)
+          );
+          return operands.length > 0 && operands.every((operand) => Boolean(resolveTarget(operand)));
+        }
+        const policy = classifyCommand(candidate);
+        return policy.writesWorkspace !== true && policy.mayMutateProject !== true;
+      });
+    });
+  };
+  const tokens = tokenizeShellWords(normalized);
+  if (tokens[0] === "tee") {
+    const targets = evidenceTargetsFromTee(tokens);
     return targets.length > 0 && targets.every(pathMatches);
   }
   if (tokens[0] === "mkdir") {
-    const targets = tokens
-      .slice(1)
-      .filter((token) => token !== "-p" && token !== "--")
-      .map(resolveTarget);
+    const targets = evidenceTargetsFromMkdir(tokens);
     return targets.length > 0 && targets.every(pathMatches);
   }
 
   let strippedEvidenceRedirect = false;
   let rejectedRedirect = false;
   const withoutEvidenceRedirects = normalized.replace(
-    /(^|\s)(?:\d*>>?|&>>?)\s*("[^"]+"|'[^']+'|[^\s;&|]+)/g,
+    /(^|\s)(?:\d*>>?|&>>?)\s*("[^"]+"|'[^']+'|&\d+|[^\s;&|]+)/g,
     (match, prefix, target) => {
       const resolvedTarget = resolveTarget(target);
       if (/^(?:&\d+|\/dev\/null)$/u.test(resolvedTarget)) return prefix;
@@ -12822,15 +13312,19 @@ function commandWritesOnlyEvidenceMatching(command = "", pathMatches = () => fal
       return prefix;
     }
   ).trim();
-  if (rejectedRedirect || !strippedEvidenceRedirect || !withoutEvidenceRedirects) {
+  if (rejectedRedirect || !withoutEvidenceRedirects) {
     return false;
   }
   const sequence = parseTopLevelShellSequence(withoutEvidenceRedirects);
   if (sequence.openQuote || sequence.trailingEscape || sequence.trailingSeparator) {
     return false;
   }
-  return sequence.commands.every((segment) => {
+  let sawEvidenceWrite = strippedEvidenceRedirect;
+  const safeSequence = sequence.commands.every((segment) => {
     const withoutAssignments = String(segment || "")
+      .trim()
+      .replace(/^\{\s*/u, "")
+      .replace(/\s*\}$/u, "")
       .trim()
       .replace(
         /^(?:[A-Za-z_]\w*=(?:"[^"\n]*"|'[^'\n]*'|[^\s;&|]+)\s*)+/u,
@@ -12839,6 +13333,20 @@ function commandWritesOnlyEvidenceMatching(command = "", pathMatches = () => fal
       .trim();
     if (!withoutAssignments) return true;
     const commandTokens = tokenizeShellWords(withoutAssignments);
+    if (boundedReadOnlyTestPrefixCommand(withoutAssignments)) return true;
+    const teeTargets = evidenceTargetsFromTee(commandTokens);
+    if (teeTargets.length) {
+      const safe = teeTargets.every(pathMatches);
+      if (safe) sawEvidenceWrite = true;
+      return safe;
+    }
+    const mkdirTargets = evidenceTargetsFromMkdir(commandTokens);
+    if (mkdirTargets.length) {
+      const safe = mkdirTargets.every(pathMatches);
+      if (safe) sawEvidenceWrite = true;
+      return safe;
+    }
+    if (boundedEchoProbeIsReadOnly(withoutAssignments)) return true;
     if (
       ["cat", "cd", "head", "ls", "stat", "tail", "wc"].includes(
         String(commandTokens[0] || "")
@@ -12852,6 +13360,7 @@ function commandWritesOnlyEvidenceMatching(command = "", pathMatches = () => fal
       underlyingPolicy.mayMutateProject !== true
     );
   });
+  return safeSequence && sawEvidenceWrite;
 }
 
 function commandWritesOnlyPrivateVerificationEvidence(command = "") {