@lazyingart/agintiflow 0.20.336-integration.2 → 0.20.336-integration.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.336-integration.2",
+  "version": "0.20.336-integration.3",
   "type": "module",
   "description": "AgInTiFlow is a project-aware agent workspace for hybrid wet-dry R&D, hardware-aware intelligence, software automation, and industrial workflows.",
   "license": "Apache-2.0",

package/scripts/smoke-integration-analysis-planner.js

@@ -2128,6 +2128,7 @@ async function executesAndSynthesizesPlot() {
   assert.equal(planner.attestation.priorArtifactsAuthorizeExecution, false);
   assert.equal(planner.attestation.priorArtifactsCountAsCurrentEvidence, false);
   assert.equal(planner.attestation.contextualTurnsRequireCurrentExecutionAuthority, true);
+  assert.equal(planner.attestation.hostNativeToolRequestsFailClosed, true);
   assert.equal(planner.attestation.maximumToolCalls, INTEGRATION_ANALYSIS_MAX_TOOL_CALLS);
   assert.equal(planner.attestation.maximumRequiredToolFormationRetries, 2);
   assert.equal(planner.attestation.boundedCurrentRunArtifactEvidence, true);
@@ -2189,6 +2190,105 @@ async function directAnswerDoesNotExecute() {
   coordinator.close();
 }
 
+async function hostNativeToolRequestsFailClosedWithoutPythonSubstitution() {
+  const prompts = [
+    "Use tmux_list_sessions to inspect active native tmux sessions and tell me what is running.",
+    "Inspect the host terminal sessions and report the active tmux windows.",
+  ];
+  for (let index = 0; index < prompts.length; index += 1) {
+    const prompt = prompts[index];
+    let modelCalls = 0;
+    const progress = [];
+    const finals = [];
+    const routed = fixture(async () => {
+      modelCalls += 1;
+      return toolResponse("print('invented host evidence')");
+    });
+    const result = await routed.planner.run(
+      scope(`run_00000000-0000-4000-8000-${String(170 + index).padStart(12, "0")}`),
+      { prompt },
+      {
+        onProgress(value) {
+          progress.push(value);
+        },
+        onFinal(value) {
+          finals.push(value);
+        },
+      }
+    );
+    assert.equal(modelCalls, 0, prompt);
+    assert.equal(result.kind, "direct", prompt);
+    assert.equal(result.toolCalls, 0, prompt);
+    assert.equal(result.executionStatus, null, prompt);
+    assert.deepEqual(result.artifacts, [], prompt);
+    assert.match(result.text, /native host\/session tools are not exposed/u, prompt);
+    assert.match(result.text, /No host evidence was collected/u, prompt);
+    assert.doesNotMatch(result.text, /invented|tmux windows:/iu, prompt);
+    assert.deepEqual(finals, [result], prompt);
+    assert.deepEqual(progress, [
+      Object.freeze({
+        phase: "synthesizing",
+        toolCallsCompleted: 0,
+        executionSucceeded: false,
+        artifactCount: 0,
+      }),
+    ], prompt);
+    assert.equal(
+      routed.rpcCalls.filter(({ pathname }) => pathname === EXECUTION_WORKER_RPC_PATHS.jobsStart).length,
+      0,
+      prompt
+    );
+    routed.coordinator.close();
+  }
+
+  let explanatoryModelCalls = 0;
+  const explanatory = fixture(async () => {
+    explanatoryModelCalls += 1;
+    return textResponse("tmux_list_sessions would list terminal multiplexer sessions when such a host tool exists.");
+  });
+  const explanatoryResult = await explanatory.planner.run(
+    scope("run_00000000-0000-4000-8000-000000000172"),
+    { prompt: "Explain what a tool named tmux_list_sessions would do, without using it." }
+  );
+  assert.equal(explanatoryModelCalls, 1);
+  assert.equal(explanatoryResult.kind, "direct");
+  assert.equal(explanatoryResult.toolCalls, 0);
+  assert.doesNotMatch(explanatoryResult.text, /Capability limit:/u);
+  assert.equal(
+    explanatory.rpcCalls.filter(({ pathname }) => pathname === EXECUTION_WORKER_RPC_PATHS.jobsStart).length,
+    0
+  );
+  explanatory.coordinator.close();
+
+  const benignPrompts = [
+    "Use train_test_split to split this dataset.",
+    "Show the process values in this supplied table.",
+    "Use psnr_metric to evaluate this reconstruction.",
+  ];
+  for (let index = 0; index < benignPrompts.length; index += 1) {
+    const prompt = benignPrompts[index];
+    let benignModelCalls = 0;
+    const benign = fixture(async () => {
+      benignModelCalls += 1;
+      return textResponse("This benign request is handled without host-native capability claims.");
+    });
+    const benignResult = await benign.planner.run(
+      scope(`run_00000000-0000-4000-8000-${String(173 + index).padStart(12, "0")}`),
+      { prompt }
+    );
+    assert.equal(benignModelCalls, 1, prompt);
+    assert.equal(benignResult.kind, "direct", prompt);
+    assert.equal(benignResult.toolCalls, 0, prompt);
+    assert.doesNotMatch(benignResult.text, /Capability limit:/u, prompt);
+    assert.equal(
+      benign.rpcCalls.filter(({ pathname }) => pathname === EXECUTION_WORKER_RPC_PATHS.jobsStart).length,
+      0,
+      prompt
+    );
+    benign.coordinator.close();
+  }
+}
+
 async function unsupportedMixedActionsDiscloseAndContinue() {
   const cases = [
     ["Install numpy, then explain a median in one sentence.", /package installation is unavailable/u],
@@ -5320,6 +5420,7 @@ await groundsWithPrivateSearchBeforeModelSynthesis();
 await deepResearchCompletesWithoutSecondModelSynthesis();
 await executesAndSynthesizesPlot();
 await directAnswerDoesNotExecute();
+await hostNativeToolRequestsFailClosedWithoutPythonSubstitution();
 await unsupportedMixedActionsDiscloseAndContinue();
 await coordinatedExecutionClausesHonorLocalNegation();
 await leadingGeneralFileImperativesRequireTheFileWorker();

package/scripts/smoke-integration-analysis-session-service.js

@@ -617,6 +617,74 @@ async function plotThenProseContinuationRoundTrip(temporaryRoot) {
   }
 }
 
+async function hostNativeToolCapabilityLimitRoundTrip(temporaryRoot) {
+  const root = path.join(temporaryRoot, "host-native-limit-state");
+  const prompt = "Use tmux_list_sessions to inspect active native tmux sessions and tell me what is running.";
+  const fixture = createExplicitPythonRunnerFixture({
+    async complete() {
+      return {
+        choices: [{
+          message: {
+            role: "assistant",
+            content: null,
+            tool_calls: [{
+              id: "call_wrong_host_substitute",
+              type: "function",
+              function: {
+                name: "execute_python_analysis",
+                arguments: JSON.stringify({ source: "print('invented host evidence')" }),
+              },
+            }],
+          },
+        }],
+      };
+    },
+  });
+  let service = createTestOnlyIntegrationAnalysisSessionService({
+    analysisRunner: fixture.planner,
+    stateRoot: root,
+  });
+  let restarted = null;
+  try {
+    const created = await service.createThread({ title: "Host-native limit" }, context());
+    const started = await service.startRun({
+      threadId: created.thread.id,
+      input: { text: prompt },
+    }, context());
+    await service.waitForIdle();
+
+    const completed = (await service.getRunStatus({ runId: started.run.id }, context())).run;
+    assert.equal(completed.status, "completed", JSON.stringify(completed.error));
+    assert.match(completed.output, /native host\/session tools are not exposed/u);
+    assert.match(completed.output, /No host evidence was collected/u);
+    assert.equal(fixture.modelCalls, 0);
+    assert.equal(fixture.workerSources.length, 0);
+    assert.equal(
+      fixture.rpcCalls.filter(({ pathname }) => pathname === EXECUTION_WORKER_RPC_PATHS.jobsStart).length,
+      0
+    );
+    const events = await (await service.loadRunEvents(eventsRequest(started.run.id), context()))
+      .publicEventLedger.loadEventsAfter(0);
+    assert.equal(events.some((event) => event.type.startsWith("tool.")), false);
+    assert(events.some((event) => event.type === "run.completed"));
+    assert.deepEqual((await service.listArtifacts({ runId: started.run.id }, context())).artifacts, []);
+
+    await service.close({ mode: "wait" });
+    service = null;
+    restarted = createTestOnlyIntegrationAnalysisSessionService({
+      analysisRunner: fixture.planner,
+      stateRoot: root,
+    });
+    const replayed = (await restarted.getRunStatus({ runId: started.run.id }, context())).run;
+    assert.equal(replayed.output, completed.output);
+    assert.equal(fixture.modelCalls, 0, "durable replay must not call the model");
+  } finally {
+    await service?.close({ mode: "abort" }).catch(() => {});
+    await restarted?.close({ mode: "abort" }).catch(() => {});
+    fixture.coordinator.close();
+  }
+}
+
 async function markdownArtifactFollowupUsesToolRoundTrip(temporaryRoot) {
   const root = path.join(temporaryRoot, "markdown-followup-state");
   const followupPrompt =
@@ -3998,6 +4066,7 @@ async function main() {
   try {
     await explicitPythonDurabilityRoundTrip(temporaryRoot);
     await plotThenProseContinuationRoundTrip(temporaryRoot);
+    await hostNativeToolCapabilityLimitRoundTrip(temporaryRoot);
     await markdownArtifactFollowupUsesToolRoundTrip(temporaryRoot);
     await boundedPriorArtifactContextRoundTrip(temporaryRoot);
     await groundedSearchDurabilityRoundTrip(temporaryRoot);

package/src/integration-analysis-planner.js

@@ -248,7 +248,11 @@ const UNSUPPORTED_SINGLE_TEX_PDF_ACTION =
   /^(?:make|create|generate|produce|prepare|export|save|download|upload|provide|return|output)\b[^.!?;\r\n]{0,180}(?:\.(?:tex|pdf)\b|\b(?:pdf\s+(?:file|report|document)|(?:latex|tex)\s+(?:source|file)\s+only|(?:as|in)\s+(?:a\s+)?pdf)\b)|^(?:compile|typeset|render|export|build|convert)\b[^.!?;\r\n]{0,180}\b(?:latex|tex|source)\b[^.!?;\r\n]{0,120}\b(?:to|into|as)\s+(?:a\s+)?pdf\b/iu;
 const UNSUPPORTED_EXTERNAL_ACTION =
   /^(?:deploy|publish|push|upload|email|post|submit)\b|^send\b[^.!?;\r\n]{0,160}\b(?:email|notification)\b|^send\b[^.!?;\r\n]{0,160}\bto\s+(?!(?:me|us|here|this\s+chat)\b)\S|^(?:change|update|delete|remove)\b[^.!?;\r\n]{0,160}\b(?:account|website|site|server|deployment|repository|repo|setting|record|remote)\b|\b(?:and|then|also)\s+(?:deploy|publish|push|upload|email|post|submit)\b/iu;
-const UNSUPPORTED_CAPABILITY_ORDER = Object.freeze(["package", "shell", "search", "web", "file", "external"]);
+const UNSUPPORTED_NATIVE_HOST_TOOL_ACTION =
+  /\b(?:use|call|invoke|run|execute)\s+(?:the\s+)?(?!execute_python_analysis\b|grounded_search\b|deep_research\b|compile_tex_document\b|publish_file_artifact\b)(?:(?:tmux|terminal|shell|systemd|journalctl|lsof|netstat|host|native|workstation|ps)(?:_[a-z0-9]+)+|[a-z][a-z0-9]*(?:_[a-z0-9]+)*(?:_tmux|_terminal|_shell|_systemd|_journalctl|_lsof|_netstat|_host|_native|_workstation|_pid|_pids|_processes)(?:_[a-z0-9]+)*)\b/iu;
+const UNSUPPORTED_NATIVE_HOST_INSPECTION_ACTION =
+  /\b(?:inspect|list|show|check|query|get|read)\b[^.!?;\r\n]{0,160}\b(?:native|host|workstation)\b[^.!?;\r\n]{0,120}\b(?:tmux|terminal\s+sessions?|shell\s+sessions?|process(?:es)?|pids?|systemd|journalctl|ss|lsof|netstat|ports?|listeners?)\b|\b(?:inspect|list|show|check|query|get|read)\b[^.!?;\r\n]{0,160}\b(?:tmux|terminal\s+sessions?|shell\s+sessions?|systemd|journalctl|ss|lsof|netstat)\b|\b(?:tmux|terminal|shell)\s+sessions?\b[^.!?;\r\n]{0,120}\b(?:inspect|list|show|check|query|get|read|running|active)\b|\b(?:inspect|list|show|check|query|get|read)\b[^.!?;\r\n]{0,120}\b(?:running|host|system)\s+process(?:es)?\b/iu;
+const UNSUPPORTED_CAPABILITY_ORDER = Object.freeze(["package", "shell", "search", "web", "file", "external", "nativeHost"]);
 const GENERAL_FILE_CREATION_ACTION =
   /^(?:(?:using|from|with|based\s+on)\b[^.!?;\r\n]{0,180},?\s+)?(?:make|create|generate|write|produce|prepare|export|save|provide|return|output)\b[^.!?;\r\n]{0,220}(?:\b(?:files?|attachments?|downloads?|archives?)\b|\.(?:csv|json|md|markdown|txt|log|xml|html?|css|m?js|cjs|tsx?|py|sh|svg|png|jpe?g|webp|gif|zip|gz|bin|dat|docx|xlsx|pptx)\b)|^turn\b[^.!?;\r\n]{0,160}\binto\b[^.!?;\r\n]{0,100}(?:\b(?:files?|attachments?|downloads?|archives?)\b|\.(?:csv|json|md|markdown|txt|log|xml|html?|css|m?js|cjs|tsx?|py|sh|svg|png|jpe?g|webp|gif|zip|gz|bin|dat|docx|xlsx|pptx)\b)|\b(?:and|then|also)\s+(?:make|create|generate|write|produce|prepare|export|save)\b[^.!?;\r\n]{0,180}(?:\bfiles?\b|\.(?:csv|json|md|txt|py|js|ts|html|svg|png|jpe?g|webp|zip)\b)/iu;
 const UNSUPPORTED_CAPABILITY_TEXT = Object.freeze({
@@ -258,6 +262,8 @@ const UNSUPPORTED_CAPABILITY_TEXT = Object.freeze({
   web: "Capability limit: arbitrary web browsing and exact URL opening or fetching are unavailable; enabled Search can retrieve only bounded evidence sources.",
   file: "Capability limit: the requested file operation is outside the bounded verified local artifact broker.",
   external: "Capability limit: external actions such as deployment, publishing, uploads, messaging, and email are unavailable.",
+  nativeHost:
+    "Capability limit: native host/session tools are not exposed in this public Agent; I cannot inspect tmux sessions, host processes, terminals, or private workstation state.",
 });
 const EXPRESSION_PLOT_MODEL_FALLBACK_PROMPT =
   "The user explicitly requires a plot, but the fixed single-expression compiler could not represent this natural-language request. Interpret the request and its conversation context, then call the bounded analysis tool and emit a real plot artifact. Never claim a plot exists unless the tool succeeds and emits it.";
@@ -713,6 +719,16 @@ function requiresGeneralFileCreation(value, { texPdfEnabled = false } = {}) {
   ));
 }
 
+function unsupportedNativeHostCapabilityRequired(value) {
+  return unquotedImperativeClauses(value).some((clause) => (
+    !UNSUPPORTED_ACTION_EXCLUSION.test(clause) &&
+    !NON_EXECUTION_LEAD.test(clause) &&
+    !UNSUPPORTED_DISCUSSION_LEAD.test(clause) &&
+    (UNSUPPORTED_NATIVE_HOST_TOOL_ACTION.test(clause) ||
+      UNSUPPORTED_NATIVE_HOST_INSPECTION_ACTION.test(clause))
+  ));
+}
+
 function unsupportedCapabilityRequests(
   value,
   { searchEnabled = false, texPdfEnabled = false, fileCreationEnabled = false } = {}
@@ -743,6 +759,10 @@ function unsupportedCapabilityRequests(
     if (!fileCreationEnabled && UNSUPPORTED_FILE_ACTION.test(fileClause)) requested.add("file");
     if (!texPdfEnabled && UNSUPPORTED_SINGLE_TEX_PDF_ACTION.test(clause)) requested.add("file");
     if (UNSUPPORTED_EXTERNAL_ACTION.test(clause)) requested.add("external");
+    if (UNSUPPORTED_NATIVE_HOST_TOOL_ACTION.test(clause) ||
+        UNSUPPORTED_NATIVE_HOST_INSPECTION_ACTION.test(clause)) {
+      requested.add("nativeHost");
+    }
   }
   return Object.freeze(UNSUPPORTED_CAPABILITY_ORDER.filter((category) => requested.has(category)));
 }
@@ -752,6 +772,12 @@ function prependCapabilityLimits(text, categories) {
   return `${categories.map((category) => UNSUPPORTED_CAPABILITY_TEXT[category]).join("\n")}\n\n${text}`;
 }
 
+function blockingUnsupportedCapabilityLimitText(categories) {
+  const ordered = categories.includes("nativeHost") ? categories : Object.freeze([...categories, "nativeHost"]);
+  return `${ordered.map((category) => UNSUPPORTED_CAPABILITY_TEXT[category]).join("\n")}\n\n` +
+    "No host evidence was collected, and no bounded Python analysis was run.";
+}
+
 function contextualNoToolTurn(conversation, priorArtifacts, explicitExecution) {
   return !explicitExecution && (conversation.length > 0 || priorArtifacts.length > 0);
 }
@@ -2827,6 +2853,7 @@ function createPlanner({
     priorArtifactsAuthorizeExecution: false,
     priorArtifactsCountAsCurrentEvidence: false,
     contextualTurnsRequireCurrentExecutionAuthority: true,
+    hostNativeToolRequestsFailClosed: true,
     maximumToolCalls: INTEGRATION_ANALYSIS_MAX_TOOL_CALLS,
     maximumRequiredToolFormationRetries: MAXIMUM_REQUIRED_TOOL_FORMATION_RETRIES,
     exactToolArguments: true,
@@ -3149,6 +3176,7 @@ function createPlanner({
       texPdfEnabled: documentArtifactIntent.required,
       fileCreationEnabled: fileArtifactRequired,
     });
+    const blockingUnsupportedNativeHost = unsupportedNativeHostCapabilityRequired(input.prompt);
     if (documentArtifactRevision && options.priorDocument === undefined) {
       fail(
         "ANALYSIS_DOCUMENT_SOURCE_REQUIRED",
@@ -3275,6 +3303,26 @@ function createPlanner({
       return finalResult;
     };
 
+    const finalizeBlockingUnsupportedCapability = async () => {
+      const finalResult = publicFinalResult({
+        text: blockingUnsupportedCapabilityLimitText(unsupportedCapabilities),
+        toolCalls: 0,
+        artifacts,
+        executionStatus: null,
+      });
+      if (options.onFinal) await options.onFinal(finalResult);
+      assertNotAborted(signal);
+      return finalResult;
+    };
+
+    if (blockingUnsupportedNativeHost) {
+      await emitProgress("synthesizing", {
+        executionSucceeded: false,
+        artifactCount: 0,
+      });
+      return await finalizeBlockingUnsupportedCapability();
+    }
+
     const executeOnce = async (executionInput, toolCallNumber) => {
       let lastExecutionState = "";
       let terminalSuccessPending = false;