@lazyingart/agintiflow 0.20.73 → 0.20.75

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.73",
+  "version": "0.20.75",
   "type": "module",
   "description": "Low-cost, project-aware Web and CLI agents with DeepSeek/Venice/OpenAI routing, visible tool calls, durable sessions, scouts, AAPS, SCS, and guarded local execution.",
   "license": "Apache-2.0",

package/scripts/smoke-coding-tools.js

@@ -78,6 +78,31 @@ try {
   };
   const repair = repairModelMessageHistory(staleDeepSeekState, { provider: "deepseek" });
   assert(repair.changed, "stale DeepSeek history was not repaired");
+
+  const interleavedToolState = {
+    messages: [
+      { role: "system", content: "system" },
+      { role: "user", content: "do guarded writes" },
+      {
+        role: "assistant",
+        content: "",
+        tool_calls: [
+          { id: "call-a", type: "function", function: { name: "write_file", arguments: "{\"path\":\".env\",\"content\":\"TOKEN=blocked\"}" } },
+          { id: "call-b", type: "function", function: { name: "write_file", arguments: "{\"path\":\"notes/ok.md\",\"content\":\"ok\"}" } },
+        ],
+      },
+      { role: "tool", tool_call_id: "call-a", content: "{\"ok\":false,\"blocked\":true}" },
+      { role: "user", content: "Loop guard: do not repeat the blocked call." },
+      { role: "tool", tool_call_id: "call-b", content: "{\"ok\":false,\"skipped\":true}" },
+    ],
+  };
+  const interleavedRepair = repairModelMessageHistory(interleavedToolState, { provider: "openai" });
+  assert(interleavedRepair.changed, "interleaved tool-call history repair did not report a change");
+  const roles = interleavedToolState.messages.map((message) => `${message.role}:${message.tool_call_id || ""}`);
+  assert(
+    roles.join("|") === "system:|user:|assistant:|tool:call-a|tool:call-b|user:",
+    `interleaved tool-call history was not repaired into provider-valid order: ${roles.join("|")}`
+  );
   assert(
     staleDeepSeekState.messages.every(
       (message) => message.role !== "assistant" || message.reasoning_content || message.reasoningContent
@@ -530,6 +555,54 @@ try {
     });
   assert(envRun.events.some((event) => event.type === "tool.blocked"), ".env guardrail did not emit tool.blocked");
 
+  const secretContentResult = await executeWorkspaceTool(
+    "write_file",
+    {
+      path: "notes/secret-leak-report.md",
+      content: "Content attempted: DEMO_SECRET_TOKEN=aginti_fake_do_not_use\n",
+      mode: "create",
+    },
+    {
+      commandCwd: workspace,
+      allowFileTools: true,
+    }
+  );
+  assert(secretContentResult.blocked && secretContentResult.category === "workspace-content", "write_file secret-like content was not blocked");
+  await fs
+    .access(path.join(workspace, "notes/secret-leak-report.md"))
+    .then(() => {
+      throw new Error("secret-like report content was written despite content guardrails");
+    })
+    .catch((error) => {
+      if (error.code !== "ENOENT") throw error;
+    });
+
+  const redactedContentResult = await executeWorkspaceTool(
+    "write_file",
+    {
+      path: "notes/redacted-report.md",
+      content: "Content attempted: DEMO_SECRET_TOKEN=[REDACTED]\n",
+      mode: "create",
+    },
+    {
+      commandCwd: workspace,
+      allowFileTools: true,
+    }
+  );
+  assert(redactedContentResult.ok, "write_file should allow already-redacted secret placeholders");
+
+  const secretPatchResult = await executeWorkspaceTool(
+    "apply_patch",
+    {
+      patch: ["*** Begin Patch", "*** Add File: notes/secret-patch.md", "+DEMO_SECRET_TOKEN=aginti_fake_do_not_use", "*** End Patch"].join("\n"),
+    },
+    {
+      commandCwd: workspace,
+      allowFileTools: true,
+    }
+  );
+  assert(secretPatchResult.blocked && secretPatchResult.category === "workspace-content", "apply_patch secret-like additions were not blocked");
+
   const outsideRun = await runMock("Create file: ../outside-workspace.txt with blocked content.", "coding-block-outside");
   await fs
     .access(path.join(tempRoot, "outside-workspace.txt"))
@@ -548,6 +621,7 @@ try {
         workspace,
         checks: [
           "deepseek_history_repair",
+          "interleaved_tool_history_repair",
           "blocked_tool_batch_short_circuit",
           "deepseek_pro_patch_route",
           "runtime_time_context",
@@ -576,6 +650,9 @@ try {
           "patch_guardrail",
           "patch_move_no_overwrite",
           "block_env",
+          "block_secret_write_content",
+          "allow_redacted_write_content",
+          "block_secret_patch_content",
           "block_outside",
         ],
       },

package/src/agent-runner.js

@@ -213,14 +213,23 @@ function normalizeUrlPath(relativePath) {
 function preserveAssistantMessage(message) {
   const preserved = {
     role: "assistant",
-    content: message.content || "",
-    tool_calls: message.tool_calls,
+    content: redactSensitiveText(message.content || ""),
+    tool_calls: Array.isArray(message.tool_calls)
+      ? message.tool_calls.map((call) => ({
+          ...call,
+          function: {
+            ...(call.function || {}),
+            arguments:
+              typeof call.function?.arguments === "string"
+                ? redactSensitiveText(call.function.arguments)
+                : call.function?.arguments,
+          },
+        }))
+      : message.tool_calls,
   };
 
   const reasoningContent = message.reasoning_content || message.reasoningContent;
-  if (reasoningContent) {
-    preserved.reasoning_content = reasoningContent;
-  }
+  if (reasoningContent) preserved.reasoning_content = redactSensitiveText(reasoningContent);
 
   return preserved;
 }
@@ -233,6 +242,7 @@ export function repairModelMessageHistory(state, config = {}) {
       convertedAssistantMessages: 0,
       droppedToolMessages: 0,
       incompleteToolCallMessages: 0,
+      reorderedInterleavedMessages: 0,
     };
   }
 
@@ -241,6 +251,7 @@ export function repairModelMessageHistory(state, config = {}) {
   let convertedAssistantMessages = 0;
   let droppedToolMessages = 0;
   let incompleteToolCallMessages = 0;
+  let reorderedInterleavedMessages = 0;
 
   for (let index = 0; index < state.messages.length; index += 1) {
     const message = state.messages[index];
@@ -254,12 +265,21 @@ export function repairModelMessageHistory(state, config = {}) {
         const expectedIds = toolCalls.map((call) => String(call?.id || "")).filter(Boolean);
         const expected = new Set(expectedIds);
         const followingToolMessages = [];
+        const deferredInterleavedMessages = [];
         const duplicateOrUnexpectedToolMessages = [];
         const seen = new Set();
         let cursor = index + 1;
 
-        while (cursor < state.messages.length && state.messages[cursor]?.role === "tool") {
-          const toolMessage = state.messages[cursor];
+        while (cursor < state.messages.length) {
+          const nextMessage = state.messages[cursor];
+          if (nextMessage?.role !== "tool") {
+            const complete = expectedIds.length > 0 && expectedIds.every((id) => seen.has(id));
+            if (complete || nextMessage?.role === "assistant") break;
+            deferredInterleavedMessages.push(nextMessage);
+            cursor += 1;
+            continue;
+          }
+          const toolMessage = nextMessage;
           const toolCallId = String(toolMessage.tool_call_id || "");
           if (expected.has(toolCallId) && !seen.has(toolCallId)) {
             followingToolMessages.push(toolMessage);
@@ -275,12 +295,18 @@ export function repairModelMessageHistory(state, config = {}) {
           droppedAssistantMessages += 1;
           droppedToolMessages += followingToolMessages.length + duplicateOrUnexpectedToolMessages.length;
           if (!completeToolResults) incompleteToolCallMessages += 1;
+          if (deferredInterleavedMessages.length) {
+            repaired.push(...deferredInterleavedMessages);
+            reorderedInterleavedMessages += deferredInterleavedMessages.length;
+          }
           index = cursor - 1;
           continue;
         }
 
         repaired.push(preserveAssistantMessage(message));
         repaired.push(...followingToolMessages);
+        repaired.push(...deferredInterleavedMessages);
+        reorderedInterleavedMessages += deferredInterleavedMessages.length;
         droppedToolMessages += duplicateOrUnexpectedToolMessages.length;
         index = cursor - 1;
         continue;
@@ -320,6 +346,7 @@ export function repairModelMessageHistory(state, config = {}) {
     droppedAssistantMessages > 0 ||
     convertedAssistantMessages > 0 ||
     droppedToolMessages > 0 ||
+    reorderedInterleavedMessages > 0 ||
     repaired.length !== state.messages.length;
 
   if (changed) {
@@ -332,6 +359,7 @@ export function repairModelMessageHistory(state, config = {}) {
     convertedAssistantMessages,
     droppedToolMessages,
     incompleteToolCallMessages,
+    reorderedInterleavedMessages,
   };
 }
 
@@ -1372,7 +1400,7 @@ async function executeTool(browserState, toolCall, snapshot, config, store, obse
         return result;
       }
       case "finish":
-        return { ok: true, done: true, result: String(args.result || ""), toolName: "finish" };
+        return { ok: true, done: true, result: redactSensitiveText(String(args.result || "")), toolName: "finish" };
       default:
         throw new Error(`Unknown tool: ${toolCall.function.name}`);
     }
@@ -1481,7 +1509,7 @@ export async function runAgent(config) {
           taskProfile: config.taskProfile,
           goal: config.goal,
         });
-        state.plan = scsPlan.plan;
+        state.plan = redactSensitiveText(scsPlan.plan);
         state.meta.scs = scsPlan.scs;
         state.messages.push({
           role: "user",
@@ -1496,7 +1524,7 @@ export async function runAgent(config) {
         await store.appendEvent("scs.committee.plan_drafted", {
           phase: scsPlan.scs.phase,
           phaseGoal: scsPlan.scs.phaseGoal,
-          plan: scsPlan.plan,
+          plan: state.plan,
           acceptanceCriteria: scsPlan.scs.acceptanceCriteria,
         });
         await store.appendEvent(`scs.student.${scsPlan.scs.student.decision}`, scsPlan.scs.student);
@@ -1504,16 +1532,16 @@ export async function runAgent(config) {
           phase: scsPlan.scs.phase,
           phaseGoal: scsPlan.scs.phaseGoal,
         });
-        await store.savePlan(scsPlan.plan);
-        await store.appendEvent("plan.created", { plan: scsPlan.plan, scs: true });
+        await store.savePlan(state.plan);
+        await store.appendEvent("plan.created", { plan: state.plan, scs: true });
         await store.saveState(state);
-        observers.event("plan.created", { plan: scsPlan.plan, scs: true });
+        observers.event("plan.created", { plan: state.plan, scs: true });
         observers.event("scs.student.approve_plan", scsPlan.scs.student);
         emitConsole(config, `SCS: student approved phase plan (${Math.round((scsPlan.scs.student.confidence || 0) * 100)}%).`, {
           kind: "meta",
         });
       } else {
-        const plan = await createPlan(client, config, state);
+        const plan = redactSensitiveText(await createPlan(client, config, state));
         state.plan = plan;
         await store.savePlan(plan);
         await store.appendEvent("plan.created", { plan });
@@ -1718,7 +1746,7 @@ export async function runAgent(config) {
 
       await store.appendEvent("model.responded", {
         step,
-        content: assistantMessage.content || "",
+        content: redactSensitiveText(assistantMessage.content || ""),
         toolCalls: (assistantMessage.tool_calls || []).map((call) => ({
           id: call.id,
           name: call.function.name,
@@ -1727,7 +1755,7 @@ export async function runAgent(config) {
       });
       observers.event("model.responded", {
         step,
-        content: assistantMessage.content || "",
+        content: redactSensitiveText(assistantMessage.content || ""),
       });
 
       const toolCalls = assistantMessage.tool_calls || [];
@@ -1740,7 +1768,7 @@ export async function runAgent(config) {
           await store.saveState(state);
           continue;
         }
-        const fallback = assistantMessage.content?.trim() || "No tool call returned.";
+        const fallback = redactSensitiveText(assistantMessage.content?.trim() || "No tool call returned.");
         if (config.scsActive) {
           const decision = await reviewScsFinish(client, config, state, fallback, {
             events: await store.loadEvents(),
@@ -1792,6 +1820,7 @@ export async function runAgent(config) {
       }
 
       let continueForQueuedInput = false;
+      const postBatchToolResults = [];
       for (let toolIndex = 0; toolIndex < toolCalls.length; toolIndex += 1) {
         const toolCall = toolCalls[toolIndex];
         throwIfAborted(config);
@@ -1801,44 +1830,7 @@ export async function runAgent(config) {
           tool_call_id: toolCall.id,
           content: JSON.stringify(toolResult),
         });
-        await applyToolLoopGuard(state, toolResult, store, observers);
-
-        if (config.scsActive && shouldReviewToolResult(toolResult, state)) {
-          const decision = await reviewScsToolResult(client, config, state, toolResult, {
-            events: await store.loadEvents(),
-            taskProfile: config.taskProfile,
-            goal: config.goal,
-          });
-          state.meta.scs = state.meta.scs || { enabled: true, mode: config.enableScs || "on", active: true };
-          state.meta.scs.monitorReviews = (state.meta.scs.monitorReviews || 0) + 1;
-          state.meta.scs.lastStudentDecision = decision;
-          await store.appendEvent(`scs.student.${decision.decision}`, {
-            ...decision,
-            toolName: toolResult.toolName,
-          });
-          observers.event(`scs.student.${decision.decision}`, {
-            decision: decision.decision,
-            reason: decision.reason,
-            toolName: toolResult.toolName,
-          });
-          if (decision.decision === "rethink_plan" || decision.decision === "reject_phase") {
-            state.messages.push({
-              role: "user",
-              content: [
-                "SCS student monitor requested a rethink based on tool evidence.",
-                `Decision: ${decision.decision}`,
-                `Reason: ${decision.reason || "No reason provided."}`,
-                decision.nextRequiredAction ? `Next required action: ${decision.nextRequiredAction}` : "",
-                "Supervisor: do not repeat the same failed call. Adjust within the approved phase or finish with a concrete blocker if the phase is invalidated.",
-              ]
-                .filter(Boolean)
-                .join("\n"),
-            });
-            emitConsole(config, `SCS: ${decision.decision} after ${toolResult.toolName}: ${decision.reason || "reviewed"}`, {
-              kind: "meta",
-            });
-          }
-        }
+        postBatchToolResults.push(toolResult);
 
         if (toolResult.toolName === "run_command") {
           observers.log("command.output", {
@@ -1956,6 +1948,47 @@ export async function runAgent(config) {
         }
       }
 
+      for (const toolResult of postBatchToolResults) {
+        await applyToolLoopGuard(state, toolResult, store, observers);
+
+        if (config.scsActive && shouldReviewToolResult(toolResult, state)) {
+          const decision = await reviewScsToolResult(client, config, state, toolResult, {
+            events: await store.loadEvents(),
+            taskProfile: config.taskProfile,
+            goal: config.goal,
+          });
+          state.meta.scs = state.meta.scs || { enabled: true, mode: config.enableScs || "on", active: true };
+          state.meta.scs.monitorReviews = (state.meta.scs.monitorReviews || 0) + 1;
+          state.meta.scs.lastStudentDecision = decision;
+          await store.appendEvent(`scs.student.${decision.decision}`, {
+            ...decision,
+            toolName: toolResult.toolName,
+          });
+          observers.event(`scs.student.${decision.decision}`, {
+            decision: decision.decision,
+            reason: decision.reason,
+            toolName: toolResult.toolName,
+          });
+          if (decision.decision === "rethink_plan" || decision.decision === "reject_phase") {
+            state.messages.push({
+              role: "user",
+              content: [
+                "SCS student monitor requested a rethink based on tool evidence.",
+                `Decision: ${decision.decision}`,
+                `Reason: ${decision.reason || "No reason provided."}`,
+                decision.nextRequiredAction ? `Next required action: ${decision.nextRequiredAction}` : "",
+                "Supervisor: do not repeat the same failed call. Adjust within the approved phase or finish with a concrete blocker if the phase is invalidated.",
+              ]
+                .filter(Boolean)
+                .join("\n"),
+            });
+            emitConsole(config, `SCS: ${decision.decision} after ${toolResult.toolName}: ${decision.reason || "reviewed"}`, {
+              kind: "meta",
+            });
+          }
+        }
+      }
+
       if (continueForQueuedInput) continue;
 
       if (config.scsActive && shouldReviewScsProgress(step, state)) {

package/src/behavior-contract.js

@@ -69,6 +69,7 @@ export function formatBehaviorContractForPrompt({ mode = "runtime" } = {}) {
     "Make surgical edits: no drive-by refactors, unrelated formatting churn, or deletion of code you did not need to touch.",
     "Define or infer concrete success criteria for non-trivial work, then run focused checks or state why checks are unavailable.",
     "Respect the permission contract: if a tool is blocked or returns permissionAdvice, stop and present the exact suggestedCommand/approval path instead of retrying variants or inventing CLI flags.",
+    "Protect secrets aggressively: never repeat token/key/password/secret values from prompts, files, tool output, plans, final answers, reports, diffs, or artifacts. Redact the value as [REDACTED] and use dedicated key storage such as `aginti keys set` when credentials are needed.",
     "Keep artifacts durable and discoverable with descriptive non-conflicting names; never overwrite unless the user clearly asked.",
     "When reporting shell, language, runtime, build, or test results, name the actual environment used (host vs Docker, relevant interpreter/tool path/version when it matters). Do not claim compatibility across untested runtimes, hosts, containers, or language versions; state the caveat or run an explicit check.",
     "Do not self-invoke AgInTiFlow with npx/npm exec or nested aginti commands from inside the agent shell; it can resolve stale project packages or create recursive sessions. Use current runtime evidence, project/session files, or ask for a host-side diagnostic instead.",

package/src/model-client.js

@@ -6,6 +6,7 @@ import { engineeringGuidanceForTask } from "./engineering-guidance.js";
 import { formatSkillsForPrompt, selectSkillsForGoal } from "./skill-library.js";
 import { platformInfo, platformLabel } from "./platform.js";
 import { formatBehaviorContractForPrompt } from "./behavior-contract.js";
+import { redactSensitiveText } from "./redaction.js";
 
 export function createClient(config) {
   if (config.provider === "mock") {
@@ -558,7 +559,7 @@ export async function createPlan(client, config, state) {
     requestOptions(config)
   );
 
-  return response.choices[0]?.message?.content?.trim() || "1. Inspect the page.\n2. Use the smallest safe action.\n3. Finish with a concise answer.";
+  return redactSensitiveText(response.choices[0]?.message?.content?.trim() || "1. Inspect the page.\n2. Use the smallest safe action.\n3. Finish with a concise answer.");
 }
 
 export async function requestNextStep(client, config, messages) {

package/src/redaction.js

@@ -19,6 +19,11 @@ export function redactSensitiveText(value) {
   return text;
 }
 
+export function hasSensitiveText(value) {
+  const text = String(value ?? "");
+  return redactSensitiveText(text) !== text;
+}
+
 export function redactValue(value) {
   if (typeof value === "string") return redactSensitiveText(value);
   if (Array.isArray(value)) return value.map((item) => redactValue(item));

package/src/workspace-tools.js

@@ -1,7 +1,7 @@
 import crypto from "node:crypto";
 import fs from "node:fs/promises";
 import path from "node:path";
-import { redactSensitiveText } from "./redaction.js";
+import { hasSensitiveText, redactSensitiveText } from "./redaction.js";
 
 export const WORKSPACE_TOOL_NAMES = ["inspect_project", "list_files", "read_file", "search_files", "write_file", "apply_patch"];
 export const WORKSPACE_WRITE_TOOL_NAMES = ["write_file", "apply_patch"];
@@ -188,6 +188,37 @@ function pathPolicy(toolName, relativePath) {
   return { allowed: true };
 }
 
+function secretContentPolicy(content) {
+  if (!hasSensitiveText(content)) return { allowed: true };
+  return {
+    allowed: false,
+    reason:
+      "Write content appears to contain token-like secret text. Redact secret values as [REDACTED] or use dedicated key storage such as `aginti keys set`; do not write credentials into workspace files.",
+    category: "workspace-content",
+  };
+}
+
+function writeContentPolicy(toolName, args, operations = null) {
+  if (toolName === "write_file") return secretContentPolicy(args.content || "");
+  if (toolName !== "apply_patch") return { allowed: true };
+
+  if (typeof args.patch === "string" && args.patch.trim()) {
+    for (const operation of operations || []) {
+      if (operation.type === "add") {
+        const policy = secretContentPolicy(operation.content || "");
+        if (!policy.allowed) return policy;
+      }
+      for (const hunk of operation.hunks || []) {
+        const policy = secretContentPolicy(hunk.replace || "");
+        if (!policy.allowed) return policy;
+      }
+    }
+    return { allowed: true };
+  }
+
+  return secretContentPolicy(args.replace ?? "");
+}
+
 export function checkWorkspaceToolUse(toolName, args, config) {
   if (!WORKSPACE_TOOL_NAMES.includes(toolName)) return { allowed: true };
   if (!config.allowFileTools) {
@@ -196,17 +227,26 @@ export function checkWorkspaceToolUse(toolName, args, config) {
 
   try {
     if (toolName === "apply_patch" && typeof args.patch === "string" && args.patch.trim()) {
-      for (const operation of parsePatchDocument(args.patch)) {
+      const operations = parsePatchDocument(args.patch);
+      for (const operation of operations) {
         for (const candidate of [operation.path, operation.newPath].filter(Boolean)) {
           const target = resolveWorkspacePath(config, candidate);
           const policy = pathPolicy(toolName, target.relativePath);
           if (!policy.allowed) return policy;
         }
       }
+      const contentPolicy = writeContentPolicy(toolName, args, operations);
+      if (!contentPolicy.allowed) return contentPolicy;
       return { allowed: true };
     }
     const target = resolveWorkspacePath(config, args.path || ".");
-    return pathPolicy(toolName, target.relativePath);
+    const policy = pathPolicy(toolName, target.relativePath);
+    if (!policy.allowed) return policy;
+    if (WORKSPACE_WRITE_TOOL_NAMES.includes(toolName)) {
+      const contentPolicy = writeContentPolicy(toolName, args);
+      if (!contentPolicy.allowed) return contentPolicy;
+    }
+    return { allowed: true };
   } catch (error) {
     return {
       allowed: false,
@@ -591,6 +631,8 @@ async function writeChange(target, nextContent, action, details = {}) {
   if (Buffer.byteLength(content, "utf8") > MAX_WRITE_BYTES) {
     throw new Error(`Write is too large for safe workspace tools: ${target.relativePath}`);
   }
+  const contentPolicy = secretContentPolicy(content);
+  if (!contentPolicy.allowed) throw new Error(contentPolicy.reason);
 
   await fs.mkdir(path.dirname(target.absolutePath), { recursive: true });
   let beforeText = "";