@lazyingart/agintiflow 0.20.74 → 0.20.76

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.74",
+  "version": "0.20.76",
   "type": "module",
   "description": "Low-cost, project-aware Web and CLI agents with DeepSeek/Venice/OpenAI routing, visible tool calls, durable sessions, scouts, AAPS, SCS, and guarded local execution.",
   "license": "Apache-2.0",

package/scripts/smoke-coding-tools.js

@@ -78,6 +78,31 @@ try {
   };
   const repair = repairModelMessageHistory(staleDeepSeekState, { provider: "deepseek" });
   assert(repair.changed, "stale DeepSeek history was not repaired");
+
+  const interleavedToolState = {
+    messages: [
+      { role: "system", content: "system" },
+      { role: "user", content: "do guarded writes" },
+      {
+        role: "assistant",
+        content: "",
+        tool_calls: [
+          { id: "call-a", type: "function", function: { name: "write_file", arguments: "{\"path\":\".env\",\"content\":\"TOKEN=blocked\"}" } },
+          { id: "call-b", type: "function", function: { name: "write_file", arguments: "{\"path\":\"notes/ok.md\",\"content\":\"ok\"}" } },
+        ],
+      },
+      { role: "tool", tool_call_id: "call-a", content: "{\"ok\":false,\"blocked\":true}" },
+      { role: "user", content: "Loop guard: do not repeat the blocked call." },
+      { role: "tool", tool_call_id: "call-b", content: "{\"ok\":false,\"skipped\":true}" },
+    ],
+  };
+  const interleavedRepair = repairModelMessageHistory(interleavedToolState, { provider: "openai" });
+  assert(interleavedRepair.changed, "interleaved tool-call history repair did not report a change");
+  const roles = interleavedToolState.messages.map((message) => `${message.role}:${message.tool_call_id || ""}`);
+  assert(
+    roles.join("|") === "system:|user:|assistant:|tool:call-a|tool:call-b|user:",
+    `interleaved tool-call history was not repaired into provider-valid order: ${roles.join("|")}`
+  );
   assert(
     staleDeepSeekState.messages.every(
       (message) => message.role !== "assistant" || message.reasoning_content || message.reasoningContent
@@ -254,6 +279,28 @@ try {
   });
   assert(permissionAdvice.suggestedCommand.includes("coding-policy-smoke"), "permission advice did not include resume session id");
   assert(permissionAdvice.suggestedCommand.includes("--sandbox-mode docker-workspace"), "permission advice did not suggest docker-workspace recovery");
+  const destructiveAdvice = buildPermissionAdvice({
+    toolName: "run_command",
+    args: { command: "rm -rf reports && git reset --hard" },
+    guard: { category: "destructive", reason: "Destructive shell commands require Allow destructive actions." },
+    config: dockerWorkspacePolicy,
+    state: { sessionId: "coding-destructive-smoke" },
+  });
+  const destructiveAdviceText = [
+    destructiveAdvice.summary,
+    ...(destructiveAdvice.options || []),
+    destructiveAdvice.suggestedCommand,
+    destructiveAdvice.destructiveApprovalCommand,
+  ].join("\n");
+  assert(/dry-run|inspect-only/i.test(destructiveAdviceText), "destructive advice did not lead with dry-run or inspect-only alternatives");
+  assert(
+    !destructiveAdvice.suggestedCommand.includes("--allow-destructive"),
+    "default destructive advice suggested command should not enable destructive mode"
+  );
+  assert(
+    destructiveAdvice.destructiveApprovalCommand.includes("--allow-destructive"),
+    "destructive advice did not provide an explicit approval command"
+  );
   const failedNetworkAdvice = buildFailedCommandAdvice({
     args: { command: "git clone https://github.com/lazyingart/AgInTiFlow.git" },
     commandPolicy: clonePolicy,
@@ -596,6 +643,7 @@ try {
         workspace,
         checks: [
           "deepseek_history_repair",
+          "interleaved_tool_history_repair",
           "blocked_tool_batch_short_circuit",
           "deepseek_pro_patch_route",
           "runtime_time_context",

package/src/agent-runner.js

@@ -213,14 +213,23 @@ function normalizeUrlPath(relativePath) {
 function preserveAssistantMessage(message) {
   const preserved = {
     role: "assistant",
-    content: message.content || "",
-    tool_calls: message.tool_calls,
+    content: redactSensitiveText(message.content || ""),
+    tool_calls: Array.isArray(message.tool_calls)
+      ? message.tool_calls.map((call) => ({
+          ...call,
+          function: {
+            ...(call.function || {}),
+            arguments:
+              typeof call.function?.arguments === "string"
+                ? redactSensitiveText(call.function.arguments)
+                : call.function?.arguments,
+          },
+        }))
+      : message.tool_calls,
   };
 
   const reasoningContent = message.reasoning_content || message.reasoningContent;
-  if (reasoningContent) {
-    preserved.reasoning_content = reasoningContent;
-  }
+  if (reasoningContent) preserved.reasoning_content = redactSensitiveText(reasoningContent);
 
   return preserved;
 }
@@ -233,6 +242,7 @@ export function repairModelMessageHistory(state, config = {}) {
       convertedAssistantMessages: 0,
       droppedToolMessages: 0,
       incompleteToolCallMessages: 0,
+      reorderedInterleavedMessages: 0,
     };
   }
 
@@ -241,6 +251,7 @@ export function repairModelMessageHistory(state, config = {}) {
   let convertedAssistantMessages = 0;
   let droppedToolMessages = 0;
   let incompleteToolCallMessages = 0;
+  let reorderedInterleavedMessages = 0;
 
   for (let index = 0; index < state.messages.length; index += 1) {
     const message = state.messages[index];
@@ -254,12 +265,21 @@ export function repairModelMessageHistory(state, config = {}) {
         const expectedIds = toolCalls.map((call) => String(call?.id || "")).filter(Boolean);
         const expected = new Set(expectedIds);
         const followingToolMessages = [];
+        const deferredInterleavedMessages = [];
         const duplicateOrUnexpectedToolMessages = [];
         const seen = new Set();
         let cursor = index + 1;
 
-        while (cursor < state.messages.length && state.messages[cursor]?.role === "tool") {
-          const toolMessage = state.messages[cursor];
+        while (cursor < state.messages.length) {
+          const nextMessage = state.messages[cursor];
+          if (nextMessage?.role !== "tool") {
+            const complete = expectedIds.length > 0 && expectedIds.every((id) => seen.has(id));
+            if (complete || nextMessage?.role === "assistant") break;
+            deferredInterleavedMessages.push(nextMessage);
+            cursor += 1;
+            continue;
+          }
+          const toolMessage = nextMessage;
           const toolCallId = String(toolMessage.tool_call_id || "");
           if (expected.has(toolCallId) && !seen.has(toolCallId)) {
             followingToolMessages.push(toolMessage);
@@ -275,12 +295,18 @@ export function repairModelMessageHistory(state, config = {}) {
           droppedAssistantMessages += 1;
           droppedToolMessages += followingToolMessages.length + duplicateOrUnexpectedToolMessages.length;
           if (!completeToolResults) incompleteToolCallMessages += 1;
+          if (deferredInterleavedMessages.length) {
+            repaired.push(...deferredInterleavedMessages);
+            reorderedInterleavedMessages += deferredInterleavedMessages.length;
+          }
           index = cursor - 1;
           continue;
         }
 
         repaired.push(preserveAssistantMessage(message));
         repaired.push(...followingToolMessages);
+        repaired.push(...deferredInterleavedMessages);
+        reorderedInterleavedMessages += deferredInterleavedMessages.length;
         droppedToolMessages += duplicateOrUnexpectedToolMessages.length;
         index = cursor - 1;
         continue;
@@ -320,6 +346,7 @@ export function repairModelMessageHistory(state, config = {}) {
     droppedAssistantMessages > 0 ||
     convertedAssistantMessages > 0 ||
     droppedToolMessages > 0 ||
+    reorderedInterleavedMessages > 0 ||
     repaired.length !== state.messages.length;
 
   if (changed) {
@@ -332,6 +359,7 @@ export function repairModelMessageHistory(state, config = {}) {
     convertedAssistantMessages,
     droppedToolMessages,
     incompleteToolCallMessages,
+    reorderedInterleavedMessages,
   };
 }
 
@@ -1372,7 +1400,7 @@ async function executeTool(browserState, toolCall, snapshot, config, store, obse
         return result;
       }
       case "finish":
-        return { ok: true, done: true, result: String(args.result || ""), toolName: "finish" };
+        return { ok: true, done: true, result: redactSensitiveText(String(args.result || "")), toolName: "finish" };
       default:
         throw new Error(`Unknown tool: ${toolCall.function.name}`);
     }
@@ -1481,7 +1509,7 @@ export async function runAgent(config) {
           taskProfile: config.taskProfile,
           goal: config.goal,
         });
-        state.plan = scsPlan.plan;
+        state.plan = redactSensitiveText(scsPlan.plan);
         state.meta.scs = scsPlan.scs;
         state.messages.push({
           role: "user",
@@ -1496,7 +1524,7 @@ export async function runAgent(config) {
         await store.appendEvent("scs.committee.plan_drafted", {
           phase: scsPlan.scs.phase,
           phaseGoal: scsPlan.scs.phaseGoal,
-          plan: scsPlan.plan,
+          plan: state.plan,
           acceptanceCriteria: scsPlan.scs.acceptanceCriteria,
         });
         await store.appendEvent(`scs.student.${scsPlan.scs.student.decision}`, scsPlan.scs.student);
@@ -1504,16 +1532,16 @@ export async function runAgent(config) {
           phase: scsPlan.scs.phase,
           phaseGoal: scsPlan.scs.phaseGoal,
         });
-        await store.savePlan(scsPlan.plan);
-        await store.appendEvent("plan.created", { plan: scsPlan.plan, scs: true });
+        await store.savePlan(state.plan);
+        await store.appendEvent("plan.created", { plan: state.plan, scs: true });
         await store.saveState(state);
-        observers.event("plan.created", { plan: scsPlan.plan, scs: true });
+        observers.event("plan.created", { plan: state.plan, scs: true });
         observers.event("scs.student.approve_plan", scsPlan.scs.student);
         emitConsole(config, `SCS: student approved phase plan (${Math.round((scsPlan.scs.student.confidence || 0) * 100)}%).`, {
           kind: "meta",
         });
       } else {
-        const plan = await createPlan(client, config, state);
+        const plan = redactSensitiveText(await createPlan(client, config, state));
         state.plan = plan;
         await store.savePlan(plan);
         await store.appendEvent("plan.created", { plan });
@@ -1718,7 +1746,7 @@ export async function runAgent(config) {
 
       await store.appendEvent("model.responded", {
         step,
-        content: assistantMessage.content || "",
+        content: redactSensitiveText(assistantMessage.content || ""),
         toolCalls: (assistantMessage.tool_calls || []).map((call) => ({
           id: call.id,
           name: call.function.name,
@@ -1727,7 +1755,7 @@ export async function runAgent(config) {
       });
       observers.event("model.responded", {
         step,
-        content: assistantMessage.content || "",
+        content: redactSensitiveText(assistantMessage.content || ""),
       });
 
       const toolCalls = assistantMessage.tool_calls || [];
@@ -1740,7 +1768,7 @@ export async function runAgent(config) {
           await store.saveState(state);
           continue;
         }
-        const fallback = assistantMessage.content?.trim() || "No tool call returned.";
+        const fallback = redactSensitiveText(assistantMessage.content?.trim() || "No tool call returned.");
         if (config.scsActive) {
           const decision = await reviewScsFinish(client, config, state, fallback, {
             events: await store.loadEvents(),
@@ -1792,6 +1820,7 @@ export async function runAgent(config) {
       }
 
       let continueForQueuedInput = false;
+      const postBatchToolResults = [];
       for (let toolIndex = 0; toolIndex < toolCalls.length; toolIndex += 1) {
         const toolCall = toolCalls[toolIndex];
         throwIfAborted(config);
@@ -1801,44 +1830,7 @@ export async function runAgent(config) {
           tool_call_id: toolCall.id,
           content: JSON.stringify(toolResult),
         });
-        await applyToolLoopGuard(state, toolResult, store, observers);
-
-        if (config.scsActive && shouldReviewToolResult(toolResult, state)) {
-          const decision = await reviewScsToolResult(client, config, state, toolResult, {
-            events: await store.loadEvents(),
-            taskProfile: config.taskProfile,
-            goal: config.goal,
-          });
-          state.meta.scs = state.meta.scs || { enabled: true, mode: config.enableScs || "on", active: true };
-          state.meta.scs.monitorReviews = (state.meta.scs.monitorReviews || 0) + 1;
-          state.meta.scs.lastStudentDecision = decision;
-          await store.appendEvent(`scs.student.${decision.decision}`, {
-            ...decision,
-            toolName: toolResult.toolName,
-          });
-          observers.event(`scs.student.${decision.decision}`, {
-            decision: decision.decision,
-            reason: decision.reason,
-            toolName: toolResult.toolName,
-          });
-          if (decision.decision === "rethink_plan" || decision.decision === "reject_phase") {
-            state.messages.push({
-              role: "user",
-              content: [
-                "SCS student monitor requested a rethink based on tool evidence.",
-                `Decision: ${decision.decision}`,
-                `Reason: ${decision.reason || "No reason provided."}`,
-                decision.nextRequiredAction ? `Next required action: ${decision.nextRequiredAction}` : "",
-                "Supervisor: do not repeat the same failed call. Adjust within the approved phase or finish with a concrete blocker if the phase is invalidated.",
-              ]
-                .filter(Boolean)
-                .join("\n"),
-            });
-            emitConsole(config, `SCS: ${decision.decision} after ${toolResult.toolName}: ${decision.reason || "reviewed"}`, {
-              kind: "meta",
-            });
-          }
-        }
+        postBatchToolResults.push(toolResult);
 
         if (toolResult.toolName === "run_command") {
           observers.log("command.output", {
@@ -1956,6 +1948,47 @@ export async function runAgent(config) {
         }
       }
 
+      for (const toolResult of postBatchToolResults) {
+        await applyToolLoopGuard(state, toolResult, store, observers);
+
+        if (config.scsActive && shouldReviewToolResult(toolResult, state)) {
+          const decision = await reviewScsToolResult(client, config, state, toolResult, {
+            events: await store.loadEvents(),
+            taskProfile: config.taskProfile,
+            goal: config.goal,
+          });
+          state.meta.scs = state.meta.scs || { enabled: true, mode: config.enableScs || "on", active: true };
+          state.meta.scs.monitorReviews = (state.meta.scs.monitorReviews || 0) + 1;
+          state.meta.scs.lastStudentDecision = decision;
+          await store.appendEvent(`scs.student.${decision.decision}`, {
+            ...decision,
+            toolName: toolResult.toolName,
+          });
+          observers.event(`scs.student.${decision.decision}`, {
+            decision: decision.decision,
+            reason: decision.reason,
+            toolName: toolResult.toolName,
+          });
+          if (decision.decision === "rethink_plan" || decision.decision === "reject_phase") {
+            state.messages.push({
+              role: "user",
+              content: [
+                "SCS student monitor requested a rethink based on tool evidence.",
+                `Decision: ${decision.decision}`,
+                `Reason: ${decision.reason || "No reason provided."}`,
+                decision.nextRequiredAction ? `Next required action: ${decision.nextRequiredAction}` : "",
+                "Supervisor: do not repeat the same failed call. Adjust within the approved phase or finish with a concrete blocker if the phase is invalidated.",
+              ]
+                .filter(Boolean)
+                .join("\n"),
+            });
+            emitConsole(config, `SCS: ${decision.decision} after ${toolResult.toolName}: ${decision.reason || "reviewed"}`, {
+              kind: "meta",
+            });
+          }
+        }
+      }
+
       if (continueForQueuedInput) continue;
 
       if (config.scsActive && shouldReviewScsProgress(step, state)) {

package/src/behavior-contract.js

@@ -69,6 +69,7 @@ export function formatBehaviorContractForPrompt({ mode = "runtime" } = {}) {
     "Make surgical edits: no drive-by refactors, unrelated formatting churn, or deletion of code you did not need to touch.",
     "Define or infer concrete success criteria for non-trivial work, then run focused checks or state why checks are unavailable.",
     "Respect the permission contract: if a tool is blocked or returns permissionAdvice, stop and present the exact suggestedCommand/approval path instead of retrying variants or inventing CLI flags.",
+    "When destructive cleanup is blocked, lead with inspect-only or dry-run evidence (`git status`, `git clean -nd`, targeted file lists). Do not call delete/reset/clean commands safe unless they are clearly labeled as requiring explicit user approval.",
     "Protect secrets aggressively: never repeat token/key/password/secret values from prompts, files, tool output, plans, final answers, reports, diffs, or artifacts. Redact the value as [REDACTED] and use dedicated key storage such as `aginti keys set` when credentials are needed.",
     "Keep artifacts durable and discoverable with descriptive non-conflicting names; never overwrite unless the user clearly asked.",
     "When reporting shell, language, runtime, build, or test results, name the actual environment used (host vs Docker, relevant interpreter/tool path/version when it matters). Do not claim compatibility across untested runtimes, hosts, containers, or language versions; state the caveat or run an explicit check.",

package/src/model-client.js

@@ -6,6 +6,7 @@ import { engineeringGuidanceForTask } from "./engineering-guidance.js";
 import { formatSkillsForPrompt, selectSkillsForGoal } from "./skill-library.js";
 import { platformInfo, platformLabel } from "./platform.js";
 import { formatBehaviorContractForPrompt } from "./behavior-contract.js";
+import { redactSensitiveText } from "./redaction.js";
 
 export function createClient(config) {
   if (config.provider === "mock") {
@@ -558,7 +559,7 @@ export async function createPlan(client, config, state) {
     requestOptions(config)
   );
 
-  return response.choices[0]?.message?.content?.trim() || "1. Inspect the page.\n2. Use the smallest safe action.\n3. Finish with a concise answer.";
+  return redactSensitiveText(response.choices[0]?.message?.content?.trim() || "1. Inspect the page.\n2. Use the smallest safe action.\n3. Finish with a concise answer.");
 }
 
 export async function requestNextStep(client, config, messages) {

package/src/permission-advice.js

@@ -135,7 +135,40 @@ function adviceForCategory(category = "", { toolName = "", args = {}, config = {
     };
   }
 
-  if (category === "destructive" || category === "permission-change" || category === "general-shell") {
+  if (category === "destructive") {
+    return {
+      ...base,
+      summary:
+        "This command is destructive and was blocked. Do not retry variants. First offer inspect-only or dry-run cleanup evidence; destructive cleanup requires explicit user approval.",
+      options: [
+        "Inspect only: run non-destructive checks such as `git status --short`, `git clean -nd`, `find <path> -maxdepth ... -print`, or targeted file listings.",
+        "Safer cleanup plan: write a report listing exact files that would be removed, then ask the user before deletion.",
+        "Explicit destructive approval: only rerun with --allow-destructive after the user accepts the data-loss risk.",
+      ],
+      suggestedCommand: resumeCommand({
+        config,
+        state,
+        sandboxMode: "docker-workspace",
+        prompt: "Continue with inspect-only or dry-run cleanup evidence. Do not delete, reset, clean, or overwrite anything unless the user explicitly approves destructive actions.",
+      }),
+      destructiveApprovalCommand: resumeCommand({
+        config,
+        state,
+        sandboxMode: "docker-workspace",
+        destructive: true,
+        prompt: "Continue after the user explicitly approved destructive project-local cleanup. Inspect first, delete only the named targets, and verify git status afterwards.",
+      }),
+      trustedHostCommand: resumeCommand({
+        config,
+        state,
+        sandboxMode: "host",
+        destructive: true,
+        prompt: "Continue after the user explicitly approved trusted host destructive execution. Inspect first, avoid unrelated files, and keep git status understandable.",
+      }),
+    };
+  }
+
+  if (category === "permission-change" || category === "general-shell") {
     return {
       ...base,
       summary: