@lazyingart/agintiflow 0.20.92 → 0.20.94

package/README.md

@@ -155,7 +155,7 @@ aginti --resume <session-id> \
   "Take a fresh screenshot of the running app in the emulator, save it with a durable filename in this project, and keep git status clean."
 ```
 
-Permission behavior is intentionally consistent: writes inside the current project are allowed through file tools, network/setup runs are normal in approved Docker workspace mode, and outside-project or trusted-host actions stop with a clear blocker plus a suggested rerun command. See [runtime modes and autonomy](docs/runtime-modes-and-autonomy.md) for the full contract.
+Permission behavior is intentionally consistent: writes inside the current project are allowed through file tools, workspace-local toolchain builds/probes can run when their command is narrowly classified, network/setup runs are normal in approved Docker workspace mode, and outside-project or trusted-host actions stop with a clear blocker plus a suggested rerun command. See [runtime modes and autonomy](docs/runtime-modes-and-autonomy.md) for the full contract.
 
 Tmux follows the same rule. In Docker sandbox mode, `tmux_start_session` and `tmux_send_keys` are durable host tools, but their commands must stay workspace-bound. In host mode, tmux startup/send command text follows the same host shell policy as `run_command`; broad host shell work needs explicit `--allow-destructive`. Use `--sandbox-mode host --allow-destructive` only when a tmux task really needs trusted whole-host execution.
 
@@ -167,7 +167,7 @@ Use these when you want explicit control instead of the default interactive poli
 | --- | --- | --- |
 | Strict inspection | `aginti --sandbox-mode docker-readonly --package-install-policy block --allow-shell --no-file-tools --no-web-search "inspect this project without edits"` | Enforced read-only project inspection through shell commands such as `ls`, `rg`, `cat`, and test commands that do not write. No file-tool writes, web calls, workspace writes, or installs. |
 | Full write in current folder | `aginti --sandbox-mode docker-workspace --package-install-policy allow --approve-package-installs --allow-shell --allow-file-tools "build and test this project"` | Read/write inside the current project folder, run network/setup commands in Docker, keep host safer. |
-| Full host computer access | `aginti --sandbox-mode host --package-install-policy allow --approve-package-installs --allow-shell --allow-file-tools --allow-destructive "perform the trusted host maintenance task"` | Direct host shell and destructive actions. Use only when you trust the task and want whole-host access. |
+| Full host computer access | `aginti --sandbox-mode host --package-install-policy allow --approve-package-installs --allow-shell --allow-file-tools --allow-destructive "perform the trusted host maintenance task"` | Direct host shell and destructive actions. Use only when you trust the task and want whole-host access. Android emulator/device work often needs this because the SDK and emulator live on the host. |
 
 For resume:
 

package/docs/runtime-modes-and-autonomy.md

@@ -13,7 +13,7 @@ The failed task was expected under the current Docker design, but the agent shou
 
 The fix is guidance plus guardrails: raw `tmux` shell commands are blocked inside Docker `run_command`, and the model is told to use host tmux tools for durable sessions.
 
-Important boundary: host tmux tools are durable, but they are not a permission escape hatch. In `docker-readonly` and `docker-workspace` modes, `tmux_start_session` and `tmux_send_keys` are still workspace-bound. Startup commands and sent shell text must use relative paths under the project, not absolute host paths outside the project. In `host` mode, tmux startup/send command text follows the same host shell policy as `run_command`, so broad host shell work requires `--allow-destructive`. If a task really needs `/home/...`, `/etc/...`, an emulator outside the project, or whole-host maintenance, rerun explicitly with `--sandbox-mode host --allow-destructive`.
+Important boundary: host tmux tools are durable, but they are not a permission escape hatch. In `docker-readonly` and `docker-workspace` modes, `tmux_start_session` and `tmux_send_keys` are still workspace-bound. Startup commands and sent shell text must use relative paths under the project, not absolute host paths outside the project. In `host` mode, tmux startup/send command text follows the same host shell policy as `run_command`, so broad host shell work requires `--allow-destructive`. Narrow workspace-local probes/builds can run without full-host trust, but if a task really needs `/home/...`, `/etc/...`, an emulator outside the project, or whole-host maintenance, rerun explicitly with `--sandbox-mode host --allow-destructive`.
 
 ## Execution Modes
 
@@ -51,11 +51,13 @@ The runtime must be consistent when an action is not permitted. A blocked action
 Current contract:
 
 - Workspace file tools may read and write inside the configured project folder when file tools are enabled.
+- Narrow workspace-local shell actions such as safe probes, Gradle/TeX builds, and `chmod +x` on a project script may run when the command policy can classify them precisely.
 - Workspace writes outside that folder, secret paths, `.git` internals, and dependency folders such as `node_modules` are blocked.
 - `git clone`, `git fetch`, `git pull --ff-only`, `git push`, `curl`, and `wget` are classified as network operations.
 - Network/setup commands are allowed in `docker-workspace` only when package installs are approved.
 - Host `sudo` and host OS package installs are not automatic. The agent should ask the user to run a manual command or switch to a safer Docker setup.
 - Destructive host shell/git operations need explicit trusted host mode.
+- Android SDK/emulator work commonly needs host mode because `adb`, emulator images, and device state live outside Docker; use trusted host mode for install/launch/screenshot steps when the user approves that host access.
 
 When a tool is blocked, the tool result includes `permissionAdvice` with three choices: refuse/stop, approve a safer rerun, or switch to a trusted host run. The model prompt requires the agent to present that blocker and avoid retrying variants until the user approves a path.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.92",
+  "version": "0.20.94",
   "type": "module",
   "description": "Low-cost, project-aware Web and CLI agents with DeepSeek/Venice/OpenAI routing, visible tool calls, durable sessions, scouts, AAPS, SCS, and guarded local execution.",
   "license": "Apache-2.0",

package/scripts/smoke-coding-tools.js

@@ -270,6 +270,14 @@ try {
     ...dockerWorkspacePolicy,
     packageInstallPolicy: "block",
   };
+  const hostWorkspacePolicy = {
+    allowShellTool: true,
+    useDockerSandbox: false,
+    sandboxMode: "host",
+    packageInstallPolicy: "allow",
+    allowDestructive: false,
+    commandCwd: workspace,
+  };
   const readonlyProbePolicy = evaluateCommandPolicy(
     'which pdflatex 2>&1; which latexmk 2>&1; echo "---"; find /workspace -name \'*.tex\' -maxdepth 3 2>/dev/null; echo "exit: $?"',
     dockerWorkspaceNoInstallsPolicy
@@ -326,6 +334,21 @@ try {
   assert(safeChmodAndRunPolicy.allowed, "safe workspace chmod + script run sequence should be allowed in docker-workspace allow mode");
   const unsafeChmodPolicy = evaluateCommandPolicy("chmod +x /etc/passwd", dockerWorkspacePolicy);
   assert(!unsafeChmodPolicy.allowed, "chmod outside the workspace should be blocked");
+  const hostWorkspaceChmodPolicy = evaluateCommandPolicy("chmod +x android-app/gradlew && echo \"CHMOD_OK\"", hostWorkspacePolicy);
+  assert(hostWorkspaceChmodPolicy.allowed, "host mode should allow workspace-local chmod without full-host destructive access");
+  assert(
+    hostWorkspaceChmodPolicy.category === "permission-change",
+    "host workspace chmod sequence should remain categorized as permission-change"
+  );
+  const androidReadonlyProbePolicy = evaluateCommandPolicy(
+    'test -x /usr/bin/gradle && echo "GRADLE_OK" ; test -x /usr/bin/java && /usr/bin/java -version 2>&1 | head -1; adb devices; emulator -list-avds; find android-app -type f | sort',
+    hostWorkspacePolicy
+  );
+  assert(androidReadonlyProbePolicy.allowed, "Android host read-only probes should not require full-host destructive access");
+  assert(androidReadonlyProbePolicy.category === "read-only", "Android host probes should remain read-only");
+  const androidGradleBuildPolicy = evaluateCommandPolicy("cd android-app && ./gradlew :app:assembleDebug", hostWorkspacePolicy);
+  assert(androidGradleBuildPolicy.allowed, "workspace-local Gradle Android build should be allowed in host workspace mode");
+  assert(androidGradleBuildPolicy.category === "toolchain", "workspace-local Gradle Android build should be toolchain");
   const cdWorkspacePolicy = evaluateCommandPolicy("cd /workspace && git status --short 2>&1 | head -20", dockerWorkspacePolicy);
   assert(cdWorkspacePolicy.allowed, "cd /workspace should be allowed in docker-workspace mode");
   const gitCleanDryRunPolicy = evaluateCommandPolicy("git clean -nd reports", dockerWorkspacePolicy);
@@ -338,8 +361,21 @@ try {
   assert(localGitCommitPolicy.category === "git-workflow", "local git commit should be classified as git-workflow");
   const localGitSwitchPolicy = evaluateCommandPolicy("git switch -c feature-a", dockerWorkspaceNoInstallsPolicy);
   assert(localGitSwitchPolicy.allowed, "local git switch -c should be allowed without package installs");
+  const localGitCheckoutExistingPolicy = evaluateCommandPolicy("git checkout main", dockerWorkspaceNoInstallsPolicy);
+  assert(localGitCheckoutExistingPolicy.allowed, "local git checkout existing branch should be allowed without package installs");
   const localGitMergePolicy = evaluateCommandPolicy("git merge --ff-only feature-a", dockerWorkspaceNoInstallsPolicy);
   assert(localGitMergePolicy.allowed, "local git fast-forward merge should be allowed without package installs");
+  const localGitNoFfMergePolicy = evaluateCommandPolicy("git merge --no-ff --no-edit feature-b", dockerWorkspaceNoInstallsPolicy);
+  assert(localGitNoFfMergePolicy.allowed, "local git explicit no-ff merge should be allowed without package installs");
+  const localGitNoFfMergeAltPolicy = evaluateCommandPolicy("git merge --no-ff feature-b --no-edit", dockerWorkspaceNoInstallsPolicy);
+  assert(localGitNoFfMergeAltPolicy.allowed, "local git explicit no-ff merge alternate arg order should be allowed");
+  const localGitWorkflowSequencePolicy = evaluateCommandPolicy(
+    "cd /workspace/git-practice && git checkout main && git merge --ff-only feature-a",
+    dockerWorkspaceNoInstallsPolicy
+  );
+  assert(localGitWorkflowSequencePolicy.allowed, "local git checkout + ff-only merge sequence should be allowed without package installs");
+  const plainGitMergePolicy = evaluateCommandPolicy("git merge feature-a", dockerWorkspaceNoInstallsPolicy);
+  assert(!plainGitMergePolicy.allowed, "plain git merge should stay guarded because it can hang or make an ambiguous merge");
   const unsafeRebasePolicy = evaluateCommandPolicy("git rebase main", dockerWorkspaceNoInstallsPolicy);
   assert(!unsafeRebasePolicy.allowed, "git rebase should still require stronger permission because it rewrites history");
   const unsafeCloneTarget = evaluateCommandPolicy("git clone https://github.com/lazyingart/AgInTiFlow.git ../AgInTiFlow", dockerWorkspacePolicy);
@@ -780,6 +816,9 @@ try {
           "command_policy_git_rebase_still_guarded",
           "command_policy_git_clone_network",
           "command_policy_safe_chmod_sequence",
+          "command_policy_host_workspace_chmod",
+          "command_policy_android_host_probes",
+          "command_policy_android_gradle_build",
           "command_policy_cd_workspace",
           "command_policy_git_clean_dry_run",
           "permission_recovery_advice",

package/scripts/smoke-tmux-tools.js

@@ -126,6 +126,25 @@ try {
   });
   assert.equal(dockerTmuxRelativeStart.allowed, true, "Docker-mode tmux_start_session should allow workspace-relative paths");
 
+  const dockerTmuxGitFfMergeStart = checkToolUse({
+    toolName: "tmux_start_session",
+    args: {
+      name: `${session}-docker-git-ff`,
+      cwd: ".",
+      command: "git checkout main && git merge --ff-only feature-a",
+    },
+    config: dockerNoInstallsConfig,
+  });
+  assert.equal(dockerTmuxGitFfMergeStart.allowed, true, "Docker-mode tmux should allow explicit local checkout + ff-only merge workflow");
+
+  const dockerTmuxGitPlainMergeStart = checkToolUse({
+    toolName: "tmux_start_session",
+    args: { name: `${session}-docker-git-plain-merge`, cwd: ".", command: "git merge feature-a" },
+    config: dockerNoInstallsConfig,
+  });
+  assert.equal(dockerTmuxGitPlainMergeStart.allowed, false, "Docker-mode tmux should keep plain git merge guarded");
+  assert.equal(dockerTmuxGitPlainMergeStart.category, "destructive", "plain git merge should keep destructive category");
+
   const dockerTmuxRebaseStart = checkToolUse({
     toolName: "tmux_start_session",
     args: { name: `${session}-docker-rebase`, cwd: ".", command: "git rebase main" },
@@ -235,6 +254,8 @@ try {
           "docker-tmux-start-project-path-allowed",
           "docker-tmux-start-relative-path-allowed",
           "docker-tmux-start-command-policy-guardrail",
+          "docker-tmux-start-git-ff-merge-allowed",
+          "docker-tmux-start-plain-git-merge-guarded",
           "docker-tmux-send-command-policy-guardrail",
           "docker-tmux-send-readonly-command-allowed",
           "host-tmux-start-shell-policy-guardrail",

package/skills/android/SKILL.md

@@ -22,12 +22,13 @@ tools:
 
 1. Inspect before editing: `git status --short`, project tree, Gradle/settings files, AndroidManifest, package names, modules, Java/Kotlin versions, `ANDROID_HOME`/`ANDROID_SDK_ROOT`, likely SDK folders, `adb devices`, and emulator/AVD availability.
 2. Do not use host `sudo`, `apt`, `dnf`, `yum`, `brew`, `winget`, or global host installs for Android app work. These can hang on password prompts or mutate the user's machine. Prefer existing Android SDK tools, project-local Gradle wrapper setup, user-writable caches, or a clear setup report with the exact manual command.
-3. If a Gradle wrapper is needed, create `gradle/wrapper/` before downloading files. Prefer a valid project-local wrapper or an already-installed Gradle. Do not loop on the same failed install/download.
-4. Patch source-set-aware files only: manifests, Gradle scripts, Kotlin/Java sources, XML resources, and project docs. Keep generated build outputs out of patches and commits.
-5. Build with the narrowest useful task first, usually `./gradlew :app:assembleDebug` or `./gradlew assembleDebug`. Repair build failures from the actual error text.
-6. Install and launch on an available device/emulator with `adb install` and `adb shell am start`. Verify with `adb shell pidof`, `adb logcat -d`, `adb shell screencap`, or similar evidence when available.
-7. Save screenshots and APK references in durable workspace paths with descriptive names when the user did not specify paths, for example `artifacts/screenshots/<app>-<timestamp>.png` and `app/build/outputs/apk/debug/app-debug.apk`. Do not rely only on a temporary screenshot that is deleted after canvas preview.
-8. Commit only after build/install/launch verification, with a clear message. Before final summary, run `git status --short`; leave source changes committed and generated/session artifacts ignored or explicitly reported. If no device/emulator exists, finish with a concrete external blocker and the generated APK path.
+3. Android SDK and emulator tooling usually lives on the host, not inside Docker. If a permission block appears while using a host SDK/emulator, prefer the exact trusted host resume command from `permissionAdvice.trustedHostCommand` over a Docker rerun unless the SDK is explicitly mounted in Docker.
+4. If a Gradle wrapper is needed, create `gradle/wrapper/` before downloading files. Prefer a valid project-local wrapper or an already-installed Gradle. Do not loop on the same failed install/download.
+5. Patch source-set-aware files only: manifests, Gradle scripts, Kotlin/Java sources, XML resources, and project docs. Keep generated build outputs out of patches and commits.
+6. Build with the narrowest useful task first, usually `./gradlew :app:assembleDebug` or `./gradlew assembleDebug`. Repair build failures from the actual error text.
+7. Install and launch on an available device/emulator with `adb install` and `adb shell am start`. Verify with `adb shell pidof`, `adb logcat -d`, `adb shell screencap`, or similar evidence when available.
+8. Save screenshots and APK references in durable workspace paths with descriptive names when the user did not specify paths, for example `artifacts/screenshots/<app>-<timestamp>.png` and `app/build/outputs/apk/debug/app-debug.apk`. Do not rely only on a temporary screenshot that is deleted after canvas preview.
+9. Commit only after build/install/launch verification, with a clear message. Before final summary, run `git status --short`; leave source changes committed and generated/session artifacts ignored or explicitly reported. If no device/emulator exists, finish with a concrete external blocker and the generated APK path.
 
 ## Missing Tooling
 

package/skills/github-maintenance/SKILL.md

@@ -20,6 +20,6 @@ tools:
 
 Always inspect `git status --short` and relevant diffs before committing or pushing. Keep commits scoped and stop on conflicts, divergence, or unrelated dirty work.
 
-For local workflow practice or repository setup, prefer a disposable subdirectory if the user did not clearly target the current repository. Configure only local git identity (`git config user.name`, `git config user.email`) inside that repo; never change global git config. Use accurate git scenarios: a fast-forward merge means the target branch has not diverged; a non-fast-forward merge intentionally creates a merge commit after both branches diverge; a rebase rewrites local branch commits and should be used only in an explicitly disposable/local branch or after user approval.
+For local workflow practice or repository setup, prefer a disposable subdirectory if the user did not clearly target the current repository. Configure only local git identity (`git config user.name`, `git config user.email`) inside that repo; never change global git config. Use policy-friendly local commands: `git switch <branch>` or `git checkout <branch>` for existing branches, `git switch -c <branch>` or `git checkout -b <branch>` for new branches, `git merge --ff-only <branch>` for fast-forward evidence, and `git merge --no-ff --no-edit <branch>` for explicit merge-commit evidence. Avoid plain `git merge <branch>` because it can hang on an editor or make an ambiguous merge. Use accurate git scenarios: a fast-forward merge means the target branch has not diverged; a non-fast-forward merge intentionally creates a merge commit after both branches diverge; a rebase rewrites local branch commits and should be used only in an explicitly disposable/local branch or after user approval.
 
 Use `gh` for PR/release/status workflows when authenticated. Fold long command output but preserve key errors, URLs, branch names, and commit hashes.

package/src/command-policy.js

@@ -15,6 +15,7 @@ const READ_ONLY_PATTERNS = [
   /^cat(?:\s+[-\w./~*]+)+$/,
   /^head(?:\s+.+)?$/,
   /^tail(?:\s+.+)?$/,
+  /^sort(?:\s+[-\w./~*]+)*$/,
   /^wc(?:\s+.+)?$/,
   /^sed\s+-n\s+['"0-9,:p\s-]+\s+[-\w./~*]+$/,
   /^git\s+(status|branch|log|show|diff(?:\s+--stat)?|remote\s+-v)(?:\s+.+)?$/,
@@ -23,6 +24,11 @@ const READ_ONLY_PATTERNS = [
   /^python(?:3)?\s+--version$/,
   /^pip(?:3)?\s+--version$/,
   /^conda\s+--version$/,
+  /^(?:[-/\w.]+\/)?java\s+-version$/,
+  /^(?:[-/\w.]+\/)?gradle\s+--version$/,
+  /^(?:[-/\w.]+\/)?adb\s+devices(?:\s+-l)?$/,
+  /^(?:[-/\w.]+\/)?emulator\s+-list-avds$/,
+  /^(?:[-/\w.]+\/)?sdkmanager\s+--list(?:\s+[-\w./:=]+)*$/,
   /^(?:pdflatex|latexmk)\s+--version$/,
   /^test\s+-[efdx]\s+[-\w./~]+$/,
   /^true$/,
@@ -81,9 +87,13 @@ const GIT_WORKFLOW_PATTERNS = [
   /^git\s+branch\s+[A-Za-z0-9][-\w./]*$/,
   /^git\s+switch\s+(?:-c\s+)?[A-Za-z0-9][-\w./]*$/,
   /^git\s+checkout\s+-b\s+[A-Za-z0-9][-\w./]*$/,
+  /^git\s+checkout\s+[A-Za-z0-9][-\w./]*$/,
   /^git\s+merge\s+--ff-only\s+[A-Za-z0-9][-\w./]*$/,
   /^git\s+merge\s+--no-ff\s+--no-edit\s+[A-Za-z0-9][-\w./]*$/,
+  /^git\s+merge\s+--no-ff\s+[A-Za-z0-9][-\w./]*\s+--no-edit$/,
+  /^git\s+merge\s+--no-edit\s+--no-ff\s+[A-Za-z0-9][-\w./]*$/,
   /^git\s+merge\s+[A-Za-z0-9][-\w./]*\s+--no-ff\s+--no-edit$/,
+  /^git\s+merge\s+[A-Za-z0-9][-\w./]*\s+--no-edit\s+--no-ff$/,
   /^git\s+fetch(?:\s+[-\w./:=]+)*$/,
   /^git\s+pull\s+--ff-only(?:\s+[-\w./:=]+)*$/,
   /^git\s+push(?:\s+[-\w./:=]+)*$/,
@@ -96,6 +106,7 @@ const UNSAFE_GIT_PATTERNS = [
 
 const TOOLCHAIN_PATTERNS = [
   /^python(?:3)?\s+[-\w./]+\.py(?:\s+[-\w./:=]+)*$/,
+  /^\.\/gradlew\s+(?:(?::[-\w]+:)?(?:assembleDebug|assembleRelease|bundleDebug|bundleRelease|compileDebugKotlin|compileReleaseKotlin|testDebugUnitTest|lintDebug|lint|check|build))(?:\s+[-\w./:=]+)*$/,
   /^latexmk\s+(?=[-\w./=\s]*-pdf\b)(?:(?:-cd|-pdf|-interaction=nonstopmode|-halt-on-error|-output-directory=[-\w./]+)\s+)+[-\w./]+\.tex$/,
   /^pdflatex\s+(?:(?:-interaction=nonstopmode|-halt-on-error|-output-directory=[-\w./]+|-jobname\s+[-\w./]+)\s+)*[-\w./]+\.tex$/,
 ];
@@ -647,7 +658,7 @@ export function evaluateCommandPolicy(command, config) {
     };
   }
 
-  if (classification.category === "permission-change" && !trustedDockerShell && !trustedHostShell) {
+  if (classification.category === "permission-change" && sandboxMode !== "host" && !trustedDockerShell && !trustedHostShell) {
     return {
       allowed: false,
       ...classification,

package/src/task-profiles.js

@@ -227,7 +227,7 @@ export const TASK_PROFILES = {
     id: "android",
     label: "Android",
     prompt:
-      "Bias toward end-to-end Android app delivery while still handling normal project work. Inspect git status, existing Gradle files, AndroidManifest, SDK paths, Java/Kotlin versions, adb devices, and emulator/AVD availability before editing. Do not use host sudo, apt, dnf, yum, brew, winget, or global host installs during Android tasks; prefer the existing Android SDK, project-local Gradle wrapper, user-writable caches, or a clear setup report. Create missing wrapper directories before downloads, avoid repeated failing install attempts, build with focused Gradle tasks, install and launch with adb when a device/emulator exists, verify with am/logcat/screencap when possible, save screenshots under durable workspace paths, and commit the finished app only after checks.",
+      "Bias toward end-to-end Android app delivery while still handling normal project work. Inspect git status, existing Gradle files, AndroidManifest, SDK paths, Java/Kotlin versions, adb devices, and emulator/AVD availability before editing. Do not use host sudo, apt, dnf, yum, brew, winget, or global host installs during Android tasks; prefer the existing Android SDK, project-local Gradle wrapper, user-writable caches, or a clear setup report. Android SDK/emulator work usually needs host mode because device tools live outside Docker; if host policy blocks a required project-local build/probe, present the exact trusted host resume command from permissionAdvice rather than suggesting Docker as the primary route. Create missing wrapper directories before downloads, avoid repeated failing install attempts, build with focused Gradle tasks, install and launch with adb when a device/emulator exists, verify with am/logcat/screencap when possible, save screenshots under durable workspace paths, and commit the finished app only after checks.",
     tools: ["inspect_project", "search_files", "read_file", "apply_patch", "shell", "sandbox", "canvas"],
   },
   website: {
@@ -255,7 +255,7 @@ export const TASK_PROFILES = {
     id: "github",
     label: "GitHub maintenance",
     prompt:
-      "Bias toward safe git and GitHub maintenance while still fixing code/docs when asked. Always inspect git status and remotes first, separate unrelated changes, run relevant checks before commits, use gh when available for PR/issues/releases, prefer fast-forward pulls, and stop on conflicts or ambiguous history. For local workflow practice, use a disposable subdirectory, set only local git identity, avoid real remotes unless explicitly requested, and describe fast-forward, non-fast-forward merge, and rebase evidence accurately.",
+      "Bias toward safe git and GitHub maintenance while still fixing code/docs when asked. Always inspect git status and remotes first, separate unrelated changes, run relevant checks before commits, use gh when available for PR/issues/releases, prefer fast-forward pulls, and stop on conflicts or ambiguous history. For local workflow practice, use a disposable subdirectory, set only local git identity, avoid real remotes unless explicitly requested, prefer `git switch <branch>`/`git checkout <branch>` for branch changes, use `git merge --ff-only <branch>` for fast-forward evidence, use `git merge --no-ff --no-edit <branch>` for intentional merge commits, avoid plain `git merge <branch>`, and describe fast-forward, non-fast-forward merge, and rebase evidence accurately.",
     tools: ["shell", "files", "web_search", "inspect_project"],
   },
   word: {