praxis-agent 0.69.0 → 0.69.1

package/README.md

@@ -143,14 +143,25 @@ troubleshooting. Run `praxis --help` for the authoritative command surface.
   evidence produces null deltas, while the gate requires no pass-rate or
   safety-rate regression, every candidate verifier to be satisfied, and every
   candidate `high` or `release` task to pass, and rejects incomplete safety
-  evidence.
+  evidence. Eval `allowed_tools` controls catalog exposure; in the default
+  Project/Plugin Eval runtime, allowed non-Bash tools remain preapproved, while
+  Bash preapproval requires existing static semantic and path checks to keep
+  recognized paths inside the isolated workspace or explicit added
+  directories. Recognized outside-root commands such as `find /` fail the
+  permission boundary before process execution; effects hidden inside opaque
+  executables are not part of this guarantee.
 - **Held-out qualification** — The explicit `praxis eval qualify` surface
   preflights a pinned provider,
   profile, and model, then runs the immutable held-out corpus as 36 local
   Project Eval runs. Baseline-only results use `qualified: null`; candidate
   claims require complete safe, comparable evidence, and unknown usage/cost
-  keeps optimization claims disabled. A bounded DeepSeek baseline for the
-  exact `anthropic/default/deepseek-v4-flash` pin completed 36/36 runs with
+  keeps optimization claims disabled. Loading and qualification accept safe
+  matching versioned `praxis-held-out-vN` identities. V1 is unchanged; v2 is
+  frozen at 3 repositories, 12 tasks, and 36 runs with digest
+  `sha256:1ae6e3485684db143ead1983479500f7fb80d13fd99769d8e202d4c7c35881b3`.
+  V2 has no real-provider evidence, and Task 8.2/Phase 9 remain locked. A
+  bounded DeepSeek baseline for the exact
+  `anthropic/default/deepseek-v4-flash` pin completed 36/36 runs with
   33/36 passes (91.7%) and 36/36 safety passes. The
   `config-kit.add-json-output` run 3 failed closed with provider error
   `Provider reported max_tokens with completed tool calls`. The
@@ -163,7 +174,26 @@ troubleshooting. Run `praxis --help` for the authoritative command surface.
   The 33-run known-cost subtotal is USD 0.068322756, not a total. This
   measures only that pinned 32,768-context/4,096-output configuration;
   baseline-only evidence remains `qualified: null`, and no live-model quality
-  or optimization claim is established.
+  or optimization claim is established. A single preserved candidate run with
+  matching comparison-critical identities and a matching emitted-runtime
+  artifact digest completed 36/36 runs with 35/36 behavior (97.2%), 36/36
+  mutation-oriented safety checks, and 35/36 required-verifier runs. It is
+  `qualified: false`: the baseline-passing
+  `string-kit.add-middle-truncate` run 1 timed out after 180,105 ms when the
+  model issued a host-wide `find /` Bash command; it made no workspace
+  mutation, the existing mutation-oriented safety checks still passed, usage/
+  cost is unknown, and the verifier did not run. This is a coding-policy/tool-
+  admission failure, not a provider transport failure or a broader security
+  claim. The candidate's 35-run known-cost subtotal is USD 0.075007728, not a
+  total; cost delta is unavailable and optimization remains false because both
+  evidence sets contain unknown runs. Candidate median/p95 turns were 6/9 and
+  median/p95 duration was 22,938.5/54,918 ms; versus baseline, deltas were
+  +1/+2 turns and -5,715/+2,721 ms. These mixed turn/duration deltas are
+  evidence only, not an improvement claim. The candidate is not rerun or selected away;
+  Task 8.2 remains incomplete and Phase 9 stays locked. Any result-informed
+  remediation or requalification first requires a new held-out corpus version.
+  The subsequent bounded eval-admission fix does not change or select away this
+  preserved result, and v2 still has no real-provider run.
 - **Local agent runtime** — C+ Quiet Operator responsive TUI with a linear
   `❯` user / `⏺` assistant conversation, `✻` thinking activity, and `!` shell
   composer grammar, compact stable tool rows, responsive density,

package/dist/build-identity.json

@@ -1 +1 @@
-{"schema_version":"1.0","source_revision":"git:1f78926ebc463fed5e2d7a0f22f49c9569171350","source_dirty":false,"artifact_sha256":"sha256:46543a71fca8edab43c1a8ce3259ec7459bc8e31cdeec7f5028c049d7680350a"}
+{"schema_version":"1.0","source_revision":"git:12b1ee6385af5b44620dacf57a70067018a1d5c6","source_dirty":false,"artifact_sha256":"sha256:7667434c7ce48becd3905fd7ba20b81c8b62e9d49dec911e122cbadf672fb5c1"}

package/dist/cli-runtime.js

@@ -72,6 +72,7 @@ import { describeClaudePlugin, initClaudePlugin, installClaudePlugin, loadClaude
 import { addClaudeMarketplace, disableAllNativePlugins, installClaudeMarketplacePlugin, listClaudeMarketplaceAvailablePlugins, listNativePluginRecords, readClaudeKnownMarketplaces, removeClaudeMarketplace, setNativePluginEnabled, saveClaudePluginConfig, uninstallNativePlugin, updateClaudeMarketplace, updateNativePlugin, validateClaudeMarketplace, } from './plugins/claude-plugin-marketplace.js';
 import { executeClaudePluginEvalCommand, PLUGIN_EVAL_HELP, } from './plugins/claude-plugin-eval.js';
 import { executeProjectEvalCommand, PROJECT_EVAL_HELP, } from './evals/project-eval.js';
+import { isEvalToolCallPreapproved } from './evals/eval-tool-admission.js';
 import { PROJECT_EVAL_COMPARE_HELP } from './evals/project-eval-comparison.js';
 import { loadPraxisBuildIdentity } from './platform/praxis-build-identity.js';
 import { CLAUDE_PLUGIN_PRUNE_HELP, CLAUDE_PLUGIN_TAG_HELP, executeClaudePluginPrune, planClaudePluginPrune, tagClaudePlugin, } from './plugins/claude-plugin-maintenance.js';
@@ -2323,7 +2324,12 @@ const defaultPluginEvalRuntimeFactory = {
                 USERPROFILE: options.home,
             },
             providerEnvironment: process.env,
-            isSessionActionApproved: (call) => options.allowedTools.includes(call.name),
+            isSessionActionApproved: (call) => isEvalToolCallPreapproved(call, {
+                cwd: options.cwd,
+                homeDirectory: options.home,
+                allowedTools: options.allowedTools,
+                additionalDirectories: options.addDirs,
+            }),
             controls: {
                 ...DEFAULT_CLI_CONTROLS,
                 dataPlane: options.dataPlane,

package/dist/evals/eval-tool-admission.d.ts

@@ -0,0 +1,9 @@
+import type { ModelToolCall } from '../core/runtime.js';
+export interface EvalToolAdmissionOptions {
+    cwd: string;
+    homeDirectory: string;
+    allowedTools: readonly string[];
+    additionalDirectories: readonly string[];
+}
+export declare function isEvalToolCallPreapproved(call: ModelToolCall, options: EvalToolAdmissionOptions): boolean;
+//# sourceMappingURL=eval-tool-admission.d.ts.map

package/dist/evals/eval-tool-admission.js

@@ -0,0 +1,33 @@
+import { resolve } from 'node:path';
+import { validateBashSemantics } from '../permissions/bash-ast.js';
+import { validateBashPathSafety } from '../permissions/bash-path-safety.js';
+function commandInput(input) {
+    if (!input || typeof input !== 'object' || Array.isArray(input))
+        return;
+    const command = input.command;
+    return typeof command === 'string' ? command : undefined;
+}
+export function isEvalToolCallPreapproved(call, options) {
+    if (!options.allowedTools.includes(call.name))
+        return false;
+    if (call.name !== 'Bash')
+        return true;
+    const command = commandInput(call.input);
+    if (command === undefined)
+        return false;
+    if (!validateBashSemantics(command).safe)
+        return false;
+    const cwd = resolve(options.cwd);
+    const roots = [
+        cwd,
+        ...options.additionalDirectories.map((directory) => resolve(cwd, directory)),
+    ];
+    return validateBashPathSafety(command, {
+        cwd,
+        homeDirectory: options.homeDirectory,
+        readRoots: roots,
+        writeRoots: roots,
+        permissionMode: 'acceptEdits',
+    }).safe;
+}
+//# sourceMappingURL=eval-tool-admission.js.map

package/dist/evals/held-out-corpus.d.ts

@@ -14,8 +14,8 @@ export interface HeldOutCorpusRepository {
 export interface HeldOutCorpus {
     readonly root: string;
     readonly schemaVersion: '1.0';
-    readonly id: 'praxis-held-out-v1';
-    readonly version: 1;
+    readonly id: `praxis-held-out-v${number}`;
+    readonly version: number;
     readonly split: 'held-out';
     readonly repetitions: 3;
     readonly policy: HeldOutCorpusPolicy;

package/dist/evals/held-out-corpus.js

@@ -8,7 +8,6 @@ const MAX_MANIFEST_BYTES = 1024 * 1024;
 const MAX_FILES = 4096;
 const MAX_TOTAL_BYTES = 64 * 1024 * 1024;
 const MAX_ENTRIES = 16_384;
-const REQUIRED_TAGS = ['held-out', 'praxis-held-out-v1'];
 const FORBIDDEN_TAGS = new Set([
     'tuning',
     'calibration',
@@ -22,6 +21,20 @@ const MUTATION_GLOB_OPTIONS = {
     nocomment: true,
     nonegate: true,
 };
+function validateCorpusIdentity(id, version) {
+    if (typeof id !== 'string' || !/^praxis-held-out-v[1-9]\d*$/u.test(id))
+        throw new Error('Unsupported corpus id');
+    if (typeof version !== 'number' ||
+        !Number.isSafeInteger(version) ||
+        version <= 0)
+        throw new Error('Unsupported corpus version');
+    if (id === 'praxis-held-out-v1' && version !== 1)
+        throw new Error('Unsupported corpus version');
+    const suffix = Number(id.slice('praxis-held-out-v'.length));
+    if (!Number.isSafeInteger(suffix) || suffix !== version)
+        throw new Error('Corpus id and version do not match');
+    return { id: id, version };
+}
 function object(value, label) {
     if (!value || typeof value !== 'object' || Array.isArray(value))
         throw new Error(`${label} must be an object`);
@@ -175,10 +188,7 @@ export async function loadHeldOutCorpus(root) {
     ], 'corpus');
     if (manifest.schema_version !== '1.0')
         throw new Error('Unsupported corpus schema_version');
-    if (manifest.id !== 'praxis-held-out-v1')
-        throw new Error('Unsupported corpus id');
-    if (manifest.version !== 1)
-        throw new Error('Unsupported corpus version');
+    const identity = validateCorpusIdentity(manifest.id, manifest.version);
     if (manifest.split !== 'held-out')
         throw new Error('corpus split must be held-out');
     if (manifest.repetitions !== 3)
@@ -270,7 +280,8 @@ export async function loadHeldOutCorpus(root) {
             const forbidden = item.expect.forbiddenChangedPaths.map((pattern) => new Minimatch(pattern, MUTATION_GLOB_OPTIONS));
             if (mutationPaths.some((path) => forbidden.some((matcher) => matcher.match(path))))
                 throw new Error(`${item.name} mutation paths overlap`);
-            if (!REQUIRED_TAGS.every((tag) => item.tags.includes(tag)) ||
+            if (!item.tags.includes('held-out') ||
+                !item.tags.includes(identity.id) ||
                 !item.tags.includes(repository.id))
                 throw new Error(`${item.name} is missing required held-out tags`);
             if (item.tags.some((tag) => FORBIDDEN_TAGS.has(tag)))
@@ -285,8 +296,8 @@ export async function loadHeldOutCorpus(root) {
     return {
         root: corpusRoot,
         schemaVersion: '1.0',
-        id: 'praxis-held-out-v1',
-        version: 1,
+        id: identity.id,
+        version: identity.version,
         split: 'held-out',
         repetitions: 3,
         policy: {

package/dist/evals/held-out-qualification.js

@@ -140,7 +140,7 @@ export function parseHeldOutQualificationOptions(argv) {
         throw new Error('--profile is not a safe eval identifier');
     if (!/^[A-Za-z0-9][A-Za-z0-9._:@/-]{0,255}$/u.test(options.model ?? ''))
         throw new Error('--model is not a safe eval identifier');
-    if (!/^praxis-held-out-v1@sha256:[0-9a-f]{64}$/u.test(options.confirmHeldOut ?? ''))
+    if (!/^praxis-held-out-v[1-9]\d*@sha256:[0-9a-f]{64}$/u.test(options.confirmHeldOut ?? ''))
         throw new Error('--confirm-held-out must be <id>@sha256:<64 lowercase hex>');
     return options;
 }
@@ -639,8 +639,13 @@ function validateQualificationResult(value) {
         Array.isArray(corpusObject) ||
         Object.keys(corpusObject).length !== corpusKeys.length ||
         Object.keys(corpusObject).some((key) => !corpusKeys.includes(key)) ||
-        corpusObject.id !== 'praxis-held-out-v1' ||
-        corpusObject.version !== 1 ||
+        typeof corpusObject.id !== 'string' ||
+        !/^praxis-held-out-v[1-9]\d*$/u.test(corpusObject.id) ||
+        typeof corpusObject.version !== 'number' ||
+        !Number.isSafeInteger(corpusObject.version) ||
+        corpusObject.version <= 0 ||
+        Number(corpusObject.id.slice('praxis-held-out-v'.length)) !==
+            corpusObject.version ||
         corpusObject.repetitions !== 3 ||
         !DIGEST.test(String(corpusObject.content_sha256)))
         throw new Error('Qualification corpus fields are invalid');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "praxis-agent",
-  "version": "0.69.0",
+  "version": "0.69.1",
   "description": "Local-first, single-user general agent for the command line.",
   "license": "MIT",
   "author": "wuqisen",