Runs record a context manifest once a model turn succeeds; the chat
marks each human message with the agents that read its current version.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The three third-party keys were hardcoded or read from the environment.
Operators now enter them in Settings > Integrations; they are stored
encrypted in the app-wide integration_keys table (migration 058).
An agent holding connector grants fails loudly when no Composio key is
saved. The goal-review test no longer depends on absolute dates.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Adopted from studying Claude Code's /goal (completion judged by a fresh
model, never the one doing the work) and pi-goal-x's auditor (isolated
session, read-only tools, explicit approval marker, rejects scaffold-only
and proxy-metric completions).
complete_goal no longer closes a goal on the caller's word:
- It now takes a required `evidence` claim, and permission/argument gates
run before any audit spend.
- The audit is an isolated tool-turn loop: fresh conversation (the auditor
never sees the executor's transcript), read-only workspace tools (no
run_command), strict auditor instructions, at most 6 iterations.
- Only an explicit <approved/> closes the goal (recorded with the audit
verdict). <disapproved/>, no marker, or an exhausted budget all leave the
goal active and hand the decisive gap back to the caller as the tool
result.
- The handler moved from the sync dispatcher into the run loop's async
routing because it needs provider access; the goal-review prompt warns
that substanceless claims will bounce.
AGENTS.md documents both this and the web-access contract.
"Be ashamed to guess APIs blindly; be proud to look things up carefully" —
until now the agents had no way to look anything up: no search, no fetch,
so market research, API usage, and competitive claims were all invented
from model memory.
agent-web-tools.ts, carried by every agent in every run (same pattern as
the workspace tools, no grant needed):
- web_search: keyless DuckDuckGo HTML backend; parses titles, unwraps the
/l/?uddg= redirect hrefs, pairs snippets; reports honestly when nothing
parses instead of fabricating results. Verified against the live endpoint.
- fetch_url: readable-text extraction (dependency-free HTML-to-text with
entity decoding), 20k-char page cap, 2MB body cap read in chunks, 30s
timeout.
- SSRF guard on both: hostnames resolve before connecting and loopback,
private, link-local, CGNAT, and reserved ranges are refused — re-checked
on every redirect hop, so a public page cannot bounce the agent into
127.0.0.1 or the cloud metadata address. IPv6 and v4-mapped forms covered.
- The fetcher is injectable, so the test suite covers the guard, redirect
policy, truncation, extraction, and the DuckDuckGo parser without
touching the network.
Every "engineering" deliverable the company ever produced was a markdown
skeleton, because documentation was the ceiling of the toolset:
write_deliverable and create_document were the only artifact tools. An
engineer could not see the files that exist, read a line of code, or run a
single command — and create_task hardcoded requires_filesystem to false, so
the entire approval-gated read_write mount plumbing was dead code.
New workspace capability (agent-workspace-tools.ts):
- list_files / read_file: explore the bound workspace, traversal-guarded by
the same resolveWorkspacePath used for writes, size- and count-capped.
- run_command: real shell execution with the workspace as cwd, 120s timeout,
16k output cap. Gated on the task's approved filesystem grant — the same
requires_filesystem flag that flips the mount to read_write and routes the
task through operator approval (auto-approved only in AI-CEO mode, which
is that mode's explicit contract).
- create_task now takes requires_filesystem, so the CEO and officers can
delegate engineering work that is allowed to change code and run tests.
- Prompts brief every agent on the tools, and filesystem tasks state the
bar directly: real output is code that builds and tests that pass — a
document describing the work does not close an engineering task.
Tests: tool registry, dependency-folder-skipping listing, traversal refusal,
the run_command access gate plus exit-code reporting, and the create_task
approval path for filesystem work.
The legacy application - its src, tests, landing site, promo assets, docs,
release tooling, CI workflows, and root configs - leaves the tree; it stays
reachable in history. Everything under AgentCompany-New moves up unchanged:
same package name, so the production userData/database path is untouched,
and e2e/build scripts already resolved paths relative to the project. The
developer cred.txt stays gitignored at its new location. Full verify:ci
passes from the new root.
