mirror of
https://github.com/multica-ai/multica.git
synced 2026-08-07 11:14:28 +02:00
84fe84cd9e
* fix(daemon): resolve six injected-instruction contradictions found by the MUL-5696 conflict audit Cross-checking the four injection surfaces (runtime brief, per-turn prompts, built-in skills, CLI help) against each other: - brief taught --due-date <RFC3339> while the CLI help, the projects skill, and util.ParseCalendarDate all pin YYYY-MM-DD (RFC3339 passes only at exact UTC midnight); 3 occurrences aligned to <YYYY-MM-DD> - autopilot per-turn prompt banned 'multica issue get' unconditionally while the brief's autopilot workflow allows issue commands when the autopilot instructions direct issue work; prompt now mirrors the brief - quick-create per-turn prompt said 'do NOT pass --attachment' while the quick-create ## Output section (test-pinned) names --attachment on the create call as the surface's only file channel; ban is now scoped to URLs from user input - assignment prompt claimed the workflow file documents pagination, but MUL-5442 (#6347) retreated those semantics to --help; pointer updated - 'attachment download' help example recommended -o /tmp/images, the exact machine-shared path the --content-file/--attachment workdir guards reject (MUL-4252) and the brief's Attachments section assumes away; example moved inside the workdir - multica-squads skill still listed an unbounded 'issue comment list' pull, contradicting the never-one-bulk-pull doctrine (same class as MUL-5372 / #6347); replaced with the bounded roots scan - multica-working-on-issues pinned a different metadata write bar ('explicit task requirement') than the brief's two-condition bar; aligned to the brief MUL-5696 Co-authored-by: multica-agent <github@multica.ai> * fix(cli): create the download output directory; pin MUL-5696 alignments with tests Review follow-ups for PR #6354 (MUL-5696): - 'attachment download -o' now creates the output directory, so the help example ('-o ./attachments') works from a clean workdir; regression test added and verified red without the fix - the run-only autopilot issue-command boundary is now a single shared constant (execenv.AutopilotIssueCommandsGuard) emitted by both the brief and the per-turn prompt, so the two copies cannot drift apart again - regression pins for the audit alignments: the brief --due-date synopsis stays calendar-day (<RFC3339> banned), the quick-create prompt keeps the URL-scoped --attachment boundary (blanket ban banned), the squads skill carries no unbounded comment read, and working-on-issues keeps the brief's metadata write bar Co-authored-by: multica-agent <github@multica.ai> * test(cli): let attachment download tests run inside agent workdirs Second-round review follow-up for PR #6354 (MUL-5696): the download tests set only setCLITestServerEnv's non-mat_ token, so inside an agent workdir (daemon task marker present) newAPIClient rejected them before the download logic ran — including the new directory-creation test, which made it a net-new in-tree failure. All three download tests now set a task-scoped mat_ test token, the same pattern the upload tests already use; in a standard agent workdir the full-suite failure set drops from 94 (base) to 92, with the two pre-existing download failures fixed and none added. Also bans the old 'explicit task requirement' metadata phrase in the working-on-issues skill test (review nit). Co-authored-by: multica-agent <github@multica.ai> * refactor(daemon): single-source the autopilot guard in the brief; trim per-turn prompt additions Follow-up to keep PR #6354 byte-neutral-or-better per surface: - the per-turn autopilot prompt no longer restates the issue-command boundary; the brief's autopilot workflow section is its single emission point (a second hand-maintained copy is exactly how the two drifted before), pinned on both sides - the assignment prompt's read-surface pointer and the quick-create attachment bullet are tightened Measured against origin/main with identical contexts: per-turn prompts assignment -26 B, autopilot -68 B, quick-create -7 B; briefs +6/+6/+3 B (YYYY-MM-DD is 3 bytes longer than RFC3339). Net per run: assignment -20 B, autopilot -62 B, quick-create -4 B, comment-reply +6 B. Rebase note: the audit's metadata-bar finding is superseded by #6351, which landed the opposite canonical direction (brief defers to the skill); the rebase keeps main's owner-ruled skill text and drops the now-wrong test pins. --------- Co-authored-by: Bohan-J <bohan@devv.ai> Co-authored-by: multica-agent <github@multica.ai>