@lazyingart/agintiflow 0.1.0

package/src/docker-sandbox.js

@@ -0,0 +1,309 @@
+import { constants as fsConstants } from "node:fs";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { execFile as execFileCallback } from "node:child_process";
+import { promisify } from "node:util";
+import { evaluateCommandPolicy, normalizePackageInstallPolicy, normalizeSandboxMode } from "./command-policy.js";
+import { redactSensitiveText, redactValue } from "./redaction.js";
+
+const execFile = promisify(execFileCallback);
+const DOCKER_WORKSPACE = "/workspace";
+const READY_IMAGES = new Set();
+const SANDBOX_LOG_LIMIT = 80;
+const sandboxLogs = [];
+
+function recordSandboxLog(type, data = {}) {
+  sandboxLogs.push({
+    at: new Date().toISOString(),
+    type,
+    data: redactValue(data),
+  });
+  while (sandboxLogs.length > SANDBOX_LOG_LIMIT) sandboxLogs.shift();
+}
+
+function shellEscape(value) {
+  return `'${String(value).replace(/'/g, `'\"'\"'`)}'`;
+}
+
+function buildDockerInvocation(args) {
+  return ["docker", ...args].map(shellEscape).join(" ");
+}
+
+async function execDocker(args, options = {}) {
+  const execOptions = {
+    timeout: options.timeout ?? 30000,
+    maxBuffer: options.maxBuffer ?? 200 * 1024,
+  };
+  recordSandboxLog("docker.command", { args });
+
+  try {
+    const result = await execFile("docker", args, execOptions);
+    return {
+      stdout: redactSensitiveText(result.stdout),
+      stderr: redactSensitiveText(result.stderr),
+    };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (!/permission denied|Got permission denied|connect: permission denied/i.test(message)) {
+      throw error;
+    }
+
+    const result = await execFile("sg", ["docker", "-c", buildDockerInvocation(args)], execOptions);
+    return {
+      stdout: redactSensitiveText(result.stdout),
+      stderr: redactSensitiveText(result.stderr),
+    };
+  }
+}
+
+async function dockerAvailable() {
+  try {
+    await execDocker(["version", "--format", "{{.Server.Version}}"], { timeout: 8000, maxBuffer: 16 * 1024 });
+    return true;
+  } catch (error) {
+    recordSandboxLog("docker.unavailable", { error: error instanceof Error ? error.message : String(error) });
+    return false;
+  }
+}
+
+async function dockerImageExists(image) {
+  try {
+    await execDocker(["image", "inspect", image], {
+      timeout: 10000,
+      maxBuffer: 100 * 1024,
+    });
+    READY_IMAGES.add(image);
+    return true;
+  } catch {
+    READY_IMAGES.delete(image);
+    return false;
+  }
+}
+
+async function pathAccess(targetPath, mode) {
+  try {
+    await fs.access(targetPath, mode);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export function getSandboxLogs(limit = 30) {
+  return sandboxLogs.slice(-limit);
+}
+
+export async function getDockerSandboxStatus(config) {
+  const image = config.dockerSandboxImage;
+  const dockerfilePath = path.join(config.baseDir, "docker", "sandbox.Dockerfile");
+  const workspace = config.commandCwd;
+  const [dockerReady, dockerfileExists, workspaceExists, workspaceReadable, workspaceWritable] = await Promise.all([
+    dockerAvailable(),
+    pathAccess(dockerfilePath, fsConstants.R_OK),
+    pathAccess(workspace, fsConstants.F_OK),
+    pathAccess(workspace, fsConstants.R_OK),
+    pathAccess(workspace, fsConstants.W_OK),
+  ]);
+
+  const imageReady = dockerReady ? await dockerImageExists(image) : false;
+  return {
+    sandboxMode: normalizeSandboxMode(config.sandboxMode),
+    useDockerSandbox: Boolean(config.useDockerSandbox),
+    packageInstallPolicy: normalizePackageInstallPolicy(config.packageInstallPolicy),
+    image,
+    dockerfilePath,
+    dockerAvailable: dockerReady,
+    imageReady,
+    workspace,
+    workspaceExists,
+    workspaceReadable,
+    workspaceWritable,
+    dockerfileExists,
+    logs: getSandboxLogs(),
+  };
+}
+
+async function buildDockerSandboxImage(config, observers) {
+  const image = config.dockerSandboxImage;
+  const dockerfilePath = path.join(config.baseDir, "docker", "sandbox.Dockerfile");
+  observers?.log?.("docker.building", {
+    image,
+    dockerfilePath,
+  });
+  recordSandboxLog("docker.building", { image, dockerfilePath });
+
+  await execDocker(["build", "-t", image, "-f", dockerfilePath, config.baseDir], {
+    timeout: 10 * 60 * 1000,
+    maxBuffer: 1024 * 1024,
+  });
+
+  READY_IMAGES.add(image);
+  observers?.event?.("docker.ready", { image });
+  recordSandboxLog("docker.ready", { image });
+}
+
+export async function ensureDockerSandboxReady(config, observers, options = {}) {
+  const image = config.dockerSandboxImage;
+  if (!config.useDockerSandbox || (READY_IMAGES.has(image) && !options.forceBuild)) return;
+
+  const dockerfilePath = path.join(config.baseDir, "docker", "sandbox.Dockerfile");
+  await fs.access(dockerfilePath).catch(() => {
+    throw new Error(`Docker sandbox file is missing: ${dockerfilePath}`);
+  });
+
+  if (!options.forceBuild && (await dockerImageExists(image))) return;
+
+  await buildDockerSandboxImage(config, observers);
+}
+
+function dockerRunArgs(command, config, policy = evaluateCommandPolicy(command, config)) {
+  const uid = typeof process.getuid === "function" ? String(process.getuid()) : "";
+  const gid = typeof process.getgid === "function" ? String(process.getgid()) : "";
+  const userArgs = uid && gid ? ["--user", `${uid}:${gid}`] : [];
+  const sandboxMode = normalizeSandboxMode(config.sandboxMode);
+  const mountMode = sandboxMode === "docker-workspace" ? "rw" : "ro";
+  const networkMode = policy.needsNetwork ? "bridge" : "none";
+  const readOnlyArgs =
+    mountMode === "ro"
+      ? ["--read-only", "--tmpfs", "/tmp:rw,nosuid,nodev,size=128m"]
+      : ["--tmpfs", "/tmp:rw,nosuid,nodev,size=256m"];
+
+  return [
+    "run",
+    "--rm",
+    "--network",
+    networkMode,
+    "--cap-drop",
+    "ALL",
+    "--security-opt",
+    "no-new-privileges",
+    "--pids-limit",
+    "256",
+    "--memory",
+    "768m",
+    "--cpus",
+    "1.5",
+    ...readOnlyArgs,
+    ...userArgs,
+    "-e",
+    "HOME=/tmp",
+    "-e",
+    "NPM_CONFIG_USERCONFIG=/tmp/.npmrc",
+    "-e",
+    "PIP_DISABLE_PIP_VERSION_CHECK=1",
+    "-v",
+    `${config.commandCwd}:${DOCKER_WORKSPACE}:${mountMode}`,
+    "-w",
+    DOCKER_WORKSPACE,
+    config.dockerSandboxImage,
+    "bash",
+    "-lc",
+    String(command),
+  ];
+}
+
+export async function runDockerSandboxCommand(command, config, policy = evaluateCommandPolicy(command, config)) {
+  const result = await execDocker(dockerRunArgs(command, config, policy), {
+    timeout: policy.needsNetwork ? 120000 : 15000,
+    maxBuffer: 300 * 1024,
+  });
+
+  const payload = {
+    stdout: result.stdout.trim().slice(0, 12000),
+    stderr: result.stderr.trim().slice(0, 6000),
+  };
+  recordSandboxLog("sandbox.command.completed", {
+    command,
+    category: policy.category,
+    sandboxMode: policy.sandboxMode,
+    network: policy.needsNetwork ? "bridge" : "none",
+    stdout: payload.stdout.slice(0, 1200),
+    stderr: payload.stderr.slice(0, 1200),
+  });
+  return payload;
+}
+
+async function detectWorkspaceManifests(workspace) {
+  const candidates = ["package.json", "package-lock.json", "requirements.txt", "pyproject.toml", "environment.yml"];
+  const manifests = [];
+  for (const candidate of candidates) {
+    if (await pathAccess(path.join(workspace, candidate), fsConstants.R_OK)) manifests.push(candidate);
+  }
+  return manifests;
+}
+
+export async function runDockerPreflight(config, options = {}) {
+  const buildImage = Boolean(options.buildImage);
+  const statusBefore = await getDockerSandboxStatus(config);
+  const manifests = await detectWorkspaceManifests(config.commandCwd);
+  let checks = [];
+
+  if (buildImage && statusBefore.dockerAvailable && statusBefore.dockerfileExists && !statusBefore.imageReady) {
+    await ensureDockerSandboxReady(config, {
+      log: (message, data) => recordSandboxLog(message, data),
+      event: (type, data) => recordSandboxLog(type, data),
+    });
+  }
+
+  let status = await getDockerSandboxStatus(config);
+  const runChecks = async () => {
+    const results = [];
+    for (const command of [
+      "node -v",
+      "npm -v",
+      "python3 --version",
+      "python3 -m pip --version",
+      "git --version",
+      "rg --version",
+    ]) {
+      try {
+        const result = await execDocker(dockerRunArgs(command, config, { needsNetwork: false, category: "preflight" }), {
+          timeout: 15000,
+          maxBuffer: 100 * 1024,
+        });
+        results.push({ command, ok: true, stdout: result.stdout.trim(), stderr: result.stderr.trim() });
+      } catch (error) {
+        results.push({
+          command,
+          ok: false,
+          error: redactSensitiveText(error instanceof Error ? error.message : String(error)),
+        });
+      }
+    }
+    return results;
+  };
+
+  if (status.imageReady) {
+    checks = await runChecks();
+    if (buildImage && checks.some((check) => !check.ok)) {
+      recordSandboxLog("docker.rebuilding-stale-image", {
+        image: config.dockerSandboxImage,
+        failedChecks: checks.filter((check) => !check.ok).map((check) => check.command),
+      });
+      await ensureDockerSandboxReady(
+        config,
+        {
+          log: (message, data) => recordSandboxLog(message, data),
+          event: (type, data) => recordSandboxLog(type, data),
+        },
+        { forceBuild: true }
+      );
+      status = await getDockerSandboxStatus(config);
+      checks = await runChecks();
+    }
+  }
+
+  const result = {
+    ok: Boolean(status.dockerAvailable && status.workspaceReadable && status.dockerfileExists && status.imageReady),
+    status,
+    manifests,
+    checks,
+    logs: getSandboxLogs(),
+  };
+  recordSandboxLog("sandbox.preflight.completed", {
+    ok: result.ok,
+    manifests,
+    checks: checks.map((check) => ({ command: check.command, ok: check.ok })),
+  });
+  return result;
+}

package/src/guardrails.js

@@ -0,0 +1,122 @@
+import { evaluateCommandPolicy } from "./command-policy.js";
+
+const DESTRUCTIVE_KEYWORDS = [
+  "delete",
+  "remove",
+  "purchase",
+  "buy now",
+  "checkout",
+  "pay now",
+  "place order",
+  "confirm order",
+  "sign out",
+  "log out",
+  "logout",
+];
+
+const KNOWN_WRAPPERS = new Set(["codex", "claude", "gemini", "copilot", "qwen"]);
+const DESTRUCTIVE_PROMPT_HINTS = [
+  "delete",
+  "remove files",
+  "rm -",
+  "git push",
+  "git reset",
+  "git checkout",
+  "install",
+  "sudo",
+  "deploy",
+  "publish",
+];
+
+function normalizeDomain(hostname) {
+  return hostname.replace(/^www\./, "").toLowerCase();
+}
+
+export function isDomainAllowed(urlString, allowedDomains) {
+  if (!allowedDomains || allowedDomains.length === 0) return true;
+  const url = new URL(urlString);
+  const hostname = normalizeDomain(url.hostname);
+
+  return allowedDomains.some((allowed) => {
+    const candidate = normalizeDomain(allowed);
+    return hostname === candidate || hostname.endsWith(`.${candidate}`);
+  });
+}
+
+export function checkToolUse({ toolName, args, snapshot, config }) {
+  if (toolName === "open_url") {
+    if (!/^https?:\/\//.test(String(args.url || ""))) {
+      return { allowed: false, reason: "Only http and https URLs are allowed." };
+    }
+
+    if (!isDomainAllowed(args.url, config.allowedDomains)) {
+      return {
+        allowed: false,
+        reason: `Domain is outside the allowlist: ${args.url}`,
+      };
+    }
+
+    return { allowed: true };
+  }
+
+  if (toolName === "click") {
+    const element = snapshot.elements.find((item) => item.id === String(args.id));
+    if (!element) return { allowed: false, reason: `Element ${args.id} is not in the latest snapshot.` };
+
+    const label = `${element.text} ${element.ariaLabel}`.toLowerCase();
+    if (!config.allowDestructive && DESTRUCTIVE_KEYWORDS.some((word) => label.includes(word))) {
+      return { allowed: false, reason: `Blocked potentially destructive click target: "${label.trim()}"` };
+    }
+
+    return { allowed: true, element };
+  }
+
+  if (toolName === "type") {
+    const element = snapshot.elements.find((item) => item.id === String(args.id));
+    if (!element) return { allowed: false, reason: `Element ${args.id} is not in the latest snapshot.` };
+
+    const looksSensitive =
+      element.inputType === "password" ||
+      /password/.test(element.autocomplete || "") ||
+      /password/.test(`${element.text} ${element.ariaLabel} ${element.placeholder}`.toLowerCase());
+
+    if (!config.allowPasswords && looksSensitive) {
+      return { allowed: false, reason: "Typing into password-like fields is blocked by default." };
+    }
+
+    return { allowed: true, element };
+  }
+
+  if (toolName === "run_command") {
+    const command = String(args.command || "").trim();
+    return evaluateCommandPolicy(command, config);
+  }
+
+  if (toolName === "delegate_agent") {
+    if (!config.allowWrapperTools) {
+      return { allowed: false, reason: "Agent wrapper tools are disabled for this run." };
+    }
+
+    const wrapper = String(args.wrapper || "");
+    if (!KNOWN_WRAPPERS.has(wrapper)) {
+      return { allowed: false, reason: `Unknown agent wrapper: ${wrapper}` };
+    }
+
+    const prompt = String(args.prompt || "").trim();
+    if (prompt.length < 8) {
+      return { allowed: false, reason: "Agent wrapper prompt is too short." };
+    }
+    if (prompt.length > 4000) {
+      return { allowed: false, reason: "Agent wrapper prompt is too long." };
+    }
+
+    const loweredPrompt = prompt.toLowerCase();
+    if (!config.allowDestructive && DESTRUCTIVE_PROMPT_HINTS.some((hint) => loweredPrompt.includes(hint))) {
+      return { allowed: false, reason: "Agent wrapper prompt appears to request write-capable or destructive work." };
+    }
+
+    return { allowed: true };
+  }
+
+  return { allowed: true };
+}

package/src/model-client.js

@@ -0,0 +1,212 @@
+import OpenAI from "openai";
+import { WRAPPER_NAMES, wrapperStatusText } from "./tool-wrappers.js";
+
+export function createClient(config) {
+  return new OpenAI({
+    apiKey: config.apiKey,
+    baseURL: config.baseURL,
+  });
+}
+
+export async function createPlan(client, config, state) {
+  const response = await client.chat.completions.create({
+    model: config.model,
+    temperature: 0,
+    messages: [
+      {
+        role: "system",
+        content:
+          "You are planning a browser-and-shell automation task. If a local shell command can satisfy the goal, prefer that before browser actions. Treat any suggested start URL as optional. Write a concise execution plan with 3 to 6 steps. Mention risks or blockers when relevant. Keep it short and practical.",
+      },
+      {
+        role: "user",
+        content: [
+          `Goal: ${state.goal}`,
+          state.startUrl ? `Suggested start URL: ${state.startUrl}` : "",
+          config.allowedDomains.length > 0 ? `Allowed domains: ${config.allowedDomains.join(", ")}` : "",
+          config.allowShellTool
+            ? `Shell tool is enabled in ${config.commandCwd}. Sandbox mode: ${config.sandboxMode}. Package install policy: ${config.packageInstallPolicy}. For npm/pip/conda/venv setup, explain the need and wait for approval unless policy is allow.`
+            : "",
+          config.allowWrapperTools ? `Agent wrappers are enabled: ${wrapperStatusText()}.` : "",
+          "Return a numbered plan only.",
+        ]
+          .filter(Boolean)
+          .join("\n"),
+      },
+    ],
+  });
+
+  return response.choices[0]?.message?.content?.trim() || "1. Inspect the page.\n2. Use the smallest safe action.\n3. Finish with a concise answer.";
+}
+
+export async function requestNextStep(client, config, messages) {
+  const tools = [
+    {
+      type: "function",
+      function: {
+        name: "open_url",
+        description: "Open an absolute http or https URL in the browser.",
+        parameters: {
+          type: "object",
+          properties: {
+            url: { type: "string" },
+          },
+          required: ["url"],
+          additionalProperties: false,
+        },
+      },
+    },
+    {
+      type: "function",
+      function: {
+        name: "click",
+        description: "Click a visible element by its id from the latest snapshot.",
+        parameters: {
+          type: "object",
+          properties: {
+            id: { type: "string" },
+          },
+          required: ["id"],
+          additionalProperties: false,
+        },
+      },
+    },
+    {
+      type: "function",
+      function: {
+        name: "type",
+        description: "Type text into an input-like element by id. Optionally press Enter after typing.",
+        parameters: {
+          type: "object",
+          properties: {
+            id: { type: "string" },
+            text: { type: "string" },
+            pressEnter: { type: "boolean" },
+          },
+          required: ["id", "text"],
+          additionalProperties: false,
+        },
+      },
+    },
+    {
+      type: "function",
+      function: {
+        name: "scroll",
+        description: "Scroll the page vertically.",
+        parameters: {
+          type: "object",
+          properties: {
+            direction: { type: "string", enum: ["up", "down"] },
+            amount: { type: "integer" },
+          },
+          required: ["direction"],
+          additionalProperties: false,
+        },
+      },
+    },
+    {
+      type: "function",
+      function: {
+        name: "press",
+        description: "Press a keyboard key such as Enter, Tab, Escape, ArrowDown, or ArrowUp.",
+        parameters: {
+          type: "object",
+          properties: {
+            key: { type: "string" },
+          },
+          required: ["key"],
+          additionalProperties: false,
+        },
+      },
+    },
+    {
+      type: "function",
+      function: {
+        name: "back",
+        description: "Go back to the previous page in browser history.",
+        parameters: {
+          type: "object",
+          properties: {},
+          additionalProperties: false,
+        },
+      },
+    },
+    {
+      type: "function",
+      function: {
+        name: "wait",
+        description: "Wait for the page to update after an action.",
+        parameters: {
+          type: "object",
+          properties: {
+            ms: { type: "integer" },
+          },
+          additionalProperties: false,
+        },
+      },
+    },
+    {
+      type: "function",
+      function: {
+        name: "finish",
+        description: "Return the final answer when the goal is complete.",
+        parameters: {
+          type: "object",
+          properties: {
+            result: { type: "string" },
+          },
+          required: ["result"],
+          additionalProperties: false,
+        },
+      },
+    },
+  ];
+
+  if (config.allowShellTool) {
+    tools.splice(-1, 0, {
+      type: "function",
+      function: {
+        name: "run_command",
+        description:
+          "Run an allowlisted terminal command in the configured working directory. Good for inspection, tests, and approved Docker package/environment setup. NPM publishing, tokens, sudo, arbitrary network commands, and destructive git/file actions are blocked.",
+        parameters: {
+          type: "object",
+          properties: {
+            command: { type: "string" },
+          },
+          required: ["command"],
+          additionalProperties: false,
+        },
+      },
+    });
+  }
+
+  if (config.allowWrapperTools) {
+    tools.splice(-1, 0, {
+      type: "function",
+      function: {
+        name: "delegate_agent",
+        description:
+          "Ask an installed external coding agent wrapper for advisory help. Use for codebase analysis, implementation strategy, or second-opinion review. The wrapper is instructed to avoid modifying files.",
+        parameters: {
+          type: "object",
+          properties: {
+            wrapper: { type: "string", enum: WRAPPER_NAMES },
+            prompt: { type: "string" },
+          },
+          required: ["wrapper", "prompt"],
+          additionalProperties: false,
+        },
+      },
+    });
+  }
+
+  return client.chat.completions.create({
+    model: config.model,
+    temperature: 0,
+    tool_choice: "auto",
+    parallel_tool_calls: false,
+    messages,
+    tools,
+  });
+}