@lazyingart/agintiflow 0.20.117 → 0.20.119

package/README.md

@@ -170,7 +170,7 @@ aginti --resume <session-id> \
   "Take a fresh screenshot of the running app in the emulator, save it with a durable filename in this project, and keep git status clean."
 ```
 
-Permission behavior is intentionally consistent. Use `-s safe` for read-first sessions that ask before writes/setup, `-s normal` for current-project writes plus Docker setup, and `-s danger` for trusted host/full-access work. Inside chat, `/safe`, `/normal`, and `/danger` switch the current session. When a blocked action appears, CLI and web can offer `No`, `Yes this time`, or `Yes and always for this session` instead of making the agent retry command variants. Android/Gradle builds can use safe local env assignments such as `ANDROID_HOME=... JAVA_HOME=... ./gradlew assembleDebug` and relative workspace logs without requiring whole-host destructive mode. See [runtime modes and autonomy](docs/runtime-modes-and-autonomy.md) for the full contract.
+Permission behavior is intentionally consistent. Use `-s safe` for read-first sessions that ask before writes/setup, `-s normal` for current-project writes plus Docker setup, and `-s danger` for trusted host/full-access work. In Docker workspace mode, common host data roots such as the user's home parent are mounted read-only at their original absolute paths so sibling projects and datasets can be inspected without granting host-write permission. Inside chat, `/safe`, `/normal`, and `/danger` switch the current session, and `/status` remains available while a run is active. When a blocked action appears, CLI and web can offer `No`, `Yes this time`, or `Yes and always for this session` instead of making the agent retry command variants. Android/Gradle builds can use safe local env assignments such as `ANDROID_HOME=... JAVA_HOME=... ./gradlew assembleDebug` and relative workspace logs without requiring whole-host destructive mode. See [runtime modes and autonomy](docs/runtime-modes-and-autonomy.md) for the full contract.
 
 Tmux follows the same rule. In Docker sandbox mode, `tmux_start_session` and `tmux_send_keys` are durable host tools, but their commands must stay workspace-bound. In host mode, tmux startup/send command text follows the same host shell policy as `run_command`; broad host shell work needs explicit `--allow-destructive`. Use `--sandbox-mode host --allow-destructive` only when a tmux task really needs trusted whole-host execution.
 

package/docs/runtime-modes-and-autonomy.md

@@ -52,7 +52,7 @@ The runtime must be consistent when an action is not permitted. A blocked action
 Current contract:
 
 - `safe` asks before file-tool writes and package/setup actions. It is the right mode for inspection, review, and cautious first passes.
-- `normal` allows writes inside the current project folder and package/setup inside Docker workspace mode. It still blocks outside-project writes and host-system changes until approved.
+- `normal` allows writes inside the current project folder, read-only inspection of visible host data roots, and package/setup inside Docker workspace mode. It still blocks outside-project writes and host-system changes until approved.
 - `danger` is trusted host/full-access mode: host shell, destructive actions, host installs, password typing, and outside-workspace file paths are enabled. Use it only for tasks you trust; obvious secret/publish exfiltration guards remain hard stops.
 - Workspace file tools may read and write inside the configured project folder when file tools are enabled.
 - Narrow workspace-local shell actions such as safe probes, Gradle/TeX builds, and `chmod +x` on a project script may run when the command policy can classify them precisely.
@@ -111,6 +111,8 @@ aginti
 
 This starts interactive chat with Docker workspace mode, file tools, shell tools, web search, and package installs allowed inside Docker.
 
+Docker workspace mode also mounts common host data roots, such as the user's home parent, read-only at their original absolute paths. This lets a task in `/home/lachlan/ProjectsLFS/aginti-test` inspect a sibling dataset such as `/home/lachlan/ProjectsLFS/ProteinStructure` without switching to host-write mode. Outputs and edits still belong under `/workspace` unless the user explicitly approves stronger host permissions. Set `AGINTI_DOCKER_READONLY_HOST_MOUNTS=/path/a:/path/b` to override the read-only mounts, or set it to `off` to disable them.
+
 Direct trusted host mode:
 
 ```bash

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.117",
+  "version": "0.20.119",
   "type": "module",
   "description": "AgInTiFlow is a project-aware agent workspace for hybrid wet-dry R&D, hardware-aware intelligence, software automation, and industrial workflows.",
   "license": "Apache-2.0",

package/scripts/smoke-cli-chat.js

@@ -10,6 +10,7 @@ import {
   buildPromptLayout,
   buildPromptRenderSequence,
   ComposerHistory,
+  activeRunSlashCommandAction,
   canonicalSlashPromptBuffer,
   classifyEscapeAction,
   formatElapsedDuration,
@@ -368,6 +369,15 @@ try {
   if (classifyEscapeAction({ active: true, pendingAsap: [] }) !== "abort") {
     throw new Error("active Esc should abort when no ASAP pipe messages are pending");
   }
+  if (activeRunSlashCommandAction("/status") !== "status" || activeRunSlashCommandAction("/status verbose") !== "status") {
+    throw new Error("active /status should be allowed during a run");
+  }
+  if (activeRunSlashCommandAction("/scs") !== "blocked") {
+    throw new Error("active mutating slash commands should remain blocked during a run");
+  }
+  if (activeRunSlashCommandAction("continue writing") !== "") {
+    throw new Error("active normal input should still pipe into the running task");
+  }
   const composerHistory = new ComposerHistory([
     "first prompt",
     "second prompt\nwith code",

package/scripts/smoke-coding-tools.js

@@ -9,6 +9,7 @@ import {
   runAgent,
   sanitizeToolResult,
   shouldShortCircuitToolBatch,
+  shellDiagnosticHint,
   skippedAfterBlockedToolResult,
 } from "../src/agent-runner.js";
 import { formatBehaviorContractForPrompt } from "../src/behavior-contract.js";
@@ -410,6 +411,13 @@ try {
     quotedDangerSearchPolicy.category !== "destructive",
     "quoted destructive strings in grep pattern should not classify as a destructive command"
   );
+  const grepCountHint = shellDiagnosticHint("grep -c 'Fatal\\|Emergency' article.log && echo done", {
+    ok: false,
+    exitCode: 1,
+    stdout: "0\n",
+    stderr: "",
+  });
+  assert(grepCountHint.includes("grep -c exits 1"), "failed grep-count validation should explain clean zero-match exit behavior");
   const actualDangerAfterQuotePolicy = evaluateCommandPolicy('echo "rm -rf is text" && rm -rf reports', dockerWorkspacePolicy);
   assert(!actualDangerAfterQuotePolicy.allowed, "actual destructive command after quoted text should still be blocked");
   assert(actualDangerAfterQuotePolicy.category === "destructive", "actual destructive command after quoted text was not classified as destructive");

package/scripts/smoke-toolchain-docker.js

@@ -5,7 +5,7 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { readArtifactContent } from "../src/artifact-tunnel.js";
 import { evaluateCommandPolicy } from "../src/command-policy.js";
-import { runDockerPreflight, runDockerSandboxCommand } from "../src/docker-sandbox.js";
+import { dockerReadOnlyHostMounts, runDockerPreflight, runDockerSandboxCommand } from "../src/docker-sandbox.js";
 import { resolveRuntimeConfig } from "../src/config.js";
 
 const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
@@ -13,7 +13,10 @@ const tempRoot = await fs.mkdtemp(path.join(os.tmpdir(), "agintiflow-toolchain-"
 process.env.AGINTIFLOW_HOME = path.join(tempRoot, ".agintiflow-home");
 const runtimeDir = path.join(tempRoot, "runtime");
 const workspace = path.join(tempRoot, "workspace");
+const outsideData = path.join(tempRoot, "outside-data");
 await fs.mkdir(workspace, { recursive: true });
+await fs.mkdir(outsideData, { recursive: true });
+process.env.AGINTI_DOCKER_READONLY_HOST_MOUNTS = tempRoot;
 
 function assert(condition, message) {
   if (!condition) throw new Error(message);
@@ -53,6 +56,33 @@ try {
 
   const preflight = await runDockerPreflight(config, { buildImage: false });
   assert(preflight.ok, "Docker toolchain preflight failed. Run scripts/setup-agent-toolchain-docker.sh first.");
+  assert(
+    dockerReadOnlyHostMounts(config).includes(tempRoot),
+    "Docker read-only host mount configuration did not include the requested outside-data root"
+  );
+
+  await fs.writeFile(path.join(outsideData, "source-note.txt"), "READ_ONLY_HOST_MOUNT_OK\n", "utf8");
+  const outsideRead = await runToolchainCommand(`cat ${path.join(outsideData, "source-note.txt")}`, config);
+  assert(outsideRead.stdout.includes("READ_ONLY_HOST_MOUNT_OK"), "Docker normal mode could not read the configured outside data root");
+
+  const abortController = new AbortController();
+  const abortCommand = `python3 -c 'import time; time.sleep(20)'`;
+  const abortPolicy = evaluateCommandPolicy(abortCommand, { ...config, packageInstallPolicy: "allow" });
+  assert(abortPolicy.allowed, "long-running Docker command should be allowed for interrupt smoke");
+  const abortStartedAt = Date.now();
+  const abortRun = runDockerSandboxCommand(abortCommand, { ...config, packageInstallPolicy: "allow" }, abortPolicy, {
+    signal: abortController.signal,
+  });
+  setTimeout(() => abortController.abort(new Error("smoke interrupt")), 500);
+  let interrupted = false;
+  try {
+    await abortRun;
+  } catch (error) {
+    interrupted = /abort|interrupt|cancel/i.test(String(error?.name || "")) || /abort|interrupt|cancel/i.test(String(error?.message || ""));
+  }
+  const abortElapsed = Date.now() - abortStartedAt;
+  assert(interrupted, "Docker command did not reject as interrupted after AbortController abort");
+  assert(abortElapsed < 8000, `Docker interrupt took too long: ${abortElapsed}ms`);
 
   await fs.writeFile(
     path.join(workspace, "plot_fx.py"),
@@ -174,6 +204,7 @@ try {
         ok: true,
         image: config.dockerSandboxImage,
         workspace,
+        outsideReadRoot: outsideData,
         outputs: ["plot_fx.svg", "paper.pdf", "figure-note/fx_figure.pdf", "figure-note/figure_note.pdf"],
         artifactKinds: ["image/svg+xml", "application/pdf"],
       },

package/src/agent-runner.js

@@ -2,9 +2,8 @@ import crypto from "node:crypto";
 import fs from "node:fs/promises";
 import net from "node:net";
 import path from "node:path";
-import { exec as execCallback, spawn } from "node:child_process";
+import { spawn } from "node:child_process";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { promisify } from "node:util";
 import { chromium } from "playwright";
 import { createClient, createPlan, requestNextStep } from "./model-client.js";
 import { SessionStore } from "./session-store.js";
@@ -54,7 +53,6 @@ import {
   serializeStepBudgetState,
 } from "./step-budget-controller.js";
 
-const exec = promisify(execCallback);
 const BROWSER_TOOLS = new Set(["open_url", "open_workspace_file", "preview_workspace", "click", "type", "scroll", "press", "back"]);
 const WORKSPACE_TOOLS = new Set(WORKSPACE_TOOL_NAMES);
 const STATIC_PREVIEW_SERVER_PATH = fileURLToPath(new URL("./static-preview-server.js", import.meta.url));
@@ -580,13 +578,14 @@ async function createInitialState(config, sessionId) {
           "Treat AGINTI.md as durable project memory and operating instructions for this project. The user can edit it manually or ask you in chat to update it; use workspace file tools for that and never store secrets there.",
           config.allowShellTool
             ? config.useDockerSandbox
-              ? `A shell command tool is available inside Docker sandbox mode ${config.sandboxMode}. Docker workspace mode with approved package installs supports broader setup and network commands. The project is mounted at /workspace and the persistent agent toolchain is mounted at /aginti-env with caches under /aginti-cache. Do not run npx aginti, npm exec aginti, or nested aginti diagnostics from this Docker shell; they may resolve stale project packages or create recursive agent sessions.`
+              ? `A shell command tool is available inside Docker sandbox mode ${config.sandboxMode}. Docker workspace mode with approved package installs supports broader setup and network commands. The project is mounted at /workspace, persistent agent toolchain state is mounted at /aginti-env with caches under /aginti-cache, and common host data roots such as the user's home parent are mounted read-only at their original absolute paths. Use /workspace for outputs and writes; use absolute host paths only for read-only inspection when visible. Do not run npx aginti, npm exec aginti, or nested aginti diagnostics from this Docker shell; they may resolve stale project packages or create recursive agent sessions.`
               : `A host shell command tool is available under the configured trust policy on ${platformLabel(platform)}. On native Windows, prefer PowerShell/cmd-compatible commands or switch to WSL/Docker for bash-like toolchains.`
             : "No shell command tool is available.",
-          `Permission contract: permission mode is ${config.permissionMode || "normal"}. Safe mode asks before workspace writes/setup. Normal mode allows current-project writes and approved Docker setup, but outside-workspace paths and host-system changes require approval. Danger mode is trusted host/full-access mode. Do not bypass blockers by retrying variants. If a tool result includes permissionAdvice or suggestedCommand, stop, explain the blocker, copy the exact suggestedCommand when giving a rerun path, and ask the user to approve/rerun that mode or choose a safer workspace-relative path. Never invent legacy AgInTi syntax such as \`aginti run --sandbox host\`; use the exact flags from permissionAdvice.`,
+          `Permission contract: permission mode is ${config.permissionMode || "normal"}. Safe mode asks before workspace writes/setup. Normal mode allows current-project writes, read-only inspection of visible host paths, and approved Docker setup, but outside-workspace writes and host-system changes require approval. Danger mode is trusted host/full-access mode. Do not bypass blockers by retrying variants. If a tool result includes permissionAdvice or suggestedCommand, stop, explain the blocker, copy the exact suggestedCommand when giving a rerun path, and ask the user to approve/rerun that mode or choose a safer workspace-relative path. Never invent legacy AgInTi syntax such as \`aginti run --sandbox host\`; use the exact flags from permissionAdvice.`,
           "If an operation fails but a directory, artifact, or file already exists, treat it as pre-existing unless you have evidence this run created or updated it. Verify expected outputs before claiming success.",
+          "For validation/evidence commands, remember that grep exits 1 on zero matches. If zero matches is the expected clean result, use `grep -c PATTERN file || true`, split evidence checks into independent commands, or use awk/python so a clean zero count does not stop an `&&` chain.",
           config.allowShellTool
-        ? "Host tmux tools are available for long-running terminals: list sessions, capture panes, send safe keys/text, and start detached sessions. Prefer these tools for monitoring long installs/tests/dev servers without blocking; capture before sending input and never send secrets or sudo passwords. Do not start or install tmux inside Docker run_command containers because those containers are short-lived. In Docker sandbox mode, tmux start/send commands must stay workspace-bound and must not reference absolute host paths outside the project; ask for --sandbox-mode host for trusted whole-host work."
+        ? "Host tmux tools are available for long-running terminals: list sessions, capture panes, send safe keys/text, and start detached sessions. Prefer these tools for monitoring long installs/tests/dev servers without blocking; capture before sending input and never send secrets or sudo passwords. Do not start or install tmux inside Docker run_command containers because those containers are short-lived. In Docker sandbox mode, tmux start/send commands must stay workspace-write-bound; prefer run_command for read-only host absolute path inspection through read-only mounts, and ask for --sandbox-mode host for trusted whole-host write/system work."
         + " For one-shot tmux commands, redirect stdout/stderr and exit status to a durable workspace log or keep the pane alive for capture; if capture fails because the session ended, do not infer output or exit status."
         : "",
           config.allowFileTools
@@ -640,7 +639,7 @@ async function createInitialState(config, sessionId) {
           config.allowedDomains.length > 0 ? `Allowed domains: ${config.allowedDomains.join(", ")}` : "",
           config.allowShellTool
             ? config.useDockerSandbox
-              ? `Shell working directory mounted into Docker as /workspace from ${config.commandCwd}. Use relative paths or /workspace paths, not absolute host temp paths. Persistent Docker env: /aginti-env, caches: /aginti-cache. Sandbox mode: ${config.sandboxMode}. Package install policy: ${config.packageInstallPolicy}.`
+              ? `Shell working directory mounted into Docker as /workspace from ${config.commandCwd}. Use relative paths or /workspace paths for outputs/writes; common host data roots are read-only at original absolute paths for inspection. Persistent Docker env: /aginti-env, caches: /aginti-cache. Sandbox mode: ${config.sandboxMode}. Package install policy: ${config.packageInstallPolicy}.`
               : `Shell working directory: ${config.commandCwd}`
             : "",
           config.allowFileTools
@@ -1006,9 +1005,10 @@ async function applyContinuationPrompt(state, config, observers) {
       temporalContext,
       config.startUrl ? `Suggested start URL: ${config.startUrl}` : "",
       config.allowedDomains.length > 0 ? `Allowed domains: ${config.allowedDomains.join(", ")}` : "",
+      "Validation reminder: grep exits 1 on zero matches. For clean-zero checks, guard `grep -c` with `|| true` or split evidence commands so the validation can continue.",
       config.allowShellTool
         ? config.useDockerSandbox
-          ? `Shell working directory mounted into Docker as /workspace from ${config.commandCwd}. Use relative paths or /workspace paths. Persistent Docker env: /aginti-env, caches: /aginti-cache. Sandbox mode: ${config.sandboxMode}. Package install policy: ${config.packageInstallPolicy}.`
+          ? `Shell working directory mounted into Docker as /workspace from ${config.commandCwd}. Use relative paths or /workspace paths for outputs/writes; common host data roots are read-only at original absolute paths for inspection. Persistent Docker env: /aginti-env, caches: /aginti-cache. Sandbox mode: ${config.sandboxMode}. Package install policy: ${config.packageInstallPolicy}.`
           : `Shell working directory: ${config.commandCwd}. Host platform: ${platformLabel(platform)}. Use OS-compatible commands; prefer WSL/Docker for bash-heavy workflows on Windows.`
         : "",
       config.allowFileTools
@@ -1076,6 +1076,112 @@ function safeExecutionEnv() {
   };
 }
 
+function trimOutput(value = "", limit = 8000) {
+  const text = redactSensitiveText(String(value || ""));
+  return text.trim().slice(0, limit);
+}
+
+function killChildTree(child, signal = "SIGTERM") {
+  if (!child || child.killed) return;
+  try {
+    if (process.platform === "win32") child.kill(signal);
+    else process.kill(-child.pid, signal);
+  } catch {
+    try {
+      child.kill(signal);
+    } catch {
+      // Best effort; process may already be gone.
+    }
+  }
+}
+
+function runHostShellCommand(command, config) {
+  return new Promise((resolve, reject) => {
+    const shell = hostShellOption();
+    const child = spawn(String(command || ""), {
+      cwd: config.commandCwd,
+      env: safeExecutionEnv(),
+      shell,
+      detached: process.platform !== "win32",
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+    let stdout = "";
+    let stderr = "";
+    let settled = false;
+    let timedOut = false;
+    const timeoutMs = Number(config.shellTimeoutMs || process.env.AGINTI_SHELL_TIMEOUT_MS || 30000);
+    const maxStdout = 220 * 1024;
+    const maxStderr = 120 * 1024;
+
+    const settle = (callback) => {
+      if (settled) return;
+      settled = true;
+      if (timer) clearTimeout(timer);
+      if (config.abortSignal && onAbort) config.abortSignal.removeEventListener("abort", onAbort);
+      callback();
+    };
+    const onAbort = () => {
+      killChildTree(child, "SIGTERM");
+      setTimeout(() => killChildTree(child, "SIGKILL"), 1200).unref?.();
+      const error = new Error("Run interrupted by user.");
+      error.name = "AbortError";
+      error.code = "ABORT_ERR";
+      settle(() => reject(error));
+    };
+    const timer =
+      Number.isFinite(timeoutMs) && timeoutMs > 0
+        ? setTimeout(() => {
+            timedOut = true;
+            killChildTree(child, "SIGTERM");
+            setTimeout(() => killChildTree(child, "SIGKILL"), 1200).unref?.();
+          }, timeoutMs)
+        : null;
+    timer?.unref?.();
+
+    if (config.abortSignal?.aborted) return onAbort();
+    if (config.abortSignal) config.abortSignal.addEventListener("abort", onAbort, { once: true });
+
+    child.stdout?.on("data", (chunk) => {
+      if (stdout.length < maxStdout) stdout += chunk.toString();
+    });
+    child.stderr?.on("data", (chunk) => {
+      if (stderr.length < maxStderr) stderr += chunk.toString();
+    });
+    child.on("error", (error) => {
+      settle(() =>
+        resolve({
+          ok: false,
+          exitCode: 1,
+          stdout,
+          stderr: `${stderr}${stderr ? "\n" : ""}${error instanceof Error ? error.message : String(error)}`,
+        })
+      );
+    });
+    child.on("close", (code, signalName) => {
+      settle(() =>
+        resolve({
+          ok: !timedOut && Number(code || 0) === 0,
+          exitCode: timedOut ? 124 : Number.isInteger(code) ? code : signalName ? 130 : 1,
+          stdout,
+          stderr: `${stderr}${timedOut ? `\nCommand timed out after ${timeoutMs}ms.` : ""}`,
+        })
+      );
+    });
+  });
+}
+
+export function shellDiagnosticHint(command = "", result = {}) {
+  if (result?.ok !== false) return "";
+  const text = String(command || "");
+  if (/\bgrep\b[\s\S]*\s-c\b|\bgrep\s+-c\b/.test(text)) {
+    return "grep -c exits 1 when it finds zero matches even though it prints 0. For count-only validation, use `grep -c PATTERN file || true`, split evidence commands, or use awk/python when zero matches is the expected clean state.";
+  }
+  if (/\bgrep\b/.test(text) && /&&/.test(text)) {
+    return "grep exits 1 when it finds no matches, so an `&&` evidence chain can stop early. If no matches is acceptable, guard that grep with `|| true` or run independent validation commands.";
+  }
+  return "";
+}
+
 function hashForLog(value) {
   return crypto.createHash("sha256").update(String(value ?? "")).digest("hex");
 }
@@ -1261,29 +1367,26 @@ async function runShellCommand(command, config, policy = evaluateCommandPolicy(c
     throwIfAborted(config);
     const result = config.useDockerSandbox
       ? await runDockerSandboxCommand(command, config, policy, { signal: config.abortSignal })
-      : await exec(command, {
-          cwd: config.commandCwd,
-          timeout: 30000,
-          maxBuffer: 200 * 1024,
-          shell: hostShellOption(),
-          env: safeExecutionEnv(),
-          signal: config.abortSignal,
-        });
+      : await runHostShellCommand(command, config);
+    const diagnosticHint = shellDiagnosticHint(command, result);
 
     return {
-      ok: true,
-      exitCode: 0,
-      stdout: redactSensitiveText(result.stdout).trim().slice(0, 8000),
-      stderr: redactSensitiveText(result.stderr).trim().slice(0, 4000),
+      ok: result.ok !== false,
+      exitCode: Number.isInteger(result.exitCode) ? result.exitCode : 0,
+      stdout: trimOutput(result.stdout, 8000),
+      stderr: trimOutput(result.stderr, 4000),
+      ...(diagnosticHint ? { diagnosticHint } : {}),
     };
   } catch (error) {
     if (isAbortError(error, config)) throw error;
-    return {
+    const failedResult = {
       ok: false,
       exitCode: Number.isInteger(error?.code) ? error.code : 1,
-      stdout: redactSensitiveText(String(error?.stdout || "")).trim().slice(0, 8000),
-      stderr: redactSensitiveText(String(error?.stderr || error?.message || "")).trim().slice(0, 4000),
+      stdout: trimOutput(error?.stdout || "", 8000),
+      stderr: trimOutput(error?.stderr || error?.message || "", 4000),
     };
+    const diagnosticHint = shellDiagnosticHint(command, failedResult);
+    return diagnosticHint ? { ...failedResult, diagnosticHint } : failedResult;
   }
 }
 
@@ -1295,13 +1398,14 @@ async function captureSyntheticSnapshot(store, step, config) {
     pageText: [
       "No browser page is currently open.",
       config.startUrl ? `Suggested start URL: ${config.startUrl}` : "",
+      "Validation reminder: grep exits 1 on zero matches; guard expected clean-zero grep checks or split evidence commands.",
       config.allowShellTool
         ? config.useDockerSandbox
-          ? `Shell tool available in Docker with mounted workspace /workspace from ${config.commandCwd}. Use relative paths or /workspace paths. Persistent Docker env: /aginti-env, caches: /aginti-cache. Sandbox mode: ${config.sandboxMode}. Package install policy: ${config.packageInstallPolicy}.`
+          ? `Shell tool available in Docker with mounted workspace /workspace from ${config.commandCwd}. Use relative paths or /workspace paths for outputs/writes; common host data roots are read-only at original absolute paths for inspection. Persistent Docker env: /aginti-env, caches: /aginti-cache. Sandbox mode: ${config.sandboxMode}. Package install policy: ${config.packageInstallPolicy}.`
           : `Shell tool available in: ${config.commandCwd} on ${platformLabel(platform)}. Use OS-compatible commands; prefer WSL/Docker for bash-heavy workflows on Windows.`
         : "Shell tool disabled.",
       config.allowShellTool
-        ? "Host tmux tools available: tmux_list_sessions, tmux_capture_pane, tmux_send_keys, tmux_start_session. Use them for long-running jobs and agent terminals; capture before sending input. Docker run_command containers are ephemeral, so tmux there will not persist. In Docker sandbox mode, tmux start/send commands must stay workspace-bound and cannot reference absolute host paths outside the project; when sending text into a shell pane, tmux follows the same Docker workspace command policy as run_command and is not a bypass for package installs, destructive git history rewrites, or broad shell text. Use --sandbox-mode host for trusted whole-host work. In host mode, tmux startup/send command text follows the same host shell policy as run_command; if a broad host command is blocked, present the approval/rerun path instead of trying tmux as a workaround. For one-shot tmux commands, redirect output and exit status to a durable workspace log or keep the pane alive for capture; if capture fails because the session ended, do not infer output or exit status."
+        ? "Host tmux tools available: tmux_list_sessions, tmux_capture_pane, tmux_send_keys, tmux_start_session. Use them for long-running jobs and agent terminals; capture before sending input. Docker run_command containers are ephemeral, so tmux there will not persist. In Docker sandbox mode, tmux start/send commands must stay workspace-write-bound; when sending text into a shell pane, tmux follows the same Docker workspace command policy as run_command and is not a bypass for package installs, destructive git history rewrites, or broad shell text. Prefer run_command for read-only host absolute path inspection through read-only mounts. Use --sandbox-mode host for trusted whole-host write/system work. In host mode, tmux startup/send command text follows the same host shell policy as run_command; if a broad host command is blocked, present the approval/rerun path instead of trying tmux as a workaround. For one-shot tmux commands, redirect output and exit status to a durable workspace log or keep the pane alive for capture; if capture fails because the session ended, do not infer output or exit status."
         : "",
       config.allowFileTools
         ? `Workspace file tools available in: ${config.commandCwd}. Use inspect_project first for large or unfamiliar codebases, then search/read exact files before editing. Use workspace-relative paths. Use apply_patch for code edits; it supports exact single-file replacement and multi-file Codex-style/unified patches. For new standalone generated content, pick a descriptive non-conflicting filename and avoid overwriting unless explicitly requested.`
@@ -2377,6 +2481,7 @@ export async function runAgent(config) {
             command: redactSensitiveText(toolResult.args?.command || ""),
             stdout: toolResult.stdout || "",
             stderr: toolResult.stderr || "",
+            diagnosticHint: toolResult.diagnosticHint || "",
             commandPolicy: toolResult.commandPolicy,
             blocked: Boolean(toolResult.blocked),
             error: toolResult.error || toolResult.reason || "",

package/src/docker-sandbox.js

@@ -1,4 +1,5 @@
-import { constants as fsConstants } from "node:fs";
+import crypto from "node:crypto";
+import fsSync, { constants as fsConstants } from "node:fs";
 import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
@@ -15,6 +16,7 @@ const DOCKER_ENV = "/aginti-env";
 const READY_IMAGES = new Set();
 const SANDBOX_LOG_LIMIT = 80;
 const sandboxLogs = [];
+const DISABLE_HOST_READ_MOUNTS = new Set(["0", "false", "no", "off", "none"]);
 
 function recordSandboxLog(type, data = {}) {
   sandboxLogs.push({
@@ -62,6 +64,23 @@ async function execDocker(args, options = {}) {
     signal: options.signal,
   };
   recordSandboxLog("docker.command", { args });
+  const containerName = options.containerName || "";
+  let abortHandler = null;
+  if (options.signal && containerName) {
+    abortHandler = () => {
+      void execFile("docker", ["kill", containerName], {
+        timeout: 8000,
+        maxBuffer: 32 * 1024,
+      }).catch((error) => {
+        recordSandboxLog("docker.kill.failed", {
+          containerName,
+          error: error instanceof Error ? error.message : String(error),
+        });
+      });
+    };
+    if (options.signal.aborted) abortHandler();
+    else options.signal.addEventListener("abort", abortHandler, { once: true });
+  }
 
   try {
     const result = await execFile("docker", args, execOptions);
@@ -80,6 +99,8 @@ async function execDocker(args, options = {}) {
       stdout: redactSensitiveText(result.stdout),
       stderr: redactSensitiveText(result.stderr),
     };
+  } finally {
+    if (options.signal && abortHandler) options.signal.removeEventListener("abort", abortHandler);
   }
 }
 
@@ -140,6 +161,30 @@ function persistentDockerDirs(config) {
   };
 }
 
+function uniqueHostMounts(mounts = []) {
+  const seen = new Set();
+  const result = [];
+  for (const mount of mounts) {
+    const normalized = path.resolve(String(mount || "").trim());
+    if (!normalized || normalized === "/" || seen.has(normalized)) continue;
+    if (!path.isAbsolute(normalized) || !fsSync.existsSync(normalized)) continue;
+    seen.add(normalized);
+    result.push(normalized);
+  }
+  return result;
+}
+
+export function dockerReadOnlyHostMounts(config = {}, sandboxMode = normalizeSandboxMode(config.sandboxMode)) {
+  if (sandboxMode !== "docker-workspace") return [];
+  const configured = process.env.AGINTI_DOCKER_READONLY_HOST_MOUNTS || process.env.AGINTI_DOCKER_HOST_READ_MOUNTS || "";
+  if (DISABLE_HOST_READ_MOUNTS.has(configured.trim().toLowerCase())) return [];
+  if (Array.isArray(config.readOnlyHostMounts)) return uniqueHostMounts(config.readOnlyHostMounts);
+  if (configured.trim()) return uniqueHostMounts(configured.split(path.delimiter));
+
+  const homeParent = path.dirname(os.homedir() || "");
+  return uniqueHostMounts([homeParent, "/mnt", "/media", "/Volumes"]);
+}
+
 async function ensurePersistentDockerDirs(config) {
   const dirs = persistentDockerDirs(config);
   await Promise.all([fs.mkdir(dirs.home, { recursive: true }), fs.mkdir(dirs.cache, { recursive: true }), fs.mkdir(dirs.env, { recursive: true })]);
@@ -257,7 +302,11 @@ function dockerCommand(command, policy) {
   return [...envLines, dockerUserCommand(command, policy)].join("\n");
 }
 
-function dockerRunArgs(command, config, policy = evaluateCommandPolicy(command, config), persistentDirs = persistentDockerDirs(config)) {
+function dockerContainerName() {
+  return `aginti-${process.pid}-${Date.now()}-${crypto.randomBytes(4).toString("hex")}`.slice(0, 63);
+}
+
+function dockerRunArgs(command, config, policy = evaluateCommandPolicy(command, config), persistentDirs = persistentDockerDirs(config), options = {}) {
   const uid = typeof process.getuid === "function" ? String(process.getuid()) : "";
   const gid = typeof process.getgid === "function" ? String(process.getgid()) : "";
   const userArgs = uid && gid && !policy.requiresDockerRoot ? ["--user", `${uid}:${gid}`] : [];
@@ -265,6 +314,7 @@ function dockerRunArgs(command, config, policy = evaluateCommandPolicy(command,
   const mountMode = sandboxMode === "docker-workspace" ? "rw" : "ro";
   const networkMode = policy.needsNetwork ? "bridge" : "none";
   const toolchain = policy.category === "toolchain";
+  const readOnlyHostMountArgs = dockerReadOnlyHostMounts(config, sandboxMode).flatMap((mount) => ["-v", `${mount}:${mount}:ro`]);
   const readOnlyArgs =
     mountMode === "ro"
       ? ["--read-only", "--tmpfs", "/tmp:rw,nosuid,nodev,size=128m"]
@@ -273,6 +323,7 @@ function dockerRunArgs(command, config, policy = evaluateCommandPolicy(command,
   return [
     "run",
     "--rm",
+    ...(options.containerName ? ["--name", options.containerName] : []),
     "--network",
     networkMode,
     "--cap-drop",
@@ -291,6 +342,7 @@ function dockerRunArgs(command, config, policy = evaluateCommandPolicy(command,
     "NPM_CONFIG_USERCONFIG=/tmp/.npmrc",
     "-e",
     "PIP_DISABLE_PIP_VERSION_CHECK=1",
+    ...readOnlyHostMountArgs,
     "-v",
     `${config.commandCwd}:${DOCKER_WORKSPACE}:${mountMode}`,
     "-v",
@@ -310,10 +362,12 @@ function dockerRunArgs(command, config, policy = evaluateCommandPolicy(command,
 
 export async function runDockerSandboxCommand(command, config, policy = evaluateCommandPolicy(command, config), options = {}) {
   const persistentDirs = await ensurePersistentDockerDirs(config);
-  const result = await execDocker(dockerRunArgs(command, config, policy, persistentDirs), {
+  const containerName = dockerContainerName();
+  const result = await execDocker(dockerRunArgs(command, config, policy, persistentDirs, { containerName }), {
     timeout: dockerExecTimeoutMs(policy),
     maxBuffer: 300 * 1024,
     signal: options.signal,
+    containerName,
   });
 
   const payload = {

package/src/interactive-cli.js

@@ -720,6 +720,9 @@ function printCommandOutputLog(data = {}) {
     if (advice.suggestedCommand) outputLine(`${color(" | ", ansi.red)} rerun: ${compactLine(advice.suggestedCommand, 120)}`);
     if (advice.trustedHostCommand) outputLine(`${color(" | ", ansi.red)} host: ${compactLine(advice.trustedHostCommand, 120)}`);
   }
+  if (data.diagnosticHint) {
+    outputLine(`${label("hint", ansi.yellow)} ${compactLine(data.diagnosticHint, 112)}`);
+  }
 }
 
 function printHeading(text) {
@@ -1182,6 +1185,13 @@ export function classifyEscapeAction({ active = false, pendingAsap = [] } = {})
   return Array.isArray(pendingAsap) && pendingAsap.length > 0 ? "wait-for-asap" : "abort";
 }
 
+export function activeRunSlashCommandAction(value = "") {
+  const content = canonicalSlashPromptBuffer(value).trim();
+  if (!content.startsWith("/")) return "";
+  if (/^\/status(?:\s|$)/.test(content)) return "status";
+  return "blocked";
+}
+
 function readTtyPrompt(options = {}) {
   return new Promise((resolve, reject) => {
     emitKeypressEvents(input);
@@ -1581,8 +1591,18 @@ class LiveRunInput {
   async submitAsap() {
     const content = this.buffer.trim();
     if (!content) return;
-    if (content.startsWith("/")) {
-      this.printLine(`${label("warn", ansi.red)} Slash commands are disabled while a run is active. Press Esc/Ctrl+C to stop, or wait until idle.`);
+    const slashAction = activeRunSlashCommandAction(content);
+    if (slashAction === "status") {
+      this.setBuffer("");
+      printStatus(this.state);
+      if (this.pendingAsap.length || this.pendingQueued.length) {
+        printSystemLine(`pending asap=${this.pendingAsap.length} queued=${this.pendingQueued.length}`);
+      }
+      this.redraw();
+      return;
+    }
+    if (slashAction === "blocked") {
+      this.printLine(`${label("warn", ansi.red)} Slash commands are disabled while a run is active except /status. Press Esc/Ctrl+C to stop, or wait until idle.`);
       this.setStatus(`running · command ${compactLine(content, 24)} not accepted during active run`);
       return;
     }
@@ -1610,7 +1630,14 @@ class LiveRunInput {
   queueAfterFinish() {
     const content = this.buffer.trim();
     if (!content) return;
-    if (content.startsWith("/")) {
+    const slashAction = activeRunSlashCommandAction(content);
+    if (slashAction === "status") {
+      this.setBuffer("");
+      printStatus(this.state);
+      this.redraw();
+      return;
+    }
+    if (slashAction === "blocked") {
       this.printLine(`${label("warn", ansi.red)} Slash commands cannot be queued during a run. Wait until idle, then run ${content}.`);
       this.setStatus(`running · command ${compactLine(content, 24)} not queued`);
       return;
@@ -1651,7 +1678,8 @@ class LiveRunInput {
 
   handleKey(str = "", key = {}) {
     if (key.ctrl && key.name === "c") {
-      this.controller.abort(new Error("Interrupted by ctrl-c."));
+      this.setStatus("stopping · ctrl-c");
+      this.controller.abort(createAbortError("Interrupted by ctrl-c."));
       return;
     }
     if (key.name === "escape") {
@@ -1662,7 +1690,8 @@ class LiveRunInput {
         this.redraw();
         return;
       }
-      this.controller.abort(new Error("Interrupted by escape."));
+      this.setStatus("stopping · escape");
+      this.controller.abort(createAbortError("Interrupted by escape."));
       return;
     }
     if (key.meta && key.name === "up") {
@@ -1760,7 +1789,9 @@ function printStatus(state) {
   printSystemLine(`project=${process.cwd()}`);
   printSystemLine(`cwd=${state.commandCwd || process.cwd()}`);
   printSystemLine(`session=${state.sessionId || "new"}`);
-  printSystemLine(`status=${state.status || "idle"}${state.activeGoal ? ` workingOn=${state.activeGoal}` : ""}`);
+  const progress =
+    state.currentStep && state.currentMaxSteps ? ` progress=${state.currentStep}/${state.currentMaxSteps}` : state.currentStep ? ` progress=${state.currentStep}` : "";
+  printSystemLine(`status=${state.status || "idle"}${progress}${state.activeGoal ? ` workingOn=${state.activeGoal}` : ""}`);
   printSystemLine(`language=${state.language || cliLanguage} (${languageLabel(state.language || cliLanguage)})`);
   if (state.lastEvent) printSystemLine(`last=${state.lastEvent}`);
   printSystemLine(`provider=${state.provider || "auto"} routing=${state.routingMode} model=${state.model || "auto"}`);
@@ -1930,9 +1961,26 @@ async function printResumeHistory(state, { limit = 0 } = {}) {
   for (const entry of shown) printHistoryEntry(entry);
 }
 
-function printStatusEvent(state, label, details = "") {
+function toolStatusDetails(data = {}) {
+  const tool = data.toolName || "unknown";
+  const args = data.args || {};
+  if (tool === "run_command" && args.command) return `${tool}: ${compactLine(args.command, 58)}`;
+  if ((tool === "write_file" || tool === "apply_patch" || tool === "read_file" || tool === "open_workspace_file") && args.path) {
+    return `${tool}: ${compactLine(args.path, 58)}`;
+  }
+  if ((tool === "open_url" || tool === "web_research" || tool === "web_search") && (args.url || args.query || args.q)) {
+    return `${tool}: ${compactLine(args.url || args.query || args.q, 58)}`;
+  }
+  return tool;
+}
+
+function printStatusEvent(state, label, details = "", meta = {}) {
   const safeDetails = compactLine(details, 72);
-  state.lastEvent = safeDetails ? `${label}: ${safeDetails}` : label;
+  if (meta.step) state.currentStep = meta.step;
+  if (meta.maxSteps) state.currentMaxSteps = meta.maxSteps;
+  const progress =
+    state.currentStep && state.currentMaxSteps ? `step ${state.currentStep}/${state.currentMaxSteps} · ` : state.currentStep ? `step ${state.currentStep} · ` : "";
+  state.lastEvent = `${progress}${safeDetails ? `${label}: ${safeDetails}` : label}`;
   const statusText = `${state.status || "running"} · ${state.lastEvent}`;
   if (activeRunInput) {
     activeRunInput.setStatus(statusText);
@@ -1955,7 +2003,7 @@ function attachRunInterrupts(controller) {
     if (controller.signal.aborted) return;
     const reason = isEscape ? "escape" : "ctrl-c";
     printSystemLine(`status=stopping reason=${reason}`);
-    controller.abort(new Error(`Interrupted by ${reason}.`));
+    controller.abort(createAbortError(`Interrupted by ${reason}.`));
   };
   input.on("keypress", handler);
   return () => {
@@ -3589,12 +3637,18 @@ async function runPrompt(prompt, state, packageDir, { approvalDepth = 0 } = {})
       onEvent: (type, data = {}) => {
         if (type === "plan.created") {
           printStatusEvent(state, "planned");
+        } else if (type === "budget.initialized") {
+          state.currentMaxSteps = data.currentMaxSteps || data.initialMaxSteps || state.maxSteps;
+          printStatusEvent(state, "budget", `${state.currentMaxSteps} steps`);
         } else if (type === "model.requested") {
-          printStatusEvent(state, "model_wait", `${data.provider || "model"}/${data.model || ""}`);
+          printStatusEvent(state, "model_wait", `${data.provider || "model"}/${data.model || ""}`, {
+            step: data.step,
+            maxSteps: state.currentMaxSteps,
+          });
         } else if (type === "tool.started") {
-          printStatusEvent(state, "tool", data.toolName || "unknown");
-        } else if (type === "tool.completed") {
-          printStatusEvent(state, "tool_done", data.toolName || "unknown");
+          printStatusEvent(state, "tool", toolStatusDetails(data));
+        } else if (type === "tool.completed" || type === "tool.failed") {
+          printStatusEvent(state, type === "tool.failed" || data.ok === false ? "tool_failed" : "tool_done", toolStatusDetails(data));
         } else if (type === "file.changed") {
           printWorkspaceChange(data);
         } else if (type === "tool.blocked") {
@@ -3619,7 +3673,10 @@ async function runPrompt(prompt, state, packageDir, { approvalDepth = 0 } = {})
         } else if (type === "session.stopped") {
           printStatusEvent(state, "stopped", data.reason || "");
         } else if (type === "model.responded") {
-          printStatusEvent(state, "model_responded", data.content ? data.content.slice(0, 80).replace(/\s+/g, " ") : "");
+          printStatusEvent(state, "model_responded", data.content ? data.content.slice(0, 80).replace(/\s+/g, " ") : "", {
+            step: data.step,
+            maxSteps: state.currentMaxSteps,
+          });
         }
       },
     });

package/src/model-client.js

@@ -603,10 +603,10 @@ export async function createPlan(client, config, state) {
           state.startUrl ? `Suggested start URL: ${state.startUrl}` : "",
           config.allowedDomains.length > 0 ? `Allowed domains: ${config.allowedDomains.join(", ")}` : "",
           config.allowShellTool
-            ? `Shell tool is enabled in ${config.commandCwd}. Host platform: ${platformLabel(platform)}. In Docker, this path is mounted as /workspace with persistent /aginti-env and /aginti-cache mounts. Use relative paths or /workspace paths, not absolute host temp paths. Permission mode: ${config.permissionMode || "normal"}. Sandbox mode: ${config.sandboxMode}. Package install policy: ${config.packageInstallPolicy}. For npm/pip/conda/venv setup, explain the need and wait for approval unless policy is allow. Do not run npx aginti, npm exec aginti, or nested aginti diagnostics from this shell; they may resolve stale project packages or create recursive agent sessions. On native Windows host mode, prefer PowerShell/cmd-compatible commands or WSL/Docker for bash-like toolchains.`
+            ? `Shell tool is enabled in ${config.commandCwd}. Host platform: ${platformLabel(platform)}. In Docker, this path is mounted as /workspace with persistent /aginti-env and /aginti-cache mounts, and common host data roots such as the user's home parent are mounted read-only at their original absolute paths for inspection. Use relative paths or /workspace for outputs and writes. Absolute host paths are acceptable for read-only inspection when visible, but do not write outside /workspace unless the user approves host mode. Permission mode: ${config.permissionMode || "normal"}. Sandbox mode: ${config.sandboxMode}. Package install policy: ${config.packageInstallPolicy}. For npm/pip/conda/venv setup, explain the need and wait for approval unless policy is allow. Do not run npx aginti, npm exec aginti, or nested aginti diagnostics from this shell; they may resolve stale project packages or create recursive agent sessions. On native Windows host mode, prefer PowerShell/cmd-compatible commands or WSL/Docker for bash-like toolchains.`
             : "",
           config.allowShellTool
-            ? "Host tmux tools are enabled for long-running sessions. Plan to use tmux_start_session for durable jobs, tmux_capture_pane to monitor, tmux_send_keys to interact after capture, and tmux_list_sessions to discover existing sessions. Do not install or run tmux inside Docker run_command containers; those containers are short-lived and cannot preserve tmux servers. In Docker sandbox mode, tmux startup/send commands are still workspace-bound and shell-pane text follows the same Docker workspace command policy as run_command: use relative project paths, not absolute host paths outside the workspace, and do not use tmux as a workaround for package installs, destructive git rewrites, or broad shell commands. In host mode, tmux startup/send command text follows the same host shell policy as run_command; if blocked, present the suggested approval/rerun path instead of trying tmux as a workaround. Ask for --sandbox-mode host --allow-destructive before trusted whole-host tmux work."
+            ? "Host tmux tools are enabled for long-running sessions. Plan to use tmux_start_session for durable jobs, tmux_capture_pane to monitor, tmux_send_keys to interact after capture, and tmux_list_sessions to discover existing sessions. Do not install or run tmux inside Docker run_command containers; those containers are short-lived and cannot preserve tmux servers. In Docker sandbox mode, tmux startup/send commands are still workspace-write-bound and shell-pane text follows the same Docker workspace command policy as run_command: use relative project paths for writes and outputs. Read-only inspection of visible host absolute paths is allowed through run_command's read-only mounts; do not use tmux as a workaround for package installs, destructive git rewrites, or broad shell commands. In host mode, tmux startup/send command text follows the same host shell policy as run_command; if blocked, present the suggested approval/rerun path instead of trying tmux as a workaround. Ask for --sandbox-mode host --allow-destructive before trusted whole-host write/system work."
             : "",
           config.allowFileTools
             ? `Workspace file tools are enabled in ${config.commandCwd}: inspect_project, list_files, read_file, search_files, write_file, apply_patch, open_workspace_file, preview_workspace. For large or unfamiliar repos, plan to call inspect_project first, then search/read AGINTI.md/AGENTS.md/README/manifests and exact files. apply_patch supports exact single-file replacements and Codex-style/unified multi-file patches; prefer it for edits after reading relevant context. Keep all paths workspace-relative, for example plot_fx.svg or docs/report.tex, and avoid secrets. For newly generated standalone prose/docs/stories/assets, choose a descriptive non-conflicting filename from the topic/language instead of generic names like story.txt or output.txt; do not overwrite existing files unless the user explicitly asked to update/replace/overwrite that file. For generated local HTML/SVG/PDF/static sites, plan to use open_workspace_file or preview_workspace rather than starting a localhost server inside Docker.`