@lazyingart/agintiflow 0.20.136 → 0.20.138

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.136",
+  "version": "0.20.138",
   "type": "module",
   "description": "AgInTiFlow is a project-aware agent workspace for hybrid wet-dry R&D, hardware-aware intelligence, software automation, and industrial workflows.",
   "license": "Apache-2.0",

package/scripts/smoke-coding-tools.js

@@ -681,6 +681,20 @@ try {
   );
   assert(limitedReadResult.content === "line 001\nline 002\nline 003", "read_file lineLimit did not return the requested line slice");
   assert(limitedReadResult.contentTruncatedByLines === true, "read_file lineLimit should report remaining lines");
+  const largeReadLines = Array.from({ length: 30000 }, (_, index) => `large line ${String(index + 1).padStart(5, "0")}`).join("\n");
+  await fs.writeFile(path.join(workspace, "large-read-smoke.md"), largeReadLines, "utf8");
+  const largeLimitedReadResult = await executeWorkspaceTool(
+    "read_file",
+    { path: "large-read-smoke.md", startLine: 100, lineLimit: 2 },
+    {
+      commandCwd: workspace,
+      allowFileTools: true,
+    }
+  );
+  assert(
+    largeLimitedReadResult.content === "large line 00100\nlarge line 00101",
+    "read_file lineLimit should work on larger text files"
+  );
   const inspected = await executeWorkspaceTool(
     "inspect_project",
     { path: ".", maxDepth: 4, limit: 200 },
@@ -1017,6 +1031,27 @@ try {
       if (error.code !== "ENOENT") throw error;
     });
 
+  const safeEnvReferenceResult = await executeWorkspaceTool(
+    "write_file",
+    {
+      path: "scripts/safe-env-reference.py",
+      content: [
+        "import os",
+        "from openai import OpenAI",
+        'api_key = os.environ.get("DEEPSEEK_API_KEY")',
+        'client = OpenAI(api_key=api_key, base_url="https://api.deepseek.com")',
+        "print(client)",
+        "",
+      ].join("\n"),
+      mode: "create",
+    },
+    {
+      commandCwd: workspace,
+      allowFileTools: true,
+    }
+  );
+  assert(safeEnvReferenceResult.ok, "write_file should allow safe env-var credential references in source code");
+
   const redactedContentResult = await executeWorkspaceTool(
     "write_file",
     {
@@ -1113,6 +1148,7 @@ try {
           "patch_move_no_overwrite",
           "block_env",
           "block_secret_write_content",
+          "allow_safe_env_reference_content",
           "allow_redacted_write_content",
           "block_secret_patch_content",
           "block_outside",

package/src/workspace-tools.js

@@ -7,6 +7,7 @@ export const WORKSPACE_TOOL_NAMES = ["inspect_project", "list_files", "read_file
 export const WORKSPACE_WRITE_TOOL_NAMES = ["write_file", "apply_patch"];
 
 const MAX_READ_BYTES = 220_000;
+const MAX_LINE_LIMIT_READ_BYTES = 5_000_000;
 const MAX_WRITE_BYTES = 220_000;
 const MAX_PATCH_BYTES = 260_000;
 const MAX_LIST_ENTRIES = 360;
@@ -197,7 +198,7 @@ function pathPolicy(toolName, relativePath) {
 }
 
 function secretContentPolicy(content) {
-  if (!hasSensitiveText(content)) return { allowed: true };
+  if (!hasSensitiveText(stripSafeCredentialReferences(content))) return { allowed: true };
   return {
     allowed: false,
     reason:
@@ -206,6 +207,35 @@ function secretContentPolicy(content) {
   };
 }
 
+function stripSafeCredentialReferences(content) {
+  let text = String(content ?? "");
+  const keyName = String.raw`(?:api[_-]?key|token|secret|password|passwd|npm_token|_authToken|grsai|venice_api_key)`;
+  const envName = String.raw`[A-Z][A-Z0-9_]*(?:API[_-]?KEY|TOKEN|SECRET|PASSWORD|PASSWD|GRSAI|VENICE)[A-Z0-9_]*`;
+
+  text = text.replace(
+    new RegExp(String.raw`\b${keyName}\s*=\s*(?:os\.environ\.get|os\.getenv)\(\s*["']${envName}["'](?:\s*,\s*(?:None|""|''))?\s*\)`, "gi"),
+    "safe_credential_ref=[ENV_REF]"
+  );
+  text = text.replace(
+    new RegExp(String.raw`\b${keyName}\s*=\s*(?:os\.environ|env)\[\s*["']${envName}["']\s*\]`, "gi"),
+    "safe_credential_ref=[ENV_REF]"
+  );
+  text = text.replace(
+    new RegExp(String.raw`\b${keyName}\s*=\s*(?:process\.env\.${envName}|Deno\.env\.get\(\s*["']${envName}["']\s*\))`, "gi"),
+    "safe_credential_ref=[ENV_REF]"
+  );
+  text = text.replace(
+    new RegExp(String.raw`([,(]\s*)${keyName}\s*=\s*[A-Za-z_$][\w$]*(?=\s*[,)\n])`, "gi"),
+    "$1safe_credential_ref=[VAR_REF]"
+  );
+  text = text.replace(
+    new RegExp(String.raw`([,{]\s*)${keyName}\s*:\s*[A-Za-z_$][\w$]*(?=\s*[,}\n])`, "gi"),
+    "$1safe_credential_ref=[VAR_REF]"
+  );
+
+  return text;
+}
+
 function writeContentPolicy(toolName, args, operations = null) {
   if (toolName === "write_file") return secretContentPolicy(args.content || "");
   if (toolName !== "apply_patch") return { allowed: true };
@@ -390,10 +420,14 @@ async function listFiles(config, args) {
   };
 }
 
-async function readTextFile(target) {
+async function readTextFile(target, { allowLargeLineLimited = false } = {}) {
   const stat = await fs.stat(target.absolutePath);
   if (!stat.isFile()) throw new Error(`Path is not a file: ${target.relativePath}`);
-  if (stat.size > MAX_READ_BYTES) throw new Error(`File is too large to read safely: ${target.relativePath}`);
+  if (stat.size > MAX_READ_BYTES) {
+    if (!allowLargeLineLimited || stat.size > MAX_LINE_LIMIT_READ_BYTES) {
+      throw new Error(`File is too large to read safely: ${target.relativePath}`);
+    }
+  }
 
   const buffer = await fs.readFile(target.absolutePath);
   if (buffer.includes(0)) throw new Error(`Binary files are not readable through this tool: ${target.relativePath}`);
@@ -406,11 +440,11 @@ async function readTextFile(target) {
 
 async function readFile(config, args) {
   const target = resolveWorkspacePath(config, args.path);
-  const { stat, content, hash } = await readTextFile(target);
-  const lines = content.split(/\r?\n/);
-  const startLine = Math.min(Math.max(Number(args.startLine) || 1, 1), Math.max(lines.length, 1));
   const requestedLineLimit = Number(args.lineLimit || args.limit || 0);
   const lineLimit = Number.isFinite(requestedLineLimit) && requestedLineLimit > 0 ? Math.min(requestedLineLimit, 1000) : 0;
+  const { stat, content, hash } = await readTextFile(target, { allowLargeLineLimited: lineLimit > 0 });
+  const lines = content.split(/\r?\n/);
+  const startLine = Math.min(Math.max(Number(args.startLine) || 1, 1), Math.max(lines.length, 1));
   const selectedLines = lineLimit > 0 ? lines.slice(startLine - 1, startLine - 1 + lineLimit) : lines;
   const selectedContent = selectedLines.join("\n");
   return {