@lazyingart/agintiflow 0.20.186 → 0.20.187

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.186",
+  "version": "0.20.187",
   "type": "module",
   "description": "AgInTiFlow is a project-aware agent workspace for hybrid wet-dry R&D, hardware-aware intelligence, software automation, and industrial workflows.",
   "license": "Apache-2.0",

package/public/app.js

@@ -1251,6 +1251,37 @@ function workspaceFilesByLane() {
   return groups;
 }
 
+function buildWorkspaceFolderTree(files = []) {
+  const root = { name: "", path: "", dirs: new Map(), files: [] };
+  for (const file of files) {
+    const parts = String(file.path || "")
+      .split("/")
+      .filter(Boolean);
+    if (!parts.length) continue;
+    const fileName = parts.pop();
+    let node = root;
+    let currentPath = "";
+    for (const part of parts) {
+      currentPath = currentPath ? `${currentPath}/${part}` : part;
+      if (!node.dirs.has(part)) node.dirs.set(part, { name: part, path: currentPath, dirs: new Map(), files: [] });
+      node = node.dirs.get(part);
+    }
+    node.files.push({ ...file, name: file.name || fileName });
+  }
+  return root;
+}
+
+function workspaceFolderCount(node) {
+  if (!node) return 0;
+  let count = node.files?.length || 0;
+  for (const child of node.dirs?.values?.() || []) count += workspaceFolderCount(child);
+  return count;
+}
+
+function sortWorkspaceFiles(left, right) {
+  return String(left.path || "").localeCompare(String(right.path || ""));
+}
+
 function workspaceActiveFile() {
   return workspaceBrowser.files.find((file) => file.path === workspaceBrowser.activePath) || null;
 }
@@ -1279,12 +1310,18 @@ function renderWorkspaceExplorer() {
   const activeLane = workspaceBrowser.activeLane || "all";
   const warnings = workspaceBrowser.warnings?.length ? ` · ${workspaceBrowser.warnings.length} warning(s)` : "";
   const truncated = workspaceBrowser.truncated ? " · truncated" : "";
-  const status = workspaceBrowser.loading
-    ? "Loading workspace..."
-    : workspaceBrowser.error
-      ? `Workspace unavailable: ${workspaceBrowser.error}`
-      : `${workspaceBrowser.files.length} files · ${workspaceBrowser.root || workspaceRoot()}${warnings}${truncated}`;
-  workspaceBrowserStatusEl.textContent = status;
+  if (workspaceBrowser.loading) {
+    workspaceBrowserStatusEl.textContent = "Loading workspace...";
+  } else if (workspaceBrowser.error) {
+    workspaceBrowserStatusEl.textContent = `Workspace unavailable: ${workspaceBrowser.error}`;
+  } else {
+    workspaceBrowserStatusEl.innerHTML = `
+      <span class="workspace-status-chip">${workspaceBrowser.files.length} files</span>
+      <span class="workspace-status-chip">${escapeHtml(activeLane)}</span>
+      <code class="workspace-root-path">${escapeHtml(workspaceBrowser.root || workspaceRoot())}</code>
+      ${warnings || truncated ? `<span class="workspace-status-warn">${escapeHtml(`${warnings}${truncated}`.replace(/^ · /, ""))}</span>` : ""}
+    `;
+  }
 
   workspaceLanesEl.innerHTML = WORKSPACE_LANES.map((lane) => {
     const count = groups[lane.id]?.length || 0;
@@ -1302,34 +1339,69 @@ function renderWorkspaceExplorer() {
     `;
   }).join("");
 
-  const visibleFiles = (groups[activeLane] || []).slice().sort((left, right) => left.path.localeCompare(right.path));
+  const visibleFiles = (groups[activeLane] || []).slice().sort(sortWorkspaceFiles);
   if (!visibleFiles.length) {
     workspaceTreeEl.innerHTML = `<p class="subtle workspace-empty">No files in this category.</p>`;
     return;
   }
 
-  workspaceTreeEl.innerHTML = visibleFiles
-    .map((file) => {
-      const lane = inferWorkspaceLane(file);
-      const active = file.path === workspaceBrowser.activePath;
-      const meta = [lane, formatBytes(file.size), file.binary ? "binary" : "text"].join(" · ");
-      return `
-        <button
-          type="button"
-          class="workspace-file-row"
-          data-workspace-file="${escapeHtml(file.path)}"
-          data-selected="${active}"
-          draggable="true"
-        >
-          <span class="workspace-file-main">
-            <strong>${escapeHtml(workspaceBaseName(file.path))}</strong>
-            <small>${escapeHtml(workspaceDir(file.path) || ".")}</small>
-          </span>
-          <span class="workspace-file-meta">${escapeHtml(meta)}</span>
-        </button>
-      `;
-    })
-    .join("");
+  const tree = buildWorkspaceFolderTree(visibleFiles);
+  workspaceTreeEl.innerHTML = `
+    <div class="workspace-tree-toolbar">
+      <span>${escapeHtml(WORKSPACE_LANES.find((lane) => lane.id === activeLane)?.label || "Files")}</span>
+      <strong>${visibleFiles.length}</strong>
+    </div>
+    <div class="workspace-folder-root">
+      ${renderWorkspaceFolderNode(tree, 0)}
+    </div>
+  `;
+}
+
+function renderWorkspaceFileNode(file, depth = 0) {
+  const lane = inferWorkspaceLane(file);
+  const active = file.path === workspaceBrowser.activePath;
+  const meta = [lane, formatBytes(file.size), file.binary ? "binary" : "text"].join(" · ");
+  return `
+    <button
+      type="button"
+      class="workspace-file-row workspace-tree-file"
+      data-workspace-file="${escapeHtml(file.path)}"
+      data-selected="${active}"
+      draggable="true"
+      style="--depth: ${depth};"
+    >
+      <span class="workspace-file-icon" aria-hidden="true">${file.binary ? "bin" : "txt"}</span>
+      <span class="workspace-file-main">
+        <strong>${escapeHtml(workspaceBaseName(file.path))}</strong>
+        <small>${escapeHtml(workspaceDir(file.path) || ".")}</small>
+      </span>
+      <span class="workspace-file-meta">${escapeHtml(meta)}</span>
+    </button>
+  `;
+}
+
+function renderWorkspaceFolderNode(node, depth = 0) {
+  const dirs = [...(node.dirs?.values?.() || [])].sort((left, right) => left.name.localeCompare(right.name));
+  const files = (node.files || []).slice().sort(sortWorkspaceFiles);
+  const children = [
+    ...dirs.map((child) => renderWorkspaceFolderNode(child, depth + 1)),
+    ...files.map((file) => renderWorkspaceFileNode(file, depth)),
+  ].join("");
+  if (depth === 0) return children;
+  const activeInside = workspaceBrowser.activePath && workspaceBrowser.activePath.startsWith(`${node.path}/`);
+  const open = depth <= 2 || activeInside;
+  return `
+    <details class="workspace-folder" ${open ? "open" : ""} style="--depth: ${Math.max(depth - 1, 0)};">
+      <summary>
+        <span class="workspace-folder-icon" aria-hidden="true">&gt;</span>
+        <span class="workspace-folder-name">${escapeHtml(node.name)}</span>
+        <small>${workspaceFolderCount(node)}</small>
+      </summary>
+      <div class="workspace-folder-children">
+        ${children}
+      </div>
+    </details>
+  `;
 }
 
 function renderWorkspaceWorkbench() {

package/public/styles.css

@@ -959,10 +959,43 @@ button.danger {
 }
 
 .workspace-browser-status {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 7px;
   line-height: 1.35;
   overflow-wrap: anywhere;
 }
 
+.workspace-status-chip {
+  padding: 4px 8px;
+  border: 1px solid rgba(15, 118, 110, 0.16);
+  border-radius: 999px;
+  background: rgba(255, 253, 250, 0.86);
+  color: var(--ink);
+  font-size: 0.76rem;
+  font-weight: 700;
+  text-transform: capitalize;
+}
+
+.workspace-root-path {
+  min-width: 0;
+  max-width: 100%;
+  padding: 5px 8px;
+  border: 1px solid rgba(15, 118, 110, 0.14);
+  border-radius: 10px;
+  background: rgba(13, 148, 136, 0.07);
+  color: #155e75;
+  font-family: "IBM Plex Mono", "SFMono-Regular", monospace;
+  font-size: 0.76rem;
+  overflow-wrap: anywhere;
+}
+
+.workspace-status-warn {
+  color: #b45309;
+  font-size: 0.76rem;
+}
+
 .workspace-lanes {
   display: grid;
   grid-template-columns: repeat(auto-fit, minmax(82px, 1fr));
@@ -995,11 +1028,105 @@ button.danger {
 }
 
 .workspace-tree {
-  display: grid;
-  gap: 7px;
   max-height: 440px;
   overflow: auto;
-  padding-right: 2px;
+  padding: 8px;
+  border: 1px solid rgba(15, 118, 110, 0.12);
+  border-radius: 16px;
+  background:
+    linear-gradient(180deg, rgba(255, 253, 250, 0.88), rgba(240, 253, 250, 0.58)),
+    rgba(255, 255, 255, 0.72);
+}
+
+.workspace-tree-toolbar {
+  position: sticky;
+  top: 0;
+  z-index: 1;
+  display: flex;
+  justify-content: space-between;
+  align-items: center;
+  gap: 10px;
+  margin: -8px -8px 8px;
+  padding: 8px 10px;
+  border-bottom: 1px solid rgba(15, 118, 110, 0.1);
+  background: rgba(255, 253, 250, 0.95);
+  color: var(--muted);
+  font-size: 0.78rem;
+  font-weight: 700;
+  text-transform: uppercase;
+  letter-spacing: 0.03em;
+}
+
+.workspace-tree-toolbar strong {
+  color: var(--accent);
+}
+
+.workspace-folder-root,
+.workspace-folder-children {
+  display: grid;
+  gap: 4px;
+}
+
+.workspace-folder {
+  margin-left: calc(var(--depth, 0) * 12px);
+}
+
+.workspace-folder summary {
+  display: flex;
+  align-items: center;
+  gap: 7px;
+  min-height: 32px;
+  padding: 6px 8px;
+  border: 1px solid transparent;
+  border-radius: 11px;
+  color: var(--ink);
+  cursor: pointer;
+  list-style: none;
+  user-select: none;
+}
+
+.workspace-folder summary::-webkit-details-marker {
+  display: none;
+}
+
+.workspace-folder summary:hover {
+  border-color: rgba(15, 118, 110, 0.16);
+  background: rgba(240, 253, 250, 0.72);
+}
+
+.workspace-folder-icon {
+  display: inline-grid;
+  place-items: center;
+  width: 18px;
+  height: 18px;
+  border: 1px solid rgba(15, 118, 110, 0.18);
+  border-radius: 6px;
+  color: var(--accent);
+  font-family: "IBM Plex Mono", "SFMono-Regular", monospace;
+  font-size: 0.68rem;
+  transition: transform 0.16s ease;
+}
+
+.workspace-folder[open] > summary .workspace-folder-icon {
+  transform: rotate(90deg);
+}
+
+.workspace-folder-name {
+  min-width: 0;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+  font-weight: 750;
+}
+
+.workspace-folder summary small {
+  margin-left: auto;
+  color: var(--muted);
+  font-size: 0.72rem;
+}
+
+.workspace-folder-children {
+  margin-top: 4px;
 }
 
 .workspace-empty {
@@ -1011,18 +1138,23 @@ button.danger {
 
 .workspace-file-row {
   display: grid;
-  grid-template-columns: minmax(0, 1fr);
-  gap: 3px;
+  grid-template-columns: auto minmax(0, 1fr);
+  gap: 6px 8px;
+  align-items: center;
   width: 100%;
-  padding: 10px 11px;
+  padding: 8px 10px;
   border: 1px solid rgba(217, 119, 6, 0.16);
-  border-radius: 14px;
+  border-radius: 12px;
   background: rgba(255, 253, 250, 0.72);
   color: var(--ink);
   cursor: pointer;
   text-align: left;
 }
 
+.workspace-tree-file {
+  margin-left: calc(var(--depth, 0) * 12px);
+}
+
 .workspace-file-row:hover {
   border-color: rgba(15, 118, 110, 0.34);
   background: rgba(240, 253, 250, 0.72);
@@ -1030,10 +1162,24 @@ button.danger {
 
 .workspace-file-row[data-selected="true"] {
   border-color: rgba(15, 118, 110, 0.58);
-  background: linear-gradient(135deg, rgba(15, 118, 110, 0.18), rgba(255, 255, 255, 0.92));
+  background: linear-gradient(135deg, rgba(15, 118, 110, 0.22), rgba(255, 255, 255, 0.96));
   box-shadow: 0 0 0 2px rgba(15, 118, 110, 0.1);
 }
 
+.workspace-file-icon {
+  display: inline-grid;
+  place-items: center;
+  width: 30px;
+  height: 24px;
+  border-radius: 8px;
+  background: rgba(15, 118, 110, 0.09);
+  color: #155e75;
+  font-family: "IBM Plex Mono", "SFMono-Regular", monospace;
+  font-size: 0.62rem;
+  font-weight: 800;
+  text-transform: uppercase;
+}
+
 .workspace-file-main {
   display: grid;
   gap: 1px;
@@ -1050,6 +1196,7 @@ button.danger {
 
 .workspace-file-main small,
 .workspace-file-meta {
+  grid-column: 2;
   color: var(--muted);
   font-size: 0.76rem;
 }

package/references/agintiflow-npm-publication-memory.md

@@ -10,6 +10,17 @@ This note records the working publication route for AgInTiFlow so future release
 
 Latest verified release:
 
+- Version: `0.20.186`
+- Commit: `f32a748`
+- GitHub Actions run: `https://github.com/lazyingart/AgInTiFlow/actions/runs/26700782132`
+- Workflow result: success
+- npm registry check: `npm view @lazyingart/agintiflow version dist-tags.latest --registry=https://registry.npmjs.org` returned `0.20.186`.
+- Installed verification: `npm install -g @lazyingart/agintiflow@0.20.186` then `aginti --version` returned `0.20.186`.
+- Webapp verification: `aginti webapp restart --port 3210` then `curl -fsS http://127.0.0.1:3210/health` returned `version":"0.20.186"` from the global npm package path.
+- Direct image CLI verification: `aginti image --json --dry-run --format svg` returned `requestedFormat:"svg"`, `actualFormat:"png"`, and a clear raster PNG fallback notice.
+
+Previous verified release:
+
 - Version: `0.20.185`
 - Commit: `58d6087`
 - GitHub Actions run: `https://github.com/lazyingart/AgInTiFlow/actions/runs/26700387931`

package/scripts/smoke-web-api.js

@@ -93,6 +93,7 @@ try {
   await fs.mkdir(path.join(runtimeDir, "data"), { recursive: true });
   await fs.writeFile(path.join(runtimeDir, "notes", "workspace-smoke.md"), "# Workspace smoke\n\nEditable text.\n");
   await fs.writeFile(path.join(runtimeDir, "data", "workspace-smoke.csv"), "sample,value\nalpha,1\n");
+  await fs.writeFile(path.join(runtimeDir, ".aginti", ".env"), "DEEPSEEK_API_KEY=should-not-render\n");
 
   const webAppHtml = await fs.readFile(path.join(repoRoot, "public", "index.html"), "utf8");
   const chatThreadIndex = webAppHtml.indexOf('id="chat-thread"');
@@ -145,6 +146,9 @@ try {
   if (!workspaceSnapshot.files?.some((file) => file.path === "notes/workspace-smoke.md" && file.content.includes("Editable text."))) {
     throw new Error(`workspace snapshot did not include editable note: ${JSON.stringify(workspaceSnapshot.files?.slice(0, 5))}`);
   }
+  if (workspaceSnapshot.files?.some((file) => file.path === ".aginti/.env" || file.path === ".aginti/mcp.json" || file.path === ".env")) {
+    throw new Error(`workspace snapshot exposed protected internal/secret files: ${JSON.stringify(workspaceSnapshot.files?.slice(0, 10))}`);
+  }
   const rawWorkspaceResponse = await fetch(
     `${baseUrl}/api/workspace/raw?commandCwd=${encodeURIComponent(runtimeDir)}&path=${encodeURIComponent("notes/workspace-smoke.md")}`
   );
@@ -152,6 +156,20 @@ try {
   if (!rawWorkspaceResponse.ok || !rawWorkspaceText.includes("Workspace smoke")) {
     throw new Error(`workspace raw endpoint failed: status=${rawWorkspaceResponse.status} body=${rawWorkspaceText.slice(0, 120)}`);
   }
+  const protectedRawResponse = await fetch(
+    `${baseUrl}/api/workspace/raw?commandCwd=${encodeURIComponent(runtimeDir)}&path=${encodeURIComponent(".aginti/.env")}`
+  );
+  if (protectedRawResponse.ok) {
+    throw new Error("workspace raw endpoint exposed protected .aginti/.env");
+  }
+  const protectedWriteResponse = await fetch(`${baseUrl}/api/workspace/write`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ commandCwd: runtimeDir, path: ".env", content: "SECRET=blocked\n" }),
+  });
+  if (protectedWriteResponse.ok) {
+    throw new Error("workspace write endpoint allowed protected .env");
+  }
   const writtenWorkspace = await fetchJson("/api/workspace/write", {
     method: "POST",
     headers: { "Content-Type": "application/json" },

package/scripts/smoke-web-ui.js

@@ -73,8 +73,10 @@ let browser;
 
 try {
   await waitForHealth();
+  await fs.mkdir(path.join(runtimeDir, ".aginti"), { recursive: true });
   await fs.mkdir(path.join(runtimeDir, "notes"), { recursive: true });
   await fs.mkdir(path.join(runtimeDir, "data"), { recursive: true });
+  await fs.writeFile(path.join(runtimeDir, ".aginti", ".env"), "DEEPSEEK_API_KEY=should-not-render\n");
   await fs.writeFile(path.join(runtimeDir, "notes", "workspace-ui.md"), "# Workspace UI\n\ninitial body\n");
   await fs.writeFile(path.join(runtimeDir, "data", "workspace-ui.csv"), "sample,value\nalpha,1\n");
   browser = await chromium.launch({ headless: true });
@@ -102,6 +104,16 @@ try {
   if ((await page.locator("#workspace-lanes [data-workspace-lane]").count()) < 8) {
     throw new Error("workspace explorer did not render general category lanes");
   }
+  if ((await page.locator('[data-workspace-file=".aginti/.env"]').count()) !== 0) {
+    throw new Error("workspace explorer exposed protected .aginti/.env");
+  }
+  if ((await page.locator("#workspace-tree details.workspace-folder").count()) < 1) {
+    throw new Error("workspace explorer did not render a folder tree");
+  }
+  const statusText = await page.locator("#workspace-browser-status").innerText();
+  if (!statusText.includes(runtimeDir) || !/files/i.test(statusText)) {
+    throw new Error(`workspace explorer status did not show file count and root path: ${statusText}`);
+  }
   if ((await page.locator('[data-workspace-file="notes/workspace-ui.md"]').getAttribute("draggable")) !== "true") {
     throw new Error("workspace file rows are not draggable");
   }
@@ -305,6 +317,9 @@ try {
           "working-directory-search-top",
           "project-status-chips",
           "workspace-explorer-general-lanes",
+          "workspace-explorer-folder-tree",
+          "workspace-explorer-protected-files-hidden",
+          "workspace-explorer-status-root",
           "workspace-file-selection",
           "workspace-editor-save-persists",
           "workspace-file-drop-to-chat",

package/web.js

@@ -778,8 +778,11 @@ const WORKSPACE_SKIP_NAMES = new Set([
   ".git",
   ".hg",
   ".svn",
+  ".aginti",
+  ".aginti-work",
   ".aginti-sessions",
   ".agintiflow-home",
+  ".sessions",
   ".cache",
   ".pytest_cache",
   ".ruff_cache",
@@ -790,9 +793,26 @@ const WORKSPACE_SKIP_NAMES = new Set([
   "dist",
   "node_modules",
 ]);
+const WORKSPACE_PROTECTED_DIRS = new Set([".aginti", ".aginti-work", ".aginti-sessions", ".agintiflow-home", ".sessions", ".git", ".hg", ".svn"]);
+const WORKSPACE_PROTECTED_FILES = new Set([".env", ".npmrc", ".pypirc", ".netrc"]);
 const WORKSPACE_MAX_FILES = 1600;
 const WORKSPACE_MAX_TEXT_BYTES = 512 * 1024;
 
+function isProtectedEnvName(name = "") {
+  const value = String(name || "");
+  if (value === ".env") return true;
+  if (!value.startsWith(".env.")) return false;
+  return !/\.(example|sample|template)$/i.test(value);
+}
+
+function isProtectedWorkspacePath(relativePath = "") {
+  const normalized = String(relativePath || "")
+    .replace(/\\/g, "/")
+    .replace(/^\/+/, "");
+  const parts = normalized.split("/").filter(Boolean);
+  return parts.some((part) => WORKSPACE_PROTECTED_DIRS.has(part) || WORKSPACE_PROTECTED_FILES.has(part) || isProtectedEnvName(part));
+}
+
 function isInsideDirectory(parent, candidate) {
   const relative = path.relative(parent, candidate);
   return relative === "" || (!relative.startsWith("..") && !path.isAbsolute(relative));
@@ -820,6 +840,9 @@ async function resolveWorkspaceFilePath(root, relativePath = "", { mustExist = f
     .replace(/\\/g, "/")
     .replace(/^\/+/, "");
   if (!normalizedRelative || normalizedRelative.includes("\0")) throw new Error("Workspace file path is required.");
+  if (isProtectedWorkspacePath(normalizedRelative)) {
+    throw new Error("Workspace file is protected because it may contain secrets or AgInTiFlow internals.");
+  }
   const absolutePath = path.resolve(root, normalizedRelative);
   if (!isInsideDirectory(root, absolutePath)) throw new Error("Workspace file path escapes the selected folder.");
 
@@ -892,6 +915,7 @@ async function buildWorkspaceSnapshot(root) {
 
       const absolutePath = path.join(currentDir, entry.name);
       const relativePath = relativeWorkspacePath(root, absolutePath);
+      if (isProtectedWorkspacePath(relativePath)) continue;
       let stat;
       let realPath = absolutePath;
       let symlink = false;