@lazyingart/agintiflow 0.20.217 → 0.20.218

package/docs/supervision-campaign-ledger.md

@@ -267,3 +267,66 @@ platform-aware POSIX and Windows command quoting; and recognition of bounded
 stdin `sed -n` pipelines as read-only inspection. Production code contains no
 campaign scenario IDs, target paths, expected prose, commit IDs, or acceptance
 literals.
+
+### Live inbox requirement coalescing
+
+The next installed-release run tested actual mid-turn input rather than a
+sequence of explicit resume commands. A DeepSeek task started from a normal
+repository-writing request. While its first model call was active, two
+independent corrections were appended through `aginti queue`. Both received
+distinct durable inbox IDs and were applied exactly once at the first safe tool
+boundary, before the source note was read.
+
+AgInTiFlow `0.20.217` retained both corrections through later context
+compaction, produced one concise artifact, removed every superseded value,
+preserved the source note, added only narrowly scoped runtime ignore rules,
+committed the intentional files, and left the target repository clean. An
+external semantic and repository-state contract passed at target commit
+`f19ff4b`. No AgInTiFlow source change or task-specific prompt branch was
+needed; the run validates the generic inbox, context, evidence, and completion
+contracts in the published package.
+
+### LabCanvas least-privilege worker integration
+
+`labcanvas-worker-permission-018` validated the installed AgInTiFlow `0.20.217`
+through LabCanvas after a real WeCom research task paused at
+`permission_required`. The defect was in the integration boundary: LabCanvas
+unconditionally selected AgInTi's blocked package-install tier, which also
+blocked ordinary workspace shell execution. LabCanvas now keeps response-only
+roles blocked while granting genuine worker roles reversible package setup
+inside the Docker workspace. Host access, credentials, payment, publication,
+destructive operations, and other irreversible actions remain separately
+guarded.
+
+A direct DeepSeek-backed worker smoke created and validated a bounded workspace
+artifact without a permission prompt. Focused backend regressions, all WeChat
+self-checks, the complete 1,442-test LabCanvas suite, and GitHub Actions passed.
+The originally blocked exact-chat task was then resumed without duplicate model
+work, produced a visually inspected nine-page XeLaTeX research report, and
+delivered one concise message plus the PDF through the verified WeCom transport.
+The follow-up message was preserved in the same chat session. The reusable fix
+is AgenticApp commit `e705bb0`; no AgInTiFlow release change was required.
+
+### Durable background-job recovery after foreground interruption
+
+`long-job-recovery-019` exercised installed AgInTiFlow `0.20.217` with a normal
+laboratory-export request whose terminal could disconnect. The DeepSeek-backed
+agent inspected the checked-in resumable scripts, rejected duplicate execution,
+and selected the generic `start_long_job` routine. The campaign interrupted only
+the foreground AgInTi pane after durable admission; the independent job tmux
+continued, completed eight delayed batches, ran deferred verification, and
+cleaned up its own tmux session.
+
+The same AgInTi session then resumed from retained state. It recovered the exact
+job ID through `long_job_status`, independently reran the project verifier,
+confirmed the artifact and checksum, and finished without calling
+`start_long_job` again. Proactive context compaction reduced the resumed history
+from 190,805 to 30,680 characters while preserving the job identity and original
+task boundary.
+
+The independent acceptance contract verified one process invocation, one durable
+job directory, attempt `1`, command and verifier exit `0`, the required durable
+event sequence, a project handoff with exact status and verification commands,
+and no lingering job tmux session. No source patch or npm release was needed;
+this run validates the published package's general long-job, resume, context,
+deduplication, and cleanup contracts without task-specific routing.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.217",
+  "version": "0.20.218",
   "type": "module",
   "description": "AgInTiFlow is a project-aware agent workspace for hybrid wet-dry R&D, hardware-aware intelligence, software automation, and industrial workflows.",
   "license": "Apache-2.0",

package/scripts/smoke-coding-tools.js

@@ -583,6 +583,58 @@ try {
     ...hostWorkspacePolicy,
     readOnlyRoots: [externalReadRoot],
   };
+  const exactReadOnlySkillLoop = [
+    "for f in",
+    "/home/lachlan/.agintiflow/skillmesh/skills/lazyedit-publish-workflow/SKILL.md",
+    "/home/lachlan/.codex/skills/musia-music-production/SKILL.md",
+    "/home/lachlan/.codex/skills/musia-lalachan-mv-workflow/SKILL.md",
+    "/home/lachlan/.codex/skills/lalachan-xyq-browser-video/SKILL.md",
+    "/home/lachlan/.nvm/versions/node/v22.21.0/lib/node_modules/@lazyingart/agintiflow/skills/browser-automation/SKILL.md",
+    "/home/lachlan/.codex/skills/musia-song-localization/SKILL.md;",
+    'do echo "===== $f ====="; wc -l "$f"; done',
+  ].join(" ");
+  const exactReadOnlySkillLoopPolicy = evaluateCommandPolicy(exactReadOnlySkillLoop, hostWorkspacePolicy);
+  assert(
+    exactReadOnlySkillLoopPolicy.allowed &&
+      exactReadOnlySkillLoopPolicy.category === "read-only" &&
+      exactReadOnlySkillLoopPolicy.boundedForLoop === true &&
+      exactReadOnlySkillLoopPolicy.needsNetwork === false &&
+      exactReadOnlySkillLoopPolicy.writesWorkspace === false,
+    "a finite echo/wc skill audit loop incorrectly required destructive host permission"
+  );
+  const multilineReadOnlyLoopPolicy = evaluateCommandPolicy(
+    [
+      "for target in README.md package.json",
+      "do",
+      '  echo "== ${target} =="',
+      '  wc -l "$target"',
+      "done",
+    ].join("\n"),
+    hostWorkspacePolicy
+  );
+  assert(
+    multilineReadOnlyLoopPolicy.allowed && multilineReadOnlyLoopPolicy.category === "read-only",
+    "a multiline finite read-only loop was not recognized"
+  );
+  for (const unsafeLoop of [
+    'for f in README.md; do rm -rf "$f"; done',
+    'for f in README.md; do curl "https://example.com/$f"; done',
+    'for f in README.md; do cp "$f" copied.md; done',
+    'for f in README.md; do echo "$f" > report.md; done',
+    'for f in $(find . -type f); do wc -l "$f"; done',
+    'for f in *.md; do wc -l "$f"; done',
+    'for f in --pre=unsafe-helper; do rg pattern "$f"; done',
+    'for f in $FILES; do wc -l "$f"; done',
+    'for f in README.md; do wc -l "${f:-package.json}"; done',
+    'for f in README.md; do for g in package.json; do wc -l "$g"; done; done',
+    'for f in README.md; do wc -l "$f" & done',
+  ]) {
+    const unsafeLoopPolicy = evaluateCommandPolicy(unsafeLoop, hostWorkspacePolicy);
+    assert(
+      !unsafeLoopPolicy.allowed && unsafeLoopPolicy.category !== "read-only",
+      `unsafe or dynamic shell loop bypassed the bounded read-only policy: ${unsafeLoop}`
+    );
+  }
   const readRootDoctorPolicy = evaluateCommandPolicy(
     `cd ${externalReadRoot} && node bin/musia.js doctor --json 2>&1 | head -80`,
     hostReadRootPolicy

package/src/command-policy.js

@@ -1372,6 +1372,100 @@ function classifyShellSequence(normalized) {
   };
 }
 
+const READ_ONLY_FOR_LOOP_MAX_ITEMS = 64;
+const READ_ONLY_FOR_LOOP_MAX_COMMANDS = 16;
+const READ_ONLY_FOR_LOOP_LITERAL_PATTERN = /^[A-Za-z0-9_@%+=:,./~+-]+$/;
+
+function shellIdentifierPattern(value = "") {
+  return String(value || "").replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+function broadForLoopClassification(normalized, reason) {
+  return {
+    category: "general-shell",
+    needsNetwork: false,
+    writesWorkspace: true,
+    reason: `Shell for-loop is outside the bounded read-only form (${reason}): ${normalized}`,
+  };
+}
+
+function classifyReadOnlyForLoop(normalized) {
+  const text = String(normalized || "").trim();
+  if (!/^for\s+/.test(text)) return null;
+  if (text.length > 64 * 1024) {
+    return broadForLoopClassification(text, "command is too large");
+  }
+
+  const match = text.match(
+    /^for[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+in[ \t]+([\s\S]*?)(?:;|\n)[ \t]*do\s+([\s\S]*?)(?:;|\n)[ \t]*done[ \t]*$/
+  );
+  if (!match) return broadForLoopClassification(text, "unsupported loop syntax");
+
+  const [, variableName, itemSource, bodySource] = match;
+  if (hasActiveShellExpansion(itemSource) || hasActiveShellCommandSubstitution(itemSource)) {
+    return broadForLoopClassification(text, "the item list is dynamic");
+  }
+  const items = tokenizeShellWords(itemSource);
+  if (!items.length || items.length > READ_ONLY_FOR_LOOP_MAX_ITEMS) {
+    return broadForLoopClassification(text, "the item list is empty or unbounded");
+  }
+  if (items.some((item) => item.startsWith("-") || !READ_ONLY_FOR_LOOP_LITERAL_PATTERN.test(item))) {
+    return broadForLoopClassification(
+      text,
+      "items must be finite literal words or paths without option prefixes or globs"
+    );
+  }
+
+  const unquotedBody = stripQuotedSegments(bodySource);
+  if (/[|&<>(){}]/.test(unquotedBody) || hasActiveShellCommandSubstitution(bodySource)) {
+    return broadForLoopClassification(text, "the body uses control, redirection, or substitution syntax");
+  }
+
+  const escapedVariable = shellIdentifierPattern(variableName);
+  const variableReference = new RegExp(
+    `\\$(?:\\{${escapedVariable}\\}|${escapedVariable}(?![A-Za-z0-9_]))`,
+    "g"
+  );
+  const referenceCount = [...bodySource.matchAll(variableReference)].length;
+  if (!referenceCount) {
+    return broadForLoopClassification(text, "the body does not consume the loop item");
+  }
+
+  for (const item of items) {
+    const expandedBody = bodySource.replace(variableReference, item);
+    if (hasActiveShellExpansion(expandedBody) || hasActiveShellCommandSubstitution(expandedBody)) {
+      return broadForLoopClassification(text, "the body contains expansion beyond the loop variable");
+    }
+    const sequence = splitTopLevelShellSequence(expandedBody);
+    const commands = sequence?.parts || [expandedBody.trim()];
+    if (
+      !commands.length ||
+      commands.length > READ_ONLY_FOR_LOOP_MAX_COMMANDS ||
+      (sequence && sequence.separators.some((separator) => ![";", "newline"].includes(separator)))
+    ) {
+      return broadForLoopClassification(text, "the body is not a bounded sequential command list");
+    }
+    for (const command of commands) {
+      const classification = classifySimpleCommand(command);
+      if (classification.category === "blocked" || classification.category === "destructive") {
+        return { ...classification, gitOnly: false };
+      }
+      if (classification.category !== "read-only" || classification.writesWorkspace) {
+        return broadForLoopClassification(text, `body command is ${classification.category}`);
+      }
+    }
+  }
+
+  return {
+    category: "read-only",
+    needsNetwork: false,
+    writesWorkspace: false,
+    gitOnly: false,
+    boundedForLoop: true,
+    reason: `Finite read-only shell loop over ${items.length} literal item${items.length === 1 ? "" : "s"}.`,
+  };
+}
+
 function splitTopLevelPipeline(command = "") {
   const parts = [];
   let current = "";
@@ -1536,7 +1630,7 @@ export function classifyCommand(command) {
   const normalized = String(command || "").trim();
   if (!normalized) return { category: "blocked", reason: "Command is empty." };
 
-  return classifyBackgroundShell(normalized) || classifyCdCommand(normalized) || classifyShellSequence(normalized) || classifyPipelineSequence(normalized) || classifySimpleCommand(normalized);
+  return classifyBackgroundShell(normalized) || classifyReadOnlyForLoop(normalized) || classifyCdCommand(normalized) || classifyShellSequence(normalized) || classifyPipelineSequence(normalized) || classifySimpleCommand(normalized);
 }
 
 export function evaluateCommandPolicy(command, config = {}) {