@lazyingart/agintiflow 0.20.217 → 0.20.219

package/docs/supervision-campaign-ledger.md

@@ -267,3 +267,66 @@ platform-aware POSIX and Windows command quoting; and recognition of bounded
 stdin `sed -n` pipelines as read-only inspection. Production code contains no
 campaign scenario IDs, target paths, expected prose, commit IDs, or acceptance
 literals.
+
+### Live inbox requirement coalescing
+
+The next installed-release run tested actual mid-turn input rather than a
+sequence of explicit resume commands. A DeepSeek task started from a normal
+repository-writing request. While its first model call was active, two
+independent corrections were appended through `aginti queue`. Both received
+distinct durable inbox IDs and were applied exactly once at the first safe tool
+boundary, before the source note was read.
+
+AgInTiFlow `0.20.217` retained both corrections through later context
+compaction, produced one concise artifact, removed every superseded value,
+preserved the source note, added only narrowly scoped runtime ignore rules,
+committed the intentional files, and left the target repository clean. An
+external semantic and repository-state contract passed at target commit
+`f19ff4b`. No AgInTiFlow source change or task-specific prompt branch was
+needed; the run validates the generic inbox, context, evidence, and completion
+contracts in the published package.
+
+### LabCanvas least-privilege worker integration
+
+`labcanvas-worker-permission-018` validated the installed AgInTiFlow `0.20.217`
+through LabCanvas after a real WeCom research task paused at
+`permission_required`. The defect was in the integration boundary: LabCanvas
+unconditionally selected AgInTi's blocked package-install tier, which also
+blocked ordinary workspace shell execution. LabCanvas now keeps response-only
+roles blocked while granting genuine worker roles reversible package setup
+inside the Docker workspace. Host access, credentials, payment, publication,
+destructive operations, and other irreversible actions remain separately
+guarded.
+
+A direct DeepSeek-backed worker smoke created and validated a bounded workspace
+artifact without a permission prompt. Focused backend regressions, all WeChat
+self-checks, the complete 1,442-test LabCanvas suite, and GitHub Actions passed.
+The originally blocked exact-chat task was then resumed without duplicate model
+work, produced a visually inspected nine-page XeLaTeX research report, and
+delivered one concise message plus the PDF through the verified WeCom transport.
+The follow-up message was preserved in the same chat session. The reusable fix
+is AgenticApp commit `e705bb0`; no AgInTiFlow release change was required.
+
+### Durable background-job recovery after foreground interruption
+
+`long-job-recovery-019` exercised installed AgInTiFlow `0.20.217` with a normal
+laboratory-export request whose terminal could disconnect. The DeepSeek-backed
+agent inspected the checked-in resumable scripts, rejected duplicate execution,
+and selected the generic `start_long_job` routine. The campaign interrupted only
+the foreground AgInTi pane after durable admission; the independent job tmux
+continued, completed eight delayed batches, ran deferred verification, and
+cleaned up its own tmux session.
+
+The same AgInTi session then resumed from retained state. It recovered the exact
+job ID through `long_job_status`, independently reran the project verifier,
+confirmed the artifact and checksum, and finished without calling
+`start_long_job` again. Proactive context compaction reduced the resumed history
+from 190,805 to 30,680 characters while preserving the job identity and original
+task boundary.
+
+The independent acceptance contract verified one process invocation, one durable
+job directory, attempt `1`, command and verifier exit `0`, the required durable
+event sequence, a project handoff with exact status and verification commands,
+and no lingering job tmux session. No source patch or npm release was needed;
+this run validates the published package's general long-job, resume, context,
+deduplication, and cleanup contracts without task-specific routing.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.217",
+  "version": "0.20.219",
   "type": "module",
   "description": "AgInTiFlow is a project-aware agent workspace for hybrid wet-dry R&D, hardware-aware intelligence, software automation, and industrial workflows.",
   "license": "Apache-2.0",

package/scripts/smoke-coding-tools.js

@@ -583,6 +583,100 @@ try {
     ...hostWorkspacePolicy,
     readOnlyRoots: [externalReadRoot],
   };
+  const exactReadOnlySkillLoop = [
+    "for f in",
+    "/home/lachlan/.agintiflow/skillmesh/skills/lazyedit-publish-workflow/SKILL.md",
+    "/home/lachlan/.codex/skills/musia-music-production/SKILL.md",
+    "/home/lachlan/.codex/skills/musia-lalachan-mv-workflow/SKILL.md",
+    "/home/lachlan/.codex/skills/lalachan-xyq-browser-video/SKILL.md",
+    "/home/lachlan/.nvm/versions/node/v22.21.0/lib/node_modules/@lazyingart/agintiflow/skills/browser-automation/SKILL.md",
+    "/home/lachlan/.codex/skills/musia-song-localization/SKILL.md;",
+    'do echo "===== $f ====="; wc -l "$f"; done',
+  ].join(" ");
+  const exactReadOnlySkillLoopPolicy = evaluateCommandPolicy(exactReadOnlySkillLoop, hostWorkspacePolicy);
+  assert(
+    exactReadOnlySkillLoopPolicy.allowed &&
+      exactReadOnlySkillLoopPolicy.category === "read-only" &&
+      exactReadOnlySkillLoopPolicy.boundedForLoop === true &&
+      exactReadOnlySkillLoopPolicy.needsNetwork === false &&
+      exactReadOnlySkillLoopPolicy.writesWorkspace === false,
+    "a finite echo/wc skill audit loop incorrectly required destructive host permission"
+  );
+  const multilineReadOnlyLoopPolicy = evaluateCommandPolicy(
+    [
+      "for target in README.md package.json",
+      "do",
+      '  echo "== ${target} =="',
+      '  wc -l "$target"',
+      "done",
+    ].join("\n"),
+    hostWorkspacePolicy
+  );
+  assert(
+    multilineReadOnlyLoopPolicy.allowed && multilineReadOnlyLoopPolicy.category === "read-only",
+    "a multiline finite read-only loop was not recognized"
+  );
+  for (const unsafeLoop of [
+    'for f in README.md; do rm -rf "$f"; done',
+    'for f in README.md; do curl "https://example.com/$f"; done',
+    'for f in README.md; do cp "$f" copied.md; done',
+    'for f in README.md; do echo "$f" > report.md; done',
+    'for f in $(find . -type f); do wc -l "$f"; done',
+    'for f in *.md; do wc -l "$f"; done',
+    'for f in --pre=unsafe-helper; do rg pattern "$f"; done',
+    'for f in $FILES; do wc -l "$f"; done',
+    'for f in README.md; do wc -l "${f:-package.json}"; done',
+    'for f in README.md; do for g in package.json; do wc -l "$g"; done; done',
+    'for f in README.md; do wc -l "$f" & done',
+  ]) {
+    const unsafeLoopPolicy = evaluateCommandPolicy(unsafeLoop, hostWorkspacePolicy);
+    assert(
+      !unsafeLoopPolicy.allowed && unsafeLoopPolicy.category !== "read-only",
+      `unsafe or dynamic shell loop bypassed the bounded read-only policy: ${unsafeLoop}`
+    );
+  }
+  const exactCompoundReadOnlyAudit = [
+    'echo "=== CWD ==="',
+    'pwd',
+    'echo "=== workspace listing ==="',
+    'ls -la',
+    'echo "=== workspace git status ==="',
+    'git status --short 2>&1 | head -40',
+    'echo "=== read roots ==="',
+    'for d in /home/lachlan/ProjectsLFS/AgenticApp /home/lachlan/ProjectsLFS/Musia /home/lachlan/ProjectsLFS/LALACHAN /home/lachlan/DiskMech/Projects/lazyedit; do echo "--- $d ---"; if [ -d "$d" ]; then ls -la "$d" 2>&1 | head -80; else echo "MISSING"; fi; done',
+  ].join("; ");
+  const exactCompoundReadOnlyAuditPolicy = evaluateCommandPolicy(
+    exactCompoundReadOnlyAudit,
+    hostReadRootPolicy
+  );
+  assert(
+    exactCompoundReadOnlyAuditPolicy.allowed &&
+      exactCompoundReadOnlyAuditPolicy.category === "read-only" &&
+      exactCompoundReadOnlyAuditPolicy.boundedForLoop === true &&
+      exactCompoundReadOnlyAuditPolicy.boundedCompoundSequence === true &&
+      exactCompoundReadOnlyAuditPolicy.needsNetwork === false &&
+      exactCompoundReadOnlyAuditPolicy.writesWorkspace === false,
+    "a finite read-only prelude and conditional directory audit incorrectly required destructive host permission"
+  );
+  for (const unsafeCompoundAudit of [
+    'cp README.md copied.md; for d in /tmp; do echo "$d"; done',
+    'echo start; for d in /tmp; do if [ -d "$d" ]; then rm -rf "$d"; else echo missing; fi; done',
+    'echo start; for d in /tmp; do if [ -d "$d" ]; then curl https://example.com; else echo missing; fi; done',
+    'echo start; for d in /tmp; do if [ -d "$d" ]; then echo "$d" > report.md; else echo missing; fi; done',
+    'echo start; for d in /tmp; do if [ -d "$(pwd)" ]; then ls; else echo missing; fi; done',
+    'echo start; for d in /tmp; do if [ -d "$d" ]; then if [ -f "$d/x" ]; then cat "$d/x"; else echo missing; fi; else echo absent; fi; done',
+    'echo start; for d in $ROOTS; do if [ -d "$d" ]; then ls "$d"; else echo missing; fi; done',
+    'echo start; for d in /tmp; do if [ -d "$d" ]; then ls "$d"; else echo missing; fi; done; rm -rf report.md',
+  ]) {
+    const unsafeCompoundAuditPolicy = evaluateCommandPolicy(unsafeCompoundAudit, hostReadRootPolicy);
+    assert(
+      !unsafeCompoundAuditPolicy.allowed ||
+        unsafeCompoundAuditPolicy.category !== "read-only" ||
+        unsafeCompoundAuditPolicy.writesWorkspace === true ||
+        unsafeCompoundAuditPolicy.needsNetwork === true,
+      `unsafe compound shell audit bypassed the bounded read-only policy: ${unsafeCompoundAudit}`
+    );
+  }
   const readRootDoctorPolicy = evaluateCommandPolicy(
     `cd ${externalReadRoot} && node bin/musia.js doctor --json 2>&1 | head -80`,
     hostReadRootPolicy

package/src/command-policy.js

@@ -16,7 +16,7 @@ const READ_ONLY_PATTERNS = [
   /^which\s+[-\w.]+(?:\s+[-\w.]+)*$/,
   /^command\s+-v\s+[-\w.]+$/,
   /^uname(?:\s+-a)?$/,
-  /^ls(?:\s+[-\w./~*]+)*$/,
+  /^ls(?:\s+(?:"[^"\n]*"|'[^'\n]*'|[-\w./~*]+))*$/,
   /^find(?:\s+[./~\w-]+)*(?:\s+-maxdepth\s+\d+)?(?:\s+-type\s+[fd])?$/,
   /^rg(?:\s+.+)?$/,
   /^grep(?:\s+.+)?$/,
@@ -1372,6 +1372,257 @@ function classifyShellSequence(normalized) {
   };
 }
 
+const READ_ONLY_FOR_LOOP_MAX_ITEMS = 64;
+const READ_ONLY_FOR_LOOP_MAX_COMMANDS = 16;
+const READ_ONLY_FOR_LOOP_LITERAL_PATTERN = /^[A-Za-z0-9_@%+=:,./~+-]+$/;
+
+function shellIdentifierPattern(value = "") {
+  return String(value || "").replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+function broadForLoopClassification(normalized, reason) {
+  return {
+    category: "general-shell",
+    needsNetwork: false,
+    writesWorkspace: true,
+    reason: `Shell for-loop is outside the bounded read-only form (${reason}): ${normalized}`,
+  };
+}
+
+function findUnquotedShellWord(value = "", expectedWord = "", startIndex = 0) {
+  const text = String(value || "");
+  const word = String(expectedWord || "");
+  let quote = "";
+  let escaped = false;
+
+  for (let index = 0; index <= text.length - word.length; index += 1) {
+    const char = text[index];
+    if (quote === "'") {
+      if (char === "'") quote = "";
+      continue;
+    }
+    if (escaped) {
+      escaped = false;
+      continue;
+    }
+    if (char === "\\") {
+      escaped = true;
+      continue;
+    }
+    if (quote === '"') {
+      if (char === '"') quote = "";
+      continue;
+    }
+    if (char === "'" || char === '"') {
+      quote = char;
+      continue;
+    }
+    if (index < Math.max(0, startIndex) || text.slice(index, index + word.length) !== word) continue;
+    const before = index > 0 ? text[index - 1] : "";
+    const after = text[index + word.length] || "";
+    if ((!before || !/[A-Za-z0-9_]/.test(before)) && (!after || !/[A-Za-z0-9_]/.test(after))) {
+      return index;
+    }
+  }
+  return -1;
+}
+
+function trimShellListBoundary(value = "") {
+  return String(value || "")
+    .replace(/^[\s;]+/, "")
+    .replace(/[\s;]+$/, "")
+    .trim();
+}
+
+function classifyReadOnlyCommandList(value = "") {
+  const text = trimShellListBoundary(value);
+  if (!text) {
+    return {
+      category: "read-only",
+      needsNetwork: false,
+      writesWorkspace: false,
+      emptyCommandList: true,
+    };
+  }
+  const sequence = splitTopLevelShellSequence(text);
+  if (sequence && sequence.parts.length > READ_ONLY_FOR_LOOP_MAX_COMMANDS) {
+    return broadForLoopClassification(text, "the command list is too large");
+  }
+  return classifyShellSequence(text) || classifyPipelineSequence(text) || classifySimpleCommand(text);
+}
+
+function isReadOnlyShellCondition(value = "") {
+  const tokens = tokenizeShellWords(trimShellListBoundary(value));
+  let option = "";
+  let candidate = "";
+  if (tokens.length === 4 && tokens[0] === "[" && tokens[3] === "]") {
+    [, option, candidate] = tokens;
+  } else if (tokens.length === 3 && tokens[0] === "test") {
+    [, option, candidate] = tokens;
+  } else {
+    return false;
+  }
+  return /^-[efdx]$/.test(option) &&
+    !candidate.startsWith("-") &&
+    READ_ONLY_FOR_LOOP_LITERAL_PATTERN.test(candidate);
+}
+
+function classifyReadOnlyLoopBody(bodySource = "") {
+  const text = String(bodySource || "").trim();
+  const controlWords = ["if", "then", "else", "elif", "fi", "for", "do", "done", "while", "until", "case", "esac"];
+  const presentControls = controlWords.filter((word) => findUnquotedShellWord(text, word) >= 0);
+  if (!presentControls.length) return classifyReadOnlyCommandList(text);
+
+  if (presentControls.some((word) => !["if", "then", "else", "fi"].includes(word))) {
+    return broadForLoopClassification(text, "the body contains nested or unsupported control flow");
+  }
+
+  const ifIndex = findUnquotedShellWord(text, "if");
+  const thenIndex = findUnquotedShellWord(text, "then", ifIndex + 2);
+  const elseIndex = findUnquotedShellWord(text, "else", thenIndex + 4);
+  const fiIndex = findUnquotedShellWord(text, "fi", elseIndex + 4);
+  if (ifIndex < 0 || thenIndex < 0 || elseIndex < 0 || fiIndex < 0 ||
+      findUnquotedShellWord(text, "if", ifIndex + 2) >= 0 ||
+      findUnquotedShellWord(text, "then", thenIndex + 4) >= 0 ||
+      findUnquotedShellWord(text, "else", elseIndex + 4) >= 0 ||
+      findUnquotedShellWord(text, "fi", fiIndex + 2) >= 0) {
+    return broadForLoopClassification(text, "the conditional is not a single bounded if/else block");
+  }
+
+  const prefix = trimShellListBoundary(text.slice(0, ifIndex));
+  const condition = trimShellListBoundary(text.slice(ifIndex + 2, thenIndex));
+  const thenBranch = trimShellListBoundary(text.slice(thenIndex + 4, elseIndex));
+  const elseBranch = trimShellListBoundary(text.slice(elseIndex + 4, fiIndex));
+  const suffix = trimShellListBoundary(text.slice(fiIndex + 2));
+  if (!isReadOnlyShellCondition(condition) || !thenBranch || !elseBranch) {
+    return broadForLoopClassification(text, "the conditional test or branch is not bounded read-only syntax");
+  }
+
+  const classifications = [prefix, thenBranch, elseBranch, suffix]
+    .filter(Boolean)
+    .map((part) => classifyReadOnlyCommandList(part));
+  const blocked = classifications.find(
+    (classification) => classification.category === "blocked" || classification.category === "destructive"
+  );
+  if (blocked) return { ...blocked, gitOnly: false };
+  if (classifications.some(
+    (classification) => classification.category !== "read-only" || classification.writesWorkspace
+  )) {
+    return broadForLoopClassification(text, "a conditional branch is not read-only");
+  }
+  return {
+    category: "read-only",
+    needsNetwork: false,
+    writesWorkspace: false,
+    boundedConditional: true,
+  };
+}
+
+function classifyReadOnlyForLoop(normalized) {
+  const text = String(normalized || "").trim();
+  if (!/^for\s+/.test(text)) return null;
+  if (text.length > 64 * 1024) {
+    return broadForLoopClassification(text, "command is too large");
+  }
+
+  const match = text.match(
+    /^for[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+in[ \t]+([\s\S]*?)(?:;|\n)[ \t]*do\s+([\s\S]*?)(?:;|\n)[ \t]*done[ \t]*$/
+  );
+  if (!match) return broadForLoopClassification(text, "unsupported loop syntax");
+
+  const [, variableName, itemSource, bodySource] = match;
+  if (hasActiveShellExpansion(itemSource) || hasActiveShellCommandSubstitution(itemSource)) {
+    return broadForLoopClassification(text, "the item list is dynamic");
+  }
+  const items = tokenizeShellWords(itemSource);
+  if (!items.length || items.length > READ_ONLY_FOR_LOOP_MAX_ITEMS) {
+    return broadForLoopClassification(text, "the item list is empty or unbounded");
+  }
+  if (items.some((item) => item.startsWith("-") || !READ_ONLY_FOR_LOOP_LITERAL_PATTERN.test(item))) {
+    return broadForLoopClassification(
+      text,
+      "items must be finite literal words or paths without option prefixes or globs"
+    );
+  }
+
+  if (hasActiveShellCommandSubstitution(bodySource)) {
+    return broadForLoopClassification(text, "the body uses command substitution");
+  }
+
+  const escapedVariable = shellIdentifierPattern(variableName);
+  const variableReference = new RegExp(
+    `\\$(?:\\{${escapedVariable}\\}|${escapedVariable}(?![A-Za-z0-9_]))`,
+    "g"
+  );
+  const referenceCount = [...bodySource.matchAll(variableReference)].length;
+  if (!referenceCount) {
+    return broadForLoopClassification(text, "the body does not consume the loop item");
+  }
+
+  for (const item of items) {
+    const expandedBody = bodySource.replace(variableReference, item);
+    if (hasActiveShellExpansion(expandedBody) || hasActiveShellCommandSubstitution(expandedBody)) {
+      return broadForLoopClassification(text, "the body contains expansion beyond the loop variable");
+    }
+    const classification = classifyReadOnlyLoopBody(expandedBody);
+    if (classification.category === "blocked" || classification.category === "destructive") {
+      return { ...classification, gitOnly: false };
+    }
+    if (classification.category !== "read-only" || classification.writesWorkspace) {
+      return broadForLoopClassification(text, `body is ${classification.category}`);
+    }
+  }
+
+  return {
+    category: "read-only",
+    needsNetwork: false,
+    writesWorkspace: false,
+    gitOnly: false,
+    boundedForLoop: true,
+    reason: `Finite read-only shell loop over ${items.length} literal item${items.length === 1 ? "" : "s"}.`,
+  };
+}
+
+function classifyReadOnlyCompoundSequence(normalized) {
+  const text = String(normalized || "").trim();
+  if (!text || /^for\s+/.test(text) || hasActiveShellCommandSubstitution(text)) return null;
+
+  let forIndex = findUnquotedShellWord(text, "for");
+  const startsAtCommandBoundary = (index) => {
+    let boundary = index - 1;
+    while (boundary >= 0 && /[ \t]/.test(text[boundary])) boundary -= 1;
+    return boundary >= 0 && /[;\n\r]/.test(text[boundary]);
+  };
+  while (forIndex > 0 && !startsAtCommandBoundary(forIndex)) {
+    forIndex = findUnquotedShellWord(text, "for", forIndex + 3);
+  }
+  if (forIndex <= 0) return null;
+
+  const prefixSource = trimShellListBoundary(text.slice(0, forIndex));
+  const loopSource = text.slice(forIndex).trim();
+  const prefixClassification = classifyReadOnlyCommandList(prefixSource);
+  if (prefixClassification.category === "blocked" || prefixClassification.category === "destructive") {
+    return { ...prefixClassification, gitOnly: false };
+  }
+  if (prefixClassification.category !== "read-only" || prefixClassification.writesWorkspace) {
+    return broadForLoopClassification(text, "the command prelude is not read-only");
+  }
+  const loopClassification = classifyReadOnlyForLoop(loopSource);
+  if (!loopClassification) return null;
+  if (loopClassification.category !== "read-only" || loopClassification.writesWorkspace) {
+    return loopClassification;
+  }
+  return {
+    category: "read-only",
+    needsNetwork: false,
+    writesWorkspace: false,
+    gitOnly: false,
+    boundedForLoop: true,
+    boundedCompoundSequence: true,
+    reason: "Finite read-only command prelude followed by a bounded read-only shell loop.",
+  };
+}
+
 function splitTopLevelPipeline(command = "") {
   const parts = [];
   let current = "";
@@ -1536,7 +1787,7 @@ export function classifyCommand(command) {
   const normalized = String(command || "").trim();
   if (!normalized) return { category: "blocked", reason: "Command is empty." };
 
-  return classifyBackgroundShell(normalized) || classifyCdCommand(normalized) || classifyShellSequence(normalized) || classifyPipelineSequence(normalized) || classifySimpleCommand(normalized);
+  return classifyBackgroundShell(normalized) || classifyReadOnlyCompoundSequence(normalized) || classifyReadOnlyForLoop(normalized) || classifyCdCommand(normalized) || classifyShellSequence(normalized) || classifyPipelineSequence(normalized) || classifySimpleCommand(normalized);
 }
 
 export function evaluateCommandPolicy(command, config = {}) {