@lazyingart/agintiflow 0.20.218 → 0.20.220

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.218",
+  "version": "0.20.220",
   "type": "module",
   "description": "AgInTiFlow is a project-aware agent workspace for hybrid wet-dry R&D, hardware-aware intelligence, software automation, and industrial workflows.",
   "license": "Apache-2.0",

package/scripts/smoke-coding-tools.js

@@ -635,6 +635,83 @@ try {
       `unsafe or dynamic shell loop bypassed the bounded read-only policy: ${unsafeLoop}`
     );
   }
+  const exactCompoundReadOnlyAudit = [
+    'echo "=== CWD ==="',
+    'pwd',
+    'echo "=== workspace listing ==="',
+    'ls -la',
+    'echo "=== workspace git status ==="',
+    'git status --short 2>&1 | head -40',
+    'echo "=== read roots ==="',
+    'for d in /home/lachlan/ProjectsLFS/AgenticApp /home/lachlan/ProjectsLFS/Musia /home/lachlan/ProjectsLFS/LALACHAN /home/lachlan/DiskMech/Projects/lazyedit; do echo "--- $d ---"; if [ -d "$d" ]; then ls -la "$d" 2>&1 | head -80; else echo "MISSING"; fi; done',
+  ].join("; ");
+  const exactCompoundReadOnlyAuditPolicy = evaluateCommandPolicy(
+    exactCompoundReadOnlyAudit,
+    hostReadRootPolicy
+  );
+  assert(
+    exactCompoundReadOnlyAuditPolicy.allowed &&
+      exactCompoundReadOnlyAuditPolicy.category === "read-only" &&
+      exactCompoundReadOnlyAuditPolicy.boundedForLoop === true &&
+      exactCompoundReadOnlyAuditPolicy.boundedCompoundSequence === true &&
+      exactCompoundReadOnlyAuditPolicy.needsNetwork === false &&
+      exactCompoundReadOnlyAuditPolicy.writesWorkspace === false,
+    "a finite read-only prelude and conditional directory audit incorrectly required destructive host permission"
+  );
+  const exactReadOnlyGitIdentityProbe =
+    'git status --short && echo "TOPLEVEL=$(git rev-parse --show-toplevel 2>&1)" && echo "BRANCH=$(git rev-parse --abbrev-ref HEAD 2>&1)"';
+  const exactReadOnlyGitIdentityProbePolicy = evaluateCommandPolicy(
+    exactReadOnlyGitIdentityProbe,
+    hostWorkspacePolicy
+  );
+  assert(
+    exactReadOnlyGitIdentityProbePolicy.allowed &&
+      exactReadOnlyGitIdentityProbePolicy.category === "read-only" &&
+      exactReadOnlyGitIdentityProbePolicy.needsNetwork === false &&
+      exactReadOnlyGitIdentityProbePolicy.writesWorkspace === false,
+    "bounded read-only git identity substitutions incorrectly required destructive host permission"
+  );
+  for (const unsafeEchoSubstitution of [
+    'echo "VALUE=$(rm -rf report.md)"',
+    'echo "VALUE=$(cp README.md report.md)"',
+    'echo "VALUE=$(curl https://example.com)"',
+    'echo "VALUE=$(git status; rm -rf report.md)"',
+    'echo "VALUE=$(echo $(pwd))"',
+    'echo "VALUE=$((1 + 1))"',
+    'echo "VALUE=$(git status)" > report.md',
+    'echo "VALUE=`git status`"',
+  ]) {
+    const unsafeEchoSubstitutionPolicy = evaluateCommandPolicy(
+      unsafeEchoSubstitution,
+      hostWorkspacePolicy
+    );
+    assert(
+      !unsafeEchoSubstitutionPolicy.allowed ||
+        unsafeEchoSubstitutionPolicy.category !== "read-only" ||
+        unsafeEchoSubstitutionPolicy.writesWorkspace === true ||
+        unsafeEchoSubstitutionPolicy.needsNetwork === true,
+      `unsafe echo command substitution bypassed the bounded read-only policy: ${unsafeEchoSubstitution}`
+    );
+  }
+  for (const unsafeCompoundAudit of [
+    'cp README.md copied.md; for d in /tmp; do echo "$d"; done',
+    'echo start; for d in /tmp; do if [ -d "$d" ]; then rm -rf "$d"; else echo missing; fi; done',
+    'echo start; for d in /tmp; do if [ -d "$d" ]; then curl https://example.com; else echo missing; fi; done',
+    'echo start; for d in /tmp; do if [ -d "$d" ]; then echo "$d" > report.md; else echo missing; fi; done',
+    'echo start; for d in /tmp; do if [ -d "$(pwd)" ]; then ls; else echo missing; fi; done',
+    'echo start; for d in /tmp; do if [ -d "$d" ]; then if [ -f "$d/x" ]; then cat "$d/x"; else echo missing; fi; else echo absent; fi; done',
+    'echo start; for d in $ROOTS; do if [ -d "$d" ]; then ls "$d"; else echo missing; fi; done',
+    'echo start; for d in /tmp; do if [ -d "$d" ]; then ls "$d"; else echo missing; fi; done; rm -rf report.md',
+  ]) {
+    const unsafeCompoundAuditPolicy = evaluateCommandPolicy(unsafeCompoundAudit, hostReadRootPolicy);
+    assert(
+      !unsafeCompoundAuditPolicy.allowed ||
+        unsafeCompoundAuditPolicy.category !== "read-only" ||
+        unsafeCompoundAuditPolicy.writesWorkspace === true ||
+        unsafeCompoundAuditPolicy.needsNetwork === true,
+      `unsafe compound shell audit bypassed the bounded read-only policy: ${unsafeCompoundAudit}`
+    );
+  }
   const readRootDoctorPolicy = evaluateCommandPolicy(
     `cd ${externalReadRoot} && node bin/musia.js doctor --json 2>&1 | head -80`,
     hostReadRootPolicy

package/src/command-policy.js

@@ -16,7 +16,7 @@ const READ_ONLY_PATTERNS = [
   /^which\s+[-\w.]+(?:\s+[-\w.]+)*$/,
   /^command\s+-v\s+[-\w.]+$/,
   /^uname(?:\s+-a)?$/,
-  /^ls(?:\s+[-\w./~*]+)*$/,
+  /^ls(?:\s+(?:"[^"\n]*"|'[^'\n]*'|[-\w./~*]+))*$/,
   /^find(?:\s+[./~\w-]+)*(?:\s+-maxdepth\s+\d+)?(?:\s+-type\s+[fd])?$/,
   /^rg(?:\s+.+)?$/,
   /^grep(?:\s+.+)?$/,
@@ -30,7 +30,7 @@ const READ_ONLY_PATTERNS = [
   /^sha256sum(?:\s+[-\w./~*]+)+$/,
   /^sed\s+-n\s+['"0-9,:p\s-]+(?:\s+[-\w./~*]+)?$/,
   /^git\s+(status|branch|log|show|diff(?:\s+--stat)?|remote\s+-v)(?:\s+.+)?$/,
-  /^git\s+rev-parse(?:\s+(?:--show-toplevel|--git-dir|--is-inside-work-tree|--show-prefix|--show-cdup|--verify|--short(?:=\d+)?|[-\w./@^{}~:]+))+$/,
+  /^git\s+rev-parse(?:\s+(?:--show-toplevel|--git-dir|--is-inside-work-tree|--show-prefix|--show-cdup|--abbrev-ref|--verify|--short(?:=\d+)?|[-\w./@^{}~:]+))+$/,
   /^git\s+ls-files(?:\s+(?:--(?:cached|deleted|modified|others|ignored|stage|unmerged|exclude-standard)|[-\w./*]+))*$/,
   /^node\s+(?:-v|--version)$/,
   /^node\s+[-\w./]+\.(?:c?js|mjs)\s+(?:--help|help|doctor|status|health)(?:\s+[-\w./:=]+)*$/,
@@ -1010,6 +1010,129 @@ function classifySafeEchoRedirect(normalized = "") {
   };
 }
 
+function extractBoundedCommandSubstitutions(value = "") {
+  const text = String(value || "");
+  if (!text.includes("$(") || text.length > 16 * 1024 || text.includes("`")) return null;
+  const commands = [];
+  let template = "";
+  let quote = "";
+  let escaped = false;
+
+  for (let index = 0; index < text.length; index += 1) {
+    const char = text[index];
+    if (quote === "'") {
+      template += char;
+      if (char === "'") quote = "";
+      continue;
+    }
+    if (escaped) {
+      template += char;
+      escaped = false;
+      continue;
+    }
+    if (char === "\\") {
+      template += char;
+      escaped = true;
+      continue;
+    }
+    if (quote === '"' && char === '"') {
+      template += char;
+      quote = "";
+      continue;
+    }
+    if (!quote && char === "'") {
+      template += char;
+      quote = char;
+      continue;
+    }
+    if (!quote && char === '"') {
+      template += char;
+      quote = '"';
+      continue;
+    }
+    if (char !== "$" || text[index + 1] !== "(") {
+      template += char;
+      continue;
+    }
+    if (text[index + 2] === "(" || commands.length >= 4) return null;
+
+    let inner = "";
+    let innerQuote = "";
+    let innerEscaped = false;
+    let closed = false;
+    index += 2;
+    for (; index < text.length; index += 1) {
+      const innerChar = text[index];
+      if (innerQuote === "'") {
+        inner += innerChar;
+        if (innerChar === "'") innerQuote = "";
+        continue;
+      }
+      if (innerEscaped) {
+        inner += innerChar;
+        innerEscaped = false;
+        continue;
+      }
+      if (innerChar === "\\") {
+        inner += innerChar;
+        innerEscaped = true;
+        continue;
+      }
+      if (innerQuote === '"') {
+        inner += innerChar;
+        if (innerChar === '"') innerQuote = "";
+        else if (innerChar === "$" && text[index + 1] === "(") return null;
+        continue;
+      }
+      if (innerChar === "'" || innerChar === '"') {
+        inner += innerChar;
+        innerQuote = innerChar;
+        continue;
+      }
+      if (innerChar === "$" && text[index + 1] === "(") return null;
+      if (innerChar === "(" || innerChar === "{") return null;
+      if (innerChar === ")") {
+        closed = true;
+        break;
+      }
+      inner += innerChar;
+    }
+    if (!closed || innerQuote || innerEscaped || !inner.trim()) return null;
+    commands.push(inner.trim());
+    template += `AGINTI_READ_VALUE_${commands.length}`;
+  }
+  if (!commands.length || quote || escaped || hasActiveShellExpansion(template)) return null;
+  return { commands, template };
+}
+
+function classifySafeEchoCommandSubstitution(normalized = "") {
+  if (!/^echo\s+/.test(String(normalized || ""))) return null;
+  const extracted = extractBoundedCommandSubstitutions(normalized);
+  if (!extracted) return null;
+  const classifications = extracted.commands.map(
+    (command) => classifyShellSequence(command) || classifyPipelineSequence(command) || classifySimpleCommand(command)
+  );
+  const blocked = classifications.find(
+    (classification) => classification.category === "blocked" || classification.category === "destructive"
+  );
+  if (blocked) return blocked;
+  if (classifications.some(
+    (classification) => classification.category !== "read-only" || classification.writesWorkspace || classification.needsNetwork
+  )) {
+    return null;
+  }
+  const templateClassification = classifySimpleCommand(extracted.template);
+  if (templateClassification.category !== "read-only" || templateClassification.writesWorkspace) return null;
+  return {
+    category: "read-only",
+    needsNetwork: false,
+    writesWorkspace: false,
+    gitOnly: false,
+    boundedCommandSubstitution: true,
+    reason: `Echo uses ${extracted.commands.length} bounded read-only command substitution${extracted.commands.length === 1 ? "" : "s"}.`,
+  };
+}
+
 function classifyGitCleanDryRun(normalized) {
   const match = normalized.match(/^git\s+clean\b([\s\S]*)$/);
   if (!match) return null;
@@ -1150,6 +1273,8 @@ function classifySimpleCommand(normalized) {
   if (envExportClassification) return envExportClassification;
   const echoRedirectClassification = classifySafeEchoRedirect(normalized);
   if (echoRedirectClassification) return echoRedirectClassification;
+  const echoCommandSubstitutionClassification = classifySafeEchoCommandSubstitution(normalized);
+  if (echoCommandSubstitutionClassification) return echoCommandSubstitutionClassification;
 
   if (isUnboundedRecursiveGrep(normalized)) {
     return {
@@ -1389,6 +1514,135 @@ function broadForLoopClassification(normalized, reason) {
   };
 }
 
+function findUnquotedShellWord(value = "", expectedWord = "", startIndex = 0) {
+  const text = String(value || "");
+  const word = String(expectedWord || "");
+  let quote = "";
+  let escaped = false;
+
+  for (let index = 0; index <= text.length - word.length; index += 1) {
+    const char = text[index];
+    if (quote === "'") {
+      if (char === "'") quote = "";
+      continue;
+    }
+    if (escaped) {
+      escaped = false;
+      continue;
+    }
+    if (char === "\\") {
+      escaped = true;
+      continue;
+    }
+    if (quote === '"') {
+      if (char === '"') quote = "";
+      continue;
+    }
+    if (char === "'" || char === '"') {
+      quote = char;
+      continue;
+    }
+    if (index < Math.max(0, startIndex) || text.slice(index, index + word.length) !== word) continue;
+    const before = index > 0 ? text[index - 1] : "";
+    const after = text[index + word.length] || "";
+    if ((!before || !/[A-Za-z0-9_]/.test(before)) && (!after || !/[A-Za-z0-9_]/.test(after))) {
+      return index;
+    }
+  }
+  return -1;
+}
+
+function trimShellListBoundary(value = "") {
+  return String(value || "")
+    .replace(/^[\s;]+/, "")
+    .replace(/[\s;]+$/, "")
+    .trim();
+}
+
+function classifyReadOnlyCommandList(value = "") {
+  const text = trimShellListBoundary(value);
+  if (!text) {
+    return {
+      category: "read-only",
+      needsNetwork: false,
+      writesWorkspace: false,
+      emptyCommandList: true,
+    };
+  }
+  const sequence = splitTopLevelShellSequence(text);
+  if (sequence && sequence.parts.length > READ_ONLY_FOR_LOOP_MAX_COMMANDS) {
+    return broadForLoopClassification(text, "the command list is too large");
+  }
+  return classifyShellSequence(text) || classifyPipelineSequence(text) || classifySimpleCommand(text);
+}
+
+function isReadOnlyShellCondition(value = "") {
+  const tokens = tokenizeShellWords(trimShellListBoundary(value));
+  let option = "";
+  let candidate = "";
+  if (tokens.length === 4 && tokens[0] === "[" && tokens[3] === "]") {
+    [, option, candidate] = tokens;
+  } else if (tokens.length === 3 && tokens[0] === "test") {
+    [, option, candidate] = tokens;
+  } else {
+    return false;
+  }
+  return /^-[efdx]$/.test(option) &&
+    !candidate.startsWith("-") &&
+    READ_ONLY_FOR_LOOP_LITERAL_PATTERN.test(candidate);
+}
+
+function classifyReadOnlyLoopBody(bodySource = "") {
+  const text = String(bodySource || "").trim();
+  const controlWords = ["if", "then", "else", "elif", "fi", "for", "do", "done", "while", "until", "case", "esac"];
+  const presentControls = controlWords.filter((word) => findUnquotedShellWord(text, word) >= 0);
+  if (!presentControls.length) return classifyReadOnlyCommandList(text);
+
+  if (presentControls.some((word) => !["if", "then", "else", "fi"].includes(word))) {
+    return broadForLoopClassification(text, "the body contains nested or unsupported control flow");
+  }
+
+  const ifIndex = findUnquotedShellWord(text, "if");
+  const thenIndex = findUnquotedShellWord(text, "then", ifIndex + 2);
+  const elseIndex = findUnquotedShellWord(text, "else", thenIndex + 4);
+  const fiIndex = findUnquotedShellWord(text, "fi", elseIndex + 4);
+  if (ifIndex < 0 || thenIndex < 0 || elseIndex < 0 || fiIndex < 0 ||
+      findUnquotedShellWord(text, "if", ifIndex + 2) >= 0 ||
+      findUnquotedShellWord(text, "then", thenIndex + 4) >= 0 ||
+      findUnquotedShellWord(text, "else", elseIndex + 4) >= 0 ||
+      findUnquotedShellWord(text, "fi", fiIndex + 2) >= 0) {
+    return broadForLoopClassification(text, "the conditional is not a single bounded if/else block");
+  }
+
+  const prefix = trimShellListBoundary(text.slice(0, ifIndex));
+  const condition = trimShellListBoundary(text.slice(ifIndex + 2, thenIndex));
+  const thenBranch = trimShellListBoundary(text.slice(thenIndex + 4, elseIndex));
+  const elseBranch = trimShellListBoundary(text.slice(elseIndex + 4, fiIndex));
+  const suffix = trimShellListBoundary(text.slice(fiIndex + 2));
+  if (!isReadOnlyShellCondition(condition) || !thenBranch || !elseBranch) {
+    return broadForLoopClassification(text, "the conditional test or branch is not bounded read-only syntax");
+  }
+
+  const classifications = [prefix, thenBranch, elseBranch, suffix]
+    .filter(Boolean)
+    .map((part) => classifyReadOnlyCommandList(part));
+  const blocked = classifications.find(
+    (classification) => classification.category === "blocked" || classification.category === "destructive"
+  );
+  if (blocked) return { ...blocked, gitOnly: false };
+  if (classifications.some(
+    (classification) => classification.category !== "read-only" || classification.writesWorkspace
+  )) {
+    return broadForLoopClassification(text, "a conditional branch is not read-only");
+  }
+  return {
+    category: "read-only",
+    needsNetwork: false,
+    writesWorkspace: false,
+    boundedConditional: true,
+  };
+}
+
 function classifyReadOnlyForLoop(normalized) {
   const text = String(normalized || "").trim();
   if (!/^for\s+/.test(text)) return null;
@@ -1416,9 +1670,8 @@ function classifyReadOnlyForLoop(normalized) {
     );
   }
 
-  const unquotedBody = stripQuotedSegments(bodySource);
-  if (/[|&<>(){}]/.test(unquotedBody) || hasActiveShellCommandSubstitution(bodySource)) {
-    return broadForLoopClassification(text, "the body uses control, redirection, or substitution syntax");
+  if (hasActiveShellCommandSubstitution(bodySource)) {
+    return broadForLoopClassification(text, "the body uses command substitution");
   }
 
   const escapedVariable = shellIdentifierPattern(variableName);
@@ -1436,23 +1689,12 @@ function classifyReadOnlyForLoop(normalized) {
     if (hasActiveShellExpansion(expandedBody) || hasActiveShellCommandSubstitution(expandedBody)) {
       return broadForLoopClassification(text, "the body contains expansion beyond the loop variable");
     }
-    const sequence = splitTopLevelShellSequence(expandedBody);
-    const commands = sequence?.parts || [expandedBody.trim()];
-    if (
-      !commands.length ||
-      commands.length > READ_ONLY_FOR_LOOP_MAX_COMMANDS ||
-      (sequence && sequence.separators.some((separator) => ![";", "newline"].includes(separator)))
-    ) {
-      return broadForLoopClassification(text, "the body is not a bounded sequential command list");
+    const classification = classifyReadOnlyLoopBody(expandedBody);
+    if (classification.category === "blocked" || classification.category === "destructive") {
+      return { ...classification, gitOnly: false };
     }
-    for (const command of commands) {
-      const classification = classifySimpleCommand(command);
-      if (classification.category === "blocked" || classification.category === "destructive") {
-        return { ...classification, gitOnly: false };
-      }
-      if (classification.category !== "read-only" || classification.writesWorkspace) {
-        return broadForLoopClassification(text, `body command is ${classification.category}`);
-      }
+    if (classification.category !== "read-only" || classification.writesWorkspace) {
+      return broadForLoopClassification(text, `body is ${classification.category}`);
     }
   }
 
@@ -1466,6 +1708,46 @@ function classifyReadOnlyForLoop(normalized) {
   };
 }
 
+function classifyReadOnlyCompoundSequence(normalized) {
+  const text = String(normalized || "").trim();
+  if (!text || /^for\s+/.test(text) || hasActiveShellCommandSubstitution(text)) return null;
+
+  let forIndex = findUnquotedShellWord(text, "for");
+  const startsAtCommandBoundary = (index) => {
+    let boundary = index - 1;
+    while (boundary >= 0 && /[ \t]/.test(text[boundary])) boundary -= 1;
+    return boundary >= 0 && /[;\n\r]/.test(text[boundary]);
+  };
+  while (forIndex > 0 && !startsAtCommandBoundary(forIndex)) {
+    forIndex = findUnquotedShellWord(text, "for", forIndex + 3);
+  }
+  if (forIndex <= 0) return null;
+
+  const prefixSource = trimShellListBoundary(text.slice(0, forIndex));
+  const loopSource = text.slice(forIndex).trim();
+  const prefixClassification = classifyReadOnlyCommandList(prefixSource);
+  if (prefixClassification.category === "blocked" || prefixClassification.category === "destructive") {
+    return { ...prefixClassification, gitOnly: false };
+  }
+  if (prefixClassification.category !== "read-only" || prefixClassification.writesWorkspace) {
+    return broadForLoopClassification(text, "the command prelude is not read-only");
+  }
+  const loopClassification = classifyReadOnlyForLoop(loopSource);
+  if (!loopClassification) return null;
+  if (loopClassification.category !== "read-only" || loopClassification.writesWorkspace) {
+    return loopClassification;
+  }
+  return {
+    category: "read-only",
+    needsNetwork: false,
+    writesWorkspace: false,
+    gitOnly: false,
+    boundedForLoop: true,
+    boundedCompoundSequence: true,
+    reason: "Finite read-only command prelude followed by a bounded read-only shell loop.",
+  };
+}
+
 function splitTopLevelPipeline(command = "") {
   const parts = [];
   let current = "";
@@ -1630,7 +1912,7 @@ export function classifyCommand(command) {
   const normalized = String(command || "").trim();
   if (!normalized) return { category: "blocked", reason: "Command is empty." };
 
-  return classifyBackgroundShell(normalized) || classifyReadOnlyForLoop(normalized) || classifyCdCommand(normalized) || classifyShellSequence(normalized) || classifyPipelineSequence(normalized) || classifySimpleCommand(normalized);
+  return classifyBackgroundShell(normalized) || classifyReadOnlyCompoundSequence(normalized) || classifyReadOnlyForLoop(normalized) || classifyCdCommand(normalized) || classifyShellSequence(normalized) || classifyPipelineSequence(normalized) || classifySimpleCommand(normalized);
 }
 
 export function evaluateCommandPolicy(command, config = {}) {