@lazyingart/agintiflow 0.20.219 → 0.20.221

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.219",
+  "version": "0.20.221",
   "type": "module",
   "description": "AgInTiFlow is a project-aware agent workspace for hybrid wet-dry R&D, hardware-aware intelligence, software automation, and industrial workflows.",
   "license": "Apache-2.0",

package/scripts/smoke-coding-tools.js

@@ -658,6 +658,77 @@ try {
       exactCompoundReadOnlyAuditPolicy.writesWorkspace === false,
     "a finite read-only prelude and conditional directory audit incorrectly required destructive host permission"
   );
+  const exactReadOnlyGitIdentityProbe =
+    'git status --short && echo "TOPLEVEL=$(git rev-parse --show-toplevel 2>&1)" && echo "BRANCH=$(git rev-parse --abbrev-ref HEAD 2>&1)"';
+  const exactReadOnlyGitIdentityProbePolicy = evaluateCommandPolicy(
+    exactReadOnlyGitIdentityProbe,
+    hostWorkspacePolicy
+  );
+  assert(
+    exactReadOnlyGitIdentityProbePolicy.allowed &&
+      exactReadOnlyGitIdentityProbePolicy.category === "read-only" &&
+      exactReadOnlyGitIdentityProbePolicy.needsNetwork === false &&
+      exactReadOnlyGitIdentityProbePolicy.writesWorkspace === false,
+    "bounded read-only git identity substitutions incorrectly required destructive host permission"
+  );
+  const exactReadOnlyGitIdentityLoop =
+    'for d in /home/lachlan/ProjectsLFS/AgenticApp /home/lachlan/ProjectsLFS/Musia /home/lachlan/ProjectsLFS/LALACHAN /home/lachlan/DiskMech/Projects/lazyedit; do echo "=== $d ==="; echo "user.name=[$(git -C "$d" config user.name 2>/dev/null)]"; echo "user.email=[$(git -C "$d" config user.email 2>/dev/null)]"; echo "--status--"; git -C "$d" status --short 2>&1 | head -15; echo; done';
+  const exactReadOnlyGitIdentityLoopPolicy = evaluateCommandPolicy(
+    exactReadOnlyGitIdentityLoop,
+    hostReadRootPolicy
+  );
+  assert(
+    exactReadOnlyGitIdentityLoopPolicy.allowed &&
+      exactReadOnlyGitIdentityLoopPolicy.category === "read-only" &&
+      exactReadOnlyGitIdentityLoopPolicy.boundedForLoop === true &&
+      exactReadOnlyGitIdentityLoopPolicy.needsNetwork === false &&
+      exactReadOnlyGitIdentityLoopPolicy.writesWorkspace === false,
+    "bounded per-repository Git identity/status audit incorrectly required destructive host permission"
+  );
+  for (const unsafeEchoSubstitution of [
+    'echo "VALUE=$(rm -rf report.md)"',
+    'echo "VALUE=$(cp README.md report.md)"',
+    'echo "VALUE=$(curl https://example.com)"',
+    'echo "VALUE=$(git status; rm -rf report.md)"',
+    'echo "VALUE=$(echo $(pwd))"',
+    'echo "VALUE=$((1 + 1))"',
+    'echo "VALUE=$(git status)" > report.md',
+    'echo "VALUE=`git status`"',
+  ]) {
+    const unsafeEchoSubstitutionPolicy = evaluateCommandPolicy(
+      unsafeEchoSubstitution,
+      hostWorkspacePolicy
+    );
+    assert(
+      !unsafeEchoSubstitutionPolicy.allowed ||
+        unsafeEchoSubstitutionPolicy.category !== "read-only" ||
+        unsafeEchoSubstitutionPolicy.writesWorkspace === true ||
+        unsafeEchoSubstitutionPolicy.needsNetwork === true,
+      `unsafe echo command substitution bypassed the bounded read-only policy: ${unsafeEchoSubstitution}`
+    );
+  }
+  for (const unsafeLoopSubstitution of [
+    'for d in /tmp; do echo "VALUE=$(rm -rf report.md)"; done',
+    'for d in /tmp; do echo "VALUE=$(curl https://example.com)"; done',
+    'for d in /tmp; do echo "VALUE=$(echo $(pwd))"; done',
+    'for d in /tmp; do echo "VALUE=$SECRET"; done',
+    'for d in /tmp; do echo "VALUE=$(git -C "$d" config user.name attacker)"; done',
+    'for d in /tmp; do echo "VALUE=$(git -C "$d" config --global user.name)"; done',
+    'for d in /tmp; do echo "VALUE=$(git -C "$d" status; rm -rf report.md)"; done',
+    'for d in /tmp; do git -C "$d" status --short > report.md; done',
+  ]) {
+    const unsafeLoopSubstitutionPolicy = evaluateCommandPolicy(
+      unsafeLoopSubstitution,
+      hostReadRootPolicy
+    );
+    assert(
+      !unsafeLoopSubstitutionPolicy.allowed ||
+        unsafeLoopSubstitutionPolicy.category !== "read-only" ||
+        unsafeLoopSubstitutionPolicy.writesWorkspace === true ||
+        unsafeLoopSubstitutionPolicy.needsNetwork === true,
+      `unsafe loop substitution bypassed the bounded read-only policy: ${unsafeLoopSubstitution}`
+    );
+  }
   for (const unsafeCompoundAudit of [
     'cp README.md copied.md; for d in /tmp; do echo "$d"; done',
     'echo start; for d in /tmp; do if [ -d "$d" ]; then rm -rf "$d"; else echo missing; fi; done',

package/src/command-policy.js

@@ -30,7 +30,7 @@ const READ_ONLY_PATTERNS = [
   /^sha256sum(?:\s+[-\w./~*]+)+$/,
   /^sed\s+-n\s+['"0-9,:p\s-]+(?:\s+[-\w./~*]+)?$/,
   /^git\s+(status|branch|log|show|diff(?:\s+--stat)?|remote\s+-v)(?:\s+.+)?$/,
-  /^git\s+rev-parse(?:\s+(?:--show-toplevel|--git-dir|--is-inside-work-tree|--show-prefix|--show-cdup|--verify|--short(?:=\d+)?|[-\w./@^{}~:]+))+$/,
+  /^git\s+rev-parse(?:\s+(?:--show-toplevel|--git-dir|--is-inside-work-tree|--show-prefix|--show-cdup|--abbrev-ref|--verify|--short(?:=\d+)?|[-\w./@^{}~:]+))+$/,
   /^git\s+ls-files(?:\s+(?:--(?:cached|deleted|modified|others|ignored|stage|unmerged|exclude-standard)|[-\w./*]+))*$/,
   /^node\s+(?:-v|--version)$/,
   /^node\s+[-\w./]+\.(?:c?js|mjs)\s+(?:--help|help|doctor|status|health)(?:\s+[-\w./:=]+)*$/,
@@ -1010,6 +1010,166 @@ function classifySafeEchoRedirect(normalized = "") {
   };
 }
 
+function extractBoundedCommandSubstitutions(value = "") {
+  const text = String(value || "");
+  if (!text.includes("$(") || text.length > 16 * 1024 || text.includes("`")) return null;
+  const commands = [];
+  let template = "";
+  let quote = "";
+  let escaped = false;
+
+  for (let index = 0; index < text.length; index += 1) {
+    const char = text[index];
+    if (quote === "'") {
+      template += char;
+      if (char === "'") quote = "";
+      continue;
+    }
+    if (escaped) {
+      template += char;
+      escaped = false;
+      continue;
+    }
+    if (char === "\\") {
+      template += char;
+      escaped = true;
+      continue;
+    }
+    if (quote === '"' && char === '"') {
+      template += char;
+      quote = "";
+      continue;
+    }
+    if (!quote && char === "'") {
+      template += char;
+      quote = char;
+      continue;
+    }
+    if (!quote && char === '"') {
+      template += char;
+      quote = '"';
+      continue;
+    }
+    if (char !== "$" || text[index + 1] !== "(") {
+      template += char;
+      continue;
+    }
+    if (text[index + 2] === "(" || commands.length >= 4) return null;
+
+    let inner = "";
+    let innerQuote = "";
+    let innerEscaped = false;
+    let closed = false;
+    index += 2;
+    for (; index < text.length; index += 1) {
+      const innerChar = text[index];
+      if (innerQuote === "'") {
+        inner += innerChar;
+        if (innerChar === "'") innerQuote = "";
+        continue;
+      }
+      if (innerEscaped) {
+        inner += innerChar;
+        innerEscaped = false;
+        continue;
+      }
+      if (innerChar === "\\") {
+        inner += innerChar;
+        innerEscaped = true;
+        continue;
+      }
+      if (innerQuote === '"') {
+        inner += innerChar;
+        if (innerChar === '"') innerQuote = "";
+        else if (innerChar === "$" && text[index + 1] === "(") return null;
+        continue;
+      }
+      if (innerChar === "'" || innerChar === '"') {
+        inner += innerChar;
+        innerQuote = innerChar;
+        continue;
+      }
+      if (innerChar === "$" && text[index + 1] === "(") return null;
+      if (innerChar === "(" || innerChar === "{") return null;
+      if (innerChar === ")") {
+        closed = true;
+        break;
+      }
+      inner += innerChar;
+    }
+    if (!closed || innerQuote || innerEscaped || !inner.trim()) return null;
+    commands.push(inner.trim());
+    template += `AGINTI_READ_VALUE_${commands.length}`;
+  }
+  if (!commands.length || quote || escaped || hasActiveShellExpansion(template)) return null;
+  return { commands, template };
+}
+
+function classifySafeEchoCommandSubstitution(normalized = "") {
+  if (!/^echo\s+/.test(String(normalized || ""))) return null;
+  const extracted = extractBoundedCommandSubstitutions(normalized);
+  if (!extracted) return null;
+  const classifications = extracted.commands.map(
+    (command) => classifyShellSequence(command) || classifyPipelineSequence(command) || classifySimpleCommand(command)
+  );
+  const blocked = classifications.find(
+    (classification) => classification.category === "blocked" || classification.category === "destructive"
+  );
+  if (blocked) return blocked;
+  if (classifications.some(
+    (classification) => classification.category !== "read-only" || classification.writesWorkspace || classification.needsNetwork
+  )) {
+    return null;
+  }
+  const templateClassification = classifySimpleCommand(extracted.template);
+  if (templateClassification.category !== "read-only" || templateClassification.writesWorkspace) return null;
+  return {
+    category: "read-only",
+    needsNetwork: false,
+    writesWorkspace: false,
+    gitOnly: false,
+    boundedCommandSubstitution: true,
+    reason: `Echo uses ${extracted.commands.length} bounded read-only command substitution${extracted.commands.length === 1 ? "" : "s"}.`,
+  };
+}
+
+function classifyScopedReadOnlyGitProbe(normalized = "") {
+  const command = stripBenignRedirections(normalized);
+  if (!/^git\s+-C\s+/.test(command) || hasActiveShellExpansion(command)) return null;
+
+  const tokens = tokenizeShellWords(command);
+  if (tokens.length < 5 || tokens[0] !== "git" || tokens[1] !== "-C") return null;
+  const repository = tokens[2] || "";
+  if (
+    !repository ||
+    repository.startsWith("-") ||
+    !/^[A-Za-z0-9_@%+=:,./~+-]+$/.test(repository) ||
+    /[*?\[\]{}]/.test(repository)
+  ) {
+    return null;
+  }
+
+  const operation = tokens[3] || "";
+  const args = tokens.slice(4);
+  const safeStatus = operation === "status" && args.every((arg) =>
+    ["--short", "-s", "--porcelain", "--porcelain=v1", "--porcelain=v2", "--branch", "-b"].includes(arg)
+  );
+  const safeIdentityConfig = operation === "config" && (
+    (args.length === 1 && ["user.name", "user.email"].includes(args[0])) ||
+    (args.length === 2 && args[0] === "--get" && ["user.name", "user.email"].includes(args[1]))
+  );
+  if (!safeStatus && !safeIdentityConfig) return null;
+
+  return {
+    category: "read-only",
+    needsNetwork: false,
+    writesWorkspace: false,
+    gitOnly: true,
+    scopedGitProbe: true,
+    reason: `Git ${operation} reads bounded repository metadata through -C.`,
+  };
+}
+
 function classifyGitCleanDryRun(normalized) {
   const match = normalized.match(/^git\s+clean\b([\s\S]*)$/);
   if (!match) return null;
@@ -1103,6 +1263,8 @@ function classifySimpleCommand(normalized) {
   }
   const gitCleanDryRun = classifyGitCleanDryRun(normalized);
   if (gitCleanDryRun) return gitCleanDryRun;
+  const scopedReadOnlyGitProbe = classifyScopedReadOnlyGitProbe(normalized);
+  if (scopedReadOnlyGitProbe) return scopedReadOnlyGitProbe;
   const gitWorkflowClassification = classifyGitWorkflow(normalized);
   if (gitWorkflowClassification) return gitWorkflowClassification;
   const condaRunClassification = classifyCondaRun(normalized);
@@ -1150,6 +1312,8 @@ function classifySimpleCommand(normalized) {
   if (envExportClassification) return envExportClassification;
   const echoRedirectClassification = classifySafeEchoRedirect(normalized);
   if (echoRedirectClassification) return echoRedirectClassification;
+  const echoCommandSubstitutionClassification = classifySafeEchoCommandSubstitution(normalized);
+  if (echoCommandSubstitutionClassification) return echoCommandSubstitutionClassification;
 
   if (isUnboundedRecursiveGrep(normalized)) {
     return {
@@ -1518,6 +1682,27 @@ function classifyReadOnlyLoopBody(bodySource = "") {
   };
 }
 
+function loopBodyHasOnlyBoundedReadOnlyExpansions(bodySource = "") {
+  const text = String(bodySource || "").trim();
+  if (!hasActiveShellExpansion(text)) return true;
+  const sequence = parseTopLevelShellSequence(text);
+  if (
+    !sequence.commands.length ||
+    sequence.openQuote ||
+    sequence.trailingEscape ||
+    sequence.trailingSeparator
+  ) {
+    return false;
+  }
+  return sequence.commands.every((command) => {
+    if (!hasActiveShellExpansion(command)) return true;
+    const classification = classifySafeEchoCommandSubstitution(command);
+    return classification?.category === "read-only" &&
+      classification.writesWorkspace === false &&
+      classification.needsNetwork === false;
+  });
+}
+
 function classifyReadOnlyForLoop(normalized) {
   const text = String(normalized || "").trim();
   if (!/^for\s+/.test(text)) return null;
@@ -1545,10 +1730,6 @@ function classifyReadOnlyForLoop(normalized) {
     );
   }
 
-  if (hasActiveShellCommandSubstitution(bodySource)) {
-    return broadForLoopClassification(text, "the body uses command substitution");
-  }
-
   const escapedVariable = shellIdentifierPattern(variableName);
   const variableReference = new RegExp(
     `\\$(?:\\{${escapedVariable}\\}|${escapedVariable}(?![A-Za-z0-9_]))`,
@@ -1561,7 +1742,7 @@ function classifyReadOnlyForLoop(normalized) {
 
   for (const item of items) {
     const expandedBody = bodySource.replace(variableReference, item);
-    if (hasActiveShellExpansion(expandedBody) || hasActiveShellCommandSubstitution(expandedBody)) {
+    if (!loopBodyHasOnlyBoundedReadOnlyExpansions(expandedBody)) {
       return broadForLoopClassification(text, "the body contains expansion beyond the loop variable");
     }
     const classification = classifyReadOnlyLoopBody(expandedBody);