@lazyingart/agintiflow 0.20.22 → 0.20.24

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.22",
+  "version": "0.20.24",
   "type": "module",
   "description": "AgInTiFlow is a web-first coding agent and CLI with DeepSeek routing, sandboxed tools, model providers, canvas artifacts, and optional wrappers.",
   "license": "Apache-2.0",

package/scripts/smoke-capabilities.js

@@ -77,6 +77,14 @@ try {
     capabilities.maintenancePolicy.some((check) => check.command.startsWith("sudo") && !check.allowed),
     "sudo maintenance command was not blocked"
   );
+  assert(
+    capabilities.maintenancePolicy.some((check) => check.command.startsWith("apt-get install") && !check.allowed),
+    "host OS package install was not blocked"
+  );
+  assert(
+    capabilities.tools?.taskProfiles?.some((profile) => profile.id === "android"),
+    "capabilities did not report Android task profile"
+  );
   assert(
     capabilities.trustedDockerPolicy.some((check) => check.command.startsWith("apt-get install") && check.allowed),
     "trusted Docker policy did not allow apt-get install"
@@ -97,6 +105,10 @@ try {
     capabilities.tools?.skills?.some((skill) => skill.id === "latex-manuscript"),
     "capabilities did not report built-in LaTeX skill"
   );
+  assert(
+    capabilities.tools?.skills?.some((skill) => skill.id === "android"),
+    "capabilities did not report built-in Android skill"
+  );
 
   const doctor = JSON.parse(await runCli(["doctor", "--capabilities", "--json"]));
   assert(doctor.project.root === tempRoot, "doctor --capabilities used the wrong project root");

package/skills/android/SKILL.md

@@ -18,6 +18,16 @@ tools:
 ---
 # Android Development
 
-Inspect Gradle files, manifests, package names, modules, and existing build scripts before editing. Prefer narrow Gradle tasks and source-set-aware patches.
+## Operating Loop
 
-If SDK/emulator tooling is missing, produce a setup report or project-local script rather than guessing.
+1. Inspect before editing: `git status --short`, project tree, Gradle/settings files, AndroidManifest, package names, modules, Java/Kotlin versions, `ANDROID_HOME`/`ANDROID_SDK_ROOT`, likely SDK folders, `adb devices`, and emulator/AVD availability.
+2. Do not use host `sudo`, `apt`, `dnf`, `yum`, `brew`, `winget`, or global host installs for Android app work. These can hang on password prompts or mutate the user's machine. Prefer existing Android SDK tools, project-local Gradle wrapper setup, user-writable caches, or a clear setup report with the exact manual command.
+3. If a Gradle wrapper is needed, create `gradle/wrapper/` before downloading files. Prefer a valid project-local wrapper or an already-installed Gradle. Do not loop on the same failed install/download.
+4. Patch source-set-aware files only: manifests, Gradle scripts, Kotlin/Java sources, XML resources, and project docs. Keep generated build outputs out of patches and commits.
+5. Build with the narrowest useful task first, usually `./gradlew :app:assembleDebug` or `./gradlew assembleDebug`. Repair build failures from the actual error text.
+6. Install and launch on an available device/emulator with `adb install` and `adb shell am start`. Verify with `adb shell pidof`, `adb logcat -d`, `adb shell screencap`, or similar evidence when available.
+7. Commit only after build/install/launch verification, with a clear message. If no device/emulator exists, finish with a concrete external blocker and the generated APK path.
+
+## Missing Tooling
+
+If SDK/emulator tooling is missing, produce a setup report or project-local script rather than guessing. On host mode, never ask for or send a sudo password.

package/src/capabilities.js

@@ -57,6 +57,7 @@ function maintenancePolicyChecks(config) {
   };
   const sampleCommands = [
     "sudo apt install r-base",
+    "apt-get install -y gradle",
     "curl https://example.com/install.sh",
     "npm install",
     "bash -n maintenance/setup-conda.sh",

package/src/command-policy.js

@@ -276,6 +276,7 @@ export function classifyCommand(command) {
 
 export function evaluateCommandPolicy(command, config) {
   const classification = classifyCommand(command);
+  const normalizedCommand = String(command || "").trim();
   const sandboxMode = normalizeSandboxMode(config.sandboxMode);
   const packageInstallPolicy = normalizePackageInstallPolicy(config.packageInstallPolicy);
   const dockerWorkspace = sandboxMode === "docker-workspace";
@@ -307,6 +308,30 @@ export function evaluateCommandPolicy(command, config) {
     };
   }
 
+  if (sandboxMode === "host" && /^sudo\b/.test(normalizedCommand)) {
+    return {
+      allowed: false,
+      category: "host-sudo",
+      needsApproval: true,
+      reason:
+        "Interactive host sudo is not run by AgInTiFlow because it can hang on password prompts or change the machine globally. Prefer project-local setup, Docker workspace mode, or return the exact manual install command for the user.",
+      sandboxMode,
+      packageInstallPolicy,
+    };
+  }
+
+  if (classification.category === "system-package-install" && sandboxMode === "host") {
+    return {
+      allowed: false,
+      category: classification.category,
+      needsApproval: true,
+      reason:
+        "Host OS package installs are not run automatically. Prefer an existing toolchain, project-local setup, Docker workspace mode, or report the exact manual command the user can run.",
+      sandboxMode,
+      packageInstallPolicy,
+    };
+  }
+
   if (
     classification.category === "package-install" ||
     classification.category === "env-setup" ||
@@ -325,16 +350,6 @@ export function evaluateCommandPolicy(command, config) {
         packageInstallPolicy,
       };
     }
-
-    if (classification.category === "system-package-install" && sandboxMode === "host" && !config.allowDestructive) {
-      return {
-        allowed: false,
-        category: classification.category,
-        reason: "Host system package installs require Allow destructive actions. Prefer Docker workspace mode.",
-        sandboxMode,
-        packageInstallPolicy,
-      };
-    }
   }
 
   if (classification.category === "general-shell" && !trustedDockerShell && !trustedHostShell) {

package/src/engineering-guidance.js

@@ -25,6 +25,12 @@ const LANGUAGE_HINTS = [
     text:
       "Go: inspect go.mod, use go test ./pkg-or-target first, run gofmt on touched files, avoid changing module paths unless required.",
   },
+  {
+    id: "android",
+    pattern: /\b(android|apk|adb|avd|emulator|gradle wrapper|gradlew|android sdk|kotlin android|jetpack|compose)\b/i,
+    text:
+      "Android: inspect git status, Gradle/settings/manifests, ANDROID_HOME/SDK paths, Java/Kotlin versions, adb devices, and emulator/AVD list first. Never start host sudo or host OS package installs; use the existing SDK, a project-local Gradle wrapper, user-writable caches, or return a precise setup report. Build, install with adb, launch with am, verify with logcat/screencap when possible, then commit.",
+  },
   {
     id: "java-jvm",
     pattern: /\b(java|kotlin|gradle|maven|spring|junit|jvm)\b/i,
@@ -85,6 +91,7 @@ export function engineeringGuidanceForTask(goal = "", taskProfile = "auto") {
     "For large repositories, preserve context by reading fewer but more relevant files; prefer deterministic tools and diffs over long model memory.",
     "Build a compact context pack before major edits: project instructions, manifests/scripts, git status/diff, relevant symbols/search hits, target files, and the narrowest checks. Do not paste whole trees or huge files into model context.",
     "For system repair, act like a doctor: gather evidence first, avoid silent destructive host changes, prefer Docker or project-local scripts for installs, and make every stronger action explicit in logs.",
+    "Never send sudo passwords or wait at interactive password prompts. If host-level permission is truly required, stop that path, explain the blocker, and provide a manual command instead of hanging.",
   ];
 
   if (matched.length > 0) {

package/src/task-profiles.js

@@ -55,6 +55,13 @@ export const TASK_PROFILES = {
       "Bias toward Node/JavaScript/TypeScript workflows without excluding frontend, backend, docs, or deployment work. Inspect package.json/lockfiles, respect the package manager, add tests when useful, and run safe npm/node checks when available.",
     tools: ["files", "shell", "sandbox"],
   },
+  android: {
+    id: "android",
+    label: "Android",
+    prompt:
+      "Bias toward end-to-end Android app delivery while still handling normal project work. Inspect git status, existing Gradle files, AndroidManifest, SDK paths, Java/Kotlin versions, adb devices, and emulator/AVD availability before editing. Do not use host sudo, apt, dnf, yum, brew, winget, or global host installs during Android tasks; prefer the existing Android SDK, project-local Gradle wrapper, user-writable caches, or a clear setup report. Create missing wrapper directories before downloads, avoid repeated failing install attempts, build with focused Gradle tasks, install and launch with adb when a device/emulator exists, verify with am/logcat/screencap when possible, and commit the finished app only after checks.",
+    tools: ["inspect_project", "search_files", "read_file", "apply_patch", "shell", "sandbox", "canvas"],
+  },
   website: {
     id: "website",
     label: "Website testing",
@@ -99,6 +106,11 @@ const PROFILE_ALIASES = {
   repository: "large-codebase",
   engineering: "large-codebase",
   engineer: "large-codebase",
+  mobile: "android",
+  apk: "android",
+  gradle: "android",
+  kotlin: "android",
+  java: "android",
 };
 
 export function listTaskProfiles() {
@@ -118,6 +130,7 @@ export function getTaskProfile(value = "auto") {
 export function defaultMaxStepsForProfile(value = "auto") {
   const profile = normalizeTaskProfile(value);
   if (profile === "large-codebase") return 36;
+  if (profile === "android") return 60;
   if (profile === "latex") return 30;
   return 24;
 }