@lazyingart/agintiflow 0.20.220 → 0.20.222

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.220",
+  "version": "0.20.222",
   "type": "module",
   "description": "AgInTiFlow is a project-aware agent workspace for hybrid wet-dry R&D, hardware-aware intelligence, software automation, and industrial workflows.",
   "license": "Apache-2.0",

package/scripts/smoke-coding-tools.js

@@ -671,6 +671,34 @@ try {
       exactReadOnlyGitIdentityProbePolicy.writesWorkspace === false,
     "bounded read-only git identity substitutions incorrectly required destructive host permission"
   );
+  const exactReadOnlyGitIdentityLoop =
+    'for d in /home/lachlan/ProjectsLFS/AgenticApp /home/lachlan/ProjectsLFS/Musia /home/lachlan/ProjectsLFS/LALACHAN /home/lachlan/DiskMech/Projects/lazyedit; do echo "=== $d ==="; echo "user.name=[$(git -C "$d" config user.name 2>/dev/null)]"; echo "user.email=[$(git -C "$d" config user.email 2>/dev/null)]"; echo "--status--"; git -C "$d" status --short 2>&1 | head -15; echo; done';
+  const exactReadOnlyGitIdentityLoopPolicy = evaluateCommandPolicy(
+    exactReadOnlyGitIdentityLoop,
+    hostReadRootPolicy
+  );
+  assert(
+    exactReadOnlyGitIdentityLoopPolicy.allowed &&
+      exactReadOnlyGitIdentityLoopPolicy.category === "read-only" &&
+      exactReadOnlyGitIdentityLoopPolicy.boundedForLoop === true &&
+      exactReadOnlyGitIdentityLoopPolicy.needsNetwork === false &&
+      exactReadOnlyGitIdentityLoopPolicy.writesWorkspace === false,
+    "bounded per-repository Git identity/status audit incorrectly required destructive host permission"
+  );
+  const exactReadOnlyGitRepositoryAudit =
+    'for d in /home/lachlan/ProjectsLFS/AgenticApp /home/lachlan/ProjectsLFS/Musia /home/lachlan/ProjectsLFS/LALACHAN /home/lachlan/DiskMech/Projects/lazyedit; do echo "=== $d ==="; git -C "$d" config --get user.name; git -C "$d" config --get user.email; git -C "$d" status --porcelain=v1 --branch; echo "--- remotes ---"; git -C "$d" remote -v; echo; done';
+  const exactReadOnlyGitRepositoryAuditPolicy = evaluateCommandPolicy(
+    exactReadOnlyGitRepositoryAudit,
+    hostReadRootPolicy
+  );
+  assert(
+    exactReadOnlyGitRepositoryAuditPolicy.allowed &&
+      exactReadOnlyGitRepositoryAuditPolicy.category === "read-only" &&
+      exactReadOnlyGitRepositoryAuditPolicy.boundedForLoop === true &&
+      exactReadOnlyGitRepositoryAuditPolicy.needsNetwork === false &&
+      exactReadOnlyGitRepositoryAuditPolicy.writesWorkspace === false,
+    "bounded per-repository Git identity/status/remote audit incorrectly required destructive host permission"
+  );
   for (const unsafeEchoSubstitution of [
     'echo "VALUE=$(rm -rf report.md)"',
     'echo "VALUE=$(cp README.md report.md)"',
@@ -693,6 +721,30 @@ try {
       `unsafe echo command substitution bypassed the bounded read-only policy: ${unsafeEchoSubstitution}`
     );
   }
+  for (const unsafeLoopSubstitution of [
+    'for d in /tmp; do echo "VALUE=$(rm -rf report.md)"; done',
+    'for d in /tmp; do echo "VALUE=$(curl https://example.com)"; done',
+    'for d in /tmp; do echo "VALUE=$(echo $(pwd))"; done',
+    'for d in /tmp; do echo "VALUE=$SECRET"; done',
+    'for d in /tmp; do echo "VALUE=$(git -C "$d" config user.name attacker)"; done',
+    'for d in /tmp; do echo "VALUE=$(git -C "$d" config --global user.name)"; done',
+    'for d in /tmp; do echo "VALUE=$(git -C "$d" status; rm -rf report.md)"; done',
+    'for d in /tmp; do git -C "$d" status --short > report.md; done',
+    'for d in /tmp; do git -C "$d" remote add origin https://example.com/repo.git; done',
+    'for d in /tmp; do git -C "$d" remote set-url origin https://example.com/repo.git; done',
+  ]) {
+    const unsafeLoopSubstitutionPolicy = evaluateCommandPolicy(
+      unsafeLoopSubstitution,
+      hostReadRootPolicy
+    );
+    assert(
+      !unsafeLoopSubstitutionPolicy.allowed ||
+        unsafeLoopSubstitutionPolicy.category !== "read-only" ||
+        unsafeLoopSubstitutionPolicy.writesWorkspace === true ||
+        unsafeLoopSubstitutionPolicy.needsNetwork === true,
+      `unsafe loop substitution bypassed the bounded read-only policy: ${unsafeLoopSubstitution}`
+    );
+  }
   for (const unsafeCompoundAudit of [
     'cp README.md copied.md; for d in /tmp; do echo "$d"; done',
     'echo start; for d in /tmp; do if [ -d "$d" ]; then rm -rf "$d"; else echo missing; fi; done',

package/src/command-policy.js

@@ -1133,6 +1133,44 @@ function classifySafeEchoCommandSubstitution(normalized = "") {
   };
 }
 
+function classifyScopedReadOnlyGitProbe(normalized = "") {
+  const command = stripBenignRedirections(normalized);
+  if (!/^git\s+-C\s+/.test(command) || hasActiveShellExpansion(command)) return null;
+
+  const tokens = tokenizeShellWords(command);
+  if (tokens.length < 5 || tokens[0] !== "git" || tokens[1] !== "-C") return null;
+  const repository = tokens[2] || "";
+  if (
+    !repository ||
+    repository.startsWith("-") ||
+    !/^[A-Za-z0-9_@%+=:,./~+-]+$/.test(repository) ||
+    /[*?\[\]{}]/.test(repository)
+  ) {
+    return null;
+  }
+
+  const operation = tokens[3] || "";
+  const args = tokens.slice(4);
+  const safeStatus = operation === "status" && args.every((arg) =>
+    ["--short", "-s", "--porcelain", "--porcelain=v1", "--porcelain=v2", "--branch", "-b"].includes(arg)
+  );
+  const safeIdentityConfig = operation === "config" && (
+    (args.length === 1 && ["user.name", "user.email"].includes(args[0])) ||
+    (args.length === 2 && args[0] === "--get" && ["user.name", "user.email"].includes(args[1]))
+  );
+  const safeRemoteList = operation === "remote" && args.length === 1 && args[0] === "-v";
+  if (!safeStatus && !safeIdentityConfig && !safeRemoteList) return null;
+
+  return {
+    category: "read-only",
+    needsNetwork: false,
+    writesWorkspace: false,
+    gitOnly: true,
+    scopedGitProbe: true,
+    reason: `Git ${operation} reads bounded repository metadata through -C.`,
+  };
+}
+
 function classifyGitCleanDryRun(normalized) {
   const match = normalized.match(/^git\s+clean\b([\s\S]*)$/);
   if (!match) return null;
@@ -1226,6 +1264,8 @@ function classifySimpleCommand(normalized) {
   }
   const gitCleanDryRun = classifyGitCleanDryRun(normalized);
   if (gitCleanDryRun) return gitCleanDryRun;
+  const scopedReadOnlyGitProbe = classifyScopedReadOnlyGitProbe(normalized);
+  if (scopedReadOnlyGitProbe) return scopedReadOnlyGitProbe;
   const gitWorkflowClassification = classifyGitWorkflow(normalized);
   if (gitWorkflowClassification) return gitWorkflowClassification;
   const condaRunClassification = classifyCondaRun(normalized);
@@ -1643,6 +1683,27 @@ function classifyReadOnlyLoopBody(bodySource = "") {
   };
 }
 
+function loopBodyHasOnlyBoundedReadOnlyExpansions(bodySource = "") {
+  const text = String(bodySource || "").trim();
+  if (!hasActiveShellExpansion(text)) return true;
+  const sequence = parseTopLevelShellSequence(text);
+  if (
+    !sequence.commands.length ||
+    sequence.openQuote ||
+    sequence.trailingEscape ||
+    sequence.trailingSeparator
+  ) {
+    return false;
+  }
+  return sequence.commands.every((command) => {
+    if (!hasActiveShellExpansion(command)) return true;
+    const classification = classifySafeEchoCommandSubstitution(command);
+    return classification?.category === "read-only" &&
+      classification.writesWorkspace === false &&
+      classification.needsNetwork === false;
+  });
+}
+
 function classifyReadOnlyForLoop(normalized) {
   const text = String(normalized || "").trim();
   if (!/^for\s+/.test(text)) return null;
@@ -1670,10 +1731,6 @@ function classifyReadOnlyForLoop(normalized) {
     );
   }
 
-  if (hasActiveShellCommandSubstitution(bodySource)) {
-    return broadForLoopClassification(text, "the body uses command substitution");
-  }
-
   const escapedVariable = shellIdentifierPattern(variableName);
   const variableReference = new RegExp(
     `\\$(?:\\{${escapedVariable}\\}|${escapedVariable}(?![A-Za-z0-9_]))`,
@@ -1686,7 +1743,7 @@ function classifyReadOnlyForLoop(normalized) {
 
   for (const item of items) {
     const expandedBody = bodySource.replace(variableReference, item);
-    if (hasActiveShellExpansion(expandedBody) || hasActiveShellCommandSubstitution(expandedBody)) {
+    if (!loopBodyHasOnlyBoundedReadOnlyExpansions(expandedBody)) {
       return broadForLoopClassification(text, "the body contains expansion beyond the loop variable");
     }
     const classification = classifyReadOnlyLoopBody(expandedBody);