@lazyingart/agintiflow 0.20.221 → 0.20.222

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.221",
+  "version": "0.20.222",
   "type": "module",
   "description": "AgInTiFlow is a project-aware agent workspace for hybrid wet-dry R&D, hardware-aware intelligence, software automation, and industrial workflows.",
   "license": "Apache-2.0",

package/scripts/smoke-coding-tools.js

@@ -685,6 +685,20 @@ try {
       exactReadOnlyGitIdentityLoopPolicy.writesWorkspace === false,
     "bounded per-repository Git identity/status audit incorrectly required destructive host permission"
   );
+  const exactReadOnlyGitRepositoryAudit =
+    'for d in /home/lachlan/ProjectsLFS/AgenticApp /home/lachlan/ProjectsLFS/Musia /home/lachlan/ProjectsLFS/LALACHAN /home/lachlan/DiskMech/Projects/lazyedit; do echo "=== $d ==="; git -C "$d" config --get user.name; git -C "$d" config --get user.email; git -C "$d" status --porcelain=v1 --branch; echo "--- remotes ---"; git -C "$d" remote -v; echo; done';
+  const exactReadOnlyGitRepositoryAuditPolicy = evaluateCommandPolicy(
+    exactReadOnlyGitRepositoryAudit,
+    hostReadRootPolicy
+  );
+  assert(
+    exactReadOnlyGitRepositoryAuditPolicy.allowed &&
+      exactReadOnlyGitRepositoryAuditPolicy.category === "read-only" &&
+      exactReadOnlyGitRepositoryAuditPolicy.boundedForLoop === true &&
+      exactReadOnlyGitRepositoryAuditPolicy.needsNetwork === false &&
+      exactReadOnlyGitRepositoryAuditPolicy.writesWorkspace === false,
+    "bounded per-repository Git identity/status/remote audit incorrectly required destructive host permission"
+  );
   for (const unsafeEchoSubstitution of [
     'echo "VALUE=$(rm -rf report.md)"',
     'echo "VALUE=$(cp README.md report.md)"',
@@ -716,6 +730,8 @@ try {
     'for d in /tmp; do echo "VALUE=$(git -C "$d" config --global user.name)"; done',
     'for d in /tmp; do echo "VALUE=$(git -C "$d" status; rm -rf report.md)"; done',
     'for d in /tmp; do git -C "$d" status --short > report.md; done',
+    'for d in /tmp; do git -C "$d" remote add origin https://example.com/repo.git; done',
+    'for d in /tmp; do git -C "$d" remote set-url origin https://example.com/repo.git; done',
   ]) {
     const unsafeLoopSubstitutionPolicy = evaluateCommandPolicy(
       unsafeLoopSubstitution,

package/src/command-policy.js

@@ -1158,7 +1158,8 @@ function classifyScopedReadOnlyGitProbe(normalized = "") {
     (args.length === 1 && ["user.name", "user.email"].includes(args[0])) ||
     (args.length === 2 && args[0] === "--get" && ["user.name", "user.email"].includes(args[1]))
   );
-  if (!safeStatus && !safeIdentityConfig) return null;
+  const safeRemoteList = operation === "remote" && args.length === 1 && args[0] === "-v";
+  if (!safeStatus && !safeIdentityConfig && !safeRemoteList) return null;
 
   return {
     category: "read-only",