@lazyingart/agintiflow 0.20.222 → 0.20.224

package/docs/runtime-modes-and-autonomy.md

@@ -73,6 +73,7 @@ Current contract:
 - `danger` is trusted host/full-access mode: host shell, destructive actions, host installs, password typing, and outside-workspace file paths are enabled. Use it only for tasks you trust; obvious secret/publish exfiltration guards remain hard stops.
 - Workspace file tools may read and write inside the configured project folder when file tools are enabled.
 - Narrow workspace-local shell actions such as safe probes, Gradle/TeX builds, and `chmod +x` on a project script may run when the command policy can classify them precisely.
+- Finite literal read-only audit loops may count matches into a temporary shell variable and echo the result without asking for destructive permission. The count command, every consumer, and any surrounding command must still classify as bounded read-only work; network, mutation, dynamic item lists, and computed values used as command arguments remain blocked.
 - Android/JVM toolchain commands may include safe local env assignments such as `ANDROID_HOME`, `ANDROID_SDK_ROOT`, `JAVA_HOME`, or `GRADLE_USER_HOME`, plus small workspace-local status-log redirects. Secret-like env vars and redirects outside the workspace remain blocked.
 - Workspace writes outside that folder, secret paths, `.git` internals, and dependency folders such as `node_modules` are blocked.
 - `git clone`, `git fetch`, `git pull --ff-only`, `git push`, `curl`, and `wget` are classified as network operations.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.222",
+  "version": "0.20.224",
   "type": "module",
   "description": "AgInTiFlow is a project-aware agent workspace for hybrid wet-dry R&D, hardware-aware intelligence, software automation, and industrial workflows.",
   "license": "Apache-2.0",

package/scripts/smoke-coding-tools.js

@@ -658,6 +658,35 @@ try {
       exactCompoundReadOnlyAuditPolicy.writesWorkspace === false,
     "a finite read-only prelude and conditional directory audit incorrectly required destructive host permission"
   );
+  const exactReadOnlyExistenceLoopWithSuffix =
+    'for f in scripts/xyq_cdp_browser.py scripts/xyq_chrome/launch_chrome.sh scripts/xyq_chrome/watch_thread_dom_download.py scripts/musia_mv_finalize.sh; do test -e "/home/lachlan/ProjectsLFS/LALACHAN/$f" && echo "OK   $f" || echo "MISS $f"; done; echo "---mv_packs---"; ls -1 /home/lachlan/ProjectsLFS/Musia/data/mv_packs 2>&1; echo "---creative_projects---"; ls -1 /home/lachlan/ProjectsLFS/Musia/data/creative_projects 2>&1 | head -20';
+  const exactReadOnlyExistenceLoopWithSuffixPolicy = evaluateCommandPolicy(
+    exactReadOnlyExistenceLoopWithSuffix,
+    hostReadRootPolicy
+  );
+  assert(
+    exactReadOnlyExistenceLoopWithSuffixPolicy.allowed &&
+      exactReadOnlyExistenceLoopWithSuffixPolicy.category === "read-only" &&
+      exactReadOnlyExistenceLoopWithSuffixPolicy.boundedForLoop === true &&
+      exactReadOnlyExistenceLoopWithSuffixPolicy.boundedCompoundSequence === true &&
+      exactReadOnlyExistenceLoopWithSuffixPolicy.needsNetwork === false &&
+      exactReadOnlyExistenceLoopWithSuffixPolicy.writesWorkspace === false,
+    "a finite read-only existence loop with bounded list suffix incorrectly required destructive host permission"
+  );
+  const exactReadOnlyReportLiteralAudit =
+    'cd . && for s in \'handoff/LABCANVAS_AGENT_API_HANDOFF_2026_07_29.md\' \'/home/lachlan/ProjectsLFS/AgenticApp\' \'src/agenticapp/musia_ops.py\' \'scripts/xyq_chrome/watch_thread_dom_download.py\' \'Reviewed master\' \'ffprobe verification\' \'Song-only versus MV separation\' \'MV request versus publication separation\'; do n=$(grep -c -- "$s" media-routine-readiness.md); echo "$n :: $s"; done; echo \'--- git status ---\'; git status --short';
+  const exactReadOnlyReportLiteralAuditPolicy = evaluateCommandPolicy(
+    exactReadOnlyReportLiteralAudit,
+    hostWorkspacePolicy
+  );
+  assert(
+    exactReadOnlyReportLiteralAuditPolicy.allowed &&
+      exactReadOnlyReportLiteralAuditPolicy.category === "read-only" &&
+      exactReadOnlyReportLiteralAuditPolicy.boundedForLoop === true &&
+      exactReadOnlyReportLiteralAuditPolicy.needsNetwork === false &&
+      exactReadOnlyReportLiteralAuditPolicy.writesWorkspace === false,
+    "a bounded report literal-count audit incorrectly required destructive host permission"
+  );
   const exactReadOnlyGitIdentityProbe =
     'git status --short && echo "TOPLEVEL=$(git rev-parse --show-toplevel 2>&1)" && echo "BRANCH=$(git rev-parse --abbrev-ref HEAD 2>&1)"';
   const exactReadOnlyGitIdentityProbePolicy = evaluateCommandPolicy(
@@ -732,6 +761,11 @@ try {
     'for d in /tmp; do git -C "$d" status --short > report.md; done',
     'for d in /tmp; do git -C "$d" remote add origin https://example.com/repo.git; done',
     'for d in /tmp; do git -C "$d" remote set-url origin https://example.com/repo.git; done',
+    'for s in README.md; do n=$(rm -rf report.md); echo "$n :: $s"; done',
+    'for s in README.md; do n=$(curl https://example.com); echo "$n :: $s"; done',
+    'for s in README.md; do n=$(cat "$s"); echo "$n :: $s"; done',
+    'for s in README.md; do n=$(grep -c -- "$s" README.md); rm -rf "$n"; done',
+    'for s in \'README.md; rm -rf report.md\'; do echo "$s"; done',
   ]) {
     const unsafeLoopSubstitutionPolicy = evaluateCommandPolicy(
       unsafeLoopSubstitution,
@@ -754,6 +788,9 @@ try {
     'echo start; for d in /tmp; do if [ -d "$d" ]; then if [ -f "$d/x" ]; then cat "$d/x"; else echo missing; fi; else echo absent; fi; done',
     'echo start; for d in $ROOTS; do if [ -d "$d" ]; then ls "$d"; else echo missing; fi; done',
     'echo start; for d in /tmp; do if [ -d "$d" ]; then ls "$d"; else echo missing; fi; done; rm -rf report.md',
+    'for f in README.md; do test -e "$f" && echo ok || echo missing; done; cp README.md copied.md',
+    'for f in README.md; do test -e "$f" && echo ok || echo missing; done; curl https://example.com',
+    'for f in README.md; do test -e "$f" && echo ok || echo missing; done; echo done > report.md',
   ]) {
     const unsafeCompoundAuditPolicy = evaluateCommandPolicy(unsafeCompoundAudit, hostReadRootPolicy);
     assert(

package/src/command-policy.js

@@ -1357,7 +1357,11 @@ function classifySimpleCommand(normalized) {
     };
   }
 
-  if (matchAny(READ_ONLY_PATTERNS, commandForPatternMatching) || isReadOnlyFindCommand(normalized)) {
+  if (
+    matchAny(READ_ONLY_PATTERNS, commandForPatternMatching) ||
+    isReadOnlyFindCommand(normalized) ||
+    (!hasActiveShellExpansion(benignRedirectCommand) && isReadOnlyShellCondition(benignRedirectCommand))
+  ) {
     return {
       category: "read-only",
       needsNetwork: false,
@@ -1539,7 +1543,7 @@ function classifyShellSequence(normalized) {
 
 const READ_ONLY_FOR_LOOP_MAX_ITEMS = 64;
 const READ_ONLY_FOR_LOOP_MAX_COMMANDS = 16;
-const READ_ONLY_FOR_LOOP_LITERAL_PATTERN = /^[A-Za-z0-9_@%+=:,./~+-]+$/;
+const READ_ONLY_FOR_LOOP_LITERAL_PATTERN = /^[A-Za-z0-9_@%+=:,./~+ -]+$/;
 
 function shellIdentifierPattern(value = "") {
   return String(value || "").replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -1704,6 +1708,83 @@ function loopBodyHasOnlyBoundedReadOnlyExpansions(bodySource = "") {
   });
 }
 
+function isBoundedReadOnlyScalarCommand(command = "") {
+  const normalized = stripBenignRedirections(command);
+  if (!normalized || hasActiveShellExpansion(normalized)) return false;
+  const tokens = tokenizeShellWords(normalized);
+  if (!tokens.length) return false;
+  if (["grep", "rg"].includes(tokens[0])) {
+    return tokens.slice(1).some((token) =>
+      token === "--count" || /^-[A-Za-z]*c[A-Za-z]*$/.test(token)
+    );
+  }
+  return tokens[0] === "wc" && tokens.slice(1).includes("-l");
+}
+
+function sanitizeReadOnlyLoopAssignments(bodySource = "") {
+  const text = String(bodySource || "").trim();
+  const sequence = parseTopLevelShellSequence(text);
+  if (
+    !sequence.commands.length ||
+    sequence.openQuote ||
+    sequence.trailingEscape ||
+    sequence.trailingSeparator
+  ) {
+    return null;
+  }
+
+  const assigned = new Map();
+  const commands = [];
+  for (const sourceCommand of sequence.commands) {
+    let command = sourceCommand;
+    for (const [name, state] of assigned.entries()) {
+      const escapedName = shellIdentifierPattern(name);
+      const reference = new RegExp(`\\$(?:\\{${escapedName}\\}|${escapedName}(?![A-Za-z0-9_]))`, "g");
+      if (!reference.test(command)) continue;
+      if (!/^echo\s+/.test(command)) return null;
+      command = command.replace(reference, `AGINTI_READ_VALUE_${name}`);
+      state.used = true;
+    }
+
+    const assignment = command.match(/^([A-Za-z_][A-Za-z0-9_]*)=(\$\([\s\S]+\))$/);
+    if (!assignment) {
+      commands.push(command);
+      continue;
+    }
+    const [, name, expression] = assignment;
+    if (assigned.has(name) || assigned.size >= 4) return null;
+    const extracted = extractBoundedCommandSubstitutions(`echo ${expression}`);
+    if (
+      !extracted ||
+      extracted.commands.length !== 1 ||
+      extracted.template !== "echo AGINTI_READ_VALUE_1"
+    ) {
+      return null;
+    }
+    const inner = extracted.commands[0];
+    const classification = classifyShellSequence(inner) ||
+      classifyPipelineSequence(inner) ||
+      classifySimpleCommand(inner);
+    if (
+      classification.category !== "read-only" ||
+      classification.writesWorkspace ||
+      classification.needsNetwork ||
+      !isBoundedReadOnlyScalarCommand(inner)
+    ) {
+      return null;
+    }
+    assigned.set(name, { used: false });
+    commands.push("true");
+  }
+  if ([...assigned.values()].some((state) => !state.used)) return null;
+
+  let sanitized = commands[0];
+  for (let index = 1; index < commands.length; index += 1) {
+    sanitized += ` ${sequence.separators[index - 1] || ";"} ${commands[index]}`;
+  }
+  return sanitized;
+}
+
 function classifyReadOnlyForLoop(normalized) {
   const text = String(normalized || "").trim();
   if (!/^for\s+/.test(text)) return null;
@@ -1743,10 +1824,11 @@ function classifyReadOnlyForLoop(normalized) {
 
   for (const item of items) {
     const expandedBody = bodySource.replace(variableReference, item);
-    if (!loopBodyHasOnlyBoundedReadOnlyExpansions(expandedBody)) {
+    const sanitizedBody = sanitizeReadOnlyLoopAssignments(expandedBody);
+    if (!sanitizedBody || !loopBodyHasOnlyBoundedReadOnlyExpansions(sanitizedBody)) {
       return broadForLoopClassification(text, "the body contains expansion beyond the loop variable");
     }
-    const classification = classifyReadOnlyLoopBody(expandedBody);
+    const classification = classifyReadOnlyLoopBody(sanitizedBody);
     if (classification.category === "blocked" || classification.category === "destructive") {
       return { ...classification, gitOnly: false };
     }
@@ -1767,7 +1849,7 @@ function classifyReadOnlyForLoop(normalized) {
 
 function classifyReadOnlyCompoundSequence(normalized) {
   const text = String(normalized || "").trim();
-  if (!text || /^for\s+/.test(text) || hasActiveShellCommandSubstitution(text)) return null;
+  if (!text) return null;
 
   let forIndex = findUnquotedShellWord(text, "for");
   const startsAtCommandBoundary = (index) => {
@@ -1778,16 +1860,24 @@ function classifyReadOnlyCompoundSequence(normalized) {
   while (forIndex > 0 && !startsAtCommandBoundary(forIndex)) {
     forIndex = findUnquotedShellWord(text, "for", forIndex + 3);
   }
-  if (forIndex <= 0) return null;
+  if (forIndex < 0) return null;
 
   const prefixSource = trimShellListBoundary(text.slice(0, forIndex));
-  const loopSource = text.slice(forIndex).trim();
-  const prefixClassification = classifyReadOnlyCommandList(prefixSource);
-  if (prefixClassification.category === "blocked" || prefixClassification.category === "destructive") {
-    return { ...prefixClassification, gitOnly: false };
-  }
-  if (prefixClassification.category !== "read-only" || prefixClassification.writesWorkspace) {
-    return broadForLoopClassification(text, "the command prelude is not read-only");
+  const doneIndex = findUnquotedShellWord(text, "done", forIndex + 3);
+  if (doneIndex < 0) return null;
+  const loopSource = text.slice(forIndex, doneIndex + 4).trim();
+  const suffixSource = trimShellListBoundary(text.slice(doneIndex + 4));
+  if (!prefixSource && !suffixSource) return null;
+
+  for (const [label, source] of [["prelude", prefixSource], ["suffix", suffixSource]]) {
+    if (!source) continue;
+    const classification = classifyReadOnlyCommandList(source);
+    if (classification.category === "blocked" || classification.category === "destructive") {
+      return { ...classification, gitOnly: false };
+    }
+    if (classification.category !== "read-only" || classification.writesWorkspace) {
+      return broadForLoopClassification(text, `the command ${label} is not read-only`);
+    }
   }
   const loopClassification = classifyReadOnlyForLoop(loopSource);
   if (!loopClassification) return null;
@@ -1801,7 +1891,7 @@ function classifyReadOnlyCompoundSequence(normalized) {
     gitOnly: false,
     boundedForLoop: true,
     boundedCompoundSequence: true,
-    reason: "Finite read-only command prelude followed by a bounded read-only shell loop.",
+    reason: "A bounded read-only shell loop has only finite read-only command context.",
   };
 }
 
@@ -1896,7 +1986,11 @@ function classifyCdCommand(normalized) {
   if (!isSafeRelativeDir(dir) && !virtualWorkspacePath) {
     return { category: "blocked", reason: `cd target must be a safe workspace-relative directory: ${dir}` };
   }
-  const innerClassification = classifyShellSequence(inner.trim()) || classifyPipelineSequence(inner.trim()) || classifySimpleCommand(inner.trim());
+  const innerClassification = classifyReadOnlyCompoundSequence(inner.trim()) ||
+    classifyReadOnlyForLoop(inner.trim()) ||
+    classifyShellSequence(inner.trim()) ||
+    classifyPipelineSequence(inner.trim()) ||
+    classifySimpleCommand(inner.trim());
   if (innerClassification.category === "blocked") return innerClassification;
   return { ...innerClassification, cdDir: dir, virtualWorkspacePath };
 }
@@ -1917,7 +2011,9 @@ function classifyReadOnlyRootCd(normalized, config = {}) {
   const readOnlyRoot = configuredReadOnlyRoot(config, dir);
   if (!readOnlyRoot) return null;
 
-  const innerClassification = classifyShellSequence(inner.trim()) ||
+  const innerClassification = classifyReadOnlyCompoundSequence(inner.trim()) ||
+    classifyReadOnlyForLoop(inner.trim()) ||
+    classifyShellSequence(inner.trim()) ||
     classifyPipelineSequence(inner.trim()) ||
     classifySimpleCommand(inner.trim());
   const safeCategory = ["read-only", "network-fetch"].includes(innerClassification.category);