@lazyingart/agintiflow 0.20.223 → 0.20.224

package/docs/runtime-modes-and-autonomy.md

@@ -73,6 +73,7 @@ Current contract:
 - `danger` is trusted host/full-access mode: host shell, destructive actions, host installs, password typing, and outside-workspace file paths are enabled. Use it only for tasks you trust; obvious secret/publish exfiltration guards remain hard stops.
 - Workspace file tools may read and write inside the configured project folder when file tools are enabled.
 - Narrow workspace-local shell actions such as safe probes, Gradle/TeX builds, and `chmod +x` on a project script may run when the command policy can classify them precisely.
+- Finite literal read-only audit loops may count matches into a temporary shell variable and echo the result without asking for destructive permission. The count command, every consumer, and any surrounding command must still classify as bounded read-only work; network, mutation, dynamic item lists, and computed values used as command arguments remain blocked.
 - Android/JVM toolchain commands may include safe local env assignments such as `ANDROID_HOME`, `ANDROID_SDK_ROOT`, `JAVA_HOME`, or `GRADLE_USER_HOME`, plus small workspace-local status-log redirects. Secret-like env vars and redirects outside the workspace remain blocked.
 - Workspace writes outside that folder, secret paths, `.git` internals, and dependency folders such as `node_modules` are blocked.
 - `git clone`, `git fetch`, `git pull --ff-only`, `git push`, `curl`, and `wget` are classified as network operations.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.223",
+  "version": "0.20.224",
   "type": "module",
   "description": "AgInTiFlow is a project-aware agent workspace for hybrid wet-dry R&D, hardware-aware intelligence, software automation, and industrial workflows.",
   "license": "Apache-2.0",

package/scripts/smoke-coding-tools.js

@@ -673,6 +673,20 @@ try {
       exactReadOnlyExistenceLoopWithSuffixPolicy.writesWorkspace === false,
     "a finite read-only existence loop with bounded list suffix incorrectly required destructive host permission"
   );
+  const exactReadOnlyReportLiteralAudit =
+    'cd . && for s in \'handoff/LABCANVAS_AGENT_API_HANDOFF_2026_07_29.md\' \'/home/lachlan/ProjectsLFS/AgenticApp\' \'src/agenticapp/musia_ops.py\' \'scripts/xyq_chrome/watch_thread_dom_download.py\' \'Reviewed master\' \'ffprobe verification\' \'Song-only versus MV separation\' \'MV request versus publication separation\'; do n=$(grep -c -- "$s" media-routine-readiness.md); echo "$n :: $s"; done; echo \'--- git status ---\'; git status --short';
+  const exactReadOnlyReportLiteralAuditPolicy = evaluateCommandPolicy(
+    exactReadOnlyReportLiteralAudit,
+    hostWorkspacePolicy
+  );
+  assert(
+    exactReadOnlyReportLiteralAuditPolicy.allowed &&
+      exactReadOnlyReportLiteralAuditPolicy.category === "read-only" &&
+      exactReadOnlyReportLiteralAuditPolicy.boundedForLoop === true &&
+      exactReadOnlyReportLiteralAuditPolicy.needsNetwork === false &&
+      exactReadOnlyReportLiteralAuditPolicy.writesWorkspace === false,
+    "a bounded report literal-count audit incorrectly required destructive host permission"
+  );
   const exactReadOnlyGitIdentityProbe =
     'git status --short && echo "TOPLEVEL=$(git rev-parse --show-toplevel 2>&1)" && echo "BRANCH=$(git rev-parse --abbrev-ref HEAD 2>&1)"';
   const exactReadOnlyGitIdentityProbePolicy = evaluateCommandPolicy(
@@ -747,6 +761,11 @@ try {
     'for d in /tmp; do git -C "$d" status --short > report.md; done',
     'for d in /tmp; do git -C "$d" remote add origin https://example.com/repo.git; done',
     'for d in /tmp; do git -C "$d" remote set-url origin https://example.com/repo.git; done',
+    'for s in README.md; do n=$(rm -rf report.md); echo "$n :: $s"; done',
+    'for s in README.md; do n=$(curl https://example.com); echo "$n :: $s"; done',
+    'for s in README.md; do n=$(cat "$s"); echo "$n :: $s"; done',
+    'for s in README.md; do n=$(grep -c -- "$s" README.md); rm -rf "$n"; done',
+    'for s in \'README.md; rm -rf report.md\'; do echo "$s"; done',
   ]) {
     const unsafeLoopSubstitutionPolicy = evaluateCommandPolicy(
       unsafeLoopSubstitution,

package/src/command-policy.js

@@ -1543,7 +1543,7 @@ function classifyShellSequence(normalized) {
 
 const READ_ONLY_FOR_LOOP_MAX_ITEMS = 64;
 const READ_ONLY_FOR_LOOP_MAX_COMMANDS = 16;
-const READ_ONLY_FOR_LOOP_LITERAL_PATTERN = /^[A-Za-z0-9_@%+=:,./~+-]+$/;
+const READ_ONLY_FOR_LOOP_LITERAL_PATTERN = /^[A-Za-z0-9_@%+=:,./~+ -]+$/;
 
 function shellIdentifierPattern(value = "") {
   return String(value || "").replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -1708,6 +1708,83 @@ function loopBodyHasOnlyBoundedReadOnlyExpansions(bodySource = "") {
   });
 }
 
+function isBoundedReadOnlyScalarCommand(command = "") {
+  const normalized = stripBenignRedirections(command);
+  if (!normalized || hasActiveShellExpansion(normalized)) return false;
+  const tokens = tokenizeShellWords(normalized);
+  if (!tokens.length) return false;
+  if (["grep", "rg"].includes(tokens[0])) {
+    return tokens.slice(1).some((token) =>
+      token === "--count" || /^-[A-Za-z]*c[A-Za-z]*$/.test(token)
+    );
+  }
+  return tokens[0] === "wc" && tokens.slice(1).includes("-l");
+}
+
+function sanitizeReadOnlyLoopAssignments(bodySource = "") {
+  const text = String(bodySource || "").trim();
+  const sequence = parseTopLevelShellSequence(text);
+  if (
+    !sequence.commands.length ||
+    sequence.openQuote ||
+    sequence.trailingEscape ||
+    sequence.trailingSeparator
+  ) {
+    return null;
+  }
+
+  const assigned = new Map();
+  const commands = [];
+  for (const sourceCommand of sequence.commands) {
+    let command = sourceCommand;
+    for (const [name, state] of assigned.entries()) {
+      const escapedName = shellIdentifierPattern(name);
+      const reference = new RegExp(`\\$(?:\\{${escapedName}\\}|${escapedName}(?![A-Za-z0-9_]))`, "g");
+      if (!reference.test(command)) continue;
+      if (!/^echo\s+/.test(command)) return null;
+      command = command.replace(reference, `AGINTI_READ_VALUE_${name}`);
+      state.used = true;
+    }
+
+    const assignment = command.match(/^([A-Za-z_][A-Za-z0-9_]*)=(\$\([\s\S]+\))$/);
+    if (!assignment) {
+      commands.push(command);
+      continue;
+    }
+    const [, name, expression] = assignment;
+    if (assigned.has(name) || assigned.size >= 4) return null;
+    const extracted = extractBoundedCommandSubstitutions(`echo ${expression}`);
+    if (
+      !extracted ||
+      extracted.commands.length !== 1 ||
+      extracted.template !== "echo AGINTI_READ_VALUE_1"
+    ) {
+      return null;
+    }
+    const inner = extracted.commands[0];
+    const classification = classifyShellSequence(inner) ||
+      classifyPipelineSequence(inner) ||
+      classifySimpleCommand(inner);
+    if (
+      classification.category !== "read-only" ||
+      classification.writesWorkspace ||
+      classification.needsNetwork ||
+      !isBoundedReadOnlyScalarCommand(inner)
+    ) {
+      return null;
+    }
+    assigned.set(name, { used: false });
+    commands.push("true");
+  }
+  if ([...assigned.values()].some((state) => !state.used)) return null;
+
+  let sanitized = commands[0];
+  for (let index = 1; index < commands.length; index += 1) {
+    sanitized += ` ${sequence.separators[index - 1] || ";"} ${commands[index]}`;
+  }
+  return sanitized;
+}
+
 function classifyReadOnlyForLoop(normalized) {
   const text = String(normalized || "").trim();
   if (!/^for\s+/.test(text)) return null;
@@ -1747,10 +1824,11 @@ function classifyReadOnlyForLoop(normalized) {
 
   for (const item of items) {
     const expandedBody = bodySource.replace(variableReference, item);
-    if (!loopBodyHasOnlyBoundedReadOnlyExpansions(expandedBody)) {
+    const sanitizedBody = sanitizeReadOnlyLoopAssignments(expandedBody);
+    if (!sanitizedBody || !loopBodyHasOnlyBoundedReadOnlyExpansions(sanitizedBody)) {
       return broadForLoopClassification(text, "the body contains expansion beyond the loop variable");
     }
-    const classification = classifyReadOnlyLoopBody(expandedBody);
+    const classification = classifyReadOnlyLoopBody(sanitizedBody);
     if (classification.category === "blocked" || classification.category === "destructive") {
       return { ...classification, gitOnly: false };
     }
@@ -1771,7 +1849,7 @@ function classifyReadOnlyForLoop(normalized) {
 
 function classifyReadOnlyCompoundSequence(normalized) {
   const text = String(normalized || "").trim();
-  if (!text || hasActiveShellCommandSubstitution(text)) return null;
+  if (!text) return null;
 
   let forIndex = findUnquotedShellWord(text, "for");
   const startsAtCommandBoundary = (index) => {
@@ -1908,7 +1986,11 @@ function classifyCdCommand(normalized) {
   if (!isSafeRelativeDir(dir) && !virtualWorkspacePath) {
     return { category: "blocked", reason: `cd target must be a safe workspace-relative directory: ${dir}` };
   }
-  const innerClassification = classifyShellSequence(inner.trim()) || classifyPipelineSequence(inner.trim()) || classifySimpleCommand(inner.trim());
+  const innerClassification = classifyReadOnlyCompoundSequence(inner.trim()) ||
+    classifyReadOnlyForLoop(inner.trim()) ||
+    classifyShellSequence(inner.trim()) ||
+    classifyPipelineSequence(inner.trim()) ||
+    classifySimpleCommand(inner.trim());
   if (innerClassification.category === "blocked") return innerClassification;
   return { ...innerClassification, cdDir: dir, virtualWorkspacePath };
 }
@@ -1929,7 +2011,9 @@ function classifyReadOnlyRootCd(normalized, config = {}) {
   const readOnlyRoot = configuredReadOnlyRoot(config, dir);
   if (!readOnlyRoot) return null;
 
-  const innerClassification = classifyShellSequence(inner.trim()) ||
+  const innerClassification = classifyReadOnlyCompoundSequence(inner.trim()) ||
+    classifyReadOnlyForLoop(inner.trim()) ||
+    classifyShellSequence(inner.trim()) ||
     classifyPipelineSequence(inner.trim()) ||
     classifySimpleCommand(inner.trim());
   const safeCategory = ["read-only", "network-fetch"].includes(innerClassification.category);