@lazyingart/agintiflow 0.20.233 → 0.20.235

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.233",
+  "version": "0.20.235",
   "type": "module",
   "description": "AgInTiFlow is a project-aware agent workspace for hybrid wet-dry R&D, hardware-aware intelligence, software automation, and industrial workflows.",
   "license": "Apache-2.0",

package/scripts/smoke-coding-tools.js

@@ -1062,6 +1062,40 @@ try {
   assert(safeChmodAndRunPolicy.allowed, "safe workspace chmod + script run sequence should be allowed in docker-workspace allow mode");
   const unsafeChmodPolicy = evaluateCommandPolicy("chmod +x /etc/passwd", dockerWorkspacePolicy);
   assert(!unsafeChmodPolicy.allowed, "chmod outside the workspace should be blocked");
+  const documentBuildSequencePolicy = evaluateCommandPolicy(
+    "sha256sum README.md PROJECT_NOTES.md source/budget.csv source/meeting-notes.txt source/style-notes.md > /tmp/src-before.sha256 && cat /tmp/src-before.sha256 && echo '---' && chmod +x build.sh scripts/*.py && ./build.sh",
+    dockerWorkspacePolicy
+  );
+  assert(
+    documentBuildSequencePolicy.allowed,
+    "bounded document build sequence with workspace-local chmod glob should be allowed in trusted Docker mode"
+  );
+  assert(
+    documentBuildSequencePolicy.category === "general-shell",
+    "document build sequence should remain broad trusted shell, not destructive"
+  );
+  const documentIntegrityBuildPolicy = evaluateCommandPolicy(
+    "set -e; mkdir -p output .verification; echo '== source hashes BEFORE build =='; sha256sum README.md PROJECT_NOTES.md source/budget.csv source/meeting-notes.txt source/style-notes.md | tee .verification/src-before.sha256; echo '== chmod + build =='; chmod +x build.sh scripts/*.py; ./build.sh; echo '== source hashes AFTER build (must match BEFORE) =='; sha256sum README.md PROJECT_NOTES.md source/budget.csv source/meeting-notes.txt source/style-notes.md | tee .verification/src-after.sha256; diff .verification/src-before.sha256 .verification/src-after.sha256 && echo 'SOURCE FILES UNCHANGED (byte-for-byte preserved)'",
+    dockerWorkspacePolicy
+  );
+  assert(
+    documentIntegrityBuildPolicy.allowed,
+    "document integrity build with bounded workspace tee targets should be allowed in trusted Docker mode"
+  );
+  assert(
+    documentIntegrityBuildPolicy.category === "general-shell",
+    "document integrity build should remain broad trusted shell, not destructive"
+  );
+  const externalTeePolicy = evaluateCommandPolicy("tee /etc/aginti-test", dockerWorkspacePolicy);
+  assert(!externalTeePolicy.allowed, "tee outside the workspace should remain blocked");
+  const globTeePolicy = evaluateCommandPolicy("tee reports/*.txt", dockerWorkspacePolicy);
+  assert(!globTeePolicy.allowed, "tee wildcard targets should remain blocked");
+  const hostGlobChmodPolicy = evaluateCommandPolicy("chmod +x scripts/*.py", hostWorkspacePolicy);
+  assert(!hostGlobChmodPolicy.allowed, "host workspace chmod globs should require explicit trusted host access");
+  const recursiveChmodPolicy = evaluateCommandPolicy("chmod -R +x scripts", dockerWorkspacePolicy);
+  assert(!recursiveChmodPolicy.allowed, "recursive chmod should remain outside the bounded permission-change policy");
+  const parentTraversalChmodPolicy = evaluateCommandPolicy("chmod +x scripts/../outside.py", dockerWorkspacePolicy);
+  assert(!parentTraversalChmodPolicy.allowed, "chmod parent traversal should remain blocked");
   const hostWorkspaceChmodPolicy = evaluateCommandPolicy("chmod +x android-app/gradlew && echo \"CHMOD_OK\"", hostWorkspacePolicy);
   assert(hostWorkspaceChmodPolicy.allowed, "host mode should allow workspace-local chmod without full-host destructive access");
   assert(

package/src/command-policy.js

@@ -732,7 +732,8 @@ function classifyBackgroundShell(normalized = "") {
 }
 
 const SAFE_WORKSPACE_WRITE_PATTERNS = [/^mkdir\s+-p\s+[-\w./]+$/];
-const PERMISSION_CHANGE_PATTERNS = [/^(?:sudo\s+)?chmod\s+[-+=,rwxugoXst0-7]+\s+[-\w./]+$/];
+const SAFE_CHMOD_MODE_PATTERN = /^[-+=,rwxugoXst0-7]+$/;
+const SAFE_WORKSPACE_TARGET_LIMIT = 64;
 const SAFE_ENV_ASSIGNMENT_NAMES = new Set(["ANDROID_HOME", "ANDROID_SDK_ROOT", "JAVA_HOME", "GRADLE_USER_HOME", "PATH"]);
 const SAFE_ENV_VALUE_PATTERN = /^[-\w./:@+,%]+$/;
 
@@ -983,6 +984,79 @@ function isSafeWorkspacePath(value) {
   return isSafeRelativeDir(value) || isSafeVirtualWorkspacePath(value);
 }
 
+function isSafeWorkspaceChmodTarget(value = "") {
+  const normalized = String(value || "").trim();
+  if (!normalized || normalized.startsWith("-") || normalized.startsWith("~")) return false;
+  const relative = normalized.startsWith("/workspace/")
+    ? normalized.replace(/^\/workspace\//, "")
+    : normalized;
+  if (!relative || relative.startsWith("/") || !/^[A-Za-z0-9_@%+=,:.*\/-]+$/.test(relative)) {
+    return false;
+  }
+  const parts = relative.split("/");
+  if (parts.some((part) => !part || part === "." || part === "..")) return false;
+  const globParts = parts.filter((part) => part.includes("*"));
+  if (!globParts.length) return isSafeWorkspacePath(normalized);
+  if (globParts.length !== 1 || !parts.at(-1)?.includes("*")) return false;
+  const leaf = parts.at(-1) || "";
+  return !leaf.includes("**") && /^[A-Za-z0-9_.-]*\*[A-Za-z0-9_.-]*$/.test(leaf);
+}
+
+function classifyWorkspacePermissionChange(normalized = "") {
+  if (hasActiveShellExpansion(normalized)) return null;
+  const tokens = tokenizeShellWords(normalized);
+  let index = 0;
+  if (tokens[index] === "sudo") index += 1;
+  if (tokens[index] !== "chmod") return null;
+  const mode = String(tokens[index + 1] || "");
+  const targets = tokens.slice(index + 2);
+  if (!SAFE_CHMOD_MODE_PATTERN.test(mode) || !targets.length || targets.length > SAFE_WORKSPACE_TARGET_LIMIT) {
+    return null;
+  }
+  const unsafeTarget = targets.find((target) => !isSafeWorkspaceChmodTarget(target));
+  if (unsafeTarget) {
+    return {
+      category: "blocked",
+      reason: `chmod target must be a bounded workspace-relative path: ${unsafeTarget}`,
+    };
+  }
+  return {
+    category: "permission-change",
+    needsNetwork: false,
+    writesWorkspace: true,
+    virtualWorkspacePath: targets.some((target) => target.startsWith("/workspace/")),
+    permissionTargetsContainGlob: targets.some((target) => target.includes("*")),
+    reason: `Command changes workspace file mode for ${targets.length} bounded target${targets.length === 1 ? "" : "s"}.`,
+  };
+}
+
+function classifyWorkspaceTee(normalized = "") {
+  if (hasActiveShellExpansion(normalized)) return null;
+  const tokens = tokenizeShellWords(normalized);
+  if (tokens[0] !== "tee") return null;
+  let index = 1;
+  if (["-a", "--append"].includes(tokens[index])) index += 1;
+  if (tokens[index] === "--") index += 1;
+  const targets = tokens.slice(index);
+  if (!targets.length || targets.length > SAFE_WORKSPACE_TARGET_LIMIT) return null;
+  const unsafeTarget = targets.find(
+    (target) => target.includes("*") || !isSafeWorkspaceChmodTarget(target)
+  );
+  if (unsafeTarget) {
+    return {
+      category: "blocked",
+      reason: `tee target must be a bounded literal workspace-relative path: ${unsafeTarget}`,
+    };
+  }
+  return {
+    category: "workspace-write",
+    needsNetwork: false,
+    writesWorkspace: true,
+    virtualWorkspacePath: targets.some((target) => target.startsWith("/workspace/")),
+    reason: `Command writes standard input to ${targets.length} bounded workspace target${targets.length === 1 ? "" : "s"}.`,
+  };
+}
+
 function isInsideDirectory(root, candidate) {
   const relative = path.relative(root, candidate);
   return relative === "" || (relative && !relative.startsWith("..") && !path.isAbsolute(relative));
@@ -1378,20 +1452,10 @@ function classifySimpleCommand(normalized) {
     }
     return { category: "workspace-write", needsNetwork: false, writesWorkspace: true, virtualWorkspacePath };
   }
-  if (matchAny(PERMISSION_CHANGE_PATTERNS, normalized)) {
-    const target = normalized.split(/\s+/).at(-1) || "";
-    const virtualWorkspacePath = isSafeVirtualWorkspacePath(target);
-    if (!isSafeWorkspacePath(target)) {
-      return { category: "blocked", reason: `chmod target must be a safe workspace-relative path: ${target}` };
-    }
-    return {
-      category: "permission-change",
-      needsNetwork: false,
-      writesWorkspace: true,
-      virtualWorkspacePath,
-      reason: `Command changes workspace file mode: ${normalized}`,
-    };
-  }
+  const permissionChangeClassification = classifyWorkspacePermissionChange(normalized);
+  if (permissionChangeClassification) return permissionChangeClassification;
+  const teeClassification = classifyWorkspaceTee(normalized);
+  if (teeClassification) return teeClassification;
   const gitCloneClassification = classifyGitClone(normalized);
   if (gitCloneClassification) return gitCloneClassification;
   const envExportClassification = classifySafeEnvExport(normalized);
@@ -2553,7 +2617,11 @@ export function evaluateCommandPolicy(command, config = {}) {
     };
   }
 
-  if (classification.category === "permission-change" && sandboxMode !== "host" && !trustedDockerShell && !trustedHostShell) {
+  if (
+    classification.category === "permission-change" &&
+    ((sandboxMode !== "host" && !trustedDockerShell && !trustedHostShell) ||
+      (sandboxMode === "host" && classification.permissionTargetsContainGlob && !trustedHostShell))
+  ) {
     return {
       allowed: false,
       ...classification,