@lazyingart/agintiflow 0.20.234 → 0.20.235

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.234",
+  "version": "0.20.235",
   "type": "module",
   "description": "AgInTiFlow is a project-aware agent workspace for hybrid wet-dry R&D, hardware-aware intelligence, software automation, and industrial workflows.",
   "license": "Apache-2.0",

package/scripts/smoke-coding-tools.js

@@ -1074,6 +1074,22 @@ try {
     documentBuildSequencePolicy.category === "general-shell",
     "document build sequence should remain broad trusted shell, not destructive"
   );
+  const documentIntegrityBuildPolicy = evaluateCommandPolicy(
+    "set -e; mkdir -p output .verification; echo '== source hashes BEFORE build =='; sha256sum README.md PROJECT_NOTES.md source/budget.csv source/meeting-notes.txt source/style-notes.md | tee .verification/src-before.sha256; echo '== chmod + build =='; chmod +x build.sh scripts/*.py; ./build.sh; echo '== source hashes AFTER build (must match BEFORE) =='; sha256sum README.md PROJECT_NOTES.md source/budget.csv source/meeting-notes.txt source/style-notes.md | tee .verification/src-after.sha256; diff .verification/src-before.sha256 .verification/src-after.sha256 && echo 'SOURCE FILES UNCHANGED (byte-for-byte preserved)'",
+    dockerWorkspacePolicy
+  );
+  assert(
+    documentIntegrityBuildPolicy.allowed,
+    "document integrity build with bounded workspace tee targets should be allowed in trusted Docker mode"
+  );
+  assert(
+    documentIntegrityBuildPolicy.category === "general-shell",
+    "document integrity build should remain broad trusted shell, not destructive"
+  );
+  const externalTeePolicy = evaluateCommandPolicy("tee /etc/aginti-test", dockerWorkspacePolicy);
+  assert(!externalTeePolicy.allowed, "tee outside the workspace should remain blocked");
+  const globTeePolicy = evaluateCommandPolicy("tee reports/*.txt", dockerWorkspacePolicy);
+  assert(!globTeePolicy.allowed, "tee wildcard targets should remain blocked");
   const hostGlobChmodPolicy = evaluateCommandPolicy("chmod +x scripts/*.py", hostWorkspacePolicy);
   assert(!hostGlobChmodPolicy.allowed, "host workspace chmod globs should require explicit trusted host access");
   const recursiveChmodPolicy = evaluateCommandPolicy("chmod -R +x scripts", dockerWorkspacePolicy);

package/src/command-policy.js

@@ -733,7 +733,7 @@ function classifyBackgroundShell(normalized = "") {
 
 const SAFE_WORKSPACE_WRITE_PATTERNS = [/^mkdir\s+-p\s+[-\w./]+$/];
 const SAFE_CHMOD_MODE_PATTERN = /^[-+=,rwxugoXst0-7]+$/;
-const SAFE_CHMOD_TARGET_LIMIT = 64;
+const SAFE_WORKSPACE_TARGET_LIMIT = 64;
 const SAFE_ENV_ASSIGNMENT_NAMES = new Set(["ANDROID_HOME", "ANDROID_SDK_ROOT", "JAVA_HOME", "GRADLE_USER_HOME", "PATH"]);
 const SAFE_ENV_VALUE_PATTERN = /^[-\w./:@+,%]+$/;
 
@@ -1010,7 +1010,7 @@ function classifyWorkspacePermissionChange(normalized = "") {
   if (tokens[index] !== "chmod") return null;
   const mode = String(tokens[index + 1] || "");
   const targets = tokens.slice(index + 2);
-  if (!SAFE_CHMOD_MODE_PATTERN.test(mode) || !targets.length || targets.length > SAFE_CHMOD_TARGET_LIMIT) {
+  if (!SAFE_CHMOD_MODE_PATTERN.test(mode) || !targets.length || targets.length > SAFE_WORKSPACE_TARGET_LIMIT) {
     return null;
   }
   const unsafeTarget = targets.find((target) => !isSafeWorkspaceChmodTarget(target));
@@ -1030,6 +1030,33 @@ function classifyWorkspacePermissionChange(normalized = "") {
   };
 }
 
+function classifyWorkspaceTee(normalized = "") {
+  if (hasActiveShellExpansion(normalized)) return null;
+  const tokens = tokenizeShellWords(normalized);
+  if (tokens[0] !== "tee") return null;
+  let index = 1;
+  if (["-a", "--append"].includes(tokens[index])) index += 1;
+  if (tokens[index] === "--") index += 1;
+  const targets = tokens.slice(index);
+  if (!targets.length || targets.length > SAFE_WORKSPACE_TARGET_LIMIT) return null;
+  const unsafeTarget = targets.find(
+    (target) => target.includes("*") || !isSafeWorkspaceChmodTarget(target)
+  );
+  if (unsafeTarget) {
+    return {
+      category: "blocked",
+      reason: `tee target must be a bounded literal workspace-relative path: ${unsafeTarget}`,
+    };
+  }
+  return {
+    category: "workspace-write",
+    needsNetwork: false,
+    writesWorkspace: true,
+    virtualWorkspacePath: targets.some((target) => target.startsWith("/workspace/")),
+    reason: `Command writes standard input to ${targets.length} bounded workspace target${targets.length === 1 ? "" : "s"}.`,
+  };
+}
+
 function isInsideDirectory(root, candidate) {
   const relative = path.relative(root, candidate);
   return relative === "" || (relative && !relative.startsWith("..") && !path.isAbsolute(relative));
@@ -1427,6 +1454,8 @@ function classifySimpleCommand(normalized) {
   }
   const permissionChangeClassification = classifyWorkspacePermissionChange(normalized);
   if (permissionChangeClassification) return permissionChangeClassification;
+  const teeClassification = classifyWorkspaceTee(normalized);
+  if (teeClassification) return teeClassification;
   const gitCloneClassification = classifyGitClone(normalized);
   if (gitCloneClassification) return gitCloneClassification;
   const envExportClassification = classifySafeEnvExport(normalized);