@lazyingart/agintiflow 0.20.236 → 0.20.237

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.236",
+  "version": "0.20.237",
   "type": "module",
   "description": "AgInTiFlow is a project-aware agent workspace for hybrid wet-dry R&D, hardware-aware intelligence, software automation, and industrial workflows.",
   "license": "Apache-2.0",

package/scripts/smoke-tmux-tools.js

@@ -261,6 +261,24 @@ try {
   assert.equal(dockerNestedAginti.allowed, false, "Docker run_command should block nested aginti CLI calls");
   assert.equal(dockerNestedAginti.category, "nested-aginti", "nested aginti block should be categorized");
 
+  const dockerShellNestedAginti = checkToolUse({
+    toolName: "run_command",
+    args: { command: "bash -lc 'aginti doctor --json'" },
+    config: dockerConfig,
+  });
+  assert.equal(dockerShellNestedAginti.allowed, false, "Docker shell -c should not bypass the nested aginti guard");
+  assert.equal(dockerShellNestedAginti.category, "nested-aginti", "shell-nested aginti block should be categorized");
+
+  const dockerAgintiLiteral = checkToolUse({
+    toolName: "run_command",
+    args: {
+      command:
+        "/aginti-env/python/bin/python3 -c \"import docx; print('aginti has all')\"; cat /aginti-env/python/pyvenv.cfg",
+    },
+    config: dockerConfig,
+  });
+  assert.equal(dockerAgintiLiteral.allowed, true, "AgInTi text and /aginti-env paths must not be treated as nested CLI calls");
+
   console.log(
     JSON.stringify(
       {
@@ -291,6 +309,8 @@ try {
           "docker-run-command-tmux-search-allowed",
           "docker-run-command-npx-aginti-guardrail",
           "docker-run-command-nested-aginti-guardrail",
+          "docker-run-command-shell-nested-aginti-guardrail",
+          "docker-run-command-aginti-literal-and-env-path",
         ],
       },
       null,

package/src/guardrails.js

@@ -7,6 +7,7 @@ import { checkMcpToolUse, isMcpBridgeTool } from "./mcp/policy.js";
 import { AGENTLINK_TOOL_NAMES, checkAgentLinkToolUse } from "./agentlink.js";
 import { normalizeProviderId } from "./provider-contract.js";
 import { resolveAuxiliaryImageEndpoint } from "./auxiliary-tools.js";
+import { splitTopLevelShellCommands, tokenizeShellWords } from "./shell-syntax.js";
 
 const DESTRUCTIVE_KEYWORDS = [
   "delete",
@@ -80,7 +81,49 @@ function isNpxAgintiCommand(command = "") {
 }
 
 function isAgintiCliCommand(command = "") {
-  return /(?:^|[\s;&|('"])(?:node\s+[-\w./]*aginti-cli\.js|aginti)(?:\s|$)/i.test(command);
+  const executableIndex = (tokens = []) => {
+    let index = 0;
+    const assignment = /^[A-Za-z_][A-Za-z0-9_]*=/;
+    while (assignment.test(tokens[index] || "")) index += 1;
+
+    if (pathBase(tokens[index]) === "env") {
+      index += 1;
+      while (/^-/.test(tokens[index] || "") || assignment.test(tokens[index] || "")) index += 1;
+    }
+    while (["command", "exec", "nohup", "sudo"].includes(pathBase(tokens[index]))) {
+      index += 1;
+      while (/^-/.test(tokens[index] || "")) index += 1;
+    }
+    return index;
+  };
+
+  const inspect = (source = "", depth = 0) => {
+    if (depth > 2) return false;
+    for (const segment of splitTopLevelShellCommands(source)) {
+      const tokens = tokenizeShellWords(segment);
+      if (!tokens.length) continue;
+      const index = executableIndex(tokens);
+      const executable = pathBase(tokens[index]);
+      if (/^aginti(?:\.exe)?$/i.test(executable)) return true;
+      if (/^node(?:\.exe)?$/i.test(executable)) {
+        const script = tokens.slice(index + 1).find((token) => !token.startsWith("-"));
+        if (/^aginti-cli\.js$/i.test(pathBase(script))) return true;
+      }
+      if (/^(?:ba|z)?sh$/i.test(executable)) {
+        const commandOption = tokens.findIndex(
+          (token, tokenIndex) => tokenIndex > index && /^-[^-]*c[^-]*$/.test(token)
+        );
+        if (commandOption >= 0 && inspect(tokens[commandOption + 1] || "", depth + 1)) return true;
+      }
+    }
+    return false;
+  };
+
+  return inspect(command);
+}
+
+function pathBase(value = "") {
+  return String(value || "").replace(/\\/g, "/").split("/").at(-1)?.toLowerCase() || "";
 }
 
 function normalizeDomain(hostname) {