@lazyingart/agintiflow 0.20.44 → 0.20.46

package/README.md

@@ -146,6 +146,8 @@ aginti resume --all-sessions
 aginti resume latest
 aginti resume <session-id> "continue with a short follow-up"
 aginti queue <session-id> "extra instruction for the running agent"
+aginti chat
+# then in chat: /review [focus]
 aginti --profile code "write a small Python CLI app with tests"
 aginti --latex "draw a figure, write a short LaTeX report, and compile the PDF"
 aginti "set up this project and run the tests"
@@ -153,7 +155,9 @@ aginti "set up this project and run the tests"
 
 Bare `aginti resume` lists sessions for the current cwd by default. Use `--all-sessions` to browse the global session index; in the interactive selector, type a number to resume, `q` to quit, `/text` to filter the visible list, or `/` to clear the filter.
 
-Session cleanup is cwd-scoped by default. `aginti --remove-empty-sessions` shows only empty sessions and preselects them; `aginti --remove-sessions` shows all cwd sessions with nothing preselected. The cleanup selector uses Space to select, Up/Down to move, Tab to switch to OK/Cancel, and a second Yes/Cancel confirmation before deleting the project pointer and central `~/.agintiflow/sessions/<session-id>` data.
+Session cleanup is cwd-scoped by default. `aginti --remove-empty-sessions` shows only empty sessions and preselects them; `aginti --remove-sessions` shows all cwd sessions with nothing preselected. The cleanup selector uses Space to select or activate the focused button, Up/Down to move, Tab to switch to Delete/Cancel, and a second Delete/Cancel confirmation before deleting the project pointer and central `~/.agintiflow/sessions/<session-id>` data.
+
+In interactive chat, `/review [focus]` starts a bounded repository review. It begins from git status/diff and project instructions, reads manifests/entry points/tests/changed files first, avoids generated or binary folders, limits discovery passes, and reports findings before any summary.
 
 Run from a source checkout:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.44",
+  "version": "0.20.46",
   "type": "module",
   "description": "AgInTiFlow is a web-first coding agent and CLI with DeepSeek routing, sandboxed tools, model providers, canvas artifacts, and optional wrappers.",
   "license": "Apache-2.0",

package/scripts/smoke-cli-chat.js

@@ -11,9 +11,11 @@ import {
   buildPromptRenderSequence,
   canonicalSlashPromptBuffer,
   classifyEscapeAction,
+  formatElapsedDuration,
   formatWorkspaceChange,
   stripMarkdown,
 } from "../src/interactive-cli.js";
+import { dockerPolicyTimeoutMs, dockerUserCommand } from "../src/docker-sandbox.js";
 
 const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const tempRoot = await fs.mkdtemp(path.join(os.tmpdir(), "agintiflow-cli-chat-"));
@@ -135,6 +137,24 @@ try {
   if (!launchHeader.includes("█████") || !launchHeader.includes("v0.0.0") || launchHeader.split("\n").length < 9) {
     throw new Error("large launch header did not render a centered multi-line title");
   }
+  if (
+    formatElapsedDuration(0) !== "00:00" ||
+    formatElapsedDuration(65_000) !== "01:05" ||
+    formatElapsedDuration(3_665_000) !== "1:01:05"
+  ) {
+    throw new Error("elapsed duration formatter returned an unexpected value");
+  }
+  const wrappedDockerCommand = dockerUserCommand("node --test 2>&1 | tail -30", {
+    category: "general-shell",
+    needsNetwork: false,
+  });
+  if (
+    dockerPolicyTimeoutMs({ needsNetwork: true }) !== 120000 ||
+    !wrappedDockerCommand.includes("timeout -k 5s 15s bash -lc") ||
+    !wrappedDockerCommand.includes("'node --test 2>&1 | tail -30'")
+  ) {
+    throw new Error("docker sandbox command wrapper did not add a bounded inner timeout");
+  }
 
   const promptLayout = buildPromptLayout(`${"x".repeat(180)}\nsecond line`, 95, 80, 24);
   const promptText = promptLayout.renderedRows
@@ -260,7 +280,7 @@ try {
   }
   const helpResult = await runChat("/help\n/exit\n");
   const misspelledAuxiliary = "/auxil" + "liary";
-  if (!helpResult.stdout.includes("/auxiliary") || helpResult.stdout.includes(misspelledAuxiliary)) {
+  if (!helpResult.stdout.includes("/auxiliary") || !helpResult.stdout.includes("/review") || helpResult.stdout.includes(misspelledAuxiliary)) {
     throw new Error("interactive help did not expose only the correctly spelled /auxiliary command");
   }
   const zhHelpResult = await runCli(["chat", "--language", "zh-Hans"], "/help\n/exit\n");
@@ -271,6 +291,10 @@ try {
   if (!skillsResult.stdout.includes("website-app") || !skillsResult.stdout.includes("Website And App Builder")) {
     throw new Error("interactive /skills did not show matching built-in skills");
   }
+  const reviewResult = await runChat("/review changed files only\n/exit\n");
+  if (!reviewResult.stdout.includes("Review focus: changed files only") || !reviewResult.stdout.includes("Mock run complete")) {
+    throw new Error("interactive /review did not launch the bounded review workflow");
+  }
   const abbreviatedSkillsResult = await runChat("/sk website\n/ex\n");
   if (abbreviatedSkillsResult.stdout.includes("Unknown command") || !abbreviatedSkillsResult.stdout.includes("website-app")) {
     throw new Error("interactive slash command prefix did not auto-select the first matching command");
@@ -347,6 +371,7 @@ try {
           "instructions-command",
           "auxiliary-command-spelling",
           "skills-command",
+          "review-command",
           "slash-prefix-autoselect",
           "slash-prefix-canonical-history",
           "instructions-chat-edit",

package/skills/code-review/SKILL.md

@@ -20,5 +20,12 @@ tools:
 
 Prioritize findings over summary. Inspect changed files, neighboring code, tests, and runtime assumptions. Report concrete risks with file paths, reproduction evidence, and suggested fixes.
 
-If no findings are found, say that clearly and name residual risk or missing test coverage. Do not rewrite code during a review unless the user asks for fixes.
+Use a bounded review loop:
+
+1. Start with git status/diff and project instructions or manifests.
+2. Read high-signal files first: changed files, entry points, tests, package/build configs, and nearby code needed to prove a risk.
+3. Avoid full-tree reads and generated/vendor/cache/binary folders such as `.git`, `node_modules`, `dist`, `build`, `target`, `coverage`, `.venv`, `__pycache__`, `.aginti-sessions`, `.sessions`, and artifacts.
+4. Cap discovery at two passes unless a concrete finding needs one more neighboring file.
+5. Run focused non-destructive checks when useful; do not install dependencies or run long broad suites for a review unless clearly justified.
 
+If no findings are found, say that clearly and name residual risk or missing test coverage. Do not rewrite code during a review unless the user asks for fixes.

package/src/cli.js

@@ -607,6 +607,7 @@ const removeSessionAnsi = {
   reset: "\x1b[0m",
   bold: "\x1b[1m",
   dim: "\x1b[2m",
+  red: "\x1b[31m",
   inverse: "\x1b[7m",
 };
 
@@ -624,10 +625,13 @@ function ellipsize(text, width) {
   return `${value.slice(0, Math.max(0, width - 1))}…`;
 }
 
-function buttonLabel(label, focused, disabled = false) {
+function buttonLabel(label, focused, disabled = false, danger = false) {
   const text = ` ${label} `;
   if (disabled) return removeSessionColor(text, removeSessionAnsi.dim);
-  return focused ? removeSessionColor(text, removeSessionAnsi.inverse, removeSessionAnsi.bold) : text;
+  const codes = [];
+  if (danger) codes.push(removeSessionAnsi.red, removeSessionAnsi.bold);
+  if (focused) codes.push(removeSessionAnsi.inverse, removeSessionAnsi.bold);
+  return codes.length > 0 ? removeSessionColor(text, ...codes) : text;
 }
 
 function renderSessionRemovalWizard(state) {
@@ -658,12 +662,12 @@ function renderSessionRemovalWizard(state) {
   });
   const footer =
     state.phase === "confirm"
-      ? `Confirm deletion: ${buttonLabel("Yes, delete", state.confirmFocus === "yes")}  ${buttonLabel("Cancel", state.confirmFocus === "cancel")}`
-      : `Actions: ${buttonLabel(`OK delete ${selectedCount}`, state.focus === "ok", selectedCount === 0)}  ${buttonLabel("Cancel", state.focus === "cancel")}`;
+      ? `Confirm deletion: ${buttonLabel("Delete", state.confirmFocus === "yes", false, true)}  ${buttonLabel("Cancel", state.confirmFocus === "cancel")}`
+      : `Actions: ${buttonLabel(`Delete ${selectedCount}`, state.focus === "ok", selectedCount === 0, true)}  ${buttonLabel("Cancel", state.focus === "cancel")}`;
   const guidance =
     state.phase === "confirm"
-      ? "Left/Right switches choice. Enter confirms. Esc/q cancels."
-      : "Space toggles. Up/Down moves. Tab changes focus. Enter opens confirm. Esc/q cancels.";
+      ? "Left/Right switches choice. Enter/Space confirms. Esc/q cancels."
+      : "Space toggles or activates focused button. Up/Down moves. Tab changes focus. Esc/q cancels.";
   const lines = [
     `╭${border}╮`,
     line(state.title),
@@ -733,7 +737,7 @@ async function promptRemoveSessions(candidates, { defaultSelectedIds = [], title
       if (name === "escape" || name === "q") return cleanup(null);
       if (state.phase === "confirm") {
         if (name === "left" || name === "right" || name === "tab") state.confirmFocus = state.confirmFocus === "yes" ? "cancel" : "yes";
-        else if (name === "return" || name === "enter") return cleanup(state.confirmFocus === "yes" ? [...state.selected] : null);
+        else if (name === "return" || name === "enter" || name === "space") return cleanup(state.confirmFocus === "yes" ? [...state.selected] : null);
         renderSessionRemovalWizard(state);
         return;
       }
@@ -741,7 +745,11 @@ async function promptRemoveSessions(candidates, { defaultSelectedIds = [], title
       else if (name === "down") moveCursor(1);
       else if (name === "pageup") moveCursor(-8);
       else if (name === "pagedown") moveCursor(8);
-      else if (name === "space") toggleCurrent();
+      else if (name === "space") {
+        if (state.focus === "list") toggleCurrent();
+        else if (state.focus === "cancel") return cleanup(null);
+        else openConfirm();
+      }
       else if (name === "tab") state.focus = state.focus === "list" ? "ok" : state.focus === "ok" ? "cancel" : "list";
       else if (name === "left" || name === "right") state.focus = state.focus === "cancel" ? "ok" : "cancel";
       else if (name === "return" || name === "enter") {

package/src/docker-sandbox.js

@@ -29,6 +29,28 @@ function shellEscape(value) {
   return `'${String(value).replace(/'/g, `'\"'\"'`)}'`;
 }
 
+export function dockerPolicyTimeoutMs(policy = {}) {
+  if (policy.needsNetwork) return 120000;
+  if (policy.category === "toolchain") return 90000;
+  return 15000;
+}
+
+function dockerExecTimeoutMs(policy = {}) {
+  return dockerPolicyTimeoutMs(policy) + 5000;
+}
+
+export function dockerUserCommand(command, policy = {}) {
+  const seconds = Math.max(1, Math.ceil(dockerPolicyTimeoutMs(policy) / 1000));
+  const escapedCommand = shellEscape(String(command || ""));
+  return [
+    `if command -v timeout >/dev/null 2>&1; then`,
+    `  timeout -k 5s ${seconds}s bash -lc ${escapedCommand}`,
+    `else`,
+    `  bash -lc ${escapedCommand}`,
+    `fi`,
+  ].join("\n");
+}
+
 function buildDockerInvocation(args) {
   return ["docker", ...args].map(shellEscape).join(" ");
 }
@@ -232,7 +254,7 @@ function dockerCommand(command, policy) {
     );
   }
 
-  return [...envLines, String(command)].join("\n");
+  return [...envLines, dockerUserCommand(command, policy)].join("\n");
 }
 
 function dockerRunArgs(command, config, policy = evaluateCommandPolicy(command, config), persistentDirs = persistentDockerDirs(config)) {
@@ -289,7 +311,7 @@ function dockerRunArgs(command, config, policy = evaluateCommandPolicy(command,
 export async function runDockerSandboxCommand(command, config, policy = evaluateCommandPolicy(command, config), options = {}) {
   const persistentDirs = await ensurePersistentDockerDirs(config);
   const result = await execDocker(dockerRunArgs(command, config, policy, persistentDirs), {
-    timeout: policy.needsNetwork ? 120000 : policy.category === "toolchain" ? 90000 : 15000,
+    timeout: dockerExecTimeoutMs(policy),
     maxBuffer: 300 * 1024,
     signal: options.signal,
   });
@@ -366,7 +388,7 @@ export async function runDockerPreflight(config, options = {}) {
     ]) {
       try {
         const result = await execDocker(dockerRunArgs(command, config, { needsNetwork: false, category: "preflight" }, persistentDirs), {
-          timeout: 15000,
+          timeout: dockerExecTimeoutMs({ needsNetwork: false, category: "preflight" }),
           maxBuffer: 100 * 1024,
         });
         results.push({ command, ok: true, stdout: result.stdout.trim(), stderr: result.stderr.trim() });

package/src/interactive-cli.js

@@ -69,6 +69,7 @@ const SLASH_COMMANDS = [
   "/new",
   "/resume",
   "/sessions",
+  "/review",
   "/rename",
   "/skills",
   "/skill",
@@ -235,6 +236,15 @@ function compactLine(value = "", limit = 96) {
   return text.length <= limit ? text : `${text.slice(0, Math.max(limit - 1, 1))}…`;
 }
 
+export function formatElapsedDuration(ms = 0) {
+  const totalSeconds = Math.max(0, Math.floor((Number(ms) || 0) / 1000));
+  const seconds = totalSeconds % 60;
+  const minutes = Math.floor(totalSeconds / 60) % 60;
+  const hours = Math.floor(totalSeconds / 3600);
+  const two = (value) => String(value).padStart(2, "0");
+  return hours > 0 ? `${hours}:${two(minutes)}:${two(seconds)}` : `${two(minutes)}:${two(seconds)}`;
+}
+
 function wrapTextLine(value = "", width = 72) {
   const text = stripAnsi(String(value || ""));
   if (text.length <= width) return [text];
@@ -635,6 +645,7 @@ function printHelp() {
       `  ${command("/auxiliary [status|grsai|venice|model [provider/model]|on|off|image]", "Manage optional auxiliary skills, including image generation.", "helpAuxiliary")}`,
       `  ${command("/new", "Start a fresh session on the next message.", "helpNew")}`,
       `  ${command("/resume <session-id>", "Continue a saved session.", "helpResume")}`,
+      `  ${command("/review [focus]", "Run a bounded repo/diff review with controlled context gathering.", "helpReview")}`,
       `  ${command("/rename [title|auto]", "Rename the current session.", "helpRename")}`,
       `  ${command("/sessions", "List recent sessions in this project.", "helpSessions")}`,
       `  ${command("/skills [query]", "List Markdown skills selected for a topic.", "helpSkills")}`,
@@ -1252,6 +1263,8 @@ class LiveRunInput {
     this.pendingAsap = [];
     this.pendingQueued = [];
     this.statusLine = "";
+    this.statusStartedAt = 0;
+    this.statusTimer = null;
     this.wasRaw = Boolean(input.isRaw);
     this.started = false;
     this.handler = this.handleKey.bind(this);
@@ -1268,6 +1281,11 @@ class LiveRunInput {
     input.setRawMode(true);
     input.on("keypress", this.handler);
     activeRunInput = this;
+    this.statusStartedAt = Date.now();
+    this.statusTimer = setInterval(() => {
+      if (this.started && this.statusLine) this.renderNow();
+    }, 1000);
+    this.statusTimer.unref?.();
     this.started = true;
     this.renderNow();
     return true;
@@ -1279,6 +1297,10 @@ class LiveRunInput {
       clearImmediate(this.redrawHandle);
       this.redrawHandle = null;
     }
+    if (this.statusTimer) {
+      clearInterval(this.statusTimer);
+      this.statusTimer = null;
+    }
     input.off("keypress", this.handler);
     if (typeof input.setRawMode === "function") input.setRawMode(this.wasRaw);
     this.clearForExternalOutput();
@@ -1310,6 +1332,12 @@ class LiveRunInput {
     output.write(ansi.cursorShow);
   }
 
+  currentStatusLine() {
+    if (!this.statusLine) return "";
+    const elapsed = formatElapsedDuration(Date.now() - (this.statusStartedAt || Date.now()));
+    return compactLine(`${elapsed} · ${this.statusLine}`, Math.max(terminalWidth() - 16, 36));
+  }
+
   renderNow() {
     if (this.redrawHandle) {
       clearImmediate(this.redrawHandle);
@@ -1318,7 +1346,7 @@ class LiveRunInput {
     this.rendered = renderPromptBuffer(this.buffer, this.cursor, this.rendered, {
       commandCwd: this.commandCwd,
       language: this.state.language || cliLanguage,
-      statusLine: this.statusLine,
+      statusLine: this.currentStatusLine(),
       pendingAsap: this.pendingAsap,
       pendingQueued: this.pendingQueued,
     });
@@ -1350,7 +1378,7 @@ class LiveRunInput {
     const layout = buildPromptLayout(this.buffer, this.cursor, terminalWidth(), terminalHeight(), {
       commandCwd: this.commandCwd,
       language: this.state.language || cliLanguage,
-      statusLine: this.statusLine,
+      statusLine: this.currentStatusLine(),
       pendingAsap: this.pendingAsap,
       pendingQueued: this.pendingQueued,
     });
@@ -2454,6 +2482,29 @@ async function promptAndSaveProviderKey(provider = "", state = null) {
   applyAuthWizardResult(result, state);
 }
 
+function buildReviewPrompt(focus = "") {
+  const target = String(focus || "").trim();
+  return [
+    target ? `Review focus: ${target}` : "Review focus: current repository state, especially local changes if any.",
+    "",
+    "Run a bounded, evidence-based code review of this workspace. Default to read-only review; do not edit files unless the review focus explicitly asks for fixes.",
+    "",
+    "Review operating loop:",
+    "1. Start with `git status --short`, `git diff --stat`, and project metadata. If git is unavailable, say so and continue from manifests.",
+    "2. Read only the highest-signal context first: AGINTI.md/AGENTS.md/README, package/build manifests, entry points, tests, and files changed in git diff.",
+    "3. Use `inspect_project`, `search_files`, and targeted `read_file`; avoid full-tree dumps. Prefer precise symbol/error searches over opening many files.",
+    "4. Exclude generated, vendored, binary, cache, and large artifact paths: .git, node_modules, vendor, dist, build, out, target, coverage, .next, .turbo, .venv, __pycache__, .pytest_cache, .aginti-sessions, .sessions, artifacts, images/videos/PDFs unless directly relevant.",
+    "5. Context budget: at most two discovery passes; at most 12 primary files read initially; expand only when a concrete risk requires neighboring code.",
+    "6. Check likely validation commands from manifests, but run only focused non-destructive checks when useful. Bound shell checks with `timeout 30s ...` when available, avoid broad watch/dev commands, and do not install packages or run long broad suites unless clearly justified.",
+    "7. Stop when you have enough evidence. Do not keep scanning just because more files exist.",
+    "",
+    "Final answer format:",
+    "- Findings first, ordered by severity, with file/line references or exact evidence. Focus on bugs, regressions, security issues, data loss, broken UX/API behavior, and missing tests.",
+    "- If no findings, state that clearly and list residual risks or unrun checks.",
+    "- Then include a short `Files inspected` and `Checks run` section. Keep summary secondary and concise.",
+  ].join("\n");
+}
+
 async function handleCommand(line, state, packageDir) {
   const [rawCommand, ...rest] = line.slice(1).trim().split(/\s+/);
   const command = resolveSlashCommand(rawCommand);
@@ -2605,6 +2656,19 @@ async function handleCommand(line, state, packageDir) {
     }
     return true;
   }
+  if (command === "review") {
+    const previousProfile = state.taskProfile;
+    const previousMaxSteps = state.maxSteps;
+    try {
+      state.taskProfile = "review";
+      state.maxSteps = Math.max(state.maxSteps, 32);
+      await runPrompt(buildReviewPrompt(value), state, packageDir);
+    } finally {
+      state.taskProfile = previousProfile;
+      state.maxSteps = previousMaxSteps;
+    }
+    return true;
+  }
   if (command === "rename") {
     if (!state.sessionId) {
       printAgentMessage("No active session to rename. Start or resume a session first.");

package/src/task-profiles.js

@@ -20,6 +20,13 @@ export const TASK_PROFILES = {
       "Bias toward senior large-repo engineering while still answering ordinary side questions. Inspect_project first unless context is already known, read AGINTI/AGENTS/README/manifests, locate entry points and tests, make a small explicit change plan, patch in coherent batches, run the narrowest relevant checks first, escalate to broader checks when stable, and summarize files changed, checks, tradeoffs, and remaining risks.",
     tools: ["inspect_project", "search_files", "read_file", "apply_patch", "shell", "sandbox", "canvas"],
   },
+  review: {
+    id: "review",
+    label: "Code review",
+    prompt:
+      "Bias toward bounded code review rather than implementation. Start with git status/diff and project instructions, then inspect manifests, entry points, tests, changed files, and only the neighboring code needed to prove or disprove concrete risks. Avoid full-tree scans, generated/vendor/cache/binary folders, and infinite context gathering. Do not edit files unless explicitly asked for fixes. Findings must come first, ordered by severity with file/line evidence; if no findings are found, say so and name residual risks and checks not run.",
+    tools: ["inspect_project", "search_files", "read_file", "shell", "web_search"],
+  },
   writing: {
     id: "writing",
     label: "Book/script writing",
@@ -331,6 +338,12 @@ const PROFILE_ALIASES = {
   etl: "data",
   dataframe: "data",
   qa: "qa",
+  review: "review",
+  reviews: "review",
+  "code-review": "review",
+  "code-audit": "review",
+  codereview: "review",
+  codeaudit: "review",
   test: "qa",
   testing: "qa",
   ci: "qa",
@@ -412,6 +425,7 @@ export function getTaskProfile(value = "auto") {
 export function defaultMaxStepsForProfile(value = "auto") {
   const profile = normalizeTaskProfile(value);
   if (profile === "code") return 36;
+  if (profile === "review") return 32;
   if (profile === "large-codebase") return 36;
   if (profile === "qa") return 40;
   if (profile === "app") return 40;