@lazyingart/agintiflow 0.20.66 → 0.20.68

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.66",
+  "version": "0.20.68",
   "type": "module",
   "description": "Low-cost, project-aware Web and CLI agents with DeepSeek/Venice/OpenAI routing, visible tool calls, durable sessions, scouts, AAPS, SCS, and guarded local execution.",
   "license": "Apache-2.0",

package/scripts/smoke-aaps-adapter.js

@@ -24,6 +24,7 @@ async function exists(file) {
 const init = await runAapsAction("init", ["Smoke AAPS Project"], { cwd: tempRoot, packageDir: repoRoot });
 assert(init.ok, "AAPS init failed");
 assert(await exists(path.join(tempRoot, "aaps.project.json")), "AAPS init did not write manifest");
+assert(await exists(path.join(tempRoot, "agents", "agent_registry.json")), "AAPS init did not write starter agent registry");
 assert(await exists(path.join(tempRoot, "workflows", "main.aaps")), "AAPS init did not write starter workflow");
 
 const files = await runAapsAction("files", [], { cwd: tempRoot, packageDir: repoRoot });
@@ -43,10 +44,7 @@ if (discovery.found) {
 
   const compile = await runAapsAction("compile", ["check"], { cwd: tempRoot, packageDir: repoRoot });
   assert(compile.json?.phase?.parse === "ok", `AAPS compile check did not return a structured parse-ok report\n${formatAapsResult(compile)}`);
-  assert(
-    compile.json?.status === "missing_components" || compile.json?.ok === true,
-    `AAPS compile check returned an unexpected status\n${formatAapsResult(compile)}`
-  );
+  assert(compile.ok && compile.json?.ok === true, `AAPS starter should compile cleanly after init\n${formatAapsResult(compile)}`);
 } else {
   const validate = await runAapsAction("validate", [], { cwd: tempRoot, packageDir: repoRoot });
   assert(validate.ok === false && validate.error, "AAPS missing path should return a structured error");

package/scripts/smoke-coding-tools.js

@@ -246,6 +246,20 @@ try {
     failedNetworkAdvice.instruction.includes("Stop and present this blocker"),
     "network failure advice did not tell the model to stop and ask"
   );
+  const failedOutsidePathAdvice = buildFailedCommandAdvice({
+    args: { command: 'echo "outside permission test" > /home/lachlan/ProjectsLFS/outside.txt' },
+    commandPolicy: evaluateCommandPolicy('echo "outside permission test" > /home/lachlan/ProjectsLFS/outside.txt', dockerWorkspacePolicy),
+    commandResult: {
+      ok: false,
+      stdout: "EXIT: 1",
+      stderr: "bash: line 1: /home/lachlan/ProjectsLFS/outside.txt: No such file or directory",
+    },
+    config: dockerWorkspacePolicy,
+    state: { sessionId: "coding-outside-path-smoke" },
+  });
+  assert(failedOutsidePathAdvice?.failureKind === "workspace-path", "outside host path failure advice was not generated");
+  assert(failedOutsidePathAdvice.suggestedCommand.includes("--sandbox-mode host"), "outside path advice did not suggest host mode");
+  assert(!failedOutsidePathAdvice.suggestedCommand.includes("aginti run --sandbox host"), "outside path advice used legacy sandbox syntax");
   assert(
     shouldRunParallelScouts(
       {

package/src/aaps-adapter.js

@@ -478,13 +478,21 @@ async function createAapsStarterProject({ cwd = process.cwd(), name = "" } = {})
   const projectDir = path.resolve(cwd || process.cwd());
   const projectName = String(name || path.basename(projectDir) || "AgInTiFlow AAPS Project").trim();
   const workflowDir = path.join(projectDir, "workflows");
+  const agentsDir = path.join(projectDir, "agents");
   const reportsDir = path.join(projectDir, "reports");
   const runsDir = path.join(projectDir, "runs");
   const artifactsDir = path.join(projectDir, "artifacts");
-  await Promise.all([fs.mkdir(workflowDir, { recursive: true }), fs.mkdir(reportsDir, { recursive: true }), fs.mkdir(runsDir, { recursive: true }), fs.mkdir(artifactsDir, { recursive: true })]);
+  await Promise.all([
+    fs.mkdir(workflowDir, { recursive: true }),
+    fs.mkdir(agentsDir, { recursive: true }),
+    fs.mkdir(reportsDir, { recursive: true }),
+    fs.mkdir(runsDir, { recursive: true }),
+    fs.mkdir(artifactsDir, { recursive: true }),
+  ]);
 
   const manifestPath = path.join(projectDir, "aaps.project.json");
   const workflowPath = path.join(workflowDir, "main.aaps");
+  const agentRegistryPath = path.join(agentsDir, "agent_registry.json");
   const created = [];
   if (!fsSync.existsSync(manifestPath)) {
     const now = new Date().toISOString();
@@ -501,6 +509,7 @@ async function createAapsStarterProject({ cwd = process.cwd(), name = "" } = {})
       updated: now,
       paths: {
         workflows: "workflows",
+        agents: "agents",
         blocks: "blocks",
         skills: "skills",
         modules: "modules",
@@ -515,6 +524,7 @@ async function createAapsStarterProject({ cwd = process.cwd(), name = "" } = {})
       runDatabase: "runs/aaps-runs.jsonl",
       tools: ["node", "python3", "git", "aginti"],
       models: ["deepseek-v4-flash", "deepseek-v4-pro"],
+      agents: ["planner"],
       files: {
         workflows: ["workflows/main.aaps"],
         blocks: [],
@@ -530,6 +540,22 @@ async function createAapsStarterProject({ cwd = process.cwd(), name = "" } = {})
     await fs.writeFile(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`, "utf8");
     created.push("aaps.project.json");
   }
+  if (!fsSync.existsSync(agentRegistryPath)) {
+    const registry = {
+      agents: [
+        {
+          name: "planner",
+          purpose: "Plan large project work in small, verifiable phases for the starter AAPS workflow.",
+          invocation: "prompt",
+          supportedTasks: ["planning", "workflow_planning", "compile_prompt"],
+          safety: ["project-local edits only", "ask before risky shell commands", "no secrets in logs"],
+          fallback: "prepare prompt-only handoff",
+        },
+      ],
+    };
+    await fs.writeFile(agentRegistryPath, `${JSON.stringify(registry, null, 2)}\n`, "utf8");
+    created.push("agents/agent_registry.json");
+  }
   if (!fsSync.existsSync(workflowPath)) {
     const source = `pipeline "${projectName} Starter" {
   subtitle "A project-local AAPS workflow for AgInTiFlow"

package/src/agent-runner.js

@@ -361,7 +361,7 @@ async function createInitialState(config, sessionId) {
               ? `A shell command tool is available inside Docker sandbox mode ${config.sandboxMode}. Docker workspace mode with approved package installs supports broader setup and network commands. The project is mounted at /workspace and the persistent agent toolchain is mounted at /aginti-env with caches under /aginti-cache.`
               : `A host shell command tool is available under the configured trust policy on ${platformLabel(platform)}. On native Windows, prefer PowerShell/cmd-compatible commands or switch to WSL/Docker for bash-like toolchains.`
             : "No shell command tool is available.",
-          "Permission contract: current-workspace file writes are allowed through workspace file tools when enabled. Outside-workspace paths, host sudo, host OS package installs, destructive git/shell actions, and blocked network/setup must not be bypassed by retrying variants. If a tool result includes permissionAdvice or suggestedCommand, stop, explain the blocker, and ask the user to approve/rerun that mode or choose a safer workspace-relative path.",
+          "Permission contract: current-workspace file writes are allowed through workspace file tools when enabled. Outside-workspace paths, host sudo, host OS package installs, destructive git/shell actions, and blocked network/setup must not be bypassed by retrying variants. If a tool result includes permissionAdvice or suggestedCommand, stop, explain the blocker, copy the exact suggestedCommand when giving a rerun path, and ask the user to approve/rerun that mode or choose a safer workspace-relative path. Never invent legacy AgInTi syntax such as `aginti run --sandbox host`; use the exact flags from permissionAdvice.",
           "If an operation fails but a directory, artifact, or file already exists, treat it as pre-existing unless you have evidence this run created or updated it. Verify expected outputs before claiming success.",
           config.allowShellTool
             ? "Host tmux tools are available for long-running terminals: list sessions, capture panes, send safe keys/text, and start detached sessions. Prefer these tools for monitoring long installs/tests/dev servers without blocking; capture before sending input and never send secrets or sudo passwords. Do not start or install tmux inside Docker run_command containers because those containers are short-lived."

package/src/behavior-contract.js

@@ -68,7 +68,7 @@ export function formatBehaviorContractForPrompt({ mode = "runtime" } = {}) {
     "Prefer the smallest coherent change that satisfies the request; do not add speculative features or abstractions.",
     "Make surgical edits: no drive-by refactors, unrelated formatting churn, or deletion of code you did not need to touch.",
     "Define or infer concrete success criteria for non-trivial work, then run focused checks or state why checks are unavailable.",
-    "Respect the permission contract: if a tool is blocked, stop and present the safe rerun/approval path instead of retrying variants.",
+    "Respect the permission contract: if a tool is blocked or returns permissionAdvice, stop and present the exact suggestedCommand/approval path instead of retrying variants or inventing CLI flags.",
     "Keep artifacts durable and discoverable with descriptive non-conflicting names; never overwrite unless the user clearly asked.",
     "When reporting shell, language, runtime, build, or test results, name the actual environment used (host vs Docker, relevant interpreter/tool path/version when it matters). Do not claim compatibility across untested runtimes, hosts, containers, or language versions; state the caveat or run an explicit check.",
   ].join(" ");

package/src/permission-advice.js

@@ -10,6 +10,13 @@ const NETWORK_FAILURE_PATTERNS = [
   /unable to access ['"].*?:/i,
 ];
 
+const DOCKER_WORKSPACE_PATH_FAILURE_PATTERNS = [
+  /\/home\/[^:\n]+:\s+No such file or directory/i,
+  /\/Users\/[^:\n]+:\s+No such file or directory/i,
+  /[A-Z]:\\[^:\n]+:\s+No such file or directory/i,
+  /cannot statx? ['"][^'"]+['"]:\s+No such file or directory/i,
+];
+
 function quoteShell(value = "") {
   const text = String(value || "");
   return `'${text.replace(/'/g, `'\\''`)}'`;
@@ -183,7 +190,26 @@ export function looksLikeNetworkFailure(result = {}) {
   return NETWORK_FAILURE_PATTERNS.some((pattern) => pattern.test(text));
 }
 
+export function looksLikeDockerWorkspacePathFailure(result = {}, config = {}) {
+  if ((config.sandboxMode || "") !== "docker-workspace") return false;
+  const text = `${result.stdout || ""}\n${result.stderr || ""}`;
+  return DOCKER_WORKSPACE_PATH_FAILURE_PATTERNS.some((pattern) => pattern.test(text));
+}
+
 export function buildFailedCommandAdvice({ args = {}, commandPolicy = {}, commandResult = {}, config = {}, state = {} } = {}) {
+  if (looksLikeDockerWorkspacePathFailure(commandResult, config)) {
+    return {
+      ...adviceForCategory("workspace-path", {
+        toolName: "run_command",
+        args,
+        config,
+        state,
+        reason:
+          "The command referenced a host absolute path that is not mounted inside the Docker workspace. Do not retry shell variants; keep output in the workspace or ask for explicit host-mode approval.",
+      }),
+      failureKind: "workspace-path",
+    };
+  }
   if (!looksLikeNetworkFailure(commandResult)) return null;
   return {
     ...adviceForCategory(commandPolicy.needsNetwork ? "network-fetch" : "general-shell", {