@lazyingart/agintiflow 0.20.67 → 0.20.69

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.67",
+  "version": "0.20.69",
   "type": "module",
   "description": "Low-cost, project-aware Web and CLI agents with DeepSeek/Venice/OpenAI routing, visible tool calls, durable sessions, scouts, AAPS, SCS, and guarded local execution.",
   "license": "Apache-2.0",

package/scripts/smoke-cli-chat.js

@@ -149,9 +149,10 @@ try {
   const behaviorContract = formatBehaviorContractForPrompt();
   if (
     !behaviorContract.includes("name the actual environment used") ||
-    !behaviorContract.includes("Do not claim compatibility across untested runtimes")
+    !behaviorContract.includes("Do not claim compatibility across untested runtimes") ||
+    !behaviorContract.includes("Do not self-invoke AgInTiFlow")
   ) {
-    throw new Error("behavior contract must guard against host/Docker and runtime-version overclaims");
+    throw new Error("behavior contract must guard against host/Docker, runtime-version, and recursive self-invocation overclaims");
   }
   const wrappedDockerCommand = dockerUserCommand("node --test 2>&1 | tail -30", {
     category: "general-shell",

package/scripts/smoke-coding-tools.js

@@ -246,6 +246,20 @@ try {
     failedNetworkAdvice.instruction.includes("Stop and present this blocker"),
     "network failure advice did not tell the model to stop and ask"
   );
+  const failedOutsidePathAdvice = buildFailedCommandAdvice({
+    args: { command: 'echo "outside permission test" > /home/lachlan/ProjectsLFS/outside.txt' },
+    commandPolicy: evaluateCommandPolicy('echo "outside permission test" > /home/lachlan/ProjectsLFS/outside.txt', dockerWorkspacePolicy),
+    commandResult: {
+      ok: false,
+      stdout: "EXIT: 1",
+      stderr: "bash: line 1: /home/lachlan/ProjectsLFS/outside.txt: No such file or directory",
+    },
+    config: dockerWorkspacePolicy,
+    state: { sessionId: "coding-outside-path-smoke" },
+  });
+  assert(failedOutsidePathAdvice?.failureKind === "workspace-path", "outside host path failure advice was not generated");
+  assert(failedOutsidePathAdvice.suggestedCommand.includes("--sandbox-mode host"), "outside path advice did not suggest host mode");
+  assert(!failedOutsidePathAdvice.suggestedCommand.includes("aginti run --sandbox host"), "outside path advice used legacy sandbox syntax");
   assert(
     shouldRunParallelScouts(
       {

package/scripts/smoke-tmux-tools.js

@@ -78,6 +78,22 @@ try {
   });
   assert.equal(dockerTmuxSearch.allowed, true, "Docker run_command should still allow harmless tmux text searches");
 
+  const dockerNpxAginti = checkToolUse({
+    toolName: "run_command",
+    args: { command: "npx aginti doctor --json" },
+    config: { ...config, useDockerSandbox: true, sandboxMode: "docker-workspace", packageInstallPolicy: "allow" },
+  });
+  assert.equal(dockerNpxAginti.allowed, false, "Docker run_command should block npx aginti self-invocation");
+  assert.equal(dockerNpxAginti.category, "nested-aginti", "npx aginti block should be categorized");
+
+  const dockerNestedAginti = checkToolUse({
+    toolName: "run_command",
+    args: { command: "aginti storage status" },
+    config: { ...config, useDockerSandbox: true, sandboxMode: "docker-workspace", packageInstallPolicy: "allow" },
+  });
+  assert.equal(dockerNestedAginti.allowed, false, "Docker run_command should block nested aginti CLI calls");
+  assert.equal(dockerNestedAginti.category, "nested-aginti", "nested aginti block should be categorized");
+
   console.log(
     JSON.stringify(
       {
@@ -93,6 +109,8 @@ try {
           "destructive-guardrail",
           "docker-run-command-tmux-guardrail",
           "docker-run-command-tmux-search-allowed",
+          "docker-run-command-npx-aginti-guardrail",
+          "docker-run-command-nested-aginti-guardrail",
         ],
       },
       null,

package/src/agent-runner.js

@@ -358,10 +358,10 @@ async function createInitialState(config, sessionId) {
           "Treat AGINTI.md as durable project memory and operating instructions for this project. The user can edit it manually or ask you in chat to update it; use workspace file tools for that and never store secrets there.",
           config.allowShellTool
             ? config.useDockerSandbox
-              ? `A shell command tool is available inside Docker sandbox mode ${config.sandboxMode}. Docker workspace mode with approved package installs supports broader setup and network commands. The project is mounted at /workspace and the persistent agent toolchain is mounted at /aginti-env with caches under /aginti-cache.`
+              ? `A shell command tool is available inside Docker sandbox mode ${config.sandboxMode}. Docker workspace mode with approved package installs supports broader setup and network commands. The project is mounted at /workspace and the persistent agent toolchain is mounted at /aginti-env with caches under /aginti-cache. Do not run npx aginti, npm exec aginti, or nested aginti diagnostics from this Docker shell; they may resolve stale project packages or create recursive agent sessions.`
               : `A host shell command tool is available under the configured trust policy on ${platformLabel(platform)}. On native Windows, prefer PowerShell/cmd-compatible commands or switch to WSL/Docker for bash-like toolchains.`
             : "No shell command tool is available.",
-          "Permission contract: current-workspace file writes are allowed through workspace file tools when enabled. Outside-workspace paths, host sudo, host OS package installs, destructive git/shell actions, and blocked network/setup must not be bypassed by retrying variants. If a tool result includes permissionAdvice or suggestedCommand, stop, explain the blocker, and ask the user to approve/rerun that mode or choose a safer workspace-relative path.",
+          "Permission contract: current-workspace file writes are allowed through workspace file tools when enabled. Outside-workspace paths, host sudo, host OS package installs, destructive git/shell actions, and blocked network/setup must not be bypassed by retrying variants. If a tool result includes permissionAdvice or suggestedCommand, stop, explain the blocker, copy the exact suggestedCommand when giving a rerun path, and ask the user to approve/rerun that mode or choose a safer workspace-relative path. Never invent legacy AgInTi syntax such as `aginti run --sandbox host`; use the exact flags from permissionAdvice.",
           "If an operation fails but a directory, artifact, or file already exists, treat it as pre-existing unless you have evidence this run created or updated it. Verify expected outputs before claiming success.",
           config.allowShellTool
             ? "Host tmux tools are available for long-running terminals: list sessions, capture panes, send safe keys/text, and start detached sessions. Prefer these tools for monitoring long installs/tests/dev servers without blocking; capture before sending input and never send secrets or sudo passwords. Do not start or install tmux inside Docker run_command containers because those containers are short-lived."

package/src/behavior-contract.js

@@ -68,9 +68,10 @@ export function formatBehaviorContractForPrompt({ mode = "runtime" } = {}) {
     "Prefer the smallest coherent change that satisfies the request; do not add speculative features or abstractions.",
     "Make surgical edits: no drive-by refactors, unrelated formatting churn, or deletion of code you did not need to touch.",
     "Define or infer concrete success criteria for non-trivial work, then run focused checks or state why checks are unavailable.",
-    "Respect the permission contract: if a tool is blocked, stop and present the safe rerun/approval path instead of retrying variants.",
+    "Respect the permission contract: if a tool is blocked or returns permissionAdvice, stop and present the exact suggestedCommand/approval path instead of retrying variants or inventing CLI flags.",
     "Keep artifacts durable and discoverable with descriptive non-conflicting names; never overwrite unless the user clearly asked.",
     "When reporting shell, language, runtime, build, or test results, name the actual environment used (host vs Docker, relevant interpreter/tool path/version when it matters). Do not claim compatibility across untested runtimes, hosts, containers, or language versions; state the caveat or run an explicit check.",
+    "Do not self-invoke AgInTiFlow with npx/npm exec or nested aginti commands from inside the agent shell; it can resolve stale project packages or create recursive sessions. Use current runtime evidence, project/session files, or ask for a host-side diagnostic instead.",
   ].join(" ");
 }
 

package/src/guardrails.js

@@ -49,6 +49,16 @@ function isDockerTmuxProcessCommand(command = "") {
   ].some((pattern) => pattern.test(command));
 }
 
+function isNpxAgintiCommand(command = "") {
+  return /\b(?:npx(?:\s+(?:-y|--yes))?|npm\s+exec|pnpm\s+dlx|yarn\s+dlx)\s+(?:@lazyingart\/agintiflow|aginti)\b/i.test(
+    command
+  );
+}
+
+function isAgintiCliCommand(command = "") {
+  return /(?:^|[\s;&|('"])(?:node\s+[-\w./]*aginti-cli\.js|aginti)(?:\s|$)/i.test(command);
+}
+
 function normalizeDomain(hostname) {
   return hostname.replace(/^www\./, "").toLowerCase();
 }
@@ -137,6 +147,22 @@ export function checkToolUse({ toolName, args, snapshot, config }) {
 
   if (toolName === "run_command") {
     const command = String(args.command || "").trim();
+    if (isNpxAgintiCommand(command)) {
+      return {
+        allowed: false,
+        reason:
+          "`npx aginti`/`npm exec aginti` is blocked inside agent shell tools because it can resolve a stale project-local AgInTiFlow package, install from the network, or start a nested agent session. Use the current runtime status, project/session files, or ask the user to run a host CLI diagnostic.",
+        category: "nested-aginti",
+      };
+    }
+    if (config.useDockerSandbox && isAgintiCliCommand(command)) {
+      return {
+        allowed: false,
+        reason:
+          "Nested AgInTiFlow CLI calls are blocked in Docker run_command because the container may not have the active host CLI and may resolve stale project node_modules. Use current session evidence, workspace files, or ask the user to run host-side `aginti doctor --json`/`aginti capabilities --json`.",
+        category: "nested-aginti",
+      };
+    }
     if (config.useDockerSandbox && isDockerTmuxProcessCommand(command)) {
       return {
         allowed: false,

package/src/model-client.js

@@ -508,7 +508,7 @@ export async function createPlan(client, config, state) {
           state.startUrl ? `Suggested start URL: ${state.startUrl}` : "",
           config.allowedDomains.length > 0 ? `Allowed domains: ${config.allowedDomains.join(", ")}` : "",
           config.allowShellTool
-            ? `Shell tool is enabled in ${config.commandCwd}. Host platform: ${platformLabel(platform)}. In Docker, this path is mounted as /workspace with persistent /aginti-env and /aginti-cache mounts. Use relative paths or /workspace paths, not absolute host temp paths. Sandbox mode: ${config.sandboxMode}. Package install policy: ${config.packageInstallPolicy}. For npm/pip/conda/venv setup, explain the need and wait for approval unless policy is allow. On native Windows host mode, prefer PowerShell/cmd-compatible commands or WSL/Docker for bash-like toolchains.`
+            ? `Shell tool is enabled in ${config.commandCwd}. Host platform: ${platformLabel(platform)}. In Docker, this path is mounted as /workspace with persistent /aginti-env and /aginti-cache mounts. Use relative paths or /workspace paths, not absolute host temp paths. Sandbox mode: ${config.sandboxMode}. Package install policy: ${config.packageInstallPolicy}. For npm/pip/conda/venv setup, explain the need and wait for approval unless policy is allow. Do not run npx aginti, npm exec aginti, or nested aginti diagnostics from this shell; they may resolve stale project packages or create recursive agent sessions. On native Windows host mode, prefer PowerShell/cmd-compatible commands or WSL/Docker for bash-like toolchains.`
             : "",
           config.allowShellTool
             ? "Host tmux tools are enabled for long-running sessions. Plan to use tmux_start_session for durable jobs, tmux_capture_pane to monitor, tmux_send_keys to interact after capture, and tmux_list_sessions to discover existing sessions. Do not install or run tmux inside Docker run_command containers; those containers are short-lived and cannot preserve tmux servers."
@@ -828,7 +828,7 @@ export async function requestNextStep(client, config, messages) {
         function: {
           name: "run_command",
           description:
-            "Run a terminal command in the configured working directory under the active shell policy. Secrets and npm publishing are always blocked; Docker workspace mode with approved package installs supports broader network/setup commands, while host destructive or privileged work requires explicit trust.",
+            "Run a terminal command in the configured working directory under the active shell policy. Secrets, npm publishing, npx/npm-exec AgInTiFlow self-invocation, and recursive Docker aginti calls are blocked; Docker workspace mode with approved package installs supports broader network/setup commands, while host destructive or privileged work requires explicit trust.",
           parameters: {
             type: "object",
             properties: {

package/src/permission-advice.js

@@ -10,6 +10,13 @@ const NETWORK_FAILURE_PATTERNS = [
   /unable to access ['"].*?:/i,
 ];
 
+const DOCKER_WORKSPACE_PATH_FAILURE_PATTERNS = [
+  /\/home\/[^:\n]+:\s+No such file or directory/i,
+  /\/Users\/[^:\n]+:\s+No such file or directory/i,
+  /[A-Z]:\\[^:\n]+:\s+No such file or directory/i,
+  /cannot statx? ['"][^'"]+['"]:\s+No such file or directory/i,
+];
+
 function quoteShell(value = "") {
   const text = String(value || "");
   return `'${text.replace(/'/g, `'\\''`)}'`;
@@ -183,7 +190,26 @@ export function looksLikeNetworkFailure(result = {}) {
   return NETWORK_FAILURE_PATTERNS.some((pattern) => pattern.test(text));
 }
 
+export function looksLikeDockerWorkspacePathFailure(result = {}, config = {}) {
+  if ((config.sandboxMode || "") !== "docker-workspace") return false;
+  const text = `${result.stdout || ""}\n${result.stderr || ""}`;
+  return DOCKER_WORKSPACE_PATH_FAILURE_PATTERNS.some((pattern) => pattern.test(text));
+}
+
 export function buildFailedCommandAdvice({ args = {}, commandPolicy = {}, commandResult = {}, config = {}, state = {} } = {}) {
+  if (looksLikeDockerWorkspacePathFailure(commandResult, config)) {
+    return {
+      ...adviceForCategory("workspace-path", {
+        toolName: "run_command",
+        args,
+        config,
+        state,
+        reason:
+          "The command referenced a host absolute path that is not mounted inside the Docker workspace. Do not retry shell variants; keep output in the workspace or ask for explicit host-mode approval.",
+      }),
+      failureKind: "workspace-path",
+    };
+  }
   if (!looksLikeNetworkFailure(commandResult)) return null;
   return {
     ...adviceForCategory(commandPolicy.needsNetwork ? "network-fetch" : "general-shell", {