@lazyingart/agintiflow 0.20.68 → 0.20.69

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.68",
+  "version": "0.20.69",
   "type": "module",
   "description": "Low-cost, project-aware Web and CLI agents with DeepSeek/Venice/OpenAI routing, visible tool calls, durable sessions, scouts, AAPS, SCS, and guarded local execution.",
   "license": "Apache-2.0",

package/scripts/smoke-cli-chat.js

@@ -149,9 +149,10 @@ try {
   const behaviorContract = formatBehaviorContractForPrompt();
   if (
     !behaviorContract.includes("name the actual environment used") ||
-    !behaviorContract.includes("Do not claim compatibility across untested runtimes")
+    !behaviorContract.includes("Do not claim compatibility across untested runtimes") ||
+    !behaviorContract.includes("Do not self-invoke AgInTiFlow")
   ) {
-    throw new Error("behavior contract must guard against host/Docker and runtime-version overclaims");
+    throw new Error("behavior contract must guard against host/Docker, runtime-version, and recursive self-invocation overclaims");
   }
   const wrappedDockerCommand = dockerUserCommand("node --test 2>&1 | tail -30", {
     category: "general-shell",

package/scripts/smoke-tmux-tools.js

@@ -78,6 +78,22 @@ try {
   });
   assert.equal(dockerTmuxSearch.allowed, true, "Docker run_command should still allow harmless tmux text searches");
 
+  const dockerNpxAginti = checkToolUse({
+    toolName: "run_command",
+    args: { command: "npx aginti doctor --json" },
+    config: { ...config, useDockerSandbox: true, sandboxMode: "docker-workspace", packageInstallPolicy: "allow" },
+  });
+  assert.equal(dockerNpxAginti.allowed, false, "Docker run_command should block npx aginti self-invocation");
+  assert.equal(dockerNpxAginti.category, "nested-aginti", "npx aginti block should be categorized");
+
+  const dockerNestedAginti = checkToolUse({
+    toolName: "run_command",
+    args: { command: "aginti storage status" },
+    config: { ...config, useDockerSandbox: true, sandboxMode: "docker-workspace", packageInstallPolicy: "allow" },
+  });
+  assert.equal(dockerNestedAginti.allowed, false, "Docker run_command should block nested aginti CLI calls");
+  assert.equal(dockerNestedAginti.category, "nested-aginti", "nested aginti block should be categorized");
+
   console.log(
     JSON.stringify(
       {
@@ -93,6 +109,8 @@ try {
           "destructive-guardrail",
           "docker-run-command-tmux-guardrail",
           "docker-run-command-tmux-search-allowed",
+          "docker-run-command-npx-aginti-guardrail",
+          "docker-run-command-nested-aginti-guardrail",
         ],
       },
       null,

package/src/agent-runner.js

@@ -358,7 +358,7 @@ async function createInitialState(config, sessionId) {
           "Treat AGINTI.md as durable project memory and operating instructions for this project. The user can edit it manually or ask you in chat to update it; use workspace file tools for that and never store secrets there.",
           config.allowShellTool
             ? config.useDockerSandbox
-              ? `A shell command tool is available inside Docker sandbox mode ${config.sandboxMode}. Docker workspace mode with approved package installs supports broader setup and network commands. The project is mounted at /workspace and the persistent agent toolchain is mounted at /aginti-env with caches under /aginti-cache.`
+              ? `A shell command tool is available inside Docker sandbox mode ${config.sandboxMode}. Docker workspace mode with approved package installs supports broader setup and network commands. The project is mounted at /workspace and the persistent agent toolchain is mounted at /aginti-env with caches under /aginti-cache. Do not run npx aginti, npm exec aginti, or nested aginti diagnostics from this Docker shell; they may resolve stale project packages or create recursive agent sessions.`
               : `A host shell command tool is available under the configured trust policy on ${platformLabel(platform)}. On native Windows, prefer PowerShell/cmd-compatible commands or switch to WSL/Docker for bash-like toolchains.`
             : "No shell command tool is available.",
           "Permission contract: current-workspace file writes are allowed through workspace file tools when enabled. Outside-workspace paths, host sudo, host OS package installs, destructive git/shell actions, and blocked network/setup must not be bypassed by retrying variants. If a tool result includes permissionAdvice or suggestedCommand, stop, explain the blocker, copy the exact suggestedCommand when giving a rerun path, and ask the user to approve/rerun that mode or choose a safer workspace-relative path. Never invent legacy AgInTi syntax such as `aginti run --sandbox host`; use the exact flags from permissionAdvice.",

package/src/behavior-contract.js

@@ -71,6 +71,7 @@ export function formatBehaviorContractForPrompt({ mode = "runtime" } = {}) {
     "Respect the permission contract: if a tool is blocked or returns permissionAdvice, stop and present the exact suggestedCommand/approval path instead of retrying variants or inventing CLI flags.",
     "Keep artifacts durable and discoverable with descriptive non-conflicting names; never overwrite unless the user clearly asked.",
     "When reporting shell, language, runtime, build, or test results, name the actual environment used (host vs Docker, relevant interpreter/tool path/version when it matters). Do not claim compatibility across untested runtimes, hosts, containers, or language versions; state the caveat or run an explicit check.",
+    "Do not self-invoke AgInTiFlow with npx/npm exec or nested aginti commands from inside the agent shell; it can resolve stale project packages or create recursive sessions. Use current runtime evidence, project/session files, or ask for a host-side diagnostic instead.",
   ].join(" ");
 }
 

package/src/guardrails.js

@@ -49,6 +49,16 @@ function isDockerTmuxProcessCommand(command = "") {
   ].some((pattern) => pattern.test(command));
 }
 
+function isNpxAgintiCommand(command = "") {
+  return /\b(?:npx(?:\s+(?:-y|--yes))?|npm\s+exec|pnpm\s+dlx|yarn\s+dlx)\s+(?:@lazyingart\/agintiflow|aginti)\b/i.test(
+    command
+  );
+}
+
+function isAgintiCliCommand(command = "") {
+  return /(?:^|[\s;&|('"])(?:node\s+[-\w./]*aginti-cli\.js|aginti)(?:\s|$)/i.test(command);
+}
+
 function normalizeDomain(hostname) {
   return hostname.replace(/^www\./, "").toLowerCase();
 }
@@ -137,6 +147,22 @@ export function checkToolUse({ toolName, args, snapshot, config }) {
 
   if (toolName === "run_command") {
     const command = String(args.command || "").trim();
+    if (isNpxAgintiCommand(command)) {
+      return {
+        allowed: false,
+        reason:
+          "`npx aginti`/`npm exec aginti` is blocked inside agent shell tools because it can resolve a stale project-local AgInTiFlow package, install from the network, or start a nested agent session. Use the current runtime status, project/session files, or ask the user to run a host CLI diagnostic.",
+        category: "nested-aginti",
+      };
+    }
+    if (config.useDockerSandbox && isAgintiCliCommand(command)) {
+      return {
+        allowed: false,
+        reason:
+          "Nested AgInTiFlow CLI calls are blocked in Docker run_command because the container may not have the active host CLI and may resolve stale project node_modules. Use current session evidence, workspace files, or ask the user to run host-side `aginti doctor --json`/`aginti capabilities --json`.",
+        category: "nested-aginti",
+      };
+    }
     if (config.useDockerSandbox && isDockerTmuxProcessCommand(command)) {
       return {
         allowed: false,

package/src/model-client.js

@@ -508,7 +508,7 @@ export async function createPlan(client, config, state) {
           state.startUrl ? `Suggested start URL: ${state.startUrl}` : "",
           config.allowedDomains.length > 0 ? `Allowed domains: ${config.allowedDomains.join(", ")}` : "",
           config.allowShellTool
-            ? `Shell tool is enabled in ${config.commandCwd}. Host platform: ${platformLabel(platform)}. In Docker, this path is mounted as /workspace with persistent /aginti-env and /aginti-cache mounts. Use relative paths or /workspace paths, not absolute host temp paths. Sandbox mode: ${config.sandboxMode}. Package install policy: ${config.packageInstallPolicy}. For npm/pip/conda/venv setup, explain the need and wait for approval unless policy is allow. On native Windows host mode, prefer PowerShell/cmd-compatible commands or WSL/Docker for bash-like toolchains.`
+            ? `Shell tool is enabled in ${config.commandCwd}. Host platform: ${platformLabel(platform)}. In Docker, this path is mounted as /workspace with persistent /aginti-env and /aginti-cache mounts. Use relative paths or /workspace paths, not absolute host temp paths. Sandbox mode: ${config.sandboxMode}. Package install policy: ${config.packageInstallPolicy}. For npm/pip/conda/venv setup, explain the need and wait for approval unless policy is allow. Do not run npx aginti, npm exec aginti, or nested aginti diagnostics from this shell; they may resolve stale project packages or create recursive agent sessions. On native Windows host mode, prefer PowerShell/cmd-compatible commands or WSL/Docker for bash-like toolchains.`
             : "",
           config.allowShellTool
             ? "Host tmux tools are enabled for long-running sessions. Plan to use tmux_start_session for durable jobs, tmux_capture_pane to monitor, tmux_send_keys to interact after capture, and tmux_list_sessions to discover existing sessions. Do not install or run tmux inside Docker run_command containers; those containers are short-lived and cannot preserve tmux servers."
@@ -828,7 +828,7 @@ export async function requestNextStep(client, config, messages) {
         function: {
           name: "run_command",
           description:
-            "Run a terminal command in the configured working directory under the active shell policy. Secrets and npm publishing are always blocked; Docker workspace mode with approved package installs supports broader network/setup commands, while host destructive or privileged work requires explicit trust.",
+            "Run a terminal command in the configured working directory under the active shell policy. Secrets, npm publishing, npx/npm-exec AgInTiFlow self-invocation, and recursive Docker aginti calls are blocked; Docker workspace mode with approved package installs supports broader network/setup commands, while host destructive or privileged work requires explicit trust.",
           parameters: {
             type: "object",
             properties: {