@lazyingart/agintiflow 0.20.73 → 0.20.74

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.73",
+  "version": "0.20.74",
   "type": "module",
   "description": "Low-cost, project-aware Web and CLI agents with DeepSeek/Venice/OpenAI routing, visible tool calls, durable sessions, scouts, AAPS, SCS, and guarded local execution.",
   "license": "Apache-2.0",

package/scripts/smoke-coding-tools.js

@@ -530,6 +530,54 @@ try {
     });
   assert(envRun.events.some((event) => event.type === "tool.blocked"), ".env guardrail did not emit tool.blocked");
 
+  const secretContentResult = await executeWorkspaceTool(
+    "write_file",
+    {
+      path: "notes/secret-leak-report.md",
+      content: "Content attempted: DEMO_SECRET_TOKEN=aginti_fake_do_not_use\n",
+      mode: "create",
+    },
+    {
+      commandCwd: workspace,
+      allowFileTools: true,
+    }
+  );
+  assert(secretContentResult.blocked && secretContentResult.category === "workspace-content", "write_file secret-like content was not blocked");
+  await fs
+    .access(path.join(workspace, "notes/secret-leak-report.md"))
+    .then(() => {
+      throw new Error("secret-like report content was written despite content guardrails");
+    })
+    .catch((error) => {
+      if (error.code !== "ENOENT") throw error;
+    });
+
+  const redactedContentResult = await executeWorkspaceTool(
+    "write_file",
+    {
+      path: "notes/redacted-report.md",
+      content: "Content attempted: DEMO_SECRET_TOKEN=[REDACTED]\n",
+      mode: "create",
+    },
+    {
+      commandCwd: workspace,
+      allowFileTools: true,
+    }
+  );
+  assert(redactedContentResult.ok, "write_file should allow already-redacted secret placeholders");
+
+  const secretPatchResult = await executeWorkspaceTool(
+    "apply_patch",
+    {
+      patch: ["*** Begin Patch", "*** Add File: notes/secret-patch.md", "+DEMO_SECRET_TOKEN=aginti_fake_do_not_use", "*** End Patch"].join("\n"),
+    },
+    {
+      commandCwd: workspace,
+      allowFileTools: true,
+    }
+  );
+  assert(secretPatchResult.blocked && secretPatchResult.category === "workspace-content", "apply_patch secret-like additions were not blocked");
+
   const outsideRun = await runMock("Create file: ../outside-workspace.txt with blocked content.", "coding-block-outside");
   await fs
     .access(path.join(tempRoot, "outside-workspace.txt"))
@@ -576,6 +624,9 @@ try {
           "patch_guardrail",
           "patch_move_no_overwrite",
           "block_env",
+          "block_secret_write_content",
+          "allow_redacted_write_content",
+          "block_secret_patch_content",
           "block_outside",
         ],
       },

package/src/behavior-contract.js

@@ -69,6 +69,7 @@ export function formatBehaviorContractForPrompt({ mode = "runtime" } = {}) {
     "Make surgical edits: no drive-by refactors, unrelated formatting churn, or deletion of code you did not need to touch.",
     "Define or infer concrete success criteria for non-trivial work, then run focused checks or state why checks are unavailable.",
     "Respect the permission contract: if a tool is blocked or returns permissionAdvice, stop and present the exact suggestedCommand/approval path instead of retrying variants or inventing CLI flags.",
+    "Protect secrets aggressively: never repeat token/key/password/secret values from prompts, files, tool output, plans, final answers, reports, diffs, or artifacts. Redact the value as [REDACTED] and use dedicated key storage such as `aginti keys set` when credentials are needed.",
     "Keep artifacts durable and discoverable with descriptive non-conflicting names; never overwrite unless the user clearly asked.",
     "When reporting shell, language, runtime, build, or test results, name the actual environment used (host vs Docker, relevant interpreter/tool path/version when it matters). Do not claim compatibility across untested runtimes, hosts, containers, or language versions; state the caveat or run an explicit check.",
     "Do not self-invoke AgInTiFlow with npx/npm exec or nested aginti commands from inside the agent shell; it can resolve stale project packages or create recursive sessions. Use current runtime evidence, project/session files, or ask for a host-side diagnostic instead.",

package/src/redaction.js

@@ -19,6 +19,11 @@ export function redactSensitiveText(value) {
   return text;
 }
 
+export function hasSensitiveText(value) {
+  const text = String(value ?? "");
+  return redactSensitiveText(text) !== text;
+}
+
 export function redactValue(value) {
   if (typeof value === "string") return redactSensitiveText(value);
   if (Array.isArray(value)) return value.map((item) => redactValue(item));

package/src/workspace-tools.js

@@ -1,7 +1,7 @@
 import crypto from "node:crypto";
 import fs from "node:fs/promises";
 import path from "node:path";
-import { redactSensitiveText } from "./redaction.js";
+import { hasSensitiveText, redactSensitiveText } from "./redaction.js";
 
 export const WORKSPACE_TOOL_NAMES = ["inspect_project", "list_files", "read_file", "search_files", "write_file", "apply_patch"];
 export const WORKSPACE_WRITE_TOOL_NAMES = ["write_file", "apply_patch"];
@@ -188,6 +188,37 @@ function pathPolicy(toolName, relativePath) {
   return { allowed: true };
 }
 
+function secretContentPolicy(content) {
+  if (!hasSensitiveText(content)) return { allowed: true };
+  return {
+    allowed: false,
+    reason:
+      "Write content appears to contain token-like secret text. Redact secret values as [REDACTED] or use dedicated key storage such as `aginti keys set`; do not write credentials into workspace files.",
+    category: "workspace-content",
+  };
+}
+
+function writeContentPolicy(toolName, args, operations = null) {
+  if (toolName === "write_file") return secretContentPolicy(args.content || "");
+  if (toolName !== "apply_patch") return { allowed: true };
+
+  if (typeof args.patch === "string" && args.patch.trim()) {
+    for (const operation of operations || []) {
+      if (operation.type === "add") {
+        const policy = secretContentPolicy(operation.content || "");
+        if (!policy.allowed) return policy;
+      }
+      for (const hunk of operation.hunks || []) {
+        const policy = secretContentPolicy(hunk.replace || "");
+        if (!policy.allowed) return policy;
+      }
+    }
+    return { allowed: true };
+  }
+
+  return secretContentPolicy(args.replace ?? "");
+}
+
 export function checkWorkspaceToolUse(toolName, args, config) {
   if (!WORKSPACE_TOOL_NAMES.includes(toolName)) return { allowed: true };
   if (!config.allowFileTools) {
@@ -196,17 +227,26 @@ export function checkWorkspaceToolUse(toolName, args, config) {
 
   try {
     if (toolName === "apply_patch" && typeof args.patch === "string" && args.patch.trim()) {
-      for (const operation of parsePatchDocument(args.patch)) {
+      const operations = parsePatchDocument(args.patch);
+      for (const operation of operations) {
         for (const candidate of [operation.path, operation.newPath].filter(Boolean)) {
           const target = resolveWorkspacePath(config, candidate);
           const policy = pathPolicy(toolName, target.relativePath);
           if (!policy.allowed) return policy;
         }
       }
+      const contentPolicy = writeContentPolicy(toolName, args, operations);
+      if (!contentPolicy.allowed) return contentPolicy;
       return { allowed: true };
     }
     const target = resolveWorkspacePath(config, args.path || ".");
-    return pathPolicy(toolName, target.relativePath);
+    const policy = pathPolicy(toolName, target.relativePath);
+    if (!policy.allowed) return policy;
+    if (WORKSPACE_WRITE_TOOL_NAMES.includes(toolName)) {
+      const contentPolicy = writeContentPolicy(toolName, args);
+      if (!contentPolicy.allowed) return contentPolicy;
+    }
+    return { allowed: true };
   } catch (error) {
     return {
       allowed: false,
@@ -591,6 +631,8 @@ async function writeChange(target, nextContent, action, details = {}) {
   if (Buffer.byteLength(content, "utf8") > MAX_WRITE_BYTES) {
     throw new Error(`Write is too large for safe workspace tools: ${target.relativePath}`);
   }
+  const contentPolicy = secretContentPolicy(content);
+  if (!contentPolicy.allowed) throw new Error(contentPolicy.reason);
 
   await fs.mkdir(path.dirname(target.absolutePath), { recursive: true });
   let beforeText = "";