@lazyingart/agintiflow 0.20.75 → 0.20.77

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.75",
+  "version": "0.20.77",
   "type": "module",
   "description": "Low-cost, project-aware Web and CLI agents with DeepSeek/Venice/OpenAI routing, visible tool calls, durable sessions, scouts, AAPS, SCS, and guarded local execution.",
   "license": "Apache-2.0",

package/scripts/smoke-coding-tools.js

@@ -279,6 +279,32 @@ try {
   });
   assert(permissionAdvice.suggestedCommand.includes("coding-policy-smoke"), "permission advice did not include resume session id");
   assert(permissionAdvice.suggestedCommand.includes("--sandbox-mode docker-workspace"), "permission advice did not suggest docker-workspace recovery");
+  const destructiveAdvice = buildPermissionAdvice({
+    toolName: "run_command",
+    args: { command: "rm -rf reports && git reset --hard" },
+    guard: { category: "destructive", reason: "Destructive shell commands require Allow destructive actions." },
+    config: dockerWorkspacePolicy,
+    state: { sessionId: "coding-destructive-smoke" },
+  });
+  const destructiveAdviceText = [
+    destructiveAdvice.summary,
+    ...(destructiveAdvice.options || []),
+    destructiveAdvice.suggestedCommand,
+    destructiveAdvice.destructiveApprovalCommand,
+  ].join("\n");
+  assert(/dry-run|inspect-only/i.test(destructiveAdviceText), "destructive advice did not lead with dry-run or inspect-only alternatives");
+  assert(
+    /Do not include executable delete\/reset\/clean commands/.test(destructiveAdviceText),
+    "destructive advice did not prohibit destructive commands inside safe cleanup instructions"
+  );
+  assert(
+    !destructiveAdvice.suggestedCommand.includes("--allow-destructive"),
+    "default destructive advice suggested command should not enable destructive mode"
+  );
+  assert(
+    destructiveAdvice.destructiveApprovalCommand.includes("--allow-destructive"),
+    "destructive advice did not provide an explicit approval command"
+  );
   const failedNetworkAdvice = buildFailedCommandAdvice({
     args: { command: "git clone https://github.com/lazyingart/AgInTiFlow.git" },
     commandPolicy: clonePolicy,

package/src/behavior-contract.js

@@ -69,6 +69,8 @@ export function formatBehaviorContractForPrompt({ mode = "runtime" } = {}) {
     "Make surgical edits: no drive-by refactors, unrelated formatting churn, or deletion of code you did not need to touch.",
     "Define or infer concrete success criteria for non-trivial work, then run focused checks or state why checks are unavailable.",
     "Respect the permission contract: if a tool is blocked or returns permissionAdvice, stop and present the exact suggestedCommand/approval path instead of retrying variants or inventing CLI flags.",
+    "When destructive cleanup is blocked, lead with inspect-only or dry-run evidence (`git status`, `git clean -nd`, targeted file lists). Do not call delete/reset/clean commands safe unless they are clearly labeled as requiring explicit user approval.",
+    "Reports after destructive blocks must not place executable destructive commands (`rm -rf`, `git reset --hard`, `git clean -fd`, `find ... -delete`, broad `git checkout -- .`) inside safe or non-destructive cleanup sections. Omit exact destructive commands or put them only in a separate explicit-approval section.",
     "Protect secrets aggressively: never repeat token/key/password/secret values from prompts, files, tool output, plans, final answers, reports, diffs, or artifacts. Redact the value as [REDACTED] and use dedicated key storage such as `aginti keys set` when credentials are needed.",
     "Keep artifacts durable and discoverable with descriptive non-conflicting names; never overwrite unless the user clearly asked.",
     "When reporting shell, language, runtime, build, or test results, name the actual environment used (host vs Docker, relevant interpreter/tool path/version when it matters). Do not claim compatibility across untested runtimes, hosts, containers, or language versions; state the caveat or run an explicit check.",

package/src/permission-advice.js

@@ -135,7 +135,40 @@ function adviceForCategory(category = "", { toolName = "", args = {}, config = {
     };
   }
 
-  if (category === "destructive" || category === "permission-change" || category === "general-shell") {
+  if (category === "destructive") {
+    return {
+      ...base,
+      summary:
+        "This command is destructive and was blocked. Do not retry variants. First offer inspect-only or dry-run cleanup evidence; destructive cleanup requires explicit user approval.",
+      options: [
+        "Inspect only: run non-destructive checks such as `git status --short`, `git clean -nd`, `find <path> -maxdepth ... -print`, or targeted file listings.",
+        "Safer cleanup plan: write a report listing exact files that would be removed. Do not include executable delete/reset/clean commands in the safe or non-destructive section.",
+        "Explicit destructive approval: only after the user accepts data-loss risk, provide a separate approval path such as a rerun command with --allow-destructive.",
+      ],
+      suggestedCommand: resumeCommand({
+        config,
+        state,
+        sandboxMode: "docker-workspace",
+        prompt: "Continue with inspect-only or dry-run cleanup evidence. Do not delete, reset, clean, overwrite, or include executable destructive cleanup commands in safe/non-destructive instructions unless the user explicitly approves destructive actions.",
+      }),
+      destructiveApprovalCommand: resumeCommand({
+        config,
+        state,
+        sandboxMode: "docker-workspace",
+        destructive: true,
+        prompt: "Continue after the user explicitly approved destructive project-local cleanup. Inspect first, delete only the named targets, and verify git status afterwards.",
+      }),
+      trustedHostCommand: resumeCommand({
+        config,
+        state,
+        sandboxMode: "host",
+        destructive: true,
+        prompt: "Continue after the user explicitly approved trusted host destructive execution. Inspect first, avoid unrelated files, and keep git status understandable.",
+      }),
+    };
+  }
+
+  if (category === "permission-change" || category === "general-shell") {
     return {
       ...base,
       summary: