@lazyingart/agintiflow 0.20.76 → 0.20.78

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.76",
+  "version": "0.20.78",
   "type": "module",
   "description": "Low-cost, project-aware Web and CLI agents with DeepSeek/Venice/OpenAI routing, visible tool calls, durable sessions, scouts, AAPS, SCS, and guarded local execution.",
   "license": "Apache-2.0",

package/scripts/smoke-coding-tools.js

@@ -263,6 +263,18 @@ try {
   assert(clonePolicy.allowed, "git clone should be allowed in docker-workspace allow mode");
   assert(clonePolicy.needsNetwork, "git clone was not classified as network");
   assert(clonePolicy.writesWorkspace, "git clone was not classified as workspace-writing");
+  const quotedDangerSearchPolicy = evaluateCommandPolicy(
+    'grep -nE "rm -rf|git reset --hard|git clean -fd|find . -delete" reports/destructive-command-policy.md',
+    dockerWorkspacePolicy
+  );
+  assert(quotedDangerSearchPolicy.allowed, "read-only grep for destructive command strings should be allowed");
+  assert(
+    quotedDangerSearchPolicy.category !== "destructive",
+    "quoted destructive strings in grep pattern should not classify as a destructive command"
+  );
+  const actualDangerAfterQuotePolicy = evaluateCommandPolicy('echo "rm -rf is text" && rm -rf reports', dockerWorkspacePolicy);
+  assert(!actualDangerAfterQuotePolicy.allowed, "actual destructive command after quoted text should still be blocked");
+  assert(actualDangerAfterQuotePolicy.category === "destructive", "actual destructive command after quoted text was not classified as destructive");
   const unsafeCloneTarget = evaluateCommandPolicy("git clone https://github.com/lazyingart/AgInTiFlow.git ../AgInTiFlow", dockerWorkspacePolicy);
   assert(!unsafeCloneTarget.allowed, "git clone outside the workspace should be blocked");
   const blockedClonePolicy = evaluateCommandPolicy("git clone https://github.com/lazyingart/AgInTiFlow.git", {
@@ -293,6 +305,10 @@ try {
     destructiveAdvice.destructiveApprovalCommand,
   ].join("\n");
   assert(/dry-run|inspect-only/i.test(destructiveAdviceText), "destructive advice did not lead with dry-run or inspect-only alternatives");
+  assert(
+    /Do not include executable delete\/reset\/clean commands/.test(destructiveAdviceText),
+    "destructive advice did not prohibit destructive commands inside safe cleanup instructions"
+  );
   assert(
     !destructiveAdvice.suggestedCommand.includes("--allow-destructive"),
     "default destructive advice suggested command should not enable destructive mode"

package/src/behavior-contract.js

@@ -70,6 +70,7 @@ export function formatBehaviorContractForPrompt({ mode = "runtime" } = {}) {
     "Define or infer concrete success criteria for non-trivial work, then run focused checks or state why checks are unavailable.",
     "Respect the permission contract: if a tool is blocked or returns permissionAdvice, stop and present the exact suggestedCommand/approval path instead of retrying variants or inventing CLI flags.",
     "When destructive cleanup is blocked, lead with inspect-only or dry-run evidence (`git status`, `git clean -nd`, targeted file lists). Do not call delete/reset/clean commands safe unless they are clearly labeled as requiring explicit user approval.",
+    "Reports after destructive blocks must not place executable destructive commands (`rm -rf`, `git reset --hard`, `git clean -fd`, `find ... -delete`, broad `git checkout -- .`) inside safe or non-destructive cleanup sections. Omit exact destructive commands or put them only in a separate explicit-approval section.",
     "Protect secrets aggressively: never repeat token/key/password/secret values from prompts, files, tool output, plans, final answers, reports, diffs, or artifacts. Redact the value as [REDACTED] and use dedicated key storage such as `aginti keys set` when credentials are needed.",
     "Keep artifacts durable and discoverable with descriptive non-conflicting names; never overwrite unless the user clearly asked.",
     "When reporting shell, language, runtime, build, or test results, name the actual environment used (host vs Docker, relevant interpreter/tool path/version when it matters). Do not claim compatibility across untested runtimes, hosts, containers, or language versions; state the caveat or run an explicit check.",

package/src/command-policy.js

@@ -11,6 +11,7 @@ const READ_ONLY_PATTERNS = [
   /^ls(?:\s+[-\w./~*]+)*$/,
   /^find(?:\s+[./~\w-]+)*(?:\s+-maxdepth\s+\d+)?(?:\s+-type\s+[fd])?$/,
   /^rg(?:\s+.+)?$/,
+  /^grep(?:\s+.+)?$/,
   /^cat(?:\s+[-\w./~*]+)+$/,
   /^head(?:\s+.+)?$/,
   /^tail(?:\s+.+)?$/,
@@ -151,6 +152,36 @@ function matchAny(patterns, command) {
   return patterns.some((pattern) => pattern.test(command));
 }
 
+function stripQuotedSegments(command = "") {
+  let output = "";
+  let quote = "";
+  let escaped = false;
+  for (const char of String(command || "")) {
+    if (escaped) {
+      escaped = false;
+      if (!quote) output += " ";
+      continue;
+    }
+    if (char === "\\") {
+      escaped = true;
+      if (!quote) output += char;
+      continue;
+    }
+    if (quote) {
+      if (char === quote) quote = "";
+      output += " ";
+      continue;
+    }
+    if (char === "'" || char === '"') {
+      quote = char;
+      output += " ";
+      continue;
+    }
+    output += char;
+  }
+  return output;
+}
+
 function isSafeRelativeDir(value) {
   const normalized = String(value || "").trim();
   if (!normalized || normalized.startsWith("/") || normalized.startsWith("~")) return false;
@@ -231,7 +262,8 @@ function classifySimpleCommand(normalized) {
   const gitCloneClassification = classifyGitClone(normalized);
   if (gitCloneClassification) return gitCloneClassification;
 
-  const lowered = ` ${normalized.toLowerCase()} `;
+  const unquoted = stripQuotedSegments(normalized);
+  const lowered = ` ${unquoted.toLowerCase()} `;
   if (BLOCKED_WRITE_TOKENS.some((part) => lowered.includes(part))) {
     return {
       category: "destructive",
@@ -240,7 +272,7 @@ function classifySimpleCommand(normalized) {
       reason: `Command contains a write-capable or destructive token: ${normalized}`,
     };
   }
-  if (BLOCKED_SHELL_TOKENS.some((part) => normalized.includes(part))) {
+  if (BLOCKED_SHELL_TOKENS.some((part) => unquoted.includes(part))) {
     return {
       category: "general-shell",
       needsNetwork: true,

package/src/permission-advice.js

@@ -142,14 +142,14 @@ function adviceForCategory(category = "", { toolName = "", args = {}, config = {
         "This command is destructive and was blocked. Do not retry variants. First offer inspect-only or dry-run cleanup evidence; destructive cleanup requires explicit user approval.",
       options: [
         "Inspect only: run non-destructive checks such as `git status --short`, `git clean -nd`, `find <path> -maxdepth ... -print`, or targeted file listings.",
-        "Safer cleanup plan: write a report listing exact files that would be removed, then ask the user before deletion.",
-        "Explicit destructive approval: only rerun with --allow-destructive after the user accepts the data-loss risk.",
+        "Safer cleanup plan: write a report listing exact files that would be removed. Do not include executable delete/reset/clean commands in the safe or non-destructive section.",
+        "Explicit destructive approval: only after the user accepts data-loss risk, provide a separate approval path such as a rerun command with --allow-destructive.",
       ],
       suggestedCommand: resumeCommand({
         config,
         state,
         sandboxMode: "docker-workspace",
-        prompt: "Continue with inspect-only or dry-run cleanup evidence. Do not delete, reset, clean, or overwrite anything unless the user explicitly approves destructive actions.",
+        prompt: "Continue with inspect-only or dry-run cleanup evidence. Do not delete, reset, clean, overwrite, or include executable destructive cleanup commands in safe/non-destructive instructions unless the user explicitly approves destructive actions.",
       }),
       destructiveApprovalCommand: resumeCommand({
         config,