@lazyingart/agintiflow 0.20.77 → 0.20.78

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.77",
+  "version": "0.20.78",
   "type": "module",
   "description": "Low-cost, project-aware Web and CLI agents with DeepSeek/Venice/OpenAI routing, visible tool calls, durable sessions, scouts, AAPS, SCS, and guarded local execution.",
   "license": "Apache-2.0",

package/scripts/smoke-coding-tools.js

@@ -263,6 +263,18 @@ try {
   assert(clonePolicy.allowed, "git clone should be allowed in docker-workspace allow mode");
   assert(clonePolicy.needsNetwork, "git clone was not classified as network");
   assert(clonePolicy.writesWorkspace, "git clone was not classified as workspace-writing");
+  const quotedDangerSearchPolicy = evaluateCommandPolicy(
+    'grep -nE "rm -rf|git reset --hard|git clean -fd|find . -delete" reports/destructive-command-policy.md',
+    dockerWorkspacePolicy
+  );
+  assert(quotedDangerSearchPolicy.allowed, "read-only grep for destructive command strings should be allowed");
+  assert(
+    quotedDangerSearchPolicy.category !== "destructive",
+    "quoted destructive strings in grep pattern should not classify as a destructive command"
+  );
+  const actualDangerAfterQuotePolicy = evaluateCommandPolicy('echo "rm -rf is text" && rm -rf reports', dockerWorkspacePolicy);
+  assert(!actualDangerAfterQuotePolicy.allowed, "actual destructive command after quoted text should still be blocked");
+  assert(actualDangerAfterQuotePolicy.category === "destructive", "actual destructive command after quoted text was not classified as destructive");
   const unsafeCloneTarget = evaluateCommandPolicy("git clone https://github.com/lazyingart/AgInTiFlow.git ../AgInTiFlow", dockerWorkspacePolicy);
   assert(!unsafeCloneTarget.allowed, "git clone outside the workspace should be blocked");
   const blockedClonePolicy = evaluateCommandPolicy("git clone https://github.com/lazyingart/AgInTiFlow.git", {

package/src/command-policy.js

@@ -11,6 +11,7 @@ const READ_ONLY_PATTERNS = [
   /^ls(?:\s+[-\w./~*]+)*$/,
   /^find(?:\s+[./~\w-]+)*(?:\s+-maxdepth\s+\d+)?(?:\s+-type\s+[fd])?$/,
   /^rg(?:\s+.+)?$/,
+  /^grep(?:\s+.+)?$/,
   /^cat(?:\s+[-\w./~*]+)+$/,
   /^head(?:\s+.+)?$/,
   /^tail(?:\s+.+)?$/,
@@ -151,6 +152,36 @@ function matchAny(patterns, command) {
   return patterns.some((pattern) => pattern.test(command));
 }
 
+function stripQuotedSegments(command = "") {
+  let output = "";
+  let quote = "";
+  let escaped = false;
+  for (const char of String(command || "")) {
+    if (escaped) {
+      escaped = false;
+      if (!quote) output += " ";
+      continue;
+    }
+    if (char === "\\") {
+      escaped = true;
+      if (!quote) output += char;
+      continue;
+    }
+    if (quote) {
+      if (char === quote) quote = "";
+      output += " ";
+      continue;
+    }
+    if (char === "'" || char === '"') {
+      quote = char;
+      output += " ";
+      continue;
+    }
+    output += char;
+  }
+  return output;
+}
+
 function isSafeRelativeDir(value) {
   const normalized = String(value || "").trim();
   if (!normalized || normalized.startsWith("/") || normalized.startsWith("~")) return false;
@@ -231,7 +262,8 @@ function classifySimpleCommand(normalized) {
   const gitCloneClassification = classifyGitClone(normalized);
   if (gitCloneClassification) return gitCloneClassification;
 
-  const lowered = ` ${normalized.toLowerCase()} `;
+  const unquoted = stripQuotedSegments(normalized);
+  const lowered = ` ${unquoted.toLowerCase()} `;
   if (BLOCKED_WRITE_TOKENS.some((part) => lowered.includes(part))) {
     return {
       category: "destructive",
@@ -240,7 +272,7 @@ function classifySimpleCommand(normalized) {
       reason: `Command contains a write-capable or destructive token: ${normalized}`,
     };
   }
-  if (BLOCKED_SHELL_TOKENS.some((part) => normalized.includes(part))) {
+  if (BLOCKED_SHELL_TOKENS.some((part) => unquoted.includes(part))) {
     return {
       category: "general-shell",
       needsNetwork: true,