@lazyingart/agintiflow 0.20.78 → 0.20.80

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.78",
+  "version": "0.20.80",
   "type": "module",
   "description": "Low-cost, project-aware Web and CLI agents with DeepSeek/Venice/OpenAI routing, visible tool calls, durable sessions, scouts, AAPS, SCS, and guarded local execution.",
   "license": "Apache-2.0",

package/scripts/smoke-coding-tools.js

@@ -3,7 +3,8 @@ import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { repairModelMessageHistory, runAgent, shouldShortCircuitToolBatch, skippedAfterBlockedToolResult } from "../src/agent-runner.js";
+import { repairModelMessageHistory, runAgent, sanitizeToolResult, shouldShortCircuitToolBatch, skippedAfterBlockedToolResult } from "../src/agent-runner.js";
+import { formatBehaviorContractForPrompt } from "../src/behavior-contract.js";
 import { resolveRuntimeConfig } from "../src/config.js";
 import { readCodebaseMap } from "../src/codebase-map.js";
 import { evaluateCommandPolicy } from "../src/command-policy.js";
@@ -249,6 +250,15 @@ try {
     guidance.includes("find . -type d -name __pycache__"),
     "engineering guidance did not include recursive Python transient checks"
   );
+  const behaviorContract = formatBehaviorContractForPrompt();
+  assert(
+    behaviorContract.includes("For tmux one-shot jobs"),
+    "behavior contract did not include tmux one-shot evidence guidance"
+  );
+  assert(
+    behaviorContract.includes("do not claim stdout, stderr, or exit status"),
+    "behavior contract did not forbid inferring tmux output after capture failure"
+  );
   const dockerWorkspacePolicy = {
     allowShellTool: true,
     useDockerSandbox: true,
@@ -275,6 +285,17 @@ try {
   const actualDangerAfterQuotePolicy = evaluateCommandPolicy('echo "rm -rf is text" && rm -rf reports', dockerWorkspacePolicy);
   assert(!actualDangerAfterQuotePolicy.allowed, "actual destructive command after quoted text should still be blocked");
   assert(actualDangerAfterQuotePolicy.category === "destructive", "actual destructive command after quoted text was not classified as destructive");
+  const safeChmodAndRunPolicy = evaluateCommandPolicy(
+    'chmod +x /workspace/reports/run_bounded_02079_v2.sh && bash /workspace/reports/run_bounded_02079.sh 2>&1; echo "RUN_COMMAND_EXIT: $?"',
+    dockerWorkspacePolicy
+  );
+  assert(safeChmodAndRunPolicy.allowed, "safe workspace chmod + script run sequence should be allowed in docker-workspace allow mode");
+  const unsafeChmodPolicy = evaluateCommandPolicy("chmod +x /etc/passwd", dockerWorkspacePolicy);
+  assert(!unsafeChmodPolicy.allowed, "chmod outside the workspace should be blocked");
+  const cdWorkspacePolicy = evaluateCommandPolicy("cd /workspace && git status --short 2>&1 | head -20", dockerWorkspacePolicy);
+  assert(cdWorkspacePolicy.allowed, "cd /workspace should be allowed in docker-workspace mode");
+  const gitCleanDryRunPolicy = evaluateCommandPolicy("git clean -nd reports", dockerWorkspacePolicy);
+  assert(gitCleanDryRunPolicy.allowed, "git clean dry-run should be allowed as read-only inspection evidence");
   const unsafeCloneTarget = evaluateCommandPolicy("git clone https://github.com/lazyingart/AgInTiFlow.git ../AgInTiFlow", dockerWorkspacePolicy);
   assert(!unsafeCloneTarget.allowed, "git clone outside the workspace should be blocked");
   const blockedClonePolicy = evaluateCommandPolicy("git clone https://github.com/lazyingart/AgInTiFlow.git", {
@@ -391,6 +412,44 @@ try {
   );
   await fs.writeFile(path.join(workspace, "src/index.js"), "export function answer() { return 42; }\n", "utf8");
   await fs.writeFile(path.join(workspace, "test/index.test.js"), "import test from 'node:test';\n", "utf8");
+  const longSmallFile = [
+    "# Small file read smoke",
+    "line 001",
+    "line 002",
+    "line 003",
+    "line 004",
+    "line 005",
+    "line 006",
+    "line 007",
+    "line 008",
+    "line 009",
+    "line 010",
+    "line 011",
+    "line 012",
+    "line 013",
+    "line 014",
+    "line 015",
+    "line 016",
+    "line 017",
+    "line 018",
+    "line 019",
+    "line 020",
+    "FINAL_SENTINEL_SMALL_FILE_FULL_CONTENT",
+    "",
+  ].join("\n");
+  await fs.writeFile(path.join(workspace, "small-read-smoke.md"), longSmallFile, "utf8");
+  const smallReadResult = await executeWorkspaceTool(
+    "read_file",
+    { path: "small-read-smoke.md" },
+    {
+      commandCwd: workspace,
+      allowFileTools: true,
+    }
+  );
+  const sanitizedSmallRead = sanitizeToolResult(smallReadResult);
+  assert(sanitizedSmallRead.content === longSmallFile, "small read_file result did not keep full content for the model");
+  assert(sanitizedSmallRead.contentTruncated === false, "small read_file result should not be marked truncated");
+  assert(!("contentPreview" in sanitizedSmallRead), "small read_file result should not replace full content with preview");
   const inspected = await executeWorkspaceTool(
     "inspect_project",
     { path: ".", maxDepth: 4, limit: 200 },
@@ -667,12 +726,16 @@ try {
           "auto_system_pro_route",
           "auto_engineering_guidance",
           "command_policy_git_clone_network",
+          "command_policy_safe_chmod_sequence",
+          "command_policy_cd_workspace",
+          "command_policy_git_clean_dry_run",
           "permission_recovery_advice",
           "parallel_scout_trigger",
           "parallel_scout_roster",
           "parallel_scout_count_clamp",
           "web_search_dry_run",
           "inspect_project",
+          "small_read_file_full_content",
           "parallel_scout_context_pack",
           "durable_codebase_map",
           "scout_blackboard",

package/skills/tmux-session/SKILL.md

@@ -30,5 +30,6 @@ Workflow:
 3. Use `tmux_start_session` for new durable host jobs rooted in the workspace.
 4. Use `tmux_send_keys` sparingly and never send secrets, sudo passwords, destructive commands, or unreviewed pasted scripts.
 5. For long commands, capture progress periodically and summarize the latest useful lines instead of flooding the chat.
+6. For one-shot tmux jobs, redirect stdout, stderr, and exit status to a durable workspace log or keep the shell open long enough for `tmux_capture_pane`. If capture fails because the session already ended, do not infer output or exit status; say the tmux output is unavailable and rely only on separately verified evidence.
 
 If host tmux is unavailable, report that limitation and suggest installing tmux on the host or using a future persistent service-container mode. If a package or sudo install is missing, report the exact command and whether it should run in Docker, host, or a user-owned tmux session.

package/src/agent-runner.js

@@ -428,8 +428,9 @@ async function createInitialState(config, sessionId) {
           "Permission contract: current-workspace file writes are allowed through workspace file tools when enabled. Outside-workspace paths, host sudo, host OS package installs, destructive git/shell actions, and blocked network/setup must not be bypassed by retrying variants. If a tool result includes permissionAdvice or suggestedCommand, stop, explain the blocker, copy the exact suggestedCommand when giving a rerun path, and ask the user to approve/rerun that mode or choose a safer workspace-relative path. Never invent legacy AgInTi syntax such as `aginti run --sandbox host`; use the exact flags from permissionAdvice.",
           "If an operation fails but a directory, artifact, or file already exists, treat it as pre-existing unless you have evidence this run created or updated it. Verify expected outputs before claiming success.",
           config.allowShellTool
-            ? "Host tmux tools are available for long-running terminals: list sessions, capture panes, send safe keys/text, and start detached sessions. Prefer these tools for monitoring long installs/tests/dev servers without blocking; capture before sending input and never send secrets or sudo passwords. Do not start or install tmux inside Docker run_command containers because those containers are short-lived."
-            : "",
+        ? "Host tmux tools are available for long-running terminals: list sessions, capture panes, send safe keys/text, and start detached sessions. Prefer these tools for monitoring long installs/tests/dev servers without blocking; capture before sending input and never send secrets or sudo passwords. Do not start or install tmux inside Docker run_command containers because those containers are short-lived."
+        + " For one-shot tmux commands, redirect stdout/stderr and exit status to a durable workspace log or keep the pane alive for capture; if capture fails because the session ended, do not infer output or exit status."
+        : "",
           config.allowFileTools
             ? `Workspace file tools are available in ${config.commandCwd}: inspect_project, list_files, read_file, search_files, write_file, apply_patch, open_workspace_file, and preview_workspace. For large or unfamiliar repositories, call inspect_project first, then search/read AGINTI.md/AGENTS.md/README/manifests as relevant before editing. apply_patch supports exact single-file replacements plus Codex-style/unified multi-file patches; prefer it for source edits after reading/searching the relevant context. Always use workspace-relative paths such as plot_fx.svg or docs/report.tex, never absolute host paths. For newly generated standalone prose/docs/stories/assets, choose a descriptive non-conflicting filename from the topic/language and use mode=create; do not overwrite existing files unless the user explicitly asked to update/replace/overwrite that file. Secret paths, .git internals, node_modules writes, and huge files are blocked. For generated local websites/pages, use open_workspace_file or preview_workspace instead of starting a localhost server inside Docker.`
             : "No workspace file tools are available.",
@@ -779,12 +780,21 @@ async function implicitOverwriteBlock(toolName, args, config, state) {
   };
 }
 
-function sanitizeToolResult(result) {
+const TOOL_RESULT_INLINE_CONTENT_BYTES = 16_000;
+const TOOL_RESULT_CONTENT_PREVIEW_CHARS = 1_200;
+
+export function sanitizeToolResult(result) {
   const safeResult = redactValue(result);
   if (typeof safeResult.content === "string") {
-    safeResult.contentPreview = safeResult.content.slice(0, 600);
-    safeResult.contentBytes = Buffer.byteLength(safeResult.content, "utf8");
-    delete safeResult.content;
+    const contentBytes = Buffer.byteLength(safeResult.content, "utf8");
+    safeResult.contentBytes = contentBytes;
+    if (safeResult.toolName === "read_file" && contentBytes <= TOOL_RESULT_INLINE_CONTENT_BYTES) {
+      safeResult.contentTruncated = false;
+    } else {
+      safeResult.contentPreview = safeResult.content.slice(0, TOOL_RESULT_CONTENT_PREVIEW_CHARS);
+      safeResult.contentTruncated = true;
+      delete safeResult.content;
+    }
   }
   return safeResult;
 }
@@ -884,7 +894,7 @@ async function captureSyntheticSnapshot(store, step, config) {
           : `Shell tool available in: ${config.commandCwd} on ${platformLabel(platform)}. Use OS-compatible commands; prefer WSL/Docker for bash-heavy workflows on Windows.`
         : "Shell tool disabled.",
       config.allowShellTool
-        ? "Host tmux tools available: tmux_list_sessions, tmux_capture_pane, tmux_send_keys, tmux_start_session. Use them for long-running jobs and agent terminals; capture before sending input. Docker run_command containers are ephemeral, so tmux there will not persist."
+        ? "Host tmux tools available: tmux_list_sessions, tmux_capture_pane, tmux_send_keys, tmux_start_session. Use them for long-running jobs and agent terminals; capture before sending input. Docker run_command containers are ephemeral, so tmux there will not persist. For one-shot tmux commands, redirect output and exit status to a durable workspace log or keep the pane alive for capture; if capture fails because the session ended, do not infer output or exit status."
         : "",
       config.allowFileTools
         ? `Workspace file tools available in: ${config.commandCwd}. Use inspect_project first for large or unfamiliar codebases, then search/read exact files before editing. Use workspace-relative paths. Use apply_patch for code edits; it supports exact single-file replacement and multi-file Codex-style/unified patches. For new standalone generated content, pick a descriptive non-conflicting filename and avoid overwriting unless explicitly requested.`

package/src/behavior-contract.js

@@ -75,6 +75,7 @@ export function formatBehaviorContractForPrompt({ mode = "runtime" } = {}) {
     "Keep artifacts durable and discoverable with descriptive non-conflicting names; never overwrite unless the user clearly asked.",
     "When reporting shell, language, runtime, build, or test results, name the actual environment used (host vs Docker, relevant interpreter/tool path/version when it matters). Do not claim compatibility across untested runtimes, hosts, containers, or language versions; state the caveat or run an explicit check.",
     "Do not self-invoke AgInTiFlow with npx/npm exec or nested aginti commands from inside the agent shell; it can resolve stale project packages or create recursive sessions. Use current runtime evidence, project/session files, or ask for a host-side diagnostic instead.",
+    "For tmux one-shot jobs, do not claim stdout, stderr, or exit status after the session disappears unless that output was captured or redirected to a durable workspace log. Prefer commands that write `...; echo EXIT:$? > logs/...` or keep the pane open long enough for `tmux_capture_pane`; if capture fails, report tmux evidence unavailable and rely only on separately verified evidence.",
   ].join(" ");
 }
 

package/src/command-policy.js

@@ -190,10 +190,34 @@ function isSafeRelativeDir(value) {
 
 function isSafeVirtualWorkspaceDir(value) {
   const normalized = String(value || "").trim();
+  if (normalized === "/workspace") return true;
   if (!normalized.startsWith("/workspace/")) return false;
   return isSafeRelativeDir(normalized.replace(/^\/workspace\//, ""));
 }
 
+function isSafeVirtualWorkspacePath(value) {
+  const normalized = String(value || "").trim();
+  return normalized.startsWith("/workspace/") && isSafeRelativeDir(normalized.replace(/^\/workspace\//, ""));
+}
+
+function isSafeWorkspacePath(value) {
+  return isSafeRelativeDir(value) || isSafeVirtualWorkspacePath(value);
+}
+
+function classifyGitCleanDryRun(normalized) {
+  const match = normalized.match(/^git\s+clean\b([\s\S]*)$/);
+  if (!match) return null;
+  const args = match[1] || "";
+  if (!/(^|\s)(?:-n\b|--dry-run\b|-[A-Za-z]*n[A-Za-z]*\b)/.test(args)) return null;
+  if (/(^|\s)(?:-f\b|--force\b|-[A-Za-z]*f[A-Za-z]*\b)/.test(args)) return null;
+  return {
+    category: "read-only",
+    needsNetwork: false,
+    writesWorkspace: false,
+    reason: "Git clean dry-run is read-only inspection evidence.",
+  };
+}
+
 function classifyGitClone(normalized) {
   const match = normalized.match(
     /^git\s+clone(?:\s+--depth\s+\d+)?(?:\s+--branch\s+[-\w./]+)?\s+(https:\/\/\S+)(?:\s+([-\w./]+))?$/
@@ -224,6 +248,8 @@ function classifySimpleCommand(normalized) {
   if (SENSITIVE_COMMAND_PATTERNS.some((pattern) => pattern.test(normalized))) {
     return { category: "blocked", reason: "Command is blocked because it references secrets or credential files." };
   }
+  const gitCleanDryRun = classifyGitCleanDryRun(normalized);
+  if (gitCleanDryRun) return gitCleanDryRun;
   if (matchAny(UNSAFE_GIT_PATTERNS, normalized)) {
     return {
       category: "destructive",
@@ -242,10 +268,16 @@ function classifySimpleCommand(normalized) {
     return { category: "workspace-write", needsNetwork: false, writesWorkspace: true, virtualWorkspacePath };
   }
   if (matchAny(PERMISSION_CHANGE_PATTERNS, normalized)) {
+    const target = normalized.split(/\s+/).at(-1) || "";
+    const virtualWorkspacePath = isSafeVirtualWorkspacePath(target);
+    if (!isSafeWorkspacePath(target)) {
+      return { category: "blocked", reason: `chmod target must be a safe workspace-relative path: ${target}` };
+    }
     return {
       category: "permission-change",
       needsNetwork: false,
       writesWorkspace: true,
+      virtualWorkspacePath,
       reason: `Command changes workspace file mode: ${normalized}`,
     };
   }
@@ -311,6 +343,68 @@ function classifySimpleCommand(normalized) {
   };
 }
 
+function splitTopLevelShellSequence(command = "") {
+  const parts = [];
+  let current = "";
+  let quote = "";
+  let escaped = false;
+  let hadSeparator = false;
+  const text = String(command || "");
+  for (let index = 0; index < text.length; index += 1) {
+    const char = text[index];
+    if (escaped) {
+      current += char;
+      escaped = false;
+      continue;
+    }
+    if (char === "\\") {
+      current += char;
+      escaped = true;
+      continue;
+    }
+    if (quote) {
+      current += char;
+      if (char === quote) quote = "";
+      continue;
+    }
+    if (char === "'" || char === '"') {
+      current += char;
+      quote = char;
+      continue;
+    }
+    if (char === ";" || (char === "&" && text[index + 1] === "&")) {
+      const part = current.trim();
+      if (!part) return null;
+      parts.push(part);
+      current = "";
+      hadSeparator = true;
+      if (char === "&") index += 1;
+      continue;
+    }
+    current += char;
+  }
+  const finalPart = current.trim();
+  if (finalPart) parts.push(finalPart);
+  if (!hadSeparator || parts.length < 2) return null;
+  return parts;
+}
+
+function classifyShellSequence(normalized) {
+  const parts = splitTopLevelShellSequence(normalized);
+  if (!parts) return null;
+  const classifications = parts.map((part) => classifyCdCommand(part) || classifySimpleCommand(part));
+  const blocked = classifications.find((classification) => classification.category === "blocked" || classification.category === "destructive");
+  if (blocked) return blocked;
+  return {
+    category: "general-shell",
+    needsNetwork: classifications.some((classification) => classification.needsNetwork),
+    writesWorkspace: classifications.some((classification) => classification.writesWorkspace),
+    requiresDockerRoot: classifications.some((classification) => classification.requiresDockerRoot),
+    virtualWorkspacePath: classifications.some((classification) => classification.virtualWorkspacePath),
+    reason: `Command sequence uses shell separators with individually classified safe segments: ${normalized}`,
+  };
+}
+
 function classifyCdCommand(normalized) {
   const match = normalized.match(/^cd\s+([-\w./]+)\s+&&\s+(.+)$/);
   if (!match) return null;
@@ -328,7 +422,7 @@ export function classifyCommand(command) {
   const normalized = String(command || "").trim();
   if (!normalized) return { category: "blocked", reason: "Command is empty." };
 
-  return classifyCdCommand(normalized) || classifySimpleCommand(normalized);
+  return classifyCdCommand(normalized) || classifyShellSequence(normalized) || classifySimpleCommand(normalized);
 }
 
 export function evaluateCommandPolicy(command, config) {

package/src/model-client.js

@@ -769,7 +769,7 @@ export async function requestNextStep(client, config, messages) {
         function: {
           name: "tmux_capture_pane",
           description:
-            "Capture recent text from a durable host tmux pane by target such as session:0.0. Use this to monitor progress or inspect a long-running job without interrupting it.",
+            "Capture recent text from a durable host tmux pane by target such as session:0.0. Use this to monitor progress or inspect a long-running job without interrupting it. If capture fails because the session ended, do not infer stdout/stderr/exit status; use a durable workspace log or rerun with output redirected to a file.",
           parameters: {
             type: "object",
             properties: {
@@ -812,7 +812,7 @@ export async function requestNextStep(client, config, messages) {
         function: {
           name: "tmux_start_session",
           description:
-            "Start a detached durable host tmux session rooted inside the workspace, optionally with a startup command. Use for long-running local jobs that should be monitored with tmux_capture_pane instead of blocking the agent. This is the correct tmux path in Docker mode because run_command containers are ephemeral.",
+            "Start a detached durable host tmux session rooted inside the workspace, optionally with a startup command. Use for long-running local jobs that should be monitored with tmux_capture_pane instead of blocking the agent. For one-shot commands, redirect output and exit status to a durable workspace log or keep the shell open so capture can verify; do not claim results from an auto-terminated session. This is the correct tmux path in Docker mode because run_command containers are ephemeral.",
           parameters: {
             type: "object",
             properties: {
@@ -887,7 +887,7 @@ export async function requestNextStep(client, config, messages) {
         function: {
           name: "read_file",
           description:
-            "Read a small UTF-8 workspace file. Secret paths, .git internals, files outside the workspace, binary files, and huge files are blocked.",
+            "Read a small UTF-8 workspace file. Small files return full content; larger files return a truncated preview with contentTruncated=true, so do not quote or reproduce omitted content unless you read it another way. Secret paths, .git internals, files outside the workspace, binary files, and huge files are blocked.",
           parameters: {
             type: "object",
             properties: {